VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 104354

Last change on this file since 104354 was 104195, checked in by vboxsync, 10 months ago

VMM/IEM: Refactoring assembly helpers to not pass eflags by reference but instead by value and return the updated value (via eax/w0) - first chunk: ADD,ADC,SUB,SBB,CMP,TEST,AND,OR,XOR. bugref:10376
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 371.7 KB
Line 
1/* $Id: IEMAllCImpl.cpp 104195 2024-04-05 14:45:23Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#define IEM_WITH_OPAQUE_DECODER_STATE
35#include <VBox/vmm/iem.h>
36#include <VBox/vmm/cpum.h>
37#include <VBox/vmm/apic.h>
38#include <VBox/vmm/pdm.h>
39#include <VBox/vmm/pgm.h>
40#include <VBox/vmm/iom.h>
41#include <VBox/vmm/em.h>
42#include <VBox/vmm/hm.h>
43#include <VBox/vmm/nem.h>
44#include <VBox/vmm/gim.h>
45#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
46# include <VBox/vmm/em.h>
47# include <VBox/vmm/hm_svm.h>
48#endif
49#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
50# include <VBox/vmm/hmvmxinline.h>
51#endif
52#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
53# include <VBox/vmm/cpuidcall.h>
54#endif
55#include <VBox/vmm/tm.h>
56#include <VBox/vmm/dbgf.h>
57#include <VBox/vmm/dbgftrace.h>
58#include "IEMInternal.h"
59#include <VBox/vmm/vmcc.h>
60#include <VBox/log.h>
61#include <VBox/err.h>
62#include <VBox/param.h>
63#include <VBox/dis.h>
64#include <iprt/asm-math.h>
65#include <iprt/assert.h>
66#include <iprt/string.h>
67#include <iprt/x86.h>
68
69#include "IEMInline.h"
70
71
72/*********************************************************************************************************************************
73* Defined Constants And Macros *
74*********************************************************************************************************************************/
75/**
76 * Flushes the prefetch buffer, light version.
77 * @todo The \#if conditions here must match the ones in iemOpcodeFlushLight().
78 */
79#ifndef IEM_WITH_CODE_TLB
80# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) iemOpcodeFlushLight(a_pVCpu, a_cbInstr)
81#else
82# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { } while (0)
83#endif
84
85/**
86 * Flushes the prefetch buffer, heavy version.
87 * @todo The \#if conditions here must match the ones in iemOpcodeFlushHeavy().
88 */
89#if !defined(IEM_WITH_CODE_TLB) || 1
90# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) iemOpcodeFlushHeavy(a_pVCpu, a_cbInstr)
91#else
92# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { } while (0)
93#endif
94
95
96
97/** @name Misc Helpers
98 * @{
99 */
100
101
102/**
103 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
104 *
105 * @returns Strict VBox status code.
106 *
107 * @param pVCpu The cross context virtual CPU structure of the calling thread.
108 * @param u16Port The port number.
109 * @param cbOperand The operand size.
110 */
111static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
112{
113 /* The TSS bits we're interested in are the same on 386 and AMD64. */
114 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
115 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
116 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
117 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
118
119 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
120
121 /*
122 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
123 */
124 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
125 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
126 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
127 {
128 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
129 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
130 return iemRaiseGeneralProtectionFault0(pVCpu);
131 }
132
133 /*
134 * Read the bitmap offset (may #PF).
135 */
136 uint16_t offBitmap;
137 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
138 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
139 if (rcStrict != VINF_SUCCESS)
140 {
141 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
142 return rcStrict;
143 }
144
145 /*
146 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
147 * describes the CPU actually reading two bytes regardless of whether the
148 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
149 */
150 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
151 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
152 * for instance sizeof(X86TSS32). */
153 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
154 {
155 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
156 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
157 return iemRaiseGeneralProtectionFault0(pVCpu);
158 }
159
160 /*
161 * Read the necessary bits.
162 */
163 /** @todo Test the assertion in the intel manual that the CPU reads two
164 * bytes. The question is how this works wrt to \#PF and \#GP on the
165 * 2nd byte when it's not required. */
166 uint16_t bmBytes = UINT16_MAX;
167 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
168 if (rcStrict != VINF_SUCCESS)
169 {
170 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
171 return rcStrict;
172 }
173
174 /*
175 * Perform the check.
176 */
177 uint16_t fPortMask = (1 << cbOperand) - 1;
178 bmBytes >>= (u16Port & 7);
179 if (bmBytes & fPortMask)
180 {
181 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
182 u16Port, cbOperand, bmBytes, fPortMask));
183 return iemRaiseGeneralProtectionFault0(pVCpu);
184 }
185
186 return VINF_SUCCESS;
187}
188
189
190/**
191 * Checks if we are allowed to access the given I/O port, raising the
192 * appropriate exceptions if we aren't (or if the I/O bitmap is not
193 * accessible).
194 *
195 * @returns Strict VBox status code.
196 *
197 * @param pVCpu The cross context virtual CPU structure of the calling thread.
198 * @param u16Port The port number.
199 * @param cbOperand The operand size.
200 */
201DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
202{
203 X86EFLAGS Efl;
204 Efl.u = IEMMISC_GET_EFL(pVCpu);
205 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
206 && ( IEM_GET_CPL(pVCpu) > Efl.Bits.u2IOPL
207 || Efl.Bits.u1VM) )
208 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
209 return VINF_SUCCESS;
210}
211
212
213#if 0
214/**
215 * Calculates the parity bit.
216 *
217 * @returns true if the bit is set, false if not.
218 * @param u8Result The least significant byte of the result.
219 */
220static bool iemHlpCalcParityFlag(uint8_t u8Result)
221{
222 /*
223 * Parity is set if the number of bits in the least significant byte of
224 * the result is even.
225 */
226 uint8_t cBits;
227 cBits = u8Result & 1; /* 0 */
228 u8Result >>= 1;
229 cBits += u8Result & 1;
230 u8Result >>= 1;
231 cBits += u8Result & 1;
232 u8Result >>= 1;
233 cBits += u8Result & 1;
234 u8Result >>= 1;
235 cBits += u8Result & 1; /* 4 */
236 u8Result >>= 1;
237 cBits += u8Result & 1;
238 u8Result >>= 1;
239 cBits += u8Result & 1;
240 u8Result >>= 1;
241 cBits += u8Result & 1;
242 return !(cBits & 1);
243}
244#endif /* not used */
245
246
247/**
248 * Updates the specified flags according to a 8-bit result.
249 *
250 * @param pVCpu The cross context virtual CPU structure of the calling thread.
251 * @param u8Result The result to set the flags according to.
252 * @param fToUpdate The flags to update.
253 * @param fUndefined The flags that are specified as undefined.
254 */
255static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
256{
257 uint32_t fEFlags = iemAImpl_test_u8(pVCpu->cpum.GstCtx.eflags.u, &u8Result, u8Result);
258 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
259 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
260}
261
262
263/**
264 * Updates the specified flags according to a 16-bit result.
265 *
266 * @param pVCpu The cross context virtual CPU structure of the calling thread.
267 * @param u16Result The result to set the flags according to.
268 * @param fToUpdate The flags to update.
269 * @param fUndefined The flags that are specified as undefined.
270 */
271static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
272{
273 uint32_t fEFlags = iemAImpl_test_u16(pVCpu->cpum.GstCtx.eflags.u, &u16Result, u16Result);
274 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
275 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
276}
277
278
279/**
280 * Helper used by iret.
281 *
282 * @param pVCpu The cross context virtual CPU structure of the calling thread.
283 * @param uCpl The new CPL.
284 * @param pSReg Pointer to the segment register.
285 */
286static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
287{
288 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
289 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
290
291 if ( uCpl > pSReg->Attr.n.u2Dpl
292 && pSReg->Attr.n.u1DescType /* code or data, not system */
293 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
294 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
295 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
296}
297
298
299/**
300 * Indicates that we have modified the FPU state.
301 *
302 * @param pVCpu The cross context virtual CPU structure of the calling thread.
303 */
304DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
305{
306 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
307}
308
309/** @} */
310
311/** @name C Implementations
312 * @{
313 */
314
315
316/**
317 * Implements a pop [mem16].
318 */
319IEM_CIMPL_DEF_2(iemCImpl_pop_mem16, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
320{
321 uint16_t u16Value;
322 RTUINT64U TmpRsp;
323 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
324 VBOXSTRICTRC rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
325 if (rcStrict == VINF_SUCCESS)
326 {
327 rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
328 if (rcStrict == VINF_SUCCESS)
329 {
330 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
331 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
332 }
333 }
334 return rcStrict;
335
336}
337
338
339/**
340 * Implements a pop [mem32].
341 */
342IEM_CIMPL_DEF_2(iemCImpl_pop_mem32, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
343{
344 uint32_t u32Value;
345 RTUINT64U TmpRsp;
346 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
347 VBOXSTRICTRC rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
348 if (rcStrict == VINF_SUCCESS)
349 {
350 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEffDst, u32Value);
351 if (rcStrict == VINF_SUCCESS)
352 {
353 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
354 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
355 }
356 }
357 return rcStrict;
358
359}
360
361
362/**
363 * Implements a pop [mem64].
364 */
365IEM_CIMPL_DEF_2(iemCImpl_pop_mem64, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
366{
367 uint64_t u64Value;
368 RTUINT64U TmpRsp;
369 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
370 VBOXSTRICTRC rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
371 if (rcStrict == VINF_SUCCESS)
372 {
373 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrEffDst, u64Value);
374 if (rcStrict == VINF_SUCCESS)
375 {
376 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
377 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
378 }
379 }
380 return rcStrict;
381
382}
383
384
385/**
386 * Implements a 16-bit popa.
387 */
388IEM_CIMPL_DEF_0(iemCImpl_popa_16)
389{
390 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
391 RTGCPTR GCPtrLast = GCPtrStart + 15;
392 VBOXSTRICTRC rcStrict;
393
394 /*
395 * The docs are a bit hard to comprehend here, but it looks like we wrap
396 * around in real mode as long as none of the individual "popa" crosses the
397 * end of the stack segment. In protected mode we check the whole access
398 * in one go. For efficiency, only do the word-by-word thing if we're in
399 * danger of wrapping around.
400 */
401 /** @todo do popa boundary / wrap-around checks. */
402 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
403 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
404 {
405 /* word-by-word */
406 RTUINT64U TmpRsp;
407 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
408 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
409 if (rcStrict == VINF_SUCCESS)
410 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
411 if (rcStrict == VINF_SUCCESS)
412 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
413 if (rcStrict == VINF_SUCCESS)
414 {
415 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
416 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
417 }
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 {
426 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
427 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
428 }
429 }
430 else
431 {
432 uint8_t bUnmapInfo;
433 uint16_t const *pau16Mem = NULL;
434 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrStart,
435 IEM_ACCESS_STACK_R, sizeof(*pau16Mem) - 1);
436 if (rcStrict == VINF_SUCCESS)
437 {
438 pVCpu->cpum.GstCtx.di = pau16Mem[7 - X86_GREG_xDI];
439 pVCpu->cpum.GstCtx.si = pau16Mem[7 - X86_GREG_xSI];
440 pVCpu->cpum.GstCtx.bp = pau16Mem[7 - X86_GREG_xBP];
441 /* skip sp */
442 pVCpu->cpum.GstCtx.bx = pau16Mem[7 - X86_GREG_xBX];
443 pVCpu->cpum.GstCtx.dx = pau16Mem[7 - X86_GREG_xDX];
444 pVCpu->cpum.GstCtx.cx = pau16Mem[7 - X86_GREG_xCX];
445 pVCpu->cpum.GstCtx.ax = pau16Mem[7 - X86_GREG_xAX];
446 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
447 if (rcStrict == VINF_SUCCESS)
448 {
449 iemRegAddToRsp(pVCpu, 16);
450 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
451 }
452 }
453 }
454 return rcStrict;
455}
456
457
458/**
459 * Implements a 32-bit popa.
460 */
461IEM_CIMPL_DEF_0(iemCImpl_popa_32)
462{
463 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
464 RTGCPTR GCPtrLast = GCPtrStart + 31;
465 VBOXSTRICTRC rcStrict;
466
467 /*
468 * The docs are a bit hard to comprehend here, but it looks like we wrap
469 * around in real mode as long as none of the individual "popa" crosses the
470 * end of the stack segment. In protected mode we check the whole access
471 * in one go. For efficiency, only do the word-by-word thing if we're in
472 * danger of wrapping around.
473 */
474 /** @todo do popa boundary / wrap-around checks. */
475 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
476 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
477 {
478 /* word-by-word */
479 RTUINT64U TmpRsp;
480 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
481 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 {
488 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
489 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
490 }
491 if (rcStrict == VINF_SUCCESS)
492 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
493 if (rcStrict == VINF_SUCCESS)
494 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
495 if (rcStrict == VINF_SUCCESS)
496 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
497 if (rcStrict == VINF_SUCCESS)
498 {
499#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
500 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
501 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
502 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
503 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
504 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
505 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
506 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
507#endif
508 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
509 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
510 }
511 }
512 else
513 {
514 uint8_t bUnmapInfo;
515 uint32_t const *pau32Mem;
516 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrStart,
517 IEM_ACCESS_STACK_R, sizeof(*pau32Mem) - 1);
518 if (rcStrict == VINF_SUCCESS)
519 {
520 pVCpu->cpum.GstCtx.rdi = pau32Mem[7 - X86_GREG_xDI];
521 pVCpu->cpum.GstCtx.rsi = pau32Mem[7 - X86_GREG_xSI];
522 pVCpu->cpum.GstCtx.rbp = pau32Mem[7 - X86_GREG_xBP];
523 /* skip esp */
524 pVCpu->cpum.GstCtx.rbx = pau32Mem[7 - X86_GREG_xBX];
525 pVCpu->cpum.GstCtx.rdx = pau32Mem[7 - X86_GREG_xDX];
526 pVCpu->cpum.GstCtx.rcx = pau32Mem[7 - X86_GREG_xCX];
527 pVCpu->cpum.GstCtx.rax = pau32Mem[7 - X86_GREG_xAX];
528 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
529 if (rcStrict == VINF_SUCCESS)
530 {
531 iemRegAddToRsp(pVCpu, 32);
532 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
533 }
534 }
535 }
536 return rcStrict;
537}
538
539
540/**
541 * Implements a 16-bit pusha.
542 */
543IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
544{
545 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
546 RTGCPTR GCPtrBottom = GCPtrTop - 15;
547 VBOXSTRICTRC rcStrict;
548
549 /*
550 * The docs are a bit hard to comprehend here, but it looks like we wrap
551 * around in real mode as long as none of the individual "pushd" crosses the
552 * end of the stack segment. In protected mode we check the whole access
553 * in one go. For efficiency, only do the word-by-word thing if we're in
554 * danger of wrapping around.
555 */
556 /** @todo do pusha boundary / wrap-around checks. */
557 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
558 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
559 {
560 /* word-by-word */
561 RTUINT64U TmpRsp;
562 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
563 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
564 if (rcStrict == VINF_SUCCESS)
565 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
566 if (rcStrict == VINF_SUCCESS)
567 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
568 if (rcStrict == VINF_SUCCESS)
569 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
570 if (rcStrict == VINF_SUCCESS)
571 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
572 if (rcStrict == VINF_SUCCESS)
573 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
574 if (rcStrict == VINF_SUCCESS)
575 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
576 if (rcStrict == VINF_SUCCESS)
577 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
578 if (rcStrict == VINF_SUCCESS)
579 {
580 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
581 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
582 }
583 }
584 else
585 {
586 GCPtrBottom--;
587 uint8_t bUnmapInfo;
588 uint16_t *pau16Mem = NULL;
589 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrBottom,
590 IEM_ACCESS_STACK_W, sizeof(*pau16Mem) - 1);
591 if (rcStrict == VINF_SUCCESS)
592 {
593 pau16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
594 pau16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
595 pau16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
596 pau16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
597 pau16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
598 pau16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
599 pau16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
600 pau16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
601 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
602 if (rcStrict == VINF_SUCCESS)
603 {
604 iemRegSubFromRsp(pVCpu, 16);
605 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
606 }
607 }
608 }
609 return rcStrict;
610}
611
612
613/**
614 * Implements a 32-bit pusha.
615 */
616IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
617{
618 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
619 RTGCPTR GCPtrBottom = GCPtrTop - 31;
620 VBOXSTRICTRC rcStrict;
621
622 /*
623 * The docs are a bit hard to comprehend here, but it looks like we wrap
624 * around in real mode as long as none of the individual "pusha" crosses the
625 * end of the stack segment. In protected mode we check the whole access
626 * in one go. For efficiency, only do the word-by-word thing if we're in
627 * danger of wrapping around.
628 */
629 /** @todo do pusha boundary / wrap-around checks. */
630 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
631 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
632 {
633 /* word-by-word */
634 RTUINT64U TmpRsp;
635 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
636 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
637 if (rcStrict == VINF_SUCCESS)
638 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
639 if (rcStrict == VINF_SUCCESS)
640 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
641 if (rcStrict == VINF_SUCCESS)
642 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
643 if (rcStrict == VINF_SUCCESS)
644 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
645 if (rcStrict == VINF_SUCCESS)
646 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
647 if (rcStrict == VINF_SUCCESS)
648 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
649 if (rcStrict == VINF_SUCCESS)
650 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
651 if (rcStrict == VINF_SUCCESS)
652 {
653 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
654 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
655 }
656 }
657 else
658 {
659 GCPtrBottom--;
660 uint8_t bUnmapInfo;
661 uint32_t *pau32Mem;
662 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrBottom,
663 IEM_ACCESS_STACK_W, sizeof(*pau32Mem) - 1);
664 if (rcStrict == VINF_SUCCESS)
665 {
666 pau32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
667 pau32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
668 pau32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
669 pau32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
670 pau32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
671 pau32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
672 pau32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
673 pau32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
674 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
675 if (rcStrict == VINF_SUCCESS)
676 {
677 iemRegSubFromRsp(pVCpu, 32);
678 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
679 }
680 }
681 }
682 return rcStrict;
683}
684
685
686/**
687 * Implements pushf.
688 *
689 *
690 * @param enmEffOpSize The effective operand size.
691 */
692IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
693{
694 VBOXSTRICTRC rcStrict;
695
696 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
697 { /* probable */ }
698 else
699 {
700 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
701 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
702 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
703 }
704
705 /*
706 * If we're in V8086 mode some care is required (which is why we're in
707 * doing this in a C implementation).
708 */
709 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
710 if ( (fEfl & X86_EFL_VM)
711 && X86_EFL_GET_IOPL(fEfl) != 3 )
712 {
713 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
714 if ( enmEffOpSize != IEMMODE_16BIT
715 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
716 return iemRaiseGeneralProtectionFault0(pVCpu);
717 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
718 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
719 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
720 }
721 else
722 {
723
724 /*
725 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
726 */
727 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
728
729 switch (enmEffOpSize)
730 {
731 case IEMMODE_16BIT:
732 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
733 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
734 fEfl |= UINT16_C(0xf000);
735 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
736 break;
737 case IEMMODE_32BIT:
738 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
739 break;
740 case IEMMODE_64BIT:
741 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
742 break;
743 IEM_NOT_REACHED_DEFAULT_CASE_RET();
744 }
745 }
746
747 if (rcStrict == VINF_SUCCESS)
748 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
749 return rcStrict;
750}
751
752
753/**
754 * Implements popf.
755 *
756 * @param enmEffOpSize The effective operand size.
757 */
758IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
759{
760 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
761 VBOXSTRICTRC rcStrict;
762 uint32_t fEflNew;
763
764 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
765 { /* probable */ }
766 else
767 {
768 Log2(("popf: Guest intercept -> #VMEXIT\n"));
769 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
770 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
771 }
772
773 /*
774 * V8086 is special as usual.
775 */
776 if (fEflOld & X86_EFL_VM)
777 {
778 /*
779 * Almost anything goes if IOPL is 3.
780 */
781 if (X86_EFL_GET_IOPL(fEflOld) == 3)
782 {
783 switch (enmEffOpSize)
784 {
785 case IEMMODE_16BIT:
786 {
787 uint16_t u16Value;
788 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
789 if (rcStrict != VINF_SUCCESS)
790 return rcStrict;
791 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
792 break;
793 }
794 case IEMMODE_32BIT:
795 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
796 if (rcStrict != VINF_SUCCESS)
797 return rcStrict;
798 break;
799 IEM_NOT_REACHED_DEFAULT_CASE_RET();
800 }
801
802 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
803 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
804 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
805 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
806 }
807 /*
808 * Interrupt flag virtualization with CR4.VME=1.
809 */
810 else if ( enmEffOpSize == IEMMODE_16BIT
811 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
812 {
813 uint16_t u16Value;
814 RTUINT64U TmpRsp;
815 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
816 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
817 if (rcStrict != VINF_SUCCESS)
818 return rcStrict;
819
820 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
821 * or before? */
822 if ( ( (u16Value & X86_EFL_IF)
823 && (fEflOld & X86_EFL_VIP))
824 || (u16Value & X86_EFL_TF) )
825 return iemRaiseGeneralProtectionFault0(pVCpu);
826
827 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
828 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
829 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
830 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
831
832 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
833 }
834 else
835 return iemRaiseGeneralProtectionFault0(pVCpu);
836
837 }
838 /*
839 * Not in V8086 mode.
840 */
841 else
842 {
843 /* Pop the flags. */
844 switch (enmEffOpSize)
845 {
846 case IEMMODE_16BIT:
847 {
848 uint16_t u16Value;
849 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
850 if (rcStrict != VINF_SUCCESS)
851 return rcStrict;
852 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
853
854 /*
855 * Ancient CPU adjustments:
856 * - 8086, 80186, V20/30:
857 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
858 * practical reasons (masking below). We add them when pushing flags.
859 * - 80286:
860 * The NT and IOPL flags cannot be popped from real mode and are
861 * therefore always zero (since a 286 can never exit from PM and
862 * their initial value is zero). This changed on a 386 and can
863 * therefore be used to detect 286 or 386 CPU in real mode.
864 */
865 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
866 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
867 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
868 break;
869 }
870 case IEMMODE_32BIT:
871 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
872 if (rcStrict != VINF_SUCCESS)
873 return rcStrict;
874 break;
875 case IEMMODE_64BIT:
876 {
877 uint64_t u64Value;
878 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
879 if (rcStrict != VINF_SUCCESS)
880 return rcStrict;
881 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
882 break;
883 }
884 IEM_NOT_REACHED_DEFAULT_CASE_RET();
885 }
886
887 /* Merge them with the current flags. */
888 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
889 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
890 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
891 || IEM_GET_CPL(pVCpu) == 0)
892 {
893 fEflNew &= fPopfBits;
894 fEflNew |= ~fPopfBits & fEflOld;
895 }
896 else if (IEM_GET_CPL(pVCpu) <= X86_EFL_GET_IOPL(fEflOld))
897 {
898 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
899 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
900 }
901 else
902 {
903 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
904 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
905 }
906 }
907
908 /*
909 * Commit the flags.
910 */
911 Assert(fEflNew & RT_BIT_32(1));
912 IEMMISC_SET_EFL(pVCpu, fEflNew);
913 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
914}
915
916
917/**
918 * Implements an indirect call.
919 *
920 * @param uNewPC The new program counter (RIP) value (loaded from the
921 * operand).
922 */
923IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
924{
925 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
926 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
927 {
928 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
929 if (rcStrict == VINF_SUCCESS)
930 {
931 pVCpu->cpum.GstCtx.rip = uNewPC;
932 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
933 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
934 }
935 return rcStrict;
936 }
937 return iemRaiseGeneralProtectionFault0(pVCpu);
938}
939
940
941/**
942 * Implements a 16-bit relative call.
943 *
944 * @param offDisp The displacment offset.
945 */
946IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
947{
948 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
949 uint16_t const uNewPC = uOldPC + offDisp;
950 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
951 {
952 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
953 if (rcStrict == VINF_SUCCESS)
954 {
955 pVCpu->cpum.GstCtx.rip = uNewPC;
956 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
957 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
958 }
959 return rcStrict;
960 }
961 return iemRaiseGeneralProtectionFault0(pVCpu);
962}
963
964
965/**
966 * Implements a 32-bit indirect call.
967 *
968 * @param uNewPC The new program counter (RIP) value (loaded from the
969 * operand).
970 */
971IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
972{
973 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
974 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
975 {
976 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
977 if (rcStrict == VINF_SUCCESS)
978 {
979 pVCpu->cpum.GstCtx.rip = uNewPC;
980 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
981 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
982 }
983 return rcStrict;
984 }
985 return iemRaiseGeneralProtectionFault0(pVCpu);
986}
987
988
989/**
990 * Implements a 32-bit relative call.
991 *
992 * @param offDisp The displacment offset.
993 */
994IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
995{
996 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
997 uint32_t const uNewPC = uOldPC + offDisp;
998 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
999 {
1000 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
1001 if (rcStrict == VINF_SUCCESS)
1002 {
1003 pVCpu->cpum.GstCtx.rip = uNewPC;
1004 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1005 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1006 }
1007 return rcStrict;
1008 }
1009 return iemRaiseGeneralProtectionFault0(pVCpu);
1010}
1011
1012
1013/**
1014 * Implements a 64-bit indirect call.
1015 *
1016 * @param uNewPC The new program counter (RIP) value (loaded from the
1017 * operand).
1018 */
1019IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
1020{
1021 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1022 if (IEM_IS_CANONICAL(uNewPC))
1023 {
1024 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1025 if (rcStrict == VINF_SUCCESS)
1026 {
1027 pVCpu->cpum.GstCtx.rip = uNewPC;
1028 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1029 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1030 }
1031 return rcStrict;
1032 }
1033 return iemRaiseGeneralProtectionFault0(pVCpu);
1034}
1035
1036
1037/**
1038 * Implements a 64-bit relative call.
1039 *
1040 * @param offDisp The displacment offset.
1041 */
1042IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
1043{
1044 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
1045 uint64_t const uNewPC = uOldPC + offDisp;
1046 if (IEM_IS_CANONICAL(uNewPC))
1047 {
1048 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
1049 if (rcStrict == VINF_SUCCESS)
1050 {
1051 pVCpu->cpum.GstCtx.rip = uNewPC;
1052 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
1053 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1054 }
1055 return rcStrict;
1056 }
1057 return iemRaiseNotCanonical(pVCpu);
1058}
1059
1060
1061/**
1062 * Implements far jumps and calls thru task segments (TSS).
1063 *
1064 * @returns VBox strict status code.
1065 * @param pVCpu The cross context virtual CPU structure of the
1066 * calling thread.
1067 * @param cbInstr The current instruction length.
1068 * @param uSel The selector.
1069 * @param enmBranch The kind of branching we're performing.
1070 * @param enmEffOpSize The effective operand size.
1071 * @param pDesc The descriptor corresponding to @a uSel. The type is
1072 * task gate.
1073 */
1074static VBOXSTRICTRC iemCImpl_BranchTaskSegment(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1075 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1076{
1077#ifndef IEM_IMPLEMENTS_TASKSWITCH
1078 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1079#else
1080 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1081 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
1082 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
1083 RT_NOREF_PV(enmEffOpSize);
1084 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1085
1086 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1087 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1088 {
1089 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1090 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1091 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1092 }
1093
1094 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1095 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1096 * checked here, need testcases. */
1097 if (!pDesc->Legacy.Gen.u1Present)
1098 {
1099 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1100 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1101 }
1102
1103 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1104 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1105 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1106#endif
1107}
1108
1109
1110/**
1111 * Implements far jumps and calls thru task gates.
1112 *
1113 * @returns VBox strict status code.
1114 * @param pVCpu The cross context virtual CPU structure of the
1115 * calling thread.
1116 * @param cbInstr The current instruction length.
1117 * @param uSel The selector.
1118 * @param enmBranch The kind of branching we're performing.
1119 * @param enmEffOpSize The effective operand size.
1120 * @param pDesc The descriptor corresponding to @a uSel. The type is
1121 * task gate.
1122 */
1123static VBOXSTRICTRC iemCImpl_BranchTaskGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1124 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1125{
1126#ifndef IEM_IMPLEMENTS_TASKSWITCH
1127 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1128#else
1129 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1130 RT_NOREF_PV(enmEffOpSize);
1131 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1132
1133 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1134 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1135 {
1136 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1137 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1138 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1139 }
1140
1141 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1142 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1143 * checked here, need testcases. */
1144 if (!pDesc->Legacy.Gen.u1Present)
1145 {
1146 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1147 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1148 }
1149
1150 /*
1151 * Fetch the new TSS descriptor from the GDT.
1152 */
1153 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1154 if (uSelTss & X86_SEL_LDT)
1155 {
1156 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1157 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1158 }
1159
1160 IEMSELDESC TssDesc;
1161 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1162 if (rcStrict != VINF_SUCCESS)
1163 return rcStrict;
1164
1165 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1166 {
1167 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1168 TssDesc.Legacy.Gate.u4Type));
1169 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1170 }
1171
1172 if (!TssDesc.Legacy.Gate.u1Present)
1173 {
1174 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1175 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1176 }
1177
1178 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1179 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1180 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1181#endif
1182}
1183
1184
1185/**
1186 * Implements far jumps and calls thru call gates.
1187 *
1188 * @returns VBox strict status code.
1189 * @param pVCpu The cross context virtual CPU structure of the
1190 * calling thread.
1191 * @param cbInstr The current instruction length.
1192 * @param uSel The selector.
1193 * @param enmBranch The kind of branching we're performing.
1194 * @param enmEffOpSize The effective operand size.
1195 * @param pDesc The descriptor corresponding to @a uSel. The type is
1196 * call gate.
1197 */
1198static VBOXSTRICTRC iemCImpl_BranchCallGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1199 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1200{
1201#define IEM_IMPLEMENTS_CALLGATE
1202#ifndef IEM_IMPLEMENTS_CALLGATE
1203 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1204#else
1205 RT_NOREF_PV(enmEffOpSize);
1206 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1207
1208 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1209 * inter-privilege calls and are much more complex.
1210 *
1211 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1212 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1213 * must be 16-bit or 32-bit.
1214 */
1215 /** @todo effective operand size is probably irrelevant here, only the
1216 * call gate bitness matters??
1217 */
1218 VBOXSTRICTRC rcStrict;
1219 RTPTRUNION uPtrRet;
1220 uint64_t uNewRsp;
1221 uint64_t uNewRip;
1222 uint64_t u64Base;
1223 uint32_t cbLimit;
1224 RTSEL uNewCS;
1225 IEMSELDESC DescCS;
1226
1227 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1228 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1229 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1230 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1231
1232 /* Determine the new instruction pointer from the gate descriptor. */
1233 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1234 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1235 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1236
1237 /* Perform DPL checks on the gate descriptor. */
1238 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1239 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1240 {
1241 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1242 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1243 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1244 }
1245
1246 /** @todo does this catch NULL selectors, too? */
1247 if (!pDesc->Legacy.Gen.u1Present)
1248 {
1249 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1250 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1251 }
1252
1253 /*
1254 * Fetch the target CS descriptor from the GDT or LDT.
1255 */
1256 uNewCS = pDesc->Legacy.Gate.u16Sel;
1257 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1258 if (rcStrict != VINF_SUCCESS)
1259 return rcStrict;
1260
1261 /* Target CS must be a code selector. */
1262 if ( !DescCS.Legacy.Gen.u1DescType
1263 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1264 {
1265 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1266 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1267 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1268 }
1269
1270 /* Privilege checks on target CS. */
1271 if (enmBranch == IEMBRANCH_JUMP)
1272 {
1273 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1274 {
1275 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1276 {
1277 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1278 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1279 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1280 }
1281 }
1282 else
1283 {
1284 if (DescCS.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
1285 {
1286 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1287 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1288 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1289 }
1290 }
1291 }
1292 else
1293 {
1294 Assert(enmBranch == IEMBRANCH_CALL);
1295 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1296 {
1297 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1298 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1299 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1300 }
1301 }
1302
1303 /* Additional long mode checks. */
1304 if (IEM_IS_LONG_MODE(pVCpu))
1305 {
1306 if (!DescCS.Legacy.Gen.u1Long)
1307 {
1308 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1309 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1310 }
1311
1312 /* L vs D. */
1313 if ( DescCS.Legacy.Gen.u1Long
1314 && DescCS.Legacy.Gen.u1DefBig)
1315 {
1316 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1317 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1318 }
1319 }
1320
1321 if (!DescCS.Legacy.Gate.u1Present)
1322 {
1323 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1324 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1325 }
1326
1327 if (enmBranch == IEMBRANCH_JUMP)
1328 {
1329 /** @todo This is very similar to regular far jumps; merge! */
1330 /* Jumps are fairly simple... */
1331
1332 /* Chop the high bits off if 16-bit gate (Intel says so). */
1333 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1334 uNewRip = (uint16_t)uNewRip;
1335
1336 /* Limit check for non-long segments. */
1337 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1338 if (DescCS.Legacy.Gen.u1Long)
1339 u64Base = 0;
1340 else
1341 {
1342 if (uNewRip > cbLimit)
1343 {
1344 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1345 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1346 }
1347 u64Base = X86DESC_BASE(&DescCS.Legacy);
1348 }
1349
1350 /* Canonical address check. */
1351 if (!IEM_IS_CANONICAL(uNewRip))
1352 {
1353 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1354 return iemRaiseNotCanonical(pVCpu);
1355 }
1356
1357 /*
1358 * Ok, everything checked out fine. Now set the accessed bit before
1359 * committing the result into CS, CSHID and RIP.
1360 */
1361 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1362 {
1363 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1364 if (rcStrict != VINF_SUCCESS)
1365 return rcStrict;
1366 /** @todo check what VT-x and AMD-V does. */
1367 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1368 }
1369
1370 /* commit */
1371 pVCpu->cpum.GstCtx.rip = uNewRip;
1372 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1373 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
1374 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1375 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1376 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1377 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1378 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1379 }
1380 else
1381 {
1382 Assert(enmBranch == IEMBRANCH_CALL);
1383 /* Calls are much more complicated. */
1384
1385 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < IEM_GET_CPL(pVCpu)))
1386 {
1387 /* More privilege. This is the fun part. */
1388 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1389
1390 /*
1391 * Determine new SS:rSP from the TSS.
1392 */
1393 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1394
1395 /* Figure out where the new stack pointer is stored in the TSS. */
1396 uint8_t const uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1397 uint16_t offNewStack; /* Offset of new stack in TSS. */
1398 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1399 if (!IEM_IS_LONG_MODE(pVCpu))
1400 {
1401 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1402 {
1403 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1404 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1405 }
1406 else
1407 {
1408 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1409 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1410 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1411 }
1412 }
1413 else
1414 {
1415 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1416 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1417 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1418 }
1419
1420 /* Check against TSS limit. */
1421 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1422 {
1423 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1424 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1425 }
1426
1427 uint8_t bUnmapInfo;
1428 RTPTRUNION uPtrTss;
1429 RTGCPTR GCPtrTss = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1430 rcStrict = iemMemMap(pVCpu, &uPtrTss.pv, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrTss, IEM_ACCESS_SYS_R, 0);
1431 if (rcStrict != VINF_SUCCESS)
1432 {
1433 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1434 return rcStrict;
1435 }
1436
1437 RTSEL uNewSS;
1438 if (!IEM_IS_LONG_MODE(pVCpu))
1439 {
1440 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1441 {
1442 uNewRsp = uPtrTss.pu32[0];
1443 uNewSS = uPtrTss.pu16[2];
1444 }
1445 else
1446 {
1447 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1448 uNewRsp = uPtrTss.pu16[0];
1449 uNewSS = uPtrTss.pu16[1];
1450 }
1451 }
1452 else
1453 {
1454 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1455 /* SS will be a NULL selector, but that's valid. */
1456 uNewRsp = uPtrTss.pu64[0];
1457 uNewSS = uNewCSDpl;
1458 }
1459
1460 /* Done with the TSS now. */
1461 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1462 if (rcStrict != VINF_SUCCESS)
1463 {
1464 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1465 return rcStrict;
1466 }
1467
1468 /* Only used outside of long mode. */
1469 uint8_t const cbWords = pDesc->Legacy.Gate.u5ParmCount;
1470
1471 /* If EFER.LMA is 0, there's extra work to do. */
1472 IEMSELDESC DescSS;
1473 if (!IEM_IS_LONG_MODE(pVCpu))
1474 {
1475 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1476 {
1477 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1478 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1479 }
1480
1481 /* Grab the new SS descriptor. */
1482 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1483 if (rcStrict != VINF_SUCCESS)
1484 return rcStrict;
1485
1486 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1487 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1488 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1489 {
1490 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1491 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1492 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1493 }
1494
1495 /* Ensure new SS is a writable data segment. */
1496 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1497 {
1498 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1499 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1500 }
1501
1502 if (!DescSS.Legacy.Gen.u1Present)
1503 {
1504 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1505 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1506 }
1507 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1508 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1509 else
1510 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1511 }
1512 else
1513 {
1514 /* Just grab the new (NULL) SS descriptor. */
1515 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1516 * like we do... */
1517 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1518 if (rcStrict != VINF_SUCCESS)
1519 return rcStrict;
1520
1521 cbNewStack = sizeof(uint64_t) * 4;
1522 }
1523
1524 /** @todo According to Intel, new stack is checked for enough space first,
1525 * then switched. According to AMD, the stack is switched first and
1526 * then pushes might fault!
1527 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1528 * incoming stack \#PF happens before actual stack switch. AMD is
1529 * either lying or implicitly assumes that new state is committed
1530 * only if and when an instruction doesn't fault.
1531 */
1532
1533 /** @todo According to AMD, CS is loaded first, then SS.
1534 * According to Intel, it's the other way around!?
1535 */
1536
1537 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1538
1539 /* Set the accessed bit before committing new SS. */
1540 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1541 {
1542 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1543 if (rcStrict != VINF_SUCCESS)
1544 return rcStrict;
1545 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1546 }
1547
1548 /* Remember the old SS:rSP and their linear address. */
1549 RTSEL const uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1550 uint64_t const uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1551
1552 RTGCPTR const GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1553
1554 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1555 or #PF, the former is not implemented in this workaround. */
1556 /** @todo Proper fix callgate target stack exceptions. */
1557 /** @todo testcase: Cover callgates with partially or fully inaccessible
1558 * target stacks. */
1559 void *pvNewFrame;
1560 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1561 rcStrict = iemMemMap(pVCpu, &pvNewFrame, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1562 if (rcStrict != VINF_SUCCESS)
1563 {
1564 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1565 return rcStrict;
1566 }
1567 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1568 if (rcStrict != VINF_SUCCESS)
1569 {
1570 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1571 return rcStrict;
1572 }
1573
1574 /* Commit new SS:rSP. */
1575 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1576 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1577 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1578 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1579 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1580 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1581 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1582 IEM_SET_CPL(pVCpu, uNewCSDpl); /** @todo Are the parameter words accessed using the new CPL or the old CPL? */
1583 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1584 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1585
1586 /* At this point the stack access must not fail because new state was already committed. */
1587 /** @todo this can still fail due to SS.LIMIT not check. */
1588 uint8_t bUnmapInfoRet;
1589 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1590 IEM_IS_LONG_MODE(pVCpu) ? 7
1591 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1592 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1593 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1594 VERR_INTERNAL_ERROR_5);
1595
1596 if (!IEM_IS_LONG_MODE(pVCpu))
1597 {
1598 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1599 {
1600 if (cbWords)
1601 {
1602 /* Map the relevant chunk of the old stack. */
1603 RTPTRUNION uPtrParmWds;
1604 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1605 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1606 if (rcStrict != VINF_SUCCESS)
1607 {
1608 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1609 return rcStrict;
1610 }
1611
1612 /* Copy the parameter (d)words. */
1613 for (int i = 0; i < cbWords; ++i)
1614 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1615
1616 /* Unmap the old stack. */
1617 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1618 if (rcStrict != VINF_SUCCESS)
1619 {
1620 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1621 return rcStrict;
1622 }
1623 }
1624
1625 /* Push the old CS:rIP. */
1626 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1627 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1628
1629 /* Push the old SS:rSP. */
1630 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1631 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1632 }
1633 else
1634 {
1635 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1636
1637 if (cbWords)
1638 {
1639 /* Map the relevant chunk of the old stack. */
1640 RTPTRUNION uPtrParmWds;
1641 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1642 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1643 if (rcStrict != VINF_SUCCESS)
1644 {
1645 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1646 return rcStrict;
1647 }
1648
1649 /* Copy the parameter words. */
1650 for (int i = 0; i < cbWords; ++i)
1651 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1652
1653 /* Unmap the old stack. */
1654 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1655 if (rcStrict != VINF_SUCCESS)
1656 {
1657 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1658 return rcStrict;
1659 }
1660 }
1661
1662 /* Push the old CS:rIP. */
1663 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1664 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1665
1666 /* Push the old SS:rSP. */
1667 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1668 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1669 }
1670 }
1671 else
1672 {
1673 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1674
1675 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1676 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1677 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1678 uPtrRet.pu64[2] = uOldRsp;
1679 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1680 }
1681
1682 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1683 if (rcStrict != VINF_SUCCESS)
1684 {
1685 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1686 return rcStrict;
1687 }
1688
1689 /* Chop the high bits off if 16-bit gate (Intel says so). */
1690 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1691 uNewRip = (uint16_t)uNewRip;
1692
1693 /* Limit / canonical check. */
1694 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1695 if (!IEM_IS_LONG_MODE(pVCpu))
1696 {
1697 if (uNewRip > cbLimit)
1698 {
1699 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1700 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1701 }
1702 u64Base = X86DESC_BASE(&DescCS.Legacy);
1703 }
1704 else
1705 {
1706 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1707 if (!IEM_IS_CANONICAL(uNewRip))
1708 {
1709 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1710 return iemRaiseNotCanonical(pVCpu);
1711 }
1712 u64Base = 0;
1713 }
1714
1715 /*
1716 * Now set the accessed bit before
1717 * writing the return address to the stack and committing the result into
1718 * CS, CSHID and RIP.
1719 */
1720 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1721 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1722 {
1723 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1724 if (rcStrict != VINF_SUCCESS)
1725 return rcStrict;
1726 /** @todo check what VT-x and AMD-V does. */
1727 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1728 }
1729
1730 /* Commit new CS:rIP. */
1731 pVCpu->cpum.GstCtx.rip = uNewRip;
1732 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1733 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1734 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1735 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1736 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1737 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1738 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1739 }
1740 else
1741 {
1742 /* Same privilege. */
1743 /** @todo This is very similar to regular far calls; merge! */
1744
1745 /* Check stack first - may #SS(0). */
1746 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1747 * 16-bit code cause a two or four byte CS to be pushed? */
1748 uint8_t bUnmapInfoRet;
1749 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1750 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1751 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1752 IEM_IS_LONG_MODE(pVCpu) ? 7
1753 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1754 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1755 if (rcStrict != VINF_SUCCESS)
1756 return rcStrict;
1757
1758 /* Chop the high bits off if 16-bit gate (Intel says so). */
1759 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1760 uNewRip = (uint16_t)uNewRip;
1761
1762 /* Limit / canonical check. */
1763 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1764 if (!IEM_IS_LONG_MODE(pVCpu))
1765 {
1766 if (uNewRip > cbLimit)
1767 {
1768 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1769 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1770 }
1771 u64Base = X86DESC_BASE(&DescCS.Legacy);
1772 }
1773 else
1774 {
1775 if (!IEM_IS_CANONICAL(uNewRip))
1776 {
1777 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1778 return iemRaiseNotCanonical(pVCpu);
1779 }
1780 u64Base = 0;
1781 }
1782
1783 /*
1784 * Now set the accessed bit before
1785 * writing the return address to the stack and committing the result into
1786 * CS, CSHID and RIP.
1787 */
1788 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1789 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1790 {
1791 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1792 if (rcStrict != VINF_SUCCESS)
1793 return rcStrict;
1794 /** @todo check what VT-x and AMD-V does. */
1795 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1796 }
1797
1798 /* stack */
1799 if (!IEM_IS_LONG_MODE(pVCpu))
1800 {
1801 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1802 {
1803 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1804 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1805 }
1806 else
1807 {
1808 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1809 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1810 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1811 }
1812 }
1813 else
1814 {
1815 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1816 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1817 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1818 }
1819
1820 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1821 if (rcStrict != VINF_SUCCESS)
1822 return rcStrict;
1823
1824 /* commit */
1825 pVCpu->cpum.GstCtx.rip = uNewRip;
1826 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1827 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1828 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1829 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1830 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1831 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1832 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1833 }
1834 }
1835 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1836
1837 iemRecalcExecModeAndCplFlags(pVCpu);
1838
1839/** @todo single stepping */
1840
1841 /* Flush the prefetch buffer. */
1842 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1843 return VINF_SUCCESS;
1844#endif /* IEM_IMPLEMENTS_CALLGATE */
1845}
1846
1847
1848/**
1849 * Implements far jumps and calls thru system selectors.
1850 *
1851 * @returns VBox strict status code.
1852 * @param pVCpu The cross context virtual CPU structure of the
1853 * calling thread.
1854 * @param cbInstr The current instruction length.
1855 * @param uSel The selector.
1856 * @param enmBranch The kind of branching we're performing.
1857 * @param enmEffOpSize The effective operand size.
1858 * @param pDesc The descriptor corresponding to @a uSel.
1859 */
1860static VBOXSTRICTRC iemCImpl_BranchSysSel(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1861 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1862{
1863 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1864 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1865 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1866
1867 if (IEM_IS_LONG_MODE(pVCpu))
1868 switch (pDesc->Legacy.Gen.u4Type)
1869 {
1870 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1871 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1872
1873 default:
1874 case AMD64_SEL_TYPE_SYS_LDT:
1875 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1876 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1877 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1878 case AMD64_SEL_TYPE_SYS_INT_GATE:
1879 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1880 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1881 }
1882
1883 switch (pDesc->Legacy.Gen.u4Type)
1884 {
1885 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1886 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1887 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1888
1889 case X86_SEL_TYPE_SYS_TASK_GATE:
1890 return iemCImpl_BranchTaskGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1891
1892 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1893 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1894 return iemCImpl_BranchTaskSegment(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1895
1896 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1897 Log(("branch %04x -> busy 286 TSS\n", uSel));
1898 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1899
1900 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1901 Log(("branch %04x -> busy 386 TSS\n", uSel));
1902 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1903
1904 default:
1905 case X86_SEL_TYPE_SYS_LDT:
1906 case X86_SEL_TYPE_SYS_286_INT_GATE:
1907 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1908 case X86_SEL_TYPE_SYS_386_INT_GATE:
1909 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1910 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1911 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1912 }
1913}
1914
1915
1916/**
1917 * Implements far jumps.
1918 *
1919 * @param uSel The selector.
1920 * @param offSeg The segment offset.
1921 * @param enmEffOpSize The effective operand size.
1922 */
1923IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1924{
1925 NOREF(cbInstr);
1926 Assert(offSeg <= UINT32_MAX || (!IEM_IS_GUEST_CPU_AMD(pVCpu) && IEM_IS_64BIT_CODE(pVCpu)));
1927
1928 /*
1929 * Real mode and V8086 mode are easy. The only snag seems to be that
1930 * CS.limit doesn't change and the limit check is done against the current
1931 * limit.
1932 */
1933 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1934 * 1998) that up to and including the Intel 486, far control
1935 * transfers in real mode set default CS attributes (0x93) and also
1936 * set a 64K segment limit. Starting with the Pentium, the
1937 * attributes and limit are left alone but the access rights are
1938 * ignored. We only implement the Pentium+ behavior.
1939 * */
1940 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1941 {
1942 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1943 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1944 {
1945 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1946 return iemRaiseGeneralProtectionFault0(pVCpu);
1947 }
1948
1949 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1950 pVCpu->cpum.GstCtx.rip = offSeg;
1951 else
1952 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1953 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1954 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1955 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1956 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1957
1958 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
1959 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
1960 { /* likely */ }
1961 else if (uSel != 0)
1962 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
1963 else
1964 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
1965 | iemCalc32BitFlatIndicator(pVCpu);
1966
1967 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1968 }
1969
1970 /*
1971 * Protected mode. Need to parse the specified descriptor...
1972 */
1973 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1974 {
1975 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1976 return iemRaiseGeneralProtectionFault0(pVCpu);
1977 }
1978
1979 /* Fetch the descriptor. */
1980 IEMSELDESC Desc;
1981 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1982 if (rcStrict != VINF_SUCCESS)
1983 return rcStrict;
1984
1985 /* Is it there? */
1986 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1987 {
1988 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1989 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1990 }
1991
1992 /*
1993 * Deal with it according to its type. We do the standard code selectors
1994 * here and dispatch the system selectors to worker functions.
1995 */
1996 if (!Desc.Legacy.Gen.u1DescType)
1997 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1998
1999 /* Only code segments. */
2000 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2001 {
2002 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2003 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2004 }
2005
2006 /* L vs D. */
2007 if ( Desc.Legacy.Gen.u1Long
2008 && Desc.Legacy.Gen.u1DefBig
2009 && IEM_IS_LONG_MODE(pVCpu))
2010 {
2011 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2012 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2013 }
2014
2015 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2016 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2017 {
2018 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2019 {
2020 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2021 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2022 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2023 }
2024 }
2025 else
2026 {
2027 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2028 {
2029 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2030 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2031 }
2032 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2033 {
2034 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2035 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2036 }
2037 }
2038
2039 /* Chop the high bits if 16-bit (Intel says so). */
2040 if (enmEffOpSize == IEMMODE_16BIT)
2041 offSeg &= UINT16_MAX;
2042
2043 /* Limit check and get the base. */
2044 uint64_t u64Base;
2045 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2046 if ( !Desc.Legacy.Gen.u1Long
2047 || !IEM_IS_LONG_MODE(pVCpu))
2048 {
2049 if (RT_LIKELY(offSeg <= cbLimit))
2050 u64Base = X86DESC_BASE(&Desc.Legacy);
2051 else
2052 {
2053 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2054 /** @todo Intel says this is \#GP(0)! */
2055 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2056 }
2057 }
2058 else
2059 u64Base = 0;
2060
2061 /*
2062 * Ok, everything checked out fine. Now set the accessed bit before
2063 * committing the result into CS, CSHID and RIP.
2064 */
2065 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2066 {
2067 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2068 if (rcStrict != VINF_SUCCESS)
2069 return rcStrict;
2070 /** @todo check what VT-x and AMD-V does. */
2071 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2072 }
2073
2074 /* commit */
2075 pVCpu->cpum.GstCtx.rip = offSeg;
2076 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2077 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
2078 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2079 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2080 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2081 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2082 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2083
2084 /** @todo check if the hidden bits are loaded correctly for 64-bit
2085 * mode. */
2086
2087 iemRecalcExecModeAndCplFlags(pVCpu);
2088
2089 /* Flush the prefetch buffer. */
2090 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2091
2092 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2093}
2094
2095
2096/**
2097 * Implements far calls.
2098 *
2099 * This very similar to iemCImpl_FarJmp.
2100 *
2101 * @param uSel The selector.
2102 * @param offSeg The segment offset.
2103 * @param enmEffOpSize The operand size (in case we need it).
2104 */
2105IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
2106{
2107 VBOXSTRICTRC rcStrict;
2108 uint64_t uNewRsp;
2109 RTPTRUNION uPtrRet;
2110 uint8_t bUnmapInfo;
2111
2112 /*
2113 * Real mode and V8086 mode are easy. The only snag seems to be that
2114 * CS.limit doesn't change and the limit check is done against the current
2115 * limit.
2116 */
2117 /** @todo See comment for similar code in iemCImpl_FarJmp */
2118 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2119 {
2120 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2121
2122 /* Check stack first - may #SS(0). */
2123 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2124 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2125 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
2126 if (rcStrict != VINF_SUCCESS)
2127 return rcStrict;
2128
2129 /* Check the target address range. */
2130/** @todo this must be wrong! Write unreal mode tests! */
2131 if (offSeg > UINT32_MAX)
2132 return iemRaiseGeneralProtectionFault0(pVCpu);
2133
2134 /* Everything is fine, push the return address. */
2135 if (enmEffOpSize == IEMMODE_16BIT)
2136 {
2137 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2138 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2139 }
2140 else
2141 {
2142 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2143 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2144 }
2145 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2146 if (rcStrict != VINF_SUCCESS)
2147 return rcStrict;
2148
2149 /* Branch. */
2150 pVCpu->cpum.GstCtx.rip = offSeg;
2151 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2152 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2153 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2154 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2155
2156 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2157 }
2158
2159 /*
2160 * Protected mode. Need to parse the specified descriptor...
2161 */
2162 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2163 {
2164 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2165 return iemRaiseGeneralProtectionFault0(pVCpu);
2166 }
2167
2168 /* Fetch the descriptor. */
2169 IEMSELDESC Desc;
2170 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2171 if (rcStrict != VINF_SUCCESS)
2172 return rcStrict;
2173
2174 /*
2175 * Deal with it according to its type. We do the standard code selectors
2176 * here and dispatch the system selectors to worker functions.
2177 */
2178 if (!Desc.Legacy.Gen.u1DescType)
2179 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2180
2181 /* Only code segments. */
2182 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2183 {
2184 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2185 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2186 }
2187
2188 /* L vs D. */
2189 if ( Desc.Legacy.Gen.u1Long
2190 && Desc.Legacy.Gen.u1DefBig
2191 && IEM_IS_LONG_MODE(pVCpu))
2192 {
2193 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2194 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2195 }
2196
2197 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2198 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2199 {
2200 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2201 {
2202 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2203 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2204 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2205 }
2206 }
2207 else
2208 {
2209 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2210 {
2211 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2212 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2213 }
2214 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2215 {
2216 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2217 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2218 }
2219 }
2220
2221 /* Is it there? */
2222 if (!Desc.Legacy.Gen.u1Present)
2223 {
2224 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2225 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2226 }
2227
2228 /* Check stack first - may #SS(0). */
2229 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2230 * 16-bit code cause a two or four byte CS to be pushed? */
2231 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2232 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2233 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2234 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
2235 if (rcStrict != VINF_SUCCESS)
2236 return rcStrict;
2237
2238 /* Chop the high bits if 16-bit (Intel says so). */
2239 if (enmEffOpSize == IEMMODE_16BIT)
2240 offSeg &= UINT16_MAX;
2241
2242 /* Limit / canonical check. */
2243 uint64_t u64Base;
2244 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2245 if ( !Desc.Legacy.Gen.u1Long
2246 || !IEM_IS_LONG_MODE(pVCpu))
2247 {
2248 if (RT_LIKELY(offSeg <= cbLimit))
2249 u64Base = X86DESC_BASE(&Desc.Legacy);
2250 else
2251 {
2252 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2253 /** @todo Intel says this is \#GP(0)! */
2254 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2255 }
2256 }
2257 else if (IEM_IS_CANONICAL(offSeg))
2258 u64Base = 0;
2259 else
2260 {
2261 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2262 return iemRaiseNotCanonical(pVCpu);
2263 }
2264
2265 /*
2266 * Now set the accessed bit before
2267 * writing the return address to the stack and committing the result into
2268 * CS, CSHID and RIP.
2269 */
2270 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2271 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2272 {
2273 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2274 if (rcStrict != VINF_SUCCESS)
2275 return rcStrict;
2276 /** @todo check what VT-x and AMD-V does. */
2277 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2278 }
2279
2280 /* stack */
2281 if (enmEffOpSize == IEMMODE_16BIT)
2282 {
2283 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2284 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2285 }
2286 else if (enmEffOpSize == IEMMODE_32BIT)
2287 {
2288 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2289 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2290 }
2291 else
2292 {
2293 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2294 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2295 }
2296 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2297 if (rcStrict != VINF_SUCCESS)
2298 return rcStrict;
2299
2300 /* commit */
2301 pVCpu->cpum.GstCtx.rip = offSeg;
2302 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2303 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
2304 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2305 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2306 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2307 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2308 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2309
2310 /** @todo check if the hidden bits are loaded correctly for 64-bit
2311 * mode. */
2312
2313 iemRecalcExecModeAndCplFlags(pVCpu);
2314
2315 /* Flush the prefetch buffer. */
2316 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2317
2318 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2319}
2320
2321
2322/**
2323 * Implements retf.
2324 *
2325 * @param enmEffOpSize The effective operand size.
2326 * @param cbPop The amount of arguments to pop from the stack
2327 * (bytes).
2328 */
2329IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2330{
2331 NOREF(cbInstr);
2332
2333 /*
2334 * Read the stack values first.
2335 */
2336 RTUINT64U NewRsp;
2337 uint8_t bUnmapInfo;
2338 RTCPTRUNION uPtrFrame;
2339 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2340 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2341 VBOXSTRICTRC rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2342 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2343 &uPtrFrame.pv, &bUnmapInfo, &NewRsp.u);
2344 if (rcStrict != VINF_SUCCESS)
2345 return rcStrict;
2346
2347 uint64_t uNewRip;
2348 uint16_t uNewCs;
2349 if (enmEffOpSize == IEMMODE_16BIT)
2350 {
2351 uNewRip = uPtrFrame.pu16[0];
2352 uNewCs = uPtrFrame.pu16[1];
2353 }
2354 else if (enmEffOpSize == IEMMODE_32BIT)
2355 {
2356 uNewRip = uPtrFrame.pu32[0];
2357 uNewCs = uPtrFrame.pu16[2];
2358 }
2359 else
2360 {
2361 uNewRip = uPtrFrame.pu64[0];
2362 uNewCs = uPtrFrame.pu16[4];
2363 }
2364
2365 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2366 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2367 { /* extremely likely */ }
2368 else
2369 return rcStrict;
2370
2371 /*
2372 * Real mode and V8086 mode are easy.
2373 */
2374 /** @todo See comment for similar code in iemCImpl_FarJmp */
2375 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2376 {
2377 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2378 /** @todo check how this is supposed to work if sp=0xfffe. */
2379
2380 /* Check the limit of the new EIP. */
2381 /** @todo Intel pseudo code only does the limit check for 16-bit
2382 * operands, AMD does not make any distinction. What is right? */
2383 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2384 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2385
2386 /* commit the operation. */
2387 if (cbPop)
2388 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2389 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2390 pVCpu->cpum.GstCtx.rip = uNewRip;
2391 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2392 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2393 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2394 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2395 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2396 }
2397
2398 /*
2399 * Protected mode is complicated, of course.
2400 */
2401 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2402 {
2403 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2404 return iemRaiseGeneralProtectionFault0(pVCpu);
2405 }
2406
2407 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2408
2409 /* Fetch the descriptor. */
2410 IEMSELDESC DescCs;
2411 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2412 if (rcStrict != VINF_SUCCESS)
2413 return rcStrict;
2414
2415 /* Can only return to a code selector. */
2416 if ( !DescCs.Legacy.Gen.u1DescType
2417 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2418 {
2419 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2420 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2421 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2422 }
2423
2424 /* L vs D. */
2425 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2426 && DescCs.Legacy.Gen.u1DefBig
2427 && IEM_IS_LONG_MODE(pVCpu))
2428 {
2429 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2430 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2431 }
2432
2433 /* DPL/RPL/CPL checks. */
2434 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
2435 {
2436 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
2437 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2438 }
2439
2440 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2441 {
2442 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2443 {
2444 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2445 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2446 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2447 }
2448 }
2449 else
2450 {
2451 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2452 {
2453 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2454 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2455 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2456 }
2457 }
2458
2459 /* Is it there? */
2460 if (!DescCs.Legacy.Gen.u1Present)
2461 {
2462 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2463 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2464 }
2465
2466 /*
2467 * Return to outer privilege? (We'll typically have entered via a call gate.)
2468 */
2469 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
2470 {
2471 /* Read the outer stack pointer stored *after* the parameters. */
2472 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, &bUnmapInfo, NewRsp.u);
2473 if (rcStrict != VINF_SUCCESS)
2474 return rcStrict;
2475
2476 uint16_t uNewOuterSs;
2477 RTUINT64U NewOuterRsp;
2478 if (enmEffOpSize == IEMMODE_16BIT)
2479 {
2480 NewOuterRsp.u = uPtrFrame.pu16[0];
2481 uNewOuterSs = uPtrFrame.pu16[1];
2482 }
2483 else if (enmEffOpSize == IEMMODE_32BIT)
2484 {
2485 NewOuterRsp.u = uPtrFrame.pu32[0];
2486 uNewOuterSs = uPtrFrame.pu16[2];
2487 }
2488 else
2489 {
2490 NewOuterRsp.u = uPtrFrame.pu64[0];
2491 uNewOuterSs = uPtrFrame.pu16[4];
2492 }
2493 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2494 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2495 { /* extremely likely */ }
2496 else
2497 return rcStrict;
2498
2499 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2500 and read the selector. */
2501 IEMSELDESC DescSs;
2502 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2503 {
2504 if ( !DescCs.Legacy.Gen.u1Long
2505 || (uNewOuterSs & X86_SEL_RPL) == 3)
2506 {
2507 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2508 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2509 return iemRaiseGeneralProtectionFault0(pVCpu);
2510 }
2511 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2512 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2513 }
2514 else
2515 {
2516 /* Fetch the descriptor for the new stack segment. */
2517 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2518 if (rcStrict != VINF_SUCCESS)
2519 return rcStrict;
2520 }
2521
2522 /* Check that RPL of stack and code selectors match. */
2523 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2524 {
2525 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2526 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2527 }
2528
2529 /* Must be a writable data segment. */
2530 if ( !DescSs.Legacy.Gen.u1DescType
2531 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2532 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2533 {
2534 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2535 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2536 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2537 }
2538
2539 /* L vs D. (Not mentioned by intel.) */
2540 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2541 && DescSs.Legacy.Gen.u1DefBig
2542 && IEM_IS_LONG_MODE(pVCpu))
2543 {
2544 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2545 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2546 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2547 }
2548
2549 /* DPL/RPL/CPL checks. */
2550 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2551 {
2552 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2553 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2554 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2555 }
2556
2557 /* Is it there? */
2558 if (!DescSs.Legacy.Gen.u1Present)
2559 {
2560 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2561 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2562 }
2563
2564 /* Calc SS limit.*/
2565 uint64_t u64BaseSs;
2566 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2567
2568 /* Is RIP canonical or within CS.limit? */
2569 uint64_t u64BaseCs;
2570 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2571
2572 /** @todo Testcase: Is this correct? */
2573 if ( DescCs.Legacy.Gen.u1Long
2574 && IEM_IS_LONG_MODE(pVCpu) )
2575 {
2576 if (!IEM_IS_CANONICAL(uNewRip))
2577 {
2578 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2579 return iemRaiseNotCanonical(pVCpu);
2580 }
2581 u64BaseCs = 0;
2582 u64BaseSs = 0;
2583 }
2584 else
2585 {
2586 if (uNewRip > cbLimitCs)
2587 {
2588 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2589 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
2590 /** @todo Intel says this is \#GP(0)! */
2591 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2592 }
2593 u64BaseCs = X86DESC_BASE(&DescCs.Legacy);
2594 u64BaseSs = X86DESC_BASE(&DescSs.Legacy);
2595 }
2596
2597 /*
2598 * Now set the accessed bit before
2599 * writing the return address to the stack and committing the result into
2600 * CS, CSHID and RIP.
2601 */
2602 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2603 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2604 {
2605 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2606 if (rcStrict != VINF_SUCCESS)
2607 return rcStrict;
2608 /** @todo check what VT-x and AMD-V does. */
2609 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2610 }
2611 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2612 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2613 {
2614 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2615 if (rcStrict != VINF_SUCCESS)
2616 return rcStrict;
2617 /** @todo check what VT-x and AMD-V does. */
2618 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2619 }
2620
2621 /* commit */
2622 if (enmEffOpSize == IEMMODE_16BIT)
2623 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2624 else
2625 pVCpu->cpum.GstCtx.rip = uNewRip;
2626 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2627 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2628 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2629 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2630 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2631 pVCpu->cpum.GstCtx.cs.u64Base = u64BaseCs;
2632 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2633 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2634 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2635 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2636 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2637 pVCpu->cpum.GstCtx.ss.u64Base = u64BaseSs;
2638
2639 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2640 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2641 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2642 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2643
2644 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2645
2646 if (cbPop)
2647 iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
2648 if (IEM_IS_64BIT_CODE(pVCpu))
2649 pVCpu->cpum.GstCtx.rsp = NewOuterRsp.u;
2650 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2651 pVCpu->cpum.GstCtx.rsp = (uint32_t)NewOuterRsp.u;
2652 else
2653 pVCpu->cpum.GstCtx.sp = (uint16_t)NewOuterRsp.u;
2654
2655 iemRecalcExecModeAndCplFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2656
2657 /** @todo check if the hidden bits are loaded correctly for 64-bit
2658 * mode. */
2659 }
2660 /*
2661 * Return to the same privilege level
2662 */
2663 else
2664 {
2665 /* Limit / canonical check. */
2666 uint64_t u64Base;
2667 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2668
2669 /** @todo Testcase: Is this correct? */
2670 bool f64BitCs = false;
2671 if ( DescCs.Legacy.Gen.u1Long
2672 && IEM_IS_LONG_MODE(pVCpu) )
2673 {
2674 if (!IEM_IS_CANONICAL(uNewRip))
2675 {
2676 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2677 return iemRaiseNotCanonical(pVCpu);
2678 }
2679 u64Base = 0;
2680 f64BitCs = true;
2681 f64BitCs = true;
2682 }
2683 else
2684 {
2685 if (uNewRip > cbLimitCs)
2686 {
2687 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2688 /** @todo Intel says this is \#GP(0)! */
2689 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2690 }
2691 u64Base = X86DESC_BASE(&DescCs.Legacy);
2692 }
2693
2694 /*
2695 * Now set the accessed bit before
2696 * writing the return address to the stack and committing the result into
2697 * CS, CSHID and RIP.
2698 */
2699 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2700 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2701 {
2702 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2703 if (rcStrict != VINF_SUCCESS)
2704 return rcStrict;
2705 /** @todo check what VT-x and AMD-V does. */
2706 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2707 }
2708
2709 /* commit */
2710 if (cbPop)
2711/** @todo This cannot be right. We're using the old CS mode here, and iemRegAddToRspEx checks fExec. */
2712 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2713 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig || f64BitCs)
2714 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2715 else
2716 pVCpu->cpum.GstCtx.sp = (uint16_t)NewRsp.u;
2717 if (enmEffOpSize == IEMMODE_16BIT)
2718 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2719 else
2720 pVCpu->cpum.GstCtx.rip = uNewRip;
2721 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2722 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2723 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2724 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2725 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2726 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2727 /** @todo check if the hidden bits are loaded correctly for 64-bit
2728 * mode. */
2729
2730 iemRecalcExecModeAndCplFlags(pVCpu);
2731 }
2732
2733 /* Flush the prefetch buffer. */
2734 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo use light flush for same privilege? */
2735
2736 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2737}
2738
2739
2740/**
2741 * Implements retn and retn imm16.
2742 *
2743 * We're doing this in C because of the \#GP that might be raised if the popped
2744 * program counter is out of bounds.
2745 *
2746 * The hope with this forced inline worker function, is that the compiler will
2747 * be clever enough to eliminate unused code for the constant enmEffOpSize and
2748 * maybe cbPop parameters.
2749 *
2750 * @param pVCpu The cross context virtual CPU structure of the
2751 * calling thread.
2752 * @param cbInstr The current instruction length.
2753 * @param enmEffOpSize The effective operand size. This is constant.
2754 * @param cbPop The amount of arguments to pop from the stack
2755 * (bytes). This can be constant (zero).
2756 */
2757DECL_FORCE_INLINE(VBOXSTRICTRC) iemCImpl_ReturnNearCommon(PVMCPUCC pVCpu, uint8_t cbInstr, IEMMODE enmEffOpSize, uint16_t cbPop)
2758{
2759 /* Fetch the RSP from the stack. */
2760 VBOXSTRICTRC rcStrict;
2761 RTUINT64U NewRip;
2762 RTUINT64U NewRsp;
2763 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2764
2765 switch (enmEffOpSize)
2766 {
2767 case IEMMODE_16BIT:
2768 NewRip.u = 0;
2769 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2770 break;
2771 case IEMMODE_32BIT:
2772 NewRip.u = 0;
2773 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2774 break;
2775 case IEMMODE_64BIT:
2776 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2777 break;
2778 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2779 }
2780 if (rcStrict != VINF_SUCCESS)
2781 return rcStrict;
2782
2783 /* Check the new RSP before loading it. */
2784 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2785 * of it. The canonical test is performed here and for call. */
2786 if (enmEffOpSize != IEMMODE_64BIT)
2787 {
2788 if (RT_LIKELY(NewRip.DWords.dw0 <= pVCpu->cpum.GstCtx.cs.u32Limit))
2789 { /* likely */ }
2790 else
2791 {
2792 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2793 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2794 }
2795 }
2796 else
2797 {
2798 if (RT_LIKELY(IEM_IS_CANONICAL(NewRip.u)))
2799 { /* likely */ }
2800 else
2801 {
2802 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2803 return iemRaiseNotCanonical(pVCpu);
2804 }
2805 }
2806
2807 /* Apply cbPop */
2808 if (cbPop)
2809 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2810
2811 /* Commit it. */
2812 pVCpu->cpum.GstCtx.rip = NewRip.u;
2813 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2814
2815 /* Flush the prefetch buffer. */
2816 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo only need a light flush here, don't we? We don't really need any flushing... */
2817 RT_NOREF(cbInstr);
2818
2819 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2820}
2821
2822
2823/**
2824 * Implements retn imm16 with 16-bit effective operand size.
2825 *
2826 * @param cbPop The amount of arguments to pop from the stack (bytes).
2827 */
2828IEM_CIMPL_DEF_1(iemCImpl_retn_iw_16, uint16_t, cbPop)
2829{
2830 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, cbPop);
2831}
2832
2833
2834/**
2835 * Implements retn imm16 with 32-bit effective operand size.
2836 *
2837 * @param cbPop The amount of arguments to pop from the stack (bytes).
2838 */
2839IEM_CIMPL_DEF_1(iemCImpl_retn_iw_32, uint16_t, cbPop)
2840{
2841 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, cbPop);
2842}
2843
2844
2845/**
2846 * Implements retn imm16 with 64-bit effective operand size.
2847 *
2848 * @param cbPop The amount of arguments to pop from the stack (bytes).
2849 */
2850IEM_CIMPL_DEF_1(iemCImpl_retn_iw_64, uint16_t, cbPop)
2851{
2852 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, cbPop);
2853}
2854
2855
2856/**
2857 * Implements retn with 16-bit effective operand size.
2858 */
2859IEM_CIMPL_DEF_0(iemCImpl_retn_16)
2860{
2861 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, 0);
2862}
2863
2864
2865/**
2866 * Implements retn with 32-bit effective operand size.
2867 */
2868IEM_CIMPL_DEF_0(iemCImpl_retn_32)
2869{
2870 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, 0);
2871}
2872
2873
2874/**
2875 * Implements retn with 64-bit effective operand size.
2876 */
2877IEM_CIMPL_DEF_0(iemCImpl_retn_64)
2878{
2879 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, 0);
2880}
2881
2882
2883/**
2884 * Implements enter.
2885 *
2886 * We're doing this in C because the instruction is insane, even for the
2887 * u8NestingLevel=0 case dealing with the stack is tedious.
2888 *
2889 * @param enmEffOpSize The effective operand size.
2890 * @param cbFrame Frame size.
2891 * @param cParameters Frame parameter count.
2892 */
2893IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2894{
2895 /* Push RBP, saving the old value in TmpRbp. */
2896 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2897 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2898 RTUINT64U NewRbp;
2899 VBOXSTRICTRC rcStrict;
2900 if (enmEffOpSize == IEMMODE_64BIT)
2901 {
2902 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2903 NewRbp = NewRsp;
2904 }
2905 else if (enmEffOpSize == IEMMODE_32BIT)
2906 {
2907 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2908 NewRbp = NewRsp;
2909 }
2910 else
2911 {
2912 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2913 NewRbp = TmpRbp;
2914 NewRbp.Words.w0 = NewRsp.Words.w0;
2915 }
2916 if (rcStrict != VINF_SUCCESS)
2917 return rcStrict;
2918
2919 /* Copy the parameters (aka nesting levels by Intel). */
2920 cParameters &= 0x1f;
2921 if (cParameters > 0)
2922 {
2923 switch (enmEffOpSize)
2924 {
2925 case IEMMODE_16BIT:
2926 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2927 TmpRbp.DWords.dw0 -= 2;
2928 else
2929 TmpRbp.Words.w0 -= 2;
2930 do
2931 {
2932 uint16_t u16Tmp;
2933 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2934 if (rcStrict != VINF_SUCCESS)
2935 break;
2936 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2937 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2938 break;
2939
2940 case IEMMODE_32BIT:
2941 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2942 TmpRbp.DWords.dw0 -= 4;
2943 else
2944 TmpRbp.Words.w0 -= 4;
2945 do
2946 {
2947 uint32_t u32Tmp;
2948 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2949 if (rcStrict != VINF_SUCCESS)
2950 break;
2951 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2952 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2953 break;
2954
2955 case IEMMODE_64BIT:
2956 TmpRbp.u -= 8;
2957 do
2958 {
2959 uint64_t u64Tmp;
2960 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2961 if (rcStrict != VINF_SUCCESS)
2962 break;
2963 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2964 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2965 break;
2966
2967 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2968 }
2969 if (rcStrict != VINF_SUCCESS)
2970 return VINF_SUCCESS;
2971
2972 /* Push the new RBP */
2973 if (enmEffOpSize == IEMMODE_64BIT)
2974 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2975 else if (enmEffOpSize == IEMMODE_32BIT)
2976 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2977 else
2978 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2979 if (rcStrict != VINF_SUCCESS)
2980 return rcStrict;
2981
2982 }
2983
2984 /* Recalc RSP. */
2985 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2986
2987 /** @todo Should probe write access at the new RSP according to AMD. */
2988 /** @todo Should handle accesses to the VMX APIC-access page. */
2989
2990 /* Commit it. */
2991 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2992 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2993 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2994}
2995
2996
2997
2998/**
2999 * Implements leave.
3000 *
3001 * We're doing this in C because messing with the stack registers is annoying
3002 * since they depends on SS attributes.
3003 *
3004 * @param enmEffOpSize The effective operand size.
3005 */
3006IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
3007{
3008 /* Calculate the intermediate RSP from RBP and the stack attributes. */
3009 RTUINT64U NewRsp;
3010 if (IEM_IS_64BIT_CODE(pVCpu))
3011 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
3012 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3013 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
3014 else
3015 {
3016 /** @todo Check that LEAVE actually preserve the high EBP bits. */
3017 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
3018 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
3019 }
3020
3021 /* Pop RBP according to the operand size. */
3022 VBOXSTRICTRC rcStrict;
3023 RTUINT64U NewRbp;
3024 switch (enmEffOpSize)
3025 {
3026 case IEMMODE_16BIT:
3027 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
3028 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
3029 break;
3030 case IEMMODE_32BIT:
3031 NewRbp.u = 0;
3032 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
3033 break;
3034 case IEMMODE_64BIT:
3035 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
3036 break;
3037 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3038 }
3039 if (rcStrict != VINF_SUCCESS)
3040 return rcStrict;
3041
3042
3043 /* Commit it. */
3044 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
3045 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
3046 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
3047}
3048
3049
3050/**
3051 * Implements int3 and int XX.
3052 *
3053 * @param u8Int The interrupt vector number.
3054 * @param enmInt The int instruction type.
3055 */
3056IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
3057{
3058 Assert(pVCpu->iem.s.cXcptRecursions == 0);
3059
3060 /*
3061 * We must check if this INT3 might belong to DBGF before raising a #BP.
3062 */
3063 if (u8Int == 3)
3064 {
3065 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
3066 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
3067 { /* likely: No vbox debugger breakpoints */ }
3068 else
3069 {
3070 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
3071 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
3072 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
3073 return iemSetPassUpStatus(pVCpu, rcStrict);
3074 }
3075 }
3076/** @todo single stepping */
3077 return iemRaiseXcptOrInt(pVCpu,
3078 cbInstr,
3079 u8Int,
3080 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
3081 0,
3082 0);
3083}
3084
3085
3086/**
3087 * Implements iret for real mode and V8086 mode.
3088 *
3089 * @param enmEffOpSize The effective operand size.
3090 */
3091IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
3092{
3093 X86EFLAGS Efl;
3094 Efl.u = IEMMISC_GET_EFL(pVCpu);
3095 NOREF(cbInstr);
3096
3097 /*
3098 * iret throws an exception if VME isn't enabled.
3099 */
3100 if ( Efl.Bits.u1VM
3101 && Efl.Bits.u2IOPL != 3
3102 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
3103 return iemRaiseGeneralProtectionFault0(pVCpu);
3104
3105 /*
3106 * Do the stack bits, but don't commit RSP before everything checks
3107 * out right.
3108 */
3109 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3110 VBOXSTRICTRC rcStrict;
3111 uint8_t bUnmapInfo;
3112 RTCPTRUNION uFrame;
3113 uint16_t uNewCs;
3114 uint32_t uNewEip;
3115 uint32_t uNewFlags;
3116 uint64_t uNewRsp;
3117 if (enmEffOpSize == IEMMODE_32BIT)
3118 {
3119 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3120 if (rcStrict != VINF_SUCCESS)
3121 return rcStrict;
3122 uNewEip = uFrame.pu32[0];
3123 if (uNewEip > UINT16_MAX)
3124 return iemRaiseGeneralProtectionFault0(pVCpu);
3125
3126 uNewCs = (uint16_t)uFrame.pu32[1];
3127 uNewFlags = uFrame.pu32[2];
3128 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3129 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
3130 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
3131 | X86_EFL_ID;
3132 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3133 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3134 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
3135 }
3136 else
3137 {
3138 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3139 if (rcStrict != VINF_SUCCESS)
3140 return rcStrict;
3141 uNewEip = uFrame.pu16[0];
3142 uNewCs = uFrame.pu16[1];
3143 uNewFlags = uFrame.pu16[2];
3144 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3145 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
3146 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
3147 /** @todo The intel pseudo code does not indicate what happens to
3148 * reserved flags. We just ignore them. */
3149 /* Ancient CPU adjustments: See iemCImpl_popf. */
3150 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
3151 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
3152 }
3153 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
3154 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3155 { /* extremely likely */ }
3156 else
3157 return rcStrict;
3158
3159 /** @todo Check how this is supposed to work if sp=0xfffe. */
3160 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
3161 uNewCs, uNewEip, uNewFlags, uNewRsp));
3162
3163 /*
3164 * Check the limit of the new EIP.
3165 */
3166 /** @todo Only the AMD pseudo code check the limit here, what's
3167 * right? */
3168 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
3169 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
3170
3171 /*
3172 * V8086 checks and flag adjustments
3173 */
3174 if (Efl.Bits.u1VM)
3175 {
3176 if (Efl.Bits.u2IOPL == 3)
3177 {
3178 /* Preserve IOPL and clear RF. */
3179 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3180 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3181 }
3182 else if ( enmEffOpSize == IEMMODE_16BIT
3183 && ( !(uNewFlags & X86_EFL_IF)
3184 || !Efl.Bits.u1VIP )
3185 && !(uNewFlags & X86_EFL_TF) )
3186 {
3187 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3188 uNewFlags &= ~X86_EFL_VIF;
3189 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3190 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3191 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3192 }
3193 else
3194 return iemRaiseGeneralProtectionFault0(pVCpu);
3195 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3196 }
3197
3198 /*
3199 * Commit the operation.
3200 */
3201#ifdef DBGFTRACE_ENABLED
3202 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3203 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3204#endif
3205 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3206 pVCpu->cpum.GstCtx.rip = uNewEip;
3207 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3208 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3209 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3210 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3211 /** @todo do we load attribs and limit as well? */
3212 Assert(uNewFlags & X86_EFL_1);
3213 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3214
3215 /* Flush the prefetch buffer. */
3216 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo can do light flush in real mode at least */
3217
3218/** @todo single stepping */
3219 return VINF_SUCCESS;
3220}
3221
3222
3223/**
3224 * Loads a segment register when entering V8086 mode.
3225 *
3226 * @param pSReg The segment register.
3227 * @param uSeg The segment to load.
3228 */
3229static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3230{
3231 pSReg->Sel = uSeg;
3232 pSReg->ValidSel = uSeg;
3233 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3234 pSReg->u64Base = (uint32_t)uSeg << 4;
3235 pSReg->u32Limit = 0xffff;
3236 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3237 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3238 * IRET'ing to V8086. */
3239}
3240
3241
3242/**
3243 * Implements iret for protected mode returning to V8086 mode.
3244 *
3245 * @param uNewEip The new EIP.
3246 * @param uNewCs The new CS.
3247 * @param uNewFlags The new EFLAGS.
3248 * @param uNewRsp The RSP after the initial IRET frame.
3249 *
3250 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3251 */
3252IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3253{
3254 RT_NOREF_PV(cbInstr);
3255 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3256
3257 /*
3258 * Pop the V8086 specific frame bits off the stack.
3259 */
3260 uint8_t bUnmapInfo;
3261 RTCPTRUNION uFrame;
3262 VBOXSTRICTRC rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3263 if (rcStrict != VINF_SUCCESS)
3264 return rcStrict;
3265 uint32_t uNewEsp = uFrame.pu32[0];
3266 uint16_t uNewSs = uFrame.pu32[1];
3267 uint16_t uNewEs = uFrame.pu32[2];
3268 uint16_t uNewDs = uFrame.pu32[3];
3269 uint16_t uNewFs = uFrame.pu32[4];
3270 uint16_t uNewGs = uFrame.pu32[5];
3271 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3272 if (rcStrict != VINF_SUCCESS)
3273 return rcStrict;
3274
3275 /*
3276 * Commit the operation.
3277 */
3278 uNewFlags &= X86_EFL_LIVE_MASK;
3279 uNewFlags |= X86_EFL_RA1_MASK;
3280#ifdef DBGFTRACE_ENABLED
3281 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3282 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3283#endif
3284 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3285
3286 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3287 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3288 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3289 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3290 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3291 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3292 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3293 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3294 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3295 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
3296 | (3 << IEM_F_X86_CPL_SHIFT)
3297 | IEM_F_MODE_X86_16BIT_PROT_V86;
3298
3299 /* Flush the prefetch buffer. */
3300 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3301
3302/** @todo single stepping */
3303 return VINF_SUCCESS;
3304}
3305
3306
3307/**
3308 * Implements iret for protected mode returning via a nested task.
3309 *
3310 * @param enmEffOpSize The effective operand size.
3311 */
3312IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3313{
3314 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3315#ifndef IEM_IMPLEMENTS_TASKSWITCH
3316 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3317#else
3318 RT_NOREF_PV(enmEffOpSize);
3319
3320 /*
3321 * Read the segment selector in the link-field of the current TSS.
3322 */
3323 RTSEL uSelRet;
3324 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3325 if (rcStrict != VINF_SUCCESS)
3326 return rcStrict;
3327
3328 /*
3329 * Fetch the returning task's TSS descriptor from the GDT.
3330 */
3331 if (uSelRet & X86_SEL_LDT)
3332 {
3333 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3334 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3335 }
3336
3337 IEMSELDESC TssDesc;
3338 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3339 if (rcStrict != VINF_SUCCESS)
3340 return rcStrict;
3341
3342 if (TssDesc.Legacy.Gate.u1DescType)
3343 {
3344 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3345 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3346 }
3347
3348 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3349 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3350 {
3351 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3352 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3353 }
3354
3355 if (!TssDesc.Legacy.Gate.u1Present)
3356 {
3357 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3358 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3359 }
3360
3361 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3362 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3363 0 /* uCr2 */, uSelRet, &TssDesc);
3364#endif
3365}
3366
3367
3368/**
3369 * Implements iret for protected mode
3370 *
3371 * @param enmEffOpSize The effective operand size.
3372 */
3373IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3374{
3375 NOREF(cbInstr);
3376 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3377
3378 /*
3379 * Nested task return.
3380 */
3381 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3382 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3383
3384 /*
3385 * Normal return.
3386 *
3387 * Do the stack bits, but don't commit RSP before everything checks
3388 * out right.
3389 */
3390 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3391 uint8_t bUnmapInfo;
3392 VBOXSTRICTRC rcStrict;
3393 RTCPTRUNION uFrame;
3394 uint16_t uNewCs;
3395 uint32_t uNewEip;
3396 uint32_t uNewFlags;
3397 uint64_t uNewRsp;
3398 if (enmEffOpSize == IEMMODE_32BIT)
3399 {
3400 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3401 if (rcStrict != VINF_SUCCESS)
3402 return rcStrict;
3403 uNewEip = uFrame.pu32[0];
3404 uNewCs = (uint16_t)uFrame.pu32[1];
3405 uNewFlags = uFrame.pu32[2];
3406 }
3407 else
3408 {
3409 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3410 if (rcStrict != VINF_SUCCESS)
3411 return rcStrict;
3412 uNewEip = uFrame.pu16[0];
3413 uNewCs = uFrame.pu16[1];
3414 uNewFlags = uFrame.pu16[2];
3415 }
3416 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3417 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3418 { /* extremely likely */ }
3419 else
3420 return rcStrict;
3421 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, IEM_GET_CPL(pVCpu)));
3422
3423 /*
3424 * We're hopefully not returning to V8086 mode...
3425 */
3426 if ( (uNewFlags & X86_EFL_VM)
3427 && IEM_GET_CPL(pVCpu) == 0)
3428 {
3429 Assert(enmEffOpSize == IEMMODE_32BIT);
3430 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3431 }
3432
3433 /*
3434 * Protected mode.
3435 */
3436 /* Read the CS descriptor. */
3437 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3438 {
3439 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3440 return iemRaiseGeneralProtectionFault0(pVCpu);
3441 }
3442
3443 IEMSELDESC DescCS;
3444 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3445 if (rcStrict != VINF_SUCCESS)
3446 {
3447 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3448 return rcStrict;
3449 }
3450
3451 /* Must be a code descriptor. */
3452 if (!DescCS.Legacy.Gen.u1DescType)
3453 {
3454 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3455 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3456 }
3457 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3458 {
3459 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3460 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3461 }
3462
3463 /* Privilege checks. */
3464 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3465 {
3466 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3467 {
3468 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3469 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3470 }
3471 }
3472 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3473 {
3474 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3475 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3476 }
3477 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3478 {
3479 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, IEM_GET_CPL(pVCpu)));
3480 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3481 }
3482
3483 /* Present? */
3484 if (!DescCS.Legacy.Gen.u1Present)
3485 {
3486 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3487 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3488 }
3489
3490 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3491
3492 /*
3493 * Return to outer level?
3494 */
3495 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
3496 {
3497 uint16_t uNewSS;
3498 uint32_t uNewESP;
3499 if (enmEffOpSize == IEMMODE_32BIT)
3500 {
3501 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3502 if (rcStrict != VINF_SUCCESS)
3503 return rcStrict;
3504/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3505 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3506 * bit of the popped SS selector it turns out. */
3507 uNewESP = uFrame.pu32[0];
3508 uNewSS = (uint16_t)uFrame.pu32[1];
3509 }
3510 else
3511 {
3512 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3513 if (rcStrict != VINF_SUCCESS)
3514 return rcStrict;
3515 uNewESP = uFrame.pu16[0];
3516 uNewSS = uFrame.pu16[1];
3517 }
3518 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
3519 if (rcStrict != VINF_SUCCESS)
3520 return rcStrict;
3521 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3522
3523 /* Read the SS descriptor. */
3524 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3525 {
3526 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3527 return iemRaiseGeneralProtectionFault0(pVCpu);
3528 }
3529
3530 IEMSELDESC DescSS;
3531 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3532 if (rcStrict != VINF_SUCCESS)
3533 {
3534 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3535 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3536 return rcStrict;
3537 }
3538
3539 /* Privilege checks. */
3540 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3541 {
3542 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3543 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3544 }
3545 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3546 {
3547 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3548 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3549 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3550 }
3551
3552 /* Must be a writeable data segment descriptor. */
3553 if (!DescSS.Legacy.Gen.u1DescType)
3554 {
3555 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3556 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3557 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3558 }
3559 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3560 {
3561 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3562 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3563 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3564 }
3565
3566 /* Present? */
3567 if (!DescSS.Legacy.Gen.u1Present)
3568 {
3569 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3570 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3571 }
3572
3573 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3574
3575 /* Check EIP. */
3576 if (uNewEip > cbLimitCS)
3577 {
3578 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3579 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3580 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3581 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3582 }
3583
3584 /*
3585 * Commit the changes, marking CS and SS accessed first since
3586 * that may fail.
3587 */
3588 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3589 {
3590 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3591 if (rcStrict != VINF_SUCCESS)
3592 return rcStrict;
3593 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3594 }
3595 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3596 {
3597 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3598 if (rcStrict != VINF_SUCCESS)
3599 return rcStrict;
3600 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3601 }
3602
3603 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3604 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3605 if (enmEffOpSize != IEMMODE_16BIT)
3606 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3607 if (IEM_GET_CPL(pVCpu) == 0)
3608 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3609 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3610 fEFlagsMask |= X86_EFL_IF;
3611 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3612 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3613 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3614 fEFlagsNew &= ~fEFlagsMask;
3615 fEFlagsNew |= uNewFlags & fEFlagsMask;
3616#ifdef DBGFTRACE_ENABLED
3617 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3618 IEM_GET_CPL(pVCpu), uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3619 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3620#endif
3621
3622 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3623 pVCpu->cpum.GstCtx.rip = uNewEip;
3624 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3625 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3626 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3627 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3628 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3629 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3630
3631 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3632 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3633 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3634 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3635 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3636 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3637 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3638 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3639 else
3640 pVCpu->cpum.GstCtx.rsp = uNewESP;
3641
3642 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3643 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3644 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3645 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3646
3647 iemRecalcExecModeAndCplFlags(pVCpu);
3648
3649 /* Done! */
3650
3651 }
3652 /*
3653 * Return to the same level.
3654 */
3655 else
3656 {
3657 /* Check EIP. */
3658 if (uNewEip > cbLimitCS)
3659 {
3660 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3661 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3662 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3663 }
3664
3665 /*
3666 * Commit the changes, marking CS first since it may fail.
3667 */
3668 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3669 {
3670 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3671 if (rcStrict != VINF_SUCCESS)
3672 return rcStrict;
3673 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3674 }
3675
3676 X86EFLAGS NewEfl;
3677 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3678 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3679 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3680 if (enmEffOpSize != IEMMODE_16BIT)
3681 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3682 if (IEM_GET_CPL(pVCpu) == 0)
3683 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3684 else if (IEM_GET_CPL(pVCpu) <= NewEfl.Bits.u2IOPL)
3685 fEFlagsMask |= X86_EFL_IF;
3686 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3687 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3688 NewEfl.u &= ~fEFlagsMask;
3689 NewEfl.u |= fEFlagsMask & uNewFlags;
3690#ifdef DBGFTRACE_ENABLED
3691 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3692 IEM_GET_CPL(pVCpu), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3693 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3694#endif
3695
3696 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3697 pVCpu->cpum.GstCtx.rip = uNewEip;
3698 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3699 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3700 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3701 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3702 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3703 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3704 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3705 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3706 else
3707 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3708
3709 iemRecalcExecModeAndCplFlags(pVCpu);
3710
3711 /* Done! */
3712 }
3713
3714 /* Flush the prefetch buffer. */
3715 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if same ring? */
3716
3717/** @todo single stepping */
3718 return VINF_SUCCESS;
3719}
3720
3721
3722/**
3723 * Implements iret for long mode
3724 *
3725 * @param enmEffOpSize The effective operand size.
3726 */
3727IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3728{
3729 NOREF(cbInstr);
3730
3731 /*
3732 * Nested task return is not supported in long mode.
3733 */
3734 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3735 {
3736 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3737 return iemRaiseGeneralProtectionFault0(pVCpu);
3738 }
3739
3740 /*
3741 * Normal return.
3742 *
3743 * Do the stack bits, but don't commit RSP before everything checks
3744 * out right.
3745 */
3746 VBOXSTRICTRC rcStrict;
3747 uint8_t bUnmapInfo;
3748 RTCPTRUNION uFrame;
3749 uint64_t uNewRip;
3750 uint16_t uNewCs;
3751 uint16_t uNewSs;
3752 uint32_t uNewFlags;
3753 uint64_t uNewRsp;
3754 if (enmEffOpSize == IEMMODE_64BIT)
3755 {
3756 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3757 if (rcStrict != VINF_SUCCESS)
3758 return rcStrict;
3759 uNewRip = uFrame.pu64[0];
3760 uNewCs = (uint16_t)uFrame.pu64[1];
3761 uNewFlags = (uint32_t)uFrame.pu64[2];
3762 uNewRsp = uFrame.pu64[3];
3763 uNewSs = (uint16_t)uFrame.pu64[4];
3764 }
3765 else if (enmEffOpSize == IEMMODE_32BIT)
3766 {
3767 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3768 if (rcStrict != VINF_SUCCESS)
3769 return rcStrict;
3770 uNewRip = uFrame.pu32[0];
3771 uNewCs = (uint16_t)uFrame.pu32[1];
3772 uNewFlags = uFrame.pu32[2];
3773 uNewRsp = uFrame.pu32[3];
3774 uNewSs = (uint16_t)uFrame.pu32[4];
3775 }
3776 else
3777 {
3778 Assert(enmEffOpSize == IEMMODE_16BIT);
3779 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3780 if (rcStrict != VINF_SUCCESS)
3781 return rcStrict;
3782 uNewRip = uFrame.pu16[0];
3783 uNewCs = uFrame.pu16[1];
3784 uNewFlags = uFrame.pu16[2];
3785 uNewRsp = uFrame.pu16[3];
3786 uNewSs = uFrame.pu16[4];
3787 }
3788 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3789 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3790 { /* extremely like */ }
3791 else
3792 return rcStrict;
3793 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3794
3795 /*
3796 * Check stuff.
3797 */
3798 /* Read the CS descriptor. */
3799 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3800 {
3801 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3802 return iemRaiseGeneralProtectionFault0(pVCpu);
3803 }
3804
3805 IEMSELDESC DescCS;
3806 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3807 if (rcStrict != VINF_SUCCESS)
3808 {
3809 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3810 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3811 return rcStrict;
3812 }
3813
3814 /* Must be a code descriptor. */
3815 if ( !DescCS.Legacy.Gen.u1DescType
3816 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3817 {
3818 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3819 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3820 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3821 }
3822
3823 /* Privilege checks. */
3824 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3825 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3826 {
3827 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3828 {
3829 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3830 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3831 }
3832 }
3833 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3834 {
3835 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3836 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3837 }
3838 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3839 {
3840 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
3841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3842 }
3843
3844 /* Present? */
3845 if (!DescCS.Legacy.Gen.u1Present)
3846 {
3847 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3848 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3849 }
3850
3851 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3852
3853 /* Read the SS descriptor. */
3854 IEMSELDESC DescSS;
3855 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3856 {
3857 if ( !DescCS.Legacy.Gen.u1Long
3858 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3859 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3860 {
3861 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3862 return iemRaiseGeneralProtectionFault0(pVCpu);
3863 }
3864 /* Make sure SS is sensible, marked as accessed etc. */
3865 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3866 }
3867 else
3868 {
3869 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3870 if (rcStrict != VINF_SUCCESS)
3871 {
3872 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3873 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3874 return rcStrict;
3875 }
3876 }
3877
3878 /* Privilege checks. */
3879 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3880 {
3881 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3882 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3883 }
3884
3885 uint32_t cbLimitSs;
3886 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3887 cbLimitSs = UINT32_MAX;
3888 else
3889 {
3890 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3891 {
3892 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3893 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3894 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3895 }
3896
3897 /* Must be a writeable data segment descriptor. */
3898 if (!DescSS.Legacy.Gen.u1DescType)
3899 {
3900 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3901 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3902 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3903 }
3904 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3905 {
3906 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3907 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3908 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3909 }
3910
3911 /* Present? */
3912 if (!DescSS.Legacy.Gen.u1Present)
3913 {
3914 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3915 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3916 }
3917 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3918 }
3919
3920 /* Check EIP. */
3921 if (DescCS.Legacy.Gen.u1Long)
3922 {
3923 if (!IEM_IS_CANONICAL(uNewRip))
3924 {
3925 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3926 uNewCs, uNewRip, uNewSs, uNewRsp));
3927 return iemRaiseNotCanonical(pVCpu);
3928 }
3929/** @todo check the location of this... Testcase. */
3930 if (RT_LIKELY(!DescCS.Legacy.Gen.u1DefBig))
3931 { /* likely */ }
3932 else
3933 {
3934 Log(("iret %04x:%016RX64/%04x:%016RX64 -> both L and D are set -> #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3935 return iemRaiseGeneralProtectionFault0(pVCpu);
3936 }
3937 }
3938 else
3939 {
3940 if (uNewRip > cbLimitCS)
3941 {
3942 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3943 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3944 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3945 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3946 }
3947 }
3948
3949 /*
3950 * Commit the changes, marking CS and SS accessed first since
3951 * that may fail.
3952 */
3953 /** @todo where exactly are these actually marked accessed by a real CPU? */
3954 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3955 {
3956 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3957 if (rcStrict != VINF_SUCCESS)
3958 return rcStrict;
3959 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3960 }
3961 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3962 {
3963 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3964 if (rcStrict != VINF_SUCCESS)
3965 return rcStrict;
3966 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3967 }
3968
3969 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3970 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3971 if (enmEffOpSize != IEMMODE_16BIT)
3972 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3973 if (IEM_GET_CPL(pVCpu) == 0)
3974 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3975 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3976 fEFlagsMask |= X86_EFL_IF;
3977 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3978 fEFlagsNew &= ~fEFlagsMask;
3979 fEFlagsNew |= uNewFlags & fEFlagsMask;
3980#ifdef DBGFTRACE_ENABLED
3981 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3982 IEM_GET_CPL(pVCpu), uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3983#endif
3984
3985 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3986 pVCpu->cpum.GstCtx.rip = uNewRip;
3987 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3988 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3989 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3990 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3991 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3992 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3993 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3994 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3995 else
3996 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3997 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3998 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3999 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
4000 {
4001 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4002 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
4003 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4004 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4005 Log2(("iretq new SS: NULL\n"));
4006 }
4007 else
4008 {
4009 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4010 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
4011 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
4012 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
4013 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4014 }
4015
4016 if (IEM_GET_CPL(pVCpu) != uNewCpl)
4017 {
4018 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
4019 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
4020 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
4021 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
4022 }
4023
4024 iemRecalcExecModeAndCplFlags(pVCpu);
4025
4026 /* Flush the prefetch buffer. */
4027 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if the ring + mode doesn't change */
4028
4029/** @todo single stepping */
4030 return VINF_SUCCESS;
4031}
4032
4033
4034/**
4035 * Implements iret.
4036 *
4037 * @param enmEffOpSize The effective operand size.
4038 */
4039IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
4040{
4041 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
4042
4043 if (!IEM_IS_IN_GUEST(pVCpu))
4044 { /* probable */ }
4045#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4046 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4047 {
4048 /*
4049 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
4050 * of this IRET instruction. We need to provide this information as part of some
4051 * VM-exits.
4052 *
4053 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
4054 */
4055 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
4056 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
4057 else
4058 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
4059
4060 /*
4061 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
4062 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
4063 */
4064 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
4065 fBlockingNmi = false;
4066
4067 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
4068 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
4069 }
4070#endif
4071 /*
4072 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
4073 * The NMI is still held pending (which I assume means blocking of further NMIs
4074 * is in effect).
4075 *
4076 * See AMD spec. 15.9 "Instruction Intercepts".
4077 * See AMD spec. 15.21.9 "NMI Support".
4078 */
4079 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
4080 {
4081 Log(("iret: Guest intercept -> #VMEXIT\n"));
4082 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
4083 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4084 }
4085
4086 /*
4087 * Clear NMI blocking, if any, before causing any further exceptions.
4088 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
4089 */
4090 if (fBlockingNmi)
4091 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
4092
4093 /*
4094 * Call a mode specific worker.
4095 */
4096 VBOXSTRICTRC rcStrict;
4097 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4098 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
4099 else
4100 {
4101 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
4102 if (IEM_IS_64BIT_CODE(pVCpu))
4103 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
4104 else
4105 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
4106 }
4107
4108#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
4109 /*
4110 * Clear NMI unblocking IRET state with the completion of IRET.
4111 */
4112 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
4113 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
4114#endif
4115 return rcStrict;
4116}
4117
4118
4119static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4120{
4121 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4122
4123 pHid->Sel = uSel;
4124 pHid->ValidSel = uSel;
4125 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4126}
4127
4128
4129static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
4130{
4131 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4132
4133 /* The base is in the first three bytes. */
4134 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
4135 /* The attributes are in the fourth byte. */
4136 pHid->Attr.u = pbMem[3];
4137 pHid->Attr.u &= ~(X86DESCATTR_L | X86DESCATTR_D); /* (just to be on the safe side) */
4138 /* The limit is in the last two bytes. */
4139 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
4140}
4141
4142
4143/**
4144 * Implements 286 LOADALL (286 CPUs only).
4145 */
4146IEM_CIMPL_DEF_0(iemCImpl_loadall286)
4147{
4148 NOREF(cbInstr);
4149
4150 /* Data is loaded from a buffer at 800h. No checks are done on the
4151 * validity of loaded state.
4152 *
4153 * LOADALL only loads the internal CPU state, it does not access any
4154 * GDT, LDT, or similar tables.
4155 */
4156
4157 if (IEM_GET_CPL(pVCpu) != 0)
4158 {
4159 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4160 return iemRaiseGeneralProtectionFault0(pVCpu);
4161 }
4162
4163 uint8_t bUnmapInfo;
4164 uint8_t const *pbMem = NULL;
4165 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
4166 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, &bUnmapInfo, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
4167 if (rcStrict != VINF_SUCCESS)
4168 return rcStrict;
4169
4170 /* The MSW is at offset 0x06. */
4171 uint16_t const *pau16Mem = (uint16_t const *)(pbMem + 0x06);
4172 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
4173 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4174 uNewCr0 |= *pau16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4175 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
4176
4177 CPUMSetGuestCR0(pVCpu, uNewCr0);
4178 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
4179
4180 /* Inform PGM if mode changed. */
4181 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
4182 {
4183 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
4184 AssertRCReturn(rc, rc);
4185 /* ignore informational status codes */
4186 }
4187 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
4188 false /* fForce */);
4189
4190 /* TR selector is at offset 0x16. */
4191 pau16Mem = (uint16_t const *)(pbMem + 0x16);
4192 pVCpu->cpum.GstCtx.tr.Sel = pau16Mem[0];
4193 pVCpu->cpum.GstCtx.tr.ValidSel = pau16Mem[0];
4194 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
4195
4196 /* Followed by FLAGS... */
4197 pVCpu->cpum.GstCtx.eflags.u = pau16Mem[1] | X86_EFL_1;
4198 pVCpu->cpum.GstCtx.ip = pau16Mem[2]; /* ...and IP. */
4199
4200 /* LDT is at offset 0x1C. */
4201 pau16Mem = (uint16_t const *)(pbMem + 0x1C);
4202 pVCpu->cpum.GstCtx.ldtr.Sel = pau16Mem[0];
4203 pVCpu->cpum.GstCtx.ldtr.ValidSel = pau16Mem[0];
4204 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4205
4206 /* Segment registers are at offset 0x1E. */
4207 pau16Mem = (uint16_t const *)(pbMem + 0x1E);
4208 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pau16Mem[0]);
4209 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pau16Mem[1]);
4210 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pau16Mem[2]);
4211 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pau16Mem[3]);
4212
4213 /* GPRs are at offset 0x26. */
4214 pau16Mem = (uint16_t const *)(pbMem + 0x26);
4215 pVCpu->cpum.GstCtx.di = pau16Mem[0];
4216 pVCpu->cpum.GstCtx.si = pau16Mem[1];
4217 pVCpu->cpum.GstCtx.bp = pau16Mem[2];
4218 pVCpu->cpum.GstCtx.sp = pau16Mem[3];
4219 pVCpu->cpum.GstCtx.bx = pau16Mem[4];
4220 pVCpu->cpum.GstCtx.dx = pau16Mem[5];
4221 pVCpu->cpum.GstCtx.cx = pau16Mem[6];
4222 pVCpu->cpum.GstCtx.ax = pau16Mem[7];
4223
4224 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4225 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4226 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4227 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4228 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4229
4230 /* GDTR contents are at offset 0x4E, 6 bytes. */
4231 uint8_t const *pau8Mem = pbMem + 0x4E;
4232 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4233 RTGCPHYS GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
4234 uint16_t cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
4235 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4236
4237 /* IDTR contents are at offset 0x5A, 6 bytes. */
4238 pau8Mem = pbMem + 0x5A;
4239 GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
4240 cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
4241 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4242
4243 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4244 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4245 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4246 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4247 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4248 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4249
4250 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
4251 if (rcStrict != VINF_SUCCESS)
4252 return rcStrict;
4253
4254 /*
4255 * The CPL may change and protected mode may change enabled. It is taken
4256 * from the "DPL fields of the SS and CS descriptor caches" but there is no
4257 * word as to what happens if those are not identical (probably bad things).
4258 */
4259 iemRecalcExecModeAndCplFlags(pVCpu);
4260 Assert(IEM_IS_16BIT_CODE(pVCpu));
4261
4262 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4263
4264 /* Flush the prefetch buffer. */
4265 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4266
4267/** @todo single stepping */
4268 return rcStrict;
4269}
4270
4271
4272/**
4273 * Implements SYSCALL (AMD and Intel64).
4274 */
4275IEM_CIMPL_DEF_0(iemCImpl_syscall)
4276{
4277 /** @todo hack, LOADALL should be decoded as such on a 286. */
4278 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4279 return iemCImpl_loadall286(pVCpu, cbInstr);
4280
4281 /*
4282 * Check preconditions.
4283 *
4284 * Note that CPUs described in the documentation may load a few odd values
4285 * into CS and SS than we allow here. This has yet to be checked on real
4286 * hardware.
4287 */
4288 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4289 {
4290 Log(("syscall: Not enabled in EFER -> #UD\n"));
4291 return iemRaiseUndefinedOpcode(pVCpu);
4292 }
4293 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4294 {
4295 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4296 return iemRaiseGeneralProtectionFault0(pVCpu);
4297 }
4298 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4299 {
4300 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4301 return iemRaiseUndefinedOpcode(pVCpu);
4302 }
4303
4304 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4305
4306 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4307 /** @todo what about LDT selectors? Shouldn't matter, really. */
4308 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4309 uint16_t uNewSs = uNewCs + 8;
4310 if (uNewCs == 0 || uNewSs == 0)
4311 {
4312 /** @todo Neither Intel nor AMD document this check. */
4313 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4314 return iemRaiseGeneralProtectionFault0(pVCpu);
4315 }
4316
4317 /* Long mode and legacy mode differs. */
4318 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4319 {
4320 uint64_t uNewRip = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4321
4322 /* This test isn't in the docs, but I'm not trusting the guys writing
4323 the MSRs to have validated the values as canonical like they should. */
4324 if (!IEM_IS_CANONICAL(uNewRip))
4325 {
4326 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4327 Log(("syscall: New RIP not canonical -> #UD\n"));
4328 return iemRaiseUndefinedOpcode(pVCpu);
4329 }
4330
4331 /*
4332 * Commit it.
4333 */
4334 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4335 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4336 pVCpu->cpum.GstCtx.rip = uNewRip;
4337
4338 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4339 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4340 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4341 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4342
4343 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4344 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4345
4346 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4347 | IEM_F_MODE_X86_64BIT;
4348 }
4349 else
4350 {
4351 /*
4352 * Commit it.
4353 */
4354 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4355 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4356 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4357 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4358
4359 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4360 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4361
4362 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4363 | IEM_F_MODE_X86_32BIT_PROT
4364 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4365 }
4366 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4367 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4368 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4369 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4370 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4371
4372 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4373 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4374 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4375 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4376 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4377
4378 /* Flush the prefetch buffer. */
4379 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4380
4381/** @todo single step */
4382 return VINF_SUCCESS;
4383}
4384
4385
4386/**
4387 * Implements SYSRET (AMD and Intel64).
4388 *
4389 * @param enmEffOpSize The effective operand size.
4390 */
4391IEM_CIMPL_DEF_1(iemCImpl_sysret, IEMMODE, enmEffOpSize)
4392
4393{
4394 RT_NOREF_PV(cbInstr);
4395
4396 /*
4397 * Check preconditions.
4398 *
4399 * Note that CPUs described in the documentation may load a few odd values
4400 * into CS and SS than we allow here. This has yet to be checked on real
4401 * hardware.
4402 */
4403 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4404 {
4405 Log(("sysret: Not enabled in EFER -> #UD\n"));
4406 return iemRaiseUndefinedOpcode(pVCpu);
4407 }
4408 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4409 {
4410 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4411 return iemRaiseUndefinedOpcode(pVCpu);
4412 }
4413 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4414 {
4415 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4416 return iemRaiseGeneralProtectionFault0(pVCpu);
4417 }
4418 if (IEM_GET_CPL(pVCpu) != 0)
4419 {
4420 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4421 return iemRaiseGeneralProtectionFault0(pVCpu);
4422 }
4423
4424 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4425
4426 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4427 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4428 uint16_t uNewSs = uNewCs + 8;
4429 if (enmEffOpSize == IEMMODE_64BIT)
4430 uNewCs += 16;
4431 if (uNewCs == 0 || uNewSs == 0)
4432 {
4433 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4434 return iemRaiseGeneralProtectionFault0(pVCpu);
4435 }
4436
4437 /*
4438 * Commit it.
4439 */
4440 bool f32Bit = true;
4441 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4442 {
4443 if (enmEffOpSize == IEMMODE_64BIT)
4444 {
4445 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4446 /* Note! We disregard intel manual regarding the RCX canonical
4447 check, ask intel+xen why AMD doesn't do it. */
4448 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4449 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4450 | (3 << X86DESCATTR_DPL_SHIFT);
4451 f32Bit = false;
4452 }
4453 else
4454 {
4455 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4456 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4457 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4458 | (3 << X86DESCATTR_DPL_SHIFT);
4459 }
4460 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4461 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4462 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4463 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4464 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4465 }
4466 else
4467 {
4468 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4469 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4470 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4471 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4472 | (3 << X86DESCATTR_DPL_SHIFT);
4473 }
4474 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4475 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4476 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4477 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4478 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4479
4480 /* The SS hidden bits remains unchanged says AMD, we presume they set DPL to 3.
4481 Intel (and presuably VIA) OTOH sets loads valid ring-3 values it seems, see
4482 X86_BUG_SYSRET_SS_ATTRS in linux 5.3. */
4483 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4484 {
4485 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u | (3 << X86DESCATTR_DPL_SHIFT) ));
4486 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4487 }
4488 else
4489 {
4490 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT) ));
4491 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC
4492 | (3 << X86DESCATTR_DPL_SHIFT);
4493 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4494 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4495 }
4496 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4497 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4498 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4499 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4500 * on sysret on AMD and not on intel. */
4501
4502 if (!f32Bit)
4503 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4504 | (3 << IEM_F_X86_CPL_SHIFT)
4505 | IEM_F_MODE_X86_64BIT;
4506 else
4507 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4508 | (3 << IEM_F_X86_CPL_SHIFT)
4509 | IEM_F_MODE_X86_32BIT_PROT
4510 /** @todo sort out the SS.BASE/LIM/ATTR claim by AMD and maybe we can switch to
4511 * iemCalc32BitFlatIndicatorDsEs and move this up into the above branch. */
4512 | iemCalc32BitFlatIndicator(pVCpu);
4513
4514 /* Flush the prefetch buffer. */
4515 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4516
4517/** @todo single step */
4518 return VINF_SUCCESS;
4519}
4520
4521
4522/**
4523 * Implements SYSENTER (Intel, 32-bit AMD).
4524 */
4525IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4526{
4527 RT_NOREF(cbInstr);
4528
4529 /*
4530 * Check preconditions.
4531 *
4532 * Note that CPUs described in the documentation may load a few odd values
4533 * into CS and SS than we allow here. This has yet to be checked on real
4534 * hardware.
4535 */
4536 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4537 {
4538 Log(("sysenter: not supported -=> #UD\n"));
4539 return iemRaiseUndefinedOpcode(pVCpu);
4540 }
4541 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4542 {
4543 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4544 return iemRaiseGeneralProtectionFault0(pVCpu);
4545 }
4546 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4547 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4548 {
4549 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4550 return iemRaiseUndefinedOpcode(pVCpu);
4551 }
4552 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4553 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4554 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4555 {
4556 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4557 return iemRaiseGeneralProtectionFault0(pVCpu);
4558 }
4559
4560 /* This test isn't in the docs, it's just a safeguard against missing
4561 canonical checks when writing the registers. */
4562 if (RT_LIKELY( !fIsLongMode
4563 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4564 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4565 { /* likely */ }
4566 else
4567 {
4568 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4569 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4570 return iemRaiseUndefinedOpcode(pVCpu);
4571 }
4572
4573/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4574
4575 /*
4576 * Update registers and commit.
4577 */
4578 if (fIsLongMode)
4579 {
4580 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4581 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4582 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4583 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4584 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4585 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4586 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4587 | IEM_F_MODE_X86_64BIT;
4588 }
4589 else
4590 {
4591 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, (uint32_t)pVCpu->cpum.GstCtx.rip,
4592 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4593 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4594 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4595 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4596 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4597 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4598 | IEM_F_MODE_X86_32BIT_PROT
4599 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4600 }
4601 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4602 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4603 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4604 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4605 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4606
4607 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4608 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4609 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4610 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4611 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4612 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4613 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4614
4615 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4616 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4617 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4618
4619 /* Flush the prefetch buffer. */
4620 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4621
4622/** @todo single stepping */
4623 return VINF_SUCCESS;
4624}
4625
4626
4627/**
4628 * Implements SYSEXIT (Intel, 32-bit AMD).
4629 *
4630 * @param enmEffOpSize The effective operand size.
4631 */
4632IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4633{
4634 RT_NOREF(cbInstr);
4635
4636 /*
4637 * Check preconditions.
4638 *
4639 * Note that CPUs described in the documentation may load a few odd values
4640 * into CS and SS than we allow here. This has yet to be checked on real
4641 * hardware.
4642 */
4643 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4644 {
4645 Log(("sysexit: not supported -=> #UD\n"));
4646 return iemRaiseUndefinedOpcode(pVCpu);
4647 }
4648 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4649 {
4650 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4651 return iemRaiseGeneralProtectionFault0(pVCpu);
4652 }
4653 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4654 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4655 {
4656 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4657 return iemRaiseUndefinedOpcode(pVCpu);
4658 }
4659 if (IEM_GET_CPL(pVCpu) != 0)
4660 {
4661 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4662 return iemRaiseGeneralProtectionFault0(pVCpu);
4663 }
4664 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4665 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4666 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4667 {
4668 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4669 return iemRaiseGeneralProtectionFault0(pVCpu);
4670 }
4671
4672 /*
4673 * Update registers and commit.
4674 */
4675 if (enmEffOpSize == IEMMODE_64BIT)
4676 {
4677 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4678 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4679 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4680 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4681 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4682 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4683 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4684 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4685 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4686 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4687
4688 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4689 | (3 << IEM_F_X86_CPL_SHIFT)
4690 | IEM_F_MODE_X86_64BIT;
4691 }
4692 else
4693 {
4694 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4695 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4696 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4697 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4698 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4699 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4700 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4701 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4702 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4703 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4704
4705 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4706 | (3 << IEM_F_X86_CPL_SHIFT)
4707 | IEM_F_MODE_X86_32BIT_PROT
4708 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4709 }
4710 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4711 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4712 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4713
4714 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4715 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4716 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4717 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4718 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4719 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4720
4721/** @todo single stepping */
4722
4723 /* Flush the prefetch buffer. */
4724 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4725
4726 return VINF_SUCCESS;
4727}
4728
4729
4730/**
4731 * Completes a MOV SReg,XXX or POP SReg instruction.
4732 *
4733 * When not modifying SS or when we're already in an interrupt shadow we
4734 * can update RIP and finish the instruction the normal way.
4735 *
4736 * Otherwise, the MOV/POP SS interrupt shadow that we now enable will block
4737 * both TF and DBx events. The TF will be ignored while the DBx ones will
4738 * be delayed till the next instruction boundrary. For more details see
4739 * @sdmv3{077,200,6.8.3,Masking Exceptions and Interrupts When Switching Stacks}.
4740 */
4741DECLINLINE(VBOXSTRICTRC) iemCImpl_LoadSRegFinish(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iSegReg)
4742{
4743 if (iSegReg != X86_SREG_SS || CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
4744 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4745
4746 iemRegAddToRip(pVCpu, cbInstr);
4747 pVCpu->cpum.GstCtx.eflags.uBoth &= ~X86_EFL_RF; /* Shadow int isn't set and DRx is delayed, so only clear RF. */
4748 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4749
4750 return VINF_SUCCESS;
4751}
4752
4753
4754/**
4755 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4756 *
4757 * @param pVCpu The cross context virtual CPU structure of the calling
4758 * thread.
4759 * @param iSegReg The segment register number (valid).
4760 * @param uSel The new selector value.
4761 */
4762static VBOXSTRICTRC iemCImpl_LoadSRegWorker(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4763{
4764 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4765 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4766 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4767
4768 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4769
4770 /*
4771 * Real mode and V8086 mode are easy.
4772 */
4773 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4774 {
4775 *pSel = uSel;
4776 pHid->u64Base = (uint32_t)uSel << 4;
4777 pHid->ValidSel = uSel;
4778 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4779#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4780 /** @todo Does the CPU actually load limits and attributes in the
4781 * real/V8086 mode segment load case? It doesn't for CS in far
4782 * jumps... Affects unreal mode. */
4783 pHid->u32Limit = 0xffff;
4784 pHid->Attr.u = 0;
4785 pHid->Attr.n.u1Present = 1;
4786 pHid->Attr.n.u1DescType = 1;
4787 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4788 ? X86_SEL_TYPE_RW
4789 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4790#endif
4791
4792 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
4793 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
4794 { /* likely */ }
4795 else if (uSel != 0)
4796 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4797 else
4798 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4799 | iemCalc32BitFlatIndicator(pVCpu);
4800 }
4801 /*
4802 * Protected / long mode - null segment.
4803 *
4804 * Check if it's a null segment selector value first, that's OK for DS, ES,
4805 * FS and GS. If not null, then we have to load and parse the descriptor.
4806 */
4807 else if (!(uSel & X86_SEL_MASK_OFF_RPL))
4808 {
4809 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4810 if (iSegReg == X86_SREG_SS)
4811 {
4812 /* In 64-bit kernel mode, the stack can be 0 because of the way
4813 interrupts are dispatched. AMD seems to have a slighly more
4814 relaxed relationship to SS.RPL than intel does. */
4815 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4816 if ( !IEM_IS_64BIT_CODE(pVCpu)
4817 || IEM_GET_CPL(pVCpu) > 2
4818 || ( uSel != IEM_GET_CPL(pVCpu)
4819 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4820 {
4821 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4822 return iemRaiseGeneralProtectionFault0(pVCpu);
4823 }
4824 }
4825
4826 *pSel = uSel; /* Not RPL, remember :-) */
4827 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4828 if (iSegReg == X86_SREG_SS)
4829 pHid->Attr.u |= IEM_GET_CPL(pVCpu) << X86DESCATTR_DPL_SHIFT;
4830
4831 /* This will affect the FLAT 32-bit mode flag: */
4832 if ( iSegReg < X86_SREG_FS
4833 && IEM_IS_32BIT_CODE(pVCpu))
4834 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4835 }
4836 /*
4837 * Protected / long mode.
4838 */
4839 else
4840 {
4841 /* Fetch the descriptor. */
4842 IEMSELDESC Desc;
4843 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4844 if (rcStrict != VINF_SUCCESS)
4845 return rcStrict;
4846
4847 /* Check GPs first. */
4848 if (!Desc.Legacy.Gen.u1DescType)
4849 {
4850 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4851 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4852 }
4853 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4854 {
4855 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4856 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4857 {
4858 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4859 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4860 }
4861 if ((uSel & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
4862 {
4863 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, IEM_GET_CPL(pVCpu)));
4864 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4865 }
4866 if (Desc.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
4867 {
4868 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
4869 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4870 }
4871 }
4872 else
4873 {
4874 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4875 {
4876 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4877 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4878 }
4879 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4880 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4881 {
4882#if 0 /* this is what intel says. */
4883 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4884 && IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4885 {
4886 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4887 iSegReg, uSel, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4888 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4889 }
4890#else /* this is what makes more sense. */
4891 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4892 {
4893 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4894 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4895 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4896 }
4897 if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4898 {
4899 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4900 iSegReg, uSel, IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4901 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4902 }
4903#endif
4904 }
4905 }
4906
4907 /* Is it there? */
4908 if (!Desc.Legacy.Gen.u1Present)
4909 {
4910 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4911 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4912 }
4913
4914 /* The base and limit. */
4915 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4916 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4917
4918 /*
4919 * Ok, everything checked out fine. Now set the accessed bit before
4920 * committing the result into the registers.
4921 */
4922 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4923 {
4924 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4925 if (rcStrict != VINF_SUCCESS)
4926 return rcStrict;
4927 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4928 }
4929
4930 /* commit */
4931 *pSel = uSel;
4932 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4933 pHid->u32Limit = cbLimit;
4934 pHid->u64Base = u64Base;
4935 pHid->ValidSel = uSel;
4936 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4937
4938 /** @todo check if the hidden bits are loaded correctly for 64-bit
4939 * mode. */
4940
4941 /* This will affect the FLAT 32-bit mode flag: */
4942 if ( iSegReg < X86_SREG_FS
4943 && IEM_IS_32BIT_CODE(pVCpu))
4944 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4945 | iemCalc32BitFlatIndicator(pVCpu);
4946 }
4947
4948 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4949 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4950 return VINF_SUCCESS;
4951}
4952
4953
4954/**
4955 * Implements 'mov SReg, r/m'.
4956 *
4957 * @param iSegReg The segment register number (valid).
4958 * @param uSel The new selector value.
4959 */
4960IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4961{
4962 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4963 if (rcStrict == VINF_SUCCESS)
4964 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4965 return rcStrict;
4966}
4967
4968
4969/**
4970 * Implements 'pop SReg'.
4971 *
4972 * @param iSegReg The segment register number (valid).
4973 * @param enmEffOpSize The efficient operand size (valid).
4974 */
4975IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4976{
4977 VBOXSTRICTRC rcStrict;
4978
4979 /*
4980 * Read the selector off the stack and join paths with mov ss, reg.
4981 */
4982 RTUINT64U TmpRsp;
4983 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4984 switch (enmEffOpSize)
4985 {
4986 case IEMMODE_16BIT:
4987 {
4988 uint16_t uSel;
4989 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4990 if (rcStrict == VINF_SUCCESS)
4991 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4992 break;
4993 }
4994
4995 case IEMMODE_32BIT:
4996 {
4997 /* Modern Intel CPU only does a WORD sized access here, both as
4998 segmentation and paging is concerned. So, we have to emulate
4999 this to make bs3-cpu-weird-1 happy. */
5000 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
5001 {
5002 /* We don't have flexible enough stack primitives here, so just
5003 do a word pop and add two bytes to SP/RSP on success. */
5004 uint16_t uSel;
5005 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
5006 if (rcStrict == VINF_SUCCESS)
5007 {
5008 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint32_t) - sizeof(uint16_t));
5009 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5010 }
5011 }
5012 else
5013 {
5014 uint32_t u32Value;
5015 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
5016 if (rcStrict == VINF_SUCCESS)
5017 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u32Value);
5018 }
5019 break;
5020 }
5021
5022 case IEMMODE_64BIT:
5023 {
5024 /* Like for the 32-bit case above, intel only does a WORD access. */
5025 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
5026 {
5027 uint16_t uSel;
5028 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
5029 if (rcStrict == VINF_SUCCESS)
5030 {
5031 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint64_t) - sizeof(uint16_t));
5032 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5033 }
5034 }
5035 else
5036 {
5037 uint64_t u64Value;
5038 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
5039 if (rcStrict == VINF_SUCCESS)
5040 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u64Value);
5041 }
5042 break;
5043 }
5044 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5045 }
5046
5047 /*
5048 * If the load succeeded, commit the stack change and finish the instruction.
5049 */
5050 if (rcStrict == VINF_SUCCESS)
5051 {
5052 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
5053 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
5054 }
5055
5056 return rcStrict;
5057}
5058
5059
5060/**
5061 * Implements lgs, lfs, les, lds & lss.
5062 */
5063IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
5064{
5065 /*
5066 * Use iemCImpl_LoadSRegWorker to do the tricky segment register loading.
5067 */
5068 /** @todo verify and test that mov, pop and lXs works the segment
5069 * register loading in the exact same way. */
5070 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
5071 if (rcStrict == VINF_SUCCESS)
5072 {
5073 switch (enmEffOpSize)
5074 {
5075 case IEMMODE_16BIT:
5076 iemGRegStoreU16(pVCpu, iGReg, offSeg);
5077 break;
5078 case IEMMODE_32BIT:
5079 case IEMMODE_64BIT:
5080 iemGRegStoreU64(pVCpu, iGReg, offSeg);
5081 break;
5082 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5083 }
5084 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5085 }
5086 return rcStrict;
5087}
5088
5089
5090/**
5091 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
5092 *
5093 * @retval VINF_SUCCESS on success.
5094 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
5095 * @retval iemMemFetchSysU64 return value.
5096 *
5097 * @param pVCpu The cross context virtual CPU structure of the calling thread.
5098 * @param uSel The selector value.
5099 * @param fAllowSysDesc Whether system descriptors are OK or not.
5100 * @param pDesc Where to return the descriptor on success.
5101 */
5102static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
5103{
5104 pDesc->Long.au64[0] = 0;
5105 pDesc->Long.au64[1] = 0;
5106
5107 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
5108 return VINF_IEM_SELECTOR_NOT_OK;
5109
5110 /* Within the table limits? */
5111 RTGCPTR GCPtrBase;
5112 if (uSel & X86_SEL_LDT)
5113 {
5114 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5115 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
5116 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
5117 return VINF_IEM_SELECTOR_NOT_OK;
5118 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
5119 }
5120 else
5121 {
5122 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5123 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
5124 return VINF_IEM_SELECTOR_NOT_OK;
5125 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
5126 }
5127
5128 /* Fetch the descriptor. */
5129 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
5130 if (rcStrict != VINF_SUCCESS)
5131 return rcStrict;
5132 if (!pDesc->Legacy.Gen.u1DescType)
5133 {
5134 if (!fAllowSysDesc)
5135 return VINF_IEM_SELECTOR_NOT_OK;
5136 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5137 {
5138 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
5139 if (rcStrict != VINF_SUCCESS)
5140 return rcStrict;
5141 }
5142
5143 }
5144
5145 return VINF_SUCCESS;
5146}
5147
5148
5149/**
5150 * Implements verr (fWrite = false) and verw (fWrite = true).
5151 */
5152IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
5153{
5154 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5155
5156 /** @todo figure whether the accessed bit is set or not. */
5157
5158 bool fAccessible = true;
5159 IEMSELDESC Desc;
5160 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
5161 if (rcStrict == VINF_SUCCESS)
5162 {
5163 /* Check the descriptor, order doesn't matter much here. */
5164 if ( !Desc.Legacy.Gen.u1DescType
5165 || !Desc.Legacy.Gen.u1Present)
5166 fAccessible = false;
5167 else
5168 {
5169 if ( fWrite
5170 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
5171 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
5172 fAccessible = false;
5173
5174 /** @todo testcase for the conforming behavior. */
5175 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5176 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
5177 {
5178 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5179 fAccessible = false;
5180 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5181 fAccessible = false;
5182 }
5183 }
5184
5185 }
5186 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5187 fAccessible = false;
5188 else
5189 return rcStrict;
5190
5191 /* commit */
5192 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
5193
5194 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5195}
5196
5197
5198/**
5199 * Implements LAR and LSL with 64-bit operand size.
5200 *
5201 * @returns VINF_SUCCESS.
5202 * @param pu64Dst Pointer to the destination register.
5203 * @param uSel The selector to load details for.
5204 * @param fIsLar true = LAR, false = LSL.
5205 */
5206IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
5207{
5208 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
5209
5210 /** @todo figure whether the accessed bit is set or not. */
5211
5212 bool fDescOk = true;
5213 IEMSELDESC Desc;
5214 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
5215 if (rcStrict == VINF_SUCCESS)
5216 {
5217 /*
5218 * Check the descriptor type.
5219 */
5220 if (!Desc.Legacy.Gen.u1DescType)
5221 {
5222 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
5223 {
5224 if (Desc.Long.Gen.u5Zeros)
5225 fDescOk = false;
5226 else
5227 switch (Desc.Long.Gen.u4Type)
5228 {
5229 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
5230 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
5231 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
5232 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
5233 break;
5234 case AMD64_SEL_TYPE_SYS_CALL_GATE:
5235 fDescOk = fIsLar;
5236 break;
5237 default:
5238 fDescOk = false;
5239 break;
5240 }
5241 }
5242 else
5243 {
5244 switch (Desc.Long.Gen.u4Type)
5245 {
5246 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
5247 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
5248 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
5249 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
5250 case X86_SEL_TYPE_SYS_LDT:
5251 break;
5252 case X86_SEL_TYPE_SYS_286_CALL_GATE:
5253 case X86_SEL_TYPE_SYS_TASK_GATE:
5254 case X86_SEL_TYPE_SYS_386_CALL_GATE:
5255 fDescOk = fIsLar;
5256 break;
5257 default:
5258 fDescOk = false;
5259 break;
5260 }
5261 }
5262 }
5263 if (fDescOk)
5264 {
5265 /*
5266 * Check the RPL/DPL/CPL interaction..
5267 */
5268 /** @todo testcase for the conforming behavior. */
5269 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
5270 || !Desc.Legacy.Gen.u1DescType)
5271 {
5272 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5273 fDescOk = false;
5274 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5275 fDescOk = false;
5276 }
5277 }
5278
5279 if (fDescOk)
5280 {
5281 /*
5282 * All fine, start committing the result.
5283 */
5284 if (fIsLar)
5285 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5286 else
5287 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5288 }
5289
5290 }
5291 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5292 fDescOk = false;
5293 else
5294 return rcStrict;
5295
5296 /* commit flags value and advance rip. */
5297 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5298 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5299}
5300
5301
5302/**
5303 * Implements LAR and LSL with 16-bit operand size.
5304 *
5305 * @returns VINF_SUCCESS.
5306 * @param pu16Dst Pointer to the destination register.
5307 * @param uSel The selector to load details for.
5308 * @param fIsLar true = LAR, false = LSL.
5309 */
5310IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5311{
5312 uint64_t u64TmpDst = *pu16Dst;
5313 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5314 *pu16Dst = u64TmpDst;
5315 return VINF_SUCCESS;
5316}
5317
5318
5319/**
5320 * Implements lgdt.
5321 *
5322 * @param iEffSeg The segment of the new gdtr contents
5323 * @param GCPtrEffSrc The address of the new gdtr contents.
5324 * @param enmEffOpSize The effective operand size.
5325 */
5326IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5327{
5328 if (IEM_GET_CPL(pVCpu) != 0)
5329 return iemRaiseGeneralProtectionFault0(pVCpu);
5330 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5331
5332 if (!IEM_IS_IN_GUEST(pVCpu))
5333 { /* probable */ }
5334 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5335 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5336 {
5337 Log(("lgdt: Guest intercept -> VM-exit\n"));
5338 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5339 }
5340 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5341 {
5342 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5343 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5344 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5345 }
5346
5347 /*
5348 * Fetch the limit and base address.
5349 */
5350 uint16_t cbLimit;
5351 RTGCPTR GCPtrBase;
5352 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5353 if (rcStrict == VINF_SUCCESS)
5354 {
5355 if ( !IEM_IS_64BIT_CODE(pVCpu)
5356 || X86_IS_CANONICAL(GCPtrBase))
5357 {
5358 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5359 if (rcStrict == VINF_SUCCESS)
5360 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5361 }
5362 else
5363 {
5364 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5365 return iemRaiseGeneralProtectionFault0(pVCpu);
5366 }
5367 }
5368 return rcStrict;
5369}
5370
5371
5372/**
5373 * Implements sgdt.
5374 *
5375 * @param iEffSeg The segment where to store the gdtr content.
5376 * @param GCPtrEffDst The address where to store the gdtr content.
5377 */
5378IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5379{
5380 /*
5381 * Join paths with sidt.
5382 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5383 * you really must know.
5384 */
5385 if (!IEM_IS_IN_GUEST(pVCpu))
5386 { /* probable */ }
5387 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5388 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5389 {
5390 Log(("sgdt: Guest intercept -> VM-exit\n"));
5391 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5392 }
5393 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5394 {
5395 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5396 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5397 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5398 }
5399
5400 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5401 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5402 if (rcStrict == VINF_SUCCESS)
5403 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5404 return rcStrict;
5405}
5406
5407
5408/**
5409 * Implements lidt.
5410 *
5411 * @param iEffSeg The segment of the new idtr contents
5412 * @param GCPtrEffSrc The address of the new idtr contents.
5413 * @param enmEffOpSize The effective operand size.
5414 */
5415IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5416{
5417 if (IEM_GET_CPL(pVCpu) != 0)
5418 return iemRaiseGeneralProtectionFault0(pVCpu);
5419 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5420
5421 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5422 { /* probable */ }
5423 else
5424 {
5425 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5426 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5427 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5428 }
5429
5430 /*
5431 * Fetch the limit and base address.
5432 */
5433 uint16_t cbLimit;
5434 RTGCPTR GCPtrBase;
5435 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5436 if (rcStrict == VINF_SUCCESS)
5437 {
5438 if ( !IEM_IS_64BIT_CODE(pVCpu)
5439 || X86_IS_CANONICAL(GCPtrBase))
5440 {
5441 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5442 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5443 }
5444 else
5445 {
5446 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5447 return iemRaiseGeneralProtectionFault0(pVCpu);
5448 }
5449 }
5450 return rcStrict;
5451}
5452
5453
5454/**
5455 * Implements sidt.
5456 *
5457 * @param iEffSeg The segment where to store the idtr content.
5458 * @param GCPtrEffDst The address where to store the idtr content.
5459 */
5460IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5461{
5462 /*
5463 * Join paths with sgdt.
5464 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5465 * you really must know.
5466 */
5467 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5468 { /* probable */ }
5469 else
5470 {
5471 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5472 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5473 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5474 }
5475
5476 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5477 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5478 if (rcStrict == VINF_SUCCESS)
5479 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5480 return rcStrict;
5481}
5482
5483
5484/**
5485 * Implements lldt.
5486 *
5487 * @param uNewLdt The new LDT selector value.
5488 */
5489IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5490{
5491 /*
5492 * Check preconditions.
5493 */
5494 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5495 {
5496 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5497 return iemRaiseUndefinedOpcode(pVCpu);
5498 }
5499 if (IEM_GET_CPL(pVCpu) != 0)
5500 {
5501 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, IEM_GET_CPL(pVCpu)));
5502 return iemRaiseGeneralProtectionFault0(pVCpu);
5503 }
5504
5505 /* Nested-guest VMX intercept (SVM is after all checks). */
5506 /** @todo testcase: exit vs check order. */
5507 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5508 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5509 { /* probable */ }
5510 else
5511 {
5512 Log(("lldt: Guest intercept -> VM-exit\n"));
5513 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5514 }
5515
5516 if (uNewLdt & X86_SEL_LDT)
5517 {
5518 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5519 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5520 }
5521
5522 /*
5523 * Now, loading a NULL selector is easy.
5524 */
5525 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5526 {
5527 /* Nested-guest SVM intercept. */
5528 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5529 { /* probable */ }
5530 else
5531 {
5532 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5533 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5534 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5535 }
5536
5537 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5538 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5539 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5540 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5541 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5542 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5543 {
5544 /* AMD-V seems to leave the base and limit alone. */
5545 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5546 }
5547 else
5548 {
5549 /* VT-x (Intel 3960x) seems to be doing the following. */
5550 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5551 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5552 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5553 }
5554
5555 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5556 }
5557
5558 /*
5559 * Read the descriptor.
5560 */
5561 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5562 IEMSELDESC Desc;
5563 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5564 if (rcStrict != VINF_SUCCESS)
5565 return rcStrict;
5566
5567 /* Check GPs first. */
5568 if (Desc.Legacy.Gen.u1DescType)
5569 {
5570 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5571 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5572 }
5573 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5574 {
5575 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5576 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5577 }
5578 uint64_t u64Base;
5579 if (!IEM_IS_LONG_MODE(pVCpu))
5580 u64Base = X86DESC_BASE(&Desc.Legacy);
5581 else
5582 {
5583 if (Desc.Long.Gen.u5Zeros)
5584 {
5585 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5586 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5587 }
5588
5589 u64Base = X86DESC64_BASE(&Desc.Long);
5590 if (!IEM_IS_CANONICAL(u64Base))
5591 {
5592 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5593 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5594 }
5595 }
5596
5597 /* NP */
5598 if (!Desc.Legacy.Gen.u1Present)
5599 {
5600 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5601 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5602 }
5603
5604 /* Nested-guest SVM intercept. */
5605 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5606 { /* probable */ }
5607 else
5608 {
5609 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5610 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5611 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5612 }
5613
5614 /*
5615 * It checks out alright, update the registers.
5616 */
5617/** @todo check if the actual value is loaded or if the RPL is dropped */
5618 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5619 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5620 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5621 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5622 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5623 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5624
5625 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5626}
5627
5628
5629/**
5630 * Implements sldt GReg
5631 *
5632 * @param iGReg The general register to store the CRx value in.
5633 * @param enmEffOpSize The operand size.
5634 */
5635IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5636{
5637 if (!IEM_IS_IN_GUEST(pVCpu))
5638 { /* probable */ }
5639 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5640 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5641 {
5642 Log(("sldt: Guest intercept -> VM-exit\n"));
5643 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5644 }
5645 else
5646 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5647
5648 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5649 switch (enmEffOpSize)
5650 {
5651 case IEMMODE_16BIT:
5652 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5653 break;
5654 case IEMMODE_32BIT:
5655 case IEMMODE_64BIT:
5656 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5657 break;
5658 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5659 }
5660 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5661}
5662
5663
5664/**
5665 * Implements sldt mem.
5666 *
5667 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5668 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5669 */
5670IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5671{
5672 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5673
5674 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5675 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5676 if (rcStrict == VINF_SUCCESS)
5677 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5678 return rcStrict;
5679}
5680
5681
5682/**
5683 * Implements ltr.
5684 *
5685 * @param uNewTr The new TSS selector value.
5686 */
5687IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5688{
5689 /*
5690 * Check preconditions.
5691 */
5692 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5693 {
5694 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5695 return iemRaiseUndefinedOpcode(pVCpu);
5696 }
5697 if (IEM_GET_CPL(pVCpu) != 0)
5698 {
5699 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, IEM_GET_CPL(pVCpu)));
5700 return iemRaiseGeneralProtectionFault0(pVCpu);
5701 }
5702 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5703 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5704 { /* probable */ }
5705 else
5706 {
5707 Log(("ltr: Guest intercept -> VM-exit\n"));
5708 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5709 }
5710 if (uNewTr & X86_SEL_LDT)
5711 {
5712 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5713 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5714 }
5715 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5716 {
5717 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5718 return iemRaiseGeneralProtectionFault0(pVCpu);
5719 }
5720 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5721 { /* probable */ }
5722 else
5723 {
5724 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5725 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5726 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5727 }
5728
5729 /*
5730 * Read the descriptor.
5731 */
5732 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5733 IEMSELDESC Desc;
5734 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5735 if (rcStrict != VINF_SUCCESS)
5736 return rcStrict;
5737
5738 /* Check GPs first. */
5739 if (Desc.Legacy.Gen.u1DescType)
5740 {
5741 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5742 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5743 }
5744 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5745 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5746 || IEM_IS_LONG_MODE(pVCpu)) )
5747 {
5748 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5749 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5750 }
5751 uint64_t u64Base;
5752 if (!IEM_IS_LONG_MODE(pVCpu))
5753 u64Base = X86DESC_BASE(&Desc.Legacy);
5754 else
5755 {
5756 if (Desc.Long.Gen.u5Zeros)
5757 {
5758 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5759 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5760 }
5761
5762 u64Base = X86DESC64_BASE(&Desc.Long);
5763 if (!IEM_IS_CANONICAL(u64Base))
5764 {
5765 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5766 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5767 }
5768 }
5769
5770 /* NP */
5771 if (!Desc.Legacy.Gen.u1Present)
5772 {
5773 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5774 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5775 }
5776
5777 /*
5778 * Set it busy.
5779 * Note! Intel says this should lock down the whole descriptor, but we'll
5780 * restrict our selves to 32-bit for now due to lack of inline
5781 * assembly and such.
5782 */
5783 uint8_t bUnmapInfo;
5784 void *pvDesc;
5785 rcStrict = iemMemMap(pVCpu, &pvDesc, &bUnmapInfo, 8, UINT8_MAX,
5786 pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW, 0);
5787 if (rcStrict != VINF_SUCCESS)
5788 return rcStrict;
5789 switch ((uintptr_t)pvDesc & 3)
5790 {
5791 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5792 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5793 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5794 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5795 }
5796 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
5797 if (rcStrict != VINF_SUCCESS)
5798 return rcStrict;
5799 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5800
5801 /*
5802 * It checks out alright, update the registers.
5803 */
5804/** @todo check if the actual value is loaded or if the RPL is dropped */
5805 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5806 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5807 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5808 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5809 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5810 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5811
5812 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5813}
5814
5815
5816/**
5817 * Implements str GReg
5818 *
5819 * @param iGReg The general register to store the CRx value in.
5820 * @param enmEffOpSize The operand size.
5821 */
5822IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5823{
5824 if (!IEM_IS_IN_GUEST(pVCpu))
5825 { /* probable */ }
5826 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5827 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5828 {
5829 Log(("str_reg: Guest intercept -> VM-exit\n"));
5830 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5831 }
5832 else
5833 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5834
5835 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5836 switch (enmEffOpSize)
5837 {
5838 case IEMMODE_16BIT:
5839 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5840 break;
5841 case IEMMODE_32BIT:
5842 case IEMMODE_64BIT:
5843 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5844 break;
5845 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5846 }
5847 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5848}
5849
5850
5851/**
5852 * Implements str mem.
5853 *
5854 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5855 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5856 */
5857IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5858{
5859 if (!IEM_IS_IN_GUEST(pVCpu))
5860 { /* probable */ }
5861 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5862 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5863 {
5864 Log(("str_mem: Guest intercept -> VM-exit\n"));
5865 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5866 }
5867 else
5868 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5869
5870 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5871 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5872 if (rcStrict == VINF_SUCCESS)
5873 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5874 return rcStrict;
5875}
5876
5877
5878/**
5879 * Implements mov GReg,CRx.
5880 *
5881 * @param iGReg The general register to store the CRx value in.
5882 * @param iCrReg The CRx register to read (valid).
5883 */
5884IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5885{
5886 if (IEM_GET_CPL(pVCpu) != 0)
5887 return iemRaiseGeneralProtectionFault0(pVCpu);
5888 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5889
5890 if (!IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5891 { /* probable */ }
5892 else
5893 {
5894 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5895 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5896 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5897 }
5898
5899 /* Read it. */
5900 uint64_t crX;
5901 switch (iCrReg)
5902 {
5903 case 0:
5904 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5905 crX = pVCpu->cpum.GstCtx.cr0;
5906 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5907 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5908 break;
5909 case 2:
5910 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5911 crX = pVCpu->cpum.GstCtx.cr2;
5912 break;
5913 case 3:
5914 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5915 crX = pVCpu->cpum.GstCtx.cr3;
5916 break;
5917 case 4:
5918 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5919 crX = pVCpu->cpum.GstCtx.cr4;
5920 break;
5921 case 8:
5922 {
5923 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5924 if (!IEM_IS_IN_GUEST(pVCpu))
5925 { /* probable */ }
5926#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5927 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5928 {
5929 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5930 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5931 return rcStrict;
5932
5933 /*
5934 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5935 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5936 * are cleared.
5937 *
5938 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5939 */
5940 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5941 {
5942 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5943 crX = (uTpr >> 4) & 0xf;
5944 break;
5945 }
5946 }
5947#endif
5948#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5949 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
5950 {
5951 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5952 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5953 {
5954 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5955 break;
5956 }
5957 }
5958#endif
5959 uint8_t uTpr;
5960 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5961 if (RT_SUCCESS(rc))
5962 crX = uTpr >> 4;
5963 else
5964 crX = 0;
5965 break;
5966 }
5967 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5968 }
5969
5970#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5971 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5972 { /* probable */ }
5973 else
5974 switch (iCrReg)
5975 {
5976 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5977 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5978 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5979 case 3:
5980 {
5981 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5982 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5983 return rcStrict;
5984 break;
5985 }
5986 }
5987#endif
5988
5989 /* Store it. */
5990 if (IEM_IS_64BIT_CODE(pVCpu))
5991 iemGRegStoreU64(pVCpu, iGReg, crX);
5992 else
5993 iemGRegStoreU64(pVCpu, iGReg, (uint32_t)crX);
5994
5995 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5996}
5997
5998
5999/**
6000 * Implements smsw GReg.
6001 *
6002 * @param iGReg The general register to store the CRx value in.
6003 * @param enmEffOpSize The operand size.
6004 */
6005IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
6006{
6007 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
6008
6009#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6010 uint64_t u64MaskedCr0;
6011 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6012 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
6013 else
6014 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
6015 uint64_t const u64GuestCr0 = u64MaskedCr0;
6016#else
6017 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
6018#endif
6019
6020 switch (enmEffOpSize)
6021 {
6022 case IEMMODE_16BIT:
6023 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
6024 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0);
6025 /* Unused bits are set on 386 and older CPU: */
6026 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6027 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xffe0);
6028 else
6029 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xfff0);
6030 break;
6031
6032/** @todo testcase for bits 31:16. We're not doing that correctly. */
6033
6034 case IEMMODE_32BIT:
6035 if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6036 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0);
6037 else /** @todo test this! */
6038 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0 | UINT32_C(0x7fffffe0)); /* Unused bits are set on 386. */
6039 break;
6040
6041 case IEMMODE_64BIT:
6042 iemGRegStoreU64(pVCpu, iGReg, u64GuestCr0);
6043 break;
6044
6045 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6046 }
6047
6048 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6049}
6050
6051
6052/**
6053 * Implements smsw mem.
6054 *
6055 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
6056 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
6057 */
6058IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6059{
6060 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
6061 if (!IEM_IS_IN_GUEST(pVCpu))
6062 { /* probable */ }
6063 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6064 u64GuestCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
6065 else
6066 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
6067
6068 uint16_t u16Value;
6069 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
6070 u16Value = (uint16_t)u64GuestCr0;
6071 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
6072 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
6073 else
6074 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
6075
6076 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
6077 if (rcStrict == VINF_SUCCESS)
6078 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6079 return rcStrict;
6080}
6081
6082
6083/**
6084 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
6085 */
6086#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
6087 do \
6088 { \
6089 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
6090 if (RT_SUCCESS(rcX)) \
6091 { /* likely */ } \
6092 else \
6093 { \
6094 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
6095 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
6096 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
6097 } \
6098 } while (0)
6099
6100
6101/**
6102 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
6103 *
6104 * @param iCrReg The CRx register to write (valid).
6105 * @param uNewCrX The new value.
6106 * @param enmAccessCrX The instruction that caused the CrX load.
6107 * @param iGReg The general register in case of a 'mov CRx,GReg'
6108 * instruction.
6109 */
6110IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
6111{
6112 VBOXSTRICTRC rcStrict;
6113 int rc;
6114#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
6115 RT_NOREF2(iGReg, enmAccessCrX);
6116#endif
6117
6118 /*
6119 * Try store it.
6120 * Unfortunately, CPUM only does a tiny bit of the work.
6121 */
6122 switch (iCrReg)
6123 {
6124 case 0:
6125 {
6126 /*
6127 * Perform checks.
6128 */
6129 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6130
6131 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
6132 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
6133
6134 /* ET is hardcoded on 486 and later. */
6135 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
6136 uNewCrX |= X86_CR0_ET;
6137 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
6138 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
6139 {
6140 uNewCrX &= fValid;
6141 uNewCrX |= X86_CR0_ET;
6142 }
6143 else
6144 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
6145
6146 /* Check for reserved bits. */
6147 if (uNewCrX & ~(uint64_t)fValid)
6148 {
6149 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6150 return iemRaiseGeneralProtectionFault0(pVCpu);
6151 }
6152
6153 /* Check for invalid combinations. */
6154 if ( (uNewCrX & X86_CR0_PG)
6155 && !(uNewCrX & X86_CR0_PE) )
6156 {
6157 Log(("Trying to set CR0.PG without CR0.PE\n"));
6158 return iemRaiseGeneralProtectionFault0(pVCpu);
6159 }
6160
6161 if ( !(uNewCrX & X86_CR0_CD)
6162 && (uNewCrX & X86_CR0_NW) )
6163 {
6164 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
6165 return iemRaiseGeneralProtectionFault0(pVCpu);
6166 }
6167
6168 if ( !(uNewCrX & X86_CR0_PG)
6169 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
6170 {
6171 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
6172 return iemRaiseGeneralProtectionFault0(pVCpu);
6173 }
6174
6175 /* Long mode consistency checks. */
6176 if ( (uNewCrX & X86_CR0_PG)
6177 && !(uOldCrX & X86_CR0_PG)
6178 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6179 {
6180 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
6181 {
6182 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
6183 return iemRaiseGeneralProtectionFault0(pVCpu);
6184 }
6185 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
6186 {
6187 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
6188 return iemRaiseGeneralProtectionFault0(pVCpu);
6189 }
6190 }
6191
6192 /** @todo testcase: what happens if we disable paging while in 64-bit code? */
6193
6194 if (!IEM_IS_IN_GUEST(pVCpu))
6195 { /* probable */ }
6196#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6197 /* Check for bits that must remain set or cleared in VMX operation,
6198 see Intel spec. 23.8 "Restrictions on VMX operation". */
6199 else if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6200 {
6201 uint64_t const uCr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
6202 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
6203 {
6204 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
6205 return iemRaiseGeneralProtectionFault0(pVCpu);
6206 }
6207
6208 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6209 if (uNewCrX & ~uCr0Fixed1)
6210 {
6211 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
6212 return iemRaiseGeneralProtectionFault0(pVCpu);
6213 }
6214 }
6215#endif
6216 /*
6217 * SVM nested-guest CR0 write intercepts.
6218 */
6219 else if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
6220 {
6221 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6222 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6223 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
6224 }
6225 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
6226 {
6227 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
6228 if ( enmAccessCrX == IEMACCESSCRX_LMSW
6229 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
6230 {
6231 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
6232 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
6233 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6234 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
6235 }
6236 }
6237
6238 /*
6239 * Change EFER.LMA if entering or leaving long mode.
6240 */
6241 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
6242 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
6243 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
6244 {
6245 if (uNewCrX & X86_CR0_PG)
6246 NewEFER |= MSR_K6_EFER_LMA;
6247 else
6248 NewEFER &= ~MSR_K6_EFER_LMA;
6249
6250 CPUMSetGuestEFER(pVCpu, NewEFER);
6251 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
6252 }
6253
6254 /*
6255 * Inform PGM.
6256 */
6257 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
6258 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
6259 {
6260 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
6261 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
6262 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6263 { /* likely */ }
6264 else
6265 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6266 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6267 AssertRCReturn(rc, rc);
6268 /* ignore informational status codes */
6269 }
6270
6271 /*
6272 * Change CR0.
6273 */
6274 CPUMSetGuestCR0(pVCpu, uNewCrX);
6275 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
6276
6277 /* Update the fExec flags if PE changed. */
6278 if ((uNewCrX ^ uOldCrX) & X86_CR0_PE)
6279 iemRecalcExecModeAndCplFlags(pVCpu);
6280
6281 /*
6282 * Inform PGM some more...
6283 */
6284 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6285 false /* fForce */);
6286 break;
6287 }
6288
6289 /*
6290 * CR2 can be changed without any restrictions.
6291 */
6292 case 2:
6293 {
6294 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
6295 { /* probable */ }
6296 else
6297 {
6298 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6299 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6300 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
6301 }
6302 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
6303 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
6304 rcStrict = VINF_SUCCESS;
6305 break;
6306 }
6307
6308 /*
6309 * CR3 is relatively simple, although AMD and Intel have different
6310 * accounts of how setting reserved bits are handled. We take intel's
6311 * word for the lower bits and AMD's for the high bits (63:52). The
6312 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
6313 * on this.
6314 */
6315 /** @todo Testcase: Setting reserved bits in CR3, especially before
6316 * enabling paging. */
6317 case 3:
6318 {
6319 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6320
6321 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6322 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6323 && (uNewCrX & RT_BIT_64(63)))
6324 {
6325 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6326 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6327 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6328 * Paging-Structure Caches". */
6329 uNewCrX &= ~RT_BIT_64(63);
6330 }
6331
6332 /* Check / mask the value. */
6333#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6334 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6335 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6336 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6337 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6338#else
6339 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6340#endif
6341 if (uNewCrX & fInvPhysMask)
6342 {
6343 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6344 * very vague in this area. As mentioned above, need testcase on real
6345 * hardware... Sigh. */
6346 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6347 return iemRaiseGeneralProtectionFault0(pVCpu);
6348 }
6349
6350 uint64_t fValid;
6351 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6352 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6353 {
6354 /** @todo Redundant? This value has already been validated above. */
6355 fValid = UINT64_C(0x000fffffffffffff);
6356 }
6357 else
6358 fValid = UINT64_C(0xffffffff);
6359 if (uNewCrX & ~fValid)
6360 {
6361 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6362 uNewCrX, uNewCrX & ~fValid));
6363 uNewCrX &= fValid;
6364 }
6365
6366 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6367 { /* probable */ }
6368 else
6369 {
6370 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6371 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6372 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6373 }
6374
6375 /* Inform PGM. */
6376 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6377 {
6378 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6379 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6380 { /* likely */ }
6381 else
6382 {
6383 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6384 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6385 }
6386 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6387 AssertRCReturn(rc, rc);
6388 /* ignore informational status codes */
6389 }
6390
6391 /* Make the change. */
6392 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6393 AssertRCSuccessReturn(rc, rc);
6394
6395 rcStrict = VINF_SUCCESS;
6396 break;
6397 }
6398
6399 /*
6400 * CR4 is a bit more tedious as there are bits which cannot be cleared
6401 * under some circumstances and such.
6402 */
6403 case 4:
6404 {
6405 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6406 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6407
6408 /* Reserved bits. */
6409 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6410 if (uNewCrX & ~(uint64_t)fValid)
6411 {
6412 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6413 return iemRaiseGeneralProtectionFault0(pVCpu);
6414 }
6415
6416 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6417 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6418
6419 /* PCIDE check. */
6420 if ( fPcide
6421 && ( !fLongMode
6422 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6423 {
6424 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6425 return iemRaiseGeneralProtectionFault0(pVCpu);
6426 }
6427
6428 /* PAE check. */
6429 if ( fLongMode
6430 && (uOldCrX & X86_CR4_PAE)
6431 && !(uNewCrX & X86_CR4_PAE))
6432 {
6433 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6434 return iemRaiseGeneralProtectionFault0(pVCpu);
6435 }
6436
6437 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6438 { /* probable */ }
6439 else
6440 {
6441 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6442 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6443 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6444 }
6445
6446 /* Check for bits that must remain set or cleared in VMX operation,
6447 see Intel spec. 23.8 "Restrictions on VMX operation". */
6448 if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
6449 { /* probable */ }
6450 else
6451 {
6452 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6453 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6454 {
6455 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6456 return iemRaiseGeneralProtectionFault0(pVCpu);
6457 }
6458
6459 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6460 if (uNewCrX & ~uCr4Fixed1)
6461 {
6462 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6463 return iemRaiseGeneralProtectionFault0(pVCpu);
6464 }
6465 }
6466
6467 /*
6468 * Notify PGM.
6469 */
6470 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6471 {
6472 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6473 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6474 { /* likely */ }
6475 else
6476 {
6477 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6478 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6479 }
6480 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6481 AssertRCReturn(rc, rc);
6482 /* ignore informational status codes */
6483 }
6484
6485 /*
6486 * Change it.
6487 */
6488 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6489 AssertRCSuccessReturn(rc, rc);
6490 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6491
6492 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6493 false /* fForce */);
6494 break;
6495 }
6496
6497 /*
6498 * CR8 maps to the APIC TPR.
6499 */
6500 case 8:
6501 {
6502 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6503 if (uNewCrX & ~(uint64_t)0xf)
6504 {
6505 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6506 return iemRaiseGeneralProtectionFault0(pVCpu);
6507 }
6508
6509 if (!IEM_IS_IN_GUEST(pVCpu))
6510 { /* probable */ }
6511#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6512 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6513 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6514 {
6515 /*
6516 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6517 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6518 * cleared. Following this the processor performs TPR virtualization.
6519 *
6520 * However, we should not perform TPR virtualization immediately here but
6521 * after this instruction has completed.
6522 *
6523 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6524 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6525 */
6526 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6527 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6528 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6529 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6530 rcStrict = VINF_SUCCESS;
6531 break;
6532 }
6533#endif
6534#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6535 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
6536 {
6537 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6538 {
6539 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6540 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6541 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6542 }
6543
6544 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6545 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6546 {
6547 rcStrict = VINF_SUCCESS;
6548 break;
6549 }
6550 }
6551#endif
6552 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6553 APICSetTpr(pVCpu, u8Tpr);
6554 rcStrict = VINF_SUCCESS;
6555 break;
6556 }
6557
6558 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6559 }
6560
6561 /*
6562 * Advance the RIP on success.
6563 */
6564 if (RT_SUCCESS(rcStrict))
6565 {
6566 if (rcStrict != VINF_SUCCESS)
6567 iemSetPassUpStatus(pVCpu, rcStrict);
6568 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6569 }
6570
6571 return rcStrict;
6572}
6573
6574
6575/**
6576 * Implements mov CRx,GReg.
6577 *
6578 * @param iCrReg The CRx register to write (valid).
6579 * @param iGReg The general register to load the CRx value from.
6580 */
6581IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6582{
6583 if (IEM_GET_CPL(pVCpu) != 0)
6584 return iemRaiseGeneralProtectionFault0(pVCpu);
6585 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6586
6587 /*
6588 * Read the new value from the source register and call common worker.
6589 */
6590 uint64_t uNewCrX;
6591 if (IEM_IS_64BIT_CODE(pVCpu))
6592 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6593 else
6594 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6595
6596#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6597 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6598 { /* probable */ }
6599 else
6600 {
6601 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6602 switch (iCrReg)
6603 {
6604 case 0:
6605 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6606 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6607 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6608 }
6609 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6610 return rcStrict;
6611 }
6612#endif
6613
6614 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6615}
6616
6617
6618/**
6619 * Implements 'LMSW r/m16'
6620 *
6621 * @param u16NewMsw The new value.
6622 * @param GCPtrEffDst The guest-linear address of the source operand in case
6623 * of a memory operand. For register operand, pass
6624 * NIL_RTGCPTR.
6625 */
6626IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6627{
6628 if (IEM_GET_CPL(pVCpu) != 0)
6629 return iemRaiseGeneralProtectionFault0(pVCpu);
6630 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6631 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6632
6633#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6634 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6635 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6636 { /* probable */ }
6637 else
6638 {
6639 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6640 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6641 return rcStrict;
6642 }
6643#else
6644 RT_NOREF_PV(GCPtrEffDst);
6645#endif
6646
6647 /*
6648 * Compose the new CR0 value and call common worker.
6649 */
6650 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6651 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6652 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6653}
6654
6655
6656/**
6657 * Implements 'CLTS'.
6658 */
6659IEM_CIMPL_DEF_0(iemCImpl_clts)
6660{
6661 if (IEM_GET_CPL(pVCpu) != 0)
6662 return iemRaiseGeneralProtectionFault0(pVCpu);
6663
6664 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6665 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6666 uNewCr0 &= ~X86_CR0_TS;
6667
6668#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6669 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6670 { /* probable */ }
6671 else
6672 {
6673 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6674 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6675 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6676 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6677 return rcStrict;
6678 }
6679#endif
6680
6681 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6682}
6683
6684
6685/**
6686 * Implements mov GReg,DRx.
6687 *
6688 * @param iGReg The general register to store the DRx value in.
6689 * @param iDrReg The DRx register to read (0-7).
6690 */
6691IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6692{
6693#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6694 /*
6695 * Check nested-guest VMX intercept.
6696 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6697 * over CPL and CR4.DE and even DR4/DR5 checks.
6698 *
6699 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6700 */
6701 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6702 { /* probable */ }
6703 else
6704 {
6705 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6706 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6707 return rcStrict;
6708 }
6709#endif
6710
6711 /*
6712 * Check preconditions.
6713 */
6714 /* Raise GPs. */
6715 if (IEM_GET_CPL(pVCpu) != 0)
6716 return iemRaiseGeneralProtectionFault0(pVCpu);
6717 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6718 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6719
6720 /** @todo \#UD in outside ring-0 too? */
6721 if (iDrReg == 4 || iDrReg == 5)
6722 {
6723 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6724 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6725 {
6726 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6727 return iemRaiseGeneralProtectionFault0(pVCpu);
6728 }
6729 iDrReg += 2;
6730 }
6731
6732 /* Raise #DB if general access detect is enabled. */
6733 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6734 {
6735 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6736 return iemRaiseDebugException(pVCpu);
6737 }
6738
6739 /*
6740 * Read the debug register and store it in the specified general register.
6741 */
6742 uint64_t drX;
6743 switch (iDrReg)
6744 {
6745 case 0:
6746 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6747 drX = pVCpu->cpum.GstCtx.dr[0];
6748 break;
6749 case 1:
6750 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6751 drX = pVCpu->cpum.GstCtx.dr[1];
6752 break;
6753 case 2:
6754 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6755 drX = pVCpu->cpum.GstCtx.dr[2];
6756 break;
6757 case 3:
6758 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6759 drX = pVCpu->cpum.GstCtx.dr[3];
6760 break;
6761 case 6:
6762 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6763 drX = pVCpu->cpum.GstCtx.dr[6];
6764 drX |= X86_DR6_RA1_MASK;
6765 drX &= ~X86_DR6_RAZ_MASK;
6766 break;
6767 case 7:
6768 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6769 drX = pVCpu->cpum.GstCtx.dr[7];
6770 drX |=X86_DR7_RA1_MASK;
6771 drX &= ~X86_DR7_RAZ_MASK;
6772 break;
6773 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6774 }
6775
6776 /** @todo SVM nested-guest intercept for DR8-DR15? */
6777 /*
6778 * Check for any SVM nested-guest intercepts for the DRx read.
6779 */
6780 if (!IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6781 { /* probable */ }
6782 else
6783 {
6784 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6785 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6786 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6787 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6788 }
6789
6790 if (IEM_IS_64BIT_CODE(pVCpu))
6791 iemGRegStoreU64(pVCpu, iGReg, drX);
6792 else
6793 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)drX);
6794
6795 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6796}
6797
6798
6799/**
6800 * Implements mov DRx,GReg.
6801 *
6802 * @param iDrReg The DRx register to write (valid).
6803 * @param iGReg The general register to load the DRx value from.
6804 */
6805IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6806{
6807#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6808 /*
6809 * Check nested-guest VMX intercept.
6810 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6811 * over CPL and CR4.DE and even DR4/DR5 checks.
6812 *
6813 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6814 */
6815 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6816 { /* probable */ }
6817 else
6818 {
6819 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6820 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6821 return rcStrict;
6822 }
6823#endif
6824
6825 /*
6826 * Check preconditions.
6827 */
6828 if (IEM_GET_CPL(pVCpu) != 0)
6829 return iemRaiseGeneralProtectionFault0(pVCpu);
6830 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6831 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6832
6833 if (iDrReg == 4 || iDrReg == 5)
6834 {
6835 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6836 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6837 {
6838 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6839 return iemRaiseGeneralProtectionFault0(pVCpu);
6840 }
6841 iDrReg += 2;
6842 }
6843
6844 /* Raise #DB if general access detect is enabled. */
6845 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6846 * \#GP? */
6847 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6848 {
6849 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6850 return iemRaiseDebugException(pVCpu);
6851 }
6852
6853 /*
6854 * Read the new value from the source register.
6855 */
6856 uint64_t uNewDrX;
6857 if (IEM_IS_64BIT_CODE(pVCpu))
6858 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6859 else
6860 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6861
6862 /*
6863 * Adjust it.
6864 */
6865 switch (iDrReg)
6866 {
6867 case 0:
6868 case 1:
6869 case 2:
6870 case 3:
6871 /* nothing to adjust */
6872 break;
6873
6874 case 6:
6875 if (uNewDrX & X86_DR6_MBZ_MASK)
6876 {
6877 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6878 return iemRaiseGeneralProtectionFault0(pVCpu);
6879 }
6880 uNewDrX |= X86_DR6_RA1_MASK;
6881 uNewDrX &= ~X86_DR6_RAZ_MASK;
6882 break;
6883
6884 case 7:
6885 if (uNewDrX & X86_DR7_MBZ_MASK)
6886 {
6887 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6888 return iemRaiseGeneralProtectionFault0(pVCpu);
6889 }
6890 uNewDrX |= X86_DR7_RA1_MASK;
6891 uNewDrX &= ~X86_DR7_RAZ_MASK;
6892 break;
6893
6894 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6895 }
6896
6897 /** @todo SVM nested-guest intercept for DR8-DR15? */
6898 /*
6899 * Check for any SVM nested-guest intercepts for the DRx write.
6900 */
6901 if (!IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6902 { /* probable */ }
6903 else
6904 {
6905 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6906 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6907 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6908 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6909 }
6910
6911 /*
6912 * Do the actual setting.
6913 */
6914 if (iDrReg < 4)
6915 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6916 else if (iDrReg == 6)
6917 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6918
6919 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6920 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6921
6922 /*
6923 * Re-init hardware breakpoint summary if it was DR7 that got changed.
6924 */
6925 if (iDrReg == 7)
6926 iemRecalcExecDbgFlags(pVCpu);
6927
6928 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6929}
6930
6931
6932/**
6933 * Implements mov GReg,TRx.
6934 *
6935 * @param iGReg The general register to store the
6936 * TRx value in.
6937 * @param iTrReg The TRx register to read (6/7).
6938 */
6939IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6940{
6941 /*
6942 * Check preconditions. NB: This instruction is 386/486 only.
6943 */
6944
6945 /* Raise GPs. */
6946 if (IEM_GET_CPL(pVCpu) != 0)
6947 return iemRaiseGeneralProtectionFault0(pVCpu);
6948 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6949
6950 if (iTrReg < 6 || iTrReg > 7)
6951 {
6952 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6953 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6954 return iemRaiseGeneralProtectionFault0(pVCpu);
6955 }
6956
6957 /*
6958 * Read the test register and store it in the specified general register.
6959 * This is currently a dummy implementation that only exists to satisfy
6960 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6961 * TR6/TR7 registers. Software which actually depends on the TR values
6962 * (different on 386/486) is exceedingly rare.
6963 */
6964 uint32_t trX;
6965 switch (iTrReg)
6966 {
6967 case 6:
6968 trX = 0; /* Currently a dummy. */
6969 break;
6970 case 7:
6971 trX = 0; /* Currently a dummy. */
6972 break;
6973 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6974 }
6975
6976 iemGRegStoreU32(pVCpu, iGReg, trX);
6977
6978 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6979}
6980
6981
6982/**
6983 * Implements mov TRx,GReg.
6984 *
6985 * @param iTrReg The TRx register to write (valid).
6986 * @param iGReg The general register to load the TRx
6987 * value from.
6988 */
6989IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6990{
6991 /*
6992 * Check preconditions. NB: This instruction is 386/486 only.
6993 */
6994
6995 /* Raise GPs. */
6996 if (IEM_GET_CPL(pVCpu) != 0)
6997 return iemRaiseGeneralProtectionFault0(pVCpu);
6998 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6999
7000 if (iTrReg < 6 || iTrReg > 7)
7001 {
7002 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
7003 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
7004 return iemRaiseGeneralProtectionFault0(pVCpu);
7005 }
7006
7007 /*
7008 * Read the new value from the source register.
7009 */
7010 uint32_t uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
7011
7012 /*
7013 * Here we would do the actual setting if this weren't a dummy implementation.
7014 * This is currently a dummy implementation that only exists to prevent
7015 * old debuggers like WDEB386 or OS/2 KDB from crashing.
7016 */
7017 RT_NOREF(uNewTrX);
7018
7019 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7020}
7021
7022
7023/**
7024 * Implements 'INVLPG m'.
7025 *
7026 * @param GCPtrPage The effective address of the page to invalidate.
7027 * @remarks Updates the RIP.
7028 */
7029IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
7030{
7031 /* ring-0 only. */
7032 if (IEM_GET_CPL(pVCpu) != 0)
7033 return iemRaiseGeneralProtectionFault0(pVCpu);
7034 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
7035 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
7036
7037 if (!IEM_IS_IN_GUEST(pVCpu))
7038 { /* probable */ }
7039#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7040 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7041 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
7042 {
7043 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
7044 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
7045 }
7046#endif
7047 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
7048 {
7049 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
7050 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7051 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
7052 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
7053 }
7054
7055 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
7056 if (rc == VINF_SUCCESS)
7057 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7058 if (rc == VINF_PGM_SYNC_CR3)
7059 {
7060 iemSetPassUpStatus(pVCpu, rc);
7061 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7062 }
7063
7064 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
7065 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
7066 return rc;
7067}
7068
7069
7070/**
7071 * Implements INVPCID.
7072 *
7073 * @param iEffSeg The segment of the invpcid descriptor.
7074 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
7075 * @param uInvpcidType The invalidation type.
7076 * @remarks Updates the RIP.
7077 */
7078IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
7079{
7080 /*
7081 * Check preconditions.
7082 */
7083 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
7084 return iemRaiseUndefinedOpcode(pVCpu);
7085
7086 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
7087 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7088 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID)))
7089 { /* likely */ }
7090 else
7091 {
7092 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
7093 return iemRaiseUndefinedOpcode(pVCpu);
7094 }
7095
7096 if (IEM_GET_CPL(pVCpu) != 0)
7097 {
7098 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
7099 return iemRaiseGeneralProtectionFault0(pVCpu);
7100 }
7101
7102 if (IEM_IS_V86_MODE(pVCpu))
7103 {
7104 Log(("invpcid: v8086 mode -> #GP(0)\n"));
7105 return iemRaiseGeneralProtectionFault0(pVCpu);
7106 }
7107
7108 /*
7109 * Check nested-guest intercept.
7110 *
7111 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
7112 * both set. We have already checked the former earlier in this function.
7113 *
7114 * CPL and virtual-8086 mode checks take priority over this VM-exit.
7115 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
7116 */
7117 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7118 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
7119 { /* probable */ }
7120 else
7121 {
7122 Log(("invpcid: Guest intercept -> #VM-exit\n"));
7123 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
7124 }
7125
7126 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
7127 {
7128 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
7129 return iemRaiseGeneralProtectionFault0(pVCpu);
7130 }
7131 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
7132
7133 /*
7134 * Fetch the invpcid descriptor from guest memory.
7135 */
7136 RTUINT128U uDesc;
7137 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
7138 if (rcStrict == VINF_SUCCESS)
7139 {
7140 /*
7141 * Validate the descriptor.
7142 */
7143 if (uDesc.s.Lo > 0xfff)
7144 {
7145 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
7146 return iemRaiseGeneralProtectionFault0(pVCpu);
7147 }
7148
7149 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
7150 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
7151 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
7152 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
7153 switch (uInvpcidType)
7154 {
7155 case X86_INVPCID_TYPE_INDV_ADDR:
7156 {
7157 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
7158 {
7159 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
7160 return iemRaiseGeneralProtectionFault0(pVCpu);
7161 }
7162 if ( !(uCr4 & X86_CR4_PCIDE)
7163 && uPcid != 0)
7164 {
7165 Log(("invpcid: invalid pcid %#x\n", uPcid));
7166 return iemRaiseGeneralProtectionFault0(pVCpu);
7167 }
7168
7169 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
7170 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7171 break;
7172 }
7173
7174 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
7175 {
7176 if ( !(uCr4 & X86_CR4_PCIDE)
7177 && uPcid != 0)
7178 {
7179 Log(("invpcid: invalid pcid %#x\n", uPcid));
7180 return iemRaiseGeneralProtectionFault0(pVCpu);
7181 }
7182 /* Invalidate all mappings associated with PCID except global translations. */
7183 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7184 break;
7185 }
7186
7187 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
7188 {
7189 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
7190 break;
7191 }
7192
7193 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
7194 {
7195 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
7196 break;
7197 }
7198 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7199 }
7200 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7201 }
7202 return rcStrict;
7203}
7204
7205
7206/**
7207 * Implements INVD.
7208 */
7209IEM_CIMPL_DEF_0(iemCImpl_invd)
7210{
7211 if (IEM_GET_CPL(pVCpu) != 0)
7212 {
7213 Log(("invd: CPL != 0 -> #GP(0)\n"));
7214 return iemRaiseGeneralProtectionFault0(pVCpu);
7215 }
7216
7217 if (!IEM_IS_IN_GUEST(pVCpu))
7218 { /* probable */ }
7219 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7220 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
7221 else
7222 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0, cbInstr);
7223
7224 /* We currently take no action here. */
7225 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7226}
7227
7228
7229/**
7230 * Implements WBINVD.
7231 */
7232IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
7233{
7234 if (IEM_GET_CPL(pVCpu) != 0)
7235 {
7236 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
7237 return iemRaiseGeneralProtectionFault0(pVCpu);
7238 }
7239
7240 if (!IEM_IS_IN_GUEST(pVCpu))
7241 { /* probable */ }
7242 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7243 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
7244 else
7245 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0, cbInstr);
7246
7247 /* We currently take no action here. */
7248 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7249}
7250
7251
7252/** Opcode 0x0f 0xaa. */
7253IEM_CIMPL_DEF_0(iemCImpl_rsm)
7254{
7255 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0, cbInstr);
7256 NOREF(cbInstr);
7257 return iemRaiseUndefinedOpcode(pVCpu);
7258}
7259
7260
7261/**
7262 * Implements RDTSC.
7263 */
7264IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
7265{
7266 /*
7267 * Check preconditions.
7268 */
7269 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
7270 return iemRaiseUndefinedOpcode(pVCpu);
7271
7272 if (IEM_GET_CPL(pVCpu) != 0)
7273 {
7274 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7275 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7276 {
7277 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7278 return iemRaiseGeneralProtectionFault0(pVCpu);
7279 }
7280 }
7281
7282 if (!IEM_IS_IN_GUEST(pVCpu))
7283 { /* probable */ }
7284 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7285 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7286 {
7287 Log(("rdtsc: Guest intercept -> VM-exit\n"));
7288 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
7289 }
7290 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
7291 {
7292 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
7293 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7294 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7295 }
7296
7297 /*
7298 * Do the job.
7299 */
7300 uint64_t uTicks = TMCpuTickGet(pVCpu);
7301#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7302 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7303#endif
7304 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7305 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7306 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
7307 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7308}
7309
7310
7311/**
7312 * Implements RDTSC.
7313 */
7314IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
7315{
7316 /*
7317 * Check preconditions.
7318 */
7319 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
7320 return iemRaiseUndefinedOpcode(pVCpu);
7321
7322 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7323 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP)))
7324 { /* likely */ }
7325 else
7326 {
7327 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
7328 return iemRaiseUndefinedOpcode(pVCpu);
7329 }
7330
7331 if (IEM_GET_CPL(pVCpu) != 0)
7332 {
7333 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7334 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7335 {
7336 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7337 return iemRaiseGeneralProtectionFault0(pVCpu);
7338 }
7339 }
7340
7341 if (!IEM_IS_IN_GUEST(pVCpu))
7342 { /* probable */ }
7343 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7344 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7345 {
7346 Log(("rdtscp: Guest intercept -> VM-exit\n"));
7347 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
7348 }
7349 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
7350 {
7351 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
7352 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7353 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7354 }
7355
7356 /*
7357 * Do the job.
7358 * Query the MSR first in case of trips to ring-3.
7359 */
7360 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7361 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7362 if (rcStrict == VINF_SUCCESS)
7363 {
7364 /* Low dword of the TSC_AUX msr only. */
7365 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7366
7367 uint64_t uTicks = TMCpuTickGet(pVCpu);
7368#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7369 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7370#endif
7371 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7372 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7373 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7374 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7375 }
7376 return rcStrict;
7377}
7378
7379
7380/**
7381 * Implements RDPMC.
7382 */
7383IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7384{
7385 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7386
7387 if ( IEM_GET_CPL(pVCpu) != 0
7388 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7389 return iemRaiseGeneralProtectionFault0(pVCpu);
7390
7391 if (!IEM_IS_IN_GUEST(pVCpu))
7392 { /* probable */ }
7393 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7394 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7395 {
7396 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7397 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7398 }
7399 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7400 {
7401 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7402 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7403 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7404 }
7405
7406 /** @todo Emulate performance counters, for now just return 0. */
7407 pVCpu->cpum.GstCtx.rax = 0;
7408 pVCpu->cpum.GstCtx.rdx = 0;
7409 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7410 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7411 * ecx but see @bugref{3472}! */
7412
7413 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7414}
7415
7416
7417/**
7418 * Implements RDMSR.
7419 */
7420IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7421{
7422 /*
7423 * Check preconditions.
7424 */
7425 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7426 return iemRaiseUndefinedOpcode(pVCpu);
7427 if (IEM_GET_CPL(pVCpu) != 0)
7428 return iemRaiseGeneralProtectionFault0(pVCpu);
7429
7430 /*
7431 * Check nested-guest intercepts.
7432 */
7433 if (!IEM_IS_IN_GUEST(pVCpu))
7434 { /* probable */ }
7435#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7436 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7437 {
7438 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7439 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7440 }
7441#endif
7442#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7443 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7444 {
7445 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */, cbInstr);
7446 if (rcStrict == VINF_SVM_VMEXIT)
7447 return VINF_SUCCESS;
7448 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7449 {
7450 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7451 return rcStrict;
7452 }
7453 }
7454#endif
7455
7456 /*
7457 * Do the job.
7458 */
7459 RTUINT64U uValue;
7460 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7461 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7462
7463 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7464 if (rcStrict == VINF_SUCCESS)
7465 {
7466 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7467 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7468 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7469
7470 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7471 }
7472
7473#ifndef IN_RING3
7474 /* Deferred to ring-3. */
7475 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7476 {
7477 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7478 return rcStrict;
7479 }
7480#endif
7481
7482 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7483 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7484 {
7485 pVCpu->iem.s.cLogRelRdMsr++;
7486 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7487 }
7488 else
7489 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7490 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7491 return iemRaiseGeneralProtectionFault0(pVCpu);
7492}
7493
7494
7495/**
7496 * Implements WRMSR.
7497 */
7498IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7499{
7500 /*
7501 * Check preconditions.
7502 */
7503 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7504 return iemRaiseUndefinedOpcode(pVCpu);
7505 if (IEM_GET_CPL(pVCpu) != 0)
7506 return iemRaiseGeneralProtectionFault0(pVCpu);
7507
7508 RTUINT64U uValue;
7509 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7510 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7511
7512 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7513
7514 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7515 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7516
7517 /*
7518 * Check nested-guest intercepts.
7519 */
7520 if (!IEM_IS_IN_GUEST(pVCpu))
7521 { /* probable */ }
7522#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7523 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7524 {
7525 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7526 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7527 }
7528#endif
7529#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7530 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7531 {
7532 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */, cbInstr);
7533 if (rcStrict == VINF_SVM_VMEXIT)
7534 return VINF_SUCCESS;
7535 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7536 {
7537 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7538 return rcStrict;
7539 }
7540 }
7541#endif
7542
7543 /*
7544 * Do the job.
7545 */
7546 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7547 if (rcStrict == VINF_SUCCESS)
7548 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7549
7550#ifndef IN_RING3
7551 /* Deferred to ring-3. */
7552 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7553 {
7554 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7555 return rcStrict;
7556 }
7557#endif
7558
7559 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7560 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7561 {
7562 pVCpu->iem.s.cLogRelWrMsr++;
7563 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7564 }
7565 else
7566 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7567 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7568 return iemRaiseGeneralProtectionFault0(pVCpu);
7569}
7570
7571
7572/**
7573 * Implements 'IN eAX, port'.
7574 *
7575 * @param u16Port The source port.
7576 * @param cbReg The register size.
7577 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7578 * immediate operand or the implicit DX register.
7579 * Bits 3-0: Effective address mode.
7580 */
7581IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7582{
7583 /*
7584 * CPL check
7585 */
7586 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7587 if (rcStrict != VINF_SUCCESS)
7588 return rcStrict;
7589
7590 if (!IEM_IS_IN_GUEST(pVCpu))
7591 { /* probable */ }
7592
7593 /*
7594 * Check VMX nested-guest IO intercept.
7595 */
7596#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7597 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7598 {
7599 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7600 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7601 return rcStrict;
7602 }
7603#endif
7604
7605 /*
7606 * Check SVM nested-guest IO intercept.
7607 */
7608#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7609 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7610 {
7611 uint8_t cAddrSizeBits;
7612 switch (bImmAndEffAddrMode & 0xf)
7613 {
7614 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7615 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7616 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7617 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7618 }
7619 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7620 false /* fRep */, false /* fStrIo */, cbInstr);
7621 if (rcStrict == VINF_SVM_VMEXIT)
7622 return VINF_SUCCESS;
7623 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7624 {
7625 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7626 VBOXSTRICTRC_VAL(rcStrict)));
7627 return rcStrict;
7628 }
7629 }
7630#endif
7631#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7632 RT_NOREF(bImmAndEffAddrMode);
7633#endif
7634
7635 /*
7636 * Perform the I/O.
7637 */
7638 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7639 uint32_t u32Value = 0;
7640 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7641 if (IOM_SUCCESS(rcStrict))
7642 {
7643 switch (cbReg)
7644 {
7645 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7646 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7647 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7648 default: AssertFailedReturn(VERR_IEM_IPE_3);
7649 }
7650
7651 pVCpu->iem.s.cPotentialExits++;
7652 if (rcStrict != VINF_SUCCESS)
7653 iemSetPassUpStatus(pVCpu, rcStrict);
7654
7655 /*
7656 * Check for I/O breakpoints before we complete the instruction.
7657 */
7658 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7659 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7660 && X86_DR7_ANY_RW_IO(fDr7)
7661 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7662 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7663 && rcStrict == VINF_SUCCESS))
7664 {
7665 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7666 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7667 }
7668
7669 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7670 }
7671
7672 return rcStrict;
7673}
7674
7675
7676/**
7677 * Implements 'IN eAX, DX'.
7678 *
7679 * @param cbReg The register size.
7680 * @param enmEffAddrMode Effective address mode.
7681 */
7682IEM_CIMPL_DEF_2(iemCImpl_in_eAX_DX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7683{
7684 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7685}
7686
7687
7688/**
7689 * Implements 'OUT port, eAX'.
7690 *
7691 * @param u16Port The destination port.
7692 * @param cbReg The register size.
7693 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7694 * immediate operand or the implicit DX register.
7695 * Bits 3-0: Effective address mode.
7696 */
7697IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7698{
7699 /*
7700 * CPL check
7701 */
7702 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7703 if (rcStrict != VINF_SUCCESS)
7704 return rcStrict;
7705
7706 if (!IEM_IS_IN_GUEST(pVCpu))
7707 { /* probable */ }
7708
7709 /*
7710 * Check VMX nested-guest I/O intercept.
7711 */
7712#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7713 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7714 {
7715 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7716 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7717 return rcStrict;
7718 }
7719#endif
7720
7721 /*
7722 * Check SVM nested-guest I/O intercept.
7723 */
7724#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7725 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7726 {
7727 uint8_t cAddrSizeBits;
7728 switch (bImmAndEffAddrMode & 0xf)
7729 {
7730 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7731 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7732 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7733 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7734 }
7735 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7736 false /* fRep */, false /* fStrIo */, cbInstr);
7737 if (rcStrict == VINF_SVM_VMEXIT)
7738 return VINF_SUCCESS;
7739 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7740 {
7741 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7742 VBOXSTRICTRC_VAL(rcStrict)));
7743 return rcStrict;
7744 }
7745 }
7746#endif
7747#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7748 RT_NOREF(bImmAndEffAddrMode);
7749#endif
7750
7751 /*
7752 * Perform the I/O.
7753 */
7754 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7755 uint32_t u32Value;
7756 switch (cbReg)
7757 {
7758 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7759 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7760 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7761 default: AssertFailedReturn(VERR_IEM_IPE_4);
7762 }
7763 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7764 if (IOM_SUCCESS(rcStrict))
7765 {
7766 pVCpu->iem.s.cPotentialExits++;
7767 if (rcStrict != VINF_SUCCESS)
7768 iemSetPassUpStatus(pVCpu, rcStrict);
7769
7770 /*
7771 * Check for I/O breakpoints before we complete the instruction.
7772 */
7773 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7774 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7775 && X86_DR7_ANY_RW_IO(fDr7)
7776 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7777 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7778 && rcStrict == VINF_SUCCESS))
7779 {
7780 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7781 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7782 }
7783
7784 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7785 }
7786 return rcStrict;
7787}
7788
7789
7790/**
7791 * Implements 'OUT DX, eAX'.
7792 *
7793 * @param cbReg The register size.
7794 * @param enmEffAddrMode Effective address mode.
7795 */
7796IEM_CIMPL_DEF_2(iemCImpl_out_DX_eAX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7797{
7798 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7799}
7800
7801
7802/**
7803 * Implements 'CLI'.
7804 */
7805IEM_CIMPL_DEF_0(iemCImpl_cli)
7806{
7807 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7808#ifdef LOG_ENABLED
7809 uint32_t const fEflOld = fEfl;
7810#endif
7811
7812 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7813 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7814 {
7815 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7816 if (!(fEfl & X86_EFL_VM))
7817 {
7818 if (IEM_GET_CPL(pVCpu) <= uIopl)
7819 fEfl &= ~X86_EFL_IF;
7820 else if ( IEM_GET_CPL(pVCpu) == 3
7821 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7822 fEfl &= ~X86_EFL_VIF;
7823 else
7824 return iemRaiseGeneralProtectionFault0(pVCpu);
7825 }
7826 /* V8086 */
7827 else if (uIopl == 3)
7828 fEfl &= ~X86_EFL_IF;
7829 else if ( uIopl < 3
7830 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7831 fEfl &= ~X86_EFL_VIF;
7832 else
7833 return iemRaiseGeneralProtectionFault0(pVCpu);
7834 }
7835 /* real mode */
7836 else
7837 fEfl &= ~X86_EFL_IF;
7838
7839 /* Commit. */
7840 IEMMISC_SET_EFL(pVCpu, fEfl);
7841 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7842 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7843 return rcStrict;
7844}
7845
7846
7847/**
7848 * Implements 'STI'.
7849 */
7850IEM_CIMPL_DEF_0(iemCImpl_sti)
7851{
7852 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7853 uint32_t const fEflOld = fEfl;
7854
7855 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7856 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7857 {
7858 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7859 if (!(fEfl & X86_EFL_VM))
7860 {
7861 if (IEM_GET_CPL(pVCpu) <= uIopl)
7862 fEfl |= X86_EFL_IF;
7863 else if ( IEM_GET_CPL(pVCpu) == 3
7864 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7865 && !(fEfl & X86_EFL_VIP) )
7866 fEfl |= X86_EFL_VIF;
7867 else
7868 return iemRaiseGeneralProtectionFault0(pVCpu);
7869 }
7870 /* V8086 */
7871 else if (uIopl == 3)
7872 fEfl |= X86_EFL_IF;
7873 else if ( uIopl < 3
7874 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7875 && !(fEfl & X86_EFL_VIP) )
7876 fEfl |= X86_EFL_VIF;
7877 else
7878 return iemRaiseGeneralProtectionFault0(pVCpu);
7879 }
7880 /* real mode */
7881 else
7882 fEfl |= X86_EFL_IF;
7883
7884 /*
7885 * Commit.
7886 *
7887 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7888 */
7889 IEMMISC_SET_EFL(pVCpu, fEfl);
7890 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7891 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7892 {
7893 /** @todo only set it the shadow flag if it was clear before? */
7894 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7895 }
7896 pVCpu->iem.s.fTbCurInstrIsSti = true;
7897 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7898 return rcStrict;
7899}
7900
7901
7902/**
7903 * Implements 'HLT'.
7904 */
7905IEM_CIMPL_DEF_0(iemCImpl_hlt)
7906{
7907 if (IEM_GET_CPL(pVCpu) != 0)
7908 return iemRaiseGeneralProtectionFault0(pVCpu);
7909
7910 if (!IEM_IS_IN_GUEST(pVCpu))
7911 { /* probable */ }
7912 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7913 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7914 {
7915 Log2(("hlt: Guest intercept -> VM-exit\n"));
7916 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7917 }
7918 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7919 {
7920 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7921 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7922 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7923 }
7924
7925 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7926 * be returning any status codes relating to non-guest events being raised, as
7927 * we'll mess up the guest HALT otherwise. */
7928 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7929 if (rcStrict == VINF_SUCCESS)
7930 rcStrict = VINF_EM_HALT;
7931 return rcStrict;
7932}
7933
7934
7935/**
7936 * Implements 'MONITOR'.
7937 */
7938IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7939{
7940 /*
7941 * Permission checks.
7942 */
7943 if (IEM_GET_CPL(pVCpu) != 0)
7944 {
7945 Log2(("monitor: CPL != 0\n"));
7946 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7947 }
7948 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7949 {
7950 Log2(("monitor: Not in CPUID\n"));
7951 return iemRaiseUndefinedOpcode(pVCpu);
7952 }
7953
7954 /*
7955 * Check VMX guest-intercept.
7956 * This should be considered a fault-like VM-exit.
7957 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7958 */
7959 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7960 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7961 { /* probable */ }
7962 else
7963 {
7964 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7965 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7966 }
7967
7968 /*
7969 * Gather the operands and validate them.
7970 */
7971 RTGCPTR GCPtrMem = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7972 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7973 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7974/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7975 * \#GP first. */
7976 if (uEcx != 0)
7977 {
7978 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7979 return iemRaiseGeneralProtectionFault0(pVCpu);
7980 }
7981
7982 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7983 if (rcStrict != VINF_SUCCESS)
7984 return rcStrict;
7985
7986 RTGCPHYS GCPhysMem;
7987 /** @todo access size */
7988 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7989 if (rcStrict != VINF_SUCCESS)
7990 return rcStrict;
7991
7992 if (!IEM_IS_IN_GUEST(pVCpu))
7993 { /* probable */ }
7994#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7995 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7996 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7997 {
7998 /*
7999 * MONITOR does not access the memory, just monitors the address. However,
8000 * if the address falls in the APIC-access page, the address monitored must
8001 * instead be the corresponding address in the virtual-APIC page.
8002 *
8003 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8004 */
8005 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8006 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8007 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8008 return rcStrict;
8009 }
8010#endif
8011 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
8012 {
8013 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
8014 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8015 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8016 }
8017
8018 /*
8019 * Call EM to prepare the monitor/wait.
8020 */
8021 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
8022 Assert(rcStrict == VINF_SUCCESS);
8023 if (rcStrict == VINF_SUCCESS)
8024 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8025 return rcStrict;
8026}
8027
8028
8029/**
8030 * Implements 'MWAIT'.
8031 */
8032IEM_CIMPL_DEF_0(iemCImpl_mwait)
8033{
8034 /*
8035 * Permission checks.
8036 */
8037 if (IEM_GET_CPL(pVCpu) != 0)
8038 {
8039 Log2(("mwait: CPL != 0\n"));
8040 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
8041 * EFLAGS.VM then.) */
8042 return iemRaiseUndefinedOpcode(pVCpu);
8043 }
8044 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
8045 {
8046 Log2(("mwait: Not in CPUID\n"));
8047 return iemRaiseUndefinedOpcode(pVCpu);
8048 }
8049
8050 /* Check VMX nested-guest intercept. */
8051 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8052 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
8053 { /* probable */ }
8054 else
8055 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
8056
8057 /*
8058 * Gather the operands and validate them.
8059 */
8060 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8061 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8062 if (uEcx != 0)
8063 {
8064 /* Only supported extension is break on IRQ when IF=0. */
8065 if (uEcx > 1)
8066 {
8067 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
8068 return iemRaiseGeneralProtectionFault0(pVCpu);
8069 }
8070 uint32_t fMWaitFeatures = 0;
8071 uint32_t uIgnore = 0;
8072 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
8073 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8074 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
8075 {
8076 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
8077 return iemRaiseGeneralProtectionFault0(pVCpu);
8078 }
8079
8080#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8081 /*
8082 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
8083 * for delivery; and interrupts are disabled the processor does not enter its
8084 * mwait state but rather passes control to the next instruction.
8085 *
8086 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
8087 */
8088 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8089 || pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
8090 { /* probable */ }
8091 else if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
8092 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
8093 /** @todo finish: check up this out after we move int window stuff out of the
8094 * run loop and into the instruction finishing logic here. */
8095 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8096#endif
8097 }
8098
8099 /*
8100 * Check SVM nested-guest mwait intercepts.
8101 */
8102 if (!IEM_IS_IN_GUEST(pVCpu))
8103 { /* probable */ }
8104 else if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
8105 && EMMonitorIsArmed(pVCpu))
8106 {
8107 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
8108 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8109 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8110 }
8111 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
8112 {
8113 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
8114 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8115 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8116 }
8117
8118 /*
8119 * Call EM to prepare the monitor/wait.
8120 *
8121 * This will return VINF_EM_HALT. If there the trap flag is set, we may
8122 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
8123 * that will only return guest related events.
8124 */
8125 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
8126
8127 /** @todo finish: This needs more thinking as we should suppress internal
8128 * debugger events here, or we'll bugger up the guest state even more than we
8129 * alread do around VINF_EM_HALT. */
8130 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8131 if (rcStrict2 != VINF_SUCCESS)
8132 {
8133 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
8134 rcStrict = rcStrict2;
8135 }
8136
8137 return rcStrict;
8138}
8139
8140
8141/**
8142 * Implements 'SWAPGS'.
8143 */
8144IEM_CIMPL_DEF_0(iemCImpl_swapgs)
8145{
8146 Assert(IEM_IS_64BIT_CODE(pVCpu)); /* Caller checks this. */
8147
8148 /*
8149 * Permission checks.
8150 */
8151 if (IEM_GET_CPL(pVCpu) != 0)
8152 {
8153 Log2(("swapgs: CPL != 0\n"));
8154 return iemRaiseUndefinedOpcode(pVCpu);
8155 }
8156
8157 /*
8158 * Do the job.
8159 */
8160 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
8161 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
8162 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
8163 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
8164
8165 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8166}
8167
8168
8169#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8170/**
8171 * Handles a CPUID call.
8172 */
8173static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
8174 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
8175{
8176 switch (iFunction)
8177 {
8178 case VBOX_CPUID_FN_ID:
8179 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
8180 *pEax = VBOX_CPUID_RESP_ID_EAX;
8181 *pEbx = VBOX_CPUID_RESP_ID_EBX;
8182 *pEcx = VBOX_CPUID_RESP_ID_ECX;
8183 *pEdx = VBOX_CPUID_RESP_ID_EDX;
8184 break;
8185
8186 case VBOX_CPUID_FN_LOG:
8187 {
8188 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
8189 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
8190
8191 /* Validate input. */
8192 uint32_t cchToLog = *pEdx;
8193 if (cchToLog <= _2M)
8194 {
8195 uint32_t const uLogPicker = *pEbx;
8196 if (uLogPicker <= 1)
8197 {
8198 /* Resolve the logger. */
8199 PRTLOGGER const pLogger = !uLogPicker
8200 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
8201 if (pLogger)
8202 {
8203 /* Copy over the data: */
8204 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
8205 while (cchToLog > 0)
8206 {
8207 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
8208 if (cbToMap > cchToLog)
8209 cbToMap = cchToLog;
8210 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
8211 * unnecessary calls & iterations per pages. */
8212 if (cbToMap > 512)
8213 cbToMap = 512;
8214 uint8_t bUnmapInfo;
8215 void *pvSrc = NULL;
8216 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, &bUnmapInfo, cbToMap,
8217 UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
8218 if (rcStrict == VINF_SUCCESS)
8219 {
8220 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
8221 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8222 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
8223 }
8224 else
8225 {
8226 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
8227 return rcStrict;
8228 }
8229
8230 /* Advance. */
8231 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
8232 *pEdx = cchToLog -= cbToMap;
8233 }
8234 *pEax = VINF_SUCCESS;
8235 }
8236 else
8237 *pEax = (uint32_t)VERR_NOT_FOUND;
8238 }
8239 else
8240 *pEax = (uint32_t)VERR_NOT_FOUND;
8241 }
8242 else
8243 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
8244 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
8245 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
8246 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
8247 break;
8248 }
8249
8250 default:
8251 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
8252 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
8253 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
8254 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
8255 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
8256 break;
8257 }
8258 return VINF_SUCCESS;
8259}
8260#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
8261
8262/**
8263 * Implements 'CPUID'.
8264 */
8265IEM_CIMPL_DEF_0(iemCImpl_cpuid)
8266{
8267 if (!IEM_IS_IN_GUEST(pVCpu))
8268 { /* probable */ }
8269 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8270 {
8271 Log2(("cpuid: Guest intercept -> VM-exit\n"));
8272 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
8273 }
8274 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
8275 {
8276 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
8277 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8278 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8279 }
8280
8281
8282 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8283 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8284
8285#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8286 /*
8287 * CPUID host call backdoor.
8288 */
8289 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
8290 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
8291 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
8292 {
8293 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
8294 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
8295 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8296 if (rcStrict != VINF_SUCCESS)
8297 return rcStrict;
8298 }
8299 /*
8300 * Regular CPUID.
8301 */
8302 else
8303#endif
8304 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
8305 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8306
8307 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
8308 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
8309 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
8310 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
8311 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
8312
8313 pVCpu->iem.s.cPotentialExits++;
8314 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8315}
8316
8317
8318/**
8319 * Implements 'AAD'.
8320 *
8321 * @param bImm The immediate operand.
8322 */
8323IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
8324{
8325 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8326 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
8327 pVCpu->cpum.GstCtx.ax = al;
8328 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8329 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8330 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8331
8332 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8333}
8334
8335
8336/**
8337 * Implements 'AAM'.
8338 *
8339 * @param bImm The immediate operand. Cannot be 0.
8340 */
8341IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
8342{
8343 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
8344
8345 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8346 uint8_t const al = (uint8_t)ax % bImm;
8347 uint8_t const ah = (uint8_t)ax / bImm;
8348 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
8349 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8350 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8351 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8352
8353 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8354}
8355
8356
8357/**
8358 * Implements 'DAA'.
8359 */
8360IEM_CIMPL_DEF_0(iemCImpl_daa)
8361{
8362 uint8_t const al = pVCpu->cpum.GstCtx.al;
8363 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8364
8365 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8366 || (al & 0xf) >= 10)
8367 {
8368 pVCpu->cpum.GstCtx.al = al + 6;
8369 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8370 }
8371 else
8372 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8373
8374 if (al >= 0x9a || fCarry)
8375 {
8376 pVCpu->cpum.GstCtx.al += 0x60;
8377 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8378 }
8379 else
8380 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8381
8382 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8383 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8384}
8385
8386
8387/**
8388 * Implements 'DAS'.
8389 */
8390IEM_CIMPL_DEF_0(iemCImpl_das)
8391{
8392 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8393 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8394
8395 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8396 || (uInputAL & 0xf) >= 10)
8397 {
8398 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8399 if (uInputAL < 6)
8400 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8401 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8402 }
8403 else
8404 {
8405 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8406 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8407 }
8408
8409 if (uInputAL >= 0x9a || fCarry)
8410 {
8411 pVCpu->cpum.GstCtx.al -= 0x60;
8412 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8413 }
8414
8415 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8416 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8417}
8418
8419
8420/**
8421 * Implements 'AAA'.
8422 */
8423IEM_CIMPL_DEF_0(iemCImpl_aaa)
8424{
8425 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8426 {
8427 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8428 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8429 {
8430 pVCpu->cpum.GstCtx.eflags.uBoth = iemAImpl_add_u16(pVCpu->cpum.GstCtx.eflags.uBoth, &pVCpu->cpum.GstCtx.ax, 0x106);
8431 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8432 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8433 }
8434 else
8435 {
8436 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8437 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8438 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8439 }
8440 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8441 }
8442 else
8443 {
8444 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8445 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8446 {
8447 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8448 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8449 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8450 }
8451 else
8452 {
8453 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8454 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8455 }
8456 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8457 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8458 }
8459
8460 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8461}
8462
8463
8464/**
8465 * Implements 'AAS'.
8466 */
8467IEM_CIMPL_DEF_0(iemCImpl_aas)
8468{
8469 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8470 {
8471 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8472 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8473 {
8474 pVCpu->cpum.GstCtx.eflags.uBoth = iemAImpl_sub_u16(pVCpu->cpum.GstCtx.eflags.uBoth, &pVCpu->cpum.GstCtx.ax, 0x106);
8475 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8476 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8477 }
8478 else
8479 {
8480 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8481 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8482 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8483 }
8484 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8485 }
8486 else
8487 {
8488 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8489 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8490 {
8491 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8492 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8493 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8494 }
8495 else
8496 {
8497 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8498 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8499 }
8500 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8501 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8502 }
8503
8504 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8505}
8506
8507
8508/**
8509 * Implements the 16-bit version of 'BOUND'.
8510 *
8511 * @note We have separate 16-bit and 32-bit variants of this function due to
8512 * the decoder using unsigned parameters, whereas we want signed one to
8513 * do the job. This is significant for a recompiler.
8514 */
8515IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8516{
8517 /*
8518 * Check if the index is inside the bounds, otherwise raise #BR.
8519 */
8520 if ( idxArray >= idxLowerBound
8521 && idxArray <= idxUpperBound)
8522 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8523 return iemRaiseBoundRangeExceeded(pVCpu);
8524}
8525
8526
8527/**
8528 * Implements the 32-bit version of 'BOUND'.
8529 */
8530IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8531{
8532 /*
8533 * Check if the index is inside the bounds, otherwise raise #BR.
8534 */
8535 if ( idxArray >= idxLowerBound
8536 && idxArray <= idxUpperBound)
8537 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8538 return iemRaiseBoundRangeExceeded(pVCpu);
8539}
8540
8541
8542
8543/*
8544 * Instantiate the various string operation combinations.
8545 */
8546#define OP_SIZE 8
8547#define ADDR_SIZE 16
8548#include "IEMAllCImplStrInstr.cpp.h"
8549#define OP_SIZE 8
8550#define ADDR_SIZE 32
8551#include "IEMAllCImplStrInstr.cpp.h"
8552#define OP_SIZE 8
8553#define ADDR_SIZE 64
8554#include "IEMAllCImplStrInstr.cpp.h"
8555
8556#define OP_SIZE 16
8557#define ADDR_SIZE 16
8558#include "IEMAllCImplStrInstr.cpp.h"
8559#define OP_SIZE 16
8560#define ADDR_SIZE 32
8561#include "IEMAllCImplStrInstr.cpp.h"
8562#define OP_SIZE 16
8563#define ADDR_SIZE 64
8564#include "IEMAllCImplStrInstr.cpp.h"
8565
8566#define OP_SIZE 32
8567#define ADDR_SIZE 16
8568#include "IEMAllCImplStrInstr.cpp.h"
8569#define OP_SIZE 32
8570#define ADDR_SIZE 32
8571#include "IEMAllCImplStrInstr.cpp.h"
8572#define OP_SIZE 32
8573#define ADDR_SIZE 64
8574#include "IEMAllCImplStrInstr.cpp.h"
8575
8576#define OP_SIZE 64
8577#define ADDR_SIZE 32
8578#include "IEMAllCImplStrInstr.cpp.h"
8579#define OP_SIZE 64
8580#define ADDR_SIZE 64
8581#include "IEMAllCImplStrInstr.cpp.h"
8582
8583
8584/**
8585 * Implements 'XGETBV'.
8586 */
8587IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8588{
8589 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8590 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8591 {
8592 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8593 switch (uEcx)
8594 {
8595 case 0:
8596 break;
8597
8598 case 1: /** @todo Implement XCR1 support. */
8599 default:
8600 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8601 return iemRaiseGeneralProtectionFault0(pVCpu);
8602
8603 }
8604 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8605 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8606 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8607
8608 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8609 }
8610 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8611 return iemRaiseUndefinedOpcode(pVCpu);
8612}
8613
8614
8615/**
8616 * Implements 'XSETBV'.
8617 */
8618IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8619{
8620 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8621 {
8622 /** @todo explain why this happens before the CPL check. */
8623 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8624 { /* probable */ }
8625 else
8626 {
8627 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8628 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8629 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8630 }
8631
8632 if (IEM_GET_CPL(pVCpu) == 0)
8633 {
8634 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8635
8636 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8637 { /* probable */ }
8638 else
8639 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8640
8641 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8642 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8643 switch (uEcx)
8644 {
8645 case 0:
8646 {
8647 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8648 if (rc == VINF_SUCCESS)
8649 break;
8650 Assert(rc == VERR_CPUM_RAISE_GP_0);
8651 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8652 return iemRaiseGeneralProtectionFault0(pVCpu);
8653 }
8654
8655 case 1: /** @todo Implement XCR1 support. */
8656 default:
8657 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8658 return iemRaiseGeneralProtectionFault0(pVCpu);
8659
8660 }
8661
8662 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8663 }
8664
8665 Log(("xsetbv cpl=%u -> GP(0)\n", IEM_GET_CPL(pVCpu)));
8666 return iemRaiseGeneralProtectionFault0(pVCpu);
8667 }
8668 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8669 return iemRaiseUndefinedOpcode(pVCpu);
8670}
8671
8672#ifndef RT_ARCH_ARM64
8673# ifdef IN_RING3
8674
8675/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8676struct IEMCIMPLCX16ARGS
8677{
8678 PRTUINT128U pu128Dst;
8679 PRTUINT128U pu128RaxRdx;
8680 PRTUINT128U pu128RbxRcx;
8681 uint32_t *pEFlags;
8682# ifdef VBOX_STRICT
8683 uint32_t cCalls;
8684# endif
8685};
8686
8687/**
8688 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8689 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8690 */
8691static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8692{
8693 RT_NOREF(pVM, pVCpu);
8694 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8695# ifdef VBOX_STRICT
8696 Assert(pArgs->cCalls == 0);
8697 pArgs->cCalls++;
8698# endif
8699
8700 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8701 return VINF_SUCCESS;
8702}
8703
8704# endif /* IN_RING3 */
8705
8706/**
8707 * Implements 'CMPXCHG16B' fallback using rendezvous.
8708 */
8709IEM_CIMPL_DEF_5(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8710 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags, uint8_t, bUnmapInfo)
8711{
8712# ifdef IN_RING3
8713 struct IEMCIMPLCX16ARGS Args;
8714 Args.pu128Dst = pu128Dst;
8715 Args.pu128RaxRdx = pu128RaxRdx;
8716 Args.pu128RbxRcx = pu128RbxRcx;
8717 Args.pEFlags = pEFlags;
8718# ifdef VBOX_STRICT
8719 Args.cCalls = 0;
8720# endif
8721 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8722 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8723 Assert(Args.cCalls == 1);
8724 if (rcStrict == VINF_SUCCESS)
8725 {
8726 /* Duplicated tail code. */
8727 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8728 if (rcStrict == VINF_SUCCESS)
8729 {
8730 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8731 if (!(*pEFlags & X86_EFL_ZF))
8732 {
8733 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8734 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8735 }
8736 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8737 }
8738 }
8739 return rcStrict;
8740# else
8741 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags, bUnmapInfo);
8742 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8743# endif
8744}
8745
8746#endif /* RT_ARCH_ARM64 */
8747
8748/**
8749 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8750 *
8751 * This is implemented in C because it triggers a load like behaviour without
8752 * actually reading anything. Since that's not so common, it's implemented
8753 * here.
8754 *
8755 * @param iEffSeg The effective segment.
8756 * @param GCPtrEff The address of the image.
8757 */
8758IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8759{
8760 /*
8761 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8762 */
8763 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8764 if (rcStrict == VINF_SUCCESS)
8765 {
8766 RTGCPHYS GCPhysMem;
8767 /** @todo access size. */
8768 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8769 if (rcStrict == VINF_SUCCESS)
8770 {
8771#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8772 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8773 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8774 { /* probable */ }
8775 else
8776 {
8777 /*
8778 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8779 * that contains the address. However, if the address falls in the APIC-access
8780 * page, the address flushed must instead be the corresponding address in the
8781 * virtual-APIC page.
8782 *
8783 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8784 */
8785 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8786 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8787 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8788 return rcStrict;
8789 }
8790#endif
8791 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8792 }
8793 }
8794
8795 return rcStrict;
8796}
8797
8798
8799/**
8800 * Implements 'FINIT' and 'FNINIT'.
8801 *
8802 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8803 * not.
8804 */
8805IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8806{
8807 /*
8808 * Exceptions.
8809 */
8810 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8811 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8812 return iemRaiseDeviceNotAvailable(pVCpu);
8813
8814 iemFpuActualizeStateForChange(pVCpu);
8815 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8816
8817 /* FINIT: Raise #MF on pending exception(s): */
8818 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8819 return iemRaiseMathFault(pVCpu);
8820
8821 /*
8822 * Reset the state.
8823 */
8824 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8825
8826 /* Rotate the stack to account for changed TOS. */
8827 iemFpuRotateStackSetTop(&pXState->x87, 0);
8828
8829 pXState->x87.FCW = 0x37f;
8830 pXState->x87.FSW = 0;
8831 pXState->x87.FTW = 0x00; /* 0 - empty. */
8832 /** @todo Intel says the instruction and data pointers are not cleared on
8833 * 387, presume that 8087 and 287 doesn't do so either. */
8834 /** @todo test this stuff. */
8835 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8836 {
8837 pXState->x87.FPUDP = 0;
8838 pXState->x87.DS = 0; //??
8839 pXState->x87.Rsrvd2 = 0;
8840 pXState->x87.FPUIP = 0;
8841 pXState->x87.CS = 0; //??
8842 pXState->x87.Rsrvd1 = 0;
8843 }
8844 pXState->x87.FOP = 0;
8845
8846 iemHlpUsedFpu(pVCpu);
8847 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8848}
8849
8850
8851/**
8852 * Implements 'FXSAVE'.
8853 *
8854 * @param iEffSeg The effective segment.
8855 * @param GCPtrEff The address of the image.
8856 * @param enmEffOpSize The operand size (only REX.W really matters).
8857 */
8858IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8859{
8860 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8861
8862 /** @todo check out bugref{1529} and AMD behaviour */
8863
8864 /*
8865 * Raise exceptions.
8866 */
8867 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8868 return iemRaiseDeviceNotAvailable(pVCpu);
8869
8870 /*
8871 * Access the memory.
8872 */
8873 uint8_t bUnmapInfo;
8874 void *pvMem512;
8875 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512,
8876 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8877 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8878 if (rcStrict != VINF_SUCCESS)
8879 return rcStrict;
8880 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8881 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8882
8883 /*
8884 * Store the registers.
8885 */
8886 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8887 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8888
8889 /* common for all formats */
8890 pDst->FCW = pSrc->FCW;
8891 pDst->FSW = pSrc->FSW;
8892 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8893 pDst->FOP = pSrc->FOP;
8894 pDst->MXCSR = pSrc->MXCSR;
8895 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8896 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8897 {
8898 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8899 * them for now... */
8900 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8901 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8902 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8903 pDst->aRegs[i].au32[3] = 0;
8904 }
8905
8906 /* FPU IP, CS, DP and DS. */
8907 pDst->FPUIP = pSrc->FPUIP;
8908 pDst->CS = pSrc->CS;
8909 pDst->FPUDP = pSrc->FPUDP;
8910 pDst->DS = pSrc->DS;
8911 if (enmEffOpSize == IEMMODE_64BIT)
8912 {
8913 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8914 pDst->Rsrvd1 = pSrc->Rsrvd1;
8915 pDst->Rsrvd2 = pSrc->Rsrvd2;
8916 }
8917 else
8918 {
8919 pDst->Rsrvd1 = 0;
8920 pDst->Rsrvd2 = 0;
8921 }
8922
8923 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set. */
8924 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8925 || !IEM_IS_64BIT_CODE(pVCpu)
8926 || IEM_GET_CPL(pVCpu) != 0)
8927 {
8928 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8929 for (uint32_t i = 0; i < cXmmRegs; i++)
8930 pDst->aXMM[i] = pSrc->aXMM[i];
8931 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8932 * right? */
8933 }
8934
8935 /*
8936 * Commit the memory.
8937 */
8938 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8939 if (rcStrict != VINF_SUCCESS)
8940 return rcStrict;
8941
8942 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8943}
8944
8945
8946/**
8947 * Implements 'FXRSTOR'.
8948 *
8949 * @param iEffSeg The effective segment register for @a GCPtrEff.
8950 * @param GCPtrEff The address of the image.
8951 * @param enmEffOpSize The operand size (only REX.W really matters).
8952 */
8953IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8954{
8955 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8956
8957 /** @todo check out bugref{1529} and AMD behaviour */
8958
8959 /*
8960 * Raise exceptions.
8961 */
8962 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8963 return iemRaiseDeviceNotAvailable(pVCpu);
8964
8965 /*
8966 * Access the memory.
8967 */
8968 uint8_t bUnmapInfo;
8969 void *pvMem512;
8970 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8971 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8972 if (rcStrict != VINF_SUCCESS)
8973 return rcStrict;
8974 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8975 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8976
8977 /*
8978 * Check the state for stuff which will #GP(0).
8979 */
8980 uint32_t const fMXCSR = pSrc->MXCSR;
8981 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8982 if (fMXCSR & ~fMXCSR_MASK)
8983 {
8984 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8985 return iemRaiseGeneralProtectionFault0(pVCpu);
8986 }
8987
8988 /*
8989 * Load the registers.
8990 */
8991 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8992 * implementation specific whether MXCSR and XMM0-XMM7 are
8993 * restored according to Intel.
8994 * AMD says MXCSR and XMM registers are never loaded if
8995 * CR4.OSFXSR=0.
8996 */
8997
8998 /* common for all formats */
8999 pDst->FCW = pSrc->FCW;
9000 pDst->FSW = pSrc->FSW;
9001 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9002 pDst->FOP = pSrc->FOP;
9003 pDst->MXCSR = fMXCSR;
9004 /* (MXCSR_MASK is read-only) */
9005 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9006 {
9007 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9008 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9009 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9010 pDst->aRegs[i].au32[3] = 0;
9011 }
9012
9013 /* FPU IP, CS, DP and DS. */
9014 /** @todo AMD says this is only done if FSW.ES is set after loading. */
9015 if (enmEffOpSize == IEMMODE_64BIT)
9016 {
9017 pDst->FPUIP = pSrc->FPUIP;
9018 pDst->CS = pSrc->CS;
9019 pDst->Rsrvd1 = pSrc->Rsrvd1;
9020 pDst->FPUDP = pSrc->FPUDP;
9021 pDst->DS = pSrc->DS;
9022 pDst->Rsrvd2 = pSrc->Rsrvd2;
9023 }
9024 else
9025 {
9026 pDst->FPUIP = pSrc->FPUIP;
9027 pDst->CS = pSrc->CS;
9028 pDst->Rsrvd1 = 0;
9029 pDst->FPUDP = pSrc->FPUDP;
9030 pDst->DS = pSrc->DS;
9031 pDst->Rsrvd2 = 0;
9032 }
9033
9034 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set.
9035 * Does not affect MXCSR, only registers.
9036 */
9037 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
9038 || !IEM_IS_64BIT_CODE(pVCpu)
9039 || IEM_GET_CPL(pVCpu) != 0)
9040 {
9041 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
9042 for (uint32_t i = 0; i < cXmmRegs; i++)
9043 pDst->aXMM[i] = pSrc->aXMM[i];
9044 }
9045
9046 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9047 iemFpuRecalcExceptionStatus(pDst);
9048
9049 if (pDst->FSW & X86_FSW_ES)
9050 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9051 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9052
9053 /*
9054 * Unmap the memory.
9055 */
9056 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9057 if (rcStrict != VINF_SUCCESS)
9058 return rcStrict;
9059
9060 iemHlpUsedFpu(pVCpu);
9061 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9062}
9063
9064
9065/**
9066 * Implements 'XSAVE'.
9067 *
9068 * @param iEffSeg The effective segment.
9069 * @param GCPtrEff The address of the image.
9070 * @param enmEffOpSize The operand size (only REX.W really matters).
9071 */
9072IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9073{
9074 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9075
9076 /*
9077 * Raise exceptions.
9078 */
9079 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9080 return iemRaiseUndefinedOpcode(pVCpu);
9081 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9082 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9083 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9084 { /* likely */ }
9085 else
9086 {
9087 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9088 return iemRaiseUndefinedOpcode(pVCpu);
9089 }
9090 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9091 return iemRaiseDeviceNotAvailable(pVCpu);
9092
9093 /*
9094 * Calc the requested mask.
9095 */
9096 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9097 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9098 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9099
9100/** @todo figure out the exact protocol for the memory access. Currently we
9101 * just need this crap to work halfways to make it possible to test
9102 * AVX instructions. */
9103/** @todo figure out the XINUSE and XMODIFIED */
9104
9105 /*
9106 * Access the x87 memory state.
9107 */
9108 /* The x87+SSE state. */
9109 uint8_t bUnmapInfoMem512;
9110 void *pvMem512;
9111 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512,
9112 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9113 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9114 if (rcStrict != VINF_SUCCESS)
9115 return rcStrict;
9116 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
9117 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
9118
9119 /* The header. */
9120 uint8_t bUnmapInfoHdr;
9121 PX86XSAVEHDR pHdr;
9122 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, &bUnmapInfoHdr, sizeof(pHdr),
9123 iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
9124 if (rcStrict != VINF_SUCCESS)
9125 return rcStrict;
9126
9127 /*
9128 * Store the X87 state.
9129 */
9130 if (fReqComponents & XSAVE_C_X87)
9131 {
9132 /* common for all formats */
9133 pDst->FCW = pSrc->FCW;
9134 pDst->FSW = pSrc->FSW;
9135 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9136 pDst->FOP = pSrc->FOP;
9137 pDst->FPUIP = pSrc->FPUIP;
9138 pDst->CS = pSrc->CS;
9139 pDst->FPUDP = pSrc->FPUDP;
9140 pDst->DS = pSrc->DS;
9141 if (enmEffOpSize == IEMMODE_64BIT)
9142 {
9143 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9144 pDst->Rsrvd1 = pSrc->Rsrvd1;
9145 pDst->Rsrvd2 = pSrc->Rsrvd2;
9146 }
9147 else
9148 {
9149 pDst->Rsrvd1 = 0;
9150 pDst->Rsrvd2 = 0;
9151 }
9152 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9153 {
9154 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
9155 * them for now... */
9156 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9157 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9158 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9159 pDst->aRegs[i].au32[3] = 0;
9160 }
9161
9162 }
9163
9164 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9165 {
9166 pDst->MXCSR = pSrc->MXCSR;
9167 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9168 }
9169
9170 if (fReqComponents & XSAVE_C_SSE)
9171 {
9172 /* XMM registers. */
9173 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9174 for (uint32_t i = 0; i < cXmmRegs; i++)
9175 pDst->aXMM[i] = pSrc->aXMM[i];
9176 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9177 * right? */
9178 }
9179
9180 /* Commit the x87 state bits. (probably wrong) */
9181 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
9182 if (rcStrict != VINF_SUCCESS)
9183 return rcStrict;
9184
9185 /*
9186 * Store AVX state.
9187 */
9188 if (fReqComponents & XSAVE_C_YMM)
9189 {
9190 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9191 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9192 uint8_t bUnmapInfoComp;
9193 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
9194 PX86XSAVEYMMHI pCompDst;
9195 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, &bUnmapInfoComp, sizeof(*pCompDst), iEffSeg,
9196 GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9197 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
9198 if (rcStrict != VINF_SUCCESS)
9199 return rcStrict;
9200
9201 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9202 for (uint32_t i = 0; i < cXmmRegs; i++)
9203 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
9204
9205 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
9206 if (rcStrict != VINF_SUCCESS)
9207 return rcStrict;
9208 }
9209
9210 /*
9211 * Update the header.
9212 */
9213 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
9214 | (fReqComponents & fXInUse);
9215
9216 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
9217 if (rcStrict != VINF_SUCCESS)
9218 return rcStrict;
9219
9220 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9221}
9222
9223
9224/**
9225 * Implements 'XRSTOR'.
9226 *
9227 * @param iEffSeg The effective segment.
9228 * @param GCPtrEff The address of the image.
9229 * @param enmEffOpSize The operand size (only REX.W really matters).
9230 */
9231IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9232{
9233 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9234
9235 /*
9236 * Raise exceptions.
9237 */
9238 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9239 return iemRaiseUndefinedOpcode(pVCpu);
9240 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9241 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9242 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9243 { /* likely */ }
9244 else
9245 {
9246 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9247 return iemRaiseUndefinedOpcode(pVCpu);
9248 }
9249 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9250 return iemRaiseDeviceNotAvailable(pVCpu);
9251 if (GCPtrEff & 63)
9252 {
9253 /** @todo CPU/VM detection possible! \#AC might not be signal for
9254 * all/any misalignment sizes, intel says its an implementation detail. */
9255 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
9256 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
9257 && IEM_GET_CPL(pVCpu) == 3)
9258 return iemRaiseAlignmentCheckException(pVCpu);
9259 return iemRaiseGeneralProtectionFault0(pVCpu);
9260 }
9261
9262/** @todo figure out the exact protocol for the memory access. Currently we
9263 * just need this crap to work halfways to make it possible to test
9264 * AVX instructions. */
9265/** @todo figure out the XINUSE and XMODIFIED */
9266
9267 /*
9268 * Access the x87 memory state.
9269 */
9270 /* The x87+SSE state. */
9271 uint8_t bUnmapInfoMem512;
9272 void *pvMem512;
9273 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
9274 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9275 if (rcStrict != VINF_SUCCESS)
9276 return rcStrict;
9277 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
9278 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
9279
9280 /*
9281 * Calc the requested mask
9282 */
9283 uint8_t bUnmapInfoHdr;
9284 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
9285 PCX86XSAVEHDR pHdrSrc;
9286 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, &bUnmapInfoHdr, sizeof(*pHdrSrc), iEffSeg, GCPtrEff + 512,
9287 IEM_ACCESS_DATA_R, 0 /* checked above */);
9288 if (rcStrict != VINF_SUCCESS)
9289 return rcStrict;
9290
9291 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9292 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9293 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9294 uint64_t const fRstorMask = pHdrSrc->bmXState;
9295 uint64_t const fCompMask = pHdrSrc->bmXComp;
9296
9297 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9298
9299 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9300
9301 /* We won't need this any longer. */
9302 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
9303 if (rcStrict != VINF_SUCCESS)
9304 return rcStrict;
9305
9306 /*
9307 * Load the X87 state.
9308 */
9309 if (fReqComponents & XSAVE_C_X87)
9310 {
9311 if (fRstorMask & XSAVE_C_X87)
9312 {
9313 pDst->FCW = pSrc->FCW;
9314 pDst->FSW = pSrc->FSW;
9315 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9316 pDst->FOP = pSrc->FOP;
9317 pDst->FPUIP = pSrc->FPUIP;
9318 pDst->CS = pSrc->CS;
9319 pDst->FPUDP = pSrc->FPUDP;
9320 pDst->DS = pSrc->DS;
9321 if (enmEffOpSize == IEMMODE_64BIT)
9322 {
9323 /* Load upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9324 pDst->Rsrvd1 = pSrc->Rsrvd1;
9325 pDst->Rsrvd2 = pSrc->Rsrvd2;
9326 }
9327 else
9328 {
9329 pDst->Rsrvd1 = 0;
9330 pDst->Rsrvd2 = 0;
9331 }
9332 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9333 {
9334 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9335 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9336 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9337 pDst->aRegs[i].au32[3] = 0;
9338 }
9339
9340 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9341 iemFpuRecalcExceptionStatus(pDst);
9342
9343 if (pDst->FSW & X86_FSW_ES)
9344 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9345 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9346 }
9347 else
9348 {
9349 pDst->FCW = 0x37f;
9350 pDst->FSW = 0;
9351 pDst->FTW = 0x00; /* 0 - empty. */
9352 pDst->FPUDP = 0;
9353 pDst->DS = 0; //??
9354 pDst->Rsrvd2= 0;
9355 pDst->FPUIP = 0;
9356 pDst->CS = 0; //??
9357 pDst->Rsrvd1= 0;
9358 pDst->FOP = 0;
9359 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9360 {
9361 pDst->aRegs[i].au32[0] = 0;
9362 pDst->aRegs[i].au32[1] = 0;
9363 pDst->aRegs[i].au32[2] = 0;
9364 pDst->aRegs[i].au32[3] = 0;
9365 }
9366 }
9367 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
9368 }
9369
9370 /* MXCSR */
9371 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9372 {
9373 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
9374 pDst->MXCSR = pSrc->MXCSR;
9375 else
9376 pDst->MXCSR = 0x1f80;
9377 }
9378
9379 /* XMM registers. */
9380 if (fReqComponents & XSAVE_C_SSE)
9381 {
9382 if (fRstorMask & XSAVE_C_SSE)
9383 {
9384 for (uint32_t i = 0; i < cXmmRegs; i++)
9385 pDst->aXMM[i] = pSrc->aXMM[i];
9386 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9387 * right? */
9388 }
9389 else
9390 {
9391 for (uint32_t i = 0; i < cXmmRegs; i++)
9392 {
9393 pDst->aXMM[i].au64[0] = 0;
9394 pDst->aXMM[i].au64[1] = 0;
9395 }
9396 }
9397 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
9398 }
9399
9400 /* Unmap the x87 state bits (so we've don't run out of mapping). */
9401 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
9402 if (rcStrict != VINF_SUCCESS)
9403 return rcStrict;
9404
9405 /*
9406 * Restore AVX state.
9407 */
9408 if (fReqComponents & XSAVE_C_YMM)
9409 {
9410 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9411 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
9412
9413 if (fRstorMask & XSAVE_C_YMM)
9414 {
9415 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9416 uint8_t bUnmapInfoComp;
9417 PCX86XSAVEYMMHI pCompSrc;
9418 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, &bUnmapInfoComp, sizeof(*pCompDst),
9419 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9420 IEM_ACCESS_DATA_R, 0 /* checked above */);
9421 if (rcStrict != VINF_SUCCESS)
9422 return rcStrict;
9423
9424 for (uint32_t i = 0; i < cXmmRegs; i++)
9425 {
9426 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9427 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9428 }
9429
9430 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
9431 if (rcStrict != VINF_SUCCESS)
9432 return rcStrict;
9433 }
9434 else
9435 {
9436 for (uint32_t i = 0; i < cXmmRegs; i++)
9437 {
9438 pCompDst->aYmmHi[i].au64[0] = 0;
9439 pCompDst->aYmmHi[i].au64[1] = 0;
9440 }
9441 }
9442 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9443 }
9444
9445 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9446}
9447
9448
9449
9450
9451/**
9452 * Implements 'STMXCSR'.
9453 *
9454 * @param iEffSeg The effective segment register for @a GCPtrEff.
9455 * @param GCPtrEff The address of the image.
9456 */
9457IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9458{
9459 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9460
9461 /*
9462 * Raise exceptions.
9463 */
9464 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9465 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9466 {
9467 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9468 {
9469 /*
9470 * Do the job.
9471 */
9472 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9473 if (rcStrict == VINF_SUCCESS)
9474 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9475 return rcStrict;
9476 }
9477 return iemRaiseDeviceNotAvailable(pVCpu);
9478 }
9479 return iemRaiseUndefinedOpcode(pVCpu);
9480}
9481
9482
9483/**
9484 * Implements 'VSTMXCSR'.
9485 *
9486 * @param iEffSeg The effective segment register for @a GCPtrEff.
9487 * @param GCPtrEff The address of the image.
9488 */
9489IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9490{
9491 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9492
9493 /*
9494 * Raise exceptions.
9495 */
9496 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9497 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9498 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9499 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9500 {
9501 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9502 {
9503 /*
9504 * Do the job.
9505 */
9506 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9507 if (rcStrict == VINF_SUCCESS)
9508 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9509 return rcStrict;
9510 }
9511 return iemRaiseDeviceNotAvailable(pVCpu);
9512 }
9513 return iemRaiseUndefinedOpcode(pVCpu);
9514}
9515
9516
9517/**
9518 * Implements 'LDMXCSR'.
9519 *
9520 * @param iEffSeg The effective segment register for @a GCPtrEff.
9521 * @param GCPtrEff The address of the image.
9522 */
9523IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9524{
9525 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9526
9527 /*
9528 * Raise exceptions.
9529 */
9530 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9531 * happen after or before \#UD and \#EM? */
9532 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9533 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9534 {
9535 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9536 {
9537 /*
9538 * Do the job.
9539 */
9540 uint32_t fNewMxCsr;
9541 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9542 if (rcStrict == VINF_SUCCESS)
9543 {
9544 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9545 if (!(fNewMxCsr & ~fMxCsrMask))
9546 {
9547 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9548 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9549 }
9550 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9551 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9552 return iemRaiseGeneralProtectionFault0(pVCpu);
9553 }
9554 return rcStrict;
9555 }
9556 return iemRaiseDeviceNotAvailable(pVCpu);
9557 }
9558 return iemRaiseUndefinedOpcode(pVCpu);
9559}
9560
9561
9562/**
9563 * Commmon routine for fnstenv and fnsave.
9564 *
9565 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9566 * @param enmEffOpSize The effective operand size.
9567 * @param uPtr Where to store the state.
9568 */
9569static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9570{
9571 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9572 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9573 if (enmEffOpSize == IEMMODE_16BIT)
9574 {
9575 uPtr.pu16[0] = pSrcX87->FCW;
9576 uPtr.pu16[1] = pSrcX87->FSW;
9577 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9578 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9579 {
9580 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9581 * protected mode or long mode and we save it in real mode? And vice
9582 * versa? And with 32-bit operand size? I think CPU is storing the
9583 * effective address ((CS << 4) + IP) in the offset register and not
9584 * doing any address calculations here. */
9585 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9586 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9587 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9588 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9589 }
9590 else
9591 {
9592 uPtr.pu16[3] = pSrcX87->FPUIP;
9593 uPtr.pu16[4] = pSrcX87->CS;
9594 uPtr.pu16[5] = pSrcX87->FPUDP;
9595 uPtr.pu16[6] = pSrcX87->DS;
9596 }
9597 }
9598 else
9599 {
9600 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9601 uPtr.pu16[0*2] = pSrcX87->FCW;
9602 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9603 uPtr.pu16[1*2] = pSrcX87->FSW;
9604 uPtr.pu16[1*2+1] = 0xffff;
9605 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9606 uPtr.pu16[2*2+1] = 0xffff;
9607 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9608 {
9609 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9610 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9611 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9612 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9613 }
9614 else
9615 {
9616 uPtr.pu32[3] = pSrcX87->FPUIP;
9617 uPtr.pu16[4*2] = pSrcX87->CS;
9618 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9619 uPtr.pu32[5] = pSrcX87->FPUDP;
9620 uPtr.pu16[6*2] = pSrcX87->DS;
9621 uPtr.pu16[6*2+1] = 0xffff;
9622 }
9623 }
9624}
9625
9626
9627/**
9628 * Commmon routine for fldenv and frstor
9629 *
9630 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9631 * @param enmEffOpSize The effective operand size.
9632 * @param uPtr Where to store the state.
9633 */
9634static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9635{
9636 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9637 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9638 if (enmEffOpSize == IEMMODE_16BIT)
9639 {
9640 pDstX87->FCW = uPtr.pu16[0];
9641 pDstX87->FSW = uPtr.pu16[1];
9642 pDstX87->FTW = uPtr.pu16[2];
9643 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9644 {
9645 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9646 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9647 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9648 pDstX87->CS = 0;
9649 pDstX87->Rsrvd1= 0;
9650 pDstX87->DS = 0;
9651 pDstX87->Rsrvd2= 0;
9652 }
9653 else
9654 {
9655 pDstX87->FPUIP = uPtr.pu16[3];
9656 pDstX87->CS = uPtr.pu16[4];
9657 pDstX87->Rsrvd1= 0;
9658 pDstX87->FPUDP = uPtr.pu16[5];
9659 pDstX87->DS = uPtr.pu16[6];
9660 pDstX87->Rsrvd2= 0;
9661 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9662 }
9663 }
9664 else
9665 {
9666 pDstX87->FCW = uPtr.pu16[0*2];
9667 pDstX87->FSW = uPtr.pu16[1*2];
9668 pDstX87->FTW = uPtr.pu16[2*2];
9669 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9670 {
9671 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9672 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9673 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9674 pDstX87->CS = 0;
9675 pDstX87->Rsrvd1= 0;
9676 pDstX87->DS = 0;
9677 pDstX87->Rsrvd2= 0;
9678 }
9679 else
9680 {
9681 pDstX87->FPUIP = uPtr.pu32[3];
9682 pDstX87->CS = uPtr.pu16[4*2];
9683 pDstX87->Rsrvd1= 0;
9684 pDstX87->FOP = uPtr.pu16[4*2+1];
9685 pDstX87->FPUDP = uPtr.pu32[5];
9686 pDstX87->DS = uPtr.pu16[6*2];
9687 pDstX87->Rsrvd2= 0;
9688 }
9689 }
9690
9691 /* Make adjustments. */
9692 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9693#ifdef LOG_ENABLED
9694 uint16_t const fOldFsw = pDstX87->FSW;
9695#endif
9696 pDstX87->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9697 iemFpuRecalcExceptionStatus(pDstX87);
9698#ifdef LOG_ENABLED
9699 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9700 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9701 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9702 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9703#endif
9704
9705 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9706 * exceptions are pending after loading the saved state? */
9707}
9708
9709
9710/**
9711 * Implements 'FNSTENV'.
9712 *
9713 * @param enmEffOpSize The operand size (only REX.W really matters).
9714 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9715 * @param GCPtrEffDst The address of the image.
9716 */
9717IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9718{
9719 uint8_t bUnmapInfo;
9720 RTPTRUNION uPtr;
9721 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9722 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9723 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9724 if (rcStrict != VINF_SUCCESS)
9725 return rcStrict;
9726
9727 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9728
9729 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9730 if (rcStrict != VINF_SUCCESS)
9731 return rcStrict;
9732
9733 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9734 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9735 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9736#ifdef LOG_ENABLED
9737 uint16_t fOldFsw = pFpuCtx->FSW;
9738#endif
9739 iemFpuRecalcExceptionStatus(pFpuCtx);
9740#ifdef LOG_ENABLED
9741 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9742 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9743 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9744#endif
9745
9746 iemHlpUsedFpu(pVCpu);
9747
9748 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9749 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9750}
9751
9752
9753/**
9754 * Implements 'FNSAVE'.
9755 *
9756 * @param enmEffOpSize The operand size.
9757 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9758 * @param GCPtrEffDst The address of the image.
9759 */
9760IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9761{
9762 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9763
9764 uint8_t bUnmapInfo;
9765 RTPTRUNION uPtr;
9766 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9767 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9768 if (rcStrict != VINF_SUCCESS)
9769 return rcStrict;
9770
9771 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9772 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9773 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9774 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9775 {
9776 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9777 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9778 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9779 }
9780
9781 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9782 if (rcStrict != VINF_SUCCESS)
9783 return rcStrict;
9784
9785 /* Rotate the stack to account for changed TOS. */
9786 iemFpuRotateStackSetTop(pFpuCtx, 0);
9787
9788 /*
9789 * Re-initialize the FPU context.
9790 */
9791 pFpuCtx->FCW = 0x37f;
9792 pFpuCtx->FSW = 0;
9793 pFpuCtx->FTW = 0x00; /* 0 - empty */
9794 pFpuCtx->FPUDP = 0;
9795 pFpuCtx->DS = 0;
9796 pFpuCtx->Rsrvd2= 0;
9797 pFpuCtx->FPUIP = 0;
9798 pFpuCtx->CS = 0;
9799 pFpuCtx->Rsrvd1= 0;
9800 pFpuCtx->FOP = 0;
9801
9802 iemHlpUsedFpu(pVCpu);
9803 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9804}
9805
9806
9807
9808/**
9809 * Implements 'FLDENV'.
9810 *
9811 * @param enmEffOpSize The operand size (only REX.W really matters).
9812 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9813 * @param GCPtrEffSrc The address of the image.
9814 */
9815IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9816{
9817 uint8_t bUnmapInfo;
9818 RTCPTRUNION uPtr;
9819 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9820 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9821 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9822 if (rcStrict != VINF_SUCCESS)
9823 return rcStrict;
9824
9825 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9826
9827 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9828 if (rcStrict != VINF_SUCCESS)
9829 return rcStrict;
9830
9831 iemHlpUsedFpu(pVCpu);
9832 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9833}
9834
9835
9836/**
9837 * Implements 'FRSTOR'.
9838 *
9839 * @param enmEffOpSize The operand size.
9840 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9841 * @param GCPtrEffSrc The address of the image.
9842 */
9843IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9844{
9845 uint8_t bUnmapInfo;
9846 RTCPTRUNION uPtr;
9847 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9848 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9849 if (rcStrict != VINF_SUCCESS)
9850 return rcStrict;
9851
9852 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9853 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9854 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9855 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9856 {
9857 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9858 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9859 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9860 pFpuCtx->aRegs[i].au32[3] = 0;
9861 }
9862
9863 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9864 if (rcStrict != VINF_SUCCESS)
9865 return rcStrict;
9866
9867 iemHlpUsedFpu(pVCpu);
9868 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9869}
9870
9871
9872/**
9873 * Implements 'FLDCW'.
9874 *
9875 * @param u16Fcw The new FCW.
9876 */
9877IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9878{
9879 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9880
9881 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9882 /** @todo Testcase: Try see what happens when trying to set undefined bits
9883 * (other than 6 and 7). Currently ignoring them. */
9884 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9885 * according to FSW. (This is what is currently implemented.) */
9886 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9887 pFpuCtx->FCW = u16Fcw & (~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK); /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9888#ifdef LOG_ENABLED
9889 uint16_t fOldFsw = pFpuCtx->FSW;
9890#endif
9891 iemFpuRecalcExceptionStatus(pFpuCtx);
9892#ifdef LOG_ENABLED
9893 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9894 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9895 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9896#endif
9897
9898 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9899 iemHlpUsedFpu(pVCpu);
9900 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9901}
9902
9903
9904
9905/**
9906 * Implements the underflow case of fxch.
9907 *
9908 * @param iStReg The other stack register.
9909 * @param uFpuOpcode The FPU opcode (for simplicity).
9910 */
9911IEM_CIMPL_DEF_2(iemCImpl_fxch_underflow, uint8_t, iStReg, uint16_t, uFpuOpcode)
9912{
9913 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9914
9915 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9916 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9917 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9918 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9919
9920 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9921 * registers are read as QNaN and then exchanged. This could be
9922 * wrong... */
9923 if (pFpuCtx->FCW & X86_FCW_IM)
9924 {
9925 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9926 {
9927 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9928 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9929 else
9930 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9931 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9932 }
9933 else
9934 {
9935 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9936 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9937 }
9938 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9939 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9940 }
9941 else
9942 {
9943 /* raise underflow exception, don't change anything. */
9944 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9945 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9946 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9947 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9948 }
9949
9950 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, uFpuOpcode);
9951 iemHlpUsedFpu(pVCpu);
9952 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9953}
9954
9955
9956/**
9957 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9958 *
9959 * @param iStReg The other stack register.
9960 * @param fUCmp true for FUCOMI[P], false for FCOMI[P].
9961 * @param uPopAndFpuOpcode Bits 15-0: The FPU opcode.
9962 * Bit 31: Whether we should pop the stack when
9963 * done or not.
9964 */
9965IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, bool, fUCmp, uint32_t, uPopAndFpuOpcode)
9966{
9967 Assert(iStReg < 8);
9968 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9969
9970 /*
9971 * Raise exceptions.
9972 */
9973 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9974 return iemRaiseDeviceNotAvailable(pVCpu);
9975
9976 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9977 uint16_t u16Fsw = pFpuCtx->FSW;
9978 if (u16Fsw & X86_FSW_ES)
9979 return iemRaiseMathFault(pVCpu);
9980
9981 /*
9982 * Check if any of the register accesses causes #SF + #IA.
9983 */
9984 bool fPop = RT_BOOL(uPopAndFpuOpcode & RT_BIT_32(31));
9985 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9986 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9987 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9988 {
9989 uint32_t u32Eflags;
9990 if (!fUCmp)
9991 u32Eflags = iemAImpl_fcomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9992 else
9993 u32Eflags = iemAImpl_fucomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9994
9995 pFpuCtx->FSW &= ~X86_FSW_C1;
9996 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9997 if ( !(u16Fsw & X86_FSW_IE)
9998 || (pFpuCtx->FCW & X86_FCW_IM) )
9999 {
10000 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10001 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10002 }
10003 }
10004 else if (pFpuCtx->FCW & X86_FCW_IM)
10005 {
10006 /* Masked underflow. */
10007 pFpuCtx->FSW &= ~X86_FSW_C1;
10008 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
10009 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
10010 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
10011 }
10012 else
10013 {
10014 /* Raise underflow - don't touch EFLAGS or TOP. */
10015 pFpuCtx->FSW &= ~X86_FSW_C1;
10016 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
10017 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
10018 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
10019 fPop = false;
10020 }
10021
10022 /*
10023 * Pop if necessary.
10024 */
10025 if (fPop)
10026 {
10027 pFpuCtx->FTW &= ~RT_BIT(iReg1);
10028 iemFpuStackIncTop(pVCpu);
10029 }
10030
10031 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, (uint16_t)uPopAndFpuOpcode);
10032 iemHlpUsedFpu(pVCpu);
10033 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10034}
10035
10036
10037/**
10038 * Implements 'RDSEED'.
10039 *
10040 * @returns VINF_SUCCESS.
10041 * @param iReg The register.
10042 * @param enmEffOpSize The operand size.
10043 */
10044IEM_CIMPL_DEF_2(iemCImpl_rdseed, uint8_t, iReg, IEMMODE, enmEffOpSize)
10045{
10046#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10047 /* Nested-guest VMX intercept. */
10048 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
10049 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDSEED_EXIT))
10050 { /* probable */ }
10051 else
10052 {
10053 Log(("rdseed: Guest intercept -> VM-exit\n"));
10054 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDSEED, VMXINSTRID_RDSEED, cbInstr);
10055 }
10056#endif
10057
10058 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
10059 switch (enmEffOpSize)
10060 {
10061 case IEMMODE_16BIT:
10062 {
10063 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10064 &iemAImpl_rdseed_u16,
10065 &iemAImpl_rdseed_u16_fallback);
10066 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
10067 (pfnImpl)(pu16Dst, pEFlags);
10068 break;
10069 }
10070 case IEMMODE_32BIT:
10071 {
10072 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10073 &iemAImpl_rdseed_u32,
10074 &iemAImpl_rdseed_u32_fallback);
10075 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10076 (pfnImpl)(pu32Dst, pEFlags);
10077 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10078 break;
10079 }
10080 case IEMMODE_64BIT:
10081 {
10082 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
10083 &iemAImpl_rdseed_u64,
10084 &iemAImpl_rdseed_u64_fallback);
10085 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10086 (pfnImpl)(pu64Dst, pEFlags);
10087 break;
10088 }
10089 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10090 }
10091 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10092}
10093
10094
10095/**
10096 * Implements 'RDRAND'.
10097 *
10098 * @returns VINF_SUCCESS.
10099 * @param iReg The register.
10100 * @param enmEffOpSize The operand size.
10101 */
10102IEM_CIMPL_DEF_2(iemCImpl_rdrand, uint8_t, iReg, IEMMODE, enmEffOpSize)
10103{
10104#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10105 /* Nested-guest VMX intercept. */
10106 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
10107 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDRAND_EXIT))
10108 { /* probable */ }
10109 else
10110 {
10111 Log(("rdrand: Guest intercept -> VM-exit\n"));
10112 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDRAND, VMXINSTRID_RDRAND, cbInstr);
10113 }
10114#endif
10115
10116 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
10117 switch (enmEffOpSize)
10118 {
10119 case IEMMODE_16BIT:
10120 {
10121 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u16,
10122 &iemAImpl_rdrand_u16_fallback);
10123 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
10124 (pfnImpl)(pu16Dst, pEFlags);
10125 break;
10126 }
10127 case IEMMODE_32BIT:
10128 {
10129 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u32,
10130 &iemAImpl_rdrand_u32_fallback);
10131 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
10132 (pfnImpl)(pu32Dst, pEFlags);
10133 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
10134 break;
10135 }
10136 case IEMMODE_64BIT:
10137 {
10138 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u64,
10139 &iemAImpl_rdrand_u64_fallback);
10140 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
10141 (pfnImpl)(pu64Dst, pEFlags);
10142 break;
10143 }
10144 IEM_NOT_REACHED_DEFAULT_CASE_RET();
10145 }
10146 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10147}
10148
10149/** @} */
10150
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette