VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 101505

Last change on this file since 101505 was 101450, checked in by vboxsync, 14 months ago

VMM/IEM: Nested VMX: bugref:10318 Added ifdef VBOX_WITH_NESTED_HWVIRT_VMX to the RDRAND, RDSEED VMX VM-exit intercept code.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 368.0 KB
Line 
1/* $Id: IEMAllCImpl.cpp 101450 2023-10-16 08:56:41Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#define IEM_WITH_OPAQUE_DECODER_STATE
35#include <VBox/vmm/iem.h>
36#include <VBox/vmm/cpum.h>
37#include <VBox/vmm/apic.h>
38#include <VBox/vmm/pdm.h>
39#include <VBox/vmm/pgm.h>
40#include <VBox/vmm/iom.h>
41#include <VBox/vmm/em.h>
42#include <VBox/vmm/hm.h>
43#include <VBox/vmm/nem.h>
44#include <VBox/vmm/gim.h>
45#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
46# include <VBox/vmm/em.h>
47# include <VBox/vmm/hm_svm.h>
48#endif
49#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
50# include <VBox/vmm/hmvmxinline.h>
51#endif
52#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
53# include <VBox/vmm/cpuidcall.h>
54#endif
55#include <VBox/vmm/tm.h>
56#include <VBox/vmm/dbgf.h>
57#include <VBox/vmm/dbgftrace.h>
58#include "IEMInternal.h"
59#include <VBox/vmm/vmcc.h>
60#include <VBox/log.h>
61#include <VBox/err.h>
62#include <VBox/param.h>
63#include <VBox/dis.h>
64#include <iprt/asm-math.h>
65#include <iprt/assert.h>
66#include <iprt/string.h>
67#include <iprt/x86.h>
68
69#include "IEMInline.h"
70
71
72/*********************************************************************************************************************************
73* Defined Constants And Macros *
74*********************************************************************************************************************************/
75/**
76 * Flushes the prefetch buffer, light version.
77 * @todo The \#if conditions here must match the ones in iemOpcodeFlushLight().
78 */
79#ifndef IEM_WITH_CODE_TLB
80# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) iemOpcodeFlushLight(a_pVCpu, a_cbInstr)
81#else
82# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { } while (0)
83#endif
84
85/**
86 * Flushes the prefetch buffer, heavy version.
87 * @todo The \#if conditions here must match the ones in iemOpcodeFlushHeavy().
88 */
89#if !defined(IEM_WITH_CODE_TLB) || 1
90# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) iemOpcodeFlushHeavy(a_pVCpu, a_cbInstr)
91#else
92# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { } while (0)
93#endif
94
95
96
97/** @name Misc Helpers
98 * @{
99 */
100
101
102/**
103 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
104 *
105 * @returns Strict VBox status code.
106 *
107 * @param pVCpu The cross context virtual CPU structure of the calling thread.
108 * @param u16Port The port number.
109 * @param cbOperand The operand size.
110 */
111static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
112{
113 /* The TSS bits we're interested in are the same on 386 and AMD64. */
114 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
115 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
116 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
117 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
118
119 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
120
121 /*
122 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
123 */
124 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
125 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
126 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
127 {
128 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
129 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
130 return iemRaiseGeneralProtectionFault0(pVCpu);
131 }
132
133 /*
134 * Read the bitmap offset (may #PF).
135 */
136 uint16_t offBitmap;
137 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
138 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
139 if (rcStrict != VINF_SUCCESS)
140 {
141 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
142 return rcStrict;
143 }
144
145 /*
146 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
147 * describes the CPU actually reading two bytes regardless of whether the
148 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
149 */
150 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
151 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
152 * for instance sizeof(X86TSS32). */
153 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
154 {
155 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
156 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
157 return iemRaiseGeneralProtectionFault0(pVCpu);
158 }
159
160 /*
161 * Read the necessary bits.
162 */
163 /** @todo Test the assertion in the intel manual that the CPU reads two
164 * bytes. The question is how this works wrt to \#PF and \#GP on the
165 * 2nd byte when it's not required. */
166 uint16_t bmBytes = UINT16_MAX;
167 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
168 if (rcStrict != VINF_SUCCESS)
169 {
170 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
171 return rcStrict;
172 }
173
174 /*
175 * Perform the check.
176 */
177 uint16_t fPortMask = (1 << cbOperand) - 1;
178 bmBytes >>= (u16Port & 7);
179 if (bmBytes & fPortMask)
180 {
181 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
182 u16Port, cbOperand, bmBytes, fPortMask));
183 return iemRaiseGeneralProtectionFault0(pVCpu);
184 }
185
186 return VINF_SUCCESS;
187}
188
189
190/**
191 * Checks if we are allowed to access the given I/O port, raising the
192 * appropriate exceptions if we aren't (or if the I/O bitmap is not
193 * accessible).
194 *
195 * @returns Strict VBox status code.
196 *
197 * @param pVCpu The cross context virtual CPU structure of the calling thread.
198 * @param u16Port The port number.
199 * @param cbOperand The operand size.
200 */
201DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
202{
203 X86EFLAGS Efl;
204 Efl.u = IEMMISC_GET_EFL(pVCpu);
205 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
206 && ( IEM_GET_CPL(pVCpu) > Efl.Bits.u2IOPL
207 || Efl.Bits.u1VM) )
208 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
209 return VINF_SUCCESS;
210}
211
212
213#if 0
214/**
215 * Calculates the parity bit.
216 *
217 * @returns true if the bit is set, false if not.
218 * @param u8Result The least significant byte of the result.
219 */
220static bool iemHlpCalcParityFlag(uint8_t u8Result)
221{
222 /*
223 * Parity is set if the number of bits in the least significant byte of
224 * the result is even.
225 */
226 uint8_t cBits;
227 cBits = u8Result & 1; /* 0 */
228 u8Result >>= 1;
229 cBits += u8Result & 1;
230 u8Result >>= 1;
231 cBits += u8Result & 1;
232 u8Result >>= 1;
233 cBits += u8Result & 1;
234 u8Result >>= 1;
235 cBits += u8Result & 1; /* 4 */
236 u8Result >>= 1;
237 cBits += u8Result & 1;
238 u8Result >>= 1;
239 cBits += u8Result & 1;
240 u8Result >>= 1;
241 cBits += u8Result & 1;
242 return !(cBits & 1);
243}
244#endif /* not used */
245
246
247/**
248 * Updates the specified flags according to a 8-bit result.
249 *
250 * @param pVCpu The cross context virtual CPU structure of the calling thread.
251 * @param u8Result The result to set the flags according to.
252 * @param fToUpdate The flags to update.
253 * @param fUndefined The flags that are specified as undefined.
254 */
255static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
256{
257 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
258 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
259 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
260 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
261}
262
263
264/**
265 * Updates the specified flags according to a 16-bit result.
266 *
267 * @param pVCpu The cross context virtual CPU structure of the calling thread.
268 * @param u16Result The result to set the flags according to.
269 * @param fToUpdate The flags to update.
270 * @param fUndefined The flags that are specified as undefined.
271 */
272static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
273{
274 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
275 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
276 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
277 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
278}
279
280
281/**
282 * Helper used by iret.
283 *
284 * @param pVCpu The cross context virtual CPU structure of the calling thread.
285 * @param uCpl The new CPL.
286 * @param pSReg Pointer to the segment register.
287 */
288static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
289{
290 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
291 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
292
293 if ( uCpl > pSReg->Attr.n.u2Dpl
294 && pSReg->Attr.n.u1DescType /* code or data, not system */
295 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
296 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
297 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
298}
299
300
301/**
302 * Indicates that we have modified the FPU state.
303 *
304 * @param pVCpu The cross context virtual CPU structure of the calling thread.
305 */
306DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
307{
308 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
309}
310
311/** @} */
312
313/** @name C Implementations
314 * @{
315 */
316
317
318/**
319 * Implements a pop [mem16].
320 */
321IEM_CIMPL_DEF_2(iemCImpl_pop_mem16, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
322{
323 uint16_t u16Value;
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
326 VBOXSTRICTRC rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 {
329 rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
330 if (rcStrict == VINF_SUCCESS)
331 {
332 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
333 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
334 }
335 }
336 return rcStrict;
337
338}
339
340
341/**
342 * Implements a pop [mem32].
343 */
344IEM_CIMPL_DEF_2(iemCImpl_pop_mem32, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
345{
346 uint32_t u32Value;
347 RTUINT64U TmpRsp;
348 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
349 VBOXSTRICTRC rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
350 if (rcStrict == VINF_SUCCESS)
351 {
352 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEffDst, u32Value);
353 if (rcStrict == VINF_SUCCESS)
354 {
355 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
356 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
357 }
358 }
359 return rcStrict;
360
361}
362
363
364/**
365 * Implements a pop [mem64].
366 */
367IEM_CIMPL_DEF_2(iemCImpl_pop_mem64, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
368{
369 uint64_t u64Value;
370 RTUINT64U TmpRsp;
371 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
372 VBOXSTRICTRC rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
373 if (rcStrict == VINF_SUCCESS)
374 {
375 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrEffDst, u64Value);
376 if (rcStrict == VINF_SUCCESS)
377 {
378 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
379 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
380 }
381 }
382 return rcStrict;
383
384}
385
386
387/**
388 * Implements a 16-bit popa.
389 */
390IEM_CIMPL_DEF_0(iemCImpl_popa_16)
391{
392 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
393 RTGCPTR GCPtrLast = GCPtrStart + 15;
394 VBOXSTRICTRC rcStrict;
395
396 /*
397 * The docs are a bit hard to comprehend here, but it looks like we wrap
398 * around in real mode as long as none of the individual "popa" crosses the
399 * end of the stack segment. In protected mode we check the whole access
400 * in one go. For efficiency, only do the word-by-word thing if we're in
401 * danger of wrapping around.
402 */
403 /** @todo do popa boundary / wrap-around checks. */
404 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
405 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
406 {
407 /* word-by-word */
408 RTUINT64U TmpRsp;
409 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
410 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
411 if (rcStrict == VINF_SUCCESS)
412 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
413 if (rcStrict == VINF_SUCCESS)
414 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
415 if (rcStrict == VINF_SUCCESS)
416 {
417 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
418 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
419 }
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
426 if (rcStrict == VINF_SUCCESS)
427 {
428 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
429 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
430 }
431 }
432 else
433 {
434 uint16_t const *pa16Mem = NULL;
435 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
436 if (rcStrict == VINF_SUCCESS)
437 {
438 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
439 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
440 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
441 /* skip sp */
442 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
443 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
444 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
445 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
446 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
447 if (rcStrict == VINF_SUCCESS)
448 {
449 iemRegAddToRsp(pVCpu, 16);
450 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
451 }
452 }
453 }
454 return rcStrict;
455}
456
457
458/**
459 * Implements a 32-bit popa.
460 */
461IEM_CIMPL_DEF_0(iemCImpl_popa_32)
462{
463 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
464 RTGCPTR GCPtrLast = GCPtrStart + 31;
465 VBOXSTRICTRC rcStrict;
466
467 /*
468 * The docs are a bit hard to comprehend here, but it looks like we wrap
469 * around in real mode as long as none of the individual "popa" crosses the
470 * end of the stack segment. In protected mode we check the whole access
471 * in one go. For efficiency, only do the word-by-word thing if we're in
472 * danger of wrapping around.
473 */
474 /** @todo do popa boundary / wrap-around checks. */
475 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
476 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
477 {
478 /* word-by-word */
479 RTUINT64U TmpRsp;
480 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
481 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 {
488 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
489 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
490 }
491 if (rcStrict == VINF_SUCCESS)
492 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
493 if (rcStrict == VINF_SUCCESS)
494 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
495 if (rcStrict == VINF_SUCCESS)
496 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
497 if (rcStrict == VINF_SUCCESS)
498 {
499#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
500 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
501 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
502 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
503 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
504 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
505 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
506 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
507#endif
508 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
509 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
510 }
511 }
512 else
513 {
514 uint32_t const *pa32Mem;
515 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
516 if (rcStrict == VINF_SUCCESS)
517 {
518 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
519 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
520 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
521 /* skip esp */
522 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
523 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
524 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
525 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
526 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
527 if (rcStrict == VINF_SUCCESS)
528 {
529 iemRegAddToRsp(pVCpu, 32);
530 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
531 }
532 }
533 }
534 return rcStrict;
535}
536
537
538/**
539 * Implements a 16-bit pusha.
540 */
541IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
542{
543 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
544 RTGCPTR GCPtrBottom = GCPtrTop - 15;
545 VBOXSTRICTRC rcStrict;
546
547 /*
548 * The docs are a bit hard to comprehend here, but it looks like we wrap
549 * around in real mode as long as none of the individual "pushd" crosses the
550 * end of the stack segment. In protected mode we check the whole access
551 * in one go. For efficiency, only do the word-by-word thing if we're in
552 * danger of wrapping around.
553 */
554 /** @todo do pusha boundary / wrap-around checks. */
555 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
556 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
557 {
558 /* word-by-word */
559 RTUINT64U TmpRsp;
560 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
561 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
562 if (rcStrict == VINF_SUCCESS)
563 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
564 if (rcStrict == VINF_SUCCESS)
565 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
566 if (rcStrict == VINF_SUCCESS)
567 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
568 if (rcStrict == VINF_SUCCESS)
569 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
570 if (rcStrict == VINF_SUCCESS)
571 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
572 if (rcStrict == VINF_SUCCESS)
573 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
574 if (rcStrict == VINF_SUCCESS)
575 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
576 if (rcStrict == VINF_SUCCESS)
577 {
578 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
579 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
580 }
581 }
582 else
583 {
584 GCPtrBottom--;
585 uint16_t *pa16Mem = NULL;
586 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
587 if (rcStrict == VINF_SUCCESS)
588 {
589 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
590 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
591 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
592 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
593 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
594 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
595 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
596 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
597 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
598 if (rcStrict == VINF_SUCCESS)
599 {
600 iemRegSubFromRsp(pVCpu, 16);
601 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
602 }
603 }
604 }
605 return rcStrict;
606}
607
608
609/**
610 * Implements a 32-bit pusha.
611 */
612IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
613{
614 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
615 RTGCPTR GCPtrBottom = GCPtrTop - 31;
616 VBOXSTRICTRC rcStrict;
617
618 /*
619 * The docs are a bit hard to comprehend here, but it looks like we wrap
620 * around in real mode as long as none of the individual "pusha" crosses the
621 * end of the stack segment. In protected mode we check the whole access
622 * in one go. For efficiency, only do the word-by-word thing if we're in
623 * danger of wrapping around.
624 */
625 /** @todo do pusha boundary / wrap-around checks. */
626 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
627 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
628 {
629 /* word-by-word */
630 RTUINT64U TmpRsp;
631 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
632 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
633 if (rcStrict == VINF_SUCCESS)
634 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
635 if (rcStrict == VINF_SUCCESS)
636 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
637 if (rcStrict == VINF_SUCCESS)
638 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
639 if (rcStrict == VINF_SUCCESS)
640 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
641 if (rcStrict == VINF_SUCCESS)
642 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
643 if (rcStrict == VINF_SUCCESS)
644 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
645 if (rcStrict == VINF_SUCCESS)
646 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
647 if (rcStrict == VINF_SUCCESS)
648 {
649 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
650 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
651 }
652 }
653 else
654 {
655 GCPtrBottom--;
656 uint32_t *pa32Mem;
657 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
658 if (rcStrict == VINF_SUCCESS)
659 {
660 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
661 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
662 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
663 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
664 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
665 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
666 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
667 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
668 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
669 if (rcStrict == VINF_SUCCESS)
670 {
671 iemRegSubFromRsp(pVCpu, 32);
672 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
673 }
674 }
675 }
676 return rcStrict;
677}
678
679
680/**
681 * Implements pushf.
682 *
683 *
684 * @param enmEffOpSize The effective operand size.
685 */
686IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
687{
688 VBOXSTRICTRC rcStrict;
689
690 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
691 { /* probable */ }
692 else
693 {
694 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
695 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
696 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
697 }
698
699 /*
700 * If we're in V8086 mode some care is required (which is why we're in
701 * doing this in a C implementation).
702 */
703 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
704 if ( (fEfl & X86_EFL_VM)
705 && X86_EFL_GET_IOPL(fEfl) != 3 )
706 {
707 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
708 if ( enmEffOpSize != IEMMODE_16BIT
709 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
710 return iemRaiseGeneralProtectionFault0(pVCpu);
711 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
712 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
713 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
714 }
715 else
716 {
717
718 /*
719 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
720 */
721 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
722
723 switch (enmEffOpSize)
724 {
725 case IEMMODE_16BIT:
726 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
727 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
728 fEfl |= UINT16_C(0xf000);
729 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
730 break;
731 case IEMMODE_32BIT:
732 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
733 break;
734 case IEMMODE_64BIT:
735 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
736 break;
737 IEM_NOT_REACHED_DEFAULT_CASE_RET();
738 }
739 }
740
741 if (rcStrict == VINF_SUCCESS)
742 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
743 return rcStrict;
744}
745
746
747/**
748 * Implements popf.
749 *
750 * @param enmEffOpSize The effective operand size.
751 */
752IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
753{
754 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
755 VBOXSTRICTRC rcStrict;
756 uint32_t fEflNew;
757
758 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
759 { /* probable */ }
760 else
761 {
762 Log2(("popf: Guest intercept -> #VMEXIT\n"));
763 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
764 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
765 }
766
767 /*
768 * V8086 is special as usual.
769 */
770 if (fEflOld & X86_EFL_VM)
771 {
772 /*
773 * Almost anything goes if IOPL is 3.
774 */
775 if (X86_EFL_GET_IOPL(fEflOld) == 3)
776 {
777 switch (enmEffOpSize)
778 {
779 case IEMMODE_16BIT:
780 {
781 uint16_t u16Value;
782 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
783 if (rcStrict != VINF_SUCCESS)
784 return rcStrict;
785 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
786 break;
787 }
788 case IEMMODE_32BIT:
789 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
790 if (rcStrict != VINF_SUCCESS)
791 return rcStrict;
792 break;
793 IEM_NOT_REACHED_DEFAULT_CASE_RET();
794 }
795
796 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
797 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
798 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
799 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
800 }
801 /*
802 * Interrupt flag virtualization with CR4.VME=1.
803 */
804 else if ( enmEffOpSize == IEMMODE_16BIT
805 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
806 {
807 uint16_t u16Value;
808 RTUINT64U TmpRsp;
809 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
810 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
811 if (rcStrict != VINF_SUCCESS)
812 return rcStrict;
813
814 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
815 * or before? */
816 if ( ( (u16Value & X86_EFL_IF)
817 && (fEflOld & X86_EFL_VIP))
818 || (u16Value & X86_EFL_TF) )
819 return iemRaiseGeneralProtectionFault0(pVCpu);
820
821 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
822 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
823 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
824 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
825
826 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
827 }
828 else
829 return iemRaiseGeneralProtectionFault0(pVCpu);
830
831 }
832 /*
833 * Not in V8086 mode.
834 */
835 else
836 {
837 /* Pop the flags. */
838 switch (enmEffOpSize)
839 {
840 case IEMMODE_16BIT:
841 {
842 uint16_t u16Value;
843 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
844 if (rcStrict != VINF_SUCCESS)
845 return rcStrict;
846 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
847
848 /*
849 * Ancient CPU adjustments:
850 * - 8086, 80186, V20/30:
851 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
852 * practical reasons (masking below). We add them when pushing flags.
853 * - 80286:
854 * The NT and IOPL flags cannot be popped from real mode and are
855 * therefore always zero (since a 286 can never exit from PM and
856 * their initial value is zero). This changed on a 386 and can
857 * therefore be used to detect 286 or 386 CPU in real mode.
858 */
859 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
860 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
861 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
862 break;
863 }
864 case IEMMODE_32BIT:
865 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
866 if (rcStrict != VINF_SUCCESS)
867 return rcStrict;
868 break;
869 case IEMMODE_64BIT:
870 {
871 uint64_t u64Value;
872 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
873 if (rcStrict != VINF_SUCCESS)
874 return rcStrict;
875 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
876 break;
877 }
878 IEM_NOT_REACHED_DEFAULT_CASE_RET();
879 }
880
881 /* Merge them with the current flags. */
882 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
883 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
884 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
885 || IEM_GET_CPL(pVCpu) == 0)
886 {
887 fEflNew &= fPopfBits;
888 fEflNew |= ~fPopfBits & fEflOld;
889 }
890 else if (IEM_GET_CPL(pVCpu) <= X86_EFL_GET_IOPL(fEflOld))
891 {
892 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
893 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
894 }
895 else
896 {
897 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
898 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
899 }
900 }
901
902 /*
903 * Commit the flags.
904 */
905 Assert(fEflNew & RT_BIT_32(1));
906 IEMMISC_SET_EFL(pVCpu, fEflNew);
907 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
908}
909
910
911/**
912 * Implements an indirect call.
913 *
914 * @param uNewPC The new program counter (RIP) value (loaded from the
915 * operand).
916 */
917IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
918{
919 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
920 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
921 {
922 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
923 if (rcStrict == VINF_SUCCESS)
924 {
925 pVCpu->cpum.GstCtx.rip = uNewPC;
926 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
927 return iemRegFinishClearingRF(pVCpu);
928 }
929 return rcStrict;
930 }
931 return iemRaiseGeneralProtectionFault0(pVCpu);
932}
933
934
935/**
936 * Implements a 16-bit relative call.
937 *
938 * @param offDisp The displacment offset.
939 */
940IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
941{
942 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
943 uint16_t const uNewPC = uOldPC + offDisp;
944 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
945 {
946 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
947 if (rcStrict == VINF_SUCCESS)
948 {
949 pVCpu->cpum.GstCtx.rip = uNewPC;
950 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
951 return iemRegFinishClearingRF(pVCpu);
952 }
953 return rcStrict;
954 }
955 return iemRaiseGeneralProtectionFault0(pVCpu);
956}
957
958
959/**
960 * Implements a 32-bit indirect call.
961 *
962 * @param uNewPC The new program counter (RIP) value (loaded from the
963 * operand).
964 */
965IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
966{
967 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
968 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
969 {
970 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
971 if (rcStrict == VINF_SUCCESS)
972 {
973 pVCpu->cpum.GstCtx.rip = uNewPC;
974 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
975 return iemRegFinishClearingRF(pVCpu);
976 }
977 return rcStrict;
978 }
979 return iemRaiseGeneralProtectionFault0(pVCpu);
980}
981
982
983/**
984 * Implements a 32-bit relative call.
985 *
986 * @param offDisp The displacment offset.
987 */
988IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
989{
990 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
991 uint32_t const uNewPC = uOldPC + offDisp;
992 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
993 {
994 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
995 if (rcStrict == VINF_SUCCESS)
996 {
997 pVCpu->cpum.GstCtx.rip = uNewPC;
998 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
999 return iemRegFinishClearingRF(pVCpu);
1000 }
1001 return rcStrict;
1002 }
1003 return iemRaiseGeneralProtectionFault0(pVCpu);
1004}
1005
1006
1007/**
1008 * Implements a 64-bit indirect call.
1009 *
1010 * @param uNewPC The new program counter (RIP) value (loaded from the
1011 * operand).
1012 */
1013IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
1014{
1015 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1016 if (IEM_IS_CANONICAL(uNewPC))
1017 {
1018 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1019 if (rcStrict == VINF_SUCCESS)
1020 {
1021 pVCpu->cpum.GstCtx.rip = uNewPC;
1022 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1023 return iemRegFinishClearingRF(pVCpu);
1024 }
1025 return rcStrict;
1026 }
1027 return iemRaiseGeneralProtectionFault0(pVCpu);
1028}
1029
1030
1031/**
1032 * Implements a 64-bit relative call.
1033 *
1034 * @param offDisp The displacment offset.
1035 */
1036IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
1037{
1038 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1039 uint64_t const uNewPC = uOldPC + offDisp;
1040 if (IEM_IS_CANONICAL(uNewPC))
1041 {
1042 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1043 if (rcStrict == VINF_SUCCESS)
1044 {
1045 pVCpu->cpum.GstCtx.rip = uNewPC;
1046 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1047 return iemRegFinishClearingRF(pVCpu);
1048 }
1049 return rcStrict;
1050 }
1051 return iemRaiseNotCanonical(pVCpu);
1052}
1053
1054
1055/**
1056 * Implements far jumps and calls thru task segments (TSS).
1057 *
1058 * @returns VBox strict status code.
1059 * @param pVCpu The cross context virtual CPU structure of the
1060 * calling thread.
1061 * @param cbInstr The current instruction length.
1062 * @param uSel The selector.
1063 * @param enmBranch The kind of branching we're performing.
1064 * @param enmEffOpSize The effective operand size.
1065 * @param pDesc The descriptor corresponding to @a uSel. The type is
1066 * task gate.
1067 */
1068static VBOXSTRICTRC iemCImpl_BranchTaskSegment(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1069 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1070{
1071#ifndef IEM_IMPLEMENTS_TASKSWITCH
1072 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1073#else
1074 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1075 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
1076 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
1077 RT_NOREF_PV(enmEffOpSize);
1078 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1079
1080 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1081 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1082 {
1083 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1084 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1085 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1086 }
1087
1088 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1089 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1090 * checked here, need testcases. */
1091 if (!pDesc->Legacy.Gen.u1Present)
1092 {
1093 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1094 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1095 }
1096
1097 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1098 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1099 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1100#endif
1101}
1102
1103
1104/**
1105 * Implements far jumps and calls thru task gates.
1106 *
1107 * @returns VBox strict status code.
1108 * @param pVCpu The cross context virtual CPU structure of the
1109 * calling thread.
1110 * @param cbInstr The current instruction length.
1111 * @param uSel The selector.
1112 * @param enmBranch The kind of branching we're performing.
1113 * @param enmEffOpSize The effective operand size.
1114 * @param pDesc The descriptor corresponding to @a uSel. The type is
1115 * task gate.
1116 */
1117static VBOXSTRICTRC iemCImpl_BranchTaskGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1118 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1119{
1120#ifndef IEM_IMPLEMENTS_TASKSWITCH
1121 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1122#else
1123 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1124 RT_NOREF_PV(enmEffOpSize);
1125 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1126
1127 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1128 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1129 {
1130 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1131 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1132 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1133 }
1134
1135 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1136 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1137 * checked here, need testcases. */
1138 if (!pDesc->Legacy.Gen.u1Present)
1139 {
1140 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1141 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1142 }
1143
1144 /*
1145 * Fetch the new TSS descriptor from the GDT.
1146 */
1147 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1148 if (uSelTss & X86_SEL_LDT)
1149 {
1150 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1151 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1152 }
1153
1154 IEMSELDESC TssDesc;
1155 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1156 if (rcStrict != VINF_SUCCESS)
1157 return rcStrict;
1158
1159 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1160 {
1161 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1162 TssDesc.Legacy.Gate.u4Type));
1163 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1164 }
1165
1166 if (!TssDesc.Legacy.Gate.u1Present)
1167 {
1168 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1169 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1170 }
1171
1172 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1173 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1174 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1175#endif
1176}
1177
1178
1179/**
1180 * Implements far jumps and calls thru call gates.
1181 *
1182 * @returns VBox strict status code.
1183 * @param pVCpu The cross context virtual CPU structure of the
1184 * calling thread.
1185 * @param cbInstr The current instruction length.
1186 * @param uSel The selector.
1187 * @param enmBranch The kind of branching we're performing.
1188 * @param enmEffOpSize The effective operand size.
1189 * @param pDesc The descriptor corresponding to @a uSel. The type is
1190 * call gate.
1191 */
1192static VBOXSTRICTRC iemCImpl_BranchCallGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1193 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1194{
1195#define IEM_IMPLEMENTS_CALLGATE
1196#ifndef IEM_IMPLEMENTS_CALLGATE
1197 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1198#else
1199 RT_NOREF_PV(enmEffOpSize);
1200 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1201
1202 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1203 * inter-privilege calls and are much more complex.
1204 *
1205 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1206 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1207 * must be 16-bit or 32-bit.
1208 */
1209 /** @todo effective operand size is probably irrelevant here, only the
1210 * call gate bitness matters??
1211 */
1212 VBOXSTRICTRC rcStrict;
1213 RTPTRUNION uPtrRet;
1214 uint64_t uNewRsp;
1215 uint64_t uNewRip;
1216 uint64_t u64Base;
1217 uint32_t cbLimit;
1218 RTSEL uNewCS;
1219 IEMSELDESC DescCS;
1220
1221 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1222 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1223 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1224 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1225
1226 /* Determine the new instruction pointer from the gate descriptor. */
1227 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1228 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1229 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1230
1231 /* Perform DPL checks on the gate descriptor. */
1232 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1233 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1234 {
1235 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1236 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1237 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1238 }
1239
1240 /** @todo does this catch NULL selectors, too? */
1241 if (!pDesc->Legacy.Gen.u1Present)
1242 {
1243 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1244 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1245 }
1246
1247 /*
1248 * Fetch the target CS descriptor from the GDT or LDT.
1249 */
1250 uNewCS = pDesc->Legacy.Gate.u16Sel;
1251 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1252 if (rcStrict != VINF_SUCCESS)
1253 return rcStrict;
1254
1255 /* Target CS must be a code selector. */
1256 if ( !DescCS.Legacy.Gen.u1DescType
1257 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1258 {
1259 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1260 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1261 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1262 }
1263
1264 /* Privilege checks on target CS. */
1265 if (enmBranch == IEMBRANCH_JUMP)
1266 {
1267 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1268 {
1269 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1270 {
1271 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1272 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1273 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1274 }
1275 }
1276 else
1277 {
1278 if (DescCS.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
1279 {
1280 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1281 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1282 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1283 }
1284 }
1285 }
1286 else
1287 {
1288 Assert(enmBranch == IEMBRANCH_CALL);
1289 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1290 {
1291 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1292 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1293 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1294 }
1295 }
1296
1297 /* Additional long mode checks. */
1298 if (IEM_IS_LONG_MODE(pVCpu))
1299 {
1300 if (!DescCS.Legacy.Gen.u1Long)
1301 {
1302 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1303 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1304 }
1305
1306 /* L vs D. */
1307 if ( DescCS.Legacy.Gen.u1Long
1308 && DescCS.Legacy.Gen.u1DefBig)
1309 {
1310 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1311 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1312 }
1313 }
1314
1315 if (!DescCS.Legacy.Gate.u1Present)
1316 {
1317 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1318 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1319 }
1320
1321 if (enmBranch == IEMBRANCH_JUMP)
1322 {
1323 /** @todo This is very similar to regular far jumps; merge! */
1324 /* Jumps are fairly simple... */
1325
1326 /* Chop the high bits off if 16-bit gate (Intel says so). */
1327 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1328 uNewRip = (uint16_t)uNewRip;
1329
1330 /* Limit check for non-long segments. */
1331 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1332 if (DescCS.Legacy.Gen.u1Long)
1333 u64Base = 0;
1334 else
1335 {
1336 if (uNewRip > cbLimit)
1337 {
1338 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1339 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1340 }
1341 u64Base = X86DESC_BASE(&DescCS.Legacy);
1342 }
1343
1344 /* Canonical address check. */
1345 if (!IEM_IS_CANONICAL(uNewRip))
1346 {
1347 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1348 return iemRaiseNotCanonical(pVCpu);
1349 }
1350
1351 /*
1352 * Ok, everything checked out fine. Now set the accessed bit before
1353 * committing the result into CS, CSHID and RIP.
1354 */
1355 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1356 {
1357 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1358 if (rcStrict != VINF_SUCCESS)
1359 return rcStrict;
1360 /** @todo check what VT-x and AMD-V does. */
1361 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1362 }
1363
1364 /* commit */
1365 pVCpu->cpum.GstCtx.rip = uNewRip;
1366 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1367 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
1368 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1369 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1370 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1371 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1372 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1373 }
1374 else
1375 {
1376 Assert(enmBranch == IEMBRANCH_CALL);
1377 /* Calls are much more complicated. */
1378
1379 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < IEM_GET_CPL(pVCpu)))
1380 {
1381 uint16_t offNewStack; /* Offset of new stack in TSS. */
1382 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1383 uint8_t uNewCSDpl;
1384 uint8_t cbWords;
1385 RTSEL uNewSS;
1386 RTSEL uOldSS;
1387 uint64_t uOldRsp;
1388 IEMSELDESC DescSS;
1389 RTPTRUNION uPtrTSS;
1390 RTGCPTR GCPtrTSS;
1391 RTPTRUNION uPtrParmWds;
1392 RTGCPTR GCPtrParmWds;
1393
1394 /* More privilege. This is the fun part. */
1395 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1396
1397 /*
1398 * Determine new SS:rSP from the TSS.
1399 */
1400 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1401
1402 /* Figure out where the new stack pointer is stored in the TSS. */
1403 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1404 if (!IEM_IS_LONG_MODE(pVCpu))
1405 {
1406 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1407 {
1408 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1409 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1410 }
1411 else
1412 {
1413 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1414 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1415 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1416 }
1417 }
1418 else
1419 {
1420 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1421 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1422 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1423 }
1424
1425 /* Check against TSS limit. */
1426 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1427 {
1428 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1429 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1430 }
1431
1432 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1433 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
1434 if (rcStrict != VINF_SUCCESS)
1435 {
1436 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1437 return rcStrict;
1438 }
1439
1440 if (!IEM_IS_LONG_MODE(pVCpu))
1441 {
1442 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1443 {
1444 uNewRsp = uPtrTSS.pu32[0];
1445 uNewSS = uPtrTSS.pu16[2];
1446 }
1447 else
1448 {
1449 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1450 uNewRsp = uPtrTSS.pu16[0];
1451 uNewSS = uPtrTSS.pu16[1];
1452 }
1453 }
1454 else
1455 {
1456 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1457 /* SS will be a NULL selector, but that's valid. */
1458 uNewRsp = uPtrTSS.pu64[0];
1459 uNewSS = uNewCSDpl;
1460 }
1461
1462 /* Done with the TSS now. */
1463 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1464 if (rcStrict != VINF_SUCCESS)
1465 {
1466 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1467 return rcStrict;
1468 }
1469
1470 /* Only used outside of long mode. */
1471 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1472
1473 /* If EFER.LMA is 0, there's extra work to do. */
1474 if (!IEM_IS_LONG_MODE(pVCpu))
1475 {
1476 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1477 {
1478 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1479 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1480 }
1481
1482 /* Grab the new SS descriptor. */
1483 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1484 if (rcStrict != VINF_SUCCESS)
1485 return rcStrict;
1486
1487 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1488 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1489 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1490 {
1491 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1492 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1493 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1494 }
1495
1496 /* Ensure new SS is a writable data segment. */
1497 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1498 {
1499 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1500 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1501 }
1502
1503 if (!DescSS.Legacy.Gen.u1Present)
1504 {
1505 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1506 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1507 }
1508 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1509 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1510 else
1511 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1512 }
1513 else
1514 {
1515 /* Just grab the new (NULL) SS descriptor. */
1516 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1517 * like we do... */
1518 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1519 if (rcStrict != VINF_SUCCESS)
1520 return rcStrict;
1521
1522 cbNewStack = sizeof(uint64_t) * 4;
1523 }
1524
1525 /** @todo According to Intel, new stack is checked for enough space first,
1526 * then switched. According to AMD, the stack is switched first and
1527 * then pushes might fault!
1528 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1529 * incoming stack \#PF happens before actual stack switch. AMD is
1530 * either lying or implicitly assumes that new state is committed
1531 * only if and when an instruction doesn't fault.
1532 */
1533
1534 /** @todo According to AMD, CS is loaded first, then SS.
1535 * According to Intel, it's the other way around!?
1536 */
1537
1538 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1539
1540 /* Set the accessed bit before committing new SS. */
1541 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1542 {
1543 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1544 if (rcStrict != VINF_SUCCESS)
1545 return rcStrict;
1546 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1547 }
1548
1549 /* Remember the old SS:rSP and their linear address. */
1550 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1551 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1552
1553 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1554
1555 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1556 or #PF, the former is not implemented in this workaround. */
1557 /** @todo Proper fix callgate target stack exceptions. */
1558 /** @todo testcase: Cover callgates with partially or fully inaccessible
1559 * target stacks. */
1560 void *pvNewFrame;
1561 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1562 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1563 if (rcStrict != VINF_SUCCESS)
1564 {
1565 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1566 return rcStrict;
1567 }
1568 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1569 if (rcStrict != VINF_SUCCESS)
1570 {
1571 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1572 return rcStrict;
1573 }
1574
1575 /* Commit new SS:rSP. */
1576 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1577 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1578 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1579 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1580 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1581 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1582 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1583 IEM_SET_CPL(pVCpu, uNewCSDpl); /** @todo Are the parameter words accessed using the new CPL or the old CPL? */
1584 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1585 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1586
1587 /* At this point the stack access must not fail because new state was already committed. */
1588 /** @todo this can still fail due to SS.LIMIT not check. */
1589 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1590 IEM_IS_LONG_MODE(pVCpu) ? 7
1591 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1592 &uPtrRet.pv, &uNewRsp);
1593 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1594 VERR_INTERNAL_ERROR_5);
1595
1596 if (!IEM_IS_LONG_MODE(pVCpu))
1597 {
1598 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1599 {
1600 if (cbWords)
1601 {
1602 /* Map the relevant chunk of the old stack. */
1603 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1604 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1605 if (rcStrict != VINF_SUCCESS)
1606 {
1607 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1608 return rcStrict;
1609 }
1610
1611 /* Copy the parameter (d)words. */
1612 for (int i = 0; i < cbWords; ++i)
1613 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1614
1615 /* Unmap the old stack. */
1616 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1617 if (rcStrict != VINF_SUCCESS)
1618 {
1619 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1620 return rcStrict;
1621 }
1622 }
1623
1624 /* Push the old CS:rIP. */
1625 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1626 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1627
1628 /* Push the old SS:rSP. */
1629 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1630 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1631 }
1632 else
1633 {
1634 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1635
1636 if (cbWords)
1637 {
1638 /* Map the relevant chunk of the old stack. */
1639 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1640 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1641 if (rcStrict != VINF_SUCCESS)
1642 {
1643 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1644 return rcStrict;
1645 }
1646
1647 /* Copy the parameter words. */
1648 for (int i = 0; i < cbWords; ++i)
1649 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1650
1651 /* Unmap the old stack. */
1652 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1653 if (rcStrict != VINF_SUCCESS)
1654 {
1655 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1656 return rcStrict;
1657 }
1658 }
1659
1660 /* Push the old CS:rIP. */
1661 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1662 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1663
1664 /* Push the old SS:rSP. */
1665 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1666 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1667 }
1668 }
1669 else
1670 {
1671 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1672
1673 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1674 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1675 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1676 uPtrRet.pu64[2] = uOldRsp;
1677 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1678 }
1679
1680 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1681 if (rcStrict != VINF_SUCCESS)
1682 {
1683 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1684 return rcStrict;
1685 }
1686
1687 /* Chop the high bits off if 16-bit gate (Intel says so). */
1688 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1689 uNewRip = (uint16_t)uNewRip;
1690
1691 /* Limit / canonical check. */
1692 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1693 if (!IEM_IS_LONG_MODE(pVCpu))
1694 {
1695 if (uNewRip > cbLimit)
1696 {
1697 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1698 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1699 }
1700 u64Base = X86DESC_BASE(&DescCS.Legacy);
1701 }
1702 else
1703 {
1704 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1705 if (!IEM_IS_CANONICAL(uNewRip))
1706 {
1707 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1708 return iemRaiseNotCanonical(pVCpu);
1709 }
1710 u64Base = 0;
1711 }
1712
1713 /*
1714 * Now set the accessed bit before
1715 * writing the return address to the stack and committing the result into
1716 * CS, CSHID and RIP.
1717 */
1718 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1719 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1720 {
1721 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1722 if (rcStrict != VINF_SUCCESS)
1723 return rcStrict;
1724 /** @todo check what VT-x and AMD-V does. */
1725 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1726 }
1727
1728 /* Commit new CS:rIP. */
1729 pVCpu->cpum.GstCtx.rip = uNewRip;
1730 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1731 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1732 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1733 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1734 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1735 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1736 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1737 }
1738 else
1739 {
1740 /* Same privilege. */
1741 /** @todo This is very similar to regular far calls; merge! */
1742
1743 /* Check stack first - may #SS(0). */
1744 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1745 * 16-bit code cause a two or four byte CS to be pushed? */
1746 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1747 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1748 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1749 IEM_IS_LONG_MODE(pVCpu) ? 7
1750 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1751 &uPtrRet.pv, &uNewRsp);
1752 if (rcStrict != VINF_SUCCESS)
1753 return rcStrict;
1754
1755 /* Chop the high bits off if 16-bit gate (Intel says so). */
1756 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1757 uNewRip = (uint16_t)uNewRip;
1758
1759 /* Limit / canonical check. */
1760 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1761 if (!IEM_IS_LONG_MODE(pVCpu))
1762 {
1763 if (uNewRip > cbLimit)
1764 {
1765 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1766 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1767 }
1768 u64Base = X86DESC_BASE(&DescCS.Legacy);
1769 }
1770 else
1771 {
1772 if (!IEM_IS_CANONICAL(uNewRip))
1773 {
1774 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1775 return iemRaiseNotCanonical(pVCpu);
1776 }
1777 u64Base = 0;
1778 }
1779
1780 /*
1781 * Now set the accessed bit before
1782 * writing the return address to the stack and committing the result into
1783 * CS, CSHID and RIP.
1784 */
1785 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1786 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1787 {
1788 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1789 if (rcStrict != VINF_SUCCESS)
1790 return rcStrict;
1791 /** @todo check what VT-x and AMD-V does. */
1792 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1793 }
1794
1795 /* stack */
1796 if (!IEM_IS_LONG_MODE(pVCpu))
1797 {
1798 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1799 {
1800 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1801 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1802 }
1803 else
1804 {
1805 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1806 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1807 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1808 }
1809 }
1810 else
1811 {
1812 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1813 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1814 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1815 }
1816
1817 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1818 if (rcStrict != VINF_SUCCESS)
1819 return rcStrict;
1820
1821 /* commit */
1822 pVCpu->cpum.GstCtx.rip = uNewRip;
1823 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1824 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1825 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1826 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1827 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1828 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1829 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1830 }
1831 }
1832 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1833
1834 iemRecalcExecModeAndCplFlags(pVCpu);
1835
1836/** @todo single stepping */
1837
1838 /* Flush the prefetch buffer. */
1839 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1840 return VINF_SUCCESS;
1841#endif /* IEM_IMPLEMENTS_CALLGATE */
1842}
1843
1844
1845/**
1846 * Implements far jumps and calls thru system selectors.
1847 *
1848 * @returns VBox strict status code.
1849 * @param pVCpu The cross context virtual CPU structure of the
1850 * calling thread.
1851 * @param cbInstr The current instruction length.
1852 * @param uSel The selector.
1853 * @param enmBranch The kind of branching we're performing.
1854 * @param enmEffOpSize The effective operand size.
1855 * @param pDesc The descriptor corresponding to @a uSel.
1856 */
1857static VBOXSTRICTRC iemCImpl_BranchSysSel(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1858 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1859{
1860 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1861 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1862 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1863
1864 if (IEM_IS_LONG_MODE(pVCpu))
1865 switch (pDesc->Legacy.Gen.u4Type)
1866 {
1867 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1868 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1869
1870 default:
1871 case AMD64_SEL_TYPE_SYS_LDT:
1872 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1873 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1874 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1875 case AMD64_SEL_TYPE_SYS_INT_GATE:
1876 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1877 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1878 }
1879
1880 switch (pDesc->Legacy.Gen.u4Type)
1881 {
1882 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1883 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1884 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1885
1886 case X86_SEL_TYPE_SYS_TASK_GATE:
1887 return iemCImpl_BranchTaskGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1888
1889 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1890 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1891 return iemCImpl_BranchTaskSegment(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1892
1893 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1894 Log(("branch %04x -> busy 286 TSS\n", uSel));
1895 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1896
1897 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1898 Log(("branch %04x -> busy 386 TSS\n", uSel));
1899 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1900
1901 default:
1902 case X86_SEL_TYPE_SYS_LDT:
1903 case X86_SEL_TYPE_SYS_286_INT_GATE:
1904 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1905 case X86_SEL_TYPE_SYS_386_INT_GATE:
1906 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1907 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1908 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1909 }
1910}
1911
1912
1913/**
1914 * Implements far jumps.
1915 *
1916 * @param uSel The selector.
1917 * @param offSeg The segment offset.
1918 * @param enmEffOpSize The effective operand size.
1919 */
1920IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1921{
1922 NOREF(cbInstr);
1923 Assert(offSeg <= UINT32_MAX || (!IEM_IS_GUEST_CPU_AMD(pVCpu) && IEM_IS_64BIT_CODE(pVCpu)));
1924
1925 /*
1926 * Real mode and V8086 mode are easy. The only snag seems to be that
1927 * CS.limit doesn't change and the limit check is done against the current
1928 * limit.
1929 */
1930 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1931 * 1998) that up to and including the Intel 486, far control
1932 * transfers in real mode set default CS attributes (0x93) and also
1933 * set a 64K segment limit. Starting with the Pentium, the
1934 * attributes and limit are left alone but the access rights are
1935 * ignored. We only implement the Pentium+ behavior.
1936 * */
1937 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1938 {
1939 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1940 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1941 {
1942 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1943 return iemRaiseGeneralProtectionFault0(pVCpu);
1944 }
1945
1946 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1947 pVCpu->cpum.GstCtx.rip = offSeg;
1948 else
1949 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1950 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1951 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1952 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1953 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1954
1955 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
1956 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
1957 { /* likely */ }
1958 else if (uSel != 0)
1959 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
1960 else
1961 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
1962 | iemCalc32BitFlatIndicator(pVCpu);
1963
1964 return iemRegFinishClearingRF(pVCpu);
1965 }
1966
1967 /*
1968 * Protected mode. Need to parse the specified descriptor...
1969 */
1970 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1971 {
1972 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1973 return iemRaiseGeneralProtectionFault0(pVCpu);
1974 }
1975
1976 /* Fetch the descriptor. */
1977 IEMSELDESC Desc;
1978 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1979 if (rcStrict != VINF_SUCCESS)
1980 return rcStrict;
1981
1982 /* Is it there? */
1983 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1984 {
1985 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1986 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1987 }
1988
1989 /*
1990 * Deal with it according to its type. We do the standard code selectors
1991 * here and dispatch the system selectors to worker functions.
1992 */
1993 if (!Desc.Legacy.Gen.u1DescType)
1994 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1995
1996 /* Only code segments. */
1997 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1998 {
1999 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2000 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2001 }
2002
2003 /* L vs D. */
2004 if ( Desc.Legacy.Gen.u1Long
2005 && Desc.Legacy.Gen.u1DefBig
2006 && IEM_IS_LONG_MODE(pVCpu))
2007 {
2008 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2009 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2010 }
2011
2012 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2013 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2014 {
2015 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2016 {
2017 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2018 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2019 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2020 }
2021 }
2022 else
2023 {
2024 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2025 {
2026 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2027 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2028 }
2029 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2030 {
2031 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2032 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2033 }
2034 }
2035
2036 /* Chop the high bits if 16-bit (Intel says so). */
2037 if (enmEffOpSize == IEMMODE_16BIT)
2038 offSeg &= UINT16_MAX;
2039
2040 /* Limit check and get the base. */
2041 uint64_t u64Base;
2042 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2043 if ( !Desc.Legacy.Gen.u1Long
2044 || !IEM_IS_LONG_MODE(pVCpu))
2045 {
2046 if (RT_LIKELY(offSeg <= cbLimit))
2047 u64Base = X86DESC_BASE(&Desc.Legacy);
2048 else
2049 {
2050 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2051 /** @todo Intel says this is \#GP(0)! */
2052 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2053 }
2054 }
2055 else
2056 u64Base = 0;
2057
2058 /*
2059 * Ok, everything checked out fine. Now set the accessed bit before
2060 * committing the result into CS, CSHID and RIP.
2061 */
2062 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2063 {
2064 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2065 if (rcStrict != VINF_SUCCESS)
2066 return rcStrict;
2067 /** @todo check what VT-x and AMD-V does. */
2068 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2069 }
2070
2071 /* commit */
2072 pVCpu->cpum.GstCtx.rip = offSeg;
2073 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2074 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
2075 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2076 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2077 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2078 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2079 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2080
2081 /** @todo check if the hidden bits are loaded correctly for 64-bit
2082 * mode. */
2083
2084 iemRecalcExecModeAndCplFlags(pVCpu);
2085
2086 /* Flush the prefetch buffer. */
2087 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2088
2089 return iemRegFinishClearingRF(pVCpu);
2090}
2091
2092
2093/**
2094 * Implements far calls.
2095 *
2096 * This very similar to iemCImpl_FarJmp.
2097 *
2098 * @param uSel The selector.
2099 * @param offSeg The segment offset.
2100 * @param enmEffOpSize The operand size (in case we need it).
2101 */
2102IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
2103{
2104 VBOXSTRICTRC rcStrict;
2105 uint64_t uNewRsp;
2106 RTPTRUNION uPtrRet;
2107
2108 /*
2109 * Real mode and V8086 mode are easy. The only snag seems to be that
2110 * CS.limit doesn't change and the limit check is done against the current
2111 * limit.
2112 */
2113 /** @todo See comment for similar code in iemCImpl_FarJmp */
2114 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2115 {
2116 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2117
2118 /* Check stack first - may #SS(0). */
2119 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2120 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2121 &uPtrRet.pv, &uNewRsp);
2122 if (rcStrict != VINF_SUCCESS)
2123 return rcStrict;
2124
2125 /* Check the target address range. */
2126/** @todo this must be wrong! Write unreal mode tests! */
2127 if (offSeg > UINT32_MAX)
2128 return iemRaiseGeneralProtectionFault0(pVCpu);
2129
2130 /* Everything is fine, push the return address. */
2131 if (enmEffOpSize == IEMMODE_16BIT)
2132 {
2133 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2134 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2135 }
2136 else
2137 {
2138 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2139 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2140 }
2141 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2142 if (rcStrict != VINF_SUCCESS)
2143 return rcStrict;
2144
2145 /* Branch. */
2146 pVCpu->cpum.GstCtx.rip = offSeg;
2147 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2148 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2149 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2150 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2151
2152 return iemRegFinishClearingRF(pVCpu);
2153 }
2154
2155 /*
2156 * Protected mode. Need to parse the specified descriptor...
2157 */
2158 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2159 {
2160 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2161 return iemRaiseGeneralProtectionFault0(pVCpu);
2162 }
2163
2164 /* Fetch the descriptor. */
2165 IEMSELDESC Desc;
2166 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2167 if (rcStrict != VINF_SUCCESS)
2168 return rcStrict;
2169
2170 /*
2171 * Deal with it according to its type. We do the standard code selectors
2172 * here and dispatch the system selectors to worker functions.
2173 */
2174 if (!Desc.Legacy.Gen.u1DescType)
2175 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2176
2177 /* Only code segments. */
2178 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2179 {
2180 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2181 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2182 }
2183
2184 /* L vs D. */
2185 if ( Desc.Legacy.Gen.u1Long
2186 && Desc.Legacy.Gen.u1DefBig
2187 && IEM_IS_LONG_MODE(pVCpu))
2188 {
2189 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2190 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2191 }
2192
2193 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2194 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2195 {
2196 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2197 {
2198 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2199 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2200 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2201 }
2202 }
2203 else
2204 {
2205 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2206 {
2207 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2208 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2209 }
2210 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2211 {
2212 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2213 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2214 }
2215 }
2216
2217 /* Is it there? */
2218 if (!Desc.Legacy.Gen.u1Present)
2219 {
2220 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2221 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2222 }
2223
2224 /* Check stack first - may #SS(0). */
2225 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2226 * 16-bit code cause a two or four byte CS to be pushed? */
2227 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2228 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2229 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2230 &uPtrRet.pv, &uNewRsp);
2231 if (rcStrict != VINF_SUCCESS)
2232 return rcStrict;
2233
2234 /* Chop the high bits if 16-bit (Intel says so). */
2235 if (enmEffOpSize == IEMMODE_16BIT)
2236 offSeg &= UINT16_MAX;
2237
2238 /* Limit / canonical check. */
2239 uint64_t u64Base;
2240 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2241 if ( !Desc.Legacy.Gen.u1Long
2242 || !IEM_IS_LONG_MODE(pVCpu))
2243 {
2244 if (RT_LIKELY(offSeg <= cbLimit))
2245 u64Base = X86DESC_BASE(&Desc.Legacy);
2246 else
2247 {
2248 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2249 /** @todo Intel says this is \#GP(0)! */
2250 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2251 }
2252 }
2253 else if (IEM_IS_CANONICAL(offSeg))
2254 u64Base = 0;
2255 else
2256 {
2257 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2258 return iemRaiseNotCanonical(pVCpu);
2259 }
2260
2261 /*
2262 * Now set the accessed bit before
2263 * writing the return address to the stack and committing the result into
2264 * CS, CSHID and RIP.
2265 */
2266 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2267 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2268 {
2269 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2270 if (rcStrict != VINF_SUCCESS)
2271 return rcStrict;
2272 /** @todo check what VT-x and AMD-V does. */
2273 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2274 }
2275
2276 /* stack */
2277 if (enmEffOpSize == IEMMODE_16BIT)
2278 {
2279 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2280 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2281 }
2282 else if (enmEffOpSize == IEMMODE_32BIT)
2283 {
2284 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2285 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2286 }
2287 else
2288 {
2289 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2290 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2291 }
2292 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2293 if (rcStrict != VINF_SUCCESS)
2294 return rcStrict;
2295
2296 /* commit */
2297 pVCpu->cpum.GstCtx.rip = offSeg;
2298 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2299 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
2300 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2301 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2302 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2303 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2304 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2305
2306 /** @todo check if the hidden bits are loaded correctly for 64-bit
2307 * mode. */
2308
2309 iemRecalcExecModeAndCplFlags(pVCpu);
2310
2311 /* Flush the prefetch buffer. */
2312 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2313
2314 return iemRegFinishClearingRF(pVCpu);
2315}
2316
2317
2318/**
2319 * Implements retf.
2320 *
2321 * @param enmEffOpSize The effective operand size.
2322 * @param cbPop The amount of arguments to pop from the stack
2323 * (bytes).
2324 */
2325IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2326{
2327 VBOXSTRICTRC rcStrict;
2328 RTCPTRUNION uPtrFrame;
2329 RTUINT64U NewRsp;
2330 uint64_t uNewRip;
2331 uint16_t uNewCs;
2332 NOREF(cbInstr);
2333
2334 /*
2335 * Read the stack values first.
2336 */
2337 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2338 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2339 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2340 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2341 &uPtrFrame.pv, &NewRsp.u);
2342 if (rcStrict != VINF_SUCCESS)
2343 return rcStrict;
2344 if (enmEffOpSize == IEMMODE_16BIT)
2345 {
2346 uNewRip = uPtrFrame.pu16[0];
2347 uNewCs = uPtrFrame.pu16[1];
2348 }
2349 else if (enmEffOpSize == IEMMODE_32BIT)
2350 {
2351 uNewRip = uPtrFrame.pu32[0];
2352 uNewCs = uPtrFrame.pu16[2];
2353 }
2354 else
2355 {
2356 uNewRip = uPtrFrame.pu64[0];
2357 uNewCs = uPtrFrame.pu16[4];
2358 }
2359 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2360 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2361 { /* extremely likely */ }
2362 else
2363 return rcStrict;
2364
2365 /*
2366 * Real mode and V8086 mode are easy.
2367 */
2368 /** @todo See comment for similar code in iemCImpl_FarJmp */
2369 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2370 {
2371 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2372 /** @todo check how this is supposed to work if sp=0xfffe. */
2373
2374 /* Check the limit of the new EIP. */
2375 /** @todo Intel pseudo code only does the limit check for 16-bit
2376 * operands, AMD does not make any distinction. What is right? */
2377 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2378 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2379
2380 /* commit the operation. */
2381 if (cbPop)
2382 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2383 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2384 pVCpu->cpum.GstCtx.rip = uNewRip;
2385 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2386 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2387 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2388 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2389 return iemRegFinishClearingRF(pVCpu);
2390 }
2391
2392 /*
2393 * Protected mode is complicated, of course.
2394 */
2395 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2396 {
2397 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2398 return iemRaiseGeneralProtectionFault0(pVCpu);
2399 }
2400
2401 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2402
2403 /* Fetch the descriptor. */
2404 IEMSELDESC DescCs;
2405 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2406 if (rcStrict != VINF_SUCCESS)
2407 return rcStrict;
2408
2409 /* Can only return to a code selector. */
2410 if ( !DescCs.Legacy.Gen.u1DescType
2411 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2412 {
2413 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2414 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2415 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2416 }
2417
2418 /* L vs D. */
2419 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2420 && DescCs.Legacy.Gen.u1DefBig
2421 && IEM_IS_LONG_MODE(pVCpu))
2422 {
2423 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2424 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2425 }
2426
2427 /* DPL/RPL/CPL checks. */
2428 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
2429 {
2430 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
2431 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2432 }
2433
2434 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2435 {
2436 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2437 {
2438 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2439 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2440 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2441 }
2442 }
2443 else
2444 {
2445 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2446 {
2447 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2448 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2449 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2450 }
2451 }
2452
2453 /* Is it there? */
2454 if (!DescCs.Legacy.Gen.u1Present)
2455 {
2456 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2457 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2458 }
2459
2460 /*
2461 * Return to outer privilege? (We'll typically have entered via a call gate.)
2462 */
2463 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
2464 {
2465 /* Read the outer stack pointer stored *after* the parameters. */
2466 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, NewRsp.u);
2467 if (rcStrict != VINF_SUCCESS)
2468 return rcStrict;
2469
2470 uint16_t uNewOuterSs;
2471 RTUINT64U NewOuterRsp;
2472 if (enmEffOpSize == IEMMODE_16BIT)
2473 {
2474 NewOuterRsp.u = uPtrFrame.pu16[0];
2475 uNewOuterSs = uPtrFrame.pu16[1];
2476 }
2477 else if (enmEffOpSize == IEMMODE_32BIT)
2478 {
2479 NewOuterRsp.u = uPtrFrame.pu32[0];
2480 uNewOuterSs = uPtrFrame.pu16[2];
2481 }
2482 else
2483 {
2484 NewOuterRsp.u = uPtrFrame.pu64[0];
2485 uNewOuterSs = uPtrFrame.pu16[4];
2486 }
2487 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2488 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2489 { /* extremely likely */ }
2490 else
2491 return rcStrict;
2492
2493 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2494 and read the selector. */
2495 IEMSELDESC DescSs;
2496 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2497 {
2498 if ( !DescCs.Legacy.Gen.u1Long
2499 || (uNewOuterSs & X86_SEL_RPL) == 3)
2500 {
2501 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2502 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2503 return iemRaiseGeneralProtectionFault0(pVCpu);
2504 }
2505 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2506 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2507 }
2508 else
2509 {
2510 /* Fetch the descriptor for the new stack segment. */
2511 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2512 if (rcStrict != VINF_SUCCESS)
2513 return rcStrict;
2514 }
2515
2516 /* Check that RPL of stack and code selectors match. */
2517 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2518 {
2519 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2520 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2521 }
2522
2523 /* Must be a writable data segment. */
2524 if ( !DescSs.Legacy.Gen.u1DescType
2525 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2526 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2527 {
2528 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2529 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2530 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2531 }
2532
2533 /* L vs D. (Not mentioned by intel.) */
2534 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2535 && DescSs.Legacy.Gen.u1DefBig
2536 && IEM_IS_LONG_MODE(pVCpu))
2537 {
2538 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2539 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2540 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2541 }
2542
2543 /* DPL/RPL/CPL checks. */
2544 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2545 {
2546 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2547 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2548 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2549 }
2550
2551 /* Is it there? */
2552 if (!DescSs.Legacy.Gen.u1Present)
2553 {
2554 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2555 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2556 }
2557
2558 /* Calc SS limit.*/
2559 uint64_t u64BaseSs;
2560 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2561
2562 /* Is RIP canonical or within CS.limit? */
2563 uint64_t u64BaseCs;
2564 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2565
2566 /** @todo Testcase: Is this correct? */
2567 if ( DescCs.Legacy.Gen.u1Long
2568 && IEM_IS_LONG_MODE(pVCpu) )
2569 {
2570 if (!IEM_IS_CANONICAL(uNewRip))
2571 {
2572 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2573 return iemRaiseNotCanonical(pVCpu);
2574 }
2575 u64BaseCs = 0;
2576 u64BaseSs = 0;
2577 }
2578 else
2579 {
2580 if (uNewRip > cbLimitCs)
2581 {
2582 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2583 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
2584 /** @todo Intel says this is \#GP(0)! */
2585 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2586 }
2587 u64BaseCs = X86DESC_BASE(&DescCs.Legacy);
2588 u64BaseSs = X86DESC_BASE(&DescSs.Legacy);
2589 }
2590
2591 /*
2592 * Now set the accessed bit before
2593 * writing the return address to the stack and committing the result into
2594 * CS, CSHID and RIP.
2595 */
2596 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2597 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2598 {
2599 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2600 if (rcStrict != VINF_SUCCESS)
2601 return rcStrict;
2602 /** @todo check what VT-x and AMD-V does. */
2603 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2604 }
2605 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2606 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2607 {
2608 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2609 if (rcStrict != VINF_SUCCESS)
2610 return rcStrict;
2611 /** @todo check what VT-x and AMD-V does. */
2612 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2613 }
2614
2615 /* commit */
2616 if (enmEffOpSize == IEMMODE_16BIT)
2617 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2618 else
2619 pVCpu->cpum.GstCtx.rip = uNewRip;
2620 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2621 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2622 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2623 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2624 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2625 pVCpu->cpum.GstCtx.cs.u64Base = u64BaseCs;
2626 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2627 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2628 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2629 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2630 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2631 pVCpu->cpum.GstCtx.ss.u64Base = u64BaseSs;
2632
2633 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2634 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2635 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2636 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2637
2638 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2639
2640 if (cbPop)
2641 iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
2642 if (IEM_IS_64BIT_CODE(pVCpu))
2643 pVCpu->cpum.GstCtx.rsp = NewOuterRsp.u;
2644 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2645 pVCpu->cpum.GstCtx.rsp = (uint32_t)NewOuterRsp.u;
2646 else
2647 pVCpu->cpum.GstCtx.sp = (uint16_t)NewOuterRsp.u;
2648
2649 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2650
2651 /** @todo check if the hidden bits are loaded correctly for 64-bit
2652 * mode. */
2653 }
2654 /*
2655 * Return to the same privilege level
2656 */
2657 else
2658 {
2659 /* Limit / canonical check. */
2660 uint64_t u64Base;
2661 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2662
2663 /** @todo Testcase: Is this correct? */
2664 bool f64BitCs = false;
2665 if ( DescCs.Legacy.Gen.u1Long
2666 && IEM_IS_LONG_MODE(pVCpu) )
2667 {
2668 if (!IEM_IS_CANONICAL(uNewRip))
2669 {
2670 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2671 return iemRaiseNotCanonical(pVCpu);
2672 }
2673 u64Base = 0;
2674 f64BitCs = true;
2675 f64BitCs = true;
2676 }
2677 else
2678 {
2679 if (uNewRip > cbLimitCs)
2680 {
2681 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2682 /** @todo Intel says this is \#GP(0)! */
2683 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2684 }
2685 u64Base = X86DESC_BASE(&DescCs.Legacy);
2686 }
2687
2688 /*
2689 * Now set the accessed bit before
2690 * writing the return address to the stack and committing the result into
2691 * CS, CSHID and RIP.
2692 */
2693 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2694 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2695 {
2696 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2697 if (rcStrict != VINF_SUCCESS)
2698 return rcStrict;
2699 /** @todo check what VT-x and AMD-V does. */
2700 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2701 }
2702
2703 /* commit */
2704 if (cbPop)
2705/** @todo This cannot be right. We're using the old CS mode here, and iemRegAddToRspEx checks fExec. */
2706 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2707 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig || f64BitCs)
2708 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2709 else
2710 pVCpu->cpum.GstCtx.sp = (uint16_t)NewRsp.u;
2711 if (enmEffOpSize == IEMMODE_16BIT)
2712 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2713 else
2714 pVCpu->cpum.GstCtx.rip = uNewRip;
2715 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2716 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2717 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2718 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2719 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2720 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2721 /** @todo check if the hidden bits are loaded correctly for 64-bit
2722 * mode. */
2723
2724 iemRecalcExecModeAndCplFlags(pVCpu);
2725 }
2726
2727 /* Flush the prefetch buffer. */
2728 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo use light flush for same privilege? */
2729
2730 return iemRegFinishClearingRF(pVCpu);
2731}
2732
2733
2734/**
2735 * Implements retn and retn imm16.
2736 *
2737 * We're doing this in C because of the \#GP that might be raised if the popped
2738 * program counter is out of bounds.
2739 *
2740 * The hope with this forced inline worker function, is that the compiler will
2741 * be clever enough to eliminate unused code for the constant enmEffOpSize and
2742 * maybe cbPop parameters.
2743 *
2744 * @param pVCpu The cross context virtual CPU structure of the
2745 * calling thread.
2746 * @param cbInstr The current instruction length.
2747 * @param enmEffOpSize The effective operand size. This is constant.
2748 * @param cbPop The amount of arguments to pop from the stack
2749 * (bytes). This can be constant (zero).
2750 */
2751DECL_FORCE_INLINE(VBOXSTRICTRC) iemCImpl_ReturnNearCommon(PVMCPUCC pVCpu, uint8_t cbInstr, IEMMODE enmEffOpSize, uint16_t cbPop)
2752{
2753 /* Fetch the RSP from the stack. */
2754 VBOXSTRICTRC rcStrict;
2755 RTUINT64U NewRip;
2756 RTUINT64U NewRsp;
2757 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2758
2759 switch (enmEffOpSize)
2760 {
2761 case IEMMODE_16BIT:
2762 NewRip.u = 0;
2763 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2764 break;
2765 case IEMMODE_32BIT:
2766 NewRip.u = 0;
2767 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2768 break;
2769 case IEMMODE_64BIT:
2770 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2771 break;
2772 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2773 }
2774 if (rcStrict != VINF_SUCCESS)
2775 return rcStrict;
2776
2777 /* Check the new RSP before loading it. */
2778 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2779 * of it. The canonical test is performed here and for call. */
2780 if (enmEffOpSize != IEMMODE_64BIT)
2781 {
2782 if (RT_LIKELY(NewRip.DWords.dw0 <= pVCpu->cpum.GstCtx.cs.u32Limit))
2783 { /* likely */ }
2784 else
2785 {
2786 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2787 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2788 }
2789 }
2790 else
2791 {
2792 if (RT_LIKELY(IEM_IS_CANONICAL(NewRip.u)))
2793 { /* likely */ }
2794 else
2795 {
2796 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2797 return iemRaiseNotCanonical(pVCpu);
2798 }
2799 }
2800
2801 /* Apply cbPop */
2802 if (cbPop)
2803 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2804
2805 /* Commit it. */
2806 pVCpu->cpum.GstCtx.rip = NewRip.u;
2807 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2808
2809 /* Flush the prefetch buffer. */
2810 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo only need a light flush here, don't we? We don't really need any flushing... */
2811 RT_NOREF(cbInstr);
2812
2813 return iemRegFinishClearingRF(pVCpu);
2814}
2815
2816
2817/**
2818 * Implements retn imm16 with 16-bit effective operand size.
2819 *
2820 * @param cbPop The amount of arguments to pop from the stack (bytes).
2821 */
2822IEM_CIMPL_DEF_1(iemCImpl_retn_iw_16, uint16_t, cbPop)
2823{
2824 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, cbPop);
2825}
2826
2827
2828/**
2829 * Implements retn imm16 with 32-bit effective operand size.
2830 *
2831 * @param cbPop The amount of arguments to pop from the stack (bytes).
2832 */
2833IEM_CIMPL_DEF_1(iemCImpl_retn_iw_32, uint16_t, cbPop)
2834{
2835 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, cbPop);
2836}
2837
2838
2839/**
2840 * Implements retn imm16 with 64-bit effective operand size.
2841 *
2842 * @param cbPop The amount of arguments to pop from the stack (bytes).
2843 */
2844IEM_CIMPL_DEF_1(iemCImpl_retn_iw_64, uint16_t, cbPop)
2845{
2846 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, cbPop);
2847}
2848
2849
2850/**
2851 * Implements retn with 16-bit effective operand size.
2852 */
2853IEM_CIMPL_DEF_0(iemCImpl_retn_16)
2854{
2855 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, 0);
2856}
2857
2858
2859/**
2860 * Implements retn with 32-bit effective operand size.
2861 */
2862IEM_CIMPL_DEF_0(iemCImpl_retn_32)
2863{
2864 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, 0);
2865}
2866
2867
2868/**
2869 * Implements retn with 64-bit effective operand size.
2870 */
2871IEM_CIMPL_DEF_0(iemCImpl_retn_64)
2872{
2873 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, 0);
2874}
2875
2876
2877/**
2878 * Implements enter.
2879 *
2880 * We're doing this in C because the instruction is insane, even for the
2881 * u8NestingLevel=0 case dealing with the stack is tedious.
2882 *
2883 * @param enmEffOpSize The effective operand size.
2884 * @param cbFrame Frame size.
2885 * @param cParameters Frame parameter count.
2886 */
2887IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2888{
2889 /* Push RBP, saving the old value in TmpRbp. */
2890 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2891 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2892 RTUINT64U NewRbp;
2893 VBOXSTRICTRC rcStrict;
2894 if (enmEffOpSize == IEMMODE_64BIT)
2895 {
2896 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2897 NewRbp = NewRsp;
2898 }
2899 else if (enmEffOpSize == IEMMODE_32BIT)
2900 {
2901 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2902 NewRbp = NewRsp;
2903 }
2904 else
2905 {
2906 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2907 NewRbp = TmpRbp;
2908 NewRbp.Words.w0 = NewRsp.Words.w0;
2909 }
2910 if (rcStrict != VINF_SUCCESS)
2911 return rcStrict;
2912
2913 /* Copy the parameters (aka nesting levels by Intel). */
2914 cParameters &= 0x1f;
2915 if (cParameters > 0)
2916 {
2917 switch (enmEffOpSize)
2918 {
2919 case IEMMODE_16BIT:
2920 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2921 TmpRbp.DWords.dw0 -= 2;
2922 else
2923 TmpRbp.Words.w0 -= 2;
2924 do
2925 {
2926 uint16_t u16Tmp;
2927 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2928 if (rcStrict != VINF_SUCCESS)
2929 break;
2930 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2931 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2932 break;
2933
2934 case IEMMODE_32BIT:
2935 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2936 TmpRbp.DWords.dw0 -= 4;
2937 else
2938 TmpRbp.Words.w0 -= 4;
2939 do
2940 {
2941 uint32_t u32Tmp;
2942 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2943 if (rcStrict != VINF_SUCCESS)
2944 break;
2945 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2946 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2947 break;
2948
2949 case IEMMODE_64BIT:
2950 TmpRbp.u -= 8;
2951 do
2952 {
2953 uint64_t u64Tmp;
2954 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2955 if (rcStrict != VINF_SUCCESS)
2956 break;
2957 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2958 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2959 break;
2960
2961 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2962 }
2963 if (rcStrict != VINF_SUCCESS)
2964 return VINF_SUCCESS;
2965
2966 /* Push the new RBP */
2967 if (enmEffOpSize == IEMMODE_64BIT)
2968 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2969 else if (enmEffOpSize == IEMMODE_32BIT)
2970 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2971 else
2972 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2973 if (rcStrict != VINF_SUCCESS)
2974 return rcStrict;
2975
2976 }
2977
2978 /* Recalc RSP. */
2979 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2980
2981 /** @todo Should probe write access at the new RSP according to AMD. */
2982 /** @todo Should handle accesses to the VMX APIC-access page. */
2983
2984 /* Commit it. */
2985 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2986 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2987 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2988}
2989
2990
2991
2992/**
2993 * Implements leave.
2994 *
2995 * We're doing this in C because messing with the stack registers is annoying
2996 * since they depends on SS attributes.
2997 *
2998 * @param enmEffOpSize The effective operand size.
2999 */
3000IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
3001{
3002 /* Calculate the intermediate RSP from RBP and the stack attributes. */
3003 RTUINT64U NewRsp;
3004 if (IEM_IS_64BIT_CODE(pVCpu))
3005 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
3006 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3007 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
3008 else
3009 {
3010 /** @todo Check that LEAVE actually preserve the high EBP bits. */
3011 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
3012 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
3013 }
3014
3015 /* Pop RBP according to the operand size. */
3016 VBOXSTRICTRC rcStrict;
3017 RTUINT64U NewRbp;
3018 switch (enmEffOpSize)
3019 {
3020 case IEMMODE_16BIT:
3021 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
3022 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
3023 break;
3024 case IEMMODE_32BIT:
3025 NewRbp.u = 0;
3026 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
3027 break;
3028 case IEMMODE_64BIT:
3029 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
3030 break;
3031 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3032 }
3033 if (rcStrict != VINF_SUCCESS)
3034 return rcStrict;
3035
3036
3037 /* Commit it. */
3038 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
3039 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
3040 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
3041}
3042
3043
3044/**
3045 * Implements int3 and int XX.
3046 *
3047 * @param u8Int The interrupt vector number.
3048 * @param enmInt The int instruction type.
3049 */
3050IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
3051{
3052 Assert(pVCpu->iem.s.cXcptRecursions == 0);
3053
3054 /*
3055 * We must check if this INT3 might belong to DBGF before raising a #BP.
3056 */
3057 if (u8Int == 3)
3058 {
3059 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
3060 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
3061 { /* likely: No vbox debugger breakpoints */ }
3062 else
3063 {
3064 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
3065 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
3066 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
3067 return iemSetPassUpStatus(pVCpu, rcStrict);
3068 }
3069 }
3070/** @todo single stepping */
3071 return iemRaiseXcptOrInt(pVCpu,
3072 cbInstr,
3073 u8Int,
3074 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
3075 0,
3076 0);
3077}
3078
3079
3080/**
3081 * Implements iret for real mode and V8086 mode.
3082 *
3083 * @param enmEffOpSize The effective operand size.
3084 */
3085IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
3086{
3087 X86EFLAGS Efl;
3088 Efl.u = IEMMISC_GET_EFL(pVCpu);
3089 NOREF(cbInstr);
3090
3091 /*
3092 * iret throws an exception if VME isn't enabled.
3093 */
3094 if ( Efl.Bits.u1VM
3095 && Efl.Bits.u2IOPL != 3
3096 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
3097 return iemRaiseGeneralProtectionFault0(pVCpu);
3098
3099 /*
3100 * Do the stack bits, but don't commit RSP before everything checks
3101 * out right.
3102 */
3103 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3104 VBOXSTRICTRC rcStrict;
3105 RTCPTRUNION uFrame;
3106 uint16_t uNewCs;
3107 uint32_t uNewEip;
3108 uint32_t uNewFlags;
3109 uint64_t uNewRsp;
3110 if (enmEffOpSize == IEMMODE_32BIT)
3111 {
3112 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
3113 if (rcStrict != VINF_SUCCESS)
3114 return rcStrict;
3115 uNewEip = uFrame.pu32[0];
3116 if (uNewEip > UINT16_MAX)
3117 return iemRaiseGeneralProtectionFault0(pVCpu);
3118
3119 uNewCs = (uint16_t)uFrame.pu32[1];
3120 uNewFlags = uFrame.pu32[2];
3121 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3122 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
3123 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
3124 | X86_EFL_ID;
3125 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3126 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3127 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
3128 }
3129 else
3130 {
3131 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3132 if (rcStrict != VINF_SUCCESS)
3133 return rcStrict;
3134 uNewEip = uFrame.pu16[0];
3135 uNewCs = uFrame.pu16[1];
3136 uNewFlags = uFrame.pu16[2];
3137 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3138 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
3139 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
3140 /** @todo The intel pseudo code does not indicate what happens to
3141 * reserved flags. We just ignore them. */
3142 /* Ancient CPU adjustments: See iemCImpl_popf. */
3143 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
3144 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
3145 }
3146 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
3147 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3148 { /* extremely likely */ }
3149 else
3150 return rcStrict;
3151
3152 /** @todo Check how this is supposed to work if sp=0xfffe. */
3153 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
3154 uNewCs, uNewEip, uNewFlags, uNewRsp));
3155
3156 /*
3157 * Check the limit of the new EIP.
3158 */
3159 /** @todo Only the AMD pseudo code check the limit here, what's
3160 * right? */
3161 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
3162 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
3163
3164 /*
3165 * V8086 checks and flag adjustments
3166 */
3167 if (Efl.Bits.u1VM)
3168 {
3169 if (Efl.Bits.u2IOPL == 3)
3170 {
3171 /* Preserve IOPL and clear RF. */
3172 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3173 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3174 }
3175 else if ( enmEffOpSize == IEMMODE_16BIT
3176 && ( !(uNewFlags & X86_EFL_IF)
3177 || !Efl.Bits.u1VIP )
3178 && !(uNewFlags & X86_EFL_TF) )
3179 {
3180 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3181 uNewFlags &= ~X86_EFL_VIF;
3182 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3183 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3184 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3185 }
3186 else
3187 return iemRaiseGeneralProtectionFault0(pVCpu);
3188 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3189 }
3190
3191 /*
3192 * Commit the operation.
3193 */
3194#ifdef DBGFTRACE_ENABLED
3195 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3196 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3197#endif
3198 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3199 pVCpu->cpum.GstCtx.rip = uNewEip;
3200 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3201 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3202 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3203 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3204 /** @todo do we load attribs and limit as well? */
3205 Assert(uNewFlags & X86_EFL_1);
3206 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3207
3208 /* Flush the prefetch buffer. */
3209 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo can do light flush in real mode at least */
3210
3211/** @todo single stepping */
3212 return VINF_SUCCESS;
3213}
3214
3215
3216/**
3217 * Loads a segment register when entering V8086 mode.
3218 *
3219 * @param pSReg The segment register.
3220 * @param uSeg The segment to load.
3221 */
3222static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3223{
3224 pSReg->Sel = uSeg;
3225 pSReg->ValidSel = uSeg;
3226 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3227 pSReg->u64Base = (uint32_t)uSeg << 4;
3228 pSReg->u32Limit = 0xffff;
3229 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3230 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3231 * IRET'ing to V8086. */
3232}
3233
3234
3235/**
3236 * Implements iret for protected mode returning to V8086 mode.
3237 *
3238 * @param uNewEip The new EIP.
3239 * @param uNewCs The new CS.
3240 * @param uNewFlags The new EFLAGS.
3241 * @param uNewRsp The RSP after the initial IRET frame.
3242 *
3243 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3244 */
3245IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3246{
3247 RT_NOREF_PV(cbInstr);
3248 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3249
3250 /*
3251 * Pop the V8086 specific frame bits off the stack.
3252 */
3253 VBOXSTRICTRC rcStrict;
3254 RTCPTRUNION uFrame;
3255 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, uNewRsp);
3256 if (rcStrict != VINF_SUCCESS)
3257 return rcStrict;
3258 uint32_t uNewEsp = uFrame.pu32[0];
3259 uint16_t uNewSs = uFrame.pu32[1];
3260 uint16_t uNewEs = uFrame.pu32[2];
3261 uint16_t uNewDs = uFrame.pu32[3];
3262 uint16_t uNewFs = uFrame.pu32[4];
3263 uint16_t uNewGs = uFrame.pu32[5];
3264 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3265 if (rcStrict != VINF_SUCCESS)
3266 return rcStrict;
3267
3268 /*
3269 * Commit the operation.
3270 */
3271 uNewFlags &= X86_EFL_LIVE_MASK;
3272 uNewFlags |= X86_EFL_RA1_MASK;
3273#ifdef DBGFTRACE_ENABLED
3274 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3275 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3276#endif
3277 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3278
3279 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3280 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3281 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3282 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3283 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3284 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3285 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3286 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3287 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3288 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
3289 | (3 << IEM_F_X86_CPL_SHIFT)
3290 | IEM_F_MODE_X86_16BIT_PROT_V86;
3291
3292 /* Flush the prefetch buffer. */
3293 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3294
3295/** @todo single stepping */
3296 return VINF_SUCCESS;
3297}
3298
3299
3300/**
3301 * Implements iret for protected mode returning via a nested task.
3302 *
3303 * @param enmEffOpSize The effective operand size.
3304 */
3305IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3306{
3307 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3308#ifndef IEM_IMPLEMENTS_TASKSWITCH
3309 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3310#else
3311 RT_NOREF_PV(enmEffOpSize);
3312
3313 /*
3314 * Read the segment selector in the link-field of the current TSS.
3315 */
3316 RTSEL uSelRet;
3317 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3318 if (rcStrict != VINF_SUCCESS)
3319 return rcStrict;
3320
3321 /*
3322 * Fetch the returning task's TSS descriptor from the GDT.
3323 */
3324 if (uSelRet & X86_SEL_LDT)
3325 {
3326 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3327 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3328 }
3329
3330 IEMSELDESC TssDesc;
3331 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3332 if (rcStrict != VINF_SUCCESS)
3333 return rcStrict;
3334
3335 if (TssDesc.Legacy.Gate.u1DescType)
3336 {
3337 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3338 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3339 }
3340
3341 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3342 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3343 {
3344 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3345 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3346 }
3347
3348 if (!TssDesc.Legacy.Gate.u1Present)
3349 {
3350 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3351 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3352 }
3353
3354 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3355 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3356 0 /* uCr2 */, uSelRet, &TssDesc);
3357#endif
3358}
3359
3360
3361/**
3362 * Implements iret for protected mode
3363 *
3364 * @param enmEffOpSize The effective operand size.
3365 */
3366IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3367{
3368 NOREF(cbInstr);
3369 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3370
3371 /*
3372 * Nested task return.
3373 */
3374 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3375 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3376
3377 /*
3378 * Normal return.
3379 *
3380 * Do the stack bits, but don't commit RSP before everything checks
3381 * out right.
3382 */
3383 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3384 VBOXSTRICTRC rcStrict;
3385 RTCPTRUNION uFrame;
3386 uint16_t uNewCs;
3387 uint32_t uNewEip;
3388 uint32_t uNewFlags;
3389 uint64_t uNewRsp;
3390 if (enmEffOpSize == IEMMODE_32BIT)
3391 {
3392 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
3393 if (rcStrict != VINF_SUCCESS)
3394 return rcStrict;
3395 uNewEip = uFrame.pu32[0];
3396 uNewCs = (uint16_t)uFrame.pu32[1];
3397 uNewFlags = uFrame.pu32[2];
3398 }
3399 else
3400 {
3401 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3402 if (rcStrict != VINF_SUCCESS)
3403 return rcStrict;
3404 uNewEip = uFrame.pu16[0];
3405 uNewCs = uFrame.pu16[1];
3406 uNewFlags = uFrame.pu16[2];
3407 }
3408 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3409 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3410 { /* extremely likely */ }
3411 else
3412 return rcStrict;
3413 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, IEM_GET_CPL(pVCpu)));
3414
3415 /*
3416 * We're hopefully not returning to V8086 mode...
3417 */
3418 if ( (uNewFlags & X86_EFL_VM)
3419 && IEM_GET_CPL(pVCpu) == 0)
3420 {
3421 Assert(enmEffOpSize == IEMMODE_32BIT);
3422 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3423 }
3424
3425 /*
3426 * Protected mode.
3427 */
3428 /* Read the CS descriptor. */
3429 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3430 {
3431 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3432 return iemRaiseGeneralProtectionFault0(pVCpu);
3433 }
3434
3435 IEMSELDESC DescCS;
3436 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3437 if (rcStrict != VINF_SUCCESS)
3438 {
3439 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3440 return rcStrict;
3441 }
3442
3443 /* Must be a code descriptor. */
3444 if (!DescCS.Legacy.Gen.u1DescType)
3445 {
3446 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3447 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3448 }
3449 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3450 {
3451 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3452 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3453 }
3454
3455 /* Privilege checks. */
3456 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3457 {
3458 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3459 {
3460 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3461 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3462 }
3463 }
3464 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3465 {
3466 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3467 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3468 }
3469 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3470 {
3471 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, IEM_GET_CPL(pVCpu)));
3472 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3473 }
3474
3475 /* Present? */
3476 if (!DescCS.Legacy.Gen.u1Present)
3477 {
3478 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3479 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3480 }
3481
3482 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3483
3484 /*
3485 * Return to outer level?
3486 */
3487 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
3488 {
3489 uint16_t uNewSS;
3490 uint32_t uNewESP;
3491 if (enmEffOpSize == IEMMODE_32BIT)
3492 {
3493 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, uNewRsp);
3494 if (rcStrict != VINF_SUCCESS)
3495 return rcStrict;
3496/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3497 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3498 * bit of the popped SS selector it turns out. */
3499 uNewESP = uFrame.pu32[0];
3500 uNewSS = (uint16_t)uFrame.pu32[1];
3501 }
3502 else
3503 {
3504 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, uNewRsp);
3505 if (rcStrict != VINF_SUCCESS)
3506 return rcStrict;
3507 uNewESP = uFrame.pu16[0];
3508 uNewSS = uFrame.pu16[1];
3509 }
3510 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3511 if (rcStrict != VINF_SUCCESS)
3512 return rcStrict;
3513 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3514
3515 /* Read the SS descriptor. */
3516 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3517 {
3518 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3519 return iemRaiseGeneralProtectionFault0(pVCpu);
3520 }
3521
3522 IEMSELDESC DescSS;
3523 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3524 if (rcStrict != VINF_SUCCESS)
3525 {
3526 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3527 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3528 return rcStrict;
3529 }
3530
3531 /* Privilege checks. */
3532 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3533 {
3534 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3535 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3536 }
3537 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3538 {
3539 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3540 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3541 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3542 }
3543
3544 /* Must be a writeable data segment descriptor. */
3545 if (!DescSS.Legacy.Gen.u1DescType)
3546 {
3547 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3548 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3549 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3550 }
3551 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3552 {
3553 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3554 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3555 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3556 }
3557
3558 /* Present? */
3559 if (!DescSS.Legacy.Gen.u1Present)
3560 {
3561 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3562 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3563 }
3564
3565 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3566
3567 /* Check EIP. */
3568 if (uNewEip > cbLimitCS)
3569 {
3570 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3571 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3572 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3573 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3574 }
3575
3576 /*
3577 * Commit the changes, marking CS and SS accessed first since
3578 * that may fail.
3579 */
3580 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3581 {
3582 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3583 if (rcStrict != VINF_SUCCESS)
3584 return rcStrict;
3585 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3586 }
3587 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3588 {
3589 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3590 if (rcStrict != VINF_SUCCESS)
3591 return rcStrict;
3592 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3593 }
3594
3595 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3596 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3597 if (enmEffOpSize != IEMMODE_16BIT)
3598 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3599 if (IEM_GET_CPL(pVCpu) == 0)
3600 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3601 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3602 fEFlagsMask |= X86_EFL_IF;
3603 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3604 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3605 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3606 fEFlagsNew &= ~fEFlagsMask;
3607 fEFlagsNew |= uNewFlags & fEFlagsMask;
3608#ifdef DBGFTRACE_ENABLED
3609 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3610 IEM_GET_CPL(pVCpu), uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3611 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3612#endif
3613
3614 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3615 pVCpu->cpum.GstCtx.rip = uNewEip;
3616 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3617 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3618 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3619 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3620 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3621 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3622
3623 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3624 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3625 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3626 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3627 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3628 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3629 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3630 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3631 else
3632 pVCpu->cpum.GstCtx.rsp = uNewESP;
3633
3634 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3635 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3636 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3637 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3638
3639 iemRecalcExecModeAndCplFlags(pVCpu);
3640
3641 /* Done! */
3642
3643 }
3644 /*
3645 * Return to the same level.
3646 */
3647 else
3648 {
3649 /* Check EIP. */
3650 if (uNewEip > cbLimitCS)
3651 {
3652 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3653 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3654 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3655 }
3656
3657 /*
3658 * Commit the changes, marking CS first since it may fail.
3659 */
3660 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3661 {
3662 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3663 if (rcStrict != VINF_SUCCESS)
3664 return rcStrict;
3665 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3666 }
3667
3668 X86EFLAGS NewEfl;
3669 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3670 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3671 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3672 if (enmEffOpSize != IEMMODE_16BIT)
3673 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3674 if (IEM_GET_CPL(pVCpu) == 0)
3675 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3676 else if (IEM_GET_CPL(pVCpu) <= NewEfl.Bits.u2IOPL)
3677 fEFlagsMask |= X86_EFL_IF;
3678 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3679 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3680 NewEfl.u &= ~fEFlagsMask;
3681 NewEfl.u |= fEFlagsMask & uNewFlags;
3682#ifdef DBGFTRACE_ENABLED
3683 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3684 IEM_GET_CPL(pVCpu), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3685 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3686#endif
3687
3688 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3689 pVCpu->cpum.GstCtx.rip = uNewEip;
3690 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3691 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3692 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3693 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3694 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3695 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3696 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3697 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3698 else
3699 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3700
3701 iemRecalcExecModeAndCplFlags(pVCpu);
3702
3703 /* Done! */
3704 }
3705
3706 /* Flush the prefetch buffer. */
3707 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if same ring? */
3708
3709/** @todo single stepping */
3710 return VINF_SUCCESS;
3711}
3712
3713
3714/**
3715 * Implements iret for long mode
3716 *
3717 * @param enmEffOpSize The effective operand size.
3718 */
3719IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3720{
3721 NOREF(cbInstr);
3722
3723 /*
3724 * Nested task return is not supported in long mode.
3725 */
3726 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3727 {
3728 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3729 return iemRaiseGeneralProtectionFault0(pVCpu);
3730 }
3731
3732 /*
3733 * Normal return.
3734 *
3735 * Do the stack bits, but don't commit RSP before everything checks
3736 * out right.
3737 */
3738 VBOXSTRICTRC rcStrict;
3739 RTCPTRUNION uFrame;
3740 uint64_t uNewRip;
3741 uint16_t uNewCs;
3742 uint16_t uNewSs;
3743 uint32_t uNewFlags;
3744 uint64_t uNewRsp;
3745 if (enmEffOpSize == IEMMODE_64BIT)
3746 {
3747 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
3748 if (rcStrict != VINF_SUCCESS)
3749 return rcStrict;
3750 uNewRip = uFrame.pu64[0];
3751 uNewCs = (uint16_t)uFrame.pu64[1];
3752 uNewFlags = (uint32_t)uFrame.pu64[2];
3753 uNewRsp = uFrame.pu64[3];
3754 uNewSs = (uint16_t)uFrame.pu64[4];
3755 }
3756 else if (enmEffOpSize == IEMMODE_32BIT)
3757 {
3758 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
3759 if (rcStrict != VINF_SUCCESS)
3760 return rcStrict;
3761 uNewRip = uFrame.pu32[0];
3762 uNewCs = (uint16_t)uFrame.pu32[1];
3763 uNewFlags = uFrame.pu32[2];
3764 uNewRsp = uFrame.pu32[3];
3765 uNewSs = (uint16_t)uFrame.pu32[4];
3766 }
3767 else
3768 {
3769 Assert(enmEffOpSize == IEMMODE_16BIT);
3770 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
3771 if (rcStrict != VINF_SUCCESS)
3772 return rcStrict;
3773 uNewRip = uFrame.pu16[0];
3774 uNewCs = uFrame.pu16[1];
3775 uNewFlags = uFrame.pu16[2];
3776 uNewRsp = uFrame.pu16[3];
3777 uNewSs = uFrame.pu16[4];
3778 }
3779 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3780 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3781 { /* extremely like */ }
3782 else
3783 return rcStrict;
3784 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3785
3786 /*
3787 * Check stuff.
3788 */
3789 /* Read the CS descriptor. */
3790 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3791 {
3792 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3793 return iemRaiseGeneralProtectionFault0(pVCpu);
3794 }
3795
3796 IEMSELDESC DescCS;
3797 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3798 if (rcStrict != VINF_SUCCESS)
3799 {
3800 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3801 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3802 return rcStrict;
3803 }
3804
3805 /* Must be a code descriptor. */
3806 if ( !DescCS.Legacy.Gen.u1DescType
3807 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3808 {
3809 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3810 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3811 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3812 }
3813
3814 /* Privilege checks. */
3815 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3816 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3817 {
3818 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3819 {
3820 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3821 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3822 }
3823 }
3824 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3825 {
3826 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3827 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3828 }
3829 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3830 {
3831 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
3832 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3833 }
3834
3835 /* Present? */
3836 if (!DescCS.Legacy.Gen.u1Present)
3837 {
3838 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3839 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3840 }
3841
3842 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3843
3844 /* Read the SS descriptor. */
3845 IEMSELDESC DescSS;
3846 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3847 {
3848 if ( !DescCS.Legacy.Gen.u1Long
3849 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3850 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3851 {
3852 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3853 return iemRaiseGeneralProtectionFault0(pVCpu);
3854 }
3855 /* Make sure SS is sensible, marked as accessed etc. */
3856 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3857 }
3858 else
3859 {
3860 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3861 if (rcStrict != VINF_SUCCESS)
3862 {
3863 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3864 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3865 return rcStrict;
3866 }
3867 }
3868
3869 /* Privilege checks. */
3870 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3871 {
3872 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3873 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3874 }
3875
3876 uint32_t cbLimitSs;
3877 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3878 cbLimitSs = UINT32_MAX;
3879 else
3880 {
3881 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3882 {
3883 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3884 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3885 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3886 }
3887
3888 /* Must be a writeable data segment descriptor. */
3889 if (!DescSS.Legacy.Gen.u1DescType)
3890 {
3891 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3892 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3894 }
3895 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3896 {
3897 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3898 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3899 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3900 }
3901
3902 /* Present? */
3903 if (!DescSS.Legacy.Gen.u1Present)
3904 {
3905 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3906 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3907 }
3908 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3909 }
3910
3911 /* Check EIP. */
3912 if (DescCS.Legacy.Gen.u1Long)
3913 {
3914 if (!IEM_IS_CANONICAL(uNewRip))
3915 {
3916 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3917 uNewCs, uNewRip, uNewSs, uNewRsp));
3918 return iemRaiseNotCanonical(pVCpu);
3919 }
3920/** @todo check the location of this... Testcase. */
3921 if (RT_LIKELY(!DescCS.Legacy.Gen.u1DefBig))
3922 { /* likely */ }
3923 else
3924 {
3925 Log(("iret %04x:%016RX64/%04x:%016RX64 -> both L and D are set -> #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3926 return iemRaiseGeneralProtectionFault0(pVCpu);
3927 }
3928 }
3929 else
3930 {
3931 if (uNewRip > cbLimitCS)
3932 {
3933 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3934 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3935 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3936 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3937 }
3938 }
3939
3940 /*
3941 * Commit the changes, marking CS and SS accessed first since
3942 * that may fail.
3943 */
3944 /** @todo where exactly are these actually marked accessed by a real CPU? */
3945 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3946 {
3947 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3948 if (rcStrict != VINF_SUCCESS)
3949 return rcStrict;
3950 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3951 }
3952 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3953 {
3954 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3955 if (rcStrict != VINF_SUCCESS)
3956 return rcStrict;
3957 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3958 }
3959
3960 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3961 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3962 if (enmEffOpSize != IEMMODE_16BIT)
3963 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3964 if (IEM_GET_CPL(pVCpu) == 0)
3965 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3966 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3967 fEFlagsMask |= X86_EFL_IF;
3968 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3969 fEFlagsNew &= ~fEFlagsMask;
3970 fEFlagsNew |= uNewFlags & fEFlagsMask;
3971#ifdef DBGFTRACE_ENABLED
3972 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3973 IEM_GET_CPL(pVCpu), uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3974#endif
3975
3976 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3977 pVCpu->cpum.GstCtx.rip = uNewRip;
3978 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3979 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3980 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3981 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3982 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3983 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3984 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3985 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3986 else
3987 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3988 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3989 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3990 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3991 {
3992 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3993 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3994 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3995 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3996 Log2(("iretq new SS: NULL\n"));
3997 }
3998 else
3999 {
4000 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4001 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
4002 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
4003 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
4004 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4005 }
4006
4007 if (IEM_GET_CPL(pVCpu) != uNewCpl)
4008 {
4009 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
4010 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
4011 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
4012 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
4013 }
4014
4015 iemRecalcExecModeAndCplFlags(pVCpu);
4016
4017 /* Flush the prefetch buffer. */
4018 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if the ring + mode doesn't change */
4019
4020/** @todo single stepping */
4021 return VINF_SUCCESS;
4022}
4023
4024
4025/**
4026 * Implements iret.
4027 *
4028 * @param enmEffOpSize The effective operand size.
4029 */
4030IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
4031{
4032 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
4033
4034 if (!IEM_IS_IN_GUEST(pVCpu))
4035 { /* probable */ }
4036#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4037 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4038 {
4039 /*
4040 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
4041 * of this IRET instruction. We need to provide this information as part of some
4042 * VM-exits.
4043 *
4044 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
4045 */
4046 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
4047 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
4048 else
4049 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
4050
4051 /*
4052 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
4053 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
4054 */
4055 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
4056 fBlockingNmi = false;
4057
4058 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
4059 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
4060 }
4061#endif
4062 /*
4063 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
4064 * The NMI is still held pending (which I assume means blocking of further NMIs
4065 * is in effect).
4066 *
4067 * See AMD spec. 15.9 "Instruction Intercepts".
4068 * See AMD spec. 15.21.9 "NMI Support".
4069 */
4070 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
4071 {
4072 Log(("iret: Guest intercept -> #VMEXIT\n"));
4073 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
4074 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4075 }
4076
4077 /*
4078 * Clear NMI blocking, if any, before causing any further exceptions.
4079 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
4080 */
4081 if (fBlockingNmi)
4082 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
4083
4084 /*
4085 * Call a mode specific worker.
4086 */
4087 VBOXSTRICTRC rcStrict;
4088 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4089 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
4090 else
4091 {
4092 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
4093 if (IEM_IS_64BIT_CODE(pVCpu))
4094 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
4095 else
4096 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
4097 }
4098
4099#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4100 /*
4101 * Clear NMI unblocking IRET state with the completion of IRET.
4102 */
4103 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4104 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
4105#endif
4106 return rcStrict;
4107}
4108
4109
4110static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4111{
4112 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4113
4114 pHid->Sel = uSel;
4115 pHid->ValidSel = uSel;
4116 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4117}
4118
4119
4120static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
4121{
4122 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4123
4124 /* The base is in the first three bytes. */
4125 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
4126 /* The attributes are in the fourth byte. */
4127 pHid->Attr.u = pbMem[3];
4128 pHid->Attr.u &= ~(X86DESCATTR_L | X86DESCATTR_D); /* (just to be on the safe side) */
4129 /* The limit is in the last two bytes. */
4130 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
4131}
4132
4133
4134/**
4135 * Implements 286 LOADALL (286 CPUs only).
4136 */
4137IEM_CIMPL_DEF_0(iemCImpl_loadall286)
4138{
4139 NOREF(cbInstr);
4140
4141 /* Data is loaded from a buffer at 800h. No checks are done on the
4142 * validity of loaded state.
4143 *
4144 * LOADALL only loads the internal CPU state, it does not access any
4145 * GDT, LDT, or similar tables.
4146 */
4147
4148 if (IEM_GET_CPL(pVCpu) != 0)
4149 {
4150 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4151 return iemRaiseGeneralProtectionFault0(pVCpu);
4152 }
4153
4154 uint8_t const *pbMem = NULL;
4155 uint16_t const *pa16Mem;
4156 uint8_t const *pa8Mem;
4157 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
4158 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
4159 if (rcStrict != VINF_SUCCESS)
4160 return rcStrict;
4161
4162 /* The MSW is at offset 0x06. */
4163 pa16Mem = (uint16_t const *)(pbMem + 0x06);
4164 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
4165 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4166 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4167 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
4168
4169 CPUMSetGuestCR0(pVCpu, uNewCr0);
4170 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
4171
4172 /* Inform PGM if mode changed. */
4173 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
4174 {
4175 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
4176 AssertRCReturn(rc, rc);
4177 /* ignore informational status codes */
4178 }
4179 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
4180 false /* fForce */);
4181
4182 /* TR selector is at offset 0x16. */
4183 pa16Mem = (uint16_t const *)(pbMem + 0x16);
4184 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
4185 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
4186 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
4187
4188 /* Followed by FLAGS... */
4189 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
4190 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
4191
4192 /* LDT is at offset 0x1C. */
4193 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
4194 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
4195 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
4196 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4197
4198 /* Segment registers are at offset 0x1E. */
4199 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
4200 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
4201 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
4202 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
4203 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
4204
4205 /* GPRs are at offset 0x26. */
4206 pa16Mem = (uint16_t const *)(pbMem + 0x26);
4207 pVCpu->cpum.GstCtx.di = pa16Mem[0];
4208 pVCpu->cpum.GstCtx.si = pa16Mem[1];
4209 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
4210 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
4211 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
4212 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
4213 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
4214 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
4215
4216 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4217 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4218 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4219 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4220 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4221
4222 /* GDTR contents are at offset 0x4E, 6 bytes. */
4223 RTGCPHYS GCPtrBase;
4224 uint16_t cbLimit;
4225 pa8Mem = pbMem + 0x4E;
4226 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4227 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4228 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4229 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4230
4231 /* IDTR contents are at offset 0x5A, 6 bytes. */
4232 pa8Mem = pbMem + 0x5A;
4233 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4234 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4235 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4236
4237 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4238 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4239 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4240 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4241 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4242 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4243
4244 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4245 if (rcStrict != VINF_SUCCESS)
4246 return rcStrict;
4247
4248 /*
4249 * The CPL may change and protected mode may change enabled. It is taken
4250 * from the "DPL fields of the SS and CS descriptor caches" but there is no
4251 * word as to what happens if those are not identical (probably bad things).
4252 */
4253 iemRecalcExecModeAndCplFlags(pVCpu);
4254 Assert(IEM_IS_16BIT_CODE(pVCpu));
4255
4256 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4257
4258 /* Flush the prefetch buffer. */
4259 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4260
4261/** @todo single stepping */
4262 return rcStrict;
4263}
4264
4265
4266/**
4267 * Implements SYSCALL (AMD and Intel64).
4268 */
4269IEM_CIMPL_DEF_0(iemCImpl_syscall)
4270{
4271 /** @todo hack, LOADALL should be decoded as such on a 286. */
4272 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4273 return iemCImpl_loadall286(pVCpu, cbInstr);
4274
4275 /*
4276 * Check preconditions.
4277 *
4278 * Note that CPUs described in the documentation may load a few odd values
4279 * into CS and SS than we allow here. This has yet to be checked on real
4280 * hardware.
4281 */
4282 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4283 {
4284 Log(("syscall: Not enabled in EFER -> #UD\n"));
4285 return iemRaiseUndefinedOpcode(pVCpu);
4286 }
4287 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4288 {
4289 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4290 return iemRaiseGeneralProtectionFault0(pVCpu);
4291 }
4292 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4293 {
4294 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4295 return iemRaiseUndefinedOpcode(pVCpu);
4296 }
4297
4298 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4299
4300 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4301 /** @todo what about LDT selectors? Shouldn't matter, really. */
4302 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4303 uint16_t uNewSs = uNewCs + 8;
4304 if (uNewCs == 0 || uNewSs == 0)
4305 {
4306 /** @todo Neither Intel nor AMD document this check. */
4307 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4308 return iemRaiseGeneralProtectionFault0(pVCpu);
4309 }
4310
4311 /* Long mode and legacy mode differs. */
4312 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4313 {
4314 uint64_t uNewRip = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4315
4316 /* This test isn't in the docs, but I'm not trusting the guys writing
4317 the MSRs to have validated the values as canonical like they should. */
4318 if (!IEM_IS_CANONICAL(uNewRip))
4319 {
4320 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4321 Log(("syscall: New RIP not canonical -> #UD\n"));
4322 return iemRaiseUndefinedOpcode(pVCpu);
4323 }
4324
4325 /*
4326 * Commit it.
4327 */
4328 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4329 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4330 pVCpu->cpum.GstCtx.rip = uNewRip;
4331
4332 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4333 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4334 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4335 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4336
4337 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4338 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4339
4340 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4341 | IEM_F_MODE_X86_64BIT;
4342 }
4343 else
4344 {
4345 /*
4346 * Commit it.
4347 */
4348 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4349 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4350 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4351 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4352
4353 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4354 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4355
4356 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4357 | IEM_F_MODE_X86_32BIT_PROT
4358 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4359 }
4360 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4361 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4362 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4363 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4364 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4365
4366 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4367 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4368 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4369 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4370 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4371
4372 /* Flush the prefetch buffer. */
4373 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4374
4375/** @todo single step */
4376 return VINF_SUCCESS;
4377}
4378
4379
4380/**
4381 * Implements SYSRET (AMD and Intel64).
4382 *
4383 * @param enmEffOpSize The effective operand size.
4384 */
4385IEM_CIMPL_DEF_1(iemCImpl_sysret, IEMMODE, enmEffOpSize)
4386
4387{
4388 RT_NOREF_PV(cbInstr);
4389
4390 /*
4391 * Check preconditions.
4392 *
4393 * Note that CPUs described in the documentation may load a few odd values
4394 * into CS and SS than we allow here. This has yet to be checked on real
4395 * hardware.
4396 */
4397 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4398 {
4399 Log(("sysret: Not enabled in EFER -> #UD\n"));
4400 return iemRaiseUndefinedOpcode(pVCpu);
4401 }
4402 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4403 {
4404 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4405 return iemRaiseUndefinedOpcode(pVCpu);
4406 }
4407 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4408 {
4409 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4410 return iemRaiseGeneralProtectionFault0(pVCpu);
4411 }
4412 if (IEM_GET_CPL(pVCpu) != 0)
4413 {
4414 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4415 return iemRaiseGeneralProtectionFault0(pVCpu);
4416 }
4417
4418 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4419
4420 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4421 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4422 uint16_t uNewSs = uNewCs + 8;
4423 if (enmEffOpSize == IEMMODE_64BIT)
4424 uNewCs += 16;
4425 if (uNewCs == 0 || uNewSs == 0)
4426 {
4427 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4428 return iemRaiseGeneralProtectionFault0(pVCpu);
4429 }
4430
4431 /*
4432 * Commit it.
4433 */
4434 bool f32Bit = true;
4435 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4436 {
4437 if (enmEffOpSize == IEMMODE_64BIT)
4438 {
4439 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4440 /* Note! We disregard intel manual regarding the RCX canonical
4441 check, ask intel+xen why AMD doesn't do it. */
4442 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4443 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4444 | (3 << X86DESCATTR_DPL_SHIFT);
4445 f32Bit = false;
4446 }
4447 else
4448 {
4449 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4450 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4451 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4452 | (3 << X86DESCATTR_DPL_SHIFT);
4453 }
4454 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4455 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4456 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4457 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4458 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4459 }
4460 else
4461 {
4462 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4463 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4464 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4465 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4466 | (3 << X86DESCATTR_DPL_SHIFT);
4467 }
4468 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4469 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4470 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4471 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4472 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4473
4474 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4475 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4476 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4477 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4478 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4479 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4480 * on sysret. */
4481 /** @todo intel documents SS.BASE and SS.LIMIT as being set as well as the
4482 * TYPE, S, DPL, P, B and G flag bits. */
4483
4484 if (!f32Bit)
4485 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4486 | (3 << IEM_F_X86_CPL_SHIFT)
4487 | IEM_F_MODE_X86_64BIT;
4488 else
4489 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4490 | (3 << IEM_F_X86_CPL_SHIFT)
4491 | IEM_F_MODE_X86_32BIT_PROT
4492 /** @todo sort out the SS.BASE/LIM/ATTR claim by AMD and maybe we can switch to
4493 * iemCalc32BitFlatIndicatorDsEs and move this up into the above branch. */
4494 | iemCalc32BitFlatIndicator(pVCpu);
4495
4496 /* Flush the prefetch buffer. */
4497 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4498
4499/** @todo single step */
4500 return VINF_SUCCESS;
4501}
4502
4503
4504/**
4505 * Implements SYSENTER (Intel, 32-bit AMD).
4506 */
4507IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4508{
4509 RT_NOREF(cbInstr);
4510
4511 /*
4512 * Check preconditions.
4513 *
4514 * Note that CPUs described in the documentation may load a few odd values
4515 * into CS and SS than we allow here. This has yet to be checked on real
4516 * hardware.
4517 */
4518 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4519 {
4520 Log(("sysenter: not supported -=> #UD\n"));
4521 return iemRaiseUndefinedOpcode(pVCpu);
4522 }
4523 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4524 {
4525 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4526 return iemRaiseGeneralProtectionFault0(pVCpu);
4527 }
4528 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4529 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4530 {
4531 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4532 return iemRaiseUndefinedOpcode(pVCpu);
4533 }
4534 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4535 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4536 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4537 {
4538 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4539 return iemRaiseGeneralProtectionFault0(pVCpu);
4540 }
4541
4542 /* This test isn't in the docs, it's just a safeguard against missing
4543 canonical checks when writing the registers. */
4544 if (RT_LIKELY( !fIsLongMode
4545 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4546 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4547 { /* likely */ }
4548 else
4549 {
4550 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4551 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4552 return iemRaiseUndefinedOpcode(pVCpu);
4553 }
4554
4555/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4556
4557 /*
4558 * Update registers and commit.
4559 */
4560 if (fIsLongMode)
4561 {
4562 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4563 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4564 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4565 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4566 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4567 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4568 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4569 | IEM_F_MODE_X86_64BIT;
4570 }
4571 else
4572 {
4573 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, (uint32_t)pVCpu->cpum.GstCtx.rip,
4574 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4575 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4576 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4577 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4578 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4579 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4580 | IEM_F_MODE_X86_32BIT_PROT
4581 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4582 }
4583 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4584 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4585 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4586 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4587 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4588
4589 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4590 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4591 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4592 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4593 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4594 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4595 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4596
4597 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4598 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4599 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4600
4601 /* Flush the prefetch buffer. */
4602 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4603
4604/** @todo single stepping */
4605 return VINF_SUCCESS;
4606}
4607
4608
4609/**
4610 * Implements SYSEXIT (Intel, 32-bit AMD).
4611 *
4612 * @param enmEffOpSize The effective operand size.
4613 */
4614IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4615{
4616 RT_NOREF(cbInstr);
4617
4618 /*
4619 * Check preconditions.
4620 *
4621 * Note that CPUs described in the documentation may load a few odd values
4622 * into CS and SS than we allow here. This has yet to be checked on real
4623 * hardware.
4624 */
4625 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4626 {
4627 Log(("sysexit: not supported -=> #UD\n"));
4628 return iemRaiseUndefinedOpcode(pVCpu);
4629 }
4630 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4631 {
4632 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4633 return iemRaiseGeneralProtectionFault0(pVCpu);
4634 }
4635 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4636 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4637 {
4638 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4639 return iemRaiseUndefinedOpcode(pVCpu);
4640 }
4641 if (IEM_GET_CPL(pVCpu) != 0)
4642 {
4643 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4644 return iemRaiseGeneralProtectionFault0(pVCpu);
4645 }
4646 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4647 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4648 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4649 {
4650 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4651 return iemRaiseGeneralProtectionFault0(pVCpu);
4652 }
4653
4654 /*
4655 * Update registers and commit.
4656 */
4657 if (enmEffOpSize == IEMMODE_64BIT)
4658 {
4659 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4660 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4661 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4662 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4663 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4664 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4665 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4666 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4667 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4668 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4669
4670 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4671 | (3 << IEM_F_X86_CPL_SHIFT)
4672 | IEM_F_MODE_X86_64BIT;
4673 }
4674 else
4675 {
4676 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4677 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4678 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4679 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4680 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4681 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4682 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4683 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4684 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4685 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4686
4687 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4688 | (3 << IEM_F_X86_CPL_SHIFT)
4689 | IEM_F_MODE_X86_32BIT_PROT
4690 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4691 }
4692 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4693 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4694 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4695
4696 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4697 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4698 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4699 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4700 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4701 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4702
4703/** @todo single stepping */
4704
4705 /* Flush the prefetch buffer. */
4706 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4707
4708 return VINF_SUCCESS;
4709}
4710
4711
4712/**
4713 * Completes a MOV SReg,XXX or POP SReg instruction.
4714 *
4715 * When not modifying SS or when we're already in an interrupt shadow we
4716 * can update RIP and finish the instruction the normal way.
4717 *
4718 * Otherwise, the MOV/POP SS interrupt shadow that we now enable will block
4719 * both TF and DBx events. The TF will be ignored while the DBx ones will
4720 * be delayed till the next instruction boundrary. For more details see
4721 * @sdmv3{077,200,6.8.3,Masking Exceptions and Interrupts When Switching Stacks}.
4722 */
4723DECLINLINE(VBOXSTRICTRC) iemCImpl_LoadSRegFinish(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iSegReg)
4724{
4725 if (iSegReg != X86_SREG_SS || CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
4726 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4727
4728 iemRegAddToRip(pVCpu, cbInstr);
4729 pVCpu->cpum.GstCtx.eflags.uBoth &= ~X86_EFL_RF; /* Shadow int isn't set and DRx is delayed, so only clear RF. */
4730 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4731
4732 return VINF_SUCCESS;
4733}
4734
4735
4736/**
4737 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4738 *
4739 * @param pVCpu The cross context virtual CPU structure of the calling
4740 * thread.
4741 * @param iSegReg The segment register number (valid).
4742 * @param uSel The new selector value.
4743 */
4744static VBOXSTRICTRC iemCImpl_LoadSRegWorker(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4745{
4746 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4747 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4748 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4749
4750 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4751
4752 /*
4753 * Real mode and V8086 mode are easy.
4754 */
4755 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4756 {
4757 *pSel = uSel;
4758 pHid->u64Base = (uint32_t)uSel << 4;
4759 pHid->ValidSel = uSel;
4760 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4761#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4762 /** @todo Does the CPU actually load limits and attributes in the
4763 * real/V8086 mode segment load case? It doesn't for CS in far
4764 * jumps... Affects unreal mode. */
4765 pHid->u32Limit = 0xffff;
4766 pHid->Attr.u = 0;
4767 pHid->Attr.n.u1Present = 1;
4768 pHid->Attr.n.u1DescType = 1;
4769 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4770 ? X86_SEL_TYPE_RW
4771 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4772#endif
4773
4774 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
4775 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
4776 { /* likely */ }
4777 else if (uSel != 0)
4778 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4779 else
4780 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4781 | iemCalc32BitFlatIndicator(pVCpu);
4782 }
4783 /*
4784 * Protected / long mode - null segment.
4785 *
4786 * Check if it's a null segment selector value first, that's OK for DS, ES,
4787 * FS and GS. If not null, then we have to load and parse the descriptor.
4788 */
4789 else if (!(uSel & X86_SEL_MASK_OFF_RPL))
4790 {
4791 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4792 if (iSegReg == X86_SREG_SS)
4793 {
4794 /* In 64-bit kernel mode, the stack can be 0 because of the way
4795 interrupts are dispatched. AMD seems to have a slighly more
4796 relaxed relationship to SS.RPL than intel does. */
4797 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4798 if ( !IEM_IS_64BIT_CODE(pVCpu)
4799 || IEM_GET_CPL(pVCpu) > 2
4800 || ( uSel != IEM_GET_CPL(pVCpu)
4801 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4802 {
4803 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4804 return iemRaiseGeneralProtectionFault0(pVCpu);
4805 }
4806 }
4807
4808 *pSel = uSel; /* Not RPL, remember :-) */
4809 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4810 if (iSegReg == X86_SREG_SS)
4811 pHid->Attr.u |= IEM_GET_CPL(pVCpu) << X86DESCATTR_DPL_SHIFT;
4812
4813 /* This will affect the FLAT 32-bit mode flag: */
4814 if ( iSegReg < X86_SREG_FS
4815 && IEM_IS_32BIT_CODE(pVCpu))
4816 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4817 }
4818 /*
4819 * Protected / long mode.
4820 */
4821 else
4822 {
4823 /* Fetch the descriptor. */
4824 IEMSELDESC Desc;
4825 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4826 if (rcStrict != VINF_SUCCESS)
4827 return rcStrict;
4828
4829 /* Check GPs first. */
4830 if (!Desc.Legacy.Gen.u1DescType)
4831 {
4832 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4833 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4834 }
4835 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4836 {
4837 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4838 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4839 {
4840 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4842 }
4843 if ((uSel & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
4844 {
4845 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, IEM_GET_CPL(pVCpu)));
4846 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4847 }
4848 if (Desc.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
4849 {
4850 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
4851 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4852 }
4853 }
4854 else
4855 {
4856 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4857 {
4858 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4859 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4860 }
4861 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4862 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4863 {
4864#if 0 /* this is what intel says. */
4865 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4866 && IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4867 {
4868 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4869 iSegReg, uSel, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4870 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4871 }
4872#else /* this is what makes more sense. */
4873 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4874 {
4875 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4876 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4877 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4878 }
4879 if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4880 {
4881 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4882 iSegReg, uSel, IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4883 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4884 }
4885#endif
4886 }
4887 }
4888
4889 /* Is it there? */
4890 if (!Desc.Legacy.Gen.u1Present)
4891 {
4892 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4893 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4894 }
4895
4896 /* The base and limit. */
4897 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4898 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4899
4900 /*
4901 * Ok, everything checked out fine. Now set the accessed bit before
4902 * committing the result into the registers.
4903 */
4904 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4905 {
4906 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4907 if (rcStrict != VINF_SUCCESS)
4908 return rcStrict;
4909 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4910 }
4911
4912 /* commit */
4913 *pSel = uSel;
4914 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4915 pHid->u32Limit = cbLimit;
4916 pHid->u64Base = u64Base;
4917 pHid->ValidSel = uSel;
4918 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4919
4920 /** @todo check if the hidden bits are loaded correctly for 64-bit
4921 * mode. */
4922
4923 /* This will affect the FLAT 32-bit mode flag: */
4924 if ( iSegReg < X86_SREG_FS
4925 && IEM_IS_32BIT_CODE(pVCpu))
4926 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4927 | iemCalc32BitFlatIndicator(pVCpu);
4928 }
4929
4930 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4931 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4932 return VINF_SUCCESS;
4933}
4934
4935
4936/**
4937 * Implements 'mov SReg, r/m'.
4938 *
4939 * @param iSegReg The segment register number (valid).
4940 * @param uSel The new selector value.
4941 */
4942IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4943{
4944 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4945 if (rcStrict == VINF_SUCCESS)
4946 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4947 return rcStrict;
4948}
4949
4950
4951/**
4952 * Implements 'pop SReg'.
4953 *
4954 * @param iSegReg The segment register number (valid).
4955 * @param enmEffOpSize The efficient operand size (valid).
4956 */
4957IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4958{
4959 VBOXSTRICTRC rcStrict;
4960
4961 /*
4962 * Read the selector off the stack and join paths with mov ss, reg.
4963 */
4964 RTUINT64U TmpRsp;
4965 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4966 switch (enmEffOpSize)
4967 {
4968 case IEMMODE_16BIT:
4969 {
4970 uint16_t uSel;
4971 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4972 if (rcStrict == VINF_SUCCESS)
4973 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4974 break;
4975 }
4976
4977 case IEMMODE_32BIT:
4978 {
4979 uint32_t u32Value;
4980 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4981 if (rcStrict == VINF_SUCCESS)
4982 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u32Value);
4983 break;
4984 }
4985
4986 case IEMMODE_64BIT:
4987 {
4988 uint64_t u64Value;
4989 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4990 if (rcStrict == VINF_SUCCESS)
4991 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u64Value);
4992 break;
4993 }
4994 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4995 }
4996
4997 /*
4998 * If the load succeeded, commit the stack change and finish the instruction.
4999 */
5000 if (rcStrict == VINF_SUCCESS)
5001 {
5002 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
5003 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
5004 }
5005
5006 return rcStrict;
5007}
5008
5009
5010/**
5011 * Implements lgs, lfs, les, lds & lss.
5012 */
5013IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
5014{
5015 /*
5016 * Use iemCImpl_LoadSRegWorker to do the tricky segment register loading.
5017 */
5018 /** @todo verify and test that mov, pop and lXs works the segment
5019 * register loading in the exact same way. */
5020 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5021 if (rcStrict == VINF_SUCCESS)
5022 {
5023 switch (enmEffOpSize)
5024 {
5025 case IEMMODE_16BIT:
5026 iemGRegStoreU16(pVCpu, iGReg, offSeg);
5027 break;
5028 case IEMMODE_32BIT:
5029 case IEMMODE_64BIT:
5030 iemGRegStoreU64(pVCpu, iGReg, offSeg);
5031 break;
5032 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5033 }
5034 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5035 }
5036 return rcStrict;
5037}
5038
5039
5040/**
5041 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
5042 *
5043 * @retval VINF_SUCCESS on success.
5044 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
5045 * @retval iemMemFetchSysU64 return value.
5046 *
5047 * @param pVCpu The cross context virtual CPU structure of the calling thread.
5048 * @param uSel The selector value.
5049 * @param fAllowSysDesc Whether system descriptors are OK or not.
5050 * @param pDesc Where to return the descriptor on success.
5051 */
5052static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
5053{
5054 pDesc->Long.au64[0] = 0;
5055 pDesc->Long.au64[1] = 0;
5056
5057 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
5058 return VINF_IEM_SELECTOR_NOT_OK;
5059
5060 /* Within the table limits? */
5061 RTGCPTR GCPtrBase;
5062 if (uSel & X86_SEL_LDT)
5063 {
5064 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5065 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
5066 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
5067 return VINF_IEM_SELECTOR_NOT_OK;
5068 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
5069 }
5070 else
5071 {
5072 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5073 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
5074 return VINF_IEM_SELECTOR_NOT_OK;
5075 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
5076 }
5077
5078 /* Fetch the descriptor. */
5079 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
5080 if (rcStrict != VINF_SUCCESS)
5081 return rcStrict;
5082 if (!pDesc->Legacy.Gen.u1DescType)
5083 {
5084 if (!fAllowSysDesc)
5085 return VINF_IEM_SELECTOR_NOT_OK;
5086 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5087 {
5088 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
5089 if (rcStrict != VINF_SUCCESS)
5090 return rcStrict;
5091 }
5092
5093 }
5094
5095 return VINF_SUCCESS;
5096}
5097
5098
5099/**
5100 * Implements verr (fWrite = false) and verw (fWrite = true).
5101 */
5102IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
5103{
5104 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5105
5106 /** @todo figure whether the accessed bit is set or not. */
5107
5108 bool fAccessible = true;
5109 IEMSELDESC Desc;
5110 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
5111 if (rcStrict == VINF_SUCCESS)
5112 {
5113 /* Check the descriptor, order doesn't matter much here. */
5114 if ( !Desc.Legacy.Gen.u1DescType
5115 || !Desc.Legacy.Gen.u1Present)
5116 fAccessible = false;
5117 else
5118 {
5119 if ( fWrite
5120 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
5121 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
5122 fAccessible = false;
5123
5124 /** @todo testcase for the conforming behavior. */
5125 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5126 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5127 {
5128 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5129 fAccessible = false;
5130 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5131 fAccessible = false;
5132 }
5133 }
5134
5135 }
5136 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5137 fAccessible = false;
5138 else
5139 return rcStrict;
5140
5141 /* commit */
5142 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
5143
5144 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5145}
5146
5147
5148/**
5149 * Implements LAR and LSL with 64-bit operand size.
5150 *
5151 * @returns VINF_SUCCESS.
5152 * @param pu64Dst Pointer to the destination register.
5153 * @param uSel The selector to load details for.
5154 * @param fIsLar true = LAR, false = LSL.
5155 */
5156IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
5157{
5158 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5159
5160 /** @todo figure whether the accessed bit is set or not. */
5161
5162 bool fDescOk = true;
5163 IEMSELDESC Desc;
5164 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
5165 if (rcStrict == VINF_SUCCESS)
5166 {
5167 /*
5168 * Check the descriptor type.
5169 */
5170 if (!Desc.Legacy.Gen.u1DescType)
5171 {
5172 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5173 {
5174 if (Desc.Long.Gen.u5Zeros)
5175 fDescOk = false;
5176 else
5177 switch (Desc.Long.Gen.u4Type)
5178 {
5179 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
5180 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
5181 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
5182 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
5183 break;
5184 case AMD64_SEL_TYPE_SYS_CALL_GATE:
5185 fDescOk = fIsLar;
5186 break;
5187 default:
5188 fDescOk = false;
5189 break;
5190 }
5191 }
5192 else
5193 {
5194 switch (Desc.Long.Gen.u4Type)
5195 {
5196 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
5197 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
5198 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
5199 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
5200 case X86_SEL_TYPE_SYS_LDT:
5201 break;
5202 case X86_SEL_TYPE_SYS_286_CALL_GATE:
5203 case X86_SEL_TYPE_SYS_TASK_GATE:
5204 case X86_SEL_TYPE_SYS_386_CALL_GATE:
5205 fDescOk = fIsLar;
5206 break;
5207 default:
5208 fDescOk = false;
5209 break;
5210 }
5211 }
5212 }
5213 if (fDescOk)
5214 {
5215 /*
5216 * Check the RPL/DPL/CPL interaction..
5217 */
5218 /** @todo testcase for the conforming behavior. */
5219 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
5220 || !Desc.Legacy.Gen.u1DescType)
5221 {
5222 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5223 fDescOk = false;
5224 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5225 fDescOk = false;
5226 }
5227 }
5228
5229 if (fDescOk)
5230 {
5231 /*
5232 * All fine, start committing the result.
5233 */
5234 if (fIsLar)
5235 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5236 else
5237 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5238 }
5239
5240 }
5241 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5242 fDescOk = false;
5243 else
5244 return rcStrict;
5245
5246 /* commit flags value and advance rip. */
5247 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5248 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5249}
5250
5251
5252/**
5253 * Implements LAR and LSL with 16-bit operand size.
5254 *
5255 * @returns VINF_SUCCESS.
5256 * @param pu16Dst Pointer to the destination register.
5257 * @param uSel The selector to load details for.
5258 * @param fIsLar true = LAR, false = LSL.
5259 */
5260IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5261{
5262 uint64_t u64TmpDst = *pu16Dst;
5263 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5264 *pu16Dst = u64TmpDst;
5265 return VINF_SUCCESS;
5266}
5267
5268
5269/**
5270 * Implements lgdt.
5271 *
5272 * @param iEffSeg The segment of the new gdtr contents
5273 * @param GCPtrEffSrc The address of the new gdtr contents.
5274 * @param enmEffOpSize The effective operand size.
5275 */
5276IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5277{
5278 if (IEM_GET_CPL(pVCpu) != 0)
5279 return iemRaiseGeneralProtectionFault0(pVCpu);
5280 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5281
5282 if (!IEM_IS_IN_GUEST(pVCpu))
5283 { /* probable */ }
5284 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5285 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5286 {
5287 Log(("lgdt: Guest intercept -> VM-exit\n"));
5288 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5289 }
5290 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5291 {
5292 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5293 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5294 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5295 }
5296
5297 /*
5298 * Fetch the limit and base address.
5299 */
5300 uint16_t cbLimit;
5301 RTGCPTR GCPtrBase;
5302 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5303 if (rcStrict == VINF_SUCCESS)
5304 {
5305 if ( !IEM_IS_64BIT_CODE(pVCpu)
5306 || X86_IS_CANONICAL(GCPtrBase))
5307 {
5308 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5309 if (rcStrict == VINF_SUCCESS)
5310 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5311 }
5312 else
5313 {
5314 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5315 return iemRaiseGeneralProtectionFault0(pVCpu);
5316 }
5317 }
5318 return rcStrict;
5319}
5320
5321
5322/**
5323 * Implements sgdt.
5324 *
5325 * @param iEffSeg The segment where to store the gdtr content.
5326 * @param GCPtrEffDst The address where to store the gdtr content.
5327 */
5328IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5329{
5330 /*
5331 * Join paths with sidt.
5332 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5333 * you really must know.
5334 */
5335 if (!IEM_IS_IN_GUEST(pVCpu))
5336 { /* probable */ }
5337 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5338 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5339 {
5340 Log(("sgdt: Guest intercept -> VM-exit\n"));
5341 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5342 }
5343 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5344 {
5345 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5346 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5347 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5348 }
5349
5350 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5351 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5352 if (rcStrict == VINF_SUCCESS)
5353 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5354 return rcStrict;
5355}
5356
5357
5358/**
5359 * Implements lidt.
5360 *
5361 * @param iEffSeg The segment of the new idtr contents
5362 * @param GCPtrEffSrc The address of the new idtr contents.
5363 * @param enmEffOpSize The effective operand size.
5364 */
5365IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5366{
5367 if (IEM_GET_CPL(pVCpu) != 0)
5368 return iemRaiseGeneralProtectionFault0(pVCpu);
5369 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5370
5371 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5372 { /* probable */ }
5373 else
5374 {
5375 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5376 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5377 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5378 }
5379
5380 /*
5381 * Fetch the limit and base address.
5382 */
5383 uint16_t cbLimit;
5384 RTGCPTR GCPtrBase;
5385 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5386 if (rcStrict == VINF_SUCCESS)
5387 {
5388 if ( !IEM_IS_64BIT_CODE(pVCpu)
5389 || X86_IS_CANONICAL(GCPtrBase))
5390 {
5391 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5392 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5393 }
5394 else
5395 {
5396 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5397 return iemRaiseGeneralProtectionFault0(pVCpu);
5398 }
5399 }
5400 return rcStrict;
5401}
5402
5403
5404/**
5405 * Implements sidt.
5406 *
5407 * @param iEffSeg The segment where to store the idtr content.
5408 * @param GCPtrEffDst The address where to store the idtr content.
5409 */
5410IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5411{
5412 /*
5413 * Join paths with sgdt.
5414 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5415 * you really must know.
5416 */
5417 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5418 { /* probable */ }
5419 else
5420 {
5421 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5422 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5423 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5424 }
5425
5426 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5427 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5428 if (rcStrict == VINF_SUCCESS)
5429 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5430 return rcStrict;
5431}
5432
5433
5434/**
5435 * Implements lldt.
5436 *
5437 * @param uNewLdt The new LDT selector value.
5438 */
5439IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5440{
5441 /*
5442 * Check preconditions.
5443 */
5444 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5445 {
5446 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5447 return iemRaiseUndefinedOpcode(pVCpu);
5448 }
5449 if (IEM_GET_CPL(pVCpu) != 0)
5450 {
5451 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, IEM_GET_CPL(pVCpu)));
5452 return iemRaiseGeneralProtectionFault0(pVCpu);
5453 }
5454
5455 /* Nested-guest VMX intercept (SVM is after all checks). */
5456 /** @todo testcase: exit vs check order. */
5457 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5458 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5459 { /* probable */ }
5460 else
5461 {
5462 Log(("lldt: Guest intercept -> VM-exit\n"));
5463 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5464 }
5465
5466 if (uNewLdt & X86_SEL_LDT)
5467 {
5468 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5469 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5470 }
5471
5472 /*
5473 * Now, loading a NULL selector is easy.
5474 */
5475 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5476 {
5477 /* Nested-guest SVM intercept. */
5478 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5479 { /* probable */ }
5480 else
5481 {
5482 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5483 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5484 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5485 }
5486
5487 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5488 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5489 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5490 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5491 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5492 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5493 {
5494 /* AMD-V seems to leave the base and limit alone. */
5495 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5496 }
5497 else
5498 {
5499 /* VT-x (Intel 3960x) seems to be doing the following. */
5500 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5501 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5502 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5503 }
5504
5505 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5506 }
5507
5508 /*
5509 * Read the descriptor.
5510 */
5511 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5512 IEMSELDESC Desc;
5513 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5514 if (rcStrict != VINF_SUCCESS)
5515 return rcStrict;
5516
5517 /* Check GPs first. */
5518 if (Desc.Legacy.Gen.u1DescType)
5519 {
5520 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5521 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5522 }
5523 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5524 {
5525 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5526 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5527 }
5528 uint64_t u64Base;
5529 if (!IEM_IS_LONG_MODE(pVCpu))
5530 u64Base = X86DESC_BASE(&Desc.Legacy);
5531 else
5532 {
5533 if (Desc.Long.Gen.u5Zeros)
5534 {
5535 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5536 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5537 }
5538
5539 u64Base = X86DESC64_BASE(&Desc.Long);
5540 if (!IEM_IS_CANONICAL(u64Base))
5541 {
5542 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5543 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5544 }
5545 }
5546
5547 /* NP */
5548 if (!Desc.Legacy.Gen.u1Present)
5549 {
5550 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5551 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5552 }
5553
5554 /* Nested-guest SVM intercept. */
5555 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5556 { /* probable */ }
5557 else
5558 {
5559 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5560 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5561 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5562 }
5563
5564 /*
5565 * It checks out alright, update the registers.
5566 */
5567/** @todo check if the actual value is loaded or if the RPL is dropped */
5568 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5569 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5570 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5571 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5572 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5573 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5574
5575 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5576}
5577
5578
5579/**
5580 * Implements sldt GReg
5581 *
5582 * @param iGReg The general register to store the CRx value in.
5583 * @param enmEffOpSize The operand size.
5584 */
5585IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5586{
5587 if (!IEM_IS_IN_GUEST(pVCpu))
5588 { /* probable */ }
5589 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5590 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5591 {
5592 Log(("sldt: Guest intercept -> VM-exit\n"));
5593 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5594 }
5595 else
5596 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5597
5598 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5599 switch (enmEffOpSize)
5600 {
5601 case IEMMODE_16BIT:
5602 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5603 break;
5604 case IEMMODE_32BIT:
5605 case IEMMODE_64BIT:
5606 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5607 break;
5608 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5609 }
5610 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5611}
5612
5613
5614/**
5615 * Implements sldt mem.
5616 *
5617 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5618 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5619 */
5620IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5621{
5622 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5623
5624 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5625 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5626 if (rcStrict == VINF_SUCCESS)
5627 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5628 return rcStrict;
5629}
5630
5631
5632/**
5633 * Implements ltr.
5634 *
5635 * @param uNewTr The new TSS selector value.
5636 */
5637IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5638{
5639 /*
5640 * Check preconditions.
5641 */
5642 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5643 {
5644 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5645 return iemRaiseUndefinedOpcode(pVCpu);
5646 }
5647 if (IEM_GET_CPL(pVCpu) != 0)
5648 {
5649 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, IEM_GET_CPL(pVCpu)));
5650 return iemRaiseGeneralProtectionFault0(pVCpu);
5651 }
5652 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5653 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5654 { /* probable */ }
5655 else
5656 {
5657 Log(("ltr: Guest intercept -> VM-exit\n"));
5658 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5659 }
5660 if (uNewTr & X86_SEL_LDT)
5661 {
5662 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5663 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5664 }
5665 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5666 {
5667 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5668 return iemRaiseGeneralProtectionFault0(pVCpu);
5669 }
5670 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5671 { /* probable */ }
5672 else
5673 {
5674 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5675 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5676 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5677 }
5678
5679 /*
5680 * Read the descriptor.
5681 */
5682 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5683 IEMSELDESC Desc;
5684 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5685 if (rcStrict != VINF_SUCCESS)
5686 return rcStrict;
5687
5688 /* Check GPs first. */
5689 if (Desc.Legacy.Gen.u1DescType)
5690 {
5691 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5692 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5693 }
5694 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5695 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5696 || IEM_IS_LONG_MODE(pVCpu)) )
5697 {
5698 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5699 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5700 }
5701 uint64_t u64Base;
5702 if (!IEM_IS_LONG_MODE(pVCpu))
5703 u64Base = X86DESC_BASE(&Desc.Legacy);
5704 else
5705 {
5706 if (Desc.Long.Gen.u5Zeros)
5707 {
5708 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5709 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5710 }
5711
5712 u64Base = X86DESC64_BASE(&Desc.Long);
5713 if (!IEM_IS_CANONICAL(u64Base))
5714 {
5715 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5716 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5717 }
5718 }
5719
5720 /* NP */
5721 if (!Desc.Legacy.Gen.u1Present)
5722 {
5723 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5724 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5725 }
5726
5727 /*
5728 * Set it busy.
5729 * Note! Intel says this should lock down the whole descriptor, but we'll
5730 * restrict our selves to 32-bit for now due to lack of inline
5731 * assembly and such.
5732 */
5733 void *pvDesc;
5734 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
5735 IEM_ACCESS_DATA_RW, 0);
5736 if (rcStrict != VINF_SUCCESS)
5737 return rcStrict;
5738 switch ((uintptr_t)pvDesc & 3)
5739 {
5740 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5741 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5742 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5743 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5744 }
5745 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5746 if (rcStrict != VINF_SUCCESS)
5747 return rcStrict;
5748 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5749
5750 /*
5751 * It checks out alright, update the registers.
5752 */
5753/** @todo check if the actual value is loaded or if the RPL is dropped */
5754 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5755 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5756 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5757 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5758 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5759 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5760
5761 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5762}
5763
5764
5765/**
5766 * Implements str GReg
5767 *
5768 * @param iGReg The general register to store the CRx value in.
5769 * @param enmEffOpSize The operand size.
5770 */
5771IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5772{
5773 if (!IEM_IS_IN_GUEST(pVCpu))
5774 { /* probable */ }
5775 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5776 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5777 {
5778 Log(("str_reg: Guest intercept -> VM-exit\n"));
5779 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5780 }
5781 else
5782 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5783
5784 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5785 switch (enmEffOpSize)
5786 {
5787 case IEMMODE_16BIT:
5788 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5789 break;
5790 case IEMMODE_32BIT:
5791 case IEMMODE_64BIT:
5792 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5793 break;
5794 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5795 }
5796 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5797}
5798
5799
5800/**
5801 * Implements str mem.
5802 *
5803 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5804 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5805 */
5806IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5807{
5808 if (!IEM_IS_IN_GUEST(pVCpu))
5809 { /* probable */ }
5810 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5811 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5812 {
5813 Log(("str_mem: Guest intercept -> VM-exit\n"));
5814 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5815 }
5816 else
5817 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5818
5819 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5820 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5821 if (rcStrict == VINF_SUCCESS)
5822 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5823 return rcStrict;
5824}
5825
5826
5827/**
5828 * Implements mov GReg,CRx.
5829 *
5830 * @param iGReg The general register to store the CRx value in.
5831 * @param iCrReg The CRx register to read (valid).
5832 */
5833IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5834{
5835 if (IEM_GET_CPL(pVCpu) != 0)
5836 return iemRaiseGeneralProtectionFault0(pVCpu);
5837 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5838
5839 if (!IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5840 { /* probable */ }
5841 else
5842 {
5843 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5844 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5845 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5846 }
5847
5848 /* Read it. */
5849 uint64_t crX;
5850 switch (iCrReg)
5851 {
5852 case 0:
5853 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5854 crX = pVCpu->cpum.GstCtx.cr0;
5855 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5856 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5857 break;
5858 case 2:
5859 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5860 crX = pVCpu->cpum.GstCtx.cr2;
5861 break;
5862 case 3:
5863 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5864 crX = pVCpu->cpum.GstCtx.cr3;
5865 break;
5866 case 4:
5867 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5868 crX = pVCpu->cpum.GstCtx.cr4;
5869 break;
5870 case 8:
5871 {
5872 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5873 if (!IEM_IS_IN_GUEST(pVCpu))
5874 { /* probable */ }
5875#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5876 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5877 {
5878 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5879 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5880 return rcStrict;
5881
5882 /*
5883 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5884 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5885 * are cleared.
5886 *
5887 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5888 */
5889 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5890 {
5891 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5892 crX = (uTpr >> 4) & 0xf;
5893 break;
5894 }
5895 }
5896#endif
5897#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5898 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
5899 {
5900 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5901 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5902 {
5903 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5904 break;
5905 }
5906 }
5907#endif
5908 uint8_t uTpr;
5909 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5910 if (RT_SUCCESS(rc))
5911 crX = uTpr >> 4;
5912 else
5913 crX = 0;
5914 break;
5915 }
5916 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5917 }
5918
5919#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5920 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5921 { /* probable */ }
5922 else
5923 switch (iCrReg)
5924 {
5925 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5926 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5927 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5928 case 3:
5929 {
5930 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5931 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5932 return rcStrict;
5933 break;
5934 }
5935 }
5936#endif
5937
5938 /* Store it. */
5939 if (IEM_IS_64BIT_CODE(pVCpu))
5940 iemGRegStoreU64(pVCpu, iGReg, crX);
5941 else
5942 iemGRegStoreU64(pVCpu, iGReg, (uint32_t)crX);
5943
5944 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5945}
5946
5947
5948/**
5949 * Implements smsw GReg.
5950 *
5951 * @param iGReg The general register to store the CRx value in.
5952 * @param enmEffOpSize The operand size.
5953 */
5954IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5955{
5956 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
5957
5958#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5959 uint64_t u64MaskedCr0;
5960 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5961 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5962 else
5963 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5964 uint64_t const u64GuestCr0 = u64MaskedCr0;
5965#else
5966 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5967#endif
5968
5969 switch (enmEffOpSize)
5970 {
5971 case IEMMODE_16BIT:
5972 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5973 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0);
5974 /* Unused bits are set on 386 and older CPU: */
5975 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5976 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xffe0);
5977 else
5978 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xfff0);
5979 break;
5980
5981/** @todo testcase for bits 31:16. We're not doing that correctly. */
5982
5983 case IEMMODE_32BIT:
5984 if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5985 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0);
5986 else /** @todo test this! */
5987 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0 | UINT32_C(0x7fffffe0)); /* Unused bits are set on 386. */
5988 break;
5989
5990 case IEMMODE_64BIT:
5991 iemGRegStoreU64(pVCpu, iGReg, u64GuestCr0);
5992 break;
5993
5994 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5995 }
5996
5997 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5998}
5999
6000
6001/**
6002 * Implements smsw mem.
6003 *
6004 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
6005 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
6006 */
6007IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6008{
6009 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
6010 if (!IEM_IS_IN_GUEST(pVCpu))
6011 { /* probable */ }
6012 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6013 u64GuestCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
6014 else
6015 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
6016
6017 uint16_t u16Value;
6018 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
6019 u16Value = (uint16_t)u64GuestCr0;
6020 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6021 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
6022 else
6023 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
6024
6025 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
6026 if (rcStrict == VINF_SUCCESS)
6027 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6028 return rcStrict;
6029}
6030
6031
6032/**
6033 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
6034 */
6035#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
6036 do \
6037 { \
6038 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
6039 if (RT_SUCCESS(rcX)) \
6040 { /* likely */ } \
6041 else \
6042 { \
6043 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
6044 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
6045 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
6046 } \
6047 } while (0)
6048
6049
6050/**
6051 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
6052 *
6053 * @param iCrReg The CRx register to write (valid).
6054 * @param uNewCrX The new value.
6055 * @param enmAccessCrX The instruction that caused the CrX load.
6056 * @param iGReg The general register in case of a 'mov CRx,GReg'
6057 * instruction.
6058 */
6059IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
6060{
6061 VBOXSTRICTRC rcStrict;
6062 int rc;
6063#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
6064 RT_NOREF2(iGReg, enmAccessCrX);
6065#endif
6066
6067 /*
6068 * Try store it.
6069 * Unfortunately, CPUM only does a tiny bit of the work.
6070 */
6071 switch (iCrReg)
6072 {
6073 case 0:
6074 {
6075 /*
6076 * Perform checks.
6077 */
6078 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6079
6080 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
6081 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
6082
6083 /* ET is hardcoded on 486 and later. */
6084 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
6085 uNewCrX |= X86_CR0_ET;
6086 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
6087 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
6088 {
6089 uNewCrX &= fValid;
6090 uNewCrX |= X86_CR0_ET;
6091 }
6092 else
6093 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
6094
6095 /* Check for reserved bits. */
6096 if (uNewCrX & ~(uint64_t)fValid)
6097 {
6098 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6099 return iemRaiseGeneralProtectionFault0(pVCpu);
6100 }
6101
6102 /* Check for invalid combinations. */
6103 if ( (uNewCrX & X86_CR0_PG)
6104 && !(uNewCrX & X86_CR0_PE) )
6105 {
6106 Log(("Trying to set CR0.PG without CR0.PE\n"));
6107 return iemRaiseGeneralProtectionFault0(pVCpu);
6108 }
6109
6110 if ( !(uNewCrX & X86_CR0_CD)
6111 && (uNewCrX & X86_CR0_NW) )
6112 {
6113 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
6114 return iemRaiseGeneralProtectionFault0(pVCpu);
6115 }
6116
6117 if ( !(uNewCrX & X86_CR0_PG)
6118 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
6119 {
6120 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
6121 return iemRaiseGeneralProtectionFault0(pVCpu);
6122 }
6123
6124 /* Long mode consistency checks. */
6125 if ( (uNewCrX & X86_CR0_PG)
6126 && !(uOldCrX & X86_CR0_PG)
6127 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6128 {
6129 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
6130 {
6131 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
6132 return iemRaiseGeneralProtectionFault0(pVCpu);
6133 }
6134 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
6135 {
6136 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
6137 return iemRaiseGeneralProtectionFault0(pVCpu);
6138 }
6139 }
6140
6141 /** @todo testcase: what happens if we disable paging while in 64-bit code? */
6142
6143 if (!IEM_IS_IN_GUEST(pVCpu))
6144 { /* probable */ }
6145#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6146 /* Check for bits that must remain set or cleared in VMX operation,
6147 see Intel spec. 23.8 "Restrictions on VMX operation". */
6148 else if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6149 {
6150 uint64_t const uCr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
6151 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
6152 {
6153 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
6154 return iemRaiseGeneralProtectionFault0(pVCpu);
6155 }
6156
6157 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6158 if (uNewCrX & ~uCr0Fixed1)
6159 {
6160 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
6161 return iemRaiseGeneralProtectionFault0(pVCpu);
6162 }
6163 }
6164#endif
6165 /*
6166 * SVM nested-guest CR0 write intercepts.
6167 */
6168 else if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
6169 {
6170 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6171 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6172 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
6173 }
6174 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
6175 {
6176 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
6177 if ( enmAccessCrX == IEMACCESSCRX_LMSW
6178 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
6179 {
6180 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
6181 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
6182 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6183 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
6184 }
6185 }
6186
6187 /*
6188 * Change EFER.LMA if entering or leaving long mode.
6189 */
6190 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
6191 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
6192 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6193 {
6194 if (uNewCrX & X86_CR0_PG)
6195 NewEFER |= MSR_K6_EFER_LMA;
6196 else
6197 NewEFER &= ~MSR_K6_EFER_LMA;
6198
6199 CPUMSetGuestEFER(pVCpu, NewEFER);
6200 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
6201 }
6202
6203 /*
6204 * Inform PGM.
6205 */
6206 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
6207 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
6208 {
6209 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
6210 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
6211 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6212 { /* likely */ }
6213 else
6214 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6215 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6216 AssertRCReturn(rc, rc);
6217 /* ignore informational status codes */
6218 }
6219
6220 /*
6221 * Change CR0.
6222 */
6223 CPUMSetGuestCR0(pVCpu, uNewCrX);
6224 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
6225
6226 /* Update the fExec flags if PE changed. */
6227 if ((uNewCrX ^ uOldCrX) & X86_CR0_PE)
6228 iemRecalcExecModeAndCplFlags(pVCpu);
6229
6230 /*
6231 * Inform PGM some more...
6232 */
6233 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6234 false /* fForce */);
6235 break;
6236 }
6237
6238 /*
6239 * CR2 can be changed without any restrictions.
6240 */
6241 case 2:
6242 {
6243 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
6244 { /* probable */ }
6245 else
6246 {
6247 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6248 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6249 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
6250 }
6251 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
6252 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
6253 rcStrict = VINF_SUCCESS;
6254 break;
6255 }
6256
6257 /*
6258 * CR3 is relatively simple, although AMD and Intel have different
6259 * accounts of how setting reserved bits are handled. We take intel's
6260 * word for the lower bits and AMD's for the high bits (63:52). The
6261 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
6262 * on this.
6263 */
6264 /** @todo Testcase: Setting reserved bits in CR3, especially before
6265 * enabling paging. */
6266 case 3:
6267 {
6268 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6269
6270 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6271 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6272 && (uNewCrX & RT_BIT_64(63)))
6273 {
6274 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6275 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6276 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6277 * Paging-Structure Caches". */
6278 uNewCrX &= ~RT_BIT_64(63);
6279 }
6280
6281 /* Check / mask the value. */
6282#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6283 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6284 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6285 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6286 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6287#else
6288 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6289#endif
6290 if (uNewCrX & fInvPhysMask)
6291 {
6292 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6293 * very vague in this area. As mentioned above, need testcase on real
6294 * hardware... Sigh. */
6295 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6296 return iemRaiseGeneralProtectionFault0(pVCpu);
6297 }
6298
6299 uint64_t fValid;
6300 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6301 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6302 {
6303 /** @todo Redundant? This value has already been validated above. */
6304 fValid = UINT64_C(0x000fffffffffffff);
6305 }
6306 else
6307 fValid = UINT64_C(0xffffffff);
6308 if (uNewCrX & ~fValid)
6309 {
6310 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6311 uNewCrX, uNewCrX & ~fValid));
6312 uNewCrX &= fValid;
6313 }
6314
6315 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6316 { /* probable */ }
6317 else
6318 {
6319 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6320 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6321 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6322 }
6323
6324 /* Inform PGM. */
6325 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6326 {
6327 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6328 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6329 { /* likely */ }
6330 else
6331 {
6332 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6333 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6334 }
6335 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6336 AssertRCReturn(rc, rc);
6337 /* ignore informational status codes */
6338 }
6339
6340 /* Make the change. */
6341 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6342 AssertRCSuccessReturn(rc, rc);
6343
6344 rcStrict = VINF_SUCCESS;
6345 break;
6346 }
6347
6348 /*
6349 * CR4 is a bit more tedious as there are bits which cannot be cleared
6350 * under some circumstances and such.
6351 */
6352 case 4:
6353 {
6354 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6355 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6356
6357 /* Reserved bits. */
6358 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6359 if (uNewCrX & ~(uint64_t)fValid)
6360 {
6361 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6362 return iemRaiseGeneralProtectionFault0(pVCpu);
6363 }
6364
6365 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6366 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6367
6368 /* PCIDE check. */
6369 if ( fPcide
6370 && ( !fLongMode
6371 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6372 {
6373 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6374 return iemRaiseGeneralProtectionFault0(pVCpu);
6375 }
6376
6377 /* PAE check. */
6378 if ( fLongMode
6379 && (uOldCrX & X86_CR4_PAE)
6380 && !(uNewCrX & X86_CR4_PAE))
6381 {
6382 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6383 return iemRaiseGeneralProtectionFault0(pVCpu);
6384 }
6385
6386 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6387 { /* probable */ }
6388 else
6389 {
6390 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6391 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6392 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6393 }
6394
6395 /* Check for bits that must remain set or cleared in VMX operation,
6396 see Intel spec. 23.8 "Restrictions on VMX operation". */
6397 if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
6398 { /* probable */ }
6399 else
6400 {
6401 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6402 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6403 {
6404 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6405 return iemRaiseGeneralProtectionFault0(pVCpu);
6406 }
6407
6408 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6409 if (uNewCrX & ~uCr4Fixed1)
6410 {
6411 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6412 return iemRaiseGeneralProtectionFault0(pVCpu);
6413 }
6414 }
6415
6416 /*
6417 * Notify PGM.
6418 */
6419 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6420 {
6421 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6422 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6423 { /* likely */ }
6424 else
6425 {
6426 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6427 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6428 }
6429 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6430 AssertRCReturn(rc, rc);
6431 /* ignore informational status codes */
6432 }
6433
6434 /*
6435 * Change it.
6436 */
6437 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6438 AssertRCSuccessReturn(rc, rc);
6439 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6440
6441 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6442 false /* fForce */);
6443 break;
6444 }
6445
6446 /*
6447 * CR8 maps to the APIC TPR.
6448 */
6449 case 8:
6450 {
6451 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6452 if (uNewCrX & ~(uint64_t)0xf)
6453 {
6454 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6455 return iemRaiseGeneralProtectionFault0(pVCpu);
6456 }
6457
6458 if (!IEM_IS_IN_GUEST(pVCpu))
6459 { /* probable */ }
6460#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6461 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6462 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6463 {
6464 /*
6465 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6466 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6467 * cleared. Following this the processor performs TPR virtualization.
6468 *
6469 * However, we should not perform TPR virtualization immediately here but
6470 * after this instruction has completed.
6471 *
6472 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6473 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6474 */
6475 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6476 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6477 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6478 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6479 rcStrict = VINF_SUCCESS;
6480 break;
6481 }
6482#endif
6483#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6484 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
6485 {
6486 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6487 {
6488 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6489 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6490 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6491 }
6492
6493 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6494 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6495 {
6496 rcStrict = VINF_SUCCESS;
6497 break;
6498 }
6499 }
6500#endif
6501 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6502 APICSetTpr(pVCpu, u8Tpr);
6503 rcStrict = VINF_SUCCESS;
6504 break;
6505 }
6506
6507 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6508 }
6509
6510 /*
6511 * Advance the RIP on success.
6512 */
6513 if (RT_SUCCESS(rcStrict))
6514 {
6515 if (rcStrict != VINF_SUCCESS)
6516 iemSetPassUpStatus(pVCpu, rcStrict);
6517 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6518 }
6519
6520 return rcStrict;
6521}
6522
6523
6524/**
6525 * Implements mov CRx,GReg.
6526 *
6527 * @param iCrReg The CRx register to write (valid).
6528 * @param iGReg The general register to load the CRx value from.
6529 */
6530IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6531{
6532 if (IEM_GET_CPL(pVCpu) != 0)
6533 return iemRaiseGeneralProtectionFault0(pVCpu);
6534 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6535
6536 /*
6537 * Read the new value from the source register and call common worker.
6538 */
6539 uint64_t uNewCrX;
6540 if (IEM_IS_64BIT_CODE(pVCpu))
6541 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6542 else
6543 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6544
6545#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6546 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6547 { /* probable */ }
6548 else
6549 {
6550 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6551 switch (iCrReg)
6552 {
6553 case 0:
6554 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6555 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6556 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6557 }
6558 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6559 return rcStrict;
6560 }
6561#endif
6562
6563 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6564}
6565
6566
6567/**
6568 * Implements 'LMSW r/m16'
6569 *
6570 * @param u16NewMsw The new value.
6571 * @param GCPtrEffDst The guest-linear address of the source operand in case
6572 * of a memory operand. For register operand, pass
6573 * NIL_RTGCPTR.
6574 */
6575IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6576{
6577 if (IEM_GET_CPL(pVCpu) != 0)
6578 return iemRaiseGeneralProtectionFault0(pVCpu);
6579 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6580 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6581
6582#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6583 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6584 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6585 { /* probable */ }
6586 else
6587 {
6588 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6589 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6590 return rcStrict;
6591 }
6592#else
6593 RT_NOREF_PV(GCPtrEffDst);
6594#endif
6595
6596 /*
6597 * Compose the new CR0 value and call common worker.
6598 */
6599 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6600 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6601 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6602}
6603
6604
6605/**
6606 * Implements 'CLTS'.
6607 */
6608IEM_CIMPL_DEF_0(iemCImpl_clts)
6609{
6610 if (IEM_GET_CPL(pVCpu) != 0)
6611 return iemRaiseGeneralProtectionFault0(pVCpu);
6612
6613 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6614 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6615 uNewCr0 &= ~X86_CR0_TS;
6616
6617#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6618 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6619 { /* probable */ }
6620 else
6621 {
6622 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6623 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6624 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6625 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6626 return rcStrict;
6627 }
6628#endif
6629
6630 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6631}
6632
6633
6634/**
6635 * Implements mov GReg,DRx.
6636 *
6637 * @param iGReg The general register to store the DRx value in.
6638 * @param iDrReg The DRx register to read (0-7).
6639 */
6640IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6641{
6642#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6643 /*
6644 * Check nested-guest VMX intercept.
6645 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6646 * over CPL and CR4.DE and even DR4/DR5 checks.
6647 *
6648 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6649 */
6650 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6651 { /* probable */ }
6652 else
6653 {
6654 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6655 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6656 return rcStrict;
6657 }
6658#endif
6659
6660 /*
6661 * Check preconditions.
6662 */
6663 /* Raise GPs. */
6664 if (IEM_GET_CPL(pVCpu) != 0)
6665 return iemRaiseGeneralProtectionFault0(pVCpu);
6666 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6667 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6668
6669 /** @todo \#UD in outside ring-0 too? */
6670 if (iDrReg == 4 || iDrReg == 5)
6671 {
6672 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6673 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6674 {
6675 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6676 return iemRaiseGeneralProtectionFault0(pVCpu);
6677 }
6678 iDrReg += 2;
6679 }
6680
6681 /* Raise #DB if general access detect is enabled. */
6682 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6683 {
6684 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6685 return iemRaiseDebugException(pVCpu);
6686 }
6687
6688 /*
6689 * Read the debug register and store it in the specified general register.
6690 */
6691 uint64_t drX;
6692 switch (iDrReg)
6693 {
6694 case 0:
6695 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6696 drX = pVCpu->cpum.GstCtx.dr[0];
6697 break;
6698 case 1:
6699 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6700 drX = pVCpu->cpum.GstCtx.dr[1];
6701 break;
6702 case 2:
6703 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6704 drX = pVCpu->cpum.GstCtx.dr[2];
6705 break;
6706 case 3:
6707 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6708 drX = pVCpu->cpum.GstCtx.dr[3];
6709 break;
6710 case 6:
6711 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6712 drX = pVCpu->cpum.GstCtx.dr[6];
6713 drX |= X86_DR6_RA1_MASK;
6714 drX &= ~X86_DR6_RAZ_MASK;
6715 break;
6716 case 7:
6717 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6718 drX = pVCpu->cpum.GstCtx.dr[7];
6719 drX |=X86_DR7_RA1_MASK;
6720 drX &= ~X86_DR7_RAZ_MASK;
6721 break;
6722 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6723 }
6724
6725 /** @todo SVM nested-guest intercept for DR8-DR15? */
6726 /*
6727 * Check for any SVM nested-guest intercepts for the DRx read.
6728 */
6729 if (!IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6730 { /* probable */ }
6731 else
6732 {
6733 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6734 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6735 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6736 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6737 }
6738
6739 if (IEM_IS_64BIT_CODE(pVCpu))
6740 iemGRegStoreU64(pVCpu, iGReg, drX);
6741 else
6742 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)drX);
6743
6744 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6745}
6746
6747
6748/**
6749 * Implements mov DRx,GReg.
6750 *
6751 * @param iDrReg The DRx register to write (valid).
6752 * @param iGReg The general register to load the DRx value from.
6753 */
6754IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6755{
6756#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6757 /*
6758 * Check nested-guest VMX intercept.
6759 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6760 * over CPL and CR4.DE and even DR4/DR5 checks.
6761 *
6762 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6763 */
6764 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6765 { /* probable */ }
6766 else
6767 {
6768 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6769 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6770 return rcStrict;
6771 }
6772#endif
6773
6774 /*
6775 * Check preconditions.
6776 */
6777 if (IEM_GET_CPL(pVCpu) != 0)
6778 return iemRaiseGeneralProtectionFault0(pVCpu);
6779 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6780 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6781
6782 if (iDrReg == 4 || iDrReg == 5)
6783 {
6784 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6785 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6786 {
6787 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6788 return iemRaiseGeneralProtectionFault0(pVCpu);
6789 }
6790 iDrReg += 2;
6791 }
6792
6793 /* Raise #DB if general access detect is enabled. */
6794 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6795 * \#GP? */
6796 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6797 {
6798 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6799 return iemRaiseDebugException(pVCpu);
6800 }
6801
6802 /*
6803 * Read the new value from the source register.
6804 */
6805 uint64_t uNewDrX;
6806 if (IEM_IS_64BIT_CODE(pVCpu))
6807 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6808 else
6809 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6810
6811 /*
6812 * Adjust it.
6813 */
6814 switch (iDrReg)
6815 {
6816 case 0:
6817 case 1:
6818 case 2:
6819 case 3:
6820 /* nothing to adjust */
6821 break;
6822
6823 case 6:
6824 if (uNewDrX & X86_DR6_MBZ_MASK)
6825 {
6826 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6827 return iemRaiseGeneralProtectionFault0(pVCpu);
6828 }
6829 uNewDrX |= X86_DR6_RA1_MASK;
6830 uNewDrX &= ~X86_DR6_RAZ_MASK;
6831 break;
6832
6833 case 7:
6834 if (uNewDrX & X86_DR7_MBZ_MASK)
6835 {
6836 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6837 return iemRaiseGeneralProtectionFault0(pVCpu);
6838 }
6839 uNewDrX |= X86_DR7_RA1_MASK;
6840 uNewDrX &= ~X86_DR7_RAZ_MASK;
6841 break;
6842
6843 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6844 }
6845
6846 /** @todo SVM nested-guest intercept for DR8-DR15? */
6847 /*
6848 * Check for any SVM nested-guest intercepts for the DRx write.
6849 */
6850 if (!IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6851 { /* probable */ }
6852 else
6853 {
6854 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6855 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6856 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6857 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6858 }
6859
6860 /*
6861 * Do the actual setting.
6862 */
6863 if (iDrReg < 4)
6864 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6865 else if (iDrReg == 6)
6866 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6867
6868 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6869 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6870
6871 /*
6872 * Re-init hardware breakpoint summary if it was DR7 that got changed.
6873 */
6874 if (iDrReg == 7)
6875 iemRecalcExecDbgFlags(pVCpu);
6876
6877 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6878}
6879
6880
6881/**
6882 * Implements mov GReg,TRx.
6883 *
6884 * @param iGReg The general register to store the
6885 * TRx value in.
6886 * @param iTrReg The TRx register to read (6/7).
6887 */
6888IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6889{
6890 /*
6891 * Check preconditions. NB: This instruction is 386/486 only.
6892 */
6893
6894 /* Raise GPs. */
6895 if (IEM_GET_CPL(pVCpu) != 0)
6896 return iemRaiseGeneralProtectionFault0(pVCpu);
6897 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6898
6899 if (iTrReg < 6 || iTrReg > 7)
6900 {
6901 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6902 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6903 return iemRaiseGeneralProtectionFault0(pVCpu);
6904 }
6905
6906 /*
6907 * Read the test register and store it in the specified general register.
6908 * This is currently a dummy implementation that only exists to satisfy
6909 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6910 * TR6/TR7 registers. Software which actually depends on the TR values
6911 * (different on 386/486) is exceedingly rare.
6912 */
6913 uint32_t trX;
6914 switch (iTrReg)
6915 {
6916 case 6:
6917 trX = 0; /* Currently a dummy. */
6918 break;
6919 case 7:
6920 trX = 0; /* Currently a dummy. */
6921 break;
6922 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6923 }
6924
6925 iemGRegStoreU32(pVCpu, iGReg, trX);
6926
6927 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6928}
6929
6930
6931/**
6932 * Implements mov TRx,GReg.
6933 *
6934 * @param iTrReg The TRx register to write (valid).
6935 * @param iGReg The general register to load the TRx
6936 * value from.
6937 */
6938IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6939{
6940 /*
6941 * Check preconditions. NB: This instruction is 386/486 only.
6942 */
6943
6944 /* Raise GPs. */
6945 if (IEM_GET_CPL(pVCpu) != 0)
6946 return iemRaiseGeneralProtectionFault0(pVCpu);
6947 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6948
6949 if (iTrReg < 6 || iTrReg > 7)
6950 {
6951 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6952 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6953 return iemRaiseGeneralProtectionFault0(pVCpu);
6954 }
6955
6956 /*
6957 * Read the new value from the source register.
6958 */
6959 uint32_t uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6960
6961 /*
6962 * Here we would do the actual setting if this weren't a dummy implementation.
6963 * This is currently a dummy implementation that only exists to prevent
6964 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6965 */
6966 RT_NOREF(uNewTrX);
6967
6968 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6969}
6970
6971
6972/**
6973 * Implements 'INVLPG m'.
6974 *
6975 * @param GCPtrPage The effective address of the page to invalidate.
6976 * @remarks Updates the RIP.
6977 */
6978IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6979{
6980 /* ring-0 only. */
6981 if (IEM_GET_CPL(pVCpu) != 0)
6982 return iemRaiseGeneralProtectionFault0(pVCpu);
6983 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6984 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6985
6986 if (!IEM_IS_IN_GUEST(pVCpu))
6987 { /* probable */ }
6988#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6989 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6990 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6991 {
6992 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6993 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6994 }
6995#endif
6996 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6997 {
6998 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6999 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7000 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
7001 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
7002 }
7003
7004 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
7005 if (rc == VINF_SUCCESS)
7006 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7007 if (rc == VINF_PGM_SYNC_CR3)
7008 {
7009 iemSetPassUpStatus(pVCpu, rc);
7010 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7011 }
7012
7013 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
7014 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
7015 return rc;
7016}
7017
7018
7019/**
7020 * Implements INVPCID.
7021 *
7022 * @param iEffSeg The segment of the invpcid descriptor.
7023 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
7024 * @param uInvpcidType The invalidation type.
7025 * @remarks Updates the RIP.
7026 */
7027IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
7028{
7029 /*
7030 * Check preconditions.
7031 */
7032 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
7033 return iemRaiseUndefinedOpcode(pVCpu);
7034
7035 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
7036 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7037 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID)))
7038 { /* likely */ }
7039 else
7040 {
7041 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
7042 return iemRaiseUndefinedOpcode(pVCpu);
7043 }
7044
7045 if (IEM_GET_CPL(pVCpu) != 0)
7046 {
7047 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
7048 return iemRaiseGeneralProtectionFault0(pVCpu);
7049 }
7050
7051 if (IEM_IS_V86_MODE(pVCpu))
7052 {
7053 Log(("invpcid: v8086 mode -> #GP(0)\n"));
7054 return iemRaiseGeneralProtectionFault0(pVCpu);
7055 }
7056
7057 /*
7058 * Check nested-guest intercept.
7059 *
7060 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
7061 * both set. We have already checked the former earlier in this function.
7062 *
7063 * CPL and virtual-8086 mode checks take priority over this VM-exit.
7064 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
7065 */
7066 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7067 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
7068 { /* probable */ }
7069 else
7070 {
7071 Log(("invpcid: Guest intercept -> #VM-exit\n"));
7072 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
7073 }
7074
7075 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
7076 {
7077 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
7078 return iemRaiseGeneralProtectionFault0(pVCpu);
7079 }
7080 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
7081
7082 /*
7083 * Fetch the invpcid descriptor from guest memory.
7084 */
7085 RTUINT128U uDesc;
7086 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
7087 if (rcStrict == VINF_SUCCESS)
7088 {
7089 /*
7090 * Validate the descriptor.
7091 */
7092 if (uDesc.s.Lo > 0xfff)
7093 {
7094 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
7095 return iemRaiseGeneralProtectionFault0(pVCpu);
7096 }
7097
7098 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
7099 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
7100 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
7101 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
7102 switch (uInvpcidType)
7103 {
7104 case X86_INVPCID_TYPE_INDV_ADDR:
7105 {
7106 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
7107 {
7108 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
7109 return iemRaiseGeneralProtectionFault0(pVCpu);
7110 }
7111 if ( !(uCr4 & X86_CR4_PCIDE)
7112 && uPcid != 0)
7113 {
7114 Log(("invpcid: invalid pcid %#x\n", uPcid));
7115 return iemRaiseGeneralProtectionFault0(pVCpu);
7116 }
7117
7118 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
7119 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7120 break;
7121 }
7122
7123 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
7124 {
7125 if ( !(uCr4 & X86_CR4_PCIDE)
7126 && uPcid != 0)
7127 {
7128 Log(("invpcid: invalid pcid %#x\n", uPcid));
7129 return iemRaiseGeneralProtectionFault0(pVCpu);
7130 }
7131 /* Invalidate all mappings associated with PCID except global translations. */
7132 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7133 break;
7134 }
7135
7136 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
7137 {
7138 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
7139 break;
7140 }
7141
7142 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
7143 {
7144 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7145 break;
7146 }
7147 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7148 }
7149 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7150 }
7151 return rcStrict;
7152}
7153
7154
7155/**
7156 * Implements INVD.
7157 */
7158IEM_CIMPL_DEF_0(iemCImpl_invd)
7159{
7160 if (IEM_GET_CPL(pVCpu) != 0)
7161 {
7162 Log(("invd: CPL != 0 -> #GP(0)\n"));
7163 return iemRaiseGeneralProtectionFault0(pVCpu);
7164 }
7165
7166 if (!IEM_IS_IN_GUEST(pVCpu))
7167 { /* probable */ }
7168 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7169 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
7170 else
7171 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0, cbInstr);
7172
7173 /* We currently take no action here. */
7174 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7175}
7176
7177
7178/**
7179 * Implements WBINVD.
7180 */
7181IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
7182{
7183 if (IEM_GET_CPL(pVCpu) != 0)
7184 {
7185 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
7186 return iemRaiseGeneralProtectionFault0(pVCpu);
7187 }
7188
7189 if (!IEM_IS_IN_GUEST(pVCpu))
7190 { /* probable */ }
7191 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7192 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
7193 else
7194 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0, cbInstr);
7195
7196 /* We currently take no action here. */
7197 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7198}
7199
7200
7201/** Opcode 0x0f 0xaa. */
7202IEM_CIMPL_DEF_0(iemCImpl_rsm)
7203{
7204 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0, cbInstr);
7205 NOREF(cbInstr);
7206 return iemRaiseUndefinedOpcode(pVCpu);
7207}
7208
7209
7210/**
7211 * Implements RDTSC.
7212 */
7213IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
7214{
7215 /*
7216 * Check preconditions.
7217 */
7218 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
7219 return iemRaiseUndefinedOpcode(pVCpu);
7220
7221 if (IEM_GET_CPL(pVCpu) != 0)
7222 {
7223 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7224 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7225 {
7226 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7227 return iemRaiseGeneralProtectionFault0(pVCpu);
7228 }
7229 }
7230
7231 if (!IEM_IS_IN_GUEST(pVCpu))
7232 { /* probable */ }
7233 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7234 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7235 {
7236 Log(("rdtsc: Guest intercept -> VM-exit\n"));
7237 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
7238 }
7239 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
7240 {
7241 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
7242 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7243 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7244 }
7245
7246 /*
7247 * Do the job.
7248 */
7249 uint64_t uTicks = TMCpuTickGet(pVCpu);
7250#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7251 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7252#endif
7253 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7254 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7255 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
7256 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7257}
7258
7259
7260/**
7261 * Implements RDTSC.
7262 */
7263IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
7264{
7265 /*
7266 * Check preconditions.
7267 */
7268 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
7269 return iemRaiseUndefinedOpcode(pVCpu);
7270
7271 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7272 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP)))
7273 { /* likely */ }
7274 else
7275 {
7276 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
7277 return iemRaiseUndefinedOpcode(pVCpu);
7278 }
7279
7280 if (IEM_GET_CPL(pVCpu) != 0)
7281 {
7282 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7283 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7284 {
7285 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7286 return iemRaiseGeneralProtectionFault0(pVCpu);
7287 }
7288 }
7289
7290 if (!IEM_IS_IN_GUEST(pVCpu))
7291 { /* probable */ }
7292 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7293 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7294 {
7295 Log(("rdtscp: Guest intercept -> VM-exit\n"));
7296 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
7297 }
7298 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
7299 {
7300 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
7301 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7302 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7303 }
7304
7305 /*
7306 * Do the job.
7307 * Query the MSR first in case of trips to ring-3.
7308 */
7309 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7310 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7311 if (rcStrict == VINF_SUCCESS)
7312 {
7313 /* Low dword of the TSC_AUX msr only. */
7314 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7315
7316 uint64_t uTicks = TMCpuTickGet(pVCpu);
7317#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7318 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7319#endif
7320 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7321 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7322 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7323 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7324 }
7325 return rcStrict;
7326}
7327
7328
7329/**
7330 * Implements RDPMC.
7331 */
7332IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7333{
7334 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7335
7336 if ( IEM_GET_CPL(pVCpu) != 0
7337 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7338 return iemRaiseGeneralProtectionFault0(pVCpu);
7339
7340 if (!IEM_IS_IN_GUEST(pVCpu))
7341 { /* probable */ }
7342 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7343 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7344 {
7345 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7346 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7347 }
7348 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7349 {
7350 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7351 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7352 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7353 }
7354
7355 /** @todo Emulate performance counters, for now just return 0. */
7356 pVCpu->cpum.GstCtx.rax = 0;
7357 pVCpu->cpum.GstCtx.rdx = 0;
7358 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7359 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7360 * ecx but see @bugref{3472}! */
7361
7362 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7363}
7364
7365
7366/**
7367 * Implements RDMSR.
7368 */
7369IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7370{
7371 /*
7372 * Check preconditions.
7373 */
7374 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7375 return iemRaiseUndefinedOpcode(pVCpu);
7376 if (IEM_GET_CPL(pVCpu) != 0)
7377 return iemRaiseGeneralProtectionFault0(pVCpu);
7378
7379 /*
7380 * Check nested-guest intercepts.
7381 */
7382 if (!IEM_IS_IN_GUEST(pVCpu))
7383 { /* probable */ }
7384#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7385 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7386 {
7387 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7388 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7389 }
7390#endif
7391#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7392 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7393 {
7394 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */, cbInstr);
7395 if (rcStrict == VINF_SVM_VMEXIT)
7396 return VINF_SUCCESS;
7397 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7398 {
7399 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7400 return rcStrict;
7401 }
7402 }
7403#endif
7404
7405 /*
7406 * Do the job.
7407 */
7408 RTUINT64U uValue;
7409 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7410 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7411
7412 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7413 if (rcStrict == VINF_SUCCESS)
7414 {
7415 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7416 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7417 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7418
7419 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7420 }
7421
7422#ifndef IN_RING3
7423 /* Deferred to ring-3. */
7424 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7425 {
7426 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7427 return rcStrict;
7428 }
7429#endif
7430
7431 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7432 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7433 {
7434 pVCpu->iem.s.cLogRelRdMsr++;
7435 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7436 }
7437 else
7438 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7439 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7440 return iemRaiseGeneralProtectionFault0(pVCpu);
7441}
7442
7443
7444/**
7445 * Implements WRMSR.
7446 */
7447IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7448{
7449 /*
7450 * Check preconditions.
7451 */
7452 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7453 return iemRaiseUndefinedOpcode(pVCpu);
7454 if (IEM_GET_CPL(pVCpu) != 0)
7455 return iemRaiseGeneralProtectionFault0(pVCpu);
7456
7457 RTUINT64U uValue;
7458 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7459 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7460
7461 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7462
7463 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7464 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7465
7466 /*
7467 * Check nested-guest intercepts.
7468 */
7469 if (!IEM_IS_IN_GUEST(pVCpu))
7470 { /* probable */ }
7471#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7472 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7473 {
7474 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7475 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7476 }
7477#endif
7478#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7479 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7480 {
7481 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */, cbInstr);
7482 if (rcStrict == VINF_SVM_VMEXIT)
7483 return VINF_SUCCESS;
7484 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7485 {
7486 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7487 return rcStrict;
7488 }
7489 }
7490#endif
7491
7492 /*
7493 * Do the job.
7494 */
7495 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7496 if (rcStrict == VINF_SUCCESS)
7497 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7498
7499#ifndef IN_RING3
7500 /* Deferred to ring-3. */
7501 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7502 {
7503 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7504 return rcStrict;
7505 }
7506#endif
7507
7508 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7509 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7510 {
7511 pVCpu->iem.s.cLogRelWrMsr++;
7512 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7513 }
7514 else
7515 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7516 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7517 return iemRaiseGeneralProtectionFault0(pVCpu);
7518}
7519
7520
7521/**
7522 * Implements 'IN eAX, port'.
7523 *
7524 * @param u16Port The source port.
7525 * @param cbReg The register size.
7526 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7527 * immediate operand or the implicit DX register.
7528 * Bits 3-0: Effective address mode.
7529 */
7530IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7531{
7532 /*
7533 * CPL check
7534 */
7535 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7536 if (rcStrict != VINF_SUCCESS)
7537 return rcStrict;
7538
7539 if (!IEM_IS_IN_GUEST(pVCpu))
7540 { /* probable */ }
7541
7542 /*
7543 * Check VMX nested-guest IO intercept.
7544 */
7545#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7546 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7547 {
7548 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7549 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7550 return rcStrict;
7551 }
7552#endif
7553
7554 /*
7555 * Check SVM nested-guest IO intercept.
7556 */
7557#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7558 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7559 {
7560 uint8_t cAddrSizeBits;
7561 switch (bImmAndEffAddrMode & 0xf)
7562 {
7563 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7564 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7565 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7566 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7567 }
7568 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7569 false /* fRep */, false /* fStrIo */, cbInstr);
7570 if (rcStrict == VINF_SVM_VMEXIT)
7571 return VINF_SUCCESS;
7572 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7573 {
7574 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7575 VBOXSTRICTRC_VAL(rcStrict)));
7576 return rcStrict;
7577 }
7578 }
7579#endif
7580#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7581 RT_NOREF(bImmAndEffAddrMode);
7582#endif
7583
7584 /*
7585 * Perform the I/O.
7586 */
7587 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7588 uint32_t u32Value = 0;
7589 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7590 if (IOM_SUCCESS(rcStrict))
7591 {
7592 switch (cbReg)
7593 {
7594 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7595 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7596 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7597 default: AssertFailedReturn(VERR_IEM_IPE_3);
7598 }
7599
7600 pVCpu->iem.s.cPotentialExits++;
7601 if (rcStrict != VINF_SUCCESS)
7602 iemSetPassUpStatus(pVCpu, rcStrict);
7603
7604 /*
7605 * Check for I/O breakpoints before we complete the instruction.
7606 */
7607 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7608 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7609 && X86_DR7_ANY_RW_IO(fDr7)
7610 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7611 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7612 && rcStrict == VINF_SUCCESS))
7613 {
7614 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7615 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7616 }
7617
7618 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7619 }
7620
7621 return rcStrict;
7622}
7623
7624
7625/**
7626 * Implements 'IN eAX, DX'.
7627 *
7628 * @param cbReg The register size.
7629 * @param enmEffAddrMode Effective address mode.
7630 */
7631IEM_CIMPL_DEF_2(iemCImpl_in_eAX_DX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7632{
7633 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7634}
7635
7636
7637/**
7638 * Implements 'OUT port, eAX'.
7639 *
7640 * @param u16Port The destination port.
7641 * @param cbReg The register size.
7642 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7643 * immediate operand or the implicit DX register.
7644 * Bits 3-0: Effective address mode.
7645 */
7646IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7647{
7648 /*
7649 * CPL check
7650 */
7651 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7652 if (rcStrict != VINF_SUCCESS)
7653 return rcStrict;
7654
7655 if (!IEM_IS_IN_GUEST(pVCpu))
7656 { /* probable */ }
7657
7658 /*
7659 * Check VMX nested-guest I/O intercept.
7660 */
7661#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7662 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7663 {
7664 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7665 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7666 return rcStrict;
7667 }
7668#endif
7669
7670 /*
7671 * Check SVM nested-guest I/O intercept.
7672 */
7673#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7674 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7675 {
7676 uint8_t cAddrSizeBits;
7677 switch (bImmAndEffAddrMode & 0xf)
7678 {
7679 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7680 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7681 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7682 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7683 }
7684 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7685 false /* fRep */, false /* fStrIo */, cbInstr);
7686 if (rcStrict == VINF_SVM_VMEXIT)
7687 return VINF_SUCCESS;
7688 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7689 {
7690 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7691 VBOXSTRICTRC_VAL(rcStrict)));
7692 return rcStrict;
7693 }
7694 }
7695#endif
7696#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7697 RT_NOREF(bImmAndEffAddrMode);
7698#endif
7699
7700 /*
7701 * Perform the I/O.
7702 */
7703 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7704 uint32_t u32Value;
7705 switch (cbReg)
7706 {
7707 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7708 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7709 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7710 default: AssertFailedReturn(VERR_IEM_IPE_4);
7711 }
7712 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7713 if (IOM_SUCCESS(rcStrict))
7714 {
7715 pVCpu->iem.s.cPotentialExits++;
7716 if (rcStrict != VINF_SUCCESS)
7717 iemSetPassUpStatus(pVCpu, rcStrict);
7718
7719 /*
7720 * Check for I/O breakpoints before we complete the instruction.
7721 */
7722 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7723 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7724 && X86_DR7_ANY_RW_IO(fDr7)
7725 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7726 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7727 && rcStrict == VINF_SUCCESS))
7728 {
7729 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7730 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7731 }
7732
7733 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7734 }
7735 return rcStrict;
7736}
7737
7738
7739/**
7740 * Implements 'OUT DX, eAX'.
7741 *
7742 * @param cbReg The register size.
7743 * @param enmEffAddrMode Effective address mode.
7744 */
7745IEM_CIMPL_DEF_2(iemCImpl_out_DX_eAX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7746{
7747 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7748}
7749
7750
7751/**
7752 * Implements 'CLI'.
7753 */
7754IEM_CIMPL_DEF_0(iemCImpl_cli)
7755{
7756 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7757#ifdef LOG_ENABLED
7758 uint32_t const fEflOld = fEfl;
7759#endif
7760
7761 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7762 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7763 {
7764 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7765 if (!(fEfl & X86_EFL_VM))
7766 {
7767 if (IEM_GET_CPL(pVCpu) <= uIopl)
7768 fEfl &= ~X86_EFL_IF;
7769 else if ( IEM_GET_CPL(pVCpu) == 3
7770 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7771 fEfl &= ~X86_EFL_VIF;
7772 else
7773 return iemRaiseGeneralProtectionFault0(pVCpu);
7774 }
7775 /* V8086 */
7776 else if (uIopl == 3)
7777 fEfl &= ~X86_EFL_IF;
7778 else if ( uIopl < 3
7779 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7780 fEfl &= ~X86_EFL_VIF;
7781 else
7782 return iemRaiseGeneralProtectionFault0(pVCpu);
7783 }
7784 /* real mode */
7785 else
7786 fEfl &= ~X86_EFL_IF;
7787
7788 /* Commit. */
7789 IEMMISC_SET_EFL(pVCpu, fEfl);
7790 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7791 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7792 return rcStrict;
7793}
7794
7795
7796/**
7797 * Implements 'STI'.
7798 */
7799IEM_CIMPL_DEF_0(iemCImpl_sti)
7800{
7801 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7802 uint32_t const fEflOld = fEfl;
7803
7804 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7805 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7806 {
7807 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7808 if (!(fEfl & X86_EFL_VM))
7809 {
7810 if (IEM_GET_CPL(pVCpu) <= uIopl)
7811 fEfl |= X86_EFL_IF;
7812 else if ( IEM_GET_CPL(pVCpu) == 3
7813 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7814 && !(fEfl & X86_EFL_VIP) )
7815 fEfl |= X86_EFL_VIF;
7816 else
7817 return iemRaiseGeneralProtectionFault0(pVCpu);
7818 }
7819 /* V8086 */
7820 else if (uIopl == 3)
7821 fEfl |= X86_EFL_IF;
7822 else if ( uIopl < 3
7823 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7824 && !(fEfl & X86_EFL_VIP) )
7825 fEfl |= X86_EFL_VIF;
7826 else
7827 return iemRaiseGeneralProtectionFault0(pVCpu);
7828 }
7829 /* real mode */
7830 else
7831 fEfl |= X86_EFL_IF;
7832
7833 /*
7834 * Commit.
7835 *
7836 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7837 */
7838 IEMMISC_SET_EFL(pVCpu, fEfl);
7839 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7840 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7841 {
7842 /** @todo only set it the shadow flag if it was clear before? */
7843 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7844 }
7845 pVCpu->iem.s.fTbCurInstrIsSti = true;
7846 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7847 return rcStrict;
7848}
7849
7850
7851/**
7852 * Implements 'HLT'.
7853 */
7854IEM_CIMPL_DEF_0(iemCImpl_hlt)
7855{
7856 if (IEM_GET_CPL(pVCpu) != 0)
7857 return iemRaiseGeneralProtectionFault0(pVCpu);
7858
7859 if (!IEM_IS_IN_GUEST(pVCpu))
7860 { /* probable */ }
7861 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7862 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7863 {
7864 Log2(("hlt: Guest intercept -> VM-exit\n"));
7865 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7866 }
7867 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7868 {
7869 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7870 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7871 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7872 }
7873
7874 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7875 * be returning any status codes relating to non-guest events being raised, as
7876 * we'll mess up the guest HALT otherwise. */
7877 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7878 if (rcStrict == VINF_SUCCESS)
7879 rcStrict = VINF_EM_HALT;
7880 return rcStrict;
7881}
7882
7883
7884/**
7885 * Implements 'MONITOR'.
7886 */
7887IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7888{
7889 /*
7890 * Permission checks.
7891 */
7892 if (IEM_GET_CPL(pVCpu) != 0)
7893 {
7894 Log2(("monitor: CPL != 0\n"));
7895 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7896 }
7897 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7898 {
7899 Log2(("monitor: Not in CPUID\n"));
7900 return iemRaiseUndefinedOpcode(pVCpu);
7901 }
7902
7903 /*
7904 * Check VMX guest-intercept.
7905 * This should be considered a fault-like VM-exit.
7906 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7907 */
7908 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7909 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7910 { /* probable */ }
7911 else
7912 {
7913 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7914 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7915 }
7916
7917 /*
7918 * Gather the operands and validate them.
7919 */
7920 RTGCPTR GCPtrMem = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7921 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7922 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7923/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7924 * \#GP first. */
7925 if (uEcx != 0)
7926 {
7927 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7928 return iemRaiseGeneralProtectionFault0(pVCpu);
7929 }
7930
7931 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7932 if (rcStrict != VINF_SUCCESS)
7933 return rcStrict;
7934
7935 RTGCPHYS GCPhysMem;
7936 /** @todo access size */
7937 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7938 if (rcStrict != VINF_SUCCESS)
7939 return rcStrict;
7940
7941 if (!IEM_IS_IN_GUEST(pVCpu))
7942 { /* probable */ }
7943#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7944 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7945 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7946 {
7947 /*
7948 * MONITOR does not access the memory, just monitors the address. However,
7949 * if the address falls in the APIC-access page, the address monitored must
7950 * instead be the corresponding address in the virtual-APIC page.
7951 *
7952 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7953 */
7954 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7955 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7956 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7957 return rcStrict;
7958 }
7959#endif
7960 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7961 {
7962 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7963 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7964 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7965 }
7966
7967 /*
7968 * Call EM to prepare the monitor/wait.
7969 */
7970 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7971 Assert(rcStrict == VINF_SUCCESS);
7972 if (rcStrict == VINF_SUCCESS)
7973 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7974 return rcStrict;
7975}
7976
7977
7978/**
7979 * Implements 'MWAIT'.
7980 */
7981IEM_CIMPL_DEF_0(iemCImpl_mwait)
7982{
7983 /*
7984 * Permission checks.
7985 */
7986 if (IEM_GET_CPL(pVCpu) != 0)
7987 {
7988 Log2(("mwait: CPL != 0\n"));
7989 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7990 * EFLAGS.VM then.) */
7991 return iemRaiseUndefinedOpcode(pVCpu);
7992 }
7993 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7994 {
7995 Log2(("mwait: Not in CPUID\n"));
7996 return iemRaiseUndefinedOpcode(pVCpu);
7997 }
7998
7999 /* Check VMX nested-guest intercept. */
8000 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8001 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
8002 { /* probable */ }
8003 else
8004 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
8005
8006 /*
8007 * Gather the operands and validate them.
8008 */
8009 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8010 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8011 if (uEcx != 0)
8012 {
8013 /* Only supported extension is break on IRQ when IF=0. */
8014 if (uEcx > 1)
8015 {
8016 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
8017 return iemRaiseGeneralProtectionFault0(pVCpu);
8018 }
8019 uint32_t fMWaitFeatures = 0;
8020 uint32_t uIgnore = 0;
8021 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
8022 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8023 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8024 {
8025 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
8026 return iemRaiseGeneralProtectionFault0(pVCpu);
8027 }
8028
8029#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8030 /*
8031 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
8032 * for delivery; and interrupts are disabled the processor does not enter its
8033 * mwait state but rather passes control to the next instruction.
8034 *
8035 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
8036 */
8037 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8038 || pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
8039 { /* probable */ }
8040 else if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
8041 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
8042 /** @todo finish: check up this out after we move int window stuff out of the
8043 * run loop and into the instruction finishing logic here. */
8044 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8045#endif
8046 }
8047
8048 /*
8049 * Check SVM nested-guest mwait intercepts.
8050 */
8051 if (!IEM_IS_IN_GUEST(pVCpu))
8052 { /* probable */ }
8053 else if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
8054 && EMMonitorIsArmed(pVCpu))
8055 {
8056 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
8057 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8058 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8059 }
8060 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
8061 {
8062 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
8063 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8064 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8065 }
8066
8067 /*
8068 * Call EM to prepare the monitor/wait.
8069 *
8070 * This will return VINF_EM_HALT. If there the trap flag is set, we may
8071 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
8072 * that will only return guest related events.
8073 */
8074 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
8075
8076 /** @todo finish: This needs more thinking as we should suppress internal
8077 * debugger events here, or we'll bugger up the guest state even more than we
8078 * alread do around VINF_EM_HALT. */
8079 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8080 if (rcStrict2 != VINF_SUCCESS)
8081 {
8082 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
8083 rcStrict = rcStrict2;
8084 }
8085
8086 return rcStrict;
8087}
8088
8089
8090/**
8091 * Implements 'SWAPGS'.
8092 */
8093IEM_CIMPL_DEF_0(iemCImpl_swapgs)
8094{
8095 Assert(IEM_IS_64BIT_CODE(pVCpu)); /* Caller checks this. */
8096
8097 /*
8098 * Permission checks.
8099 */
8100 if (IEM_GET_CPL(pVCpu) != 0)
8101 {
8102 Log2(("swapgs: CPL != 0\n"));
8103 return iemRaiseUndefinedOpcode(pVCpu);
8104 }
8105
8106 /*
8107 * Do the job.
8108 */
8109 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
8110 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
8111 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
8112 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
8113
8114 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8115}
8116
8117
8118#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8119/**
8120 * Handles a CPUID call.
8121 */
8122static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
8123 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
8124{
8125 switch (iFunction)
8126 {
8127 case VBOX_CPUID_FN_ID:
8128 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
8129 *pEax = VBOX_CPUID_RESP_ID_EAX;
8130 *pEbx = VBOX_CPUID_RESP_ID_EBX;
8131 *pEcx = VBOX_CPUID_RESP_ID_ECX;
8132 *pEdx = VBOX_CPUID_RESP_ID_EDX;
8133 break;
8134
8135 case VBOX_CPUID_FN_LOG:
8136 {
8137 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
8138 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
8139
8140 /* Validate input. */
8141 uint32_t cchToLog = *pEdx;
8142 if (cchToLog <= _2M)
8143 {
8144 uint32_t const uLogPicker = *pEbx;
8145 if (uLogPicker <= 1)
8146 {
8147 /* Resolve the logger. */
8148 PRTLOGGER const pLogger = !uLogPicker
8149 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
8150 if (pLogger)
8151 {
8152 /* Copy over the data: */
8153 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
8154 while (cchToLog > 0)
8155 {
8156 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
8157 if (cbToMap > cchToLog)
8158 cbToMap = cchToLog;
8159 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
8160 * unnecessary calls & iterations per pages. */
8161 if (cbToMap > 512)
8162 cbToMap = 512;
8163 void *pvSrc = NULL;
8164 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, cbToMap, UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
8165 if (rcStrict == VINF_SUCCESS)
8166 {
8167 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
8168 rcStrict = iemMemCommitAndUnmap(pVCpu, pvSrc, IEM_ACCESS_DATA_R);
8169 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
8170 }
8171 else
8172 {
8173 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
8174 return rcStrict;
8175 }
8176
8177 /* Advance. */
8178 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
8179 *pEdx = cchToLog -= cbToMap;
8180 }
8181 *pEax = VINF_SUCCESS;
8182 }
8183 else
8184 *pEax = (uint32_t)VERR_NOT_FOUND;
8185 }
8186 else
8187 *pEax = (uint32_t)VERR_NOT_FOUND;
8188 }
8189 else
8190 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
8191 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
8192 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
8193 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
8194 break;
8195 }
8196
8197 default:
8198 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
8199 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
8200 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
8201 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
8202 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
8203 break;
8204 }
8205 return VINF_SUCCESS;
8206}
8207#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
8208
8209/**
8210 * Implements 'CPUID'.
8211 */
8212IEM_CIMPL_DEF_0(iemCImpl_cpuid)
8213{
8214 if (!IEM_IS_IN_GUEST(pVCpu))
8215 { /* probable */ }
8216 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8217 {
8218 Log2(("cpuid: Guest intercept -> VM-exit\n"));
8219 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
8220 }
8221 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
8222 {
8223 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
8224 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8225 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8226 }
8227
8228
8229 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8230 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8231
8232#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8233 /*
8234 * CPUID host call backdoor.
8235 */
8236 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
8237 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
8238 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
8239 {
8240 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
8241 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
8242 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8243 if (rcStrict != VINF_SUCCESS)
8244 return rcStrict;
8245 }
8246 /*
8247 * Regular CPUID.
8248 */
8249 else
8250#endif
8251 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
8252 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8253
8254 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
8255 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
8256 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
8257 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
8258 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
8259
8260 pVCpu->iem.s.cPotentialExits++;
8261 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8262}
8263
8264
8265/**
8266 * Implements 'AAD'.
8267 *
8268 * @param bImm The immediate operand.
8269 */
8270IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
8271{
8272 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8273 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
8274 pVCpu->cpum.GstCtx.ax = al;
8275 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8276 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8277 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8278
8279 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8280}
8281
8282
8283/**
8284 * Implements 'AAM'.
8285 *
8286 * @param bImm The immediate operand. Cannot be 0.
8287 */
8288IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
8289{
8290 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
8291
8292 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8293 uint8_t const al = (uint8_t)ax % bImm;
8294 uint8_t const ah = (uint8_t)ax / bImm;
8295 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
8296 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8297 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8298 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8299
8300 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8301}
8302
8303
8304/**
8305 * Implements 'DAA'.
8306 */
8307IEM_CIMPL_DEF_0(iemCImpl_daa)
8308{
8309 uint8_t const al = pVCpu->cpum.GstCtx.al;
8310 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8311
8312 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8313 || (al & 0xf) >= 10)
8314 {
8315 pVCpu->cpum.GstCtx.al = al + 6;
8316 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8317 }
8318 else
8319 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8320
8321 if (al >= 0x9a || fCarry)
8322 {
8323 pVCpu->cpum.GstCtx.al += 0x60;
8324 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8325 }
8326 else
8327 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8328
8329 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8330 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8331}
8332
8333
8334/**
8335 * Implements 'DAS'.
8336 */
8337IEM_CIMPL_DEF_0(iemCImpl_das)
8338{
8339 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8340 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8341
8342 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8343 || (uInputAL & 0xf) >= 10)
8344 {
8345 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8346 if (uInputAL < 6)
8347 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8348 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8349 }
8350 else
8351 {
8352 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8353 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8354 }
8355
8356 if (uInputAL >= 0x9a || fCarry)
8357 {
8358 pVCpu->cpum.GstCtx.al -= 0x60;
8359 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8360 }
8361
8362 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8363 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8364}
8365
8366
8367/**
8368 * Implements 'AAA'.
8369 */
8370IEM_CIMPL_DEF_0(iemCImpl_aaa)
8371{
8372 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8373 {
8374 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8375 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8376 {
8377 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8378 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8379 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8380 }
8381 else
8382 {
8383 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8384 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8385 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8386 }
8387 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8388 }
8389 else
8390 {
8391 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8392 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8393 {
8394 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8395 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8396 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8397 }
8398 else
8399 {
8400 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8401 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8402 }
8403 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8404 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8405 }
8406
8407 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8408}
8409
8410
8411/**
8412 * Implements 'AAS'.
8413 */
8414IEM_CIMPL_DEF_0(iemCImpl_aas)
8415{
8416 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8417 {
8418 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8419 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8420 {
8421 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8422 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8423 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8424 }
8425 else
8426 {
8427 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8428 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8429 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8430 }
8431 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8432 }
8433 else
8434 {
8435 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8436 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8437 {
8438 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8439 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8440 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8441 }
8442 else
8443 {
8444 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8445 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8446 }
8447 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8448 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8449 }
8450
8451 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8452}
8453
8454
8455/**
8456 * Implements the 16-bit version of 'BOUND'.
8457 *
8458 * @note We have separate 16-bit and 32-bit variants of this function due to
8459 * the decoder using unsigned parameters, whereas we want signed one to
8460 * do the job. This is significant for a recompiler.
8461 */
8462IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8463{
8464 /*
8465 * Check if the index is inside the bounds, otherwise raise #BR.
8466 */
8467 if ( idxArray >= idxLowerBound
8468 && idxArray <= idxUpperBound)
8469 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8470 return iemRaiseBoundRangeExceeded(pVCpu);
8471}
8472
8473
8474/**
8475 * Implements the 32-bit version of 'BOUND'.
8476 */
8477IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8478{
8479 /*
8480 * Check if the index is inside the bounds, otherwise raise #BR.
8481 */
8482 if ( idxArray >= idxLowerBound
8483 && idxArray <= idxUpperBound)
8484 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8485 return iemRaiseBoundRangeExceeded(pVCpu);
8486}
8487
8488
8489
8490/*
8491 * Instantiate the various string operation combinations.
8492 */
8493#define OP_SIZE 8
8494#define ADDR_SIZE 16
8495#include "IEMAllCImplStrInstr.cpp.h"
8496#define OP_SIZE 8
8497#define ADDR_SIZE 32
8498#include "IEMAllCImplStrInstr.cpp.h"
8499#define OP_SIZE 8
8500#define ADDR_SIZE 64
8501#include "IEMAllCImplStrInstr.cpp.h"
8502
8503#define OP_SIZE 16
8504#define ADDR_SIZE 16
8505#include "IEMAllCImplStrInstr.cpp.h"
8506#define OP_SIZE 16
8507#define ADDR_SIZE 32
8508#include "IEMAllCImplStrInstr.cpp.h"
8509#define OP_SIZE 16
8510#define ADDR_SIZE 64
8511#include "IEMAllCImplStrInstr.cpp.h"
8512
8513#define OP_SIZE 32
8514#define ADDR_SIZE 16
8515#include "IEMAllCImplStrInstr.cpp.h"
8516#define OP_SIZE 32
8517#define ADDR_SIZE 32
8518#include "IEMAllCImplStrInstr.cpp.h"
8519#define OP_SIZE 32
8520#define ADDR_SIZE 64
8521#include "IEMAllCImplStrInstr.cpp.h"
8522
8523#define OP_SIZE 64
8524#define ADDR_SIZE 32
8525#include "IEMAllCImplStrInstr.cpp.h"
8526#define OP_SIZE 64
8527#define ADDR_SIZE 64
8528#include "IEMAllCImplStrInstr.cpp.h"
8529
8530
8531/**
8532 * Implements 'XGETBV'.
8533 */
8534IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8535{
8536 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8537 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8538 {
8539 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8540 switch (uEcx)
8541 {
8542 case 0:
8543 break;
8544
8545 case 1: /** @todo Implement XCR1 support. */
8546 default:
8547 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8548 return iemRaiseGeneralProtectionFault0(pVCpu);
8549
8550 }
8551 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8552 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8553 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8554
8555 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8556 }
8557 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8558 return iemRaiseUndefinedOpcode(pVCpu);
8559}
8560
8561
8562/**
8563 * Implements 'XSETBV'.
8564 */
8565IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8566{
8567 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8568 {
8569 /** @todo explain why this happens before the CPL check. */
8570 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8571 { /* probable */ }
8572 else
8573 {
8574 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8575 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8576 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8577 }
8578
8579 if (IEM_GET_CPL(pVCpu) == 0)
8580 {
8581 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8582
8583 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8584 { /* probable */ }
8585 else
8586 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8587
8588 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8589 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8590 switch (uEcx)
8591 {
8592 case 0:
8593 {
8594 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8595 if (rc == VINF_SUCCESS)
8596 break;
8597 Assert(rc == VERR_CPUM_RAISE_GP_0);
8598 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8599 return iemRaiseGeneralProtectionFault0(pVCpu);
8600 }
8601
8602 case 1: /** @todo Implement XCR1 support. */
8603 default:
8604 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8605 return iemRaiseGeneralProtectionFault0(pVCpu);
8606
8607 }
8608
8609 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8610 }
8611
8612 Log(("xsetbv cpl=%u -> GP(0)\n", IEM_GET_CPL(pVCpu)));
8613 return iemRaiseGeneralProtectionFault0(pVCpu);
8614 }
8615 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8616 return iemRaiseUndefinedOpcode(pVCpu);
8617}
8618
8619#ifndef RT_ARCH_ARM64
8620# ifdef IN_RING3
8621
8622/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8623struct IEMCIMPLCX16ARGS
8624{
8625 PRTUINT128U pu128Dst;
8626 PRTUINT128U pu128RaxRdx;
8627 PRTUINT128U pu128RbxRcx;
8628 uint32_t *pEFlags;
8629# ifdef VBOX_STRICT
8630 uint32_t cCalls;
8631# endif
8632};
8633
8634/**
8635 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8636 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8637 */
8638static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8639{
8640 RT_NOREF(pVM, pVCpu);
8641 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8642# ifdef VBOX_STRICT
8643 Assert(pArgs->cCalls == 0);
8644 pArgs->cCalls++;
8645# endif
8646
8647 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8648 return VINF_SUCCESS;
8649}
8650
8651# endif /* IN_RING3 */
8652
8653/**
8654 * Implements 'CMPXCHG16B' fallback using rendezvous.
8655 */
8656IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8657 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8658{
8659# ifdef IN_RING3
8660 struct IEMCIMPLCX16ARGS Args;
8661 Args.pu128Dst = pu128Dst;
8662 Args.pu128RaxRdx = pu128RaxRdx;
8663 Args.pu128RbxRcx = pu128RbxRcx;
8664 Args.pEFlags = pEFlags;
8665# ifdef VBOX_STRICT
8666 Args.cCalls = 0;
8667# endif
8668 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8669 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8670 Assert(Args.cCalls == 1);
8671 if (rcStrict == VINF_SUCCESS)
8672 {
8673 /* Duplicated tail code. */
8674 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8675 if (rcStrict == VINF_SUCCESS)
8676 {
8677 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8678 if (!(*pEFlags & X86_EFL_ZF))
8679 {
8680 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8681 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8682 }
8683 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8684 }
8685 }
8686 return rcStrict;
8687# else
8688 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8689 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8690# endif
8691}
8692
8693#endif /* RT_ARCH_ARM64 */
8694
8695/**
8696 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8697 *
8698 * This is implemented in C because it triggers a load like behaviour without
8699 * actually reading anything. Since that's not so common, it's implemented
8700 * here.
8701 *
8702 * @param iEffSeg The effective segment.
8703 * @param GCPtrEff The address of the image.
8704 */
8705IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8706{
8707 /*
8708 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8709 */
8710 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8711 if (rcStrict == VINF_SUCCESS)
8712 {
8713 RTGCPHYS GCPhysMem;
8714 /** @todo access size. */
8715 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8716 if (rcStrict == VINF_SUCCESS)
8717 {
8718#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8719 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8720 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8721 { /* probable */ }
8722 else
8723 {
8724 /*
8725 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8726 * that contains the address. However, if the address falls in the APIC-access
8727 * page, the address flushed must instead be the corresponding address in the
8728 * virtual-APIC page.
8729 *
8730 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8731 */
8732 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8733 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8734 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8735 return rcStrict;
8736 }
8737#endif
8738 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8739 }
8740 }
8741
8742 return rcStrict;
8743}
8744
8745
8746/**
8747 * Implements 'FINIT' and 'FNINIT'.
8748 *
8749 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8750 * not.
8751 */
8752IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8753{
8754 /*
8755 * Exceptions.
8756 */
8757 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8758 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8759 return iemRaiseDeviceNotAvailable(pVCpu);
8760
8761 iemFpuActualizeStateForChange(pVCpu);
8762 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8763
8764 /* FINIT: Raise #MF on pending exception(s): */
8765 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8766 return iemRaiseMathFault(pVCpu);
8767
8768 /*
8769 * Reset the state.
8770 */
8771 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8772
8773 /* Rotate the stack to account for changed TOS. */
8774 iemFpuRotateStackSetTop(&pXState->x87, 0);
8775
8776 pXState->x87.FCW = 0x37f;
8777 pXState->x87.FSW = 0;
8778 pXState->x87.FTW = 0x00; /* 0 - empty. */
8779 /** @todo Intel says the instruction and data pointers are not cleared on
8780 * 387, presume that 8087 and 287 doesn't do so either. */
8781 /** @todo test this stuff. */
8782 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8783 {
8784 pXState->x87.FPUDP = 0;
8785 pXState->x87.DS = 0; //??
8786 pXState->x87.Rsrvd2 = 0;
8787 pXState->x87.FPUIP = 0;
8788 pXState->x87.CS = 0; //??
8789 pXState->x87.Rsrvd1 = 0;
8790 }
8791 pXState->x87.FOP = 0;
8792
8793 iemHlpUsedFpu(pVCpu);
8794 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8795}
8796
8797
8798/**
8799 * Implements 'FXSAVE'.
8800 *
8801 * @param iEffSeg The effective segment.
8802 * @param GCPtrEff The address of the image.
8803 * @param enmEffOpSize The operand size (only REX.W really matters).
8804 */
8805IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8806{
8807 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8808
8809 /** @todo check out bugref{1529} and AMD behaviour */
8810
8811 /*
8812 * Raise exceptions.
8813 */
8814 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8815 return iemRaiseDeviceNotAvailable(pVCpu);
8816
8817 /*
8818 * Access the memory.
8819 */
8820 void *pvMem512;
8821 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8822 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8823 if (rcStrict != VINF_SUCCESS)
8824 return rcStrict;
8825 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8826 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8827
8828 /*
8829 * Store the registers.
8830 */
8831 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8832 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8833
8834 /* common for all formats */
8835 pDst->FCW = pSrc->FCW;
8836 pDst->FSW = pSrc->FSW;
8837 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8838 pDst->FOP = pSrc->FOP;
8839 pDst->MXCSR = pSrc->MXCSR;
8840 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8841 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8842 {
8843 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8844 * them for now... */
8845 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8846 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8847 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8848 pDst->aRegs[i].au32[3] = 0;
8849 }
8850
8851 /* FPU IP, CS, DP and DS. */
8852 pDst->FPUIP = pSrc->FPUIP;
8853 pDst->CS = pSrc->CS;
8854 pDst->FPUDP = pSrc->FPUDP;
8855 pDst->DS = pSrc->DS;
8856 if (enmEffOpSize == IEMMODE_64BIT)
8857 {
8858 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8859 pDst->Rsrvd1 = pSrc->Rsrvd1;
8860 pDst->Rsrvd2 = pSrc->Rsrvd2;
8861 }
8862 else
8863 {
8864 pDst->Rsrvd1 = 0;
8865 pDst->Rsrvd2 = 0;
8866 }
8867
8868 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set. */
8869 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8870 || !IEM_IS_64BIT_CODE(pVCpu)
8871 || IEM_GET_CPL(pVCpu) != 0)
8872 {
8873 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8874 for (uint32_t i = 0; i < cXmmRegs; i++)
8875 pDst->aXMM[i] = pSrc->aXMM[i];
8876 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8877 * right? */
8878 }
8879
8880 /*
8881 * Commit the memory.
8882 */
8883 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8884 if (rcStrict != VINF_SUCCESS)
8885 return rcStrict;
8886
8887 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8888}
8889
8890
8891/**
8892 * Implements 'FXRSTOR'.
8893 *
8894 * @param iEffSeg The effective segment register for @a GCPtrEff.
8895 * @param GCPtrEff The address of the image.
8896 * @param enmEffOpSize The operand size (only REX.W really matters).
8897 */
8898IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8899{
8900 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8901
8902 /** @todo check out bugref{1529} and AMD behaviour */
8903
8904 /*
8905 * Raise exceptions.
8906 */
8907 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8908 return iemRaiseDeviceNotAvailable(pVCpu);
8909
8910 /*
8911 * Access the memory.
8912 */
8913 void *pvMem512;
8914 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8915 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8916 if (rcStrict != VINF_SUCCESS)
8917 return rcStrict;
8918 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8919 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8920
8921 /*
8922 * Check the state for stuff which will #GP(0).
8923 */
8924 uint32_t const fMXCSR = pSrc->MXCSR;
8925 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8926 if (fMXCSR & ~fMXCSR_MASK)
8927 {
8928 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8929 return iemRaiseGeneralProtectionFault0(pVCpu);
8930 }
8931
8932 /*
8933 * Load the registers.
8934 */
8935 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8936 * implementation specific whether MXCSR and XMM0-XMM7 are
8937 * restored according to Intel.
8938 * AMD says MXCSR and XMM registers are never loaded if
8939 * CR4.OSFXSR=0.
8940 */
8941
8942 /* common for all formats */
8943 pDst->FCW = pSrc->FCW;
8944 pDst->FSW = pSrc->FSW;
8945 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8946 pDst->FOP = pSrc->FOP;
8947 pDst->MXCSR = fMXCSR;
8948 /* (MXCSR_MASK is read-only) */
8949 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8950 {
8951 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8952 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8953 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8954 pDst->aRegs[i].au32[3] = 0;
8955 }
8956
8957 /* FPU IP, CS, DP and DS. */
8958 /** @todo AMD says this is only done if FSW.ES is set after loading. */
8959 if (enmEffOpSize == IEMMODE_64BIT)
8960 {
8961 pDst->FPUIP = pSrc->FPUIP;
8962 pDst->CS = pSrc->CS;
8963 pDst->Rsrvd1 = pSrc->Rsrvd1;
8964 pDst->FPUDP = pSrc->FPUDP;
8965 pDst->DS = pSrc->DS;
8966 pDst->Rsrvd2 = pSrc->Rsrvd2;
8967 }
8968 else
8969 {
8970 pDst->FPUIP = pSrc->FPUIP;
8971 pDst->CS = pSrc->CS;
8972 pDst->Rsrvd1 = 0;
8973 pDst->FPUDP = pSrc->FPUDP;
8974 pDst->DS = pSrc->DS;
8975 pDst->Rsrvd2 = 0;
8976 }
8977
8978 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set.
8979 * Does not affect MXCSR, only registers.
8980 */
8981 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8982 || !IEM_IS_64BIT_CODE(pVCpu)
8983 || IEM_GET_CPL(pVCpu) != 0)
8984 {
8985 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8986 for (uint32_t i = 0; i < cXmmRegs; i++)
8987 pDst->aXMM[i] = pSrc->aXMM[i];
8988 }
8989
8990 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
8991 iemFpuRecalcExceptionStatus(pDst);
8992
8993 if (pDst->FSW & X86_FSW_ES)
8994 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8995 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8996
8997 /*
8998 * Unmap the memory.
8999 */
9000 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
9001 if (rcStrict != VINF_SUCCESS)
9002 return rcStrict;
9003
9004 iemHlpUsedFpu(pVCpu);
9005 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9006}
9007
9008
9009/**
9010 * Implements 'XSAVE'.
9011 *
9012 * @param iEffSeg The effective segment.
9013 * @param GCPtrEff The address of the image.
9014 * @param enmEffOpSize The operand size (only REX.W really matters).
9015 */
9016IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9017{
9018 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9019
9020 /*
9021 * Raise exceptions.
9022 */
9023 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9024 return iemRaiseUndefinedOpcode(pVCpu);
9025 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9026 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9027 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9028 { /* likely */ }
9029 else
9030 {
9031 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9032 return iemRaiseUndefinedOpcode(pVCpu);
9033 }
9034 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9035 return iemRaiseDeviceNotAvailable(pVCpu);
9036
9037 /*
9038 * Calc the requested mask.
9039 */
9040 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9041 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9042 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9043
9044/** @todo figure out the exact protocol for the memory access. Currently we
9045 * just need this crap to work halfways to make it possible to test
9046 * AVX instructions. */
9047/** @todo figure out the XINUSE and XMODIFIED */
9048
9049 /*
9050 * Access the x87 memory state.
9051 */
9052 /* The x87+SSE state. */
9053 void *pvMem512;
9054 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9055 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9056 if (rcStrict != VINF_SUCCESS)
9057 return rcStrict;
9058 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
9059 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
9060
9061 /* The header. */
9062 PX86XSAVEHDR pHdr;
9063 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
9064 if (rcStrict != VINF_SUCCESS)
9065 return rcStrict;
9066
9067 /*
9068 * Store the X87 state.
9069 */
9070 if (fReqComponents & XSAVE_C_X87)
9071 {
9072 /* common for all formats */
9073 pDst->FCW = pSrc->FCW;
9074 pDst->FSW = pSrc->FSW;
9075 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9076 pDst->FOP = pSrc->FOP;
9077 pDst->FPUIP = pSrc->FPUIP;
9078 pDst->CS = pSrc->CS;
9079 pDst->FPUDP = pSrc->FPUDP;
9080 pDst->DS = pSrc->DS;
9081 if (enmEffOpSize == IEMMODE_64BIT)
9082 {
9083 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9084 pDst->Rsrvd1 = pSrc->Rsrvd1;
9085 pDst->Rsrvd2 = pSrc->Rsrvd2;
9086 }
9087 else
9088 {
9089 pDst->Rsrvd1 = 0;
9090 pDst->Rsrvd2 = 0;
9091 }
9092 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9093 {
9094 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
9095 * them for now... */
9096 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9097 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9098 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9099 pDst->aRegs[i].au32[3] = 0;
9100 }
9101
9102 }
9103
9104 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9105 {
9106 pDst->MXCSR = pSrc->MXCSR;
9107 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9108 }
9109
9110 if (fReqComponents & XSAVE_C_SSE)
9111 {
9112 /* XMM registers. */
9113 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9114 for (uint32_t i = 0; i < cXmmRegs; i++)
9115 pDst->aXMM[i] = pSrc->aXMM[i];
9116 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9117 * right? */
9118 }
9119
9120 /* Commit the x87 state bits. (probably wrong) */
9121 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9122 if (rcStrict != VINF_SUCCESS)
9123 return rcStrict;
9124
9125 /*
9126 * Store AVX state.
9127 */
9128 if (fReqComponents & XSAVE_C_YMM)
9129 {
9130 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9131 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9132 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
9133 PX86XSAVEYMMHI pCompDst;
9134 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9135 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
9136 if (rcStrict != VINF_SUCCESS)
9137 return rcStrict;
9138
9139 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9140 for (uint32_t i = 0; i < cXmmRegs; i++)
9141 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
9142
9143 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9144 if (rcStrict != VINF_SUCCESS)
9145 return rcStrict;
9146 }
9147
9148 /*
9149 * Update the header.
9150 */
9151 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
9152 | (fReqComponents & fXInUse);
9153
9154 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
9155 if (rcStrict != VINF_SUCCESS)
9156 return rcStrict;
9157
9158 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9159}
9160
9161
9162/**
9163 * Implements 'XRSTOR'.
9164 *
9165 * @param iEffSeg The effective segment.
9166 * @param GCPtrEff The address of the image.
9167 * @param enmEffOpSize The operand size (only REX.W really matters).
9168 */
9169IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9170{
9171 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9172
9173 /*
9174 * Raise exceptions.
9175 */
9176 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9177 return iemRaiseUndefinedOpcode(pVCpu);
9178 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9179 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9180 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9181 { /* likely */ }
9182 else
9183 {
9184 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9185 return iemRaiseUndefinedOpcode(pVCpu);
9186 }
9187 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9188 return iemRaiseDeviceNotAvailable(pVCpu);
9189 if (GCPtrEff & 63)
9190 {
9191 /** @todo CPU/VM detection possible! \#AC might not be signal for
9192 * all/any misalignment sizes, intel says its an implementation detail. */
9193 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
9194 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
9195 && IEM_GET_CPL(pVCpu) == 3)
9196 return iemRaiseAlignmentCheckException(pVCpu);
9197 return iemRaiseGeneralProtectionFault0(pVCpu);
9198 }
9199
9200/** @todo figure out the exact protocol for the memory access. Currently we
9201 * just need this crap to work halfways to make it possible to test
9202 * AVX instructions. */
9203/** @todo figure out the XINUSE and XMODIFIED */
9204
9205 /*
9206 * Access the x87 memory state.
9207 */
9208 /* The x87+SSE state. */
9209 void *pvMem512;
9210 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
9211 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9212 if (rcStrict != VINF_SUCCESS)
9213 return rcStrict;
9214 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
9215 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
9216
9217 /*
9218 * Calc the requested mask
9219 */
9220 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
9221 PCX86XSAVEHDR pHdrSrc;
9222 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
9223 IEM_ACCESS_DATA_R, 0 /* checked above */);
9224 if (rcStrict != VINF_SUCCESS)
9225 return rcStrict;
9226
9227 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9228 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9229 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9230 uint64_t const fRstorMask = pHdrSrc->bmXState;
9231 uint64_t const fCompMask = pHdrSrc->bmXComp;
9232
9233 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9234
9235 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9236
9237 /* We won't need this any longer. */
9238 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
9239 if (rcStrict != VINF_SUCCESS)
9240 return rcStrict;
9241
9242 /*
9243 * Load the X87 state.
9244 */
9245 if (fReqComponents & XSAVE_C_X87)
9246 {
9247 if (fRstorMask & XSAVE_C_X87)
9248 {
9249 pDst->FCW = pSrc->FCW;
9250 pDst->FSW = pSrc->FSW;
9251 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9252 pDst->FOP = pSrc->FOP;
9253 pDst->FPUIP = pSrc->FPUIP;
9254 pDst->CS = pSrc->CS;
9255 pDst->FPUDP = pSrc->FPUDP;
9256 pDst->DS = pSrc->DS;
9257 if (enmEffOpSize == IEMMODE_64BIT)
9258 {
9259 /* Load upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9260 pDst->Rsrvd1 = pSrc->Rsrvd1;
9261 pDst->Rsrvd2 = pSrc->Rsrvd2;
9262 }
9263 else
9264 {
9265 pDst->Rsrvd1 = 0;
9266 pDst->Rsrvd2 = 0;
9267 }
9268 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9269 {
9270 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9271 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9272 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9273 pDst->aRegs[i].au32[3] = 0;
9274 }
9275
9276 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9277 iemFpuRecalcExceptionStatus(pDst);
9278
9279 if (pDst->FSW & X86_FSW_ES)
9280 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9281 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9282 }
9283 else
9284 {
9285 pDst->FCW = 0x37f;
9286 pDst->FSW = 0;
9287 pDst->FTW = 0x00; /* 0 - empty. */
9288 pDst->FPUDP = 0;
9289 pDst->DS = 0; //??
9290 pDst->Rsrvd2= 0;
9291 pDst->FPUIP = 0;
9292 pDst->CS = 0; //??
9293 pDst->Rsrvd1= 0;
9294 pDst->FOP = 0;
9295 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9296 {
9297 pDst->aRegs[i].au32[0] = 0;
9298 pDst->aRegs[i].au32[1] = 0;
9299 pDst->aRegs[i].au32[2] = 0;
9300 pDst->aRegs[i].au32[3] = 0;
9301 }
9302 }
9303 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
9304 }
9305
9306 /* MXCSR */
9307 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9308 {
9309 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
9310 pDst->MXCSR = pSrc->MXCSR;
9311 else
9312 pDst->MXCSR = 0x1f80;
9313 }
9314
9315 /* XMM registers. */
9316 if (fReqComponents & XSAVE_C_SSE)
9317 {
9318 if (fRstorMask & XSAVE_C_SSE)
9319 {
9320 for (uint32_t i = 0; i < cXmmRegs; i++)
9321 pDst->aXMM[i] = pSrc->aXMM[i];
9322 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9323 * right? */
9324 }
9325 else
9326 {
9327 for (uint32_t i = 0; i < cXmmRegs; i++)
9328 {
9329 pDst->aXMM[i].au64[0] = 0;
9330 pDst->aXMM[i].au64[1] = 0;
9331 }
9332 }
9333 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
9334 }
9335
9336 /* Unmap the x87 state bits (so we've don't run out of mapping). */
9337 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
9338 if (rcStrict != VINF_SUCCESS)
9339 return rcStrict;
9340
9341 /*
9342 * Restore AVX state.
9343 */
9344 if (fReqComponents & XSAVE_C_YMM)
9345 {
9346 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9347 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
9348
9349 if (fRstorMask & XSAVE_C_YMM)
9350 {
9351 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9352 PCX86XSAVEYMMHI pCompSrc;
9353 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
9354 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9355 IEM_ACCESS_DATA_R, 0 /* checked above */);
9356 if (rcStrict != VINF_SUCCESS)
9357 return rcStrict;
9358
9359 for (uint32_t i = 0; i < cXmmRegs; i++)
9360 {
9361 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9362 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9363 }
9364
9365 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
9366 if (rcStrict != VINF_SUCCESS)
9367 return rcStrict;
9368 }
9369 else
9370 {
9371 for (uint32_t i = 0; i < cXmmRegs; i++)
9372 {
9373 pCompDst->aYmmHi[i].au64[0] = 0;
9374 pCompDst->aYmmHi[i].au64[1] = 0;
9375 }
9376 }
9377 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9378 }
9379
9380 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9381}
9382
9383
9384
9385
9386/**
9387 * Implements 'STMXCSR'.
9388 *
9389 * @param iEffSeg The effective segment register for @a GCPtrEff.
9390 * @param GCPtrEff The address of the image.
9391 */
9392IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9393{
9394 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9395
9396 /*
9397 * Raise exceptions.
9398 */
9399 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9400 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9401 {
9402 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9403 {
9404 /*
9405 * Do the job.
9406 */
9407 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9408 if (rcStrict == VINF_SUCCESS)
9409 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9410 return rcStrict;
9411 }
9412 return iemRaiseDeviceNotAvailable(pVCpu);
9413 }
9414 return iemRaiseUndefinedOpcode(pVCpu);
9415}
9416
9417
9418/**
9419 * Implements 'VSTMXCSR'.
9420 *
9421 * @param iEffSeg The effective segment register for @a GCPtrEff.
9422 * @param GCPtrEff The address of the image.
9423 */
9424IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9425{
9426 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9427
9428 /*
9429 * Raise exceptions.
9430 */
9431 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9432 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9433 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9434 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9435 {
9436 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9437 {
9438 /*
9439 * Do the job.
9440 */
9441 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9442 if (rcStrict == VINF_SUCCESS)
9443 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9444 return rcStrict;
9445 }
9446 return iemRaiseDeviceNotAvailable(pVCpu);
9447 }
9448 return iemRaiseUndefinedOpcode(pVCpu);
9449}
9450
9451
9452/**
9453 * Implements 'LDMXCSR'.
9454 *
9455 * @param iEffSeg The effective segment register for @a GCPtrEff.
9456 * @param GCPtrEff The address of the image.
9457 */
9458IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9459{
9460 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9461
9462 /*
9463 * Raise exceptions.
9464 */
9465 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9466 * happen after or before \#UD and \#EM? */
9467 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9468 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9469 {
9470 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9471 {
9472 /*
9473 * Do the job.
9474 */
9475 uint32_t fNewMxCsr;
9476 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9477 if (rcStrict == VINF_SUCCESS)
9478 {
9479 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9480 if (!(fNewMxCsr & ~fMxCsrMask))
9481 {
9482 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9483 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9484 }
9485 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9486 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9487 return iemRaiseGeneralProtectionFault0(pVCpu);
9488 }
9489 return rcStrict;
9490 }
9491 return iemRaiseDeviceNotAvailable(pVCpu);
9492 }
9493 return iemRaiseUndefinedOpcode(pVCpu);
9494}
9495
9496
9497/**
9498 * Commmon routine for fnstenv and fnsave.
9499 *
9500 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9501 * @param enmEffOpSize The effective operand size.
9502 * @param uPtr Where to store the state.
9503 */
9504static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9505{
9506 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9507 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9508 if (enmEffOpSize == IEMMODE_16BIT)
9509 {
9510 uPtr.pu16[0] = pSrcX87->FCW;
9511 uPtr.pu16[1] = pSrcX87->FSW;
9512 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9513 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9514 {
9515 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9516 * protected mode or long mode and we save it in real mode? And vice
9517 * versa? And with 32-bit operand size? I think CPU is storing the
9518 * effective address ((CS << 4) + IP) in the offset register and not
9519 * doing any address calculations here. */
9520 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9521 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9522 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9523 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9524 }
9525 else
9526 {
9527 uPtr.pu16[3] = pSrcX87->FPUIP;
9528 uPtr.pu16[4] = pSrcX87->CS;
9529 uPtr.pu16[5] = pSrcX87->FPUDP;
9530 uPtr.pu16[6] = pSrcX87->DS;
9531 }
9532 }
9533 else
9534 {
9535 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9536 uPtr.pu16[0*2] = pSrcX87->FCW;
9537 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9538 uPtr.pu16[1*2] = pSrcX87->FSW;
9539 uPtr.pu16[1*2+1] = 0xffff;
9540 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9541 uPtr.pu16[2*2+1] = 0xffff;
9542 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9543 {
9544 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9545 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9546 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9547 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9548 }
9549 else
9550 {
9551 uPtr.pu32[3] = pSrcX87->FPUIP;
9552 uPtr.pu16[4*2] = pSrcX87->CS;
9553 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9554 uPtr.pu32[5] = pSrcX87->FPUDP;
9555 uPtr.pu16[6*2] = pSrcX87->DS;
9556 uPtr.pu16[6*2+1] = 0xffff;
9557 }
9558 }
9559}
9560
9561
9562/**
9563 * Commmon routine for fldenv and frstor
9564 *
9565 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9566 * @param enmEffOpSize The effective operand size.
9567 * @param uPtr Where to store the state.
9568 */
9569static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9570{
9571 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9572 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9573 if (enmEffOpSize == IEMMODE_16BIT)
9574 {
9575 pDstX87->FCW = uPtr.pu16[0];
9576 pDstX87->FSW = uPtr.pu16[1];
9577 pDstX87->FTW = uPtr.pu16[2];
9578 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9579 {
9580 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9581 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9582 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9583 pDstX87->CS = 0;
9584 pDstX87->Rsrvd1= 0;
9585 pDstX87->DS = 0;
9586 pDstX87->Rsrvd2= 0;
9587 }
9588 else
9589 {
9590 pDstX87->FPUIP = uPtr.pu16[3];
9591 pDstX87->CS = uPtr.pu16[4];
9592 pDstX87->Rsrvd1= 0;
9593 pDstX87->FPUDP = uPtr.pu16[5];
9594 pDstX87->DS = uPtr.pu16[6];
9595 pDstX87->Rsrvd2= 0;
9596 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9597 }
9598 }
9599 else
9600 {
9601 pDstX87->FCW = uPtr.pu16[0*2];
9602 pDstX87->FSW = uPtr.pu16[1*2];
9603 pDstX87->FTW = uPtr.pu16[2*2];
9604 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9605 {
9606 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9607 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9608 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9609 pDstX87->CS = 0;
9610 pDstX87->Rsrvd1= 0;
9611 pDstX87->DS = 0;
9612 pDstX87->Rsrvd2= 0;
9613 }
9614 else
9615 {
9616 pDstX87->FPUIP = uPtr.pu32[3];
9617 pDstX87->CS = uPtr.pu16[4*2];
9618 pDstX87->Rsrvd1= 0;
9619 pDstX87->FOP = uPtr.pu16[4*2+1];
9620 pDstX87->FPUDP = uPtr.pu32[5];
9621 pDstX87->DS = uPtr.pu16[6*2];
9622 pDstX87->Rsrvd2= 0;
9623 }
9624 }
9625
9626 /* Make adjustments. */
9627 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9628#ifdef LOG_ENABLED
9629 uint16_t const fOldFsw = pDstX87->FSW;
9630#endif
9631 pDstX87->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9632 iemFpuRecalcExceptionStatus(pDstX87);
9633#ifdef LOG_ENABLED
9634 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9635 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9636 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9637 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9638#endif
9639
9640 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9641 * exceptions are pending after loading the saved state? */
9642}
9643
9644
9645/**
9646 * Implements 'FNSTENV'.
9647 *
9648 * @param enmEffOpSize The operand size (only REX.W really matters).
9649 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9650 * @param GCPtrEffDst The address of the image.
9651 */
9652IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9653{
9654 RTPTRUNION uPtr;
9655 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9656 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9657 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9658 if (rcStrict != VINF_SUCCESS)
9659 return rcStrict;
9660
9661 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9662
9663 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9664 if (rcStrict != VINF_SUCCESS)
9665 return rcStrict;
9666
9667 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9668 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9669 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9670#ifdef LOG_ENABLED
9671 uint16_t fOldFsw = pFpuCtx->FSW;
9672#endif
9673 iemFpuRecalcExceptionStatus(pFpuCtx);
9674#ifdef LOG_ENABLED
9675 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9676 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9677 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9678#endif
9679
9680 iemHlpUsedFpu(pVCpu);
9681
9682 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9683 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9684}
9685
9686
9687/**
9688 * Implements 'FNSAVE'.
9689 *
9690 * @param enmEffOpSize The operand size.
9691 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9692 * @param GCPtrEffDst The address of the image.
9693 */
9694IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9695{
9696 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9697
9698 RTPTRUNION uPtr;
9699 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9700 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9701 if (rcStrict != VINF_SUCCESS)
9702 return rcStrict;
9703
9704 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9705 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9706 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9707 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9708 {
9709 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9710 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9711 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9712 }
9713
9714 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9715 if (rcStrict != VINF_SUCCESS)
9716 return rcStrict;
9717
9718 /* Rotate the stack to account for changed TOS. */
9719 iemFpuRotateStackSetTop(pFpuCtx, 0);
9720
9721 /*
9722 * Re-initialize the FPU context.
9723 */
9724 pFpuCtx->FCW = 0x37f;
9725 pFpuCtx->FSW = 0;
9726 pFpuCtx->FTW = 0x00; /* 0 - empty */
9727 pFpuCtx->FPUDP = 0;
9728 pFpuCtx->DS = 0;
9729 pFpuCtx->Rsrvd2= 0;
9730 pFpuCtx->FPUIP = 0;
9731 pFpuCtx->CS = 0;
9732 pFpuCtx->Rsrvd1= 0;
9733 pFpuCtx->FOP = 0;
9734
9735 iemHlpUsedFpu(pVCpu);
9736 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9737}
9738
9739
9740
9741/**
9742 * Implements 'FLDENV'.
9743 *
9744 * @param enmEffOpSize The operand size (only REX.W really matters).
9745 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9746 * @param GCPtrEffSrc The address of the image.
9747 */
9748IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9749{
9750 RTCPTRUNION uPtr;
9751 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9752 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9753 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9754 if (rcStrict != VINF_SUCCESS)
9755 return rcStrict;
9756
9757 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9758
9759 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9760 if (rcStrict != VINF_SUCCESS)
9761 return rcStrict;
9762
9763 iemHlpUsedFpu(pVCpu);
9764 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9765}
9766
9767
9768/**
9769 * Implements 'FRSTOR'.
9770 *
9771 * @param enmEffOpSize The operand size.
9772 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9773 * @param GCPtrEffSrc The address of the image.
9774 */
9775IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9776{
9777 RTCPTRUNION uPtr;
9778 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9779 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9780 if (rcStrict != VINF_SUCCESS)
9781 return rcStrict;
9782
9783 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9784 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9785 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9786 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9787 {
9788 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9789 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9790 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9791 pFpuCtx->aRegs[i].au32[3] = 0;
9792 }
9793
9794 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9795 if (rcStrict != VINF_SUCCESS)
9796 return rcStrict;
9797
9798 iemHlpUsedFpu(pVCpu);
9799 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9800}
9801
9802
9803/**
9804 * Implements 'FLDCW'.
9805 *
9806 * @param u16Fcw The new FCW.
9807 */
9808IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9809{
9810 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9811
9812 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9813 /** @todo Testcase: Try see what happens when trying to set undefined bits
9814 * (other than 6 and 7). Currently ignoring them. */
9815 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9816 * according to FSW. (This is what is currently implemented.) */
9817 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9818 pFpuCtx->FCW = u16Fcw & (~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK); /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9819#ifdef LOG_ENABLED
9820 uint16_t fOldFsw = pFpuCtx->FSW;
9821#endif
9822 iemFpuRecalcExceptionStatus(pFpuCtx);
9823#ifdef LOG_ENABLED
9824 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9825 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9826 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9827#endif
9828
9829 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9830 iemHlpUsedFpu(pVCpu);
9831 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9832}
9833
9834
9835
9836/**
9837 * Implements the underflow case of fxch.
9838 *
9839 * @param iStReg The other stack register.
9840 * @param uFpuOpcode The FPU opcode (for simplicity).
9841 */
9842IEM_CIMPL_DEF_2(iemCImpl_fxch_underflow, uint8_t, iStReg, uint16_t, uFpuOpcode)
9843{
9844 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9845
9846 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9847 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9848 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9849 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9850
9851 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9852 * registers are read as QNaN and then exchanged. This could be
9853 * wrong... */
9854 if (pFpuCtx->FCW & X86_FCW_IM)
9855 {
9856 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9857 {
9858 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9859 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9860 else
9861 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9862 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9863 }
9864 else
9865 {
9866 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9867 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9868 }
9869 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9870 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9871 }
9872 else
9873 {
9874 /* raise underflow exception, don't change anything. */
9875 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9876 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9877 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9878 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9879 }
9880
9881 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, uFpuOpcode);
9882 iemHlpUsedFpu(pVCpu);
9883 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9884}
9885
9886
9887/**
9888 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9889 *
9890 * @param iStReg The other stack register.
9891 * @param fUCmp true for FUCOMI[P], false for FCOMI[P].
9892 * @param uPopAndFpuOpcode Bits 15-0: The FPU opcode.
9893 * Bit 31: Whether we should pop the stack when
9894 * done or not.
9895 */
9896IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, bool, fUCmp, uint32_t, uPopAndFpuOpcode)
9897{
9898 Assert(iStReg < 8);
9899 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9900
9901 /*
9902 * Raise exceptions.
9903 */
9904 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9905 return iemRaiseDeviceNotAvailable(pVCpu);
9906
9907 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9908 uint16_t u16Fsw = pFpuCtx->FSW;
9909 if (u16Fsw & X86_FSW_ES)
9910 return iemRaiseMathFault(pVCpu);
9911
9912 /*
9913 * Check if any of the register accesses causes #SF + #IA.
9914 */
9915 bool fPop = RT_BOOL(uPopAndFpuOpcode & RT_BIT_32(31));
9916 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9917 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9918 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9919 {
9920 uint32_t u32Eflags;
9921 if (!fUCmp)
9922 u32Eflags = iemAImpl_fcomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9923 else
9924 u32Eflags = iemAImpl_fucomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9925
9926 pFpuCtx->FSW &= ~X86_FSW_C1;
9927 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9928 if ( !(u16Fsw & X86_FSW_IE)
9929 || (pFpuCtx->FCW & X86_FCW_IM) )
9930 {
9931 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9932 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9933 }
9934 }
9935 else if (pFpuCtx->FCW & X86_FCW_IM)
9936 {
9937 /* Masked underflow. */
9938 pFpuCtx->FSW &= ~X86_FSW_C1;
9939 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9940 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9941 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9942 }
9943 else
9944 {
9945 /* Raise underflow - don't touch EFLAGS or TOP. */
9946 pFpuCtx->FSW &= ~X86_FSW_C1;
9947 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9948 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
9949 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9950 fPop = false;
9951 }
9952
9953 /*
9954 * Pop if necessary.
9955 */
9956 if (fPop)
9957 {
9958 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9959 iemFpuStackIncTop(pVCpu);
9960 }
9961
9962 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, (uint16_t)uPopAndFpuOpcode);
9963 iemHlpUsedFpu(pVCpu);
9964 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9965}
9966
9967
9968/**
9969 * Implements 'RDSEED'.
9970 *
9971 * @returns VINF_SUCCESS.
9972 * @param iReg The register.
9973 * @param enmEffOpSize The operand size.
9974 */
9975IEM_CIMPL_DEF_2(iemCImpl_rdseed, uint8_t, iReg, IEMMODE, enmEffOpSize)
9976{
9977#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9978 /* Nested-guest VMX intercept. */
9979 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9980 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDSEED_EXIT))
9981 { /* probable */ }
9982 else
9983 {
9984 Log(("rdseed: Guest intercept -> VM-exit\n"));
9985 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDSEED, VMXINSTRID_RDSEED, cbInstr);
9986 }
9987#endif
9988
9989 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
9990 switch (enmEffOpSize)
9991 {
9992 case IEMMODE_16BIT:
9993 {
9994 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
9995 &iemAImpl_rdseed_u16,
9996 &iemAImpl_rdseed_u16_fallback);
9997 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
9998 (pfnImpl)(pu16Dst, pEFlags);
9999 break;
10000 }
10001 case IEMMODE_32BIT:
10002 {
10003 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10004 &iemAImpl_rdseed_u32,
10005 &iemAImpl_rdseed_u32_fallback);
10006 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10007 (pfnImpl)(pu32Dst, pEFlags);
10008 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10009 break;
10010 }
10011 case IEMMODE_64BIT:
10012 {
10013 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10014 &iemAImpl_rdseed_u64,
10015 &iemAImpl_rdseed_u64_fallback);
10016 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10017 (pfnImpl)(pu64Dst, pEFlags);
10018 break;
10019 }
10020 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10021 }
10022 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10023}
10024
10025
10026/**
10027 * Implements 'RDRAND'.
10028 *
10029 * @returns VINF_SUCCESS.
10030 * @param iReg The register.
10031 * @param enmEffOpSize The operand size.
10032 */
10033IEM_CIMPL_DEF_2(iemCImpl_rdrand, uint8_t, iReg, IEMMODE, enmEffOpSize)
10034{
10035#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10036 /* Nested-guest VMX intercept. */
10037 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
10038 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDRAND_EXIT))
10039 { /* probable */ }
10040 else
10041 {
10042 Log(("rdrand: Guest intercept -> VM-exit\n"));
10043 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDRAND, VMXINSTRID_RDRAND, cbInstr);
10044 }
10045#endif
10046
10047 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
10048 switch (enmEffOpSize)
10049 {
10050 case IEMMODE_16BIT:
10051 {
10052 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u16,
10053 &iemAImpl_rdrand_u16_fallback);
10054 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
10055 (pfnImpl)(pu16Dst, pEFlags);
10056 break;
10057 }
10058 case IEMMODE_32BIT:
10059 {
10060 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u32,
10061 &iemAImpl_rdrand_u32_fallback);
10062 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10063 (pfnImpl)(pu32Dst, pEFlags);
10064 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10065 break;
10066 }
10067 case IEMMODE_64BIT:
10068 {
10069 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u64,
10070 &iemAImpl_rdrand_u64_fallback);
10071 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10072 (pfnImpl)(pu64Dst, pEFlags);
10073 break;
10074 }
10075 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10076 }
10077 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10078}
10079
10080/** @} */
10081
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette