VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 103884

Last change on this file since 103884 was 103734, checked in by vboxsync, 9 months ago

VMM/IEM: Fixed bug in sysret when targeting intel CPUs where SS.ATTR/LIMIT/BASE are all reloaded unlike what AMD does and IEM did. This would cause the init process to #GP on 64-bit knoppix 8.6 (based on linux 5.3). bugref:8109
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 371.6 KB
Line 
1/* $Id: IEMAllCImpl.cpp 103734 2024-03-08 00:36:00Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#define IEM_WITH_OPAQUE_DECODER_STATE
35#include <VBox/vmm/iem.h>
36#include <VBox/vmm/cpum.h>
37#include <VBox/vmm/apic.h>
38#include <VBox/vmm/pdm.h>
39#include <VBox/vmm/pgm.h>
40#include <VBox/vmm/iom.h>
41#include <VBox/vmm/em.h>
42#include <VBox/vmm/hm.h>
43#include <VBox/vmm/nem.h>
44#include <VBox/vmm/gim.h>
45#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
46# include <VBox/vmm/em.h>
47# include <VBox/vmm/hm_svm.h>
48#endif
49#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
50# include <VBox/vmm/hmvmxinline.h>
51#endif
52#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
53# include <VBox/vmm/cpuidcall.h>
54#endif
55#include <VBox/vmm/tm.h>
56#include <VBox/vmm/dbgf.h>
57#include <VBox/vmm/dbgftrace.h>
58#include "IEMInternal.h"
59#include <VBox/vmm/vmcc.h>
60#include <VBox/log.h>
61#include <VBox/err.h>
62#include <VBox/param.h>
63#include <VBox/dis.h>
64#include <iprt/asm-math.h>
65#include <iprt/assert.h>
66#include <iprt/string.h>
67#include <iprt/x86.h>
68
69#include "IEMInline.h"
70
71
72/*********************************************************************************************************************************
73* Defined Constants And Macros *
74*********************************************************************************************************************************/
75/**
76 * Flushes the prefetch buffer, light version.
77 * @todo The \#if conditions here must match the ones in iemOpcodeFlushLight().
78 */
79#ifndef IEM_WITH_CODE_TLB
80# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) iemOpcodeFlushLight(a_pVCpu, a_cbInstr)
81#else
82# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { } while (0)
83#endif
84
85/**
86 * Flushes the prefetch buffer, heavy version.
87 * @todo The \#if conditions here must match the ones in iemOpcodeFlushHeavy().
88 */
89#if !defined(IEM_WITH_CODE_TLB) || 1
90# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) iemOpcodeFlushHeavy(a_pVCpu, a_cbInstr)
91#else
92# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { } while (0)
93#endif
94
95
96
97/** @name Misc Helpers
98 * @{
99 */
100
101
102/**
103 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
104 *
105 * @returns Strict VBox status code.
106 *
107 * @param pVCpu The cross context virtual CPU structure of the calling thread.
108 * @param u16Port The port number.
109 * @param cbOperand The operand size.
110 */
111static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
112{
113 /* The TSS bits we're interested in are the same on 386 and AMD64. */
114 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
115 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
116 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
117 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
118
119 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
120
121 /*
122 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
123 */
124 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
125 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
126 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
127 {
128 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
129 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
130 return iemRaiseGeneralProtectionFault0(pVCpu);
131 }
132
133 /*
134 * Read the bitmap offset (may #PF).
135 */
136 uint16_t offBitmap;
137 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
138 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
139 if (rcStrict != VINF_SUCCESS)
140 {
141 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
142 return rcStrict;
143 }
144
145 /*
146 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
147 * describes the CPU actually reading two bytes regardless of whether the
148 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
149 */
150 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
151 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
152 * for instance sizeof(X86TSS32). */
153 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
154 {
155 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
156 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
157 return iemRaiseGeneralProtectionFault0(pVCpu);
158 }
159
160 /*
161 * Read the necessary bits.
162 */
163 /** @todo Test the assertion in the intel manual that the CPU reads two
164 * bytes. The question is how this works wrt to \#PF and \#GP on the
165 * 2nd byte when it's not required. */
166 uint16_t bmBytes = UINT16_MAX;
167 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
168 if (rcStrict != VINF_SUCCESS)
169 {
170 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
171 return rcStrict;
172 }
173
174 /*
175 * Perform the check.
176 */
177 uint16_t fPortMask = (1 << cbOperand) - 1;
178 bmBytes >>= (u16Port & 7);
179 if (bmBytes & fPortMask)
180 {
181 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
182 u16Port, cbOperand, bmBytes, fPortMask));
183 return iemRaiseGeneralProtectionFault0(pVCpu);
184 }
185
186 return VINF_SUCCESS;
187}
188
189
190/**
191 * Checks if we are allowed to access the given I/O port, raising the
192 * appropriate exceptions if we aren't (or if the I/O bitmap is not
193 * accessible).
194 *
195 * @returns Strict VBox status code.
196 *
197 * @param pVCpu The cross context virtual CPU structure of the calling thread.
198 * @param u16Port The port number.
199 * @param cbOperand The operand size.
200 */
201DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
202{
203 X86EFLAGS Efl;
204 Efl.u = IEMMISC_GET_EFL(pVCpu);
205 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
206 && ( IEM_GET_CPL(pVCpu) > Efl.Bits.u2IOPL
207 || Efl.Bits.u1VM) )
208 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
209 return VINF_SUCCESS;
210}
211
212
213#if 0
214/**
215 * Calculates the parity bit.
216 *
217 * @returns true if the bit is set, false if not.
218 * @param u8Result The least significant byte of the result.
219 */
220static bool iemHlpCalcParityFlag(uint8_t u8Result)
221{
222 /*
223 * Parity is set if the number of bits in the least significant byte of
224 * the result is even.
225 */
226 uint8_t cBits;
227 cBits = u8Result & 1; /* 0 */
228 u8Result >>= 1;
229 cBits += u8Result & 1;
230 u8Result >>= 1;
231 cBits += u8Result & 1;
232 u8Result >>= 1;
233 cBits += u8Result & 1;
234 u8Result >>= 1;
235 cBits += u8Result & 1; /* 4 */
236 u8Result >>= 1;
237 cBits += u8Result & 1;
238 u8Result >>= 1;
239 cBits += u8Result & 1;
240 u8Result >>= 1;
241 cBits += u8Result & 1;
242 return !(cBits & 1);
243}
244#endif /* not used */
245
246
247/**
248 * Updates the specified flags according to a 8-bit result.
249 *
250 * @param pVCpu The cross context virtual CPU structure of the calling thread.
251 * @param u8Result The result to set the flags according to.
252 * @param fToUpdate The flags to update.
253 * @param fUndefined The flags that are specified as undefined.
254 */
255static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
256{
257 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
258 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
259 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
260 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
261}
262
263
264/**
265 * Updates the specified flags according to a 16-bit result.
266 *
267 * @param pVCpu The cross context virtual CPU structure of the calling thread.
268 * @param u16Result The result to set the flags according to.
269 * @param fToUpdate The flags to update.
270 * @param fUndefined The flags that are specified as undefined.
271 */
272static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
273{
274 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
275 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
276 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
277 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
278}
279
280
281/**
282 * Helper used by iret.
283 *
284 * @param pVCpu The cross context virtual CPU structure of the calling thread.
285 * @param uCpl The new CPL.
286 * @param pSReg Pointer to the segment register.
287 */
288static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
289{
290 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
291 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
292
293 if ( uCpl > pSReg->Attr.n.u2Dpl
294 && pSReg->Attr.n.u1DescType /* code or data, not system */
295 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
296 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
297 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
298}
299
300
301/**
302 * Indicates that we have modified the FPU state.
303 *
304 * @param pVCpu The cross context virtual CPU structure of the calling thread.
305 */
306DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
307{
308 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
309}
310
311/** @} */
312
313/** @name C Implementations
314 * @{
315 */
316
317
318/**
319 * Implements a pop [mem16].
320 */
321IEM_CIMPL_DEF_2(iemCImpl_pop_mem16, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
322{
323 uint16_t u16Value;
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
326 VBOXSTRICTRC rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 {
329 rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
330 if (rcStrict == VINF_SUCCESS)
331 {
332 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
333 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
334 }
335 }
336 return rcStrict;
337
338}
339
340
341/**
342 * Implements a pop [mem32].
343 */
344IEM_CIMPL_DEF_2(iemCImpl_pop_mem32, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
345{
346 uint32_t u32Value;
347 RTUINT64U TmpRsp;
348 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
349 VBOXSTRICTRC rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
350 if (rcStrict == VINF_SUCCESS)
351 {
352 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEffDst, u32Value);
353 if (rcStrict == VINF_SUCCESS)
354 {
355 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
356 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
357 }
358 }
359 return rcStrict;
360
361}
362
363
364/**
365 * Implements a pop [mem64].
366 */
367IEM_CIMPL_DEF_2(iemCImpl_pop_mem64, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
368{
369 uint64_t u64Value;
370 RTUINT64U TmpRsp;
371 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
372 VBOXSTRICTRC rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
373 if (rcStrict == VINF_SUCCESS)
374 {
375 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrEffDst, u64Value);
376 if (rcStrict == VINF_SUCCESS)
377 {
378 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
379 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
380 }
381 }
382 return rcStrict;
383
384}
385
386
387/**
388 * Implements a 16-bit popa.
389 */
390IEM_CIMPL_DEF_0(iemCImpl_popa_16)
391{
392 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
393 RTGCPTR GCPtrLast = GCPtrStart + 15;
394 VBOXSTRICTRC rcStrict;
395
396 /*
397 * The docs are a bit hard to comprehend here, but it looks like we wrap
398 * around in real mode as long as none of the individual "popa" crosses the
399 * end of the stack segment. In protected mode we check the whole access
400 * in one go. For efficiency, only do the word-by-word thing if we're in
401 * danger of wrapping around.
402 */
403 /** @todo do popa boundary / wrap-around checks. */
404 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
405 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
406 {
407 /* word-by-word */
408 RTUINT64U TmpRsp;
409 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
410 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
411 if (rcStrict == VINF_SUCCESS)
412 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
413 if (rcStrict == VINF_SUCCESS)
414 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
415 if (rcStrict == VINF_SUCCESS)
416 {
417 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
418 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
419 }
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
426 if (rcStrict == VINF_SUCCESS)
427 {
428 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
429 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
430 }
431 }
432 else
433 {
434 uint8_t bUnmapInfo;
435 uint16_t const *pau16Mem = NULL;
436 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrStart,
437 IEM_ACCESS_STACK_R, sizeof(*pau16Mem) - 1);
438 if (rcStrict == VINF_SUCCESS)
439 {
440 pVCpu->cpum.GstCtx.di = pau16Mem[7 - X86_GREG_xDI];
441 pVCpu->cpum.GstCtx.si = pau16Mem[7 - X86_GREG_xSI];
442 pVCpu->cpum.GstCtx.bp = pau16Mem[7 - X86_GREG_xBP];
443 /* skip sp */
444 pVCpu->cpum.GstCtx.bx = pau16Mem[7 - X86_GREG_xBX];
445 pVCpu->cpum.GstCtx.dx = pau16Mem[7 - X86_GREG_xDX];
446 pVCpu->cpum.GstCtx.cx = pau16Mem[7 - X86_GREG_xCX];
447 pVCpu->cpum.GstCtx.ax = pau16Mem[7 - X86_GREG_xAX];
448 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
449 if (rcStrict == VINF_SUCCESS)
450 {
451 iemRegAddToRsp(pVCpu, 16);
452 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
453 }
454 }
455 }
456 return rcStrict;
457}
458
459
460/**
461 * Implements a 32-bit popa.
462 */
463IEM_CIMPL_DEF_0(iemCImpl_popa_32)
464{
465 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
466 RTGCPTR GCPtrLast = GCPtrStart + 31;
467 VBOXSTRICTRC rcStrict;
468
469 /*
470 * The docs are a bit hard to comprehend here, but it looks like we wrap
471 * around in real mode as long as none of the individual "popa" crosses the
472 * end of the stack segment. In protected mode we check the whole access
473 * in one go. For efficiency, only do the word-by-word thing if we're in
474 * danger of wrapping around.
475 */
476 /** @todo do popa boundary / wrap-around checks. */
477 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
478 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
479 {
480 /* word-by-word */
481 RTUINT64U TmpRsp;
482 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
483 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 {
490 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
491 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
492 }
493 if (rcStrict == VINF_SUCCESS)
494 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
495 if (rcStrict == VINF_SUCCESS)
496 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
497 if (rcStrict == VINF_SUCCESS)
498 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
499 if (rcStrict == VINF_SUCCESS)
500 {
501#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
502 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
503 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
504 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
505 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
506 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
507 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
508 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
509#endif
510 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
511 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
512 }
513 }
514 else
515 {
516 uint8_t bUnmapInfo;
517 uint32_t const *pau32Mem;
518 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrStart,
519 IEM_ACCESS_STACK_R, sizeof(*pau32Mem) - 1);
520 if (rcStrict == VINF_SUCCESS)
521 {
522 pVCpu->cpum.GstCtx.rdi = pau32Mem[7 - X86_GREG_xDI];
523 pVCpu->cpum.GstCtx.rsi = pau32Mem[7 - X86_GREG_xSI];
524 pVCpu->cpum.GstCtx.rbp = pau32Mem[7 - X86_GREG_xBP];
525 /* skip esp */
526 pVCpu->cpum.GstCtx.rbx = pau32Mem[7 - X86_GREG_xBX];
527 pVCpu->cpum.GstCtx.rdx = pau32Mem[7 - X86_GREG_xDX];
528 pVCpu->cpum.GstCtx.rcx = pau32Mem[7 - X86_GREG_xCX];
529 pVCpu->cpum.GstCtx.rax = pau32Mem[7 - X86_GREG_xAX];
530 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
531 if (rcStrict == VINF_SUCCESS)
532 {
533 iemRegAddToRsp(pVCpu, 32);
534 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
535 }
536 }
537 }
538 return rcStrict;
539}
540
541
542/**
543 * Implements a 16-bit pusha.
544 */
545IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
546{
547 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
548 RTGCPTR GCPtrBottom = GCPtrTop - 15;
549 VBOXSTRICTRC rcStrict;
550
551 /*
552 * The docs are a bit hard to comprehend here, but it looks like we wrap
553 * around in real mode as long as none of the individual "pushd" crosses the
554 * end of the stack segment. In protected mode we check the whole access
555 * in one go. For efficiency, only do the word-by-word thing if we're in
556 * danger of wrapping around.
557 */
558 /** @todo do pusha boundary / wrap-around checks. */
559 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
560 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
561 {
562 /* word-by-word */
563 RTUINT64U TmpRsp;
564 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
565 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
566 if (rcStrict == VINF_SUCCESS)
567 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
568 if (rcStrict == VINF_SUCCESS)
569 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
570 if (rcStrict == VINF_SUCCESS)
571 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
572 if (rcStrict == VINF_SUCCESS)
573 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
574 if (rcStrict == VINF_SUCCESS)
575 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
576 if (rcStrict == VINF_SUCCESS)
577 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
578 if (rcStrict == VINF_SUCCESS)
579 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
580 if (rcStrict == VINF_SUCCESS)
581 {
582 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
583 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
584 }
585 }
586 else
587 {
588 GCPtrBottom--;
589 uint8_t bUnmapInfo;
590 uint16_t *pau16Mem = NULL;
591 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrBottom,
592 IEM_ACCESS_STACK_W, sizeof(*pau16Mem) - 1);
593 if (rcStrict == VINF_SUCCESS)
594 {
595 pau16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
596 pau16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
597 pau16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
598 pau16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
599 pau16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
600 pau16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
601 pau16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
602 pau16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
603 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
604 if (rcStrict == VINF_SUCCESS)
605 {
606 iemRegSubFromRsp(pVCpu, 16);
607 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
608 }
609 }
610 }
611 return rcStrict;
612}
613
614
615/**
616 * Implements a 32-bit pusha.
617 */
618IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
619{
620 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
621 RTGCPTR GCPtrBottom = GCPtrTop - 31;
622 VBOXSTRICTRC rcStrict;
623
624 /*
625 * The docs are a bit hard to comprehend here, but it looks like we wrap
626 * around in real mode as long as none of the individual "pusha" crosses the
627 * end of the stack segment. In protected mode we check the whole access
628 * in one go. For efficiency, only do the word-by-word thing if we're in
629 * danger of wrapping around.
630 */
631 /** @todo do pusha boundary / wrap-around checks. */
632 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
633 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
634 {
635 /* word-by-word */
636 RTUINT64U TmpRsp;
637 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
638 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
639 if (rcStrict == VINF_SUCCESS)
640 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
641 if (rcStrict == VINF_SUCCESS)
642 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
643 if (rcStrict == VINF_SUCCESS)
644 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
645 if (rcStrict == VINF_SUCCESS)
646 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
647 if (rcStrict == VINF_SUCCESS)
648 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
649 if (rcStrict == VINF_SUCCESS)
650 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
651 if (rcStrict == VINF_SUCCESS)
652 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
653 if (rcStrict == VINF_SUCCESS)
654 {
655 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
656 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
657 }
658 }
659 else
660 {
661 GCPtrBottom--;
662 uint8_t bUnmapInfo;
663 uint32_t *pau32Mem;
664 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrBottom,
665 IEM_ACCESS_STACK_W, sizeof(*pau32Mem) - 1);
666 if (rcStrict == VINF_SUCCESS)
667 {
668 pau32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
669 pau32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
670 pau32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
671 pau32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
672 pau32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
673 pau32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
674 pau32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
675 pau32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
676 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
677 if (rcStrict == VINF_SUCCESS)
678 {
679 iemRegSubFromRsp(pVCpu, 32);
680 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
681 }
682 }
683 }
684 return rcStrict;
685}
686
687
688/**
689 * Implements pushf.
690 *
691 *
692 * @param enmEffOpSize The effective operand size.
693 */
694IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
695{
696 VBOXSTRICTRC rcStrict;
697
698 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
699 { /* probable */ }
700 else
701 {
702 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
703 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
704 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
705 }
706
707 /*
708 * If we're in V8086 mode some care is required (which is why we're in
709 * doing this in a C implementation).
710 */
711 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
712 if ( (fEfl & X86_EFL_VM)
713 && X86_EFL_GET_IOPL(fEfl) != 3 )
714 {
715 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
716 if ( enmEffOpSize != IEMMODE_16BIT
717 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
718 return iemRaiseGeneralProtectionFault0(pVCpu);
719 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
720 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
721 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
722 }
723 else
724 {
725
726 /*
727 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
728 */
729 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
730
731 switch (enmEffOpSize)
732 {
733 case IEMMODE_16BIT:
734 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
735 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
736 fEfl |= UINT16_C(0xf000);
737 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
738 break;
739 case IEMMODE_32BIT:
740 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
741 break;
742 case IEMMODE_64BIT:
743 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
744 break;
745 IEM_NOT_REACHED_DEFAULT_CASE_RET();
746 }
747 }
748
749 if (rcStrict == VINF_SUCCESS)
750 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
751 return rcStrict;
752}
753
754
755/**
756 * Implements popf.
757 *
758 * @param enmEffOpSize The effective operand size.
759 */
760IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
761{
762 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
763 VBOXSTRICTRC rcStrict;
764 uint32_t fEflNew;
765
766 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
767 { /* probable */ }
768 else
769 {
770 Log2(("popf: Guest intercept -> #VMEXIT\n"));
771 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
772 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
773 }
774
775 /*
776 * V8086 is special as usual.
777 */
778 if (fEflOld & X86_EFL_VM)
779 {
780 /*
781 * Almost anything goes if IOPL is 3.
782 */
783 if (X86_EFL_GET_IOPL(fEflOld) == 3)
784 {
785 switch (enmEffOpSize)
786 {
787 case IEMMODE_16BIT:
788 {
789 uint16_t u16Value;
790 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
791 if (rcStrict != VINF_SUCCESS)
792 return rcStrict;
793 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
794 break;
795 }
796 case IEMMODE_32BIT:
797 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
798 if (rcStrict != VINF_SUCCESS)
799 return rcStrict;
800 break;
801 IEM_NOT_REACHED_DEFAULT_CASE_RET();
802 }
803
804 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
805 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
806 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
807 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
808 }
809 /*
810 * Interrupt flag virtualization with CR4.VME=1.
811 */
812 else if ( enmEffOpSize == IEMMODE_16BIT
813 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
814 {
815 uint16_t u16Value;
816 RTUINT64U TmpRsp;
817 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
818 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
819 if (rcStrict != VINF_SUCCESS)
820 return rcStrict;
821
822 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
823 * or before? */
824 if ( ( (u16Value & X86_EFL_IF)
825 && (fEflOld & X86_EFL_VIP))
826 || (u16Value & X86_EFL_TF) )
827 return iemRaiseGeneralProtectionFault0(pVCpu);
828
829 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
830 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
831 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
832 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
833
834 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
835 }
836 else
837 return iemRaiseGeneralProtectionFault0(pVCpu);
838
839 }
840 /*
841 * Not in V8086 mode.
842 */
843 else
844 {
845 /* Pop the flags. */
846 switch (enmEffOpSize)
847 {
848 case IEMMODE_16BIT:
849 {
850 uint16_t u16Value;
851 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
852 if (rcStrict != VINF_SUCCESS)
853 return rcStrict;
854 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
855
856 /*
857 * Ancient CPU adjustments:
858 * - 8086, 80186, V20/30:
859 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
860 * practical reasons (masking below). We add them when pushing flags.
861 * - 80286:
862 * The NT and IOPL flags cannot be popped from real mode and are
863 * therefore always zero (since a 286 can never exit from PM and
864 * their initial value is zero). This changed on a 386 and can
865 * therefore be used to detect 286 or 386 CPU in real mode.
866 */
867 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
868 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
869 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
870 break;
871 }
872 case IEMMODE_32BIT:
873 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
874 if (rcStrict != VINF_SUCCESS)
875 return rcStrict;
876 break;
877 case IEMMODE_64BIT:
878 {
879 uint64_t u64Value;
880 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
881 if (rcStrict != VINF_SUCCESS)
882 return rcStrict;
883 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
884 break;
885 }
886 IEM_NOT_REACHED_DEFAULT_CASE_RET();
887 }
888
889 /* Merge them with the current flags. */
890 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
891 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
892 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
893 || IEM_GET_CPL(pVCpu) == 0)
894 {
895 fEflNew &= fPopfBits;
896 fEflNew |= ~fPopfBits & fEflOld;
897 }
898 else if (IEM_GET_CPL(pVCpu) <= X86_EFL_GET_IOPL(fEflOld))
899 {
900 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
901 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
902 }
903 else
904 {
905 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
906 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
907 }
908 }
909
910 /*
911 * Commit the flags.
912 */
913 Assert(fEflNew & RT_BIT_32(1));
914 IEMMISC_SET_EFL(pVCpu, fEflNew);
915 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
916}
917
918
919/**
920 * Implements an indirect call.
921 *
922 * @param uNewPC The new program counter (RIP) value (loaded from the
923 * operand).
924 */
925IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
926{
927 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
928 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
929 {
930 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
931 if (rcStrict == VINF_SUCCESS)
932 {
933 pVCpu->cpum.GstCtx.rip = uNewPC;
934 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
935 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
936 }
937 return rcStrict;
938 }
939 return iemRaiseGeneralProtectionFault0(pVCpu);
940}
941
942
943/**
944 * Implements a 16-bit relative call.
945 *
946 * @param offDisp The displacment offset.
947 */
948IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
949{
950 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
951 uint16_t const uNewPC = uOldPC + offDisp;
952 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
953 {
954 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
955 if (rcStrict == VINF_SUCCESS)
956 {
957 pVCpu->cpum.GstCtx.rip = uNewPC;
958 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
959 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
960 }
961 return rcStrict;
962 }
963 return iemRaiseGeneralProtectionFault0(pVCpu);
964}
965
966
967/**
968 * Implements a 32-bit indirect call.
969 *
970 * @param uNewPC The new program counter (RIP) value (loaded from the
971 * operand).
972 */
973IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
974{
975 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
976 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
977 {
978 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
979 if (rcStrict == VINF_SUCCESS)
980 {
981 pVCpu->cpum.GstCtx.rip = uNewPC;
982 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
983 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
984 }
985 return rcStrict;
986 }
987 return iemRaiseGeneralProtectionFault0(pVCpu);
988}
989
990
991/**
992 * Implements a 32-bit relative call.
993 *
994 * @param offDisp The displacment offset.
995 */
996IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
997{
998 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
999 uint32_t const uNewPC = uOldPC + offDisp;
1000 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
1001 {
1002 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
1003 if (rcStrict == VINF_SUCCESS)
1004 {
1005 pVCpu->cpum.GstCtx.rip = uNewPC;
1006 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1007 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1008 }
1009 return rcStrict;
1010 }
1011 return iemRaiseGeneralProtectionFault0(pVCpu);
1012}
1013
1014
1015/**
1016 * Implements a 64-bit indirect call.
1017 *
1018 * @param uNewPC The new program counter (RIP) value (loaded from the
1019 * operand).
1020 */
1021IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
1022{
1023 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1024 if (IEM_IS_CANONICAL(uNewPC))
1025 {
1026 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1027 if (rcStrict == VINF_SUCCESS)
1028 {
1029 pVCpu->cpum.GstCtx.rip = uNewPC;
1030 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1031 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1032 }
1033 return rcStrict;
1034 }
1035 return iemRaiseGeneralProtectionFault0(pVCpu);
1036}
1037
1038
1039/**
1040 * Implements a 64-bit relative call.
1041 *
1042 * @param offDisp The displacment offset.
1043 */
1044IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
1045{
1046 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1047 uint64_t const uNewPC = uOldPC + offDisp;
1048 if (IEM_IS_CANONICAL(uNewPC))
1049 {
1050 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1051 if (rcStrict == VINF_SUCCESS)
1052 {
1053 pVCpu->cpum.GstCtx.rip = uNewPC;
1054 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1055 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1056 }
1057 return rcStrict;
1058 }
1059 return iemRaiseNotCanonical(pVCpu);
1060}
1061
1062
1063/**
1064 * Implements far jumps and calls thru task segments (TSS).
1065 *
1066 * @returns VBox strict status code.
1067 * @param pVCpu The cross context virtual CPU structure of the
1068 * calling thread.
1069 * @param cbInstr The current instruction length.
1070 * @param uSel The selector.
1071 * @param enmBranch The kind of branching we're performing.
1072 * @param enmEffOpSize The effective operand size.
1073 * @param pDesc The descriptor corresponding to @a uSel. The type is
1074 * task gate.
1075 */
1076static VBOXSTRICTRC iemCImpl_BranchTaskSegment(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1077 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1078{
1079#ifndef IEM_IMPLEMENTS_TASKSWITCH
1080 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1081#else
1082 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1083 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
1084 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
1085 RT_NOREF_PV(enmEffOpSize);
1086 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1087
1088 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1089 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1090 {
1091 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1092 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1093 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1094 }
1095
1096 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1097 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1098 * checked here, need testcases. */
1099 if (!pDesc->Legacy.Gen.u1Present)
1100 {
1101 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1102 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1103 }
1104
1105 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1106 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1107 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1108#endif
1109}
1110
1111
1112/**
1113 * Implements far jumps and calls thru task gates.
1114 *
1115 * @returns VBox strict status code.
1116 * @param pVCpu The cross context virtual CPU structure of the
1117 * calling thread.
1118 * @param cbInstr The current instruction length.
1119 * @param uSel The selector.
1120 * @param enmBranch The kind of branching we're performing.
1121 * @param enmEffOpSize The effective operand size.
1122 * @param pDesc The descriptor corresponding to @a uSel. The type is
1123 * task gate.
1124 */
1125static VBOXSTRICTRC iemCImpl_BranchTaskGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1126 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1127{
1128#ifndef IEM_IMPLEMENTS_TASKSWITCH
1129 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1130#else
1131 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1132 RT_NOREF_PV(enmEffOpSize);
1133 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1134
1135 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1136 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1137 {
1138 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1139 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1140 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1141 }
1142
1143 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1144 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1145 * checked here, need testcases. */
1146 if (!pDesc->Legacy.Gen.u1Present)
1147 {
1148 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1149 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1150 }
1151
1152 /*
1153 * Fetch the new TSS descriptor from the GDT.
1154 */
1155 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1156 if (uSelTss & X86_SEL_LDT)
1157 {
1158 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1159 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1160 }
1161
1162 IEMSELDESC TssDesc;
1163 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1164 if (rcStrict != VINF_SUCCESS)
1165 return rcStrict;
1166
1167 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1168 {
1169 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1170 TssDesc.Legacy.Gate.u4Type));
1171 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1172 }
1173
1174 if (!TssDesc.Legacy.Gate.u1Present)
1175 {
1176 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1177 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1178 }
1179
1180 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1181 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1182 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1183#endif
1184}
1185
1186
1187/**
1188 * Implements far jumps and calls thru call gates.
1189 *
1190 * @returns VBox strict status code.
1191 * @param pVCpu The cross context virtual CPU structure of the
1192 * calling thread.
1193 * @param cbInstr The current instruction length.
1194 * @param uSel The selector.
1195 * @param enmBranch The kind of branching we're performing.
1196 * @param enmEffOpSize The effective operand size.
1197 * @param pDesc The descriptor corresponding to @a uSel. The type is
1198 * call gate.
1199 */
1200static VBOXSTRICTRC iemCImpl_BranchCallGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1201 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1202{
1203#define IEM_IMPLEMENTS_CALLGATE
1204#ifndef IEM_IMPLEMENTS_CALLGATE
1205 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1206#else
1207 RT_NOREF_PV(enmEffOpSize);
1208 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1209
1210 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1211 * inter-privilege calls and are much more complex.
1212 *
1213 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1214 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1215 * must be 16-bit or 32-bit.
1216 */
1217 /** @todo effective operand size is probably irrelevant here, only the
1218 * call gate bitness matters??
1219 */
1220 VBOXSTRICTRC rcStrict;
1221 RTPTRUNION uPtrRet;
1222 uint64_t uNewRsp;
1223 uint64_t uNewRip;
1224 uint64_t u64Base;
1225 uint32_t cbLimit;
1226 RTSEL uNewCS;
1227 IEMSELDESC DescCS;
1228
1229 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1230 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1231 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1232 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1233
1234 /* Determine the new instruction pointer from the gate descriptor. */
1235 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1236 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1237 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1238
1239 /* Perform DPL checks on the gate descriptor. */
1240 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1241 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1242 {
1243 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1244 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1245 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1246 }
1247
1248 /** @todo does this catch NULL selectors, too? */
1249 if (!pDesc->Legacy.Gen.u1Present)
1250 {
1251 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1252 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1253 }
1254
1255 /*
1256 * Fetch the target CS descriptor from the GDT or LDT.
1257 */
1258 uNewCS = pDesc->Legacy.Gate.u16Sel;
1259 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1260 if (rcStrict != VINF_SUCCESS)
1261 return rcStrict;
1262
1263 /* Target CS must be a code selector. */
1264 if ( !DescCS.Legacy.Gen.u1DescType
1265 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1266 {
1267 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1268 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1269 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1270 }
1271
1272 /* Privilege checks on target CS. */
1273 if (enmBranch == IEMBRANCH_JUMP)
1274 {
1275 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1276 {
1277 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1278 {
1279 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1280 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1281 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1282 }
1283 }
1284 else
1285 {
1286 if (DescCS.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
1287 {
1288 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1289 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1290 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1291 }
1292 }
1293 }
1294 else
1295 {
1296 Assert(enmBranch == IEMBRANCH_CALL);
1297 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1298 {
1299 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1300 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1301 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1302 }
1303 }
1304
1305 /* Additional long mode checks. */
1306 if (IEM_IS_LONG_MODE(pVCpu))
1307 {
1308 if (!DescCS.Legacy.Gen.u1Long)
1309 {
1310 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1311 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1312 }
1313
1314 /* L vs D. */
1315 if ( DescCS.Legacy.Gen.u1Long
1316 && DescCS.Legacy.Gen.u1DefBig)
1317 {
1318 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1319 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1320 }
1321 }
1322
1323 if (!DescCS.Legacy.Gate.u1Present)
1324 {
1325 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1326 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1327 }
1328
1329 if (enmBranch == IEMBRANCH_JUMP)
1330 {
1331 /** @todo This is very similar to regular far jumps; merge! */
1332 /* Jumps are fairly simple... */
1333
1334 /* Chop the high bits off if 16-bit gate (Intel says so). */
1335 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1336 uNewRip = (uint16_t)uNewRip;
1337
1338 /* Limit check for non-long segments. */
1339 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1340 if (DescCS.Legacy.Gen.u1Long)
1341 u64Base = 0;
1342 else
1343 {
1344 if (uNewRip > cbLimit)
1345 {
1346 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1347 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1348 }
1349 u64Base = X86DESC_BASE(&DescCS.Legacy);
1350 }
1351
1352 /* Canonical address check. */
1353 if (!IEM_IS_CANONICAL(uNewRip))
1354 {
1355 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1356 return iemRaiseNotCanonical(pVCpu);
1357 }
1358
1359 /*
1360 * Ok, everything checked out fine. Now set the accessed bit before
1361 * committing the result into CS, CSHID and RIP.
1362 */
1363 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1364 {
1365 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1366 if (rcStrict != VINF_SUCCESS)
1367 return rcStrict;
1368 /** @todo check what VT-x and AMD-V does. */
1369 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1370 }
1371
1372 /* commit */
1373 pVCpu->cpum.GstCtx.rip = uNewRip;
1374 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1375 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
1376 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1377 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1378 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1379 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1380 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1381 }
1382 else
1383 {
1384 Assert(enmBranch == IEMBRANCH_CALL);
1385 /* Calls are much more complicated. */
1386
1387 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < IEM_GET_CPL(pVCpu)))
1388 {
1389 /* More privilege. This is the fun part. */
1390 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1391
1392 /*
1393 * Determine new SS:rSP from the TSS.
1394 */
1395 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1396
1397 /* Figure out where the new stack pointer is stored in the TSS. */
1398 uint8_t const uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1399 uint16_t offNewStack; /* Offset of new stack in TSS. */
1400 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1401 if (!IEM_IS_LONG_MODE(pVCpu))
1402 {
1403 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1404 {
1405 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1406 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1407 }
1408 else
1409 {
1410 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1411 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1412 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1413 }
1414 }
1415 else
1416 {
1417 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1418 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1419 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1420 }
1421
1422 /* Check against TSS limit. */
1423 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1424 {
1425 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1426 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1427 }
1428
1429 uint8_t bUnmapInfo;
1430 RTPTRUNION uPtrTss;
1431 RTGCPTR GCPtrTss = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1432 rcStrict = iemMemMap(pVCpu, &uPtrTss.pv, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrTss, IEM_ACCESS_SYS_R, 0);
1433 if (rcStrict != VINF_SUCCESS)
1434 {
1435 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1436 return rcStrict;
1437 }
1438
1439 RTSEL uNewSS;
1440 if (!IEM_IS_LONG_MODE(pVCpu))
1441 {
1442 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1443 {
1444 uNewRsp = uPtrTss.pu32[0];
1445 uNewSS = uPtrTss.pu16[2];
1446 }
1447 else
1448 {
1449 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1450 uNewRsp = uPtrTss.pu16[0];
1451 uNewSS = uPtrTss.pu16[1];
1452 }
1453 }
1454 else
1455 {
1456 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1457 /* SS will be a NULL selector, but that's valid. */
1458 uNewRsp = uPtrTss.pu64[0];
1459 uNewSS = uNewCSDpl;
1460 }
1461
1462 /* Done with the TSS now. */
1463 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1464 if (rcStrict != VINF_SUCCESS)
1465 {
1466 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1467 return rcStrict;
1468 }
1469
1470 /* Only used outside of long mode. */
1471 uint8_t const cbWords = pDesc->Legacy.Gate.u5ParmCount;
1472
1473 /* If EFER.LMA is 0, there's extra work to do. */
1474 IEMSELDESC DescSS;
1475 if (!IEM_IS_LONG_MODE(pVCpu))
1476 {
1477 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1478 {
1479 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1480 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1481 }
1482
1483 /* Grab the new SS descriptor. */
1484 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1485 if (rcStrict != VINF_SUCCESS)
1486 return rcStrict;
1487
1488 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1489 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1490 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1491 {
1492 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1493 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1494 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1495 }
1496
1497 /* Ensure new SS is a writable data segment. */
1498 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1499 {
1500 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1501 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1502 }
1503
1504 if (!DescSS.Legacy.Gen.u1Present)
1505 {
1506 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1507 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1508 }
1509 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1510 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1511 else
1512 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1513 }
1514 else
1515 {
1516 /* Just grab the new (NULL) SS descriptor. */
1517 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1518 * like we do... */
1519 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1520 if (rcStrict != VINF_SUCCESS)
1521 return rcStrict;
1522
1523 cbNewStack = sizeof(uint64_t) * 4;
1524 }
1525
1526 /** @todo According to Intel, new stack is checked for enough space first,
1527 * then switched. According to AMD, the stack is switched first and
1528 * then pushes might fault!
1529 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1530 * incoming stack \#PF happens before actual stack switch. AMD is
1531 * either lying or implicitly assumes that new state is committed
1532 * only if and when an instruction doesn't fault.
1533 */
1534
1535 /** @todo According to AMD, CS is loaded first, then SS.
1536 * According to Intel, it's the other way around!?
1537 */
1538
1539 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1540
1541 /* Set the accessed bit before committing new SS. */
1542 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1543 {
1544 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1545 if (rcStrict != VINF_SUCCESS)
1546 return rcStrict;
1547 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1548 }
1549
1550 /* Remember the old SS:rSP and their linear address. */
1551 RTSEL const uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1552 uint64_t const uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1553
1554 RTGCPTR const GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1555
1556 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1557 or #PF, the former is not implemented in this workaround. */
1558 /** @todo Proper fix callgate target stack exceptions. */
1559 /** @todo testcase: Cover callgates with partially or fully inaccessible
1560 * target stacks. */
1561 void *pvNewFrame;
1562 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1563 rcStrict = iemMemMap(pVCpu, &pvNewFrame, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1564 if (rcStrict != VINF_SUCCESS)
1565 {
1566 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1567 return rcStrict;
1568 }
1569 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1570 if (rcStrict != VINF_SUCCESS)
1571 {
1572 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1573 return rcStrict;
1574 }
1575
1576 /* Commit new SS:rSP. */
1577 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1578 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1579 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1580 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1581 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1582 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1583 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1584 IEM_SET_CPL(pVCpu, uNewCSDpl); /** @todo Are the parameter words accessed using the new CPL or the old CPL? */
1585 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1586 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1587
1588 /* At this point the stack access must not fail because new state was already committed. */
1589 /** @todo this can still fail due to SS.LIMIT not check. */
1590 uint8_t bUnmapInfoRet;
1591 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1592 IEM_IS_LONG_MODE(pVCpu) ? 7
1593 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1594 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1595 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1596 VERR_INTERNAL_ERROR_5);
1597
1598 if (!IEM_IS_LONG_MODE(pVCpu))
1599 {
1600 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1601 {
1602 if (cbWords)
1603 {
1604 /* Map the relevant chunk of the old stack. */
1605 RTPTRUNION uPtrParmWds;
1606 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1607 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1608 if (rcStrict != VINF_SUCCESS)
1609 {
1610 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1611 return rcStrict;
1612 }
1613
1614 /* Copy the parameter (d)words. */
1615 for (int i = 0; i < cbWords; ++i)
1616 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1617
1618 /* Unmap the old stack. */
1619 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1620 if (rcStrict != VINF_SUCCESS)
1621 {
1622 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1623 return rcStrict;
1624 }
1625 }
1626
1627 /* Push the old CS:rIP. */
1628 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1629 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1630
1631 /* Push the old SS:rSP. */
1632 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1633 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1634 }
1635 else
1636 {
1637 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1638
1639 if (cbWords)
1640 {
1641 /* Map the relevant chunk of the old stack. */
1642 RTPTRUNION uPtrParmWds;
1643 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1644 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1645 if (rcStrict != VINF_SUCCESS)
1646 {
1647 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1648 return rcStrict;
1649 }
1650
1651 /* Copy the parameter words. */
1652 for (int i = 0; i < cbWords; ++i)
1653 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1654
1655 /* Unmap the old stack. */
1656 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1657 if (rcStrict != VINF_SUCCESS)
1658 {
1659 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1660 return rcStrict;
1661 }
1662 }
1663
1664 /* Push the old CS:rIP. */
1665 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1666 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1667
1668 /* Push the old SS:rSP. */
1669 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1670 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1671 }
1672 }
1673 else
1674 {
1675 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1676
1677 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1678 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1679 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1680 uPtrRet.pu64[2] = uOldRsp;
1681 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1682 }
1683
1684 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1685 if (rcStrict != VINF_SUCCESS)
1686 {
1687 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1688 return rcStrict;
1689 }
1690
1691 /* Chop the high bits off if 16-bit gate (Intel says so). */
1692 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1693 uNewRip = (uint16_t)uNewRip;
1694
1695 /* Limit / canonical check. */
1696 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1697 if (!IEM_IS_LONG_MODE(pVCpu))
1698 {
1699 if (uNewRip > cbLimit)
1700 {
1701 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1702 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1703 }
1704 u64Base = X86DESC_BASE(&DescCS.Legacy);
1705 }
1706 else
1707 {
1708 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1709 if (!IEM_IS_CANONICAL(uNewRip))
1710 {
1711 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1712 return iemRaiseNotCanonical(pVCpu);
1713 }
1714 u64Base = 0;
1715 }
1716
1717 /*
1718 * Now set the accessed bit before
1719 * writing the return address to the stack and committing the result into
1720 * CS, CSHID and RIP.
1721 */
1722 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1723 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1724 {
1725 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1726 if (rcStrict != VINF_SUCCESS)
1727 return rcStrict;
1728 /** @todo check what VT-x and AMD-V does. */
1729 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1730 }
1731
1732 /* Commit new CS:rIP. */
1733 pVCpu->cpum.GstCtx.rip = uNewRip;
1734 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1735 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1736 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1737 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1738 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1739 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1740 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1741 }
1742 else
1743 {
1744 /* Same privilege. */
1745 /** @todo This is very similar to regular far calls; merge! */
1746
1747 /* Check stack first - may #SS(0). */
1748 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1749 * 16-bit code cause a two or four byte CS to be pushed? */
1750 uint8_t bUnmapInfoRet;
1751 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1752 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1753 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1754 IEM_IS_LONG_MODE(pVCpu) ? 7
1755 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1756 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1757 if (rcStrict != VINF_SUCCESS)
1758 return rcStrict;
1759
1760 /* Chop the high bits off if 16-bit gate (Intel says so). */
1761 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1762 uNewRip = (uint16_t)uNewRip;
1763
1764 /* Limit / canonical check. */
1765 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1766 if (!IEM_IS_LONG_MODE(pVCpu))
1767 {
1768 if (uNewRip > cbLimit)
1769 {
1770 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1771 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1772 }
1773 u64Base = X86DESC_BASE(&DescCS.Legacy);
1774 }
1775 else
1776 {
1777 if (!IEM_IS_CANONICAL(uNewRip))
1778 {
1779 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1780 return iemRaiseNotCanonical(pVCpu);
1781 }
1782 u64Base = 0;
1783 }
1784
1785 /*
1786 * Now set the accessed bit before
1787 * writing the return address to the stack and committing the result into
1788 * CS, CSHID and RIP.
1789 */
1790 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1791 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1792 {
1793 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1794 if (rcStrict != VINF_SUCCESS)
1795 return rcStrict;
1796 /** @todo check what VT-x and AMD-V does. */
1797 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1798 }
1799
1800 /* stack */
1801 if (!IEM_IS_LONG_MODE(pVCpu))
1802 {
1803 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1804 {
1805 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1806 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1807 }
1808 else
1809 {
1810 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1811 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1812 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1813 }
1814 }
1815 else
1816 {
1817 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1818 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1819 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1820 }
1821
1822 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1823 if (rcStrict != VINF_SUCCESS)
1824 return rcStrict;
1825
1826 /* commit */
1827 pVCpu->cpum.GstCtx.rip = uNewRip;
1828 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1829 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1830 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1831 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1832 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1833 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1834 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1835 }
1836 }
1837 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1838
1839 iemRecalcExecModeAndCplFlags(pVCpu);
1840
1841/** @todo single stepping */
1842
1843 /* Flush the prefetch buffer. */
1844 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1845 return VINF_SUCCESS;
1846#endif /* IEM_IMPLEMENTS_CALLGATE */
1847}
1848
1849
1850/**
1851 * Implements far jumps and calls thru system selectors.
1852 *
1853 * @returns VBox strict status code.
1854 * @param pVCpu The cross context virtual CPU structure of the
1855 * calling thread.
1856 * @param cbInstr The current instruction length.
1857 * @param uSel The selector.
1858 * @param enmBranch The kind of branching we're performing.
1859 * @param enmEffOpSize The effective operand size.
1860 * @param pDesc The descriptor corresponding to @a uSel.
1861 */
1862static VBOXSTRICTRC iemCImpl_BranchSysSel(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1863 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1864{
1865 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1866 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1867 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1868
1869 if (IEM_IS_LONG_MODE(pVCpu))
1870 switch (pDesc->Legacy.Gen.u4Type)
1871 {
1872 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1873 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1874
1875 default:
1876 case AMD64_SEL_TYPE_SYS_LDT:
1877 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1878 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1879 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1880 case AMD64_SEL_TYPE_SYS_INT_GATE:
1881 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1882 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1883 }
1884
1885 switch (pDesc->Legacy.Gen.u4Type)
1886 {
1887 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1888 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1889 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1890
1891 case X86_SEL_TYPE_SYS_TASK_GATE:
1892 return iemCImpl_BranchTaskGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1893
1894 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1895 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1896 return iemCImpl_BranchTaskSegment(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1897
1898 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1899 Log(("branch %04x -> busy 286 TSS\n", uSel));
1900 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1901
1902 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1903 Log(("branch %04x -> busy 386 TSS\n", uSel));
1904 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1905
1906 default:
1907 case X86_SEL_TYPE_SYS_LDT:
1908 case X86_SEL_TYPE_SYS_286_INT_GATE:
1909 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1910 case X86_SEL_TYPE_SYS_386_INT_GATE:
1911 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1912 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1913 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1914 }
1915}
1916
1917
1918/**
1919 * Implements far jumps.
1920 *
1921 * @param uSel The selector.
1922 * @param offSeg The segment offset.
1923 * @param enmEffOpSize The effective operand size.
1924 */
1925IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1926{
1927 NOREF(cbInstr);
1928 Assert(offSeg <= UINT32_MAX || (!IEM_IS_GUEST_CPU_AMD(pVCpu) && IEM_IS_64BIT_CODE(pVCpu)));
1929
1930 /*
1931 * Real mode and V8086 mode are easy. The only snag seems to be that
1932 * CS.limit doesn't change and the limit check is done against the current
1933 * limit.
1934 */
1935 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1936 * 1998) that up to and including the Intel 486, far control
1937 * transfers in real mode set default CS attributes (0x93) and also
1938 * set a 64K segment limit. Starting with the Pentium, the
1939 * attributes and limit are left alone but the access rights are
1940 * ignored. We only implement the Pentium+ behavior.
1941 * */
1942 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1943 {
1944 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1945 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1946 {
1947 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1948 return iemRaiseGeneralProtectionFault0(pVCpu);
1949 }
1950
1951 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1952 pVCpu->cpum.GstCtx.rip = offSeg;
1953 else
1954 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1955 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1956 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1957 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1958 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1959
1960 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
1961 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
1962 { /* likely */ }
1963 else if (uSel != 0)
1964 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
1965 else
1966 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
1967 | iemCalc32BitFlatIndicator(pVCpu);
1968
1969 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1970 }
1971
1972 /*
1973 * Protected mode. Need to parse the specified descriptor...
1974 */
1975 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1976 {
1977 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1978 return iemRaiseGeneralProtectionFault0(pVCpu);
1979 }
1980
1981 /* Fetch the descriptor. */
1982 IEMSELDESC Desc;
1983 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1984 if (rcStrict != VINF_SUCCESS)
1985 return rcStrict;
1986
1987 /* Is it there? */
1988 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1989 {
1990 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1991 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1992 }
1993
1994 /*
1995 * Deal with it according to its type. We do the standard code selectors
1996 * here and dispatch the system selectors to worker functions.
1997 */
1998 if (!Desc.Legacy.Gen.u1DescType)
1999 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
2000
2001 /* Only code segments. */
2002 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2003 {
2004 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2005 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2006 }
2007
2008 /* L vs D. */
2009 if ( Desc.Legacy.Gen.u1Long
2010 && Desc.Legacy.Gen.u1DefBig
2011 && IEM_IS_LONG_MODE(pVCpu))
2012 {
2013 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2014 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2015 }
2016
2017 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2018 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2019 {
2020 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2021 {
2022 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2023 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2024 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2025 }
2026 }
2027 else
2028 {
2029 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2030 {
2031 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2032 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2033 }
2034 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2035 {
2036 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2037 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2038 }
2039 }
2040
2041 /* Chop the high bits if 16-bit (Intel says so). */
2042 if (enmEffOpSize == IEMMODE_16BIT)
2043 offSeg &= UINT16_MAX;
2044
2045 /* Limit check and get the base. */
2046 uint64_t u64Base;
2047 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2048 if ( !Desc.Legacy.Gen.u1Long
2049 || !IEM_IS_LONG_MODE(pVCpu))
2050 {
2051 if (RT_LIKELY(offSeg <= cbLimit))
2052 u64Base = X86DESC_BASE(&Desc.Legacy);
2053 else
2054 {
2055 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2056 /** @todo Intel says this is \#GP(0)! */
2057 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2058 }
2059 }
2060 else
2061 u64Base = 0;
2062
2063 /*
2064 * Ok, everything checked out fine. Now set the accessed bit before
2065 * committing the result into CS, CSHID and RIP.
2066 */
2067 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2068 {
2069 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2070 if (rcStrict != VINF_SUCCESS)
2071 return rcStrict;
2072 /** @todo check what VT-x and AMD-V does. */
2073 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2074 }
2075
2076 /* commit */
2077 pVCpu->cpum.GstCtx.rip = offSeg;
2078 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2079 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
2080 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2081 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2082 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2083 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2084 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2085
2086 /** @todo check if the hidden bits are loaded correctly for 64-bit
2087 * mode. */
2088
2089 iemRecalcExecModeAndCplFlags(pVCpu);
2090
2091 /* Flush the prefetch buffer. */
2092 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2093
2094 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2095}
2096
2097
2098/**
2099 * Implements far calls.
2100 *
2101 * This very similar to iemCImpl_FarJmp.
2102 *
2103 * @param uSel The selector.
2104 * @param offSeg The segment offset.
2105 * @param enmEffOpSize The operand size (in case we need it).
2106 */
2107IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
2108{
2109 VBOXSTRICTRC rcStrict;
2110 uint64_t uNewRsp;
2111 RTPTRUNION uPtrRet;
2112 uint8_t bUnmapInfo;
2113
2114 /*
2115 * Real mode and V8086 mode are easy. The only snag seems to be that
2116 * CS.limit doesn't change and the limit check is done against the current
2117 * limit.
2118 */
2119 /** @todo See comment for similar code in iemCImpl_FarJmp */
2120 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2121 {
2122 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2123
2124 /* Check stack first - may #SS(0). */
2125 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2126 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2127 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
2128 if (rcStrict != VINF_SUCCESS)
2129 return rcStrict;
2130
2131 /* Check the target address range. */
2132/** @todo this must be wrong! Write unreal mode tests! */
2133 if (offSeg > UINT32_MAX)
2134 return iemRaiseGeneralProtectionFault0(pVCpu);
2135
2136 /* Everything is fine, push the return address. */
2137 if (enmEffOpSize == IEMMODE_16BIT)
2138 {
2139 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2140 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2141 }
2142 else
2143 {
2144 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2145 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2146 }
2147 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2148 if (rcStrict != VINF_SUCCESS)
2149 return rcStrict;
2150
2151 /* Branch. */
2152 pVCpu->cpum.GstCtx.rip = offSeg;
2153 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2154 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2155 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2156 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2157
2158 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2159 }
2160
2161 /*
2162 * Protected mode. Need to parse the specified descriptor...
2163 */
2164 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2165 {
2166 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2167 return iemRaiseGeneralProtectionFault0(pVCpu);
2168 }
2169
2170 /* Fetch the descriptor. */
2171 IEMSELDESC Desc;
2172 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2173 if (rcStrict != VINF_SUCCESS)
2174 return rcStrict;
2175
2176 /*
2177 * Deal with it according to its type. We do the standard code selectors
2178 * here and dispatch the system selectors to worker functions.
2179 */
2180 if (!Desc.Legacy.Gen.u1DescType)
2181 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2182
2183 /* Only code segments. */
2184 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2185 {
2186 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2187 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2188 }
2189
2190 /* L vs D. */
2191 if ( Desc.Legacy.Gen.u1Long
2192 && Desc.Legacy.Gen.u1DefBig
2193 && IEM_IS_LONG_MODE(pVCpu))
2194 {
2195 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2196 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2197 }
2198
2199 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2200 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2201 {
2202 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2203 {
2204 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2205 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2206 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2207 }
2208 }
2209 else
2210 {
2211 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2212 {
2213 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2214 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2215 }
2216 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2217 {
2218 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2219 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2220 }
2221 }
2222
2223 /* Is it there? */
2224 if (!Desc.Legacy.Gen.u1Present)
2225 {
2226 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2227 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2228 }
2229
2230 /* Check stack first - may #SS(0). */
2231 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2232 * 16-bit code cause a two or four byte CS to be pushed? */
2233 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2234 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2235 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2236 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
2237 if (rcStrict != VINF_SUCCESS)
2238 return rcStrict;
2239
2240 /* Chop the high bits if 16-bit (Intel says so). */
2241 if (enmEffOpSize == IEMMODE_16BIT)
2242 offSeg &= UINT16_MAX;
2243
2244 /* Limit / canonical check. */
2245 uint64_t u64Base;
2246 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2247 if ( !Desc.Legacy.Gen.u1Long
2248 || !IEM_IS_LONG_MODE(pVCpu))
2249 {
2250 if (RT_LIKELY(offSeg <= cbLimit))
2251 u64Base = X86DESC_BASE(&Desc.Legacy);
2252 else
2253 {
2254 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2255 /** @todo Intel says this is \#GP(0)! */
2256 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2257 }
2258 }
2259 else if (IEM_IS_CANONICAL(offSeg))
2260 u64Base = 0;
2261 else
2262 {
2263 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2264 return iemRaiseNotCanonical(pVCpu);
2265 }
2266
2267 /*
2268 * Now set the accessed bit before
2269 * writing the return address to the stack and committing the result into
2270 * CS, CSHID and RIP.
2271 */
2272 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2273 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2274 {
2275 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2276 if (rcStrict != VINF_SUCCESS)
2277 return rcStrict;
2278 /** @todo check what VT-x and AMD-V does. */
2279 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2280 }
2281
2282 /* stack */
2283 if (enmEffOpSize == IEMMODE_16BIT)
2284 {
2285 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2286 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2287 }
2288 else if (enmEffOpSize == IEMMODE_32BIT)
2289 {
2290 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2291 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2292 }
2293 else
2294 {
2295 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2296 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2297 }
2298 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2299 if (rcStrict != VINF_SUCCESS)
2300 return rcStrict;
2301
2302 /* commit */
2303 pVCpu->cpum.GstCtx.rip = offSeg;
2304 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2305 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
2306 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2307 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2308 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2309 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2310 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2311
2312 /** @todo check if the hidden bits are loaded correctly for 64-bit
2313 * mode. */
2314
2315 iemRecalcExecModeAndCplFlags(pVCpu);
2316
2317 /* Flush the prefetch buffer. */
2318 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2319
2320 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2321}
2322
2323
2324/**
2325 * Implements retf.
2326 *
2327 * @param enmEffOpSize The effective operand size.
2328 * @param cbPop The amount of arguments to pop from the stack
2329 * (bytes).
2330 */
2331IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2332{
2333 NOREF(cbInstr);
2334
2335 /*
2336 * Read the stack values first.
2337 */
2338 RTUINT64U NewRsp;
2339 uint8_t bUnmapInfo;
2340 RTCPTRUNION uPtrFrame;
2341 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2342 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2343 VBOXSTRICTRC rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2344 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2345 &uPtrFrame.pv, &bUnmapInfo, &NewRsp.u);
2346 if (rcStrict != VINF_SUCCESS)
2347 return rcStrict;
2348
2349 uint64_t uNewRip;
2350 uint16_t uNewCs;
2351 if (enmEffOpSize == IEMMODE_16BIT)
2352 {
2353 uNewRip = uPtrFrame.pu16[0];
2354 uNewCs = uPtrFrame.pu16[1];
2355 }
2356 else if (enmEffOpSize == IEMMODE_32BIT)
2357 {
2358 uNewRip = uPtrFrame.pu32[0];
2359 uNewCs = uPtrFrame.pu16[2];
2360 }
2361 else
2362 {
2363 uNewRip = uPtrFrame.pu64[0];
2364 uNewCs = uPtrFrame.pu16[4];
2365 }
2366
2367 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2368 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2369 { /* extremely likely */ }
2370 else
2371 return rcStrict;
2372
2373 /*
2374 * Real mode and V8086 mode are easy.
2375 */
2376 /** @todo See comment for similar code in iemCImpl_FarJmp */
2377 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2378 {
2379 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2380 /** @todo check how this is supposed to work if sp=0xfffe. */
2381
2382 /* Check the limit of the new EIP. */
2383 /** @todo Intel pseudo code only does the limit check for 16-bit
2384 * operands, AMD does not make any distinction. What is right? */
2385 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2386 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2387
2388 /* commit the operation. */
2389 if (cbPop)
2390 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2391 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2392 pVCpu->cpum.GstCtx.rip = uNewRip;
2393 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2394 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2395 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2396 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2397 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2398 }
2399
2400 /*
2401 * Protected mode is complicated, of course.
2402 */
2403 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2404 {
2405 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2406 return iemRaiseGeneralProtectionFault0(pVCpu);
2407 }
2408
2409 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2410
2411 /* Fetch the descriptor. */
2412 IEMSELDESC DescCs;
2413 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2414 if (rcStrict != VINF_SUCCESS)
2415 return rcStrict;
2416
2417 /* Can only return to a code selector. */
2418 if ( !DescCs.Legacy.Gen.u1DescType
2419 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2420 {
2421 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2422 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2423 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2424 }
2425
2426 /* L vs D. */
2427 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2428 && DescCs.Legacy.Gen.u1DefBig
2429 && IEM_IS_LONG_MODE(pVCpu))
2430 {
2431 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2432 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2433 }
2434
2435 /* DPL/RPL/CPL checks. */
2436 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
2437 {
2438 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
2439 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2440 }
2441
2442 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2443 {
2444 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2445 {
2446 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2447 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2448 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2449 }
2450 }
2451 else
2452 {
2453 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2454 {
2455 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2456 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2457 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2458 }
2459 }
2460
2461 /* Is it there? */
2462 if (!DescCs.Legacy.Gen.u1Present)
2463 {
2464 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2465 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2466 }
2467
2468 /*
2469 * Return to outer privilege? (We'll typically have entered via a call gate.)
2470 */
2471 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
2472 {
2473 /* Read the outer stack pointer stored *after* the parameters. */
2474 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, &bUnmapInfo, NewRsp.u);
2475 if (rcStrict != VINF_SUCCESS)
2476 return rcStrict;
2477
2478 uint16_t uNewOuterSs;
2479 RTUINT64U NewOuterRsp;
2480 if (enmEffOpSize == IEMMODE_16BIT)
2481 {
2482 NewOuterRsp.u = uPtrFrame.pu16[0];
2483 uNewOuterSs = uPtrFrame.pu16[1];
2484 }
2485 else if (enmEffOpSize == IEMMODE_32BIT)
2486 {
2487 NewOuterRsp.u = uPtrFrame.pu32[0];
2488 uNewOuterSs = uPtrFrame.pu16[2];
2489 }
2490 else
2491 {
2492 NewOuterRsp.u = uPtrFrame.pu64[0];
2493 uNewOuterSs = uPtrFrame.pu16[4];
2494 }
2495 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2496 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2497 { /* extremely likely */ }
2498 else
2499 return rcStrict;
2500
2501 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2502 and read the selector. */
2503 IEMSELDESC DescSs;
2504 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2505 {
2506 if ( !DescCs.Legacy.Gen.u1Long
2507 || (uNewOuterSs & X86_SEL_RPL) == 3)
2508 {
2509 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2510 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2511 return iemRaiseGeneralProtectionFault0(pVCpu);
2512 }
2513 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2514 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2515 }
2516 else
2517 {
2518 /* Fetch the descriptor for the new stack segment. */
2519 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2520 if (rcStrict != VINF_SUCCESS)
2521 return rcStrict;
2522 }
2523
2524 /* Check that RPL of stack and code selectors match. */
2525 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2526 {
2527 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2528 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2529 }
2530
2531 /* Must be a writable data segment. */
2532 if ( !DescSs.Legacy.Gen.u1DescType
2533 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2534 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2535 {
2536 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2537 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2538 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2539 }
2540
2541 /* L vs D. (Not mentioned by intel.) */
2542 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2543 && DescSs.Legacy.Gen.u1DefBig
2544 && IEM_IS_LONG_MODE(pVCpu))
2545 {
2546 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2547 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2548 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2549 }
2550
2551 /* DPL/RPL/CPL checks. */
2552 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2553 {
2554 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2555 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2556 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2557 }
2558
2559 /* Is it there? */
2560 if (!DescSs.Legacy.Gen.u1Present)
2561 {
2562 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2563 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2564 }
2565
2566 /* Calc SS limit.*/
2567 uint64_t u64BaseSs;
2568 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2569
2570 /* Is RIP canonical or within CS.limit? */
2571 uint64_t u64BaseCs;
2572 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2573
2574 /** @todo Testcase: Is this correct? */
2575 if ( DescCs.Legacy.Gen.u1Long
2576 && IEM_IS_LONG_MODE(pVCpu) )
2577 {
2578 if (!IEM_IS_CANONICAL(uNewRip))
2579 {
2580 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2581 return iemRaiseNotCanonical(pVCpu);
2582 }
2583 u64BaseCs = 0;
2584 u64BaseSs = 0;
2585 }
2586 else
2587 {
2588 if (uNewRip > cbLimitCs)
2589 {
2590 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2591 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
2592 /** @todo Intel says this is \#GP(0)! */
2593 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2594 }
2595 u64BaseCs = X86DESC_BASE(&DescCs.Legacy);
2596 u64BaseSs = X86DESC_BASE(&DescSs.Legacy);
2597 }
2598
2599 /*
2600 * Now set the accessed bit before
2601 * writing the return address to the stack and committing the result into
2602 * CS, CSHID and RIP.
2603 */
2604 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2605 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2606 {
2607 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2608 if (rcStrict != VINF_SUCCESS)
2609 return rcStrict;
2610 /** @todo check what VT-x and AMD-V does. */
2611 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2612 }
2613 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2614 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2615 {
2616 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2617 if (rcStrict != VINF_SUCCESS)
2618 return rcStrict;
2619 /** @todo check what VT-x and AMD-V does. */
2620 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2621 }
2622
2623 /* commit */
2624 if (enmEffOpSize == IEMMODE_16BIT)
2625 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2626 else
2627 pVCpu->cpum.GstCtx.rip = uNewRip;
2628 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2629 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2630 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2631 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2632 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2633 pVCpu->cpum.GstCtx.cs.u64Base = u64BaseCs;
2634 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2635 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2636 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2637 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2638 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2639 pVCpu->cpum.GstCtx.ss.u64Base = u64BaseSs;
2640
2641 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2642 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2643 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2644 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2645
2646 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2647
2648 if (cbPop)
2649 iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
2650 if (IEM_IS_64BIT_CODE(pVCpu))
2651 pVCpu->cpum.GstCtx.rsp = NewOuterRsp.u;
2652 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2653 pVCpu->cpum.GstCtx.rsp = (uint32_t)NewOuterRsp.u;
2654 else
2655 pVCpu->cpum.GstCtx.sp = (uint16_t)NewOuterRsp.u;
2656
2657 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2658
2659 /** @todo check if the hidden bits are loaded correctly for 64-bit
2660 * mode. */
2661 }
2662 /*
2663 * Return to the same privilege level
2664 */
2665 else
2666 {
2667 /* Limit / canonical check. */
2668 uint64_t u64Base;
2669 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2670
2671 /** @todo Testcase: Is this correct? */
2672 bool f64BitCs = false;
2673 if ( DescCs.Legacy.Gen.u1Long
2674 && IEM_IS_LONG_MODE(pVCpu) )
2675 {
2676 if (!IEM_IS_CANONICAL(uNewRip))
2677 {
2678 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2679 return iemRaiseNotCanonical(pVCpu);
2680 }
2681 u64Base = 0;
2682 f64BitCs = true;
2683 f64BitCs = true;
2684 }
2685 else
2686 {
2687 if (uNewRip > cbLimitCs)
2688 {
2689 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2690 /** @todo Intel says this is \#GP(0)! */
2691 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2692 }
2693 u64Base = X86DESC_BASE(&DescCs.Legacy);
2694 }
2695
2696 /*
2697 * Now set the accessed bit before
2698 * writing the return address to the stack and committing the result into
2699 * CS, CSHID and RIP.
2700 */
2701 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2702 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2703 {
2704 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2705 if (rcStrict != VINF_SUCCESS)
2706 return rcStrict;
2707 /** @todo check what VT-x and AMD-V does. */
2708 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2709 }
2710
2711 /* commit */
2712 if (cbPop)
2713/** @todo This cannot be right. We're using the old CS mode here, and iemRegAddToRspEx checks fExec. */
2714 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2715 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig || f64BitCs)
2716 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2717 else
2718 pVCpu->cpum.GstCtx.sp = (uint16_t)NewRsp.u;
2719 if (enmEffOpSize == IEMMODE_16BIT)
2720 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2721 else
2722 pVCpu->cpum.GstCtx.rip = uNewRip;
2723 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2724 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2725 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2726 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2727 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2728 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2729 /** @todo check if the hidden bits are loaded correctly for 64-bit
2730 * mode. */
2731
2732 iemRecalcExecModeAndCplFlags(pVCpu);
2733 }
2734
2735 /* Flush the prefetch buffer. */
2736 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo use light flush for same privilege? */
2737
2738 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2739}
2740
2741
2742/**
2743 * Implements retn and retn imm16.
2744 *
2745 * We're doing this in C because of the \#GP that might be raised if the popped
2746 * program counter is out of bounds.
2747 *
2748 * The hope with this forced inline worker function, is that the compiler will
2749 * be clever enough to eliminate unused code for the constant enmEffOpSize and
2750 * maybe cbPop parameters.
2751 *
2752 * @param pVCpu The cross context virtual CPU structure of the
2753 * calling thread.
2754 * @param cbInstr The current instruction length.
2755 * @param enmEffOpSize The effective operand size. This is constant.
2756 * @param cbPop The amount of arguments to pop from the stack
2757 * (bytes). This can be constant (zero).
2758 */
2759DECL_FORCE_INLINE(VBOXSTRICTRC) iemCImpl_ReturnNearCommon(PVMCPUCC pVCpu, uint8_t cbInstr, IEMMODE enmEffOpSize, uint16_t cbPop)
2760{
2761 /* Fetch the RSP from the stack. */
2762 VBOXSTRICTRC rcStrict;
2763 RTUINT64U NewRip;
2764 RTUINT64U NewRsp;
2765 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2766
2767 switch (enmEffOpSize)
2768 {
2769 case IEMMODE_16BIT:
2770 NewRip.u = 0;
2771 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2772 break;
2773 case IEMMODE_32BIT:
2774 NewRip.u = 0;
2775 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2776 break;
2777 case IEMMODE_64BIT:
2778 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2779 break;
2780 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2781 }
2782 if (rcStrict != VINF_SUCCESS)
2783 return rcStrict;
2784
2785 /* Check the new RSP before loading it. */
2786 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2787 * of it. The canonical test is performed here and for call. */
2788 if (enmEffOpSize != IEMMODE_64BIT)
2789 {
2790 if (RT_LIKELY(NewRip.DWords.dw0 <= pVCpu->cpum.GstCtx.cs.u32Limit))
2791 { /* likely */ }
2792 else
2793 {
2794 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2795 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2796 }
2797 }
2798 else
2799 {
2800 if (RT_LIKELY(IEM_IS_CANONICAL(NewRip.u)))
2801 { /* likely */ }
2802 else
2803 {
2804 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2805 return iemRaiseNotCanonical(pVCpu);
2806 }
2807 }
2808
2809 /* Apply cbPop */
2810 if (cbPop)
2811 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2812
2813 /* Commit it. */
2814 pVCpu->cpum.GstCtx.rip = NewRip.u;
2815 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2816
2817 /* Flush the prefetch buffer. */
2818 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo only need a light flush here, don't we? We don't really need any flushing... */
2819 RT_NOREF(cbInstr);
2820
2821 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2822}
2823
2824
2825/**
2826 * Implements retn imm16 with 16-bit effective operand size.
2827 *
2828 * @param cbPop The amount of arguments to pop from the stack (bytes).
2829 */
2830IEM_CIMPL_DEF_1(iemCImpl_retn_iw_16, uint16_t, cbPop)
2831{
2832 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, cbPop);
2833}
2834
2835
2836/**
2837 * Implements retn imm16 with 32-bit effective operand size.
2838 *
2839 * @param cbPop The amount of arguments to pop from the stack (bytes).
2840 */
2841IEM_CIMPL_DEF_1(iemCImpl_retn_iw_32, uint16_t, cbPop)
2842{
2843 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, cbPop);
2844}
2845
2846
2847/**
2848 * Implements retn imm16 with 64-bit effective operand size.
2849 *
2850 * @param cbPop The amount of arguments to pop from the stack (bytes).
2851 */
2852IEM_CIMPL_DEF_1(iemCImpl_retn_iw_64, uint16_t, cbPop)
2853{
2854 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, cbPop);
2855}
2856
2857
2858/**
2859 * Implements retn with 16-bit effective operand size.
2860 */
2861IEM_CIMPL_DEF_0(iemCImpl_retn_16)
2862{
2863 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, 0);
2864}
2865
2866
2867/**
2868 * Implements retn with 32-bit effective operand size.
2869 */
2870IEM_CIMPL_DEF_0(iemCImpl_retn_32)
2871{
2872 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, 0);
2873}
2874
2875
2876/**
2877 * Implements retn with 64-bit effective operand size.
2878 */
2879IEM_CIMPL_DEF_0(iemCImpl_retn_64)
2880{
2881 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, 0);
2882}
2883
2884
2885/**
2886 * Implements enter.
2887 *
2888 * We're doing this in C because the instruction is insane, even for the
2889 * u8NestingLevel=0 case dealing with the stack is tedious.
2890 *
2891 * @param enmEffOpSize The effective operand size.
2892 * @param cbFrame Frame size.
2893 * @param cParameters Frame parameter count.
2894 */
2895IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2896{
2897 /* Push RBP, saving the old value in TmpRbp. */
2898 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2899 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2900 RTUINT64U NewRbp;
2901 VBOXSTRICTRC rcStrict;
2902 if (enmEffOpSize == IEMMODE_64BIT)
2903 {
2904 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2905 NewRbp = NewRsp;
2906 }
2907 else if (enmEffOpSize == IEMMODE_32BIT)
2908 {
2909 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2910 NewRbp = NewRsp;
2911 }
2912 else
2913 {
2914 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2915 NewRbp = TmpRbp;
2916 NewRbp.Words.w0 = NewRsp.Words.w0;
2917 }
2918 if (rcStrict != VINF_SUCCESS)
2919 return rcStrict;
2920
2921 /* Copy the parameters (aka nesting levels by Intel). */
2922 cParameters &= 0x1f;
2923 if (cParameters > 0)
2924 {
2925 switch (enmEffOpSize)
2926 {
2927 case IEMMODE_16BIT:
2928 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2929 TmpRbp.DWords.dw0 -= 2;
2930 else
2931 TmpRbp.Words.w0 -= 2;
2932 do
2933 {
2934 uint16_t u16Tmp;
2935 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2936 if (rcStrict != VINF_SUCCESS)
2937 break;
2938 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2939 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2940 break;
2941
2942 case IEMMODE_32BIT:
2943 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2944 TmpRbp.DWords.dw0 -= 4;
2945 else
2946 TmpRbp.Words.w0 -= 4;
2947 do
2948 {
2949 uint32_t u32Tmp;
2950 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2951 if (rcStrict != VINF_SUCCESS)
2952 break;
2953 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2954 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2955 break;
2956
2957 case IEMMODE_64BIT:
2958 TmpRbp.u -= 8;
2959 do
2960 {
2961 uint64_t u64Tmp;
2962 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2963 if (rcStrict != VINF_SUCCESS)
2964 break;
2965 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2966 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2967 break;
2968
2969 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2970 }
2971 if (rcStrict != VINF_SUCCESS)
2972 return VINF_SUCCESS;
2973
2974 /* Push the new RBP */
2975 if (enmEffOpSize == IEMMODE_64BIT)
2976 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2977 else if (enmEffOpSize == IEMMODE_32BIT)
2978 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2979 else
2980 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2981 if (rcStrict != VINF_SUCCESS)
2982 return rcStrict;
2983
2984 }
2985
2986 /* Recalc RSP. */
2987 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2988
2989 /** @todo Should probe write access at the new RSP according to AMD. */
2990 /** @todo Should handle accesses to the VMX APIC-access page. */
2991
2992 /* Commit it. */
2993 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2994 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2995 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2996}
2997
2998
2999
3000/**
3001 * Implements leave.
3002 *
3003 * We're doing this in C because messing with the stack registers is annoying
3004 * since they depends on SS attributes.
3005 *
3006 * @param enmEffOpSize The effective operand size.
3007 */
3008IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
3009{
3010 /* Calculate the intermediate RSP from RBP and the stack attributes. */
3011 RTUINT64U NewRsp;
3012 if (IEM_IS_64BIT_CODE(pVCpu))
3013 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
3014 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3015 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
3016 else
3017 {
3018 /** @todo Check that LEAVE actually preserve the high EBP bits. */
3019 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
3020 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
3021 }
3022
3023 /* Pop RBP according to the operand size. */
3024 VBOXSTRICTRC rcStrict;
3025 RTUINT64U NewRbp;
3026 switch (enmEffOpSize)
3027 {
3028 case IEMMODE_16BIT:
3029 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
3030 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
3031 break;
3032 case IEMMODE_32BIT:
3033 NewRbp.u = 0;
3034 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
3035 break;
3036 case IEMMODE_64BIT:
3037 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
3038 break;
3039 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3040 }
3041 if (rcStrict != VINF_SUCCESS)
3042 return rcStrict;
3043
3044
3045 /* Commit it. */
3046 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
3047 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
3048 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
3049}
3050
3051
3052/**
3053 * Implements int3 and int XX.
3054 *
3055 * @param u8Int The interrupt vector number.
3056 * @param enmInt The int instruction type.
3057 */
3058IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
3059{
3060 Assert(pVCpu->iem.s.cXcptRecursions == 0);
3061
3062 /*
3063 * We must check if this INT3 might belong to DBGF before raising a #BP.
3064 */
3065 if (u8Int == 3)
3066 {
3067 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
3068 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
3069 { /* likely: No vbox debugger breakpoints */ }
3070 else
3071 {
3072 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
3073 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
3074 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
3075 return iemSetPassUpStatus(pVCpu, rcStrict);
3076 }
3077 }
3078/** @todo single stepping */
3079 return iemRaiseXcptOrInt(pVCpu,
3080 cbInstr,
3081 u8Int,
3082 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
3083 0,
3084 0);
3085}
3086
3087
3088/**
3089 * Implements iret for real mode and V8086 mode.
3090 *
3091 * @param enmEffOpSize The effective operand size.
3092 */
3093IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
3094{
3095 X86EFLAGS Efl;
3096 Efl.u = IEMMISC_GET_EFL(pVCpu);
3097 NOREF(cbInstr);
3098
3099 /*
3100 * iret throws an exception if VME isn't enabled.
3101 */
3102 if ( Efl.Bits.u1VM
3103 && Efl.Bits.u2IOPL != 3
3104 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
3105 return iemRaiseGeneralProtectionFault0(pVCpu);
3106
3107 /*
3108 * Do the stack bits, but don't commit RSP before everything checks
3109 * out right.
3110 */
3111 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3112 VBOXSTRICTRC rcStrict;
3113 uint8_t bUnmapInfo;
3114 RTCPTRUNION uFrame;
3115 uint16_t uNewCs;
3116 uint32_t uNewEip;
3117 uint32_t uNewFlags;
3118 uint64_t uNewRsp;
3119 if (enmEffOpSize == IEMMODE_32BIT)
3120 {
3121 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3122 if (rcStrict != VINF_SUCCESS)
3123 return rcStrict;
3124 uNewEip = uFrame.pu32[0];
3125 if (uNewEip > UINT16_MAX)
3126 return iemRaiseGeneralProtectionFault0(pVCpu);
3127
3128 uNewCs = (uint16_t)uFrame.pu32[1];
3129 uNewFlags = uFrame.pu32[2];
3130 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3131 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
3132 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
3133 | X86_EFL_ID;
3134 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3135 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3136 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
3137 }
3138 else
3139 {
3140 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3141 if (rcStrict != VINF_SUCCESS)
3142 return rcStrict;
3143 uNewEip = uFrame.pu16[0];
3144 uNewCs = uFrame.pu16[1];
3145 uNewFlags = uFrame.pu16[2];
3146 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3147 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
3148 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
3149 /** @todo The intel pseudo code does not indicate what happens to
3150 * reserved flags. We just ignore them. */
3151 /* Ancient CPU adjustments: See iemCImpl_popf. */
3152 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
3153 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
3154 }
3155 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
3156 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3157 { /* extremely likely */ }
3158 else
3159 return rcStrict;
3160
3161 /** @todo Check how this is supposed to work if sp=0xfffe. */
3162 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
3163 uNewCs, uNewEip, uNewFlags, uNewRsp));
3164
3165 /*
3166 * Check the limit of the new EIP.
3167 */
3168 /** @todo Only the AMD pseudo code check the limit here, what's
3169 * right? */
3170 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
3171 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
3172
3173 /*
3174 * V8086 checks and flag adjustments
3175 */
3176 if (Efl.Bits.u1VM)
3177 {
3178 if (Efl.Bits.u2IOPL == 3)
3179 {
3180 /* Preserve IOPL and clear RF. */
3181 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3182 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3183 }
3184 else if ( enmEffOpSize == IEMMODE_16BIT
3185 && ( !(uNewFlags & X86_EFL_IF)
3186 || !Efl.Bits.u1VIP )
3187 && !(uNewFlags & X86_EFL_TF) )
3188 {
3189 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3190 uNewFlags &= ~X86_EFL_VIF;
3191 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3192 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3193 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3194 }
3195 else
3196 return iemRaiseGeneralProtectionFault0(pVCpu);
3197 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3198 }
3199
3200 /*
3201 * Commit the operation.
3202 */
3203#ifdef DBGFTRACE_ENABLED
3204 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3205 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3206#endif
3207 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3208 pVCpu->cpum.GstCtx.rip = uNewEip;
3209 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3210 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3211 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3212 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3213 /** @todo do we load attribs and limit as well? */
3214 Assert(uNewFlags & X86_EFL_1);
3215 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3216
3217 /* Flush the prefetch buffer. */
3218 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo can do light flush in real mode at least */
3219
3220/** @todo single stepping */
3221 return VINF_SUCCESS;
3222}
3223
3224
3225/**
3226 * Loads a segment register when entering V8086 mode.
3227 *
3228 * @param pSReg The segment register.
3229 * @param uSeg The segment to load.
3230 */
3231static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3232{
3233 pSReg->Sel = uSeg;
3234 pSReg->ValidSel = uSeg;
3235 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3236 pSReg->u64Base = (uint32_t)uSeg << 4;
3237 pSReg->u32Limit = 0xffff;
3238 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3239 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3240 * IRET'ing to V8086. */
3241}
3242
3243
3244/**
3245 * Implements iret for protected mode returning to V8086 mode.
3246 *
3247 * @param uNewEip The new EIP.
3248 * @param uNewCs The new CS.
3249 * @param uNewFlags The new EFLAGS.
3250 * @param uNewRsp The RSP after the initial IRET frame.
3251 *
3252 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3253 */
3254IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3255{
3256 RT_NOREF_PV(cbInstr);
3257 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3258
3259 /*
3260 * Pop the V8086 specific frame bits off the stack.
3261 */
3262 uint8_t bUnmapInfo;
3263 RTCPTRUNION uFrame;
3264 VBOXSTRICTRC rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3265 if (rcStrict != VINF_SUCCESS)
3266 return rcStrict;
3267 uint32_t uNewEsp = uFrame.pu32[0];
3268 uint16_t uNewSs = uFrame.pu32[1];
3269 uint16_t uNewEs = uFrame.pu32[2];
3270 uint16_t uNewDs = uFrame.pu32[3];
3271 uint16_t uNewFs = uFrame.pu32[4];
3272 uint16_t uNewGs = uFrame.pu32[5];
3273 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3274 if (rcStrict != VINF_SUCCESS)
3275 return rcStrict;
3276
3277 /*
3278 * Commit the operation.
3279 */
3280 uNewFlags &= X86_EFL_LIVE_MASK;
3281 uNewFlags |= X86_EFL_RA1_MASK;
3282#ifdef DBGFTRACE_ENABLED
3283 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3284 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3285#endif
3286 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3287
3288 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3289 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3290 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3291 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3292 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3293 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3294 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3295 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3296 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3297 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
3298 | (3 << IEM_F_X86_CPL_SHIFT)
3299 | IEM_F_MODE_X86_16BIT_PROT_V86;
3300
3301 /* Flush the prefetch buffer. */
3302 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3303
3304/** @todo single stepping */
3305 return VINF_SUCCESS;
3306}
3307
3308
3309/**
3310 * Implements iret for protected mode returning via a nested task.
3311 *
3312 * @param enmEffOpSize The effective operand size.
3313 */
3314IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3315{
3316 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3317#ifndef IEM_IMPLEMENTS_TASKSWITCH
3318 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3319#else
3320 RT_NOREF_PV(enmEffOpSize);
3321
3322 /*
3323 * Read the segment selector in the link-field of the current TSS.
3324 */
3325 RTSEL uSelRet;
3326 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3327 if (rcStrict != VINF_SUCCESS)
3328 return rcStrict;
3329
3330 /*
3331 * Fetch the returning task's TSS descriptor from the GDT.
3332 */
3333 if (uSelRet & X86_SEL_LDT)
3334 {
3335 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3336 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3337 }
3338
3339 IEMSELDESC TssDesc;
3340 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3341 if (rcStrict != VINF_SUCCESS)
3342 return rcStrict;
3343
3344 if (TssDesc.Legacy.Gate.u1DescType)
3345 {
3346 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3347 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3348 }
3349
3350 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3351 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3352 {
3353 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3354 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3355 }
3356
3357 if (!TssDesc.Legacy.Gate.u1Present)
3358 {
3359 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3360 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3361 }
3362
3363 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3364 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3365 0 /* uCr2 */, uSelRet, &TssDesc);
3366#endif
3367}
3368
3369
3370/**
3371 * Implements iret for protected mode
3372 *
3373 * @param enmEffOpSize The effective operand size.
3374 */
3375IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3376{
3377 NOREF(cbInstr);
3378 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3379
3380 /*
3381 * Nested task return.
3382 */
3383 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3384 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3385
3386 /*
3387 * Normal return.
3388 *
3389 * Do the stack bits, but don't commit RSP before everything checks
3390 * out right.
3391 */
3392 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3393 uint8_t bUnmapInfo;
3394 VBOXSTRICTRC rcStrict;
3395 RTCPTRUNION uFrame;
3396 uint16_t uNewCs;
3397 uint32_t uNewEip;
3398 uint32_t uNewFlags;
3399 uint64_t uNewRsp;
3400 if (enmEffOpSize == IEMMODE_32BIT)
3401 {
3402 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3403 if (rcStrict != VINF_SUCCESS)
3404 return rcStrict;
3405 uNewEip = uFrame.pu32[0];
3406 uNewCs = (uint16_t)uFrame.pu32[1];
3407 uNewFlags = uFrame.pu32[2];
3408 }
3409 else
3410 {
3411 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3412 if (rcStrict != VINF_SUCCESS)
3413 return rcStrict;
3414 uNewEip = uFrame.pu16[0];
3415 uNewCs = uFrame.pu16[1];
3416 uNewFlags = uFrame.pu16[2];
3417 }
3418 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3419 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3420 { /* extremely likely */ }
3421 else
3422 return rcStrict;
3423 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, IEM_GET_CPL(pVCpu)));
3424
3425 /*
3426 * We're hopefully not returning to V8086 mode...
3427 */
3428 if ( (uNewFlags & X86_EFL_VM)
3429 && IEM_GET_CPL(pVCpu) == 0)
3430 {
3431 Assert(enmEffOpSize == IEMMODE_32BIT);
3432 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3433 }
3434
3435 /*
3436 * Protected mode.
3437 */
3438 /* Read the CS descriptor. */
3439 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3440 {
3441 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3442 return iemRaiseGeneralProtectionFault0(pVCpu);
3443 }
3444
3445 IEMSELDESC DescCS;
3446 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3447 if (rcStrict != VINF_SUCCESS)
3448 {
3449 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3450 return rcStrict;
3451 }
3452
3453 /* Must be a code descriptor. */
3454 if (!DescCS.Legacy.Gen.u1DescType)
3455 {
3456 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3457 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3458 }
3459 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3460 {
3461 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3462 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3463 }
3464
3465 /* Privilege checks. */
3466 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3467 {
3468 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3469 {
3470 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3471 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3472 }
3473 }
3474 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3475 {
3476 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3477 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3478 }
3479 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3480 {
3481 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, IEM_GET_CPL(pVCpu)));
3482 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3483 }
3484
3485 /* Present? */
3486 if (!DescCS.Legacy.Gen.u1Present)
3487 {
3488 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3489 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3490 }
3491
3492 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3493
3494 /*
3495 * Return to outer level?
3496 */
3497 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
3498 {
3499 uint16_t uNewSS;
3500 uint32_t uNewESP;
3501 if (enmEffOpSize == IEMMODE_32BIT)
3502 {
3503 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3504 if (rcStrict != VINF_SUCCESS)
3505 return rcStrict;
3506/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3507 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3508 * bit of the popped SS selector it turns out. */
3509 uNewESP = uFrame.pu32[0];
3510 uNewSS = (uint16_t)uFrame.pu32[1];
3511 }
3512 else
3513 {
3514 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3515 if (rcStrict != VINF_SUCCESS)
3516 return rcStrict;
3517 uNewESP = uFrame.pu16[0];
3518 uNewSS = uFrame.pu16[1];
3519 }
3520 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
3521 if (rcStrict != VINF_SUCCESS)
3522 return rcStrict;
3523 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3524
3525 /* Read the SS descriptor. */
3526 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3527 {
3528 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3529 return iemRaiseGeneralProtectionFault0(pVCpu);
3530 }
3531
3532 IEMSELDESC DescSS;
3533 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3534 if (rcStrict != VINF_SUCCESS)
3535 {
3536 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3537 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3538 return rcStrict;
3539 }
3540
3541 /* Privilege checks. */
3542 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3543 {
3544 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3545 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3546 }
3547 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3548 {
3549 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3550 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3551 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3552 }
3553
3554 /* Must be a writeable data segment descriptor. */
3555 if (!DescSS.Legacy.Gen.u1DescType)
3556 {
3557 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3558 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3559 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3560 }
3561 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3562 {
3563 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3564 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3565 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3566 }
3567
3568 /* Present? */
3569 if (!DescSS.Legacy.Gen.u1Present)
3570 {
3571 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3572 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3573 }
3574
3575 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3576
3577 /* Check EIP. */
3578 if (uNewEip > cbLimitCS)
3579 {
3580 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3581 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3582 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3583 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3584 }
3585
3586 /*
3587 * Commit the changes, marking CS and SS accessed first since
3588 * that may fail.
3589 */
3590 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3591 {
3592 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3593 if (rcStrict != VINF_SUCCESS)
3594 return rcStrict;
3595 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3596 }
3597 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3598 {
3599 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3600 if (rcStrict != VINF_SUCCESS)
3601 return rcStrict;
3602 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3603 }
3604
3605 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3606 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3607 if (enmEffOpSize != IEMMODE_16BIT)
3608 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3609 if (IEM_GET_CPL(pVCpu) == 0)
3610 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3611 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3612 fEFlagsMask |= X86_EFL_IF;
3613 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3614 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3615 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3616 fEFlagsNew &= ~fEFlagsMask;
3617 fEFlagsNew |= uNewFlags & fEFlagsMask;
3618#ifdef DBGFTRACE_ENABLED
3619 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3620 IEM_GET_CPL(pVCpu), uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3621 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3622#endif
3623
3624 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3625 pVCpu->cpum.GstCtx.rip = uNewEip;
3626 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3627 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3628 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3629 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3630 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3631 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3632
3633 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3634 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3635 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3636 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3637 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3638 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3639 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3640 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3641 else
3642 pVCpu->cpum.GstCtx.rsp = uNewESP;
3643
3644 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3645 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3646 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3647 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3648
3649 iemRecalcExecModeAndCplFlags(pVCpu);
3650
3651 /* Done! */
3652
3653 }
3654 /*
3655 * Return to the same level.
3656 */
3657 else
3658 {
3659 /* Check EIP. */
3660 if (uNewEip > cbLimitCS)
3661 {
3662 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3663 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3664 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3665 }
3666
3667 /*
3668 * Commit the changes, marking CS first since it may fail.
3669 */
3670 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3671 {
3672 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3673 if (rcStrict != VINF_SUCCESS)
3674 return rcStrict;
3675 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3676 }
3677
3678 X86EFLAGS NewEfl;
3679 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3680 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3681 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3682 if (enmEffOpSize != IEMMODE_16BIT)
3683 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3684 if (IEM_GET_CPL(pVCpu) == 0)
3685 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3686 else if (IEM_GET_CPL(pVCpu) <= NewEfl.Bits.u2IOPL)
3687 fEFlagsMask |= X86_EFL_IF;
3688 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3689 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3690 NewEfl.u &= ~fEFlagsMask;
3691 NewEfl.u |= fEFlagsMask & uNewFlags;
3692#ifdef DBGFTRACE_ENABLED
3693 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3694 IEM_GET_CPL(pVCpu), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3695 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3696#endif
3697
3698 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3699 pVCpu->cpum.GstCtx.rip = uNewEip;
3700 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3701 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3702 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3703 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3704 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3705 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3706 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3707 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3708 else
3709 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3710
3711 iemRecalcExecModeAndCplFlags(pVCpu);
3712
3713 /* Done! */
3714 }
3715
3716 /* Flush the prefetch buffer. */
3717 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if same ring? */
3718
3719/** @todo single stepping */
3720 return VINF_SUCCESS;
3721}
3722
3723
3724/**
3725 * Implements iret for long mode
3726 *
3727 * @param enmEffOpSize The effective operand size.
3728 */
3729IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3730{
3731 NOREF(cbInstr);
3732
3733 /*
3734 * Nested task return is not supported in long mode.
3735 */
3736 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3737 {
3738 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3739 return iemRaiseGeneralProtectionFault0(pVCpu);
3740 }
3741
3742 /*
3743 * Normal return.
3744 *
3745 * Do the stack bits, but don't commit RSP before everything checks
3746 * out right.
3747 */
3748 VBOXSTRICTRC rcStrict;
3749 uint8_t bUnmapInfo;
3750 RTCPTRUNION uFrame;
3751 uint64_t uNewRip;
3752 uint16_t uNewCs;
3753 uint16_t uNewSs;
3754 uint32_t uNewFlags;
3755 uint64_t uNewRsp;
3756 if (enmEffOpSize == IEMMODE_64BIT)
3757 {
3758 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3759 if (rcStrict != VINF_SUCCESS)
3760 return rcStrict;
3761 uNewRip = uFrame.pu64[0];
3762 uNewCs = (uint16_t)uFrame.pu64[1];
3763 uNewFlags = (uint32_t)uFrame.pu64[2];
3764 uNewRsp = uFrame.pu64[3];
3765 uNewSs = (uint16_t)uFrame.pu64[4];
3766 }
3767 else if (enmEffOpSize == IEMMODE_32BIT)
3768 {
3769 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3770 if (rcStrict != VINF_SUCCESS)
3771 return rcStrict;
3772 uNewRip = uFrame.pu32[0];
3773 uNewCs = (uint16_t)uFrame.pu32[1];
3774 uNewFlags = uFrame.pu32[2];
3775 uNewRsp = uFrame.pu32[3];
3776 uNewSs = (uint16_t)uFrame.pu32[4];
3777 }
3778 else
3779 {
3780 Assert(enmEffOpSize == IEMMODE_16BIT);
3781 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3782 if (rcStrict != VINF_SUCCESS)
3783 return rcStrict;
3784 uNewRip = uFrame.pu16[0];
3785 uNewCs = uFrame.pu16[1];
3786 uNewFlags = uFrame.pu16[2];
3787 uNewRsp = uFrame.pu16[3];
3788 uNewSs = uFrame.pu16[4];
3789 }
3790 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3791 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3792 { /* extremely like */ }
3793 else
3794 return rcStrict;
3795 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3796
3797 /*
3798 * Check stuff.
3799 */
3800 /* Read the CS descriptor. */
3801 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3802 {
3803 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3804 return iemRaiseGeneralProtectionFault0(pVCpu);
3805 }
3806
3807 IEMSELDESC DescCS;
3808 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3809 if (rcStrict != VINF_SUCCESS)
3810 {
3811 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3812 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3813 return rcStrict;
3814 }
3815
3816 /* Must be a code descriptor. */
3817 if ( !DescCS.Legacy.Gen.u1DescType
3818 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3819 {
3820 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3821 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3822 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3823 }
3824
3825 /* Privilege checks. */
3826 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3827 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3828 {
3829 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3830 {
3831 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3832 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3833 }
3834 }
3835 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3836 {
3837 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3838 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3839 }
3840 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3841 {
3842 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
3843 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3844 }
3845
3846 /* Present? */
3847 if (!DescCS.Legacy.Gen.u1Present)
3848 {
3849 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3850 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3851 }
3852
3853 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3854
3855 /* Read the SS descriptor. */
3856 IEMSELDESC DescSS;
3857 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3858 {
3859 if ( !DescCS.Legacy.Gen.u1Long
3860 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3861 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3862 {
3863 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3864 return iemRaiseGeneralProtectionFault0(pVCpu);
3865 }
3866 /* Make sure SS is sensible, marked as accessed etc. */
3867 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3868 }
3869 else
3870 {
3871 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3872 if (rcStrict != VINF_SUCCESS)
3873 {
3874 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3875 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3876 return rcStrict;
3877 }
3878 }
3879
3880 /* Privilege checks. */
3881 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3882 {
3883 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3884 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3885 }
3886
3887 uint32_t cbLimitSs;
3888 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3889 cbLimitSs = UINT32_MAX;
3890 else
3891 {
3892 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3893 {
3894 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3895 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3896 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3897 }
3898
3899 /* Must be a writeable data segment descriptor. */
3900 if (!DescSS.Legacy.Gen.u1DescType)
3901 {
3902 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3903 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3904 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3905 }
3906 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3907 {
3908 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3909 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3910 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3911 }
3912
3913 /* Present? */
3914 if (!DescSS.Legacy.Gen.u1Present)
3915 {
3916 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3917 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3918 }
3919 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3920 }
3921
3922 /* Check EIP. */
3923 if (DescCS.Legacy.Gen.u1Long)
3924 {
3925 if (!IEM_IS_CANONICAL(uNewRip))
3926 {
3927 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3928 uNewCs, uNewRip, uNewSs, uNewRsp));
3929 return iemRaiseNotCanonical(pVCpu);
3930 }
3931/** @todo check the location of this... Testcase. */
3932 if (RT_LIKELY(!DescCS.Legacy.Gen.u1DefBig))
3933 { /* likely */ }
3934 else
3935 {
3936 Log(("iret %04x:%016RX64/%04x:%016RX64 -> both L and D are set -> #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3937 return iemRaiseGeneralProtectionFault0(pVCpu);
3938 }
3939 }
3940 else
3941 {
3942 if (uNewRip > cbLimitCS)
3943 {
3944 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3945 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3946 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3947 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3948 }
3949 }
3950
3951 /*
3952 * Commit the changes, marking CS and SS accessed first since
3953 * that may fail.
3954 */
3955 /** @todo where exactly are these actually marked accessed by a real CPU? */
3956 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3957 {
3958 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3959 if (rcStrict != VINF_SUCCESS)
3960 return rcStrict;
3961 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3962 }
3963 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3964 {
3965 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3966 if (rcStrict != VINF_SUCCESS)
3967 return rcStrict;
3968 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3969 }
3970
3971 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3972 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3973 if (enmEffOpSize != IEMMODE_16BIT)
3974 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3975 if (IEM_GET_CPL(pVCpu) == 0)
3976 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3977 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3978 fEFlagsMask |= X86_EFL_IF;
3979 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3980 fEFlagsNew &= ~fEFlagsMask;
3981 fEFlagsNew |= uNewFlags & fEFlagsMask;
3982#ifdef DBGFTRACE_ENABLED
3983 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3984 IEM_GET_CPL(pVCpu), uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3985#endif
3986
3987 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3988 pVCpu->cpum.GstCtx.rip = uNewRip;
3989 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3990 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3991 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3992 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3993 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3994 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3995 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3996 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3997 else
3998 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3999 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4000 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4001 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
4002 {
4003 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4004 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
4005 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4006 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4007 Log2(("iretq new SS: NULL\n"));
4008 }
4009 else
4010 {
4011 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4012 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
4013 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
4014 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
4015 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4016 }
4017
4018 if (IEM_GET_CPL(pVCpu) != uNewCpl)
4019 {
4020 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
4021 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
4022 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
4023 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
4024 }
4025
4026 iemRecalcExecModeAndCplFlags(pVCpu);
4027
4028 /* Flush the prefetch buffer. */
4029 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if the ring + mode doesn't change */
4030
4031/** @todo single stepping */
4032 return VINF_SUCCESS;
4033}
4034
4035
4036/**
4037 * Implements iret.
4038 *
4039 * @param enmEffOpSize The effective operand size.
4040 */
4041IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
4042{
4043 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
4044
4045 if (!IEM_IS_IN_GUEST(pVCpu))
4046 { /* probable */ }
4047#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4048 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4049 {
4050 /*
4051 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
4052 * of this IRET instruction. We need to provide this information as part of some
4053 * VM-exits.
4054 *
4055 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
4056 */
4057 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
4058 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
4059 else
4060 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
4061
4062 /*
4063 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
4064 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
4065 */
4066 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
4067 fBlockingNmi = false;
4068
4069 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
4070 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
4071 }
4072#endif
4073 /*
4074 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
4075 * The NMI is still held pending (which I assume means blocking of further NMIs
4076 * is in effect).
4077 *
4078 * See AMD spec. 15.9 "Instruction Intercepts".
4079 * See AMD spec. 15.21.9 "NMI Support".
4080 */
4081 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
4082 {
4083 Log(("iret: Guest intercept -> #VMEXIT\n"));
4084 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
4085 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4086 }
4087
4088 /*
4089 * Clear NMI blocking, if any, before causing any further exceptions.
4090 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
4091 */
4092 if (fBlockingNmi)
4093 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
4094
4095 /*
4096 * Call a mode specific worker.
4097 */
4098 VBOXSTRICTRC rcStrict;
4099 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4100 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
4101 else
4102 {
4103 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
4104 if (IEM_IS_64BIT_CODE(pVCpu))
4105 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
4106 else
4107 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
4108 }
4109
4110#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4111 /*
4112 * Clear NMI unblocking IRET state with the completion of IRET.
4113 */
4114 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4115 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
4116#endif
4117 return rcStrict;
4118}
4119
4120
4121static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4122{
4123 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4124
4125 pHid->Sel = uSel;
4126 pHid->ValidSel = uSel;
4127 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4128}
4129
4130
4131static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
4132{
4133 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4134
4135 /* The base is in the first three bytes. */
4136 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
4137 /* The attributes are in the fourth byte. */
4138 pHid->Attr.u = pbMem[3];
4139 pHid->Attr.u &= ~(X86DESCATTR_L | X86DESCATTR_D); /* (just to be on the safe side) */
4140 /* The limit is in the last two bytes. */
4141 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
4142}
4143
4144
4145/**
4146 * Implements 286 LOADALL (286 CPUs only).
4147 */
4148IEM_CIMPL_DEF_0(iemCImpl_loadall286)
4149{
4150 NOREF(cbInstr);
4151
4152 /* Data is loaded from a buffer at 800h. No checks are done on the
4153 * validity of loaded state.
4154 *
4155 * LOADALL only loads the internal CPU state, it does not access any
4156 * GDT, LDT, or similar tables.
4157 */
4158
4159 if (IEM_GET_CPL(pVCpu) != 0)
4160 {
4161 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4162 return iemRaiseGeneralProtectionFault0(pVCpu);
4163 }
4164
4165 uint8_t bUnmapInfo;
4166 uint8_t const *pbMem = NULL;
4167 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
4168 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, &bUnmapInfo, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
4169 if (rcStrict != VINF_SUCCESS)
4170 return rcStrict;
4171
4172 /* The MSW is at offset 0x06. */
4173 uint16_t const *pau16Mem = (uint16_t const *)(pbMem + 0x06);
4174 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
4175 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4176 uNewCr0 |= *pau16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4177 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
4178
4179 CPUMSetGuestCR0(pVCpu, uNewCr0);
4180 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
4181
4182 /* Inform PGM if mode changed. */
4183 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
4184 {
4185 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
4186 AssertRCReturn(rc, rc);
4187 /* ignore informational status codes */
4188 }
4189 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
4190 false /* fForce */);
4191
4192 /* TR selector is at offset 0x16. */
4193 pau16Mem = (uint16_t const *)(pbMem + 0x16);
4194 pVCpu->cpum.GstCtx.tr.Sel = pau16Mem[0];
4195 pVCpu->cpum.GstCtx.tr.ValidSel = pau16Mem[0];
4196 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
4197
4198 /* Followed by FLAGS... */
4199 pVCpu->cpum.GstCtx.eflags.u = pau16Mem[1] | X86_EFL_1;
4200 pVCpu->cpum.GstCtx.ip = pau16Mem[2]; /* ...and IP. */
4201
4202 /* LDT is at offset 0x1C. */
4203 pau16Mem = (uint16_t const *)(pbMem + 0x1C);
4204 pVCpu->cpum.GstCtx.ldtr.Sel = pau16Mem[0];
4205 pVCpu->cpum.GstCtx.ldtr.ValidSel = pau16Mem[0];
4206 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4207
4208 /* Segment registers are at offset 0x1E. */
4209 pau16Mem = (uint16_t const *)(pbMem + 0x1E);
4210 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pau16Mem[0]);
4211 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pau16Mem[1]);
4212 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pau16Mem[2]);
4213 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pau16Mem[3]);
4214
4215 /* GPRs are at offset 0x26. */
4216 pau16Mem = (uint16_t const *)(pbMem + 0x26);
4217 pVCpu->cpum.GstCtx.di = pau16Mem[0];
4218 pVCpu->cpum.GstCtx.si = pau16Mem[1];
4219 pVCpu->cpum.GstCtx.bp = pau16Mem[2];
4220 pVCpu->cpum.GstCtx.sp = pau16Mem[3];
4221 pVCpu->cpum.GstCtx.bx = pau16Mem[4];
4222 pVCpu->cpum.GstCtx.dx = pau16Mem[5];
4223 pVCpu->cpum.GstCtx.cx = pau16Mem[6];
4224 pVCpu->cpum.GstCtx.ax = pau16Mem[7];
4225
4226 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4227 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4228 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4229 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4230 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4231
4232 /* GDTR contents are at offset 0x4E, 6 bytes. */
4233 uint8_t const *pau8Mem = pbMem + 0x4E;
4234 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4235 RTGCPHYS GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
4236 uint16_t cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
4237 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4238
4239 /* IDTR contents are at offset 0x5A, 6 bytes. */
4240 pau8Mem = pbMem + 0x5A;
4241 GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
4242 cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
4243 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4244
4245 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4246 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4247 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4248 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4249 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4250 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4251
4252 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
4253 if (rcStrict != VINF_SUCCESS)
4254 return rcStrict;
4255
4256 /*
4257 * The CPL may change and protected mode may change enabled. It is taken
4258 * from the "DPL fields of the SS and CS descriptor caches" but there is no
4259 * word as to what happens if those are not identical (probably bad things).
4260 */
4261 iemRecalcExecModeAndCplFlags(pVCpu);
4262 Assert(IEM_IS_16BIT_CODE(pVCpu));
4263
4264 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4265
4266 /* Flush the prefetch buffer. */
4267 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4268
4269/** @todo single stepping */
4270 return rcStrict;
4271}
4272
4273
4274/**
4275 * Implements SYSCALL (AMD and Intel64).
4276 */
4277IEM_CIMPL_DEF_0(iemCImpl_syscall)
4278{
4279 /** @todo hack, LOADALL should be decoded as such on a 286. */
4280 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4281 return iemCImpl_loadall286(pVCpu, cbInstr);
4282
4283 /*
4284 * Check preconditions.
4285 *
4286 * Note that CPUs described in the documentation may load a few odd values
4287 * into CS and SS than we allow here. This has yet to be checked on real
4288 * hardware.
4289 */
4290 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4291 {
4292 Log(("syscall: Not enabled in EFER -> #UD\n"));
4293 return iemRaiseUndefinedOpcode(pVCpu);
4294 }
4295 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4296 {
4297 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4298 return iemRaiseGeneralProtectionFault0(pVCpu);
4299 }
4300 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4301 {
4302 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4303 return iemRaiseUndefinedOpcode(pVCpu);
4304 }
4305
4306 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4307
4308 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4309 /** @todo what about LDT selectors? Shouldn't matter, really. */
4310 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4311 uint16_t uNewSs = uNewCs + 8;
4312 if (uNewCs == 0 || uNewSs == 0)
4313 {
4314 /** @todo Neither Intel nor AMD document this check. */
4315 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4316 return iemRaiseGeneralProtectionFault0(pVCpu);
4317 }
4318
4319 /* Long mode and legacy mode differs. */
4320 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4321 {
4322 uint64_t uNewRip = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4323
4324 /* This test isn't in the docs, but I'm not trusting the guys writing
4325 the MSRs to have validated the values as canonical like they should. */
4326 if (!IEM_IS_CANONICAL(uNewRip))
4327 {
4328 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4329 Log(("syscall: New RIP not canonical -> #UD\n"));
4330 return iemRaiseUndefinedOpcode(pVCpu);
4331 }
4332
4333 /*
4334 * Commit it.
4335 */
4336 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4337 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4338 pVCpu->cpum.GstCtx.rip = uNewRip;
4339
4340 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4341 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4342 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4343 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4344
4345 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4346 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4347
4348 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4349 | IEM_F_MODE_X86_64BIT;
4350 }
4351 else
4352 {
4353 /*
4354 * Commit it.
4355 */
4356 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4357 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4358 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4359 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4360
4361 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4362 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4363
4364 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4365 | IEM_F_MODE_X86_32BIT_PROT
4366 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4367 }
4368 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4369 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4370 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4371 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4372 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4373
4374 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4375 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4376 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4377 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4378 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4379
4380 /* Flush the prefetch buffer. */
4381 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4382
4383/** @todo single step */
4384 return VINF_SUCCESS;
4385}
4386
4387
4388/**
4389 * Implements SYSRET (AMD and Intel64).
4390 *
4391 * @param enmEffOpSize The effective operand size.
4392 */
4393IEM_CIMPL_DEF_1(iemCImpl_sysret, IEMMODE, enmEffOpSize)
4394
4395{
4396 RT_NOREF_PV(cbInstr);
4397
4398 /*
4399 * Check preconditions.
4400 *
4401 * Note that CPUs described in the documentation may load a few odd values
4402 * into CS and SS than we allow here. This has yet to be checked on real
4403 * hardware.
4404 */
4405 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4406 {
4407 Log(("sysret: Not enabled in EFER -> #UD\n"));
4408 return iemRaiseUndefinedOpcode(pVCpu);
4409 }
4410 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4411 {
4412 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4413 return iemRaiseUndefinedOpcode(pVCpu);
4414 }
4415 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4416 {
4417 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4418 return iemRaiseGeneralProtectionFault0(pVCpu);
4419 }
4420 if (IEM_GET_CPL(pVCpu) != 0)
4421 {
4422 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4423 return iemRaiseGeneralProtectionFault0(pVCpu);
4424 }
4425
4426 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4427
4428 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4429 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4430 uint16_t uNewSs = uNewCs + 8;
4431 if (enmEffOpSize == IEMMODE_64BIT)
4432 uNewCs += 16;
4433 if (uNewCs == 0 || uNewSs == 0)
4434 {
4435 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4436 return iemRaiseGeneralProtectionFault0(pVCpu);
4437 }
4438
4439 /*
4440 * Commit it.
4441 */
4442 bool f32Bit = true;
4443 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4444 {
4445 if (enmEffOpSize == IEMMODE_64BIT)
4446 {
4447 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4448 /* Note! We disregard intel manual regarding the RCX canonical
4449 check, ask intel+xen why AMD doesn't do it. */
4450 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4451 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4452 | (3 << X86DESCATTR_DPL_SHIFT);
4453 f32Bit = false;
4454 }
4455 else
4456 {
4457 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4458 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4459 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4460 | (3 << X86DESCATTR_DPL_SHIFT);
4461 }
4462 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4463 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4464 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4465 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4466 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4467 }
4468 else
4469 {
4470 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4471 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4472 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4473 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4474 | (3 << X86DESCATTR_DPL_SHIFT);
4475 }
4476 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4477 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4478 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4479 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4480 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4481
4482 /* The SS hidden bits remains unchanged says AMD, we presume they set DPL to 3.
4483 Intel (and presuably VIA) OTOH sets loads valid ring-3 values it seems, see
4484 X86_BUG_SYSRET_SS_ATTRS in linux 5.3. */
4485 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4486 {
4487 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u | (3 << X86DESCATTR_DPL_SHIFT) ));
4488 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4489 }
4490 else
4491 {
4492 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT) ));
4493 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC
4494 | (3 << X86DESCATTR_DPL_SHIFT);
4495 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4496 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4497 }
4498 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4499 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4500 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4501 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4502 * on sysret on AMD and not on intel. */
4503
4504 if (!f32Bit)
4505 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4506 | (3 << IEM_F_X86_CPL_SHIFT)
4507 | IEM_F_MODE_X86_64BIT;
4508 else
4509 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4510 | (3 << IEM_F_X86_CPL_SHIFT)
4511 | IEM_F_MODE_X86_32BIT_PROT
4512 /** @todo sort out the SS.BASE/LIM/ATTR claim by AMD and maybe we can switch to
4513 * iemCalc32BitFlatIndicatorDsEs and move this up into the above branch. */
4514 | iemCalc32BitFlatIndicator(pVCpu);
4515
4516 /* Flush the prefetch buffer. */
4517 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4518
4519/** @todo single step */
4520 return VINF_SUCCESS;
4521}
4522
4523
4524/**
4525 * Implements SYSENTER (Intel, 32-bit AMD).
4526 */
4527IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4528{
4529 RT_NOREF(cbInstr);
4530
4531 /*
4532 * Check preconditions.
4533 *
4534 * Note that CPUs described in the documentation may load a few odd values
4535 * into CS and SS than we allow here. This has yet to be checked on real
4536 * hardware.
4537 */
4538 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4539 {
4540 Log(("sysenter: not supported -=> #UD\n"));
4541 return iemRaiseUndefinedOpcode(pVCpu);
4542 }
4543 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4544 {
4545 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4546 return iemRaiseGeneralProtectionFault0(pVCpu);
4547 }
4548 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4549 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4550 {
4551 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4552 return iemRaiseUndefinedOpcode(pVCpu);
4553 }
4554 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4555 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4556 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4557 {
4558 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4559 return iemRaiseGeneralProtectionFault0(pVCpu);
4560 }
4561
4562 /* This test isn't in the docs, it's just a safeguard against missing
4563 canonical checks when writing the registers. */
4564 if (RT_LIKELY( !fIsLongMode
4565 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4566 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4567 { /* likely */ }
4568 else
4569 {
4570 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4571 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4572 return iemRaiseUndefinedOpcode(pVCpu);
4573 }
4574
4575/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4576
4577 /*
4578 * Update registers and commit.
4579 */
4580 if (fIsLongMode)
4581 {
4582 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4583 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4584 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4585 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4586 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4587 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4588 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4589 | IEM_F_MODE_X86_64BIT;
4590 }
4591 else
4592 {
4593 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, (uint32_t)pVCpu->cpum.GstCtx.rip,
4594 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4595 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4596 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4597 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4598 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4599 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4600 | IEM_F_MODE_X86_32BIT_PROT
4601 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4602 }
4603 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4604 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4605 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4606 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4607 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4608
4609 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4610 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4611 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4612 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4613 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4614 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4615 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4616
4617 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4618 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4619 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4620
4621 /* Flush the prefetch buffer. */
4622 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4623
4624/** @todo single stepping */
4625 return VINF_SUCCESS;
4626}
4627
4628
4629/**
4630 * Implements SYSEXIT (Intel, 32-bit AMD).
4631 *
4632 * @param enmEffOpSize The effective operand size.
4633 */
4634IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4635{
4636 RT_NOREF(cbInstr);
4637
4638 /*
4639 * Check preconditions.
4640 *
4641 * Note that CPUs described in the documentation may load a few odd values
4642 * into CS and SS than we allow here. This has yet to be checked on real
4643 * hardware.
4644 */
4645 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4646 {
4647 Log(("sysexit: not supported -=> #UD\n"));
4648 return iemRaiseUndefinedOpcode(pVCpu);
4649 }
4650 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4651 {
4652 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4653 return iemRaiseGeneralProtectionFault0(pVCpu);
4654 }
4655 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4656 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4657 {
4658 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4659 return iemRaiseUndefinedOpcode(pVCpu);
4660 }
4661 if (IEM_GET_CPL(pVCpu) != 0)
4662 {
4663 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4664 return iemRaiseGeneralProtectionFault0(pVCpu);
4665 }
4666 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4667 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4668 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4669 {
4670 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4671 return iemRaiseGeneralProtectionFault0(pVCpu);
4672 }
4673
4674 /*
4675 * Update registers and commit.
4676 */
4677 if (enmEffOpSize == IEMMODE_64BIT)
4678 {
4679 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4680 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4681 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4682 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4683 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4684 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4685 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4686 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4687 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4688 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4689
4690 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4691 | (3 << IEM_F_X86_CPL_SHIFT)
4692 | IEM_F_MODE_X86_64BIT;
4693 }
4694 else
4695 {
4696 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4697 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4698 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4699 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4700 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4701 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4702 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4703 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4704 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4705 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4706
4707 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4708 | (3 << IEM_F_X86_CPL_SHIFT)
4709 | IEM_F_MODE_X86_32BIT_PROT
4710 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4711 }
4712 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4713 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4714 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4715
4716 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4717 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4718 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4719 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4720 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4721 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4722
4723/** @todo single stepping */
4724
4725 /* Flush the prefetch buffer. */
4726 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4727
4728 return VINF_SUCCESS;
4729}
4730
4731
4732/**
4733 * Completes a MOV SReg,XXX or POP SReg instruction.
4734 *
4735 * When not modifying SS or when we're already in an interrupt shadow we
4736 * can update RIP and finish the instruction the normal way.
4737 *
4738 * Otherwise, the MOV/POP SS interrupt shadow that we now enable will block
4739 * both TF and DBx events. The TF will be ignored while the DBx ones will
4740 * be delayed till the next instruction boundrary. For more details see
4741 * @sdmv3{077,200,6.8.3,Masking Exceptions and Interrupts When Switching Stacks}.
4742 */
4743DECLINLINE(VBOXSTRICTRC) iemCImpl_LoadSRegFinish(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iSegReg)
4744{
4745 if (iSegReg != X86_SREG_SS || CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
4746 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4747
4748 iemRegAddToRip(pVCpu, cbInstr);
4749 pVCpu->cpum.GstCtx.eflags.uBoth &= ~X86_EFL_RF; /* Shadow int isn't set and DRx is delayed, so only clear RF. */
4750 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4751
4752 return VINF_SUCCESS;
4753}
4754
4755
4756/**
4757 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4758 *
4759 * @param pVCpu The cross context virtual CPU structure of the calling
4760 * thread.
4761 * @param iSegReg The segment register number (valid).
4762 * @param uSel The new selector value.
4763 */
4764static VBOXSTRICTRC iemCImpl_LoadSRegWorker(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4765{
4766 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4767 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4768 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4769
4770 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4771
4772 /*
4773 * Real mode and V8086 mode are easy.
4774 */
4775 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4776 {
4777 *pSel = uSel;
4778 pHid->u64Base = (uint32_t)uSel << 4;
4779 pHid->ValidSel = uSel;
4780 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4781#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4782 /** @todo Does the CPU actually load limits and attributes in the
4783 * real/V8086 mode segment load case? It doesn't for CS in far
4784 * jumps... Affects unreal mode. */
4785 pHid->u32Limit = 0xffff;
4786 pHid->Attr.u = 0;
4787 pHid->Attr.n.u1Present = 1;
4788 pHid->Attr.n.u1DescType = 1;
4789 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4790 ? X86_SEL_TYPE_RW
4791 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4792#endif
4793
4794 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
4795 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
4796 { /* likely */ }
4797 else if (uSel != 0)
4798 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4799 else
4800 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4801 | iemCalc32BitFlatIndicator(pVCpu);
4802 }
4803 /*
4804 * Protected / long mode - null segment.
4805 *
4806 * Check if it's a null segment selector value first, that's OK for DS, ES,
4807 * FS and GS. If not null, then we have to load and parse the descriptor.
4808 */
4809 else if (!(uSel & X86_SEL_MASK_OFF_RPL))
4810 {
4811 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4812 if (iSegReg == X86_SREG_SS)
4813 {
4814 /* In 64-bit kernel mode, the stack can be 0 because of the way
4815 interrupts are dispatched. AMD seems to have a slighly more
4816 relaxed relationship to SS.RPL than intel does. */
4817 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4818 if ( !IEM_IS_64BIT_CODE(pVCpu)
4819 || IEM_GET_CPL(pVCpu) > 2
4820 || ( uSel != IEM_GET_CPL(pVCpu)
4821 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4822 {
4823 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4824 return iemRaiseGeneralProtectionFault0(pVCpu);
4825 }
4826 }
4827
4828 *pSel = uSel; /* Not RPL, remember :-) */
4829 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4830 if (iSegReg == X86_SREG_SS)
4831 pHid->Attr.u |= IEM_GET_CPL(pVCpu) << X86DESCATTR_DPL_SHIFT;
4832
4833 /* This will affect the FLAT 32-bit mode flag: */
4834 if ( iSegReg < X86_SREG_FS
4835 && IEM_IS_32BIT_CODE(pVCpu))
4836 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4837 }
4838 /*
4839 * Protected / long mode.
4840 */
4841 else
4842 {
4843 /* Fetch the descriptor. */
4844 IEMSELDESC Desc;
4845 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4846 if (rcStrict != VINF_SUCCESS)
4847 return rcStrict;
4848
4849 /* Check GPs first. */
4850 if (!Desc.Legacy.Gen.u1DescType)
4851 {
4852 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4853 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4854 }
4855 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4856 {
4857 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4858 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4859 {
4860 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4861 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4862 }
4863 if ((uSel & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
4864 {
4865 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, IEM_GET_CPL(pVCpu)));
4866 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4867 }
4868 if (Desc.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
4869 {
4870 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
4871 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4872 }
4873 }
4874 else
4875 {
4876 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4877 {
4878 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4879 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4880 }
4881 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4882 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4883 {
4884#if 0 /* this is what intel says. */
4885 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4886 && IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4887 {
4888 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4889 iSegReg, uSel, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4890 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4891 }
4892#else /* this is what makes more sense. */
4893 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4894 {
4895 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4896 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4897 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4898 }
4899 if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4900 {
4901 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4902 iSegReg, uSel, IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4903 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4904 }
4905#endif
4906 }
4907 }
4908
4909 /* Is it there? */
4910 if (!Desc.Legacy.Gen.u1Present)
4911 {
4912 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4913 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4914 }
4915
4916 /* The base and limit. */
4917 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4918 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4919
4920 /*
4921 * Ok, everything checked out fine. Now set the accessed bit before
4922 * committing the result into the registers.
4923 */
4924 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4925 {
4926 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4927 if (rcStrict != VINF_SUCCESS)
4928 return rcStrict;
4929 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4930 }
4931
4932 /* commit */
4933 *pSel = uSel;
4934 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4935 pHid->u32Limit = cbLimit;
4936 pHid->u64Base = u64Base;
4937 pHid->ValidSel = uSel;
4938 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4939
4940 /** @todo check if the hidden bits are loaded correctly for 64-bit
4941 * mode. */
4942
4943 /* This will affect the FLAT 32-bit mode flag: */
4944 if ( iSegReg < X86_SREG_FS
4945 && IEM_IS_32BIT_CODE(pVCpu))
4946 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4947 | iemCalc32BitFlatIndicator(pVCpu);
4948 }
4949
4950 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4951 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4952 return VINF_SUCCESS;
4953}
4954
4955
4956/**
4957 * Implements 'mov SReg, r/m'.
4958 *
4959 * @param iSegReg The segment register number (valid).
4960 * @param uSel The new selector value.
4961 */
4962IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4963{
4964 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4965 if (rcStrict == VINF_SUCCESS)
4966 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4967 return rcStrict;
4968}
4969
4970
4971/**
4972 * Implements 'pop SReg'.
4973 *
4974 * @param iSegReg The segment register number (valid).
4975 * @param enmEffOpSize The efficient operand size (valid).
4976 */
4977IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4978{
4979 VBOXSTRICTRC rcStrict;
4980
4981 /*
4982 * Read the selector off the stack and join paths with mov ss, reg.
4983 */
4984 RTUINT64U TmpRsp;
4985 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4986 switch (enmEffOpSize)
4987 {
4988 case IEMMODE_16BIT:
4989 {
4990 uint16_t uSel;
4991 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4992 if (rcStrict == VINF_SUCCESS)
4993 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4994 break;
4995 }
4996
4997 case IEMMODE_32BIT:
4998 {
4999 /* Modern Intel CPU only does a WORD sized access here, both as
5000 segmentation and paging is concerned. So, we have to emulate
5001 this to make bs3-cpu-weird-1 happy. */
5002 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
5003 {
5004 /* We don't have flexible enough stack primitives here, so just
5005 do a word pop and add two bytes to SP/RSP on success. */
5006 uint16_t uSel;
5007 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
5008 if (rcStrict == VINF_SUCCESS)
5009 {
5010 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint32_t) - sizeof(uint16_t));
5011 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5012 }
5013 }
5014 else
5015 {
5016 uint32_t u32Value;
5017 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
5018 if (rcStrict == VINF_SUCCESS)
5019 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u32Value);
5020 }
5021 break;
5022 }
5023
5024 case IEMMODE_64BIT:
5025 {
5026 /* Like for the 32-bit case above, intel only does a WORD access. */
5027 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
5028 {
5029 uint16_t uSel;
5030 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
5031 if (rcStrict == VINF_SUCCESS)
5032 {
5033 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint64_t) - sizeof(uint16_t));
5034 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5035 }
5036 }
5037 else
5038 {
5039 uint64_t u64Value;
5040 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
5041 if (rcStrict == VINF_SUCCESS)
5042 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u64Value);
5043 }
5044 break;
5045 }
5046 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5047 }
5048
5049 /*
5050 * If the load succeeded, commit the stack change and finish the instruction.
5051 */
5052 if (rcStrict == VINF_SUCCESS)
5053 {
5054 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
5055 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
5056 }
5057
5058 return rcStrict;
5059}
5060
5061
5062/**
5063 * Implements lgs, lfs, les, lds & lss.
5064 */
5065IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
5066{
5067 /*
5068 * Use iemCImpl_LoadSRegWorker to do the tricky segment register loading.
5069 */
5070 /** @todo verify and test that mov, pop and lXs works the segment
5071 * register loading in the exact same way. */
5072 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5073 if (rcStrict == VINF_SUCCESS)
5074 {
5075 switch (enmEffOpSize)
5076 {
5077 case IEMMODE_16BIT:
5078 iemGRegStoreU16(pVCpu, iGReg, offSeg);
5079 break;
5080 case IEMMODE_32BIT:
5081 case IEMMODE_64BIT:
5082 iemGRegStoreU64(pVCpu, iGReg, offSeg);
5083 break;
5084 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5085 }
5086 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5087 }
5088 return rcStrict;
5089}
5090
5091
5092/**
5093 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
5094 *
5095 * @retval VINF_SUCCESS on success.
5096 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
5097 * @retval iemMemFetchSysU64 return value.
5098 *
5099 * @param pVCpu The cross context virtual CPU structure of the calling thread.
5100 * @param uSel The selector value.
5101 * @param fAllowSysDesc Whether system descriptors are OK or not.
5102 * @param pDesc Where to return the descriptor on success.
5103 */
5104static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
5105{
5106 pDesc->Long.au64[0] = 0;
5107 pDesc->Long.au64[1] = 0;
5108
5109 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
5110 return VINF_IEM_SELECTOR_NOT_OK;
5111
5112 /* Within the table limits? */
5113 RTGCPTR GCPtrBase;
5114 if (uSel & X86_SEL_LDT)
5115 {
5116 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5117 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
5118 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
5119 return VINF_IEM_SELECTOR_NOT_OK;
5120 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
5121 }
5122 else
5123 {
5124 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5125 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
5126 return VINF_IEM_SELECTOR_NOT_OK;
5127 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
5128 }
5129
5130 /* Fetch the descriptor. */
5131 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
5132 if (rcStrict != VINF_SUCCESS)
5133 return rcStrict;
5134 if (!pDesc->Legacy.Gen.u1DescType)
5135 {
5136 if (!fAllowSysDesc)
5137 return VINF_IEM_SELECTOR_NOT_OK;
5138 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5139 {
5140 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
5141 if (rcStrict != VINF_SUCCESS)
5142 return rcStrict;
5143 }
5144
5145 }
5146
5147 return VINF_SUCCESS;
5148}
5149
5150
5151/**
5152 * Implements verr (fWrite = false) and verw (fWrite = true).
5153 */
5154IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
5155{
5156 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5157
5158 /** @todo figure whether the accessed bit is set or not. */
5159
5160 bool fAccessible = true;
5161 IEMSELDESC Desc;
5162 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
5163 if (rcStrict == VINF_SUCCESS)
5164 {
5165 /* Check the descriptor, order doesn't matter much here. */
5166 if ( !Desc.Legacy.Gen.u1DescType
5167 || !Desc.Legacy.Gen.u1Present)
5168 fAccessible = false;
5169 else
5170 {
5171 if ( fWrite
5172 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
5173 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
5174 fAccessible = false;
5175
5176 /** @todo testcase for the conforming behavior. */
5177 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5178 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5179 {
5180 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5181 fAccessible = false;
5182 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5183 fAccessible = false;
5184 }
5185 }
5186
5187 }
5188 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5189 fAccessible = false;
5190 else
5191 return rcStrict;
5192
5193 /* commit */
5194 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
5195
5196 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5197}
5198
5199
5200/**
5201 * Implements LAR and LSL with 64-bit operand size.
5202 *
5203 * @returns VINF_SUCCESS.
5204 * @param pu64Dst Pointer to the destination register.
5205 * @param uSel The selector to load details for.
5206 * @param fIsLar true = LAR, false = LSL.
5207 */
5208IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
5209{
5210 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5211
5212 /** @todo figure whether the accessed bit is set or not. */
5213
5214 bool fDescOk = true;
5215 IEMSELDESC Desc;
5216 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
5217 if (rcStrict == VINF_SUCCESS)
5218 {
5219 /*
5220 * Check the descriptor type.
5221 */
5222 if (!Desc.Legacy.Gen.u1DescType)
5223 {
5224 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5225 {
5226 if (Desc.Long.Gen.u5Zeros)
5227 fDescOk = false;
5228 else
5229 switch (Desc.Long.Gen.u4Type)
5230 {
5231 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
5232 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
5233 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
5234 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
5235 break;
5236 case AMD64_SEL_TYPE_SYS_CALL_GATE:
5237 fDescOk = fIsLar;
5238 break;
5239 default:
5240 fDescOk = false;
5241 break;
5242 }
5243 }
5244 else
5245 {
5246 switch (Desc.Long.Gen.u4Type)
5247 {
5248 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
5249 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
5250 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
5251 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
5252 case X86_SEL_TYPE_SYS_LDT:
5253 break;
5254 case X86_SEL_TYPE_SYS_286_CALL_GATE:
5255 case X86_SEL_TYPE_SYS_TASK_GATE:
5256 case X86_SEL_TYPE_SYS_386_CALL_GATE:
5257 fDescOk = fIsLar;
5258 break;
5259 default:
5260 fDescOk = false;
5261 break;
5262 }
5263 }
5264 }
5265 if (fDescOk)
5266 {
5267 /*
5268 * Check the RPL/DPL/CPL interaction..
5269 */
5270 /** @todo testcase for the conforming behavior. */
5271 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
5272 || !Desc.Legacy.Gen.u1DescType)
5273 {
5274 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5275 fDescOk = false;
5276 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5277 fDescOk = false;
5278 }
5279 }
5280
5281 if (fDescOk)
5282 {
5283 /*
5284 * All fine, start committing the result.
5285 */
5286 if (fIsLar)
5287 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5288 else
5289 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5290 }
5291
5292 }
5293 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5294 fDescOk = false;
5295 else
5296 return rcStrict;
5297
5298 /* commit flags value and advance rip. */
5299 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5300 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5301}
5302
5303
5304/**
5305 * Implements LAR and LSL with 16-bit operand size.
5306 *
5307 * @returns VINF_SUCCESS.
5308 * @param pu16Dst Pointer to the destination register.
5309 * @param uSel The selector to load details for.
5310 * @param fIsLar true = LAR, false = LSL.
5311 */
5312IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5313{
5314 uint64_t u64TmpDst = *pu16Dst;
5315 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5316 *pu16Dst = u64TmpDst;
5317 return VINF_SUCCESS;
5318}
5319
5320
5321/**
5322 * Implements lgdt.
5323 *
5324 * @param iEffSeg The segment of the new gdtr contents
5325 * @param GCPtrEffSrc The address of the new gdtr contents.
5326 * @param enmEffOpSize The effective operand size.
5327 */
5328IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5329{
5330 if (IEM_GET_CPL(pVCpu) != 0)
5331 return iemRaiseGeneralProtectionFault0(pVCpu);
5332 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5333
5334 if (!IEM_IS_IN_GUEST(pVCpu))
5335 { /* probable */ }
5336 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5337 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5338 {
5339 Log(("lgdt: Guest intercept -> VM-exit\n"));
5340 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5341 }
5342 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5343 {
5344 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5345 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5346 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5347 }
5348
5349 /*
5350 * Fetch the limit and base address.
5351 */
5352 uint16_t cbLimit;
5353 RTGCPTR GCPtrBase;
5354 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5355 if (rcStrict == VINF_SUCCESS)
5356 {
5357 if ( !IEM_IS_64BIT_CODE(pVCpu)
5358 || X86_IS_CANONICAL(GCPtrBase))
5359 {
5360 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5361 if (rcStrict == VINF_SUCCESS)
5362 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5363 }
5364 else
5365 {
5366 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5367 return iemRaiseGeneralProtectionFault0(pVCpu);
5368 }
5369 }
5370 return rcStrict;
5371}
5372
5373
5374/**
5375 * Implements sgdt.
5376 *
5377 * @param iEffSeg The segment where to store the gdtr content.
5378 * @param GCPtrEffDst The address where to store the gdtr content.
5379 */
5380IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5381{
5382 /*
5383 * Join paths with sidt.
5384 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5385 * you really must know.
5386 */
5387 if (!IEM_IS_IN_GUEST(pVCpu))
5388 { /* probable */ }
5389 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5390 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5391 {
5392 Log(("sgdt: Guest intercept -> VM-exit\n"));
5393 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5394 }
5395 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5396 {
5397 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5398 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5399 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5400 }
5401
5402 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5403 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5404 if (rcStrict == VINF_SUCCESS)
5405 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5406 return rcStrict;
5407}
5408
5409
5410/**
5411 * Implements lidt.
5412 *
5413 * @param iEffSeg The segment of the new idtr contents
5414 * @param GCPtrEffSrc The address of the new idtr contents.
5415 * @param enmEffOpSize The effective operand size.
5416 */
5417IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5418{
5419 if (IEM_GET_CPL(pVCpu) != 0)
5420 return iemRaiseGeneralProtectionFault0(pVCpu);
5421 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5422
5423 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5424 { /* probable */ }
5425 else
5426 {
5427 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5428 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5429 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5430 }
5431
5432 /*
5433 * Fetch the limit and base address.
5434 */
5435 uint16_t cbLimit;
5436 RTGCPTR GCPtrBase;
5437 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5438 if (rcStrict == VINF_SUCCESS)
5439 {
5440 if ( !IEM_IS_64BIT_CODE(pVCpu)
5441 || X86_IS_CANONICAL(GCPtrBase))
5442 {
5443 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5444 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5445 }
5446 else
5447 {
5448 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5449 return iemRaiseGeneralProtectionFault0(pVCpu);
5450 }
5451 }
5452 return rcStrict;
5453}
5454
5455
5456/**
5457 * Implements sidt.
5458 *
5459 * @param iEffSeg The segment where to store the idtr content.
5460 * @param GCPtrEffDst The address where to store the idtr content.
5461 */
5462IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5463{
5464 /*
5465 * Join paths with sgdt.
5466 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5467 * you really must know.
5468 */
5469 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5470 { /* probable */ }
5471 else
5472 {
5473 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5474 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5475 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5476 }
5477
5478 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5479 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5480 if (rcStrict == VINF_SUCCESS)
5481 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5482 return rcStrict;
5483}
5484
5485
5486/**
5487 * Implements lldt.
5488 *
5489 * @param uNewLdt The new LDT selector value.
5490 */
5491IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5492{
5493 /*
5494 * Check preconditions.
5495 */
5496 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5497 {
5498 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5499 return iemRaiseUndefinedOpcode(pVCpu);
5500 }
5501 if (IEM_GET_CPL(pVCpu) != 0)
5502 {
5503 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, IEM_GET_CPL(pVCpu)));
5504 return iemRaiseGeneralProtectionFault0(pVCpu);
5505 }
5506
5507 /* Nested-guest VMX intercept (SVM is after all checks). */
5508 /** @todo testcase: exit vs check order. */
5509 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5510 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5511 { /* probable */ }
5512 else
5513 {
5514 Log(("lldt: Guest intercept -> VM-exit\n"));
5515 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5516 }
5517
5518 if (uNewLdt & X86_SEL_LDT)
5519 {
5520 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5521 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5522 }
5523
5524 /*
5525 * Now, loading a NULL selector is easy.
5526 */
5527 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5528 {
5529 /* Nested-guest SVM intercept. */
5530 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5531 { /* probable */ }
5532 else
5533 {
5534 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5535 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5536 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5537 }
5538
5539 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5540 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5541 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5542 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5543 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5544 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5545 {
5546 /* AMD-V seems to leave the base and limit alone. */
5547 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5548 }
5549 else
5550 {
5551 /* VT-x (Intel 3960x) seems to be doing the following. */
5552 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5553 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5554 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5555 }
5556
5557 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5558 }
5559
5560 /*
5561 * Read the descriptor.
5562 */
5563 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5564 IEMSELDESC Desc;
5565 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5566 if (rcStrict != VINF_SUCCESS)
5567 return rcStrict;
5568
5569 /* Check GPs first. */
5570 if (Desc.Legacy.Gen.u1DescType)
5571 {
5572 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5573 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5574 }
5575 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5576 {
5577 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5578 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5579 }
5580 uint64_t u64Base;
5581 if (!IEM_IS_LONG_MODE(pVCpu))
5582 u64Base = X86DESC_BASE(&Desc.Legacy);
5583 else
5584 {
5585 if (Desc.Long.Gen.u5Zeros)
5586 {
5587 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5588 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5589 }
5590
5591 u64Base = X86DESC64_BASE(&Desc.Long);
5592 if (!IEM_IS_CANONICAL(u64Base))
5593 {
5594 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5595 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5596 }
5597 }
5598
5599 /* NP */
5600 if (!Desc.Legacy.Gen.u1Present)
5601 {
5602 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5603 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5604 }
5605
5606 /* Nested-guest SVM intercept. */
5607 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5608 { /* probable */ }
5609 else
5610 {
5611 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5612 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5613 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5614 }
5615
5616 /*
5617 * It checks out alright, update the registers.
5618 */
5619/** @todo check if the actual value is loaded or if the RPL is dropped */
5620 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5621 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5622 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5623 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5624 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5625 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5626
5627 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5628}
5629
5630
5631/**
5632 * Implements sldt GReg
5633 *
5634 * @param iGReg The general register to store the CRx value in.
5635 * @param enmEffOpSize The operand size.
5636 */
5637IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5638{
5639 if (!IEM_IS_IN_GUEST(pVCpu))
5640 { /* probable */ }
5641 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5642 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5643 {
5644 Log(("sldt: Guest intercept -> VM-exit\n"));
5645 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5646 }
5647 else
5648 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5649
5650 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5651 switch (enmEffOpSize)
5652 {
5653 case IEMMODE_16BIT:
5654 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5655 break;
5656 case IEMMODE_32BIT:
5657 case IEMMODE_64BIT:
5658 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5659 break;
5660 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5661 }
5662 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5663}
5664
5665
5666/**
5667 * Implements sldt mem.
5668 *
5669 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5670 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5671 */
5672IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5673{
5674 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5675
5676 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5677 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5678 if (rcStrict == VINF_SUCCESS)
5679 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5680 return rcStrict;
5681}
5682
5683
5684/**
5685 * Implements ltr.
5686 *
5687 * @param uNewTr The new TSS selector value.
5688 */
5689IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5690{
5691 /*
5692 * Check preconditions.
5693 */
5694 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5695 {
5696 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5697 return iemRaiseUndefinedOpcode(pVCpu);
5698 }
5699 if (IEM_GET_CPL(pVCpu) != 0)
5700 {
5701 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, IEM_GET_CPL(pVCpu)));
5702 return iemRaiseGeneralProtectionFault0(pVCpu);
5703 }
5704 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5705 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5706 { /* probable */ }
5707 else
5708 {
5709 Log(("ltr: Guest intercept -> VM-exit\n"));
5710 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5711 }
5712 if (uNewTr & X86_SEL_LDT)
5713 {
5714 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5715 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5716 }
5717 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5718 {
5719 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5720 return iemRaiseGeneralProtectionFault0(pVCpu);
5721 }
5722 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5723 { /* probable */ }
5724 else
5725 {
5726 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5727 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5728 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5729 }
5730
5731 /*
5732 * Read the descriptor.
5733 */
5734 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5735 IEMSELDESC Desc;
5736 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5737 if (rcStrict != VINF_SUCCESS)
5738 return rcStrict;
5739
5740 /* Check GPs first. */
5741 if (Desc.Legacy.Gen.u1DescType)
5742 {
5743 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5744 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5745 }
5746 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5747 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5748 || IEM_IS_LONG_MODE(pVCpu)) )
5749 {
5750 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5751 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5752 }
5753 uint64_t u64Base;
5754 if (!IEM_IS_LONG_MODE(pVCpu))
5755 u64Base = X86DESC_BASE(&Desc.Legacy);
5756 else
5757 {
5758 if (Desc.Long.Gen.u5Zeros)
5759 {
5760 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5761 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5762 }
5763
5764 u64Base = X86DESC64_BASE(&Desc.Long);
5765 if (!IEM_IS_CANONICAL(u64Base))
5766 {
5767 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5768 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5769 }
5770 }
5771
5772 /* NP */
5773 if (!Desc.Legacy.Gen.u1Present)
5774 {
5775 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5776 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5777 }
5778
5779 /*
5780 * Set it busy.
5781 * Note! Intel says this should lock down the whole descriptor, but we'll
5782 * restrict our selves to 32-bit for now due to lack of inline
5783 * assembly and such.
5784 */
5785 uint8_t bUnmapInfo;
5786 void *pvDesc;
5787 rcStrict = iemMemMap(pVCpu, &pvDesc, &bUnmapInfo, 8, UINT8_MAX,
5788 pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW, 0);
5789 if (rcStrict != VINF_SUCCESS)
5790 return rcStrict;
5791 switch ((uintptr_t)pvDesc & 3)
5792 {
5793 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5794 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5795 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5796 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5797 }
5798 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
5799 if (rcStrict != VINF_SUCCESS)
5800 return rcStrict;
5801 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5802
5803 /*
5804 * It checks out alright, update the registers.
5805 */
5806/** @todo check if the actual value is loaded or if the RPL is dropped */
5807 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5808 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5809 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5810 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5811 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5812 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5813
5814 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5815}
5816
5817
5818/**
5819 * Implements str GReg
5820 *
5821 * @param iGReg The general register to store the CRx value in.
5822 * @param enmEffOpSize The operand size.
5823 */
5824IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5825{
5826 if (!IEM_IS_IN_GUEST(pVCpu))
5827 { /* probable */ }
5828 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5829 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5830 {
5831 Log(("str_reg: Guest intercept -> VM-exit\n"));
5832 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5833 }
5834 else
5835 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5836
5837 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5838 switch (enmEffOpSize)
5839 {
5840 case IEMMODE_16BIT:
5841 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5842 break;
5843 case IEMMODE_32BIT:
5844 case IEMMODE_64BIT:
5845 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5846 break;
5847 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5848 }
5849 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5850}
5851
5852
5853/**
5854 * Implements str mem.
5855 *
5856 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5857 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5858 */
5859IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5860{
5861 if (!IEM_IS_IN_GUEST(pVCpu))
5862 { /* probable */ }
5863 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5864 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5865 {
5866 Log(("str_mem: Guest intercept -> VM-exit\n"));
5867 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5868 }
5869 else
5870 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5871
5872 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5873 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5874 if (rcStrict == VINF_SUCCESS)
5875 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5876 return rcStrict;
5877}
5878
5879
5880/**
5881 * Implements mov GReg,CRx.
5882 *
5883 * @param iGReg The general register to store the CRx value in.
5884 * @param iCrReg The CRx register to read (valid).
5885 */
5886IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5887{
5888 if (IEM_GET_CPL(pVCpu) != 0)
5889 return iemRaiseGeneralProtectionFault0(pVCpu);
5890 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5891
5892 if (!IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5893 { /* probable */ }
5894 else
5895 {
5896 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5897 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5898 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5899 }
5900
5901 /* Read it. */
5902 uint64_t crX;
5903 switch (iCrReg)
5904 {
5905 case 0:
5906 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5907 crX = pVCpu->cpum.GstCtx.cr0;
5908 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5909 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5910 break;
5911 case 2:
5912 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5913 crX = pVCpu->cpum.GstCtx.cr2;
5914 break;
5915 case 3:
5916 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5917 crX = pVCpu->cpum.GstCtx.cr3;
5918 break;
5919 case 4:
5920 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5921 crX = pVCpu->cpum.GstCtx.cr4;
5922 break;
5923 case 8:
5924 {
5925 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5926 if (!IEM_IS_IN_GUEST(pVCpu))
5927 { /* probable */ }
5928#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5929 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5930 {
5931 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5932 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5933 return rcStrict;
5934
5935 /*
5936 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5937 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5938 * are cleared.
5939 *
5940 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5941 */
5942 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5943 {
5944 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5945 crX = (uTpr >> 4) & 0xf;
5946 break;
5947 }
5948 }
5949#endif
5950#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5951 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
5952 {
5953 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5954 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5955 {
5956 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5957 break;
5958 }
5959 }
5960#endif
5961 uint8_t uTpr;
5962 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5963 if (RT_SUCCESS(rc))
5964 crX = uTpr >> 4;
5965 else
5966 crX = 0;
5967 break;
5968 }
5969 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5970 }
5971
5972#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5973 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5974 { /* probable */ }
5975 else
5976 switch (iCrReg)
5977 {
5978 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5979 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5980 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5981 case 3:
5982 {
5983 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5984 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5985 return rcStrict;
5986 break;
5987 }
5988 }
5989#endif
5990
5991 /* Store it. */
5992 if (IEM_IS_64BIT_CODE(pVCpu))
5993 iemGRegStoreU64(pVCpu, iGReg, crX);
5994 else
5995 iemGRegStoreU64(pVCpu, iGReg, (uint32_t)crX);
5996
5997 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5998}
5999
6000
6001/**
6002 * Implements smsw GReg.
6003 *
6004 * @param iGReg The general register to store the CRx value in.
6005 * @param enmEffOpSize The operand size.
6006 */
6007IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
6008{
6009 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
6010
6011#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6012 uint64_t u64MaskedCr0;
6013 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6014 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
6015 else
6016 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
6017 uint64_t const u64GuestCr0 = u64MaskedCr0;
6018#else
6019 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
6020#endif
6021
6022 switch (enmEffOpSize)
6023 {
6024 case IEMMODE_16BIT:
6025 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
6026 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0);
6027 /* Unused bits are set on 386 and older CPU: */
6028 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6029 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xffe0);
6030 else
6031 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xfff0);
6032 break;
6033
6034/** @todo testcase for bits 31:16. We're not doing that correctly. */
6035
6036 case IEMMODE_32BIT:
6037 if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6038 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0);
6039 else /** @todo test this! */
6040 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0 | UINT32_C(0x7fffffe0)); /* Unused bits are set on 386. */
6041 break;
6042
6043 case IEMMODE_64BIT:
6044 iemGRegStoreU64(pVCpu, iGReg, u64GuestCr0);
6045 break;
6046
6047 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6048 }
6049
6050 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6051}
6052
6053
6054/**
6055 * Implements smsw mem.
6056 *
6057 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
6058 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
6059 */
6060IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6061{
6062 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
6063 if (!IEM_IS_IN_GUEST(pVCpu))
6064 { /* probable */ }
6065 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6066 u64GuestCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
6067 else
6068 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
6069
6070 uint16_t u16Value;
6071 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
6072 u16Value = (uint16_t)u64GuestCr0;
6073 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6074 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
6075 else
6076 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
6077
6078 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
6079 if (rcStrict == VINF_SUCCESS)
6080 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6081 return rcStrict;
6082}
6083
6084
6085/**
6086 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
6087 */
6088#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
6089 do \
6090 { \
6091 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
6092 if (RT_SUCCESS(rcX)) \
6093 { /* likely */ } \
6094 else \
6095 { \
6096 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
6097 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
6098 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
6099 } \
6100 } while (0)
6101
6102
6103/**
6104 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
6105 *
6106 * @param iCrReg The CRx register to write (valid).
6107 * @param uNewCrX The new value.
6108 * @param enmAccessCrX The instruction that caused the CrX load.
6109 * @param iGReg The general register in case of a 'mov CRx,GReg'
6110 * instruction.
6111 */
6112IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
6113{
6114 VBOXSTRICTRC rcStrict;
6115 int rc;
6116#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
6117 RT_NOREF2(iGReg, enmAccessCrX);
6118#endif
6119
6120 /*
6121 * Try store it.
6122 * Unfortunately, CPUM only does a tiny bit of the work.
6123 */
6124 switch (iCrReg)
6125 {
6126 case 0:
6127 {
6128 /*
6129 * Perform checks.
6130 */
6131 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6132
6133 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
6134 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
6135
6136 /* ET is hardcoded on 486 and later. */
6137 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
6138 uNewCrX |= X86_CR0_ET;
6139 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
6140 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
6141 {
6142 uNewCrX &= fValid;
6143 uNewCrX |= X86_CR0_ET;
6144 }
6145 else
6146 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
6147
6148 /* Check for reserved bits. */
6149 if (uNewCrX & ~(uint64_t)fValid)
6150 {
6151 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6152 return iemRaiseGeneralProtectionFault0(pVCpu);
6153 }
6154
6155 /* Check for invalid combinations. */
6156 if ( (uNewCrX & X86_CR0_PG)
6157 && !(uNewCrX & X86_CR0_PE) )
6158 {
6159 Log(("Trying to set CR0.PG without CR0.PE\n"));
6160 return iemRaiseGeneralProtectionFault0(pVCpu);
6161 }
6162
6163 if ( !(uNewCrX & X86_CR0_CD)
6164 && (uNewCrX & X86_CR0_NW) )
6165 {
6166 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
6167 return iemRaiseGeneralProtectionFault0(pVCpu);
6168 }
6169
6170 if ( !(uNewCrX & X86_CR0_PG)
6171 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
6172 {
6173 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
6174 return iemRaiseGeneralProtectionFault0(pVCpu);
6175 }
6176
6177 /* Long mode consistency checks. */
6178 if ( (uNewCrX & X86_CR0_PG)
6179 && !(uOldCrX & X86_CR0_PG)
6180 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6181 {
6182 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
6183 {
6184 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
6185 return iemRaiseGeneralProtectionFault0(pVCpu);
6186 }
6187 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
6188 {
6189 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
6190 return iemRaiseGeneralProtectionFault0(pVCpu);
6191 }
6192 }
6193
6194 /** @todo testcase: what happens if we disable paging while in 64-bit code? */
6195
6196 if (!IEM_IS_IN_GUEST(pVCpu))
6197 { /* probable */ }
6198#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6199 /* Check for bits that must remain set or cleared in VMX operation,
6200 see Intel spec. 23.8 "Restrictions on VMX operation". */
6201 else if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6202 {
6203 uint64_t const uCr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
6204 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
6205 {
6206 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
6207 return iemRaiseGeneralProtectionFault0(pVCpu);
6208 }
6209
6210 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6211 if (uNewCrX & ~uCr0Fixed1)
6212 {
6213 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
6214 return iemRaiseGeneralProtectionFault0(pVCpu);
6215 }
6216 }
6217#endif
6218 /*
6219 * SVM nested-guest CR0 write intercepts.
6220 */
6221 else if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
6222 {
6223 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6224 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6225 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
6226 }
6227 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
6228 {
6229 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
6230 if ( enmAccessCrX == IEMACCESSCRX_LMSW
6231 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
6232 {
6233 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
6234 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
6235 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6236 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
6237 }
6238 }
6239
6240 /*
6241 * Change EFER.LMA if entering or leaving long mode.
6242 */
6243 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
6244 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
6245 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6246 {
6247 if (uNewCrX & X86_CR0_PG)
6248 NewEFER |= MSR_K6_EFER_LMA;
6249 else
6250 NewEFER &= ~MSR_K6_EFER_LMA;
6251
6252 CPUMSetGuestEFER(pVCpu, NewEFER);
6253 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
6254 }
6255
6256 /*
6257 * Inform PGM.
6258 */
6259 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
6260 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
6261 {
6262 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
6263 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
6264 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6265 { /* likely */ }
6266 else
6267 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6268 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6269 AssertRCReturn(rc, rc);
6270 /* ignore informational status codes */
6271 }
6272
6273 /*
6274 * Change CR0.
6275 */
6276 CPUMSetGuestCR0(pVCpu, uNewCrX);
6277 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
6278
6279 /* Update the fExec flags if PE changed. */
6280 if ((uNewCrX ^ uOldCrX) & X86_CR0_PE)
6281 iemRecalcExecModeAndCplFlags(pVCpu);
6282
6283 /*
6284 * Inform PGM some more...
6285 */
6286 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6287 false /* fForce */);
6288 break;
6289 }
6290
6291 /*
6292 * CR2 can be changed without any restrictions.
6293 */
6294 case 2:
6295 {
6296 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
6297 { /* probable */ }
6298 else
6299 {
6300 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6301 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6302 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
6303 }
6304 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
6305 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
6306 rcStrict = VINF_SUCCESS;
6307 break;
6308 }
6309
6310 /*
6311 * CR3 is relatively simple, although AMD and Intel have different
6312 * accounts of how setting reserved bits are handled. We take intel's
6313 * word for the lower bits and AMD's for the high bits (63:52). The
6314 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
6315 * on this.
6316 */
6317 /** @todo Testcase: Setting reserved bits in CR3, especially before
6318 * enabling paging. */
6319 case 3:
6320 {
6321 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6322
6323 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6324 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6325 && (uNewCrX & RT_BIT_64(63)))
6326 {
6327 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6328 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6329 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6330 * Paging-Structure Caches". */
6331 uNewCrX &= ~RT_BIT_64(63);
6332 }
6333
6334 /* Check / mask the value. */
6335#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6336 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6337 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6338 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6339 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6340#else
6341 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6342#endif
6343 if (uNewCrX & fInvPhysMask)
6344 {
6345 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6346 * very vague in this area. As mentioned above, need testcase on real
6347 * hardware... Sigh. */
6348 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6349 return iemRaiseGeneralProtectionFault0(pVCpu);
6350 }
6351
6352 uint64_t fValid;
6353 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6354 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6355 {
6356 /** @todo Redundant? This value has already been validated above. */
6357 fValid = UINT64_C(0x000fffffffffffff);
6358 }
6359 else
6360 fValid = UINT64_C(0xffffffff);
6361 if (uNewCrX & ~fValid)
6362 {
6363 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6364 uNewCrX, uNewCrX & ~fValid));
6365 uNewCrX &= fValid;
6366 }
6367
6368 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6369 { /* probable */ }
6370 else
6371 {
6372 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6373 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6374 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6375 }
6376
6377 /* Inform PGM. */
6378 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6379 {
6380 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6381 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6382 { /* likely */ }
6383 else
6384 {
6385 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6386 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6387 }
6388 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6389 AssertRCReturn(rc, rc);
6390 /* ignore informational status codes */
6391 }
6392
6393 /* Make the change. */
6394 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6395 AssertRCSuccessReturn(rc, rc);
6396
6397 rcStrict = VINF_SUCCESS;
6398 break;
6399 }
6400
6401 /*
6402 * CR4 is a bit more tedious as there are bits which cannot be cleared
6403 * under some circumstances and such.
6404 */
6405 case 4:
6406 {
6407 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6408 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6409
6410 /* Reserved bits. */
6411 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6412 if (uNewCrX & ~(uint64_t)fValid)
6413 {
6414 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6415 return iemRaiseGeneralProtectionFault0(pVCpu);
6416 }
6417
6418 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6419 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6420
6421 /* PCIDE check. */
6422 if ( fPcide
6423 && ( !fLongMode
6424 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6425 {
6426 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6427 return iemRaiseGeneralProtectionFault0(pVCpu);
6428 }
6429
6430 /* PAE check. */
6431 if ( fLongMode
6432 && (uOldCrX & X86_CR4_PAE)
6433 && !(uNewCrX & X86_CR4_PAE))
6434 {
6435 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6436 return iemRaiseGeneralProtectionFault0(pVCpu);
6437 }
6438
6439 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6440 { /* probable */ }
6441 else
6442 {
6443 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6444 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6445 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6446 }
6447
6448 /* Check for bits that must remain set or cleared in VMX operation,
6449 see Intel spec. 23.8 "Restrictions on VMX operation". */
6450 if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
6451 { /* probable */ }
6452 else
6453 {
6454 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6455 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6456 {
6457 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6458 return iemRaiseGeneralProtectionFault0(pVCpu);
6459 }
6460
6461 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6462 if (uNewCrX & ~uCr4Fixed1)
6463 {
6464 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6465 return iemRaiseGeneralProtectionFault0(pVCpu);
6466 }
6467 }
6468
6469 /*
6470 * Notify PGM.
6471 */
6472 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6473 {
6474 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6475 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6476 { /* likely */ }
6477 else
6478 {
6479 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6480 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6481 }
6482 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6483 AssertRCReturn(rc, rc);
6484 /* ignore informational status codes */
6485 }
6486
6487 /*
6488 * Change it.
6489 */
6490 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6491 AssertRCSuccessReturn(rc, rc);
6492 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6493
6494 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6495 false /* fForce */);
6496 break;
6497 }
6498
6499 /*
6500 * CR8 maps to the APIC TPR.
6501 */
6502 case 8:
6503 {
6504 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6505 if (uNewCrX & ~(uint64_t)0xf)
6506 {
6507 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6508 return iemRaiseGeneralProtectionFault0(pVCpu);
6509 }
6510
6511 if (!IEM_IS_IN_GUEST(pVCpu))
6512 { /* probable */ }
6513#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6514 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6515 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6516 {
6517 /*
6518 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6519 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6520 * cleared. Following this the processor performs TPR virtualization.
6521 *
6522 * However, we should not perform TPR virtualization immediately here but
6523 * after this instruction has completed.
6524 *
6525 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6526 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6527 */
6528 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6529 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6530 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6531 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6532 rcStrict = VINF_SUCCESS;
6533 break;
6534 }
6535#endif
6536#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6537 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
6538 {
6539 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6540 {
6541 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6542 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6543 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6544 }
6545
6546 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6547 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6548 {
6549 rcStrict = VINF_SUCCESS;
6550 break;
6551 }
6552 }
6553#endif
6554 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6555 APICSetTpr(pVCpu, u8Tpr);
6556 rcStrict = VINF_SUCCESS;
6557 break;
6558 }
6559
6560 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6561 }
6562
6563 /*
6564 * Advance the RIP on success.
6565 */
6566 if (RT_SUCCESS(rcStrict))
6567 {
6568 if (rcStrict != VINF_SUCCESS)
6569 iemSetPassUpStatus(pVCpu, rcStrict);
6570 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6571 }
6572
6573 return rcStrict;
6574}
6575
6576
6577/**
6578 * Implements mov CRx,GReg.
6579 *
6580 * @param iCrReg The CRx register to write (valid).
6581 * @param iGReg The general register to load the CRx value from.
6582 */
6583IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6584{
6585 if (IEM_GET_CPL(pVCpu) != 0)
6586 return iemRaiseGeneralProtectionFault0(pVCpu);
6587 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6588
6589 /*
6590 * Read the new value from the source register and call common worker.
6591 */
6592 uint64_t uNewCrX;
6593 if (IEM_IS_64BIT_CODE(pVCpu))
6594 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6595 else
6596 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6597
6598#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6599 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6600 { /* probable */ }
6601 else
6602 {
6603 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6604 switch (iCrReg)
6605 {
6606 case 0:
6607 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6608 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6609 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6610 }
6611 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6612 return rcStrict;
6613 }
6614#endif
6615
6616 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6617}
6618
6619
6620/**
6621 * Implements 'LMSW r/m16'
6622 *
6623 * @param u16NewMsw The new value.
6624 * @param GCPtrEffDst The guest-linear address of the source operand in case
6625 * of a memory operand. For register operand, pass
6626 * NIL_RTGCPTR.
6627 */
6628IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6629{
6630 if (IEM_GET_CPL(pVCpu) != 0)
6631 return iemRaiseGeneralProtectionFault0(pVCpu);
6632 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6633 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6634
6635#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6636 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6637 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6638 { /* probable */ }
6639 else
6640 {
6641 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6642 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6643 return rcStrict;
6644 }
6645#else
6646 RT_NOREF_PV(GCPtrEffDst);
6647#endif
6648
6649 /*
6650 * Compose the new CR0 value and call common worker.
6651 */
6652 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6653 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6654 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6655}
6656
6657
6658/**
6659 * Implements 'CLTS'.
6660 */
6661IEM_CIMPL_DEF_0(iemCImpl_clts)
6662{
6663 if (IEM_GET_CPL(pVCpu) != 0)
6664 return iemRaiseGeneralProtectionFault0(pVCpu);
6665
6666 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6667 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6668 uNewCr0 &= ~X86_CR0_TS;
6669
6670#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6671 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6672 { /* probable */ }
6673 else
6674 {
6675 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6676 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6677 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6678 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6679 return rcStrict;
6680 }
6681#endif
6682
6683 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6684}
6685
6686
6687/**
6688 * Implements mov GReg,DRx.
6689 *
6690 * @param iGReg The general register to store the DRx value in.
6691 * @param iDrReg The DRx register to read (0-7).
6692 */
6693IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6694{
6695#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6696 /*
6697 * Check nested-guest VMX intercept.
6698 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6699 * over CPL and CR4.DE and even DR4/DR5 checks.
6700 *
6701 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6702 */
6703 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6704 { /* probable */ }
6705 else
6706 {
6707 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6708 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6709 return rcStrict;
6710 }
6711#endif
6712
6713 /*
6714 * Check preconditions.
6715 */
6716 /* Raise GPs. */
6717 if (IEM_GET_CPL(pVCpu) != 0)
6718 return iemRaiseGeneralProtectionFault0(pVCpu);
6719 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6720 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6721
6722 /** @todo \#UD in outside ring-0 too? */
6723 if (iDrReg == 4 || iDrReg == 5)
6724 {
6725 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6726 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6727 {
6728 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6729 return iemRaiseGeneralProtectionFault0(pVCpu);
6730 }
6731 iDrReg += 2;
6732 }
6733
6734 /* Raise #DB if general access detect is enabled. */
6735 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6736 {
6737 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6738 return iemRaiseDebugException(pVCpu);
6739 }
6740
6741 /*
6742 * Read the debug register and store it in the specified general register.
6743 */
6744 uint64_t drX;
6745 switch (iDrReg)
6746 {
6747 case 0:
6748 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6749 drX = pVCpu->cpum.GstCtx.dr[0];
6750 break;
6751 case 1:
6752 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6753 drX = pVCpu->cpum.GstCtx.dr[1];
6754 break;
6755 case 2:
6756 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6757 drX = pVCpu->cpum.GstCtx.dr[2];
6758 break;
6759 case 3:
6760 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6761 drX = pVCpu->cpum.GstCtx.dr[3];
6762 break;
6763 case 6:
6764 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6765 drX = pVCpu->cpum.GstCtx.dr[6];
6766 drX |= X86_DR6_RA1_MASK;
6767 drX &= ~X86_DR6_RAZ_MASK;
6768 break;
6769 case 7:
6770 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6771 drX = pVCpu->cpum.GstCtx.dr[7];
6772 drX |=X86_DR7_RA1_MASK;
6773 drX &= ~X86_DR7_RAZ_MASK;
6774 break;
6775 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6776 }
6777
6778 /** @todo SVM nested-guest intercept for DR8-DR15? */
6779 /*
6780 * Check for any SVM nested-guest intercepts for the DRx read.
6781 */
6782 if (!IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6783 { /* probable */ }
6784 else
6785 {
6786 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6787 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6788 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6789 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6790 }
6791
6792 if (IEM_IS_64BIT_CODE(pVCpu))
6793 iemGRegStoreU64(pVCpu, iGReg, drX);
6794 else
6795 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)drX);
6796
6797 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6798}
6799
6800
6801/**
6802 * Implements mov DRx,GReg.
6803 *
6804 * @param iDrReg The DRx register to write (valid).
6805 * @param iGReg The general register to load the DRx value from.
6806 */
6807IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6808{
6809#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6810 /*
6811 * Check nested-guest VMX intercept.
6812 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6813 * over CPL and CR4.DE and even DR4/DR5 checks.
6814 *
6815 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6816 */
6817 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6818 { /* probable */ }
6819 else
6820 {
6821 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6822 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6823 return rcStrict;
6824 }
6825#endif
6826
6827 /*
6828 * Check preconditions.
6829 */
6830 if (IEM_GET_CPL(pVCpu) != 0)
6831 return iemRaiseGeneralProtectionFault0(pVCpu);
6832 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6833 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6834
6835 if (iDrReg == 4 || iDrReg == 5)
6836 {
6837 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6838 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6839 {
6840 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6841 return iemRaiseGeneralProtectionFault0(pVCpu);
6842 }
6843 iDrReg += 2;
6844 }
6845
6846 /* Raise #DB if general access detect is enabled. */
6847 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6848 * \#GP? */
6849 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6850 {
6851 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6852 return iemRaiseDebugException(pVCpu);
6853 }
6854
6855 /*
6856 * Read the new value from the source register.
6857 */
6858 uint64_t uNewDrX;
6859 if (IEM_IS_64BIT_CODE(pVCpu))
6860 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6861 else
6862 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6863
6864 /*
6865 * Adjust it.
6866 */
6867 switch (iDrReg)
6868 {
6869 case 0:
6870 case 1:
6871 case 2:
6872 case 3:
6873 /* nothing to adjust */
6874 break;
6875
6876 case 6:
6877 if (uNewDrX & X86_DR6_MBZ_MASK)
6878 {
6879 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6880 return iemRaiseGeneralProtectionFault0(pVCpu);
6881 }
6882 uNewDrX |= X86_DR6_RA1_MASK;
6883 uNewDrX &= ~X86_DR6_RAZ_MASK;
6884 break;
6885
6886 case 7:
6887 if (uNewDrX & X86_DR7_MBZ_MASK)
6888 {
6889 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6890 return iemRaiseGeneralProtectionFault0(pVCpu);
6891 }
6892 uNewDrX |= X86_DR7_RA1_MASK;
6893 uNewDrX &= ~X86_DR7_RAZ_MASK;
6894 break;
6895
6896 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6897 }
6898
6899 /** @todo SVM nested-guest intercept for DR8-DR15? */
6900 /*
6901 * Check for any SVM nested-guest intercepts for the DRx write.
6902 */
6903 if (!IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6904 { /* probable */ }
6905 else
6906 {
6907 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6908 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6909 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6910 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6911 }
6912
6913 /*
6914 * Do the actual setting.
6915 */
6916 if (iDrReg < 4)
6917 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6918 else if (iDrReg == 6)
6919 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6920
6921 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6922 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6923
6924 /*
6925 * Re-init hardware breakpoint summary if it was DR7 that got changed.
6926 */
6927 if (iDrReg == 7)
6928 iemRecalcExecDbgFlags(pVCpu);
6929
6930 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6931}
6932
6933
6934/**
6935 * Implements mov GReg,TRx.
6936 *
6937 * @param iGReg The general register to store the
6938 * TRx value in.
6939 * @param iTrReg The TRx register to read (6/7).
6940 */
6941IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6942{
6943 /*
6944 * Check preconditions. NB: This instruction is 386/486 only.
6945 */
6946
6947 /* Raise GPs. */
6948 if (IEM_GET_CPL(pVCpu) != 0)
6949 return iemRaiseGeneralProtectionFault0(pVCpu);
6950 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6951
6952 if (iTrReg < 6 || iTrReg > 7)
6953 {
6954 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6955 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6956 return iemRaiseGeneralProtectionFault0(pVCpu);
6957 }
6958
6959 /*
6960 * Read the test register and store it in the specified general register.
6961 * This is currently a dummy implementation that only exists to satisfy
6962 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6963 * TR6/TR7 registers. Software which actually depends on the TR values
6964 * (different on 386/486) is exceedingly rare.
6965 */
6966 uint32_t trX;
6967 switch (iTrReg)
6968 {
6969 case 6:
6970 trX = 0; /* Currently a dummy. */
6971 break;
6972 case 7:
6973 trX = 0; /* Currently a dummy. */
6974 break;
6975 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6976 }
6977
6978 iemGRegStoreU32(pVCpu, iGReg, trX);
6979
6980 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6981}
6982
6983
6984/**
6985 * Implements mov TRx,GReg.
6986 *
6987 * @param iTrReg The TRx register to write (valid).
6988 * @param iGReg The general register to load the TRx
6989 * value from.
6990 */
6991IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6992{
6993 /*
6994 * Check preconditions. NB: This instruction is 386/486 only.
6995 */
6996
6997 /* Raise GPs. */
6998 if (IEM_GET_CPL(pVCpu) != 0)
6999 return iemRaiseGeneralProtectionFault0(pVCpu);
7000 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
7001
7002 if (iTrReg < 6 || iTrReg > 7)
7003 {
7004 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
7005 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
7006 return iemRaiseGeneralProtectionFault0(pVCpu);
7007 }
7008
7009 /*
7010 * Read the new value from the source register.
7011 */
7012 uint32_t uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
7013
7014 /*
7015 * Here we would do the actual setting if this weren't a dummy implementation.
7016 * This is currently a dummy implementation that only exists to prevent
7017 * old debuggers like WDEB386 or OS/2 KDB from crashing.
7018 */
7019 RT_NOREF(uNewTrX);
7020
7021 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7022}
7023
7024
7025/**
7026 * Implements 'INVLPG m'.
7027 *
7028 * @param GCPtrPage The effective address of the page to invalidate.
7029 * @remarks Updates the RIP.
7030 */
7031IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
7032{
7033 /* ring-0 only. */
7034 if (IEM_GET_CPL(pVCpu) != 0)
7035 return iemRaiseGeneralProtectionFault0(pVCpu);
7036 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
7037 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
7038
7039 if (!IEM_IS_IN_GUEST(pVCpu))
7040 { /* probable */ }
7041#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7042 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7043 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
7044 {
7045 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
7046 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
7047 }
7048#endif
7049 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
7050 {
7051 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
7052 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7053 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
7054 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
7055 }
7056
7057 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
7058 if (rc == VINF_SUCCESS)
7059 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7060 if (rc == VINF_PGM_SYNC_CR3)
7061 {
7062 iemSetPassUpStatus(pVCpu, rc);
7063 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7064 }
7065
7066 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
7067 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
7068 return rc;
7069}
7070
7071
7072/**
7073 * Implements INVPCID.
7074 *
7075 * @param iEffSeg The segment of the invpcid descriptor.
7076 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
7077 * @param uInvpcidType The invalidation type.
7078 * @remarks Updates the RIP.
7079 */
7080IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
7081{
7082 /*
7083 * Check preconditions.
7084 */
7085 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
7086 return iemRaiseUndefinedOpcode(pVCpu);
7087
7088 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
7089 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7090 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID)))
7091 { /* likely */ }
7092 else
7093 {
7094 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
7095 return iemRaiseUndefinedOpcode(pVCpu);
7096 }
7097
7098 if (IEM_GET_CPL(pVCpu) != 0)
7099 {
7100 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
7101 return iemRaiseGeneralProtectionFault0(pVCpu);
7102 }
7103
7104 if (IEM_IS_V86_MODE(pVCpu))
7105 {
7106 Log(("invpcid: v8086 mode -> #GP(0)\n"));
7107 return iemRaiseGeneralProtectionFault0(pVCpu);
7108 }
7109
7110 /*
7111 * Check nested-guest intercept.
7112 *
7113 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
7114 * both set. We have already checked the former earlier in this function.
7115 *
7116 * CPL and virtual-8086 mode checks take priority over this VM-exit.
7117 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
7118 */
7119 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7120 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
7121 { /* probable */ }
7122 else
7123 {
7124 Log(("invpcid: Guest intercept -> #VM-exit\n"));
7125 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
7126 }
7127
7128 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
7129 {
7130 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
7131 return iemRaiseGeneralProtectionFault0(pVCpu);
7132 }
7133 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
7134
7135 /*
7136 * Fetch the invpcid descriptor from guest memory.
7137 */
7138 RTUINT128U uDesc;
7139 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
7140 if (rcStrict == VINF_SUCCESS)
7141 {
7142 /*
7143 * Validate the descriptor.
7144 */
7145 if (uDesc.s.Lo > 0xfff)
7146 {
7147 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
7148 return iemRaiseGeneralProtectionFault0(pVCpu);
7149 }
7150
7151 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
7152 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
7153 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
7154 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
7155 switch (uInvpcidType)
7156 {
7157 case X86_INVPCID_TYPE_INDV_ADDR:
7158 {
7159 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
7160 {
7161 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
7162 return iemRaiseGeneralProtectionFault0(pVCpu);
7163 }
7164 if ( !(uCr4 & X86_CR4_PCIDE)
7165 && uPcid != 0)
7166 {
7167 Log(("invpcid: invalid pcid %#x\n", uPcid));
7168 return iemRaiseGeneralProtectionFault0(pVCpu);
7169 }
7170
7171 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
7172 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7173 break;
7174 }
7175
7176 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
7177 {
7178 if ( !(uCr4 & X86_CR4_PCIDE)
7179 && uPcid != 0)
7180 {
7181 Log(("invpcid: invalid pcid %#x\n", uPcid));
7182 return iemRaiseGeneralProtectionFault0(pVCpu);
7183 }
7184 /* Invalidate all mappings associated with PCID except global translations. */
7185 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7186 break;
7187 }
7188
7189 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
7190 {
7191 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
7192 break;
7193 }
7194
7195 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
7196 {
7197 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7198 break;
7199 }
7200 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7201 }
7202 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7203 }
7204 return rcStrict;
7205}
7206
7207
7208/**
7209 * Implements INVD.
7210 */
7211IEM_CIMPL_DEF_0(iemCImpl_invd)
7212{
7213 if (IEM_GET_CPL(pVCpu) != 0)
7214 {
7215 Log(("invd: CPL != 0 -> #GP(0)\n"));
7216 return iemRaiseGeneralProtectionFault0(pVCpu);
7217 }
7218
7219 if (!IEM_IS_IN_GUEST(pVCpu))
7220 { /* probable */ }
7221 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7222 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
7223 else
7224 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0, cbInstr);
7225
7226 /* We currently take no action here. */
7227 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7228}
7229
7230
7231/**
7232 * Implements WBINVD.
7233 */
7234IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
7235{
7236 if (IEM_GET_CPL(pVCpu) != 0)
7237 {
7238 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
7239 return iemRaiseGeneralProtectionFault0(pVCpu);
7240 }
7241
7242 if (!IEM_IS_IN_GUEST(pVCpu))
7243 { /* probable */ }
7244 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7245 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
7246 else
7247 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0, cbInstr);
7248
7249 /* We currently take no action here. */
7250 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7251}
7252
7253
7254/** Opcode 0x0f 0xaa. */
7255IEM_CIMPL_DEF_0(iemCImpl_rsm)
7256{
7257 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0, cbInstr);
7258 NOREF(cbInstr);
7259 return iemRaiseUndefinedOpcode(pVCpu);
7260}
7261
7262
7263/**
7264 * Implements RDTSC.
7265 */
7266IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
7267{
7268 /*
7269 * Check preconditions.
7270 */
7271 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
7272 return iemRaiseUndefinedOpcode(pVCpu);
7273
7274 if (IEM_GET_CPL(pVCpu) != 0)
7275 {
7276 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7277 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7278 {
7279 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7280 return iemRaiseGeneralProtectionFault0(pVCpu);
7281 }
7282 }
7283
7284 if (!IEM_IS_IN_GUEST(pVCpu))
7285 { /* probable */ }
7286 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7287 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7288 {
7289 Log(("rdtsc: Guest intercept -> VM-exit\n"));
7290 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
7291 }
7292 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
7293 {
7294 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
7295 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7296 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7297 }
7298
7299 /*
7300 * Do the job.
7301 */
7302 uint64_t uTicks = TMCpuTickGet(pVCpu);
7303#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7304 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7305#endif
7306 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7307 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7308 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
7309 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7310}
7311
7312
7313/**
7314 * Implements RDTSC.
7315 */
7316IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
7317{
7318 /*
7319 * Check preconditions.
7320 */
7321 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
7322 return iemRaiseUndefinedOpcode(pVCpu);
7323
7324 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7325 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP)))
7326 { /* likely */ }
7327 else
7328 {
7329 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
7330 return iemRaiseUndefinedOpcode(pVCpu);
7331 }
7332
7333 if (IEM_GET_CPL(pVCpu) != 0)
7334 {
7335 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7336 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7337 {
7338 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7339 return iemRaiseGeneralProtectionFault0(pVCpu);
7340 }
7341 }
7342
7343 if (!IEM_IS_IN_GUEST(pVCpu))
7344 { /* probable */ }
7345 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7346 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7347 {
7348 Log(("rdtscp: Guest intercept -> VM-exit\n"));
7349 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
7350 }
7351 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
7352 {
7353 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
7354 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7355 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7356 }
7357
7358 /*
7359 * Do the job.
7360 * Query the MSR first in case of trips to ring-3.
7361 */
7362 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7363 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7364 if (rcStrict == VINF_SUCCESS)
7365 {
7366 /* Low dword of the TSC_AUX msr only. */
7367 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7368
7369 uint64_t uTicks = TMCpuTickGet(pVCpu);
7370#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7371 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7372#endif
7373 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7374 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7375 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7376 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7377 }
7378 return rcStrict;
7379}
7380
7381
7382/**
7383 * Implements RDPMC.
7384 */
7385IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7386{
7387 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7388
7389 if ( IEM_GET_CPL(pVCpu) != 0
7390 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7391 return iemRaiseGeneralProtectionFault0(pVCpu);
7392
7393 if (!IEM_IS_IN_GUEST(pVCpu))
7394 { /* probable */ }
7395 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7396 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7397 {
7398 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7399 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7400 }
7401 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7402 {
7403 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7404 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7405 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7406 }
7407
7408 /** @todo Emulate performance counters, for now just return 0. */
7409 pVCpu->cpum.GstCtx.rax = 0;
7410 pVCpu->cpum.GstCtx.rdx = 0;
7411 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7412 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7413 * ecx but see @bugref{3472}! */
7414
7415 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7416}
7417
7418
7419/**
7420 * Implements RDMSR.
7421 */
7422IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7423{
7424 /*
7425 * Check preconditions.
7426 */
7427 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7428 return iemRaiseUndefinedOpcode(pVCpu);
7429 if (IEM_GET_CPL(pVCpu) != 0)
7430 return iemRaiseGeneralProtectionFault0(pVCpu);
7431
7432 /*
7433 * Check nested-guest intercepts.
7434 */
7435 if (!IEM_IS_IN_GUEST(pVCpu))
7436 { /* probable */ }
7437#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7438 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7439 {
7440 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7441 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7442 }
7443#endif
7444#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7445 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7446 {
7447 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */, cbInstr);
7448 if (rcStrict == VINF_SVM_VMEXIT)
7449 return VINF_SUCCESS;
7450 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7451 {
7452 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7453 return rcStrict;
7454 }
7455 }
7456#endif
7457
7458 /*
7459 * Do the job.
7460 */
7461 RTUINT64U uValue;
7462 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7463 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7464
7465 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7466 if (rcStrict == VINF_SUCCESS)
7467 {
7468 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7469 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7470 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7471
7472 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7473 }
7474
7475#ifndef IN_RING3
7476 /* Deferred to ring-3. */
7477 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7478 {
7479 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7480 return rcStrict;
7481 }
7482#endif
7483
7484 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7485 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7486 {
7487 pVCpu->iem.s.cLogRelRdMsr++;
7488 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7489 }
7490 else
7491 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7492 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7493 return iemRaiseGeneralProtectionFault0(pVCpu);
7494}
7495
7496
7497/**
7498 * Implements WRMSR.
7499 */
7500IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7501{
7502 /*
7503 * Check preconditions.
7504 */
7505 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7506 return iemRaiseUndefinedOpcode(pVCpu);
7507 if (IEM_GET_CPL(pVCpu) != 0)
7508 return iemRaiseGeneralProtectionFault0(pVCpu);
7509
7510 RTUINT64U uValue;
7511 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7512 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7513
7514 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7515
7516 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7517 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7518
7519 /*
7520 * Check nested-guest intercepts.
7521 */
7522 if (!IEM_IS_IN_GUEST(pVCpu))
7523 { /* probable */ }
7524#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7525 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7526 {
7527 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7528 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7529 }
7530#endif
7531#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7532 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7533 {
7534 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */, cbInstr);
7535 if (rcStrict == VINF_SVM_VMEXIT)
7536 return VINF_SUCCESS;
7537 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7538 {
7539 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7540 return rcStrict;
7541 }
7542 }
7543#endif
7544
7545 /*
7546 * Do the job.
7547 */
7548 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7549 if (rcStrict == VINF_SUCCESS)
7550 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7551
7552#ifndef IN_RING3
7553 /* Deferred to ring-3. */
7554 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7555 {
7556 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7557 return rcStrict;
7558 }
7559#endif
7560
7561 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7562 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7563 {
7564 pVCpu->iem.s.cLogRelWrMsr++;
7565 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7566 }
7567 else
7568 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7569 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7570 return iemRaiseGeneralProtectionFault0(pVCpu);
7571}
7572
7573
7574/**
7575 * Implements 'IN eAX, port'.
7576 *
7577 * @param u16Port The source port.
7578 * @param cbReg The register size.
7579 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7580 * immediate operand or the implicit DX register.
7581 * Bits 3-0: Effective address mode.
7582 */
7583IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7584{
7585 /*
7586 * CPL check
7587 */
7588 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7589 if (rcStrict != VINF_SUCCESS)
7590 return rcStrict;
7591
7592 if (!IEM_IS_IN_GUEST(pVCpu))
7593 { /* probable */ }
7594
7595 /*
7596 * Check VMX nested-guest IO intercept.
7597 */
7598#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7599 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7600 {
7601 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7602 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7603 return rcStrict;
7604 }
7605#endif
7606
7607 /*
7608 * Check SVM nested-guest IO intercept.
7609 */
7610#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7611 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7612 {
7613 uint8_t cAddrSizeBits;
7614 switch (bImmAndEffAddrMode & 0xf)
7615 {
7616 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7617 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7618 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7619 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7620 }
7621 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7622 false /* fRep */, false /* fStrIo */, cbInstr);
7623 if (rcStrict == VINF_SVM_VMEXIT)
7624 return VINF_SUCCESS;
7625 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7626 {
7627 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7628 VBOXSTRICTRC_VAL(rcStrict)));
7629 return rcStrict;
7630 }
7631 }
7632#endif
7633#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7634 RT_NOREF(bImmAndEffAddrMode);
7635#endif
7636
7637 /*
7638 * Perform the I/O.
7639 */
7640 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7641 uint32_t u32Value = 0;
7642 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7643 if (IOM_SUCCESS(rcStrict))
7644 {
7645 switch (cbReg)
7646 {
7647 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7648 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7649 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7650 default: AssertFailedReturn(VERR_IEM_IPE_3);
7651 }
7652
7653 pVCpu->iem.s.cPotentialExits++;
7654 if (rcStrict != VINF_SUCCESS)
7655 iemSetPassUpStatus(pVCpu, rcStrict);
7656
7657 /*
7658 * Check for I/O breakpoints before we complete the instruction.
7659 */
7660 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7661 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7662 && X86_DR7_ANY_RW_IO(fDr7)
7663 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7664 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7665 && rcStrict == VINF_SUCCESS))
7666 {
7667 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7668 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7669 }
7670
7671 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7672 }
7673
7674 return rcStrict;
7675}
7676
7677
7678/**
7679 * Implements 'IN eAX, DX'.
7680 *
7681 * @param cbReg The register size.
7682 * @param enmEffAddrMode Effective address mode.
7683 */
7684IEM_CIMPL_DEF_2(iemCImpl_in_eAX_DX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7685{
7686 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7687}
7688
7689
7690/**
7691 * Implements 'OUT port, eAX'.
7692 *
7693 * @param u16Port The destination port.
7694 * @param cbReg The register size.
7695 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7696 * immediate operand or the implicit DX register.
7697 * Bits 3-0: Effective address mode.
7698 */
7699IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7700{
7701 /*
7702 * CPL check
7703 */
7704 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7705 if (rcStrict != VINF_SUCCESS)
7706 return rcStrict;
7707
7708 if (!IEM_IS_IN_GUEST(pVCpu))
7709 { /* probable */ }
7710
7711 /*
7712 * Check VMX nested-guest I/O intercept.
7713 */
7714#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7715 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7716 {
7717 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7718 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7719 return rcStrict;
7720 }
7721#endif
7722
7723 /*
7724 * Check SVM nested-guest I/O intercept.
7725 */
7726#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7727 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7728 {
7729 uint8_t cAddrSizeBits;
7730 switch (bImmAndEffAddrMode & 0xf)
7731 {
7732 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7733 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7734 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7735 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7736 }
7737 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7738 false /* fRep */, false /* fStrIo */, cbInstr);
7739 if (rcStrict == VINF_SVM_VMEXIT)
7740 return VINF_SUCCESS;
7741 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7742 {
7743 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7744 VBOXSTRICTRC_VAL(rcStrict)));
7745 return rcStrict;
7746 }
7747 }
7748#endif
7749#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7750 RT_NOREF(bImmAndEffAddrMode);
7751#endif
7752
7753 /*
7754 * Perform the I/O.
7755 */
7756 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7757 uint32_t u32Value;
7758 switch (cbReg)
7759 {
7760 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7761 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7762 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7763 default: AssertFailedReturn(VERR_IEM_IPE_4);
7764 }
7765 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7766 if (IOM_SUCCESS(rcStrict))
7767 {
7768 pVCpu->iem.s.cPotentialExits++;
7769 if (rcStrict != VINF_SUCCESS)
7770 iemSetPassUpStatus(pVCpu, rcStrict);
7771
7772 /*
7773 * Check for I/O breakpoints before we complete the instruction.
7774 */
7775 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7776 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7777 && X86_DR7_ANY_RW_IO(fDr7)
7778 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7779 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7780 && rcStrict == VINF_SUCCESS))
7781 {
7782 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7783 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7784 }
7785
7786 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7787 }
7788 return rcStrict;
7789}
7790
7791
7792/**
7793 * Implements 'OUT DX, eAX'.
7794 *
7795 * @param cbReg The register size.
7796 * @param enmEffAddrMode Effective address mode.
7797 */
7798IEM_CIMPL_DEF_2(iemCImpl_out_DX_eAX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7799{
7800 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7801}
7802
7803
7804/**
7805 * Implements 'CLI'.
7806 */
7807IEM_CIMPL_DEF_0(iemCImpl_cli)
7808{
7809 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7810#ifdef LOG_ENABLED
7811 uint32_t const fEflOld = fEfl;
7812#endif
7813
7814 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7815 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7816 {
7817 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7818 if (!(fEfl & X86_EFL_VM))
7819 {
7820 if (IEM_GET_CPL(pVCpu) <= uIopl)
7821 fEfl &= ~X86_EFL_IF;
7822 else if ( IEM_GET_CPL(pVCpu) == 3
7823 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7824 fEfl &= ~X86_EFL_VIF;
7825 else
7826 return iemRaiseGeneralProtectionFault0(pVCpu);
7827 }
7828 /* V8086 */
7829 else if (uIopl == 3)
7830 fEfl &= ~X86_EFL_IF;
7831 else if ( uIopl < 3
7832 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7833 fEfl &= ~X86_EFL_VIF;
7834 else
7835 return iemRaiseGeneralProtectionFault0(pVCpu);
7836 }
7837 /* real mode */
7838 else
7839 fEfl &= ~X86_EFL_IF;
7840
7841 /* Commit. */
7842 IEMMISC_SET_EFL(pVCpu, fEfl);
7843 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7844 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7845 return rcStrict;
7846}
7847
7848
7849/**
7850 * Implements 'STI'.
7851 */
7852IEM_CIMPL_DEF_0(iemCImpl_sti)
7853{
7854 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7855 uint32_t const fEflOld = fEfl;
7856
7857 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7858 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7859 {
7860 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7861 if (!(fEfl & X86_EFL_VM))
7862 {
7863 if (IEM_GET_CPL(pVCpu) <= uIopl)
7864 fEfl |= X86_EFL_IF;
7865 else if ( IEM_GET_CPL(pVCpu) == 3
7866 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7867 && !(fEfl & X86_EFL_VIP) )
7868 fEfl |= X86_EFL_VIF;
7869 else
7870 return iemRaiseGeneralProtectionFault0(pVCpu);
7871 }
7872 /* V8086 */
7873 else if (uIopl == 3)
7874 fEfl |= X86_EFL_IF;
7875 else if ( uIopl < 3
7876 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7877 && !(fEfl & X86_EFL_VIP) )
7878 fEfl |= X86_EFL_VIF;
7879 else
7880 return iemRaiseGeneralProtectionFault0(pVCpu);
7881 }
7882 /* real mode */
7883 else
7884 fEfl |= X86_EFL_IF;
7885
7886 /*
7887 * Commit.
7888 *
7889 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7890 */
7891 IEMMISC_SET_EFL(pVCpu, fEfl);
7892 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7893 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7894 {
7895 /** @todo only set it the shadow flag if it was clear before? */
7896 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7897 }
7898 pVCpu->iem.s.fTbCurInstrIsSti = true;
7899 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7900 return rcStrict;
7901}
7902
7903
7904/**
7905 * Implements 'HLT'.
7906 */
7907IEM_CIMPL_DEF_0(iemCImpl_hlt)
7908{
7909 if (IEM_GET_CPL(pVCpu) != 0)
7910 return iemRaiseGeneralProtectionFault0(pVCpu);
7911
7912 if (!IEM_IS_IN_GUEST(pVCpu))
7913 { /* probable */ }
7914 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7915 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7916 {
7917 Log2(("hlt: Guest intercept -> VM-exit\n"));
7918 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7919 }
7920 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7921 {
7922 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7923 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7924 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7925 }
7926
7927 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7928 * be returning any status codes relating to non-guest events being raised, as
7929 * we'll mess up the guest HALT otherwise. */
7930 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7931 if (rcStrict == VINF_SUCCESS)
7932 rcStrict = VINF_EM_HALT;
7933 return rcStrict;
7934}
7935
7936
7937/**
7938 * Implements 'MONITOR'.
7939 */
7940IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7941{
7942 /*
7943 * Permission checks.
7944 */
7945 if (IEM_GET_CPL(pVCpu) != 0)
7946 {
7947 Log2(("monitor: CPL != 0\n"));
7948 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7949 }
7950 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7951 {
7952 Log2(("monitor: Not in CPUID\n"));
7953 return iemRaiseUndefinedOpcode(pVCpu);
7954 }
7955
7956 /*
7957 * Check VMX guest-intercept.
7958 * This should be considered a fault-like VM-exit.
7959 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7960 */
7961 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7962 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7963 { /* probable */ }
7964 else
7965 {
7966 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7967 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7968 }
7969
7970 /*
7971 * Gather the operands and validate them.
7972 */
7973 RTGCPTR GCPtrMem = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7974 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7975 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7976/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7977 * \#GP first. */
7978 if (uEcx != 0)
7979 {
7980 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7981 return iemRaiseGeneralProtectionFault0(pVCpu);
7982 }
7983
7984 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7985 if (rcStrict != VINF_SUCCESS)
7986 return rcStrict;
7987
7988 RTGCPHYS GCPhysMem;
7989 /** @todo access size */
7990 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7991 if (rcStrict != VINF_SUCCESS)
7992 return rcStrict;
7993
7994 if (!IEM_IS_IN_GUEST(pVCpu))
7995 { /* probable */ }
7996#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7997 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7998 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7999 {
8000 /*
8001 * MONITOR does not access the memory, just monitors the address. However,
8002 * if the address falls in the APIC-access page, the address monitored must
8003 * instead be the corresponding address in the virtual-APIC page.
8004 *
8005 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8006 */
8007 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8008 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8009 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8010 return rcStrict;
8011 }
8012#endif
8013 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
8014 {
8015 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
8016 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8017 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8018 }
8019
8020 /*
8021 * Call EM to prepare the monitor/wait.
8022 */
8023 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
8024 Assert(rcStrict == VINF_SUCCESS);
8025 if (rcStrict == VINF_SUCCESS)
8026 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8027 return rcStrict;
8028}
8029
8030
8031/**
8032 * Implements 'MWAIT'.
8033 */
8034IEM_CIMPL_DEF_0(iemCImpl_mwait)
8035{
8036 /*
8037 * Permission checks.
8038 */
8039 if (IEM_GET_CPL(pVCpu) != 0)
8040 {
8041 Log2(("mwait: CPL != 0\n"));
8042 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
8043 * EFLAGS.VM then.) */
8044 return iemRaiseUndefinedOpcode(pVCpu);
8045 }
8046 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
8047 {
8048 Log2(("mwait: Not in CPUID\n"));
8049 return iemRaiseUndefinedOpcode(pVCpu);
8050 }
8051
8052 /* Check VMX nested-guest intercept. */
8053 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8054 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
8055 { /* probable */ }
8056 else
8057 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
8058
8059 /*
8060 * Gather the operands and validate them.
8061 */
8062 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8063 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8064 if (uEcx != 0)
8065 {
8066 /* Only supported extension is break on IRQ when IF=0. */
8067 if (uEcx > 1)
8068 {
8069 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
8070 return iemRaiseGeneralProtectionFault0(pVCpu);
8071 }
8072 uint32_t fMWaitFeatures = 0;
8073 uint32_t uIgnore = 0;
8074 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
8075 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8076 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8077 {
8078 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
8079 return iemRaiseGeneralProtectionFault0(pVCpu);
8080 }
8081
8082#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8083 /*
8084 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
8085 * for delivery; and interrupts are disabled the processor does not enter its
8086 * mwait state but rather passes control to the next instruction.
8087 *
8088 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
8089 */
8090 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8091 || pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
8092 { /* probable */ }
8093 else if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
8094 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
8095 /** @todo finish: check up this out after we move int window stuff out of the
8096 * run loop and into the instruction finishing logic here. */
8097 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8098#endif
8099 }
8100
8101 /*
8102 * Check SVM nested-guest mwait intercepts.
8103 */
8104 if (!IEM_IS_IN_GUEST(pVCpu))
8105 { /* probable */ }
8106 else if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
8107 && EMMonitorIsArmed(pVCpu))
8108 {
8109 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
8110 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8111 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8112 }
8113 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
8114 {
8115 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
8116 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8117 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8118 }
8119
8120 /*
8121 * Call EM to prepare the monitor/wait.
8122 *
8123 * This will return VINF_EM_HALT. If there the trap flag is set, we may
8124 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
8125 * that will only return guest related events.
8126 */
8127 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
8128
8129 /** @todo finish: This needs more thinking as we should suppress internal
8130 * debugger events here, or we'll bugger up the guest state even more than we
8131 * alread do around VINF_EM_HALT. */
8132 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8133 if (rcStrict2 != VINF_SUCCESS)
8134 {
8135 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
8136 rcStrict = rcStrict2;
8137 }
8138
8139 return rcStrict;
8140}
8141
8142
8143/**
8144 * Implements 'SWAPGS'.
8145 */
8146IEM_CIMPL_DEF_0(iemCImpl_swapgs)
8147{
8148 Assert(IEM_IS_64BIT_CODE(pVCpu)); /* Caller checks this. */
8149
8150 /*
8151 * Permission checks.
8152 */
8153 if (IEM_GET_CPL(pVCpu) != 0)
8154 {
8155 Log2(("swapgs: CPL != 0\n"));
8156 return iemRaiseUndefinedOpcode(pVCpu);
8157 }
8158
8159 /*
8160 * Do the job.
8161 */
8162 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
8163 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
8164 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
8165 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
8166
8167 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8168}
8169
8170
8171#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8172/**
8173 * Handles a CPUID call.
8174 */
8175static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
8176 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
8177{
8178 switch (iFunction)
8179 {
8180 case VBOX_CPUID_FN_ID:
8181 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
8182 *pEax = VBOX_CPUID_RESP_ID_EAX;
8183 *pEbx = VBOX_CPUID_RESP_ID_EBX;
8184 *pEcx = VBOX_CPUID_RESP_ID_ECX;
8185 *pEdx = VBOX_CPUID_RESP_ID_EDX;
8186 break;
8187
8188 case VBOX_CPUID_FN_LOG:
8189 {
8190 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
8191 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
8192
8193 /* Validate input. */
8194 uint32_t cchToLog = *pEdx;
8195 if (cchToLog <= _2M)
8196 {
8197 uint32_t const uLogPicker = *pEbx;
8198 if (uLogPicker <= 1)
8199 {
8200 /* Resolve the logger. */
8201 PRTLOGGER const pLogger = !uLogPicker
8202 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
8203 if (pLogger)
8204 {
8205 /* Copy over the data: */
8206 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
8207 while (cchToLog > 0)
8208 {
8209 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
8210 if (cbToMap > cchToLog)
8211 cbToMap = cchToLog;
8212 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
8213 * unnecessary calls & iterations per pages. */
8214 if (cbToMap > 512)
8215 cbToMap = 512;
8216 uint8_t bUnmapInfo;
8217 void *pvSrc = NULL;
8218 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, &bUnmapInfo, cbToMap,
8219 UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
8220 if (rcStrict == VINF_SUCCESS)
8221 {
8222 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
8223 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8224 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
8225 }
8226 else
8227 {
8228 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
8229 return rcStrict;
8230 }
8231
8232 /* Advance. */
8233 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
8234 *pEdx = cchToLog -= cbToMap;
8235 }
8236 *pEax = VINF_SUCCESS;
8237 }
8238 else
8239 *pEax = (uint32_t)VERR_NOT_FOUND;
8240 }
8241 else
8242 *pEax = (uint32_t)VERR_NOT_FOUND;
8243 }
8244 else
8245 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
8246 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
8247 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
8248 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
8249 break;
8250 }
8251
8252 default:
8253 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
8254 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
8255 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
8256 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
8257 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
8258 break;
8259 }
8260 return VINF_SUCCESS;
8261}
8262#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
8263
8264/**
8265 * Implements 'CPUID'.
8266 */
8267IEM_CIMPL_DEF_0(iemCImpl_cpuid)
8268{
8269 if (!IEM_IS_IN_GUEST(pVCpu))
8270 { /* probable */ }
8271 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8272 {
8273 Log2(("cpuid: Guest intercept -> VM-exit\n"));
8274 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
8275 }
8276 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
8277 {
8278 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
8279 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8280 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8281 }
8282
8283
8284 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8285 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8286
8287#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8288 /*
8289 * CPUID host call backdoor.
8290 */
8291 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
8292 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
8293 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
8294 {
8295 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
8296 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
8297 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8298 if (rcStrict != VINF_SUCCESS)
8299 return rcStrict;
8300 }
8301 /*
8302 * Regular CPUID.
8303 */
8304 else
8305#endif
8306 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
8307 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8308
8309 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
8310 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
8311 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
8312 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
8313 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
8314
8315 pVCpu->iem.s.cPotentialExits++;
8316 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8317}
8318
8319
8320/**
8321 * Implements 'AAD'.
8322 *
8323 * @param bImm The immediate operand.
8324 */
8325IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
8326{
8327 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8328 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
8329 pVCpu->cpum.GstCtx.ax = al;
8330 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8331 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8332 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8333
8334 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8335}
8336
8337
8338/**
8339 * Implements 'AAM'.
8340 *
8341 * @param bImm The immediate operand. Cannot be 0.
8342 */
8343IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
8344{
8345 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
8346
8347 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8348 uint8_t const al = (uint8_t)ax % bImm;
8349 uint8_t const ah = (uint8_t)ax / bImm;
8350 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
8351 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8352 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8353 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8354
8355 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8356}
8357
8358
8359/**
8360 * Implements 'DAA'.
8361 */
8362IEM_CIMPL_DEF_0(iemCImpl_daa)
8363{
8364 uint8_t const al = pVCpu->cpum.GstCtx.al;
8365 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8366
8367 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8368 || (al & 0xf) >= 10)
8369 {
8370 pVCpu->cpum.GstCtx.al = al + 6;
8371 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8372 }
8373 else
8374 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8375
8376 if (al >= 0x9a || fCarry)
8377 {
8378 pVCpu->cpum.GstCtx.al += 0x60;
8379 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8380 }
8381 else
8382 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8383
8384 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8385 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8386}
8387
8388
8389/**
8390 * Implements 'DAS'.
8391 */
8392IEM_CIMPL_DEF_0(iemCImpl_das)
8393{
8394 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8395 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8396
8397 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8398 || (uInputAL & 0xf) >= 10)
8399 {
8400 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8401 if (uInputAL < 6)
8402 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8403 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8404 }
8405 else
8406 {
8407 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8408 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8409 }
8410
8411 if (uInputAL >= 0x9a || fCarry)
8412 {
8413 pVCpu->cpum.GstCtx.al -= 0x60;
8414 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8415 }
8416
8417 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8418 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8419}
8420
8421
8422/**
8423 * Implements 'AAA'.
8424 */
8425IEM_CIMPL_DEF_0(iemCImpl_aaa)
8426{
8427 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8428 {
8429 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8430 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8431 {
8432 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8433 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8434 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8435 }
8436 else
8437 {
8438 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8439 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8440 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8441 }
8442 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8443 }
8444 else
8445 {
8446 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8447 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8448 {
8449 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8450 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8451 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8452 }
8453 else
8454 {
8455 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8456 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8457 }
8458 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8459 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8460 }
8461
8462 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8463}
8464
8465
8466/**
8467 * Implements 'AAS'.
8468 */
8469IEM_CIMPL_DEF_0(iemCImpl_aas)
8470{
8471 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8472 {
8473 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8474 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8475 {
8476 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8477 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8478 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8479 }
8480 else
8481 {
8482 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8483 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8484 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8485 }
8486 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8487 }
8488 else
8489 {
8490 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8491 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8492 {
8493 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8494 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8495 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8496 }
8497 else
8498 {
8499 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8500 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8501 }
8502 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8503 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8504 }
8505
8506 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8507}
8508
8509
8510/**
8511 * Implements the 16-bit version of 'BOUND'.
8512 *
8513 * @note We have separate 16-bit and 32-bit variants of this function due to
8514 * the decoder using unsigned parameters, whereas we want signed one to
8515 * do the job. This is significant for a recompiler.
8516 */
8517IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8518{
8519 /*
8520 * Check if the index is inside the bounds, otherwise raise #BR.
8521 */
8522 if ( idxArray >= idxLowerBound
8523 && idxArray <= idxUpperBound)
8524 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8525 return iemRaiseBoundRangeExceeded(pVCpu);
8526}
8527
8528
8529/**
8530 * Implements the 32-bit version of 'BOUND'.
8531 */
8532IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8533{
8534 /*
8535 * Check if the index is inside the bounds, otherwise raise #BR.
8536 */
8537 if ( idxArray >= idxLowerBound
8538 && idxArray <= idxUpperBound)
8539 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8540 return iemRaiseBoundRangeExceeded(pVCpu);
8541}
8542
8543
8544
8545/*
8546 * Instantiate the various string operation combinations.
8547 */
8548#define OP_SIZE 8
8549#define ADDR_SIZE 16
8550#include "IEMAllCImplStrInstr.cpp.h"
8551#define OP_SIZE 8
8552#define ADDR_SIZE 32
8553#include "IEMAllCImplStrInstr.cpp.h"
8554#define OP_SIZE 8
8555#define ADDR_SIZE 64
8556#include "IEMAllCImplStrInstr.cpp.h"
8557
8558#define OP_SIZE 16
8559#define ADDR_SIZE 16
8560#include "IEMAllCImplStrInstr.cpp.h"
8561#define OP_SIZE 16
8562#define ADDR_SIZE 32
8563#include "IEMAllCImplStrInstr.cpp.h"
8564#define OP_SIZE 16
8565#define ADDR_SIZE 64
8566#include "IEMAllCImplStrInstr.cpp.h"
8567
8568#define OP_SIZE 32
8569#define ADDR_SIZE 16
8570#include "IEMAllCImplStrInstr.cpp.h"
8571#define OP_SIZE 32
8572#define ADDR_SIZE 32
8573#include "IEMAllCImplStrInstr.cpp.h"
8574#define OP_SIZE 32
8575#define ADDR_SIZE 64
8576#include "IEMAllCImplStrInstr.cpp.h"
8577
8578#define OP_SIZE 64
8579#define ADDR_SIZE 32
8580#include "IEMAllCImplStrInstr.cpp.h"
8581#define OP_SIZE 64
8582#define ADDR_SIZE 64
8583#include "IEMAllCImplStrInstr.cpp.h"
8584
8585
8586/**
8587 * Implements 'XGETBV'.
8588 */
8589IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8590{
8591 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8592 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8593 {
8594 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8595 switch (uEcx)
8596 {
8597 case 0:
8598 break;
8599
8600 case 1: /** @todo Implement XCR1 support. */
8601 default:
8602 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8603 return iemRaiseGeneralProtectionFault0(pVCpu);
8604
8605 }
8606 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8607 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8608 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8609
8610 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8611 }
8612 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8613 return iemRaiseUndefinedOpcode(pVCpu);
8614}
8615
8616
8617/**
8618 * Implements 'XSETBV'.
8619 */
8620IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8621{
8622 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8623 {
8624 /** @todo explain why this happens before the CPL check. */
8625 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8626 { /* probable */ }
8627 else
8628 {
8629 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8630 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8631 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8632 }
8633
8634 if (IEM_GET_CPL(pVCpu) == 0)
8635 {
8636 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8637
8638 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8639 { /* probable */ }
8640 else
8641 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8642
8643 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8644 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8645 switch (uEcx)
8646 {
8647 case 0:
8648 {
8649 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8650 if (rc == VINF_SUCCESS)
8651 break;
8652 Assert(rc == VERR_CPUM_RAISE_GP_0);
8653 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8654 return iemRaiseGeneralProtectionFault0(pVCpu);
8655 }
8656
8657 case 1: /** @todo Implement XCR1 support. */
8658 default:
8659 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8660 return iemRaiseGeneralProtectionFault0(pVCpu);
8661
8662 }
8663
8664 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8665 }
8666
8667 Log(("xsetbv cpl=%u -> GP(0)\n", IEM_GET_CPL(pVCpu)));
8668 return iemRaiseGeneralProtectionFault0(pVCpu);
8669 }
8670 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8671 return iemRaiseUndefinedOpcode(pVCpu);
8672}
8673
8674#ifndef RT_ARCH_ARM64
8675# ifdef IN_RING3
8676
8677/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8678struct IEMCIMPLCX16ARGS
8679{
8680 PRTUINT128U pu128Dst;
8681 PRTUINT128U pu128RaxRdx;
8682 PRTUINT128U pu128RbxRcx;
8683 uint32_t *pEFlags;
8684# ifdef VBOX_STRICT
8685 uint32_t cCalls;
8686# endif
8687};
8688
8689/**
8690 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8691 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8692 */
8693static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8694{
8695 RT_NOREF(pVM, pVCpu);
8696 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8697# ifdef VBOX_STRICT
8698 Assert(pArgs->cCalls == 0);
8699 pArgs->cCalls++;
8700# endif
8701
8702 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8703 return VINF_SUCCESS;
8704}
8705
8706# endif /* IN_RING3 */
8707
8708/**
8709 * Implements 'CMPXCHG16B' fallback using rendezvous.
8710 */
8711IEM_CIMPL_DEF_5(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8712 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags, uint8_t, bUnmapInfo)
8713{
8714# ifdef IN_RING3
8715 struct IEMCIMPLCX16ARGS Args;
8716 Args.pu128Dst = pu128Dst;
8717 Args.pu128RaxRdx = pu128RaxRdx;
8718 Args.pu128RbxRcx = pu128RbxRcx;
8719 Args.pEFlags = pEFlags;
8720# ifdef VBOX_STRICT
8721 Args.cCalls = 0;
8722# endif
8723 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8724 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8725 Assert(Args.cCalls == 1);
8726 if (rcStrict == VINF_SUCCESS)
8727 {
8728 /* Duplicated tail code. */
8729 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8730 if (rcStrict == VINF_SUCCESS)
8731 {
8732 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8733 if (!(*pEFlags & X86_EFL_ZF))
8734 {
8735 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8736 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8737 }
8738 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8739 }
8740 }
8741 return rcStrict;
8742# else
8743 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags, bUnmapInfo);
8744 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8745# endif
8746}
8747
8748#endif /* RT_ARCH_ARM64 */
8749
8750/**
8751 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8752 *
8753 * This is implemented in C because it triggers a load like behaviour without
8754 * actually reading anything. Since that's not so common, it's implemented
8755 * here.
8756 *
8757 * @param iEffSeg The effective segment.
8758 * @param GCPtrEff The address of the image.
8759 */
8760IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8761{
8762 /*
8763 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8764 */
8765 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8766 if (rcStrict == VINF_SUCCESS)
8767 {
8768 RTGCPHYS GCPhysMem;
8769 /** @todo access size. */
8770 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8771 if (rcStrict == VINF_SUCCESS)
8772 {
8773#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8774 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8775 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8776 { /* probable */ }
8777 else
8778 {
8779 /*
8780 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8781 * that contains the address. However, if the address falls in the APIC-access
8782 * page, the address flushed must instead be the corresponding address in the
8783 * virtual-APIC page.
8784 *
8785 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8786 */
8787 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8788 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8789 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8790 return rcStrict;
8791 }
8792#endif
8793 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8794 }
8795 }
8796
8797 return rcStrict;
8798}
8799
8800
8801/**
8802 * Implements 'FINIT' and 'FNINIT'.
8803 *
8804 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8805 * not.
8806 */
8807IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8808{
8809 /*
8810 * Exceptions.
8811 */
8812 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8813 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8814 return iemRaiseDeviceNotAvailable(pVCpu);
8815
8816 iemFpuActualizeStateForChange(pVCpu);
8817 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8818
8819 /* FINIT: Raise #MF on pending exception(s): */
8820 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8821 return iemRaiseMathFault(pVCpu);
8822
8823 /*
8824 * Reset the state.
8825 */
8826 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8827
8828 /* Rotate the stack to account for changed TOS. */
8829 iemFpuRotateStackSetTop(&pXState->x87, 0);
8830
8831 pXState->x87.FCW = 0x37f;
8832 pXState->x87.FSW = 0;
8833 pXState->x87.FTW = 0x00; /* 0 - empty. */
8834 /** @todo Intel says the instruction and data pointers are not cleared on
8835 * 387, presume that 8087 and 287 doesn't do so either. */
8836 /** @todo test this stuff. */
8837 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8838 {
8839 pXState->x87.FPUDP = 0;
8840 pXState->x87.DS = 0; //??
8841 pXState->x87.Rsrvd2 = 0;
8842 pXState->x87.FPUIP = 0;
8843 pXState->x87.CS = 0; //??
8844 pXState->x87.Rsrvd1 = 0;
8845 }
8846 pXState->x87.FOP = 0;
8847
8848 iemHlpUsedFpu(pVCpu);
8849 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8850}
8851
8852
8853/**
8854 * Implements 'FXSAVE'.
8855 *
8856 * @param iEffSeg The effective segment.
8857 * @param GCPtrEff The address of the image.
8858 * @param enmEffOpSize The operand size (only REX.W really matters).
8859 */
8860IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8861{
8862 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8863
8864 /** @todo check out bugref{1529} and AMD behaviour */
8865
8866 /*
8867 * Raise exceptions.
8868 */
8869 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8870 return iemRaiseDeviceNotAvailable(pVCpu);
8871
8872 /*
8873 * Access the memory.
8874 */
8875 uint8_t bUnmapInfo;
8876 void *pvMem512;
8877 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512,
8878 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8879 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8880 if (rcStrict != VINF_SUCCESS)
8881 return rcStrict;
8882 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8883 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8884
8885 /*
8886 * Store the registers.
8887 */
8888 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8889 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8890
8891 /* common for all formats */
8892 pDst->FCW = pSrc->FCW;
8893 pDst->FSW = pSrc->FSW;
8894 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8895 pDst->FOP = pSrc->FOP;
8896 pDst->MXCSR = pSrc->MXCSR;
8897 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8898 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8899 {
8900 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8901 * them for now... */
8902 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8903 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8904 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8905 pDst->aRegs[i].au32[3] = 0;
8906 }
8907
8908 /* FPU IP, CS, DP and DS. */
8909 pDst->FPUIP = pSrc->FPUIP;
8910 pDst->CS = pSrc->CS;
8911 pDst->FPUDP = pSrc->FPUDP;
8912 pDst->DS = pSrc->DS;
8913 if (enmEffOpSize == IEMMODE_64BIT)
8914 {
8915 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8916 pDst->Rsrvd1 = pSrc->Rsrvd1;
8917 pDst->Rsrvd2 = pSrc->Rsrvd2;
8918 }
8919 else
8920 {
8921 pDst->Rsrvd1 = 0;
8922 pDst->Rsrvd2 = 0;
8923 }
8924
8925 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set. */
8926 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8927 || !IEM_IS_64BIT_CODE(pVCpu)
8928 || IEM_GET_CPL(pVCpu) != 0)
8929 {
8930 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8931 for (uint32_t i = 0; i < cXmmRegs; i++)
8932 pDst->aXMM[i] = pSrc->aXMM[i];
8933 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8934 * right? */
8935 }
8936
8937 /*
8938 * Commit the memory.
8939 */
8940 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8941 if (rcStrict != VINF_SUCCESS)
8942 return rcStrict;
8943
8944 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8945}
8946
8947
8948/**
8949 * Implements 'FXRSTOR'.
8950 *
8951 * @param iEffSeg The effective segment register for @a GCPtrEff.
8952 * @param GCPtrEff The address of the image.
8953 * @param enmEffOpSize The operand size (only REX.W really matters).
8954 */
8955IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8956{
8957 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8958
8959 /** @todo check out bugref{1529} and AMD behaviour */
8960
8961 /*
8962 * Raise exceptions.
8963 */
8964 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8965 return iemRaiseDeviceNotAvailable(pVCpu);
8966
8967 /*
8968 * Access the memory.
8969 */
8970 uint8_t bUnmapInfo;
8971 void *pvMem512;
8972 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8973 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8974 if (rcStrict != VINF_SUCCESS)
8975 return rcStrict;
8976 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8977 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8978
8979 /*
8980 * Check the state for stuff which will #GP(0).
8981 */
8982 uint32_t const fMXCSR = pSrc->MXCSR;
8983 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8984 if (fMXCSR & ~fMXCSR_MASK)
8985 {
8986 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8987 return iemRaiseGeneralProtectionFault0(pVCpu);
8988 }
8989
8990 /*
8991 * Load the registers.
8992 */
8993 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8994 * implementation specific whether MXCSR and XMM0-XMM7 are
8995 * restored according to Intel.
8996 * AMD says MXCSR and XMM registers are never loaded if
8997 * CR4.OSFXSR=0.
8998 */
8999
9000 /* common for all formats */
9001 pDst->FCW = pSrc->FCW;
9002 pDst->FSW = pSrc->FSW;
9003 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9004 pDst->FOP = pSrc->FOP;
9005 pDst->MXCSR = fMXCSR;
9006 /* (MXCSR_MASK is read-only) */
9007 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9008 {
9009 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9010 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9011 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9012 pDst->aRegs[i].au32[3] = 0;
9013 }
9014
9015 /* FPU IP, CS, DP and DS. */
9016 /** @todo AMD says this is only done if FSW.ES is set after loading. */
9017 if (enmEffOpSize == IEMMODE_64BIT)
9018 {
9019 pDst->FPUIP = pSrc->FPUIP;
9020 pDst->CS = pSrc->CS;
9021 pDst->Rsrvd1 = pSrc->Rsrvd1;
9022 pDst->FPUDP = pSrc->FPUDP;
9023 pDst->DS = pSrc->DS;
9024 pDst->Rsrvd2 = pSrc->Rsrvd2;
9025 }
9026 else
9027 {
9028 pDst->FPUIP = pSrc->FPUIP;
9029 pDst->CS = pSrc->CS;
9030 pDst->Rsrvd1 = 0;
9031 pDst->FPUDP = pSrc->FPUDP;
9032 pDst->DS = pSrc->DS;
9033 pDst->Rsrvd2 = 0;
9034 }
9035
9036 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set.
9037 * Does not affect MXCSR, only registers.
9038 */
9039 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
9040 || !IEM_IS_64BIT_CODE(pVCpu)
9041 || IEM_GET_CPL(pVCpu) != 0)
9042 {
9043 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
9044 for (uint32_t i = 0; i < cXmmRegs; i++)
9045 pDst->aXMM[i] = pSrc->aXMM[i];
9046 }
9047
9048 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9049 iemFpuRecalcExceptionStatus(pDst);
9050
9051 if (pDst->FSW & X86_FSW_ES)
9052 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9053 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9054
9055 /*
9056 * Unmap the memory.
9057 */
9058 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9059 if (rcStrict != VINF_SUCCESS)
9060 return rcStrict;
9061
9062 iemHlpUsedFpu(pVCpu);
9063 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9064}
9065
9066
9067/**
9068 * Implements 'XSAVE'.
9069 *
9070 * @param iEffSeg The effective segment.
9071 * @param GCPtrEff The address of the image.
9072 * @param enmEffOpSize The operand size (only REX.W really matters).
9073 */
9074IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9075{
9076 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9077
9078 /*
9079 * Raise exceptions.
9080 */
9081 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9082 return iemRaiseUndefinedOpcode(pVCpu);
9083 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9084 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9085 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9086 { /* likely */ }
9087 else
9088 {
9089 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9090 return iemRaiseUndefinedOpcode(pVCpu);
9091 }
9092 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9093 return iemRaiseDeviceNotAvailable(pVCpu);
9094
9095 /*
9096 * Calc the requested mask.
9097 */
9098 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9099 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9100 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9101
9102/** @todo figure out the exact protocol for the memory access. Currently we
9103 * just need this crap to work halfways to make it possible to test
9104 * AVX instructions. */
9105/** @todo figure out the XINUSE and XMODIFIED */
9106
9107 /*
9108 * Access the x87 memory state.
9109 */
9110 /* The x87+SSE state. */
9111 uint8_t bUnmapInfoMem512;
9112 void *pvMem512;
9113 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512,
9114 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9115 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9116 if (rcStrict != VINF_SUCCESS)
9117 return rcStrict;
9118 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
9119 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
9120
9121 /* The header. */
9122 uint8_t bUnmapInfoHdr;
9123 PX86XSAVEHDR pHdr;
9124 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, &bUnmapInfoHdr, sizeof(pHdr),
9125 iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
9126 if (rcStrict != VINF_SUCCESS)
9127 return rcStrict;
9128
9129 /*
9130 * Store the X87 state.
9131 */
9132 if (fReqComponents & XSAVE_C_X87)
9133 {
9134 /* common for all formats */
9135 pDst->FCW = pSrc->FCW;
9136 pDst->FSW = pSrc->FSW;
9137 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9138 pDst->FOP = pSrc->FOP;
9139 pDst->FPUIP = pSrc->FPUIP;
9140 pDst->CS = pSrc->CS;
9141 pDst->FPUDP = pSrc->FPUDP;
9142 pDst->DS = pSrc->DS;
9143 if (enmEffOpSize == IEMMODE_64BIT)
9144 {
9145 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9146 pDst->Rsrvd1 = pSrc->Rsrvd1;
9147 pDst->Rsrvd2 = pSrc->Rsrvd2;
9148 }
9149 else
9150 {
9151 pDst->Rsrvd1 = 0;
9152 pDst->Rsrvd2 = 0;
9153 }
9154 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9155 {
9156 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
9157 * them for now... */
9158 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9159 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9160 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9161 pDst->aRegs[i].au32[3] = 0;
9162 }
9163
9164 }
9165
9166 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9167 {
9168 pDst->MXCSR = pSrc->MXCSR;
9169 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9170 }
9171
9172 if (fReqComponents & XSAVE_C_SSE)
9173 {
9174 /* XMM registers. */
9175 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9176 for (uint32_t i = 0; i < cXmmRegs; i++)
9177 pDst->aXMM[i] = pSrc->aXMM[i];
9178 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9179 * right? */
9180 }
9181
9182 /* Commit the x87 state bits. (probably wrong) */
9183 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
9184 if (rcStrict != VINF_SUCCESS)
9185 return rcStrict;
9186
9187 /*
9188 * Store AVX state.
9189 */
9190 if (fReqComponents & XSAVE_C_YMM)
9191 {
9192 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9193 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9194 uint8_t bUnmapInfoComp;
9195 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
9196 PX86XSAVEYMMHI pCompDst;
9197 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, &bUnmapInfoComp, sizeof(*pCompDst), iEffSeg,
9198 GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9199 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
9200 if (rcStrict != VINF_SUCCESS)
9201 return rcStrict;
9202
9203 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9204 for (uint32_t i = 0; i < cXmmRegs; i++)
9205 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
9206
9207 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
9208 if (rcStrict != VINF_SUCCESS)
9209 return rcStrict;
9210 }
9211
9212 /*
9213 * Update the header.
9214 */
9215 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
9216 | (fReqComponents & fXInUse);
9217
9218 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
9219 if (rcStrict != VINF_SUCCESS)
9220 return rcStrict;
9221
9222 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9223}
9224
9225
9226/**
9227 * Implements 'XRSTOR'.
9228 *
9229 * @param iEffSeg The effective segment.
9230 * @param GCPtrEff The address of the image.
9231 * @param enmEffOpSize The operand size (only REX.W really matters).
9232 */
9233IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9234{
9235 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9236
9237 /*
9238 * Raise exceptions.
9239 */
9240 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9241 return iemRaiseUndefinedOpcode(pVCpu);
9242 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9243 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9244 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9245 { /* likely */ }
9246 else
9247 {
9248 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9249 return iemRaiseUndefinedOpcode(pVCpu);
9250 }
9251 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9252 return iemRaiseDeviceNotAvailable(pVCpu);
9253 if (GCPtrEff & 63)
9254 {
9255 /** @todo CPU/VM detection possible! \#AC might not be signal for
9256 * all/any misalignment sizes, intel says its an implementation detail. */
9257 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
9258 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
9259 && IEM_GET_CPL(pVCpu) == 3)
9260 return iemRaiseAlignmentCheckException(pVCpu);
9261 return iemRaiseGeneralProtectionFault0(pVCpu);
9262 }
9263
9264/** @todo figure out the exact protocol for the memory access. Currently we
9265 * just need this crap to work halfways to make it possible to test
9266 * AVX instructions. */
9267/** @todo figure out the XINUSE and XMODIFIED */
9268
9269 /*
9270 * Access the x87 memory state.
9271 */
9272 /* The x87+SSE state. */
9273 uint8_t bUnmapInfoMem512;
9274 void *pvMem512;
9275 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
9276 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9277 if (rcStrict != VINF_SUCCESS)
9278 return rcStrict;
9279 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
9280 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
9281
9282 /*
9283 * Calc the requested mask
9284 */
9285 uint8_t bUnmapInfoHdr;
9286 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
9287 PCX86XSAVEHDR pHdrSrc;
9288 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, &bUnmapInfoHdr, sizeof(*pHdrSrc), iEffSeg, GCPtrEff + 512,
9289 IEM_ACCESS_DATA_R, 0 /* checked above */);
9290 if (rcStrict != VINF_SUCCESS)
9291 return rcStrict;
9292
9293 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9294 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9295 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9296 uint64_t const fRstorMask = pHdrSrc->bmXState;
9297 uint64_t const fCompMask = pHdrSrc->bmXComp;
9298
9299 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9300
9301 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9302
9303 /* We won't need this any longer. */
9304 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
9305 if (rcStrict != VINF_SUCCESS)
9306 return rcStrict;
9307
9308 /*
9309 * Load the X87 state.
9310 */
9311 if (fReqComponents & XSAVE_C_X87)
9312 {
9313 if (fRstorMask & XSAVE_C_X87)
9314 {
9315 pDst->FCW = pSrc->FCW;
9316 pDst->FSW = pSrc->FSW;
9317 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9318 pDst->FOP = pSrc->FOP;
9319 pDst->FPUIP = pSrc->FPUIP;
9320 pDst->CS = pSrc->CS;
9321 pDst->FPUDP = pSrc->FPUDP;
9322 pDst->DS = pSrc->DS;
9323 if (enmEffOpSize == IEMMODE_64BIT)
9324 {
9325 /* Load upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9326 pDst->Rsrvd1 = pSrc->Rsrvd1;
9327 pDst->Rsrvd2 = pSrc->Rsrvd2;
9328 }
9329 else
9330 {
9331 pDst->Rsrvd1 = 0;
9332 pDst->Rsrvd2 = 0;
9333 }
9334 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9335 {
9336 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9337 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9338 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9339 pDst->aRegs[i].au32[3] = 0;
9340 }
9341
9342 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9343 iemFpuRecalcExceptionStatus(pDst);
9344
9345 if (pDst->FSW & X86_FSW_ES)
9346 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9347 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9348 }
9349 else
9350 {
9351 pDst->FCW = 0x37f;
9352 pDst->FSW = 0;
9353 pDst->FTW = 0x00; /* 0 - empty. */
9354 pDst->FPUDP = 0;
9355 pDst->DS = 0; //??
9356 pDst->Rsrvd2= 0;
9357 pDst->FPUIP = 0;
9358 pDst->CS = 0; //??
9359 pDst->Rsrvd1= 0;
9360 pDst->FOP = 0;
9361 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9362 {
9363 pDst->aRegs[i].au32[0] = 0;
9364 pDst->aRegs[i].au32[1] = 0;
9365 pDst->aRegs[i].au32[2] = 0;
9366 pDst->aRegs[i].au32[3] = 0;
9367 }
9368 }
9369 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
9370 }
9371
9372 /* MXCSR */
9373 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9374 {
9375 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
9376 pDst->MXCSR = pSrc->MXCSR;
9377 else
9378 pDst->MXCSR = 0x1f80;
9379 }
9380
9381 /* XMM registers. */
9382 if (fReqComponents & XSAVE_C_SSE)
9383 {
9384 if (fRstorMask & XSAVE_C_SSE)
9385 {
9386 for (uint32_t i = 0; i < cXmmRegs; i++)
9387 pDst->aXMM[i] = pSrc->aXMM[i];
9388 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9389 * right? */
9390 }
9391 else
9392 {
9393 for (uint32_t i = 0; i < cXmmRegs; i++)
9394 {
9395 pDst->aXMM[i].au64[0] = 0;
9396 pDst->aXMM[i].au64[1] = 0;
9397 }
9398 }
9399 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
9400 }
9401
9402 /* Unmap the x87 state bits (so we've don't run out of mapping). */
9403 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
9404 if (rcStrict != VINF_SUCCESS)
9405 return rcStrict;
9406
9407 /*
9408 * Restore AVX state.
9409 */
9410 if (fReqComponents & XSAVE_C_YMM)
9411 {
9412 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9413 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
9414
9415 if (fRstorMask & XSAVE_C_YMM)
9416 {
9417 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9418 uint8_t bUnmapInfoComp;
9419 PCX86XSAVEYMMHI pCompSrc;
9420 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, &bUnmapInfoComp, sizeof(*pCompDst),
9421 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9422 IEM_ACCESS_DATA_R, 0 /* checked above */);
9423 if (rcStrict != VINF_SUCCESS)
9424 return rcStrict;
9425
9426 for (uint32_t i = 0; i < cXmmRegs; i++)
9427 {
9428 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9429 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9430 }
9431
9432 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
9433 if (rcStrict != VINF_SUCCESS)
9434 return rcStrict;
9435 }
9436 else
9437 {
9438 for (uint32_t i = 0; i < cXmmRegs; i++)
9439 {
9440 pCompDst->aYmmHi[i].au64[0] = 0;
9441 pCompDst->aYmmHi[i].au64[1] = 0;
9442 }
9443 }
9444 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9445 }
9446
9447 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9448}
9449
9450
9451
9452
9453/**
9454 * Implements 'STMXCSR'.
9455 *
9456 * @param iEffSeg The effective segment register for @a GCPtrEff.
9457 * @param GCPtrEff The address of the image.
9458 */
9459IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9460{
9461 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9462
9463 /*
9464 * Raise exceptions.
9465 */
9466 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9467 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9468 {
9469 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9470 {
9471 /*
9472 * Do the job.
9473 */
9474 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9475 if (rcStrict == VINF_SUCCESS)
9476 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9477 return rcStrict;
9478 }
9479 return iemRaiseDeviceNotAvailable(pVCpu);
9480 }
9481 return iemRaiseUndefinedOpcode(pVCpu);
9482}
9483
9484
9485/**
9486 * Implements 'VSTMXCSR'.
9487 *
9488 * @param iEffSeg The effective segment register for @a GCPtrEff.
9489 * @param GCPtrEff The address of the image.
9490 */
9491IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9492{
9493 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9494
9495 /*
9496 * Raise exceptions.
9497 */
9498 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9499 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9500 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9501 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9502 {
9503 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9504 {
9505 /*
9506 * Do the job.
9507 */
9508 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9509 if (rcStrict == VINF_SUCCESS)
9510 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9511 return rcStrict;
9512 }
9513 return iemRaiseDeviceNotAvailable(pVCpu);
9514 }
9515 return iemRaiseUndefinedOpcode(pVCpu);
9516}
9517
9518
9519/**
9520 * Implements 'LDMXCSR'.
9521 *
9522 * @param iEffSeg The effective segment register for @a GCPtrEff.
9523 * @param GCPtrEff The address of the image.
9524 */
9525IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9526{
9527 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9528
9529 /*
9530 * Raise exceptions.
9531 */
9532 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9533 * happen after or before \#UD and \#EM? */
9534 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9535 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9536 {
9537 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9538 {
9539 /*
9540 * Do the job.
9541 */
9542 uint32_t fNewMxCsr;
9543 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9544 if (rcStrict == VINF_SUCCESS)
9545 {
9546 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9547 if (!(fNewMxCsr & ~fMxCsrMask))
9548 {
9549 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9550 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9551 }
9552 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9553 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9554 return iemRaiseGeneralProtectionFault0(pVCpu);
9555 }
9556 return rcStrict;
9557 }
9558 return iemRaiseDeviceNotAvailable(pVCpu);
9559 }
9560 return iemRaiseUndefinedOpcode(pVCpu);
9561}
9562
9563
9564/**
9565 * Commmon routine for fnstenv and fnsave.
9566 *
9567 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9568 * @param enmEffOpSize The effective operand size.
9569 * @param uPtr Where to store the state.
9570 */
9571static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9572{
9573 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9574 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9575 if (enmEffOpSize == IEMMODE_16BIT)
9576 {
9577 uPtr.pu16[0] = pSrcX87->FCW;
9578 uPtr.pu16[1] = pSrcX87->FSW;
9579 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9580 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9581 {
9582 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9583 * protected mode or long mode and we save it in real mode? And vice
9584 * versa? And with 32-bit operand size? I think CPU is storing the
9585 * effective address ((CS << 4) + IP) in the offset register and not
9586 * doing any address calculations here. */
9587 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9588 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9589 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9590 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9591 }
9592 else
9593 {
9594 uPtr.pu16[3] = pSrcX87->FPUIP;
9595 uPtr.pu16[4] = pSrcX87->CS;
9596 uPtr.pu16[5] = pSrcX87->FPUDP;
9597 uPtr.pu16[6] = pSrcX87->DS;
9598 }
9599 }
9600 else
9601 {
9602 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9603 uPtr.pu16[0*2] = pSrcX87->FCW;
9604 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9605 uPtr.pu16[1*2] = pSrcX87->FSW;
9606 uPtr.pu16[1*2+1] = 0xffff;
9607 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9608 uPtr.pu16[2*2+1] = 0xffff;
9609 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9610 {
9611 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9612 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9613 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9614 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9615 }
9616 else
9617 {
9618 uPtr.pu32[3] = pSrcX87->FPUIP;
9619 uPtr.pu16[4*2] = pSrcX87->CS;
9620 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9621 uPtr.pu32[5] = pSrcX87->FPUDP;
9622 uPtr.pu16[6*2] = pSrcX87->DS;
9623 uPtr.pu16[6*2+1] = 0xffff;
9624 }
9625 }
9626}
9627
9628
9629/**
9630 * Commmon routine for fldenv and frstor
9631 *
9632 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9633 * @param enmEffOpSize The effective operand size.
9634 * @param uPtr Where to store the state.
9635 */
9636static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9637{
9638 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9639 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9640 if (enmEffOpSize == IEMMODE_16BIT)
9641 {
9642 pDstX87->FCW = uPtr.pu16[0];
9643 pDstX87->FSW = uPtr.pu16[1];
9644 pDstX87->FTW = uPtr.pu16[2];
9645 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9646 {
9647 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9648 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9649 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9650 pDstX87->CS = 0;
9651 pDstX87->Rsrvd1= 0;
9652 pDstX87->DS = 0;
9653 pDstX87->Rsrvd2= 0;
9654 }
9655 else
9656 {
9657 pDstX87->FPUIP = uPtr.pu16[3];
9658 pDstX87->CS = uPtr.pu16[4];
9659 pDstX87->Rsrvd1= 0;
9660 pDstX87->FPUDP = uPtr.pu16[5];
9661 pDstX87->DS = uPtr.pu16[6];
9662 pDstX87->Rsrvd2= 0;
9663 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9664 }
9665 }
9666 else
9667 {
9668 pDstX87->FCW = uPtr.pu16[0*2];
9669 pDstX87->FSW = uPtr.pu16[1*2];
9670 pDstX87->FTW = uPtr.pu16[2*2];
9671 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9672 {
9673 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9674 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9675 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9676 pDstX87->CS = 0;
9677 pDstX87->Rsrvd1= 0;
9678 pDstX87->DS = 0;
9679 pDstX87->Rsrvd2= 0;
9680 }
9681 else
9682 {
9683 pDstX87->FPUIP = uPtr.pu32[3];
9684 pDstX87->CS = uPtr.pu16[4*2];
9685 pDstX87->Rsrvd1= 0;
9686 pDstX87->FOP = uPtr.pu16[4*2+1];
9687 pDstX87->FPUDP = uPtr.pu32[5];
9688 pDstX87->DS = uPtr.pu16[6*2];
9689 pDstX87->Rsrvd2= 0;
9690 }
9691 }
9692
9693 /* Make adjustments. */
9694 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9695#ifdef LOG_ENABLED
9696 uint16_t const fOldFsw = pDstX87->FSW;
9697#endif
9698 pDstX87->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9699 iemFpuRecalcExceptionStatus(pDstX87);
9700#ifdef LOG_ENABLED
9701 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9702 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9703 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9704 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9705#endif
9706
9707 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9708 * exceptions are pending after loading the saved state? */
9709}
9710
9711
9712/**
9713 * Implements 'FNSTENV'.
9714 *
9715 * @param enmEffOpSize The operand size (only REX.W really matters).
9716 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9717 * @param GCPtrEffDst The address of the image.
9718 */
9719IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9720{
9721 uint8_t bUnmapInfo;
9722 RTPTRUNION uPtr;
9723 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9724 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9725 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9726 if (rcStrict != VINF_SUCCESS)
9727 return rcStrict;
9728
9729 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9730
9731 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9732 if (rcStrict != VINF_SUCCESS)
9733 return rcStrict;
9734
9735 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9736 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9737 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9738#ifdef LOG_ENABLED
9739 uint16_t fOldFsw = pFpuCtx->FSW;
9740#endif
9741 iemFpuRecalcExceptionStatus(pFpuCtx);
9742#ifdef LOG_ENABLED
9743 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9744 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9745 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9746#endif
9747
9748 iemHlpUsedFpu(pVCpu);
9749
9750 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9751 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9752}
9753
9754
9755/**
9756 * Implements 'FNSAVE'.
9757 *
9758 * @param enmEffOpSize The operand size.
9759 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9760 * @param GCPtrEffDst The address of the image.
9761 */
9762IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9763{
9764 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9765
9766 uint8_t bUnmapInfo;
9767 RTPTRUNION uPtr;
9768 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9769 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9770 if (rcStrict != VINF_SUCCESS)
9771 return rcStrict;
9772
9773 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9774 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9775 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9776 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9777 {
9778 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9779 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9780 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9781 }
9782
9783 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9784 if (rcStrict != VINF_SUCCESS)
9785 return rcStrict;
9786
9787 /* Rotate the stack to account for changed TOS. */
9788 iemFpuRotateStackSetTop(pFpuCtx, 0);
9789
9790 /*
9791 * Re-initialize the FPU context.
9792 */
9793 pFpuCtx->FCW = 0x37f;
9794 pFpuCtx->FSW = 0;
9795 pFpuCtx->FTW = 0x00; /* 0 - empty */
9796 pFpuCtx->FPUDP = 0;
9797 pFpuCtx->DS = 0;
9798 pFpuCtx->Rsrvd2= 0;
9799 pFpuCtx->FPUIP = 0;
9800 pFpuCtx->CS = 0;
9801 pFpuCtx->Rsrvd1= 0;
9802 pFpuCtx->FOP = 0;
9803
9804 iemHlpUsedFpu(pVCpu);
9805 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9806}
9807
9808
9809
9810/**
9811 * Implements 'FLDENV'.
9812 *
9813 * @param enmEffOpSize The operand size (only REX.W really matters).
9814 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9815 * @param GCPtrEffSrc The address of the image.
9816 */
9817IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9818{
9819 uint8_t bUnmapInfo;
9820 RTCPTRUNION uPtr;
9821 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9822 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9823 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9824 if (rcStrict != VINF_SUCCESS)
9825 return rcStrict;
9826
9827 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9828
9829 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9830 if (rcStrict != VINF_SUCCESS)
9831 return rcStrict;
9832
9833 iemHlpUsedFpu(pVCpu);
9834 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9835}
9836
9837
9838/**
9839 * Implements 'FRSTOR'.
9840 *
9841 * @param enmEffOpSize The operand size.
9842 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9843 * @param GCPtrEffSrc The address of the image.
9844 */
9845IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9846{
9847 uint8_t bUnmapInfo;
9848 RTCPTRUNION uPtr;
9849 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9850 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9851 if (rcStrict != VINF_SUCCESS)
9852 return rcStrict;
9853
9854 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9855 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9856 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9857 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9858 {
9859 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9860 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9861 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9862 pFpuCtx->aRegs[i].au32[3] = 0;
9863 }
9864
9865 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9866 if (rcStrict != VINF_SUCCESS)
9867 return rcStrict;
9868
9869 iemHlpUsedFpu(pVCpu);
9870 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9871}
9872
9873
9874/**
9875 * Implements 'FLDCW'.
9876 *
9877 * @param u16Fcw The new FCW.
9878 */
9879IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9880{
9881 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9882
9883 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9884 /** @todo Testcase: Try see what happens when trying to set undefined bits
9885 * (other than 6 and 7). Currently ignoring them. */
9886 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9887 * according to FSW. (This is what is currently implemented.) */
9888 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9889 pFpuCtx->FCW = u16Fcw & (~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK); /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9890#ifdef LOG_ENABLED
9891 uint16_t fOldFsw = pFpuCtx->FSW;
9892#endif
9893 iemFpuRecalcExceptionStatus(pFpuCtx);
9894#ifdef LOG_ENABLED
9895 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9896 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9897 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9898#endif
9899
9900 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9901 iemHlpUsedFpu(pVCpu);
9902 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9903}
9904
9905
9906
9907/**
9908 * Implements the underflow case of fxch.
9909 *
9910 * @param iStReg The other stack register.
9911 * @param uFpuOpcode The FPU opcode (for simplicity).
9912 */
9913IEM_CIMPL_DEF_2(iemCImpl_fxch_underflow, uint8_t, iStReg, uint16_t, uFpuOpcode)
9914{
9915 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9916
9917 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9918 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9919 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9920 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9921
9922 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9923 * registers are read as QNaN and then exchanged. This could be
9924 * wrong... */
9925 if (pFpuCtx->FCW & X86_FCW_IM)
9926 {
9927 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9928 {
9929 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9930 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9931 else
9932 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9933 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9934 }
9935 else
9936 {
9937 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9938 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9939 }
9940 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9941 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9942 }
9943 else
9944 {
9945 /* raise underflow exception, don't change anything. */
9946 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9947 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9948 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9949 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9950 }
9951
9952 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, uFpuOpcode);
9953 iemHlpUsedFpu(pVCpu);
9954 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9955}
9956
9957
9958/**
9959 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9960 *
9961 * @param iStReg The other stack register.
9962 * @param fUCmp true for FUCOMI[P], false for FCOMI[P].
9963 * @param uPopAndFpuOpcode Bits 15-0: The FPU opcode.
9964 * Bit 31: Whether we should pop the stack when
9965 * done or not.
9966 */
9967IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, bool, fUCmp, uint32_t, uPopAndFpuOpcode)
9968{
9969 Assert(iStReg < 8);
9970 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9971
9972 /*
9973 * Raise exceptions.
9974 */
9975 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9976 return iemRaiseDeviceNotAvailable(pVCpu);
9977
9978 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9979 uint16_t u16Fsw = pFpuCtx->FSW;
9980 if (u16Fsw & X86_FSW_ES)
9981 return iemRaiseMathFault(pVCpu);
9982
9983 /*
9984 * Check if any of the register accesses causes #SF + #IA.
9985 */
9986 bool fPop = RT_BOOL(uPopAndFpuOpcode & RT_BIT_32(31));
9987 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9988 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9989 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9990 {
9991 uint32_t u32Eflags;
9992 if (!fUCmp)
9993 u32Eflags = iemAImpl_fcomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9994 else
9995 u32Eflags = iemAImpl_fucomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9996
9997 pFpuCtx->FSW &= ~X86_FSW_C1;
9998 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9999 if ( !(u16Fsw & X86_FSW_IE)
10000 || (pFpuCtx->FCW & X86_FCW_IM) )
10001 {
10002 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10003 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10004 }
10005 }
10006 else if (pFpuCtx->FCW & X86_FCW_IM)
10007 {
10008 /* Masked underflow. */
10009 pFpuCtx->FSW &= ~X86_FSW_C1;
10010 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
10011 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10012 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
10013 }
10014 else
10015 {
10016 /* Raise underflow - don't touch EFLAGS or TOP. */
10017 pFpuCtx->FSW &= ~X86_FSW_C1;
10018 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
10019 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
10020 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
10021 fPop = false;
10022 }
10023
10024 /*
10025 * Pop if necessary.
10026 */
10027 if (fPop)
10028 {
10029 pFpuCtx->FTW &= ~RT_BIT(iReg1);
10030 iemFpuStackIncTop(pVCpu);
10031 }
10032
10033 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, (uint16_t)uPopAndFpuOpcode);
10034 iemHlpUsedFpu(pVCpu);
10035 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10036}
10037
10038
10039/**
10040 * Implements 'RDSEED'.
10041 *
10042 * @returns VINF_SUCCESS.
10043 * @param iReg The register.
10044 * @param enmEffOpSize The operand size.
10045 */
10046IEM_CIMPL_DEF_2(iemCImpl_rdseed, uint8_t, iReg, IEMMODE, enmEffOpSize)
10047{
10048#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10049 /* Nested-guest VMX intercept. */
10050 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
10051 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDSEED_EXIT))
10052 { /* probable */ }
10053 else
10054 {
10055 Log(("rdseed: Guest intercept -> VM-exit\n"));
10056 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDSEED, VMXINSTRID_RDSEED, cbInstr);
10057 }
10058#endif
10059
10060 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
10061 switch (enmEffOpSize)
10062 {
10063 case IEMMODE_16BIT:
10064 {
10065 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10066 &iemAImpl_rdseed_u16,
10067 &iemAImpl_rdseed_u16_fallback);
10068 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
10069 (pfnImpl)(pu16Dst, pEFlags);
10070 break;
10071 }
10072 case IEMMODE_32BIT:
10073 {
10074 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10075 &iemAImpl_rdseed_u32,
10076 &iemAImpl_rdseed_u32_fallback);
10077 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10078 (pfnImpl)(pu32Dst, pEFlags);
10079 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10080 break;
10081 }
10082 case IEMMODE_64BIT:
10083 {
10084 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10085 &iemAImpl_rdseed_u64,
10086 &iemAImpl_rdseed_u64_fallback);
10087 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10088 (pfnImpl)(pu64Dst, pEFlags);
10089 break;
10090 }
10091 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10092 }
10093 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10094}
10095
10096
10097/**
10098 * Implements 'RDRAND'.
10099 *
10100 * @returns VINF_SUCCESS.
10101 * @param iReg The register.
10102 * @param enmEffOpSize The operand size.
10103 */
10104IEM_CIMPL_DEF_2(iemCImpl_rdrand, uint8_t, iReg, IEMMODE, enmEffOpSize)
10105{
10106#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10107 /* Nested-guest VMX intercept. */
10108 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
10109 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDRAND_EXIT))
10110 { /* probable */ }
10111 else
10112 {
10113 Log(("rdrand: Guest intercept -> VM-exit\n"));
10114 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDRAND, VMXINSTRID_RDRAND, cbInstr);
10115 }
10116#endif
10117
10118 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
10119 switch (enmEffOpSize)
10120 {
10121 case IEMMODE_16BIT:
10122 {
10123 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u16,
10124 &iemAImpl_rdrand_u16_fallback);
10125 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
10126 (pfnImpl)(pu16Dst, pEFlags);
10127 break;
10128 }
10129 case IEMMODE_32BIT:
10130 {
10131 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u32,
10132 &iemAImpl_rdrand_u32_fallback);
10133 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10134 (pfnImpl)(pu32Dst, pEFlags);
10135 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10136 break;
10137 }
10138 case IEMMODE_64BIT:
10139 {
10140 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u64,
10141 &iemAImpl_rdrand_u64_fallback);
10142 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10143 (pfnImpl)(pu64Dst, pEFlags);
10144 break;
10145 }
10146 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10147 }
10148 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10149}
10150
10151/** @} */
10152
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette