VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 95522

Last change on this file since 95522 was 95422, checked in by vboxsync, 3 years ago

VMM/IEM: Fixes to the finit/fninit implementation.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 338.7 KB
Line 
1/* $Id: IEMAllCImpl.cpp 95422 2022-06-29 02:42:16Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_IEM
23#define VMCPU_INCL_CPUM_GST_CTX
24#include <VBox/vmm/iem.h>
25#include <VBox/vmm/cpum.h>
26#include <VBox/vmm/apic.h>
27#include <VBox/vmm/pdm.h>
28#include <VBox/vmm/pgm.h>
29#include <VBox/vmm/iom.h>
30#include <VBox/vmm/em.h>
31#include <VBox/vmm/hm.h>
32#include <VBox/vmm/nem.h>
33#include <VBox/vmm/gim.h>
34#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
35# include <VBox/vmm/em.h>
36# include <VBox/vmm/hm_svm.h>
37#endif
38#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
39# include <VBox/vmm/hmvmxinline.h>
40#endif
41#include <VBox/vmm/tm.h>
42#include <VBox/vmm/dbgf.h>
43#include <VBox/vmm/dbgftrace.h>
44#include "IEMInternal.h"
45#include <VBox/vmm/vmcc.h>
46#include <VBox/log.h>
47#include <VBox/err.h>
48#include <VBox/param.h>
49#include <VBox/dis.h>
50#include <VBox/disopcode.h>
51#include <iprt/asm-math.h>
52#include <iprt/assert.h>
53#include <iprt/string.h>
54#include <iprt/x86.h>
55
56#include "IEMInline.h"
57
58
59/** @name Misc Helpers
60 * @{
61 */
62
63
64/**
65 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
66 *
67 * @returns Strict VBox status code.
68 *
69 * @param pVCpu The cross context virtual CPU structure of the calling thread.
70 * @param u16Port The port number.
71 * @param cbOperand The operand size.
72 */
73static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
74{
75 /* The TSS bits we're interested in are the same on 386 and AMD64. */
76 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
77 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
78 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
79 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
80
81 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
82
83 /*
84 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
85 */
86 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
87 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
88 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
89 {
90 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
91 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
92 return iemRaiseGeneralProtectionFault0(pVCpu);
93 }
94
95 /*
96 * Read the bitmap offset (may #PF).
97 */
98 uint16_t offBitmap;
99 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
100 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
101 if (rcStrict != VINF_SUCCESS)
102 {
103 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
104 return rcStrict;
105 }
106
107 /*
108 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
109 * describes the CPU actually reading two bytes regardless of whether the
110 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
111 */
112 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
113 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
114 * for instance sizeof(X86TSS32). */
115 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
116 {
117 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
118 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
119 return iemRaiseGeneralProtectionFault0(pVCpu);
120 }
121
122 /*
123 * Read the necessary bits.
124 */
125 /** @todo Test the assertion in the intel manual that the CPU reads two
126 * bytes. The question is how this works wrt to \#PF and \#GP on the
127 * 2nd byte when it's not required. */
128 uint16_t bmBytes = UINT16_MAX;
129 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
130 if (rcStrict != VINF_SUCCESS)
131 {
132 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
133 return rcStrict;
134 }
135
136 /*
137 * Perform the check.
138 */
139 uint16_t fPortMask = (1 << cbOperand) - 1;
140 bmBytes >>= (u16Port & 7);
141 if (bmBytes & fPortMask)
142 {
143 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
144 u16Port, cbOperand, bmBytes, fPortMask));
145 return iemRaiseGeneralProtectionFault0(pVCpu);
146 }
147
148 return VINF_SUCCESS;
149}
150
151
152/**
153 * Checks if we are allowed to access the given I/O port, raising the
154 * appropriate exceptions if we aren't (or if the I/O bitmap is not
155 * accessible).
156 *
157 * @returns Strict VBox status code.
158 *
159 * @param pVCpu The cross context virtual CPU structure of the calling thread.
160 * @param u16Port The port number.
161 * @param cbOperand The operand size.
162 */
163DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
164{
165 X86EFLAGS Efl;
166 Efl.u = IEMMISC_GET_EFL(pVCpu);
167 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
168 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
169 || Efl.Bits.u1VM) )
170 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
171 return VINF_SUCCESS;
172}
173
174
175#if 0
176/**
177 * Calculates the parity bit.
178 *
179 * @returns true if the bit is set, false if not.
180 * @param u8Result The least significant byte of the result.
181 */
182static bool iemHlpCalcParityFlag(uint8_t u8Result)
183{
184 /*
185 * Parity is set if the number of bits in the least significant byte of
186 * the result is even.
187 */
188 uint8_t cBits;
189 cBits = u8Result & 1; /* 0 */
190 u8Result >>= 1;
191 cBits += u8Result & 1;
192 u8Result >>= 1;
193 cBits += u8Result & 1;
194 u8Result >>= 1;
195 cBits += u8Result & 1;
196 u8Result >>= 1;
197 cBits += u8Result & 1; /* 4 */
198 u8Result >>= 1;
199 cBits += u8Result & 1;
200 u8Result >>= 1;
201 cBits += u8Result & 1;
202 u8Result >>= 1;
203 cBits += u8Result & 1;
204 return !(cBits & 1);
205}
206#endif /* not used */
207
208
209/**
210 * Updates the specified flags according to a 8-bit result.
211 *
212 * @param pVCpu The cross context virtual CPU structure of the calling thread.
213 * @param u8Result The result to set the flags according to.
214 * @param fToUpdate The flags to update.
215 * @param fUndefined The flags that are specified as undefined.
216 */
217static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
218{
219 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
220 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
221 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
222 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
223}
224
225
226/**
227 * Updates the specified flags according to a 16-bit result.
228 *
229 * @param pVCpu The cross context virtual CPU structure of the calling thread.
230 * @param u16Result The result to set the flags according to.
231 * @param fToUpdate The flags to update.
232 * @param fUndefined The flags that are specified as undefined.
233 */
234static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
235{
236 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
237 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
238 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
239 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
240}
241
242
243/**
244 * Helper used by iret.
245 *
246 * @param pVCpu The cross context virtual CPU structure of the calling thread.
247 * @param uCpl The new CPL.
248 * @param pSReg Pointer to the segment register.
249 */
250static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
251{
252 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
253 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
254
255 if ( uCpl > pSReg->Attr.n.u2Dpl
256 && pSReg->Attr.n.u1DescType /* code or data, not system */
257 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
258 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
259 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
260}
261
262
263/**
264 * Indicates that we have modified the FPU state.
265 *
266 * @param pVCpu The cross context virtual CPU structure of the calling thread.
267 */
268DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
269{
270 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
271}
272
273/** @} */
274
275/** @name C Implementations
276 * @{
277 */
278
279/**
280 * Implements a 16-bit popa.
281 */
282IEM_CIMPL_DEF_0(iemCImpl_popa_16)
283{
284 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
285 RTGCPTR GCPtrLast = GCPtrStart + 15;
286 VBOXSTRICTRC rcStrict;
287
288 /*
289 * The docs are a bit hard to comprehend here, but it looks like we wrap
290 * around in real mode as long as none of the individual "popa" crosses the
291 * end of the stack segment. In protected mode we check the whole access
292 * in one go. For efficiency, only do the word-by-word thing if we're in
293 * danger of wrapping around.
294 */
295 /** @todo do popa boundary / wrap-around checks. */
296 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
297 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
298 {
299 /* word-by-word */
300 RTUINT64U TmpRsp;
301 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
302 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
303 if (rcStrict == VINF_SUCCESS)
304 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
305 if (rcStrict == VINF_SUCCESS)
306 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
307 if (rcStrict == VINF_SUCCESS)
308 {
309 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
310 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
311 }
312 if (rcStrict == VINF_SUCCESS)
313 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
314 if (rcStrict == VINF_SUCCESS)
315 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
316 if (rcStrict == VINF_SUCCESS)
317 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
318 if (rcStrict == VINF_SUCCESS)
319 {
320 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
321 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
322 }
323 }
324 else
325 {
326 uint16_t const *pa16Mem = NULL;
327 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
328 if (rcStrict == VINF_SUCCESS)
329 {
330 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
331 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
332 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
333 /* skip sp */
334 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
335 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
336 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
337 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
338 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
339 if (rcStrict == VINF_SUCCESS)
340 {
341 iemRegAddToRsp(pVCpu, 16);
342 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
343 }
344 }
345 }
346 return rcStrict;
347}
348
349
350/**
351 * Implements a 32-bit popa.
352 */
353IEM_CIMPL_DEF_0(iemCImpl_popa_32)
354{
355 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
356 RTGCPTR GCPtrLast = GCPtrStart + 31;
357 VBOXSTRICTRC rcStrict;
358
359 /*
360 * The docs are a bit hard to comprehend here, but it looks like we wrap
361 * around in real mode as long as none of the individual "popa" crosses the
362 * end of the stack segment. In protected mode we check the whole access
363 * in one go. For efficiency, only do the word-by-word thing if we're in
364 * danger of wrapping around.
365 */
366 /** @todo do popa boundary / wrap-around checks. */
367 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
368 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
369 {
370 /* word-by-word */
371 RTUINT64U TmpRsp;
372 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
373 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
374 if (rcStrict == VINF_SUCCESS)
375 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
376 if (rcStrict == VINF_SUCCESS)
377 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
378 if (rcStrict == VINF_SUCCESS)
379 {
380 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
381 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
382 }
383 if (rcStrict == VINF_SUCCESS)
384 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
385 if (rcStrict == VINF_SUCCESS)
386 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
387 if (rcStrict == VINF_SUCCESS)
388 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
389 if (rcStrict == VINF_SUCCESS)
390 {
391#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
392 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
393 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
394 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
395 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
396 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
397 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
398 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
399#endif
400 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
401 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
402 }
403 }
404 else
405 {
406 uint32_t const *pa32Mem;
407 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
408 if (rcStrict == VINF_SUCCESS)
409 {
410 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
411 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
412 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
413 /* skip esp */
414 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
415 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
416 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
417 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
418 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
419 if (rcStrict == VINF_SUCCESS)
420 {
421 iemRegAddToRsp(pVCpu, 32);
422 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
423 }
424 }
425 }
426 return rcStrict;
427}
428
429
430/**
431 * Implements a 16-bit pusha.
432 */
433IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
434{
435 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
436 RTGCPTR GCPtrBottom = GCPtrTop - 15;
437 VBOXSTRICTRC rcStrict;
438
439 /*
440 * The docs are a bit hard to comprehend here, but it looks like we wrap
441 * around in real mode as long as none of the individual "pushd" crosses the
442 * end of the stack segment. In protected mode we check the whole access
443 * in one go. For efficiency, only do the word-by-word thing if we're in
444 * danger of wrapping around.
445 */
446 /** @todo do pusha boundary / wrap-around checks. */
447 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
448 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
449 {
450 /* word-by-word */
451 RTUINT64U TmpRsp;
452 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
453 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
454 if (rcStrict == VINF_SUCCESS)
455 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
456 if (rcStrict == VINF_SUCCESS)
457 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
458 if (rcStrict == VINF_SUCCESS)
459 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
460 if (rcStrict == VINF_SUCCESS)
461 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
462 if (rcStrict == VINF_SUCCESS)
463 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
464 if (rcStrict == VINF_SUCCESS)
465 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
466 if (rcStrict == VINF_SUCCESS)
467 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
468 if (rcStrict == VINF_SUCCESS)
469 {
470 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
471 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
472 }
473 }
474 else
475 {
476 GCPtrBottom--;
477 uint16_t *pa16Mem = NULL;
478 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
479 if (rcStrict == VINF_SUCCESS)
480 {
481 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
482 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
483 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
484 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
485 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
486 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
487 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
488 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
489 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
490 if (rcStrict == VINF_SUCCESS)
491 {
492 iemRegSubFromRsp(pVCpu, 16);
493 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
494 }
495 }
496 }
497 return rcStrict;
498}
499
500
501/**
502 * Implements a 32-bit pusha.
503 */
504IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
505{
506 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
507 RTGCPTR GCPtrBottom = GCPtrTop - 31;
508 VBOXSTRICTRC rcStrict;
509
510 /*
511 * The docs are a bit hard to comprehend here, but it looks like we wrap
512 * around in real mode as long as none of the individual "pusha" crosses the
513 * end of the stack segment. In protected mode we check the whole access
514 * in one go. For efficiency, only do the word-by-word thing if we're in
515 * danger of wrapping around.
516 */
517 /** @todo do pusha boundary / wrap-around checks. */
518 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
519 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
520 {
521 /* word-by-word */
522 RTUINT64U TmpRsp;
523 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
524 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
525 if (rcStrict == VINF_SUCCESS)
526 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
527 if (rcStrict == VINF_SUCCESS)
528 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
529 if (rcStrict == VINF_SUCCESS)
530 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
531 if (rcStrict == VINF_SUCCESS)
532 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
533 if (rcStrict == VINF_SUCCESS)
534 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
535 if (rcStrict == VINF_SUCCESS)
536 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
537 if (rcStrict == VINF_SUCCESS)
538 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
539 if (rcStrict == VINF_SUCCESS)
540 {
541 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
542 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
543 }
544 }
545 else
546 {
547 GCPtrBottom--;
548 uint32_t *pa32Mem;
549 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
550 if (rcStrict == VINF_SUCCESS)
551 {
552 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
553 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
554 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
555 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
556 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
557 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
558 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
559 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
560 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
561 if (rcStrict == VINF_SUCCESS)
562 {
563 iemRegSubFromRsp(pVCpu, 32);
564 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
565 }
566 }
567 }
568 return rcStrict;
569}
570
571
572/**
573 * Implements pushf.
574 *
575 *
576 * @param enmEffOpSize The effective operand size.
577 */
578IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
579{
580 VBOXSTRICTRC rcStrict;
581
582 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
583 {
584 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
585 IEM_SVM_UPDATE_NRIP(pVCpu);
586 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
587 }
588
589 /*
590 * If we're in V8086 mode some care is required (which is why we're in
591 * doing this in a C implementation).
592 */
593 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
594 if ( (fEfl & X86_EFL_VM)
595 && X86_EFL_GET_IOPL(fEfl) != 3 )
596 {
597 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
598 if ( enmEffOpSize != IEMMODE_16BIT
599 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
600 return iemRaiseGeneralProtectionFault0(pVCpu);
601 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
602 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
603 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
604 }
605 else
606 {
607
608 /*
609 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
610 */
611 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
612
613 switch (enmEffOpSize)
614 {
615 case IEMMODE_16BIT:
616 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
617 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
618 fEfl |= UINT16_C(0xf000);
619 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
620 break;
621 case IEMMODE_32BIT:
622 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
623 break;
624 case IEMMODE_64BIT:
625 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
626 break;
627 IEM_NOT_REACHED_DEFAULT_CASE_RET();
628 }
629 }
630 if (rcStrict != VINF_SUCCESS)
631 return rcStrict;
632
633 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
634 return VINF_SUCCESS;
635}
636
637
638/**
639 * Implements popf.
640 *
641 * @param enmEffOpSize The effective operand size.
642 */
643IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
644{
645 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
646 VBOXSTRICTRC rcStrict;
647 uint32_t fEflNew;
648
649 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
650 {
651 Log2(("popf: Guest intercept -> #VMEXIT\n"));
652 IEM_SVM_UPDATE_NRIP(pVCpu);
653 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
654 }
655
656 /*
657 * V8086 is special as usual.
658 */
659 if (fEflOld & X86_EFL_VM)
660 {
661 /*
662 * Almost anything goes if IOPL is 3.
663 */
664 if (X86_EFL_GET_IOPL(fEflOld) == 3)
665 {
666 switch (enmEffOpSize)
667 {
668 case IEMMODE_16BIT:
669 {
670 uint16_t u16Value;
671 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
672 if (rcStrict != VINF_SUCCESS)
673 return rcStrict;
674 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
675 break;
676 }
677 case IEMMODE_32BIT:
678 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
679 if (rcStrict != VINF_SUCCESS)
680 return rcStrict;
681 break;
682 IEM_NOT_REACHED_DEFAULT_CASE_RET();
683 }
684
685 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
686 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
687 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
688 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
689 }
690 /*
691 * Interrupt flag virtualization with CR4.VME=1.
692 */
693 else if ( enmEffOpSize == IEMMODE_16BIT
694 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
695 {
696 uint16_t u16Value;
697 RTUINT64U TmpRsp;
698 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
699 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
700 if (rcStrict != VINF_SUCCESS)
701 return rcStrict;
702
703 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
704 * or before? */
705 if ( ( (u16Value & X86_EFL_IF)
706 && (fEflOld & X86_EFL_VIP))
707 || (u16Value & X86_EFL_TF) )
708 return iemRaiseGeneralProtectionFault0(pVCpu);
709
710 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
711 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
712 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
713 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
714
715 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
716 }
717 else
718 return iemRaiseGeneralProtectionFault0(pVCpu);
719
720 }
721 /*
722 * Not in V8086 mode.
723 */
724 else
725 {
726 /* Pop the flags. */
727 switch (enmEffOpSize)
728 {
729 case IEMMODE_16BIT:
730 {
731 uint16_t u16Value;
732 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
733 if (rcStrict != VINF_SUCCESS)
734 return rcStrict;
735 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
736
737 /*
738 * Ancient CPU adjustments:
739 * - 8086, 80186, V20/30:
740 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
741 * practical reasons (masking below). We add them when pushing flags.
742 * - 80286:
743 * The NT and IOPL flags cannot be popped from real mode and are
744 * therefore always zero (since a 286 can never exit from PM and
745 * their initial value is zero). This changed on a 386 and can
746 * therefore be used to detect 286 or 386 CPU in real mode.
747 */
748 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
749 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
750 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
751 break;
752 }
753 case IEMMODE_32BIT:
754 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
755 if (rcStrict != VINF_SUCCESS)
756 return rcStrict;
757 break;
758 case IEMMODE_64BIT:
759 {
760 uint64_t u64Value;
761 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
762 if (rcStrict != VINF_SUCCESS)
763 return rcStrict;
764 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
765 break;
766 }
767 IEM_NOT_REACHED_DEFAULT_CASE_RET();
768 }
769
770 /* Merge them with the current flags. */
771 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
772 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
773 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
774 || pVCpu->iem.s.uCpl == 0)
775 {
776 fEflNew &= fPopfBits;
777 fEflNew |= ~fPopfBits & fEflOld;
778 }
779 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
780 {
781 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
782 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
783 }
784 else
785 {
786 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
787 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
788 }
789 }
790
791 /*
792 * Commit the flags.
793 */
794 Assert(fEflNew & RT_BIT_32(1));
795 IEMMISC_SET_EFL(pVCpu, fEflNew);
796 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
797
798 return VINF_SUCCESS;
799}
800
801
802/**
803 * Implements an indirect call.
804 *
805 * @param uNewPC The new program counter (RIP) value (loaded from the
806 * operand).
807 */
808IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
809{
810 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
811 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
812 return iemRaiseGeneralProtectionFault0(pVCpu);
813
814 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
815 if (rcStrict != VINF_SUCCESS)
816 return rcStrict;
817
818 pVCpu->cpum.GstCtx.rip = uNewPC;
819 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
820
821#ifndef IEM_WITH_CODE_TLB
822 /* Flush the prefetch buffer. */
823 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
824#endif
825 return VINF_SUCCESS;
826}
827
828
829/**
830 * Implements a 16-bit relative call.
831 *
832 * @param offDisp The displacment offset.
833 */
834IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
835{
836 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
837 uint16_t uNewPC = uOldPC + offDisp;
838 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
839 return iemRaiseGeneralProtectionFault0(pVCpu);
840
841 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
842 if (rcStrict != VINF_SUCCESS)
843 return rcStrict;
844
845 pVCpu->cpum.GstCtx.rip = uNewPC;
846 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
847
848#ifndef IEM_WITH_CODE_TLB
849 /* Flush the prefetch buffer. */
850 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
851#endif
852 return VINF_SUCCESS;
853}
854
855
856/**
857 * Implements a 32-bit indirect call.
858 *
859 * @param uNewPC The new program counter (RIP) value (loaded from the
860 * operand).
861 */
862IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
863{
864 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
865 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
866 return iemRaiseGeneralProtectionFault0(pVCpu);
867
868 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
869 if (rcStrict != VINF_SUCCESS)
870 return rcStrict;
871
872 pVCpu->cpum.GstCtx.rip = uNewPC;
873 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
874
875#ifndef IEM_WITH_CODE_TLB
876 /* Flush the prefetch buffer. */
877 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
878#endif
879 return VINF_SUCCESS;
880}
881
882
883/**
884 * Implements a 32-bit relative call.
885 *
886 * @param offDisp The displacment offset.
887 */
888IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
889{
890 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
891 uint32_t uNewPC = uOldPC + offDisp;
892 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
893 return iemRaiseGeneralProtectionFault0(pVCpu);
894
895 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
896 if (rcStrict != VINF_SUCCESS)
897 return rcStrict;
898
899 pVCpu->cpum.GstCtx.rip = uNewPC;
900 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
901
902#ifndef IEM_WITH_CODE_TLB
903 /* Flush the prefetch buffer. */
904 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
905#endif
906 return VINF_SUCCESS;
907}
908
909
910/**
911 * Implements a 64-bit indirect call.
912 *
913 * @param uNewPC The new program counter (RIP) value (loaded from the
914 * operand).
915 */
916IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
917{
918 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
919 if (!IEM_IS_CANONICAL(uNewPC))
920 return iemRaiseGeneralProtectionFault0(pVCpu);
921
922 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
923 if (rcStrict != VINF_SUCCESS)
924 return rcStrict;
925
926 pVCpu->cpum.GstCtx.rip = uNewPC;
927 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
928
929#ifndef IEM_WITH_CODE_TLB
930 /* Flush the prefetch buffer. */
931 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
932#endif
933 return VINF_SUCCESS;
934}
935
936
937/**
938 * Implements a 64-bit relative call.
939 *
940 * @param offDisp The displacment offset.
941 */
942IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
943{
944 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
945 uint64_t uNewPC = uOldPC + offDisp;
946 if (!IEM_IS_CANONICAL(uNewPC))
947 return iemRaiseNotCanonical(pVCpu);
948
949 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
950 if (rcStrict != VINF_SUCCESS)
951 return rcStrict;
952
953 pVCpu->cpum.GstCtx.rip = uNewPC;
954 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
955
956#ifndef IEM_WITH_CODE_TLB
957 /* Flush the prefetch buffer. */
958 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
959#endif
960
961 return VINF_SUCCESS;
962}
963
964
965/**
966 * Implements far jumps and calls thru task segments (TSS).
967 *
968 * @param uSel The selector.
969 * @param enmBranch The kind of branching we're performing.
970 * @param enmEffOpSize The effective operand size.
971 * @param pDesc The descriptor corresponding to @a uSel. The type is
972 * task gate.
973 */
974IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
975{
976#ifndef IEM_IMPLEMENTS_TASKSWITCH
977 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
978#else
979 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
980 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
981 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
982 RT_NOREF_PV(enmEffOpSize);
983 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
984
985 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
986 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
987 {
988 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
989 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
990 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
991 }
992
993 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
994 * far calls (see iemCImpl_callf). Most likely in both cases it should be
995 * checked here, need testcases. */
996 if (!pDesc->Legacy.Gen.u1Present)
997 {
998 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
999 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1000 }
1001
1002 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1003 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1004 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1005#endif
1006}
1007
1008
1009/**
1010 * Implements far jumps and calls thru task gates.
1011 *
1012 * @param uSel The selector.
1013 * @param enmBranch The kind of branching we're performing.
1014 * @param enmEffOpSize The effective operand size.
1015 * @param pDesc The descriptor corresponding to @a uSel. The type is
1016 * task gate.
1017 */
1018IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1019{
1020#ifndef IEM_IMPLEMENTS_TASKSWITCH
1021 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1022#else
1023 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1024 RT_NOREF_PV(enmEffOpSize);
1025 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1026
1027 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1028 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1029 {
1030 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1031 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1032 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1033 }
1034
1035 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1036 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1037 * checked here, need testcases. */
1038 if (!pDesc->Legacy.Gen.u1Present)
1039 {
1040 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1041 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1042 }
1043
1044 /*
1045 * Fetch the new TSS descriptor from the GDT.
1046 */
1047 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1048 if (uSelTss & X86_SEL_LDT)
1049 {
1050 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1051 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1052 }
1053
1054 IEMSELDESC TssDesc;
1055 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1056 if (rcStrict != VINF_SUCCESS)
1057 return rcStrict;
1058
1059 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1060 {
1061 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1062 TssDesc.Legacy.Gate.u4Type));
1063 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1064 }
1065
1066 if (!TssDesc.Legacy.Gate.u1Present)
1067 {
1068 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1069 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1070 }
1071
1072 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1073 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1074 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1075#endif
1076}
1077
1078
1079/**
1080 * Implements far jumps and calls thru call gates.
1081 *
1082 * @param uSel The selector.
1083 * @param enmBranch The kind of branching we're performing.
1084 * @param enmEffOpSize The effective operand size.
1085 * @param pDesc The descriptor corresponding to @a uSel. The type is
1086 * call gate.
1087 */
1088IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1089{
1090#define IEM_IMPLEMENTS_CALLGATE
1091#ifndef IEM_IMPLEMENTS_CALLGATE
1092 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1093#else
1094 RT_NOREF_PV(enmEffOpSize);
1095 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1096
1097 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1098 * inter-privilege calls and are much more complex.
1099 *
1100 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1101 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1102 * must be 16-bit or 32-bit.
1103 */
1104 /** @todo effective operand size is probably irrelevant here, only the
1105 * call gate bitness matters??
1106 */
1107 VBOXSTRICTRC rcStrict;
1108 RTPTRUNION uPtrRet;
1109 uint64_t uNewRsp;
1110 uint64_t uNewRip;
1111 uint64_t u64Base;
1112 uint32_t cbLimit;
1113 RTSEL uNewCS;
1114 IEMSELDESC DescCS;
1115
1116 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1117 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1118 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1119 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1120
1121 /* Determine the new instruction pointer from the gate descriptor. */
1122 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1123 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1124 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1125
1126 /* Perform DPL checks on the gate descriptor. */
1127 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1128 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1129 {
1130 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1131 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1132 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1133 }
1134
1135 /** @todo does this catch NULL selectors, too? */
1136 if (!pDesc->Legacy.Gen.u1Present)
1137 {
1138 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1139 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1140 }
1141
1142 /*
1143 * Fetch the target CS descriptor from the GDT or LDT.
1144 */
1145 uNewCS = pDesc->Legacy.Gate.u16Sel;
1146 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1147 if (rcStrict != VINF_SUCCESS)
1148 return rcStrict;
1149
1150 /* Target CS must be a code selector. */
1151 if ( !DescCS.Legacy.Gen.u1DescType
1152 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1153 {
1154 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1155 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1156 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1157 }
1158
1159 /* Privilege checks on target CS. */
1160 if (enmBranch == IEMBRANCH_JUMP)
1161 {
1162 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1163 {
1164 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1165 {
1166 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1167 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1168 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1169 }
1170 }
1171 else
1172 {
1173 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1174 {
1175 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1176 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1177 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1178 }
1179 }
1180 }
1181 else
1182 {
1183 Assert(enmBranch == IEMBRANCH_CALL);
1184 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1185 {
1186 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1187 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1188 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1189 }
1190 }
1191
1192 /* Additional long mode checks. */
1193 if (IEM_IS_LONG_MODE(pVCpu))
1194 {
1195 if (!DescCS.Legacy.Gen.u1Long)
1196 {
1197 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1198 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1199 }
1200
1201 /* L vs D. */
1202 if ( DescCS.Legacy.Gen.u1Long
1203 && DescCS.Legacy.Gen.u1DefBig)
1204 {
1205 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1206 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1207 }
1208 }
1209
1210 if (!DescCS.Legacy.Gate.u1Present)
1211 {
1212 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1213 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1214 }
1215
1216 if (enmBranch == IEMBRANCH_JUMP)
1217 {
1218 /** @todo This is very similar to regular far jumps; merge! */
1219 /* Jumps are fairly simple... */
1220
1221 /* Chop the high bits off if 16-bit gate (Intel says so). */
1222 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1223 uNewRip = (uint16_t)uNewRip;
1224
1225 /* Limit check for non-long segments. */
1226 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1227 if (DescCS.Legacy.Gen.u1Long)
1228 u64Base = 0;
1229 else
1230 {
1231 if (uNewRip > cbLimit)
1232 {
1233 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1234 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1235 }
1236 u64Base = X86DESC_BASE(&DescCS.Legacy);
1237 }
1238
1239 /* Canonical address check. */
1240 if (!IEM_IS_CANONICAL(uNewRip))
1241 {
1242 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1243 return iemRaiseNotCanonical(pVCpu);
1244 }
1245
1246 /*
1247 * Ok, everything checked out fine. Now set the accessed bit before
1248 * committing the result into CS, CSHID and RIP.
1249 */
1250 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1251 {
1252 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1253 if (rcStrict != VINF_SUCCESS)
1254 return rcStrict;
1255 /** @todo check what VT-x and AMD-V does. */
1256 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1257 }
1258
1259 /* commit */
1260 pVCpu->cpum.GstCtx.rip = uNewRip;
1261 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1262 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1263 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1264 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1265 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1266 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1267 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1268 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1269 }
1270 else
1271 {
1272 Assert(enmBranch == IEMBRANCH_CALL);
1273 /* Calls are much more complicated. */
1274
1275 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1276 {
1277 uint16_t offNewStack; /* Offset of new stack in TSS. */
1278 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1279 uint8_t uNewCSDpl;
1280 uint8_t cbWords;
1281 RTSEL uNewSS;
1282 RTSEL uOldSS;
1283 uint64_t uOldRsp;
1284 IEMSELDESC DescSS;
1285 RTPTRUNION uPtrTSS;
1286 RTGCPTR GCPtrTSS;
1287 RTPTRUNION uPtrParmWds;
1288 RTGCPTR GCPtrParmWds;
1289
1290 /* More privilege. This is the fun part. */
1291 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1292
1293 /*
1294 * Determine new SS:rSP from the TSS.
1295 */
1296 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1297
1298 /* Figure out where the new stack pointer is stored in the TSS. */
1299 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1300 if (!IEM_IS_LONG_MODE(pVCpu))
1301 {
1302 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1303 {
1304 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1305 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1306 }
1307 else
1308 {
1309 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1310 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1311 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1312 }
1313 }
1314 else
1315 {
1316 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1317 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1318 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1319 }
1320
1321 /* Check against TSS limit. */
1322 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1323 {
1324 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1325 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1326 }
1327
1328 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1329 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
1330 if (rcStrict != VINF_SUCCESS)
1331 {
1332 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1333 return rcStrict;
1334 }
1335
1336 if (!IEM_IS_LONG_MODE(pVCpu))
1337 {
1338 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1339 {
1340 uNewRsp = uPtrTSS.pu32[0];
1341 uNewSS = uPtrTSS.pu16[2];
1342 }
1343 else
1344 {
1345 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1346 uNewRsp = uPtrTSS.pu16[0];
1347 uNewSS = uPtrTSS.pu16[1];
1348 }
1349 }
1350 else
1351 {
1352 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1353 /* SS will be a NULL selector, but that's valid. */
1354 uNewRsp = uPtrTSS.pu64[0];
1355 uNewSS = uNewCSDpl;
1356 }
1357
1358 /* Done with the TSS now. */
1359 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1360 if (rcStrict != VINF_SUCCESS)
1361 {
1362 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1363 return rcStrict;
1364 }
1365
1366 /* Only used outside of long mode. */
1367 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1368
1369 /* If EFER.LMA is 0, there's extra work to do. */
1370 if (!IEM_IS_LONG_MODE(pVCpu))
1371 {
1372 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1373 {
1374 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1375 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1376 }
1377
1378 /* Grab the new SS descriptor. */
1379 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1380 if (rcStrict != VINF_SUCCESS)
1381 return rcStrict;
1382
1383 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1384 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1385 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1386 {
1387 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1388 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1389 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1390 }
1391
1392 /* Ensure new SS is a writable data segment. */
1393 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1394 {
1395 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1396 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1397 }
1398
1399 if (!DescSS.Legacy.Gen.u1Present)
1400 {
1401 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1402 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1403 }
1404 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1405 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1406 else
1407 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1408 }
1409 else
1410 {
1411 /* Just grab the new (NULL) SS descriptor. */
1412 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1413 * like we do... */
1414 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1415 if (rcStrict != VINF_SUCCESS)
1416 return rcStrict;
1417
1418 cbNewStack = sizeof(uint64_t) * 4;
1419 }
1420
1421 /** @todo According to Intel, new stack is checked for enough space first,
1422 * then switched. According to AMD, the stack is switched first and
1423 * then pushes might fault!
1424 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1425 * incoming stack \#PF happens before actual stack switch. AMD is
1426 * either lying or implicitly assumes that new state is committed
1427 * only if and when an instruction doesn't fault.
1428 */
1429
1430 /** @todo According to AMD, CS is loaded first, then SS.
1431 * According to Intel, it's the other way around!?
1432 */
1433
1434 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1435
1436 /* Set the accessed bit before committing new SS. */
1437 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1438 {
1439 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1440 if (rcStrict != VINF_SUCCESS)
1441 return rcStrict;
1442 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1443 }
1444
1445 /* Remember the old SS:rSP and their linear address. */
1446 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1447 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1448
1449 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1450
1451 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1452 or #PF, the former is not implemented in this workaround. */
1453 /** @todo Proper fix callgate target stack exceptions. */
1454 /** @todo testcase: Cover callgates with partially or fully inaccessible
1455 * target stacks. */
1456 void *pvNewFrame;
1457 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1458 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1459 if (rcStrict != VINF_SUCCESS)
1460 {
1461 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1462 return rcStrict;
1463 }
1464 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1465 if (rcStrict != VINF_SUCCESS)
1466 {
1467 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1468 return rcStrict;
1469 }
1470
1471 /* Commit new SS:rSP. */
1472 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1473 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1474 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1475 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1476 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1477 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1478 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1479 pVCpu->iem.s.uCpl = uNewCSDpl; /** @todo is the parameter words accessed using the new CPL or the old CPL? */
1480 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1481 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1482
1483 /* At this point the stack access must not fail because new state was already committed. */
1484 /** @todo this can still fail due to SS.LIMIT not check. */
1485 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1486 IEM_IS_LONG_MODE(pVCpu) ? 7
1487 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1488 &uPtrRet.pv, &uNewRsp);
1489 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1490 VERR_INTERNAL_ERROR_5);
1491
1492 if (!IEM_IS_LONG_MODE(pVCpu))
1493 {
1494 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1495 {
1496 if (cbWords)
1497 {
1498 /* Map the relevant chunk of the old stack. */
1499 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1500 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1501 if (rcStrict != VINF_SUCCESS)
1502 {
1503 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1504 return rcStrict;
1505 }
1506
1507 /* Copy the parameter (d)words. */
1508 for (int i = 0; i < cbWords; ++i)
1509 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1510
1511 /* Unmap the old stack. */
1512 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1513 if (rcStrict != VINF_SUCCESS)
1514 {
1515 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1516 return rcStrict;
1517 }
1518 }
1519
1520 /* Push the old CS:rIP. */
1521 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1522 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1523
1524 /* Push the old SS:rSP. */
1525 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1526 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1527 }
1528 else
1529 {
1530 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1531
1532 if (cbWords)
1533 {
1534 /* Map the relevant chunk of the old stack. */
1535 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1536 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1537 if (rcStrict != VINF_SUCCESS)
1538 {
1539 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1540 return rcStrict;
1541 }
1542
1543 /* Copy the parameter words. */
1544 for (int i = 0; i < cbWords; ++i)
1545 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1546
1547 /* Unmap the old stack. */
1548 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1549 if (rcStrict != VINF_SUCCESS)
1550 {
1551 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1552 return rcStrict;
1553 }
1554 }
1555
1556 /* Push the old CS:rIP. */
1557 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1558 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1559
1560 /* Push the old SS:rSP. */
1561 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1562 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1563 }
1564 }
1565 else
1566 {
1567 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1568
1569 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1570 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1571 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1572 uPtrRet.pu64[2] = uOldRsp;
1573 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1574 }
1575
1576 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1577 if (rcStrict != VINF_SUCCESS)
1578 {
1579 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1580 return rcStrict;
1581 }
1582
1583 /* Chop the high bits off if 16-bit gate (Intel says so). */
1584 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1585 uNewRip = (uint16_t)uNewRip;
1586
1587 /* Limit / canonical check. */
1588 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1589 if (!IEM_IS_LONG_MODE(pVCpu))
1590 {
1591 if (uNewRip > cbLimit)
1592 {
1593 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1594 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1595 }
1596 u64Base = X86DESC_BASE(&DescCS.Legacy);
1597 }
1598 else
1599 {
1600 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1601 if (!IEM_IS_CANONICAL(uNewRip))
1602 {
1603 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1604 return iemRaiseNotCanonical(pVCpu);
1605 }
1606 u64Base = 0;
1607 }
1608
1609 /*
1610 * Now set the accessed bit before
1611 * writing the return address to the stack and committing the result into
1612 * CS, CSHID and RIP.
1613 */
1614 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1615 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1616 {
1617 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1618 if (rcStrict != VINF_SUCCESS)
1619 return rcStrict;
1620 /** @todo check what VT-x and AMD-V does. */
1621 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1622 }
1623
1624 /* Commit new CS:rIP. */
1625 pVCpu->cpum.GstCtx.rip = uNewRip;
1626 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1627 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1628 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1629 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1630 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1631 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1632 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1633 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1634 }
1635 else
1636 {
1637 /* Same privilege. */
1638 /** @todo This is very similar to regular far calls; merge! */
1639
1640 /* Check stack first - may #SS(0). */
1641 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1642 * 16-bit code cause a two or four byte CS to be pushed? */
1643 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1644 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1645 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1646 IEM_IS_LONG_MODE(pVCpu) ? 7
1647 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1648 &uPtrRet.pv, &uNewRsp);
1649 if (rcStrict != VINF_SUCCESS)
1650 return rcStrict;
1651
1652 /* Chop the high bits off if 16-bit gate (Intel says so). */
1653 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1654 uNewRip = (uint16_t)uNewRip;
1655
1656 /* Limit / canonical check. */
1657 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1658 if (!IEM_IS_LONG_MODE(pVCpu))
1659 {
1660 if (uNewRip > cbLimit)
1661 {
1662 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1663 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1664 }
1665 u64Base = X86DESC_BASE(&DescCS.Legacy);
1666 }
1667 else
1668 {
1669 if (!IEM_IS_CANONICAL(uNewRip))
1670 {
1671 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1672 return iemRaiseNotCanonical(pVCpu);
1673 }
1674 u64Base = 0;
1675 }
1676
1677 /*
1678 * Now set the accessed bit before
1679 * writing the return address to the stack and committing the result into
1680 * CS, CSHID and RIP.
1681 */
1682 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1683 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1684 {
1685 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1686 if (rcStrict != VINF_SUCCESS)
1687 return rcStrict;
1688 /** @todo check what VT-x and AMD-V does. */
1689 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1690 }
1691
1692 /* stack */
1693 if (!IEM_IS_LONG_MODE(pVCpu))
1694 {
1695 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1696 {
1697 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1698 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1699 }
1700 else
1701 {
1702 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1703 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1704 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1705 }
1706 }
1707 else
1708 {
1709 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1710 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1711 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1712 }
1713
1714 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1715 if (rcStrict != VINF_SUCCESS)
1716 return rcStrict;
1717
1718 /* commit */
1719 pVCpu->cpum.GstCtx.rip = uNewRip;
1720 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1721 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1722 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1723 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1724 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1725 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1726 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1727 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1728 }
1729 }
1730 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1731
1732 /* Flush the prefetch buffer. */
1733# ifdef IEM_WITH_CODE_TLB
1734 pVCpu->iem.s.pbInstrBuf = NULL;
1735# else
1736 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1737# endif
1738 return VINF_SUCCESS;
1739#endif
1740}
1741
1742
1743/**
1744 * Implements far jumps and calls thru system selectors.
1745 *
1746 * @param uSel The selector.
1747 * @param enmBranch The kind of branching we're performing.
1748 * @param enmEffOpSize The effective operand size.
1749 * @param pDesc The descriptor corresponding to @a uSel.
1750 */
1751IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1752{
1753 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1754 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1755 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1756
1757 if (IEM_IS_LONG_MODE(pVCpu))
1758 switch (pDesc->Legacy.Gen.u4Type)
1759 {
1760 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1761 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1762
1763 default:
1764 case AMD64_SEL_TYPE_SYS_LDT:
1765 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1766 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1767 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1768 case AMD64_SEL_TYPE_SYS_INT_GATE:
1769 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1770 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1771 }
1772
1773 switch (pDesc->Legacy.Gen.u4Type)
1774 {
1775 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1776 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1777 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1778
1779 case X86_SEL_TYPE_SYS_TASK_GATE:
1780 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1781
1782 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1783 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1784 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1785
1786 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1787 Log(("branch %04x -> busy 286 TSS\n", uSel));
1788 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1789
1790 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1791 Log(("branch %04x -> busy 386 TSS\n", uSel));
1792 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1793
1794 default:
1795 case X86_SEL_TYPE_SYS_LDT:
1796 case X86_SEL_TYPE_SYS_286_INT_GATE:
1797 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1798 case X86_SEL_TYPE_SYS_386_INT_GATE:
1799 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1800 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1801 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1802 }
1803}
1804
1805
1806/**
1807 * Implements far jumps.
1808 *
1809 * @param uSel The selector.
1810 * @param offSeg The segment offset.
1811 * @param enmEffOpSize The effective operand size.
1812 */
1813IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1814{
1815 NOREF(cbInstr);
1816 Assert(offSeg <= UINT32_MAX);
1817
1818 /*
1819 * Real mode and V8086 mode are easy. The only snag seems to be that
1820 * CS.limit doesn't change and the limit check is done against the current
1821 * limit.
1822 */
1823 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1824 * 1998) that up to and including the Intel 486, far control
1825 * transfers in real mode set default CS attributes (0x93) and also
1826 * set a 64K segment limit. Starting with the Pentium, the
1827 * attributes and limit are left alone but the access rights are
1828 * ignored. We only implement the Pentium+ behavior.
1829 * */
1830 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1831 {
1832 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1833 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1834 {
1835 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1836 return iemRaiseGeneralProtectionFault0(pVCpu);
1837 }
1838
1839 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1840 pVCpu->cpum.GstCtx.rip = offSeg;
1841 else
1842 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1843 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1844 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1845 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1846 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1847 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1848 return VINF_SUCCESS;
1849 }
1850
1851 /*
1852 * Protected mode. Need to parse the specified descriptor...
1853 */
1854 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1855 {
1856 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1857 return iemRaiseGeneralProtectionFault0(pVCpu);
1858 }
1859
1860 /* Fetch the descriptor. */
1861 IEMSELDESC Desc;
1862 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1863 if (rcStrict != VINF_SUCCESS)
1864 return rcStrict;
1865
1866 /* Is it there? */
1867 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1868 {
1869 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1870 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1871 }
1872
1873 /*
1874 * Deal with it according to its type. We do the standard code selectors
1875 * here and dispatch the system selectors to worker functions.
1876 */
1877 if (!Desc.Legacy.Gen.u1DescType)
1878 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1879
1880 /* Only code segments. */
1881 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1882 {
1883 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1884 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1885 }
1886
1887 /* L vs D. */
1888 if ( Desc.Legacy.Gen.u1Long
1889 && Desc.Legacy.Gen.u1DefBig
1890 && IEM_IS_LONG_MODE(pVCpu))
1891 {
1892 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895
1896 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1897 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1898 {
1899 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1900 {
1901 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1902 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1903 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1904 }
1905 }
1906 else
1907 {
1908 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1909 {
1910 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1911 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1912 }
1913 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1914 {
1915 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1916 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1917 }
1918 }
1919
1920 /* Chop the high bits if 16-bit (Intel says so). */
1921 if (enmEffOpSize == IEMMODE_16BIT)
1922 offSeg &= UINT16_MAX;
1923
1924 /* Limit check. (Should alternatively check for non-canonical addresses
1925 here, but that is ruled out by offSeg being 32-bit, right?) */
1926 uint64_t u64Base;
1927 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1928 if (Desc.Legacy.Gen.u1Long)
1929 u64Base = 0;
1930 else
1931 {
1932 if (offSeg > cbLimit)
1933 {
1934 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1935 /** @todo Intel says this is \#GP(0)! */
1936 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1937 }
1938 u64Base = X86DESC_BASE(&Desc.Legacy);
1939 }
1940
1941 /*
1942 * Ok, everything checked out fine. Now set the accessed bit before
1943 * committing the result into CS, CSHID and RIP.
1944 */
1945 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1946 {
1947 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1948 if (rcStrict != VINF_SUCCESS)
1949 return rcStrict;
1950 /** @todo check what VT-x and AMD-V does. */
1951 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1952 }
1953
1954 /* commit */
1955 pVCpu->cpum.GstCtx.rip = offSeg;
1956 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1957 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1958 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1959 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1960 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1961 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1962 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1963 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1964 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1965 /** @todo check if the hidden bits are loaded correctly for 64-bit
1966 * mode. */
1967
1968 /* Flush the prefetch buffer. */
1969#ifdef IEM_WITH_CODE_TLB
1970 pVCpu->iem.s.pbInstrBuf = NULL;
1971#else
1972 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1973#endif
1974
1975 return VINF_SUCCESS;
1976}
1977
1978
1979/**
1980 * Implements far calls.
1981 *
1982 * This very similar to iemCImpl_FarJmp.
1983 *
1984 * @param uSel The selector.
1985 * @param offSeg The segment offset.
1986 * @param enmEffOpSize The operand size (in case we need it).
1987 */
1988IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1989{
1990 VBOXSTRICTRC rcStrict;
1991 uint64_t uNewRsp;
1992 RTPTRUNION uPtrRet;
1993
1994 /*
1995 * Real mode and V8086 mode are easy. The only snag seems to be that
1996 * CS.limit doesn't change and the limit check is done against the current
1997 * limit.
1998 */
1999 /** @todo See comment for similar code in iemCImpl_FarJmp */
2000 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2001 {
2002 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2003
2004 /* Check stack first - may #SS(0). */
2005 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2006 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2007 &uPtrRet.pv, &uNewRsp);
2008 if (rcStrict != VINF_SUCCESS)
2009 return rcStrict;
2010
2011 /* Check the target address range. */
2012 if (offSeg > UINT32_MAX)
2013 return iemRaiseGeneralProtectionFault0(pVCpu);
2014
2015 /* Everything is fine, push the return address. */
2016 if (enmEffOpSize == IEMMODE_16BIT)
2017 {
2018 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2019 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2020 }
2021 else
2022 {
2023 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2024 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2025 }
2026 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2027 if (rcStrict != VINF_SUCCESS)
2028 return rcStrict;
2029
2030 /* Branch. */
2031 pVCpu->cpum.GstCtx.rip = offSeg;
2032 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2033 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2034 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2035 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2036 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2037 return VINF_SUCCESS;
2038 }
2039
2040 /*
2041 * Protected mode. Need to parse the specified descriptor...
2042 */
2043 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2044 {
2045 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2046 return iemRaiseGeneralProtectionFault0(pVCpu);
2047 }
2048
2049 /* Fetch the descriptor. */
2050 IEMSELDESC Desc;
2051 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2052 if (rcStrict != VINF_SUCCESS)
2053 return rcStrict;
2054
2055 /*
2056 * Deal with it according to its type. We do the standard code selectors
2057 * here and dispatch the system selectors to worker functions.
2058 */
2059 if (!Desc.Legacy.Gen.u1DescType)
2060 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2061
2062 /* Only code segments. */
2063 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2064 {
2065 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2066 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2067 }
2068
2069 /* L vs D. */
2070 if ( Desc.Legacy.Gen.u1Long
2071 && Desc.Legacy.Gen.u1DefBig
2072 && IEM_IS_LONG_MODE(pVCpu))
2073 {
2074 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2075 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2076 }
2077
2078 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2079 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2080 {
2081 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2082 {
2083 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2084 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2085 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2086 }
2087 }
2088 else
2089 {
2090 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2091 {
2092 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2093 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2094 }
2095 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2096 {
2097 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2098 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2099 }
2100 }
2101
2102 /* Is it there? */
2103 if (!Desc.Legacy.Gen.u1Present)
2104 {
2105 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2106 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2107 }
2108
2109 /* Check stack first - may #SS(0). */
2110 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2111 * 16-bit code cause a two or four byte CS to be pushed? */
2112 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2113 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2114 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2115 &uPtrRet.pv, &uNewRsp);
2116 if (rcStrict != VINF_SUCCESS)
2117 return rcStrict;
2118
2119 /* Chop the high bits if 16-bit (Intel says so). */
2120 if (enmEffOpSize == IEMMODE_16BIT)
2121 offSeg &= UINT16_MAX;
2122
2123 /* Limit / canonical check. */
2124 uint64_t u64Base;
2125 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2126 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2127 {
2128 if (!IEM_IS_CANONICAL(offSeg))
2129 {
2130 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2131 return iemRaiseNotCanonical(pVCpu);
2132 }
2133 u64Base = 0;
2134 }
2135 else
2136 {
2137 if (offSeg > cbLimit)
2138 {
2139 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2140 /** @todo Intel says this is \#GP(0)! */
2141 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2142 }
2143 u64Base = X86DESC_BASE(&Desc.Legacy);
2144 }
2145
2146 /*
2147 * Now set the accessed bit before
2148 * writing the return address to the stack and committing the result into
2149 * CS, CSHID and RIP.
2150 */
2151 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2152 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2153 {
2154 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2155 if (rcStrict != VINF_SUCCESS)
2156 return rcStrict;
2157 /** @todo check what VT-x and AMD-V does. */
2158 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2159 }
2160
2161 /* stack */
2162 if (enmEffOpSize == IEMMODE_16BIT)
2163 {
2164 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2165 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2166 }
2167 else if (enmEffOpSize == IEMMODE_32BIT)
2168 {
2169 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2170 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2171 }
2172 else
2173 {
2174 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2175 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2176 }
2177 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2178 if (rcStrict != VINF_SUCCESS)
2179 return rcStrict;
2180
2181 /* commit */
2182 pVCpu->cpum.GstCtx.rip = offSeg;
2183 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2184 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2185 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2186 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2187 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2188 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2189 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2190 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2191 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2192 /** @todo check if the hidden bits are loaded correctly for 64-bit
2193 * mode. */
2194
2195 /* Flush the prefetch buffer. */
2196#ifdef IEM_WITH_CODE_TLB
2197 pVCpu->iem.s.pbInstrBuf = NULL;
2198#else
2199 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2200#endif
2201 return VINF_SUCCESS;
2202}
2203
2204
2205/**
2206 * Implements retf.
2207 *
2208 * @param enmEffOpSize The effective operand size.
2209 * @param cbPop The amount of arguments to pop from the stack
2210 * (bytes).
2211 */
2212IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2213{
2214 VBOXSTRICTRC rcStrict;
2215 RTCPTRUNION uPtrFrame;
2216 uint64_t uNewRsp;
2217 uint64_t uNewRip;
2218 uint16_t uNewCs;
2219 NOREF(cbInstr);
2220
2221 /*
2222 * Read the stack values first.
2223 */
2224 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2225 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2226 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2227 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2228 &uPtrFrame.pv, &uNewRsp);
2229 if (rcStrict != VINF_SUCCESS)
2230 return rcStrict;
2231 if (enmEffOpSize == IEMMODE_16BIT)
2232 {
2233 uNewRip = uPtrFrame.pu16[0];
2234 uNewCs = uPtrFrame.pu16[1];
2235 }
2236 else if (enmEffOpSize == IEMMODE_32BIT)
2237 {
2238 uNewRip = uPtrFrame.pu32[0];
2239 uNewCs = uPtrFrame.pu16[2];
2240 }
2241 else
2242 {
2243 uNewRip = uPtrFrame.pu64[0];
2244 uNewCs = uPtrFrame.pu16[4];
2245 }
2246 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2247 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2248 { /* extremely likely */ }
2249 else
2250 return rcStrict;
2251
2252 /*
2253 * Real mode and V8086 mode are easy.
2254 */
2255 /** @todo See comment for similar code in iemCImpl_FarJmp */
2256 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2257 {
2258 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2259 /** @todo check how this is supposed to work if sp=0xfffe. */
2260
2261 /* Check the limit of the new EIP. */
2262 /** @todo Intel pseudo code only does the limit check for 16-bit
2263 * operands, AMD does not make any distinction. What is right? */
2264 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2265 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2266
2267 /* commit the operation. */
2268 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2269 pVCpu->cpum.GstCtx.rip = uNewRip;
2270 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2271 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2272 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2273 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2274 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2275 if (cbPop)
2276 iemRegAddToRsp(pVCpu, cbPop);
2277 return VINF_SUCCESS;
2278 }
2279
2280 /*
2281 * Protected mode is complicated, of course.
2282 */
2283 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2284 {
2285 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2286 return iemRaiseGeneralProtectionFault0(pVCpu);
2287 }
2288
2289 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2290
2291 /* Fetch the descriptor. */
2292 IEMSELDESC DescCs;
2293 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2294 if (rcStrict != VINF_SUCCESS)
2295 return rcStrict;
2296
2297 /* Can only return to a code selector. */
2298 if ( !DescCs.Legacy.Gen.u1DescType
2299 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2300 {
2301 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2302 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2303 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2304 }
2305
2306 /* L vs D. */
2307 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2308 && DescCs.Legacy.Gen.u1DefBig
2309 && IEM_IS_LONG_MODE(pVCpu))
2310 {
2311 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2312 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2313 }
2314
2315 /* DPL/RPL/CPL checks. */
2316 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2317 {
2318 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2319 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2320 }
2321
2322 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2323 {
2324 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2325 {
2326 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2327 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2328 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2329 }
2330 }
2331 else
2332 {
2333 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2334 {
2335 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2336 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2337 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2338 }
2339 }
2340
2341 /* Is it there? */
2342 if (!DescCs.Legacy.Gen.u1Present)
2343 {
2344 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2345 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2346 }
2347
2348 /*
2349 * Return to outer privilege? (We'll typically have entered via a call gate.)
2350 */
2351 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2352 {
2353 /* Read the outer stack pointer stored *after* the parameters. */
2354 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2355 if (rcStrict != VINF_SUCCESS)
2356 return rcStrict;
2357
2358 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2359
2360 uint16_t uNewOuterSs;
2361 uint64_t uNewOuterRsp;
2362 if (enmEffOpSize == IEMMODE_16BIT)
2363 {
2364 uNewOuterRsp = uPtrFrame.pu16[0];
2365 uNewOuterSs = uPtrFrame.pu16[1];
2366 }
2367 else if (enmEffOpSize == IEMMODE_32BIT)
2368 {
2369 uNewOuterRsp = uPtrFrame.pu32[0];
2370 uNewOuterSs = uPtrFrame.pu16[2];
2371 }
2372 else
2373 {
2374 uNewOuterRsp = uPtrFrame.pu64[0];
2375 uNewOuterSs = uPtrFrame.pu16[4];
2376 }
2377 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2378 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2379 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2380 { /* extremely likely */ }
2381 else
2382 return rcStrict;
2383
2384 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2385 and read the selector. */
2386 IEMSELDESC DescSs;
2387 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2388 {
2389 if ( !DescCs.Legacy.Gen.u1Long
2390 || (uNewOuterSs & X86_SEL_RPL) == 3)
2391 {
2392 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2393 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2394 return iemRaiseGeneralProtectionFault0(pVCpu);
2395 }
2396 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2397 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2398 }
2399 else
2400 {
2401 /* Fetch the descriptor for the new stack segment. */
2402 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2403 if (rcStrict != VINF_SUCCESS)
2404 return rcStrict;
2405 }
2406
2407 /* Check that RPL of stack and code selectors match. */
2408 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2409 {
2410 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2411 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2412 }
2413
2414 /* Must be a writable data segment. */
2415 if ( !DescSs.Legacy.Gen.u1DescType
2416 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2417 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2418 {
2419 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2420 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2421 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2422 }
2423
2424 /* L vs D. (Not mentioned by intel.) */
2425 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2426 && DescSs.Legacy.Gen.u1DefBig
2427 && IEM_IS_LONG_MODE(pVCpu))
2428 {
2429 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2430 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2431 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2432 }
2433
2434 /* DPL/RPL/CPL checks. */
2435 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2436 {
2437 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2438 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2439 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2440 }
2441
2442 /* Is it there? */
2443 if (!DescSs.Legacy.Gen.u1Present)
2444 {
2445 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2446 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2447 }
2448
2449 /* Calc SS limit.*/
2450 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2451
2452 /* Is RIP canonical or within CS.limit? */
2453 uint64_t u64Base;
2454 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2455
2456 /** @todo Testcase: Is this correct? */
2457 if ( DescCs.Legacy.Gen.u1Long
2458 && IEM_IS_LONG_MODE(pVCpu) )
2459 {
2460 if (!IEM_IS_CANONICAL(uNewRip))
2461 {
2462 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2463 return iemRaiseNotCanonical(pVCpu);
2464 }
2465 u64Base = 0;
2466 }
2467 else
2468 {
2469 if (uNewRip > cbLimitCs)
2470 {
2471 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2472 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2473 /** @todo Intel says this is \#GP(0)! */
2474 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2475 }
2476 u64Base = X86DESC_BASE(&DescCs.Legacy);
2477 }
2478
2479 /*
2480 * Now set the accessed bit before
2481 * writing the return address to the stack and committing the result into
2482 * CS, CSHID and RIP.
2483 */
2484 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2485 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2486 {
2487 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2488 if (rcStrict != VINF_SUCCESS)
2489 return rcStrict;
2490 /** @todo check what VT-x and AMD-V does. */
2491 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2492 }
2493 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2494 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2495 {
2496 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2497 if (rcStrict != VINF_SUCCESS)
2498 return rcStrict;
2499 /** @todo check what VT-x and AMD-V does. */
2500 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2501 }
2502
2503 /* commit */
2504 if (enmEffOpSize == IEMMODE_16BIT)
2505 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2506 else
2507 pVCpu->cpum.GstCtx.rip = uNewRip;
2508 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2509 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2510 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2511 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2512 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2513 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2514 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2515 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2516 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2517 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2518 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2519 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2520 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2521 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2522 else
2523 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2524 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2525 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewOuterRsp;
2526 else
2527 pVCpu->cpum.GstCtx.rsp = uNewOuterRsp;
2528
2529 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2530 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2531 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2532 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2533 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2534
2535 /** @todo check if the hidden bits are loaded correctly for 64-bit
2536 * mode. */
2537
2538 if (cbPop)
2539 iemRegAddToRsp(pVCpu, cbPop);
2540 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2541
2542 /* Done! */
2543 }
2544 /*
2545 * Return to the same privilege level
2546 */
2547 else
2548 {
2549 /* Limit / canonical check. */
2550 uint64_t u64Base;
2551 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2552
2553 /** @todo Testcase: Is this correct? */
2554 if ( DescCs.Legacy.Gen.u1Long
2555 && IEM_IS_LONG_MODE(pVCpu) )
2556 {
2557 if (!IEM_IS_CANONICAL(uNewRip))
2558 {
2559 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2560 return iemRaiseNotCanonical(pVCpu);
2561 }
2562 u64Base = 0;
2563 }
2564 else
2565 {
2566 if (uNewRip > cbLimitCs)
2567 {
2568 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2569 /** @todo Intel says this is \#GP(0)! */
2570 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2571 }
2572 u64Base = X86DESC_BASE(&DescCs.Legacy);
2573 }
2574
2575 /*
2576 * Now set the accessed bit before
2577 * writing the return address to the stack and committing the result into
2578 * CS, CSHID and RIP.
2579 */
2580 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2581 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2582 {
2583 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2584 if (rcStrict != VINF_SUCCESS)
2585 return rcStrict;
2586 /** @todo check what VT-x and AMD-V does. */
2587 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2588 }
2589
2590 /* commit */
2591 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2592 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
2593 else
2594 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2595 if (enmEffOpSize == IEMMODE_16BIT)
2596 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2597 else
2598 pVCpu->cpum.GstCtx.rip = uNewRip;
2599 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2600 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2601 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2602 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2603 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2604 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2605 /** @todo check if the hidden bits are loaded correctly for 64-bit
2606 * mode. */
2607 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2608 if (cbPop)
2609 iemRegAddToRsp(pVCpu, cbPop);
2610 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2611 }
2612
2613 /* Flush the prefetch buffer. */
2614#ifdef IEM_WITH_CODE_TLB
2615 pVCpu->iem.s.pbInstrBuf = NULL;
2616#else
2617 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2618#endif
2619 return VINF_SUCCESS;
2620}
2621
2622
2623/**
2624 * Implements retn.
2625 *
2626 * We're doing this in C because of the \#GP that might be raised if the popped
2627 * program counter is out of bounds.
2628 *
2629 * @param enmEffOpSize The effective operand size.
2630 * @param cbPop The amount of arguments to pop from the stack
2631 * (bytes).
2632 */
2633IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2634{
2635 NOREF(cbInstr);
2636
2637 /* Fetch the RSP from the stack. */
2638 VBOXSTRICTRC rcStrict;
2639 RTUINT64U NewRip;
2640 RTUINT64U NewRsp;
2641 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2642
2643 switch (enmEffOpSize)
2644 {
2645 case IEMMODE_16BIT:
2646 NewRip.u = 0;
2647 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2648 break;
2649 case IEMMODE_32BIT:
2650 NewRip.u = 0;
2651 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2652 break;
2653 case IEMMODE_64BIT:
2654 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2655 break;
2656 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2657 }
2658 if (rcStrict != VINF_SUCCESS)
2659 return rcStrict;
2660
2661 /* Check the new RSP before loading it. */
2662 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2663 * of it. The canonical test is performed here and for call. */
2664 if (enmEffOpSize != IEMMODE_64BIT)
2665 {
2666 if (NewRip.DWords.dw0 > pVCpu->cpum.GstCtx.cs.u32Limit)
2667 {
2668 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2669 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2670 }
2671 }
2672 else
2673 {
2674 if (!IEM_IS_CANONICAL(NewRip.u))
2675 {
2676 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2677 return iemRaiseNotCanonical(pVCpu);
2678 }
2679 }
2680
2681 /* Apply cbPop */
2682 if (cbPop)
2683 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2684
2685 /* Commit it. */
2686 pVCpu->cpum.GstCtx.rip = NewRip.u;
2687 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2688 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2689
2690 /* Flush the prefetch buffer. */
2691#ifndef IEM_WITH_CODE_TLB
2692 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2693#endif
2694
2695 return VINF_SUCCESS;
2696}
2697
2698
2699/**
2700 * Implements enter.
2701 *
2702 * We're doing this in C because the instruction is insane, even for the
2703 * u8NestingLevel=0 case dealing with the stack is tedious.
2704 *
2705 * @param enmEffOpSize The effective operand size.
2706 * @param cbFrame Frame size.
2707 * @param cParameters Frame parameter count.
2708 */
2709IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2710{
2711 /* Push RBP, saving the old value in TmpRbp. */
2712 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2713 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2714 RTUINT64U NewRbp;
2715 VBOXSTRICTRC rcStrict;
2716 if (enmEffOpSize == IEMMODE_64BIT)
2717 {
2718 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2719 NewRbp = NewRsp;
2720 }
2721 else if (enmEffOpSize == IEMMODE_32BIT)
2722 {
2723 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2724 NewRbp = NewRsp;
2725 }
2726 else
2727 {
2728 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2729 NewRbp = TmpRbp;
2730 NewRbp.Words.w0 = NewRsp.Words.w0;
2731 }
2732 if (rcStrict != VINF_SUCCESS)
2733 return rcStrict;
2734
2735 /* Copy the parameters (aka nesting levels by Intel). */
2736 cParameters &= 0x1f;
2737 if (cParameters > 0)
2738 {
2739 switch (enmEffOpSize)
2740 {
2741 case IEMMODE_16BIT:
2742 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2743 TmpRbp.DWords.dw0 -= 2;
2744 else
2745 TmpRbp.Words.w0 -= 2;
2746 do
2747 {
2748 uint16_t u16Tmp;
2749 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2750 if (rcStrict != VINF_SUCCESS)
2751 break;
2752 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2753 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2754 break;
2755
2756 case IEMMODE_32BIT:
2757 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2758 TmpRbp.DWords.dw0 -= 4;
2759 else
2760 TmpRbp.Words.w0 -= 4;
2761 do
2762 {
2763 uint32_t u32Tmp;
2764 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2765 if (rcStrict != VINF_SUCCESS)
2766 break;
2767 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2768 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2769 break;
2770
2771 case IEMMODE_64BIT:
2772 TmpRbp.u -= 8;
2773 do
2774 {
2775 uint64_t u64Tmp;
2776 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2777 if (rcStrict != VINF_SUCCESS)
2778 break;
2779 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2780 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2781 break;
2782
2783 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2784 }
2785 if (rcStrict != VINF_SUCCESS)
2786 return VINF_SUCCESS;
2787
2788 /* Push the new RBP */
2789 if (enmEffOpSize == IEMMODE_64BIT)
2790 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2791 else if (enmEffOpSize == IEMMODE_32BIT)
2792 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2793 else
2794 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2795 if (rcStrict != VINF_SUCCESS)
2796 return rcStrict;
2797
2798 }
2799
2800 /* Recalc RSP. */
2801 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2802
2803 /** @todo Should probe write access at the new RSP according to AMD. */
2804 /** @todo Should handle accesses to the VMX APIC-access page. */
2805
2806 /* Commit it. */
2807 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2808 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2809 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2810
2811 return VINF_SUCCESS;
2812}
2813
2814
2815
2816/**
2817 * Implements leave.
2818 *
2819 * We're doing this in C because messing with the stack registers is annoying
2820 * since they depends on SS attributes.
2821 *
2822 * @param enmEffOpSize The effective operand size.
2823 */
2824IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2825{
2826 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2827 RTUINT64U NewRsp;
2828 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2829 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2830 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2831 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2832 else
2833 {
2834 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2835 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2836 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2837 }
2838
2839 /* Pop RBP according to the operand size. */
2840 VBOXSTRICTRC rcStrict;
2841 RTUINT64U NewRbp;
2842 switch (enmEffOpSize)
2843 {
2844 case IEMMODE_16BIT:
2845 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2846 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2847 break;
2848 case IEMMODE_32BIT:
2849 NewRbp.u = 0;
2850 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2851 break;
2852 case IEMMODE_64BIT:
2853 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2854 break;
2855 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2856 }
2857 if (rcStrict != VINF_SUCCESS)
2858 return rcStrict;
2859
2860
2861 /* Commit it. */
2862 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2863 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2864 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2865
2866 return VINF_SUCCESS;
2867}
2868
2869
2870/**
2871 * Implements int3 and int XX.
2872 *
2873 * @param u8Int The interrupt vector number.
2874 * @param enmInt The int instruction type.
2875 */
2876IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2877{
2878 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2879
2880 /*
2881 * We must check if this INT3 might belong to DBGF before raising a #BP.
2882 */
2883 if (u8Int == 3)
2884 {
2885 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2886 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2887 { /* likely: No vbox debugger breakpoints */ }
2888 else
2889 {
2890 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(&pVCpu->cpum.GstCtx));
2891 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2892 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2893 return iemSetPassUpStatus(pVCpu, rcStrict);
2894 }
2895 }
2896 return iemRaiseXcptOrInt(pVCpu,
2897 cbInstr,
2898 u8Int,
2899 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2900 0,
2901 0);
2902}
2903
2904
2905/**
2906 * Implements iret for real mode and V8086 mode.
2907 *
2908 * @param enmEffOpSize The effective operand size.
2909 */
2910IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2911{
2912 X86EFLAGS Efl;
2913 Efl.u = IEMMISC_GET_EFL(pVCpu);
2914 NOREF(cbInstr);
2915
2916 /*
2917 * iret throws an exception if VME isn't enabled.
2918 */
2919 if ( Efl.Bits.u1VM
2920 && Efl.Bits.u2IOPL != 3
2921 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2922 return iemRaiseGeneralProtectionFault0(pVCpu);
2923
2924 /*
2925 * Do the stack bits, but don't commit RSP before everything checks
2926 * out right.
2927 */
2928 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2929 VBOXSTRICTRC rcStrict;
2930 RTCPTRUNION uFrame;
2931 uint16_t uNewCs;
2932 uint32_t uNewEip;
2933 uint32_t uNewFlags;
2934 uint64_t uNewRsp;
2935 if (enmEffOpSize == IEMMODE_32BIT)
2936 {
2937 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
2938 if (rcStrict != VINF_SUCCESS)
2939 return rcStrict;
2940 uNewEip = uFrame.pu32[0];
2941 if (uNewEip > UINT16_MAX)
2942 return iemRaiseGeneralProtectionFault0(pVCpu);
2943
2944 uNewCs = (uint16_t)uFrame.pu32[1];
2945 uNewFlags = uFrame.pu32[2];
2946 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2947 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2948 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2949 | X86_EFL_ID;
2950 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2951 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2952 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2953 }
2954 else
2955 {
2956 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
2957 if (rcStrict != VINF_SUCCESS)
2958 return rcStrict;
2959 uNewEip = uFrame.pu16[0];
2960 uNewCs = uFrame.pu16[1];
2961 uNewFlags = uFrame.pu16[2];
2962 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2963 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2964 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2965 /** @todo The intel pseudo code does not indicate what happens to
2966 * reserved flags. We just ignore them. */
2967 /* Ancient CPU adjustments: See iemCImpl_popf. */
2968 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2969 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2970 }
2971 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2972 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2973 { /* extremely likely */ }
2974 else
2975 return rcStrict;
2976
2977 /** @todo Check how this is supposed to work if sp=0xfffe. */
2978 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2979 uNewCs, uNewEip, uNewFlags, uNewRsp));
2980
2981 /*
2982 * Check the limit of the new EIP.
2983 */
2984 /** @todo Only the AMD pseudo code check the limit here, what's
2985 * right? */
2986 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2987 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2988
2989 /*
2990 * V8086 checks and flag adjustments
2991 */
2992 if (Efl.Bits.u1VM)
2993 {
2994 if (Efl.Bits.u2IOPL == 3)
2995 {
2996 /* Preserve IOPL and clear RF. */
2997 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2998 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2999 }
3000 else if ( enmEffOpSize == IEMMODE_16BIT
3001 && ( !(uNewFlags & X86_EFL_IF)
3002 || !Efl.Bits.u1VIP )
3003 && !(uNewFlags & X86_EFL_TF) )
3004 {
3005 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3006 uNewFlags &= ~X86_EFL_VIF;
3007 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3008 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3009 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3010 }
3011 else
3012 return iemRaiseGeneralProtectionFault0(pVCpu);
3013 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3014 }
3015
3016 /*
3017 * Commit the operation.
3018 */
3019#ifdef DBGFTRACE_ENABLED
3020 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3021 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3022#endif
3023 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3024 pVCpu->cpum.GstCtx.rip = uNewEip;
3025 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3026 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3027 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3028 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3029 /** @todo do we load attribs and limit as well? */
3030 Assert(uNewFlags & X86_EFL_1);
3031 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3032
3033 /* Flush the prefetch buffer. */
3034#ifdef IEM_WITH_CODE_TLB
3035 pVCpu->iem.s.pbInstrBuf = NULL;
3036#else
3037 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3038#endif
3039
3040 return VINF_SUCCESS;
3041}
3042
3043
3044/**
3045 * Loads a segment register when entering V8086 mode.
3046 *
3047 * @param pSReg The segment register.
3048 * @param uSeg The segment to load.
3049 */
3050static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3051{
3052 pSReg->Sel = uSeg;
3053 pSReg->ValidSel = uSeg;
3054 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3055 pSReg->u64Base = (uint32_t)uSeg << 4;
3056 pSReg->u32Limit = 0xffff;
3057 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3058 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3059 * IRET'ing to V8086. */
3060}
3061
3062
3063/**
3064 * Implements iret for protected mode returning to V8086 mode.
3065 *
3066 * @param uNewEip The new EIP.
3067 * @param uNewCs The new CS.
3068 * @param uNewFlags The new EFLAGS.
3069 * @param uNewRsp The RSP after the initial IRET frame.
3070 *
3071 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3072 */
3073IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3074{
3075 RT_NOREF_PV(cbInstr);
3076 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3077
3078 /*
3079 * Pop the V8086 specific frame bits off the stack.
3080 */
3081 VBOXSTRICTRC rcStrict;
3082 RTCPTRUNION uFrame;
3083 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3084 if (rcStrict != VINF_SUCCESS)
3085 return rcStrict;
3086 uint32_t uNewEsp = uFrame.pu32[0];
3087 uint16_t uNewSs = uFrame.pu32[1];
3088 uint16_t uNewEs = uFrame.pu32[2];
3089 uint16_t uNewDs = uFrame.pu32[3];
3090 uint16_t uNewFs = uFrame.pu32[4];
3091 uint16_t uNewGs = uFrame.pu32[5];
3092 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3093 if (rcStrict != VINF_SUCCESS)
3094 return rcStrict;
3095
3096 /*
3097 * Commit the operation.
3098 */
3099 uNewFlags &= X86_EFL_LIVE_MASK;
3100 uNewFlags |= X86_EFL_RA1_MASK;
3101#ifdef DBGFTRACE_ENABLED
3102 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3103 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3104#endif
3105 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3106
3107 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3108 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3109 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3110 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3111 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3112 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3113 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3114 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3115 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3116 pVCpu->iem.s.uCpl = 3;
3117
3118 /* Flush the prefetch buffer. */
3119#ifdef IEM_WITH_CODE_TLB
3120 pVCpu->iem.s.pbInstrBuf = NULL;
3121#else
3122 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3123#endif
3124
3125 return VINF_SUCCESS;
3126}
3127
3128
3129/**
3130 * Implements iret for protected mode returning via a nested task.
3131 *
3132 * @param enmEffOpSize The effective operand size.
3133 */
3134IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3135{
3136 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3137#ifndef IEM_IMPLEMENTS_TASKSWITCH
3138 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3139#else
3140 RT_NOREF_PV(enmEffOpSize);
3141
3142 /*
3143 * Read the segment selector in the link-field of the current TSS.
3144 */
3145 RTSEL uSelRet;
3146 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3147 if (rcStrict != VINF_SUCCESS)
3148 return rcStrict;
3149
3150 /*
3151 * Fetch the returning task's TSS descriptor from the GDT.
3152 */
3153 if (uSelRet & X86_SEL_LDT)
3154 {
3155 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3156 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3157 }
3158
3159 IEMSELDESC TssDesc;
3160 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3161 if (rcStrict != VINF_SUCCESS)
3162 return rcStrict;
3163
3164 if (TssDesc.Legacy.Gate.u1DescType)
3165 {
3166 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3167 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3168 }
3169
3170 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3171 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3172 {
3173 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3174 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3175 }
3176
3177 if (!TssDesc.Legacy.Gate.u1Present)
3178 {
3179 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3180 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3181 }
3182
3183 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3184 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3185 0 /* uCr2 */, uSelRet, &TssDesc);
3186#endif
3187}
3188
3189
3190/**
3191 * Implements iret for protected mode
3192 *
3193 * @param enmEffOpSize The effective operand size.
3194 */
3195IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3196{
3197 NOREF(cbInstr);
3198 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3199
3200 /*
3201 * Nested task return.
3202 */
3203 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3204 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3205
3206 /*
3207 * Normal return.
3208 *
3209 * Do the stack bits, but don't commit RSP before everything checks
3210 * out right.
3211 */
3212 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3213 VBOXSTRICTRC rcStrict;
3214 RTCPTRUNION uFrame;
3215 uint16_t uNewCs;
3216 uint32_t uNewEip;
3217 uint32_t uNewFlags;
3218 uint64_t uNewRsp;
3219 if (enmEffOpSize == IEMMODE_32BIT)
3220 {
3221 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
3222 if (rcStrict != VINF_SUCCESS)
3223 return rcStrict;
3224 uNewEip = uFrame.pu32[0];
3225 uNewCs = (uint16_t)uFrame.pu32[1];
3226 uNewFlags = uFrame.pu32[2];
3227 }
3228 else
3229 {
3230 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3231 if (rcStrict != VINF_SUCCESS)
3232 return rcStrict;
3233 uNewEip = uFrame.pu16[0];
3234 uNewCs = uFrame.pu16[1];
3235 uNewFlags = uFrame.pu16[2];
3236 }
3237 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3238 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3239 { /* extremely likely */ }
3240 else
3241 return rcStrict;
3242 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3243
3244 /*
3245 * We're hopefully not returning to V8086 mode...
3246 */
3247 if ( (uNewFlags & X86_EFL_VM)
3248 && pVCpu->iem.s.uCpl == 0)
3249 {
3250 Assert(enmEffOpSize == IEMMODE_32BIT);
3251 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3252 }
3253
3254 /*
3255 * Protected mode.
3256 */
3257 /* Read the CS descriptor. */
3258 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3259 {
3260 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3261 return iemRaiseGeneralProtectionFault0(pVCpu);
3262 }
3263
3264 IEMSELDESC DescCS;
3265 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3266 if (rcStrict != VINF_SUCCESS)
3267 {
3268 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3269 return rcStrict;
3270 }
3271
3272 /* Must be a code descriptor. */
3273 if (!DescCS.Legacy.Gen.u1DescType)
3274 {
3275 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3276 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3277 }
3278 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3279 {
3280 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3281 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3282 }
3283
3284 /* Privilege checks. */
3285 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3286 {
3287 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3288 {
3289 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3290 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3291 }
3292 }
3293 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3294 {
3295 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3296 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3297 }
3298 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3299 {
3300 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3301 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3302 }
3303
3304 /* Present? */
3305 if (!DescCS.Legacy.Gen.u1Present)
3306 {
3307 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3308 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3309 }
3310
3311 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3312
3313 /*
3314 * Return to outer level?
3315 */
3316 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3317 {
3318 uint16_t uNewSS;
3319 uint32_t uNewESP;
3320 if (enmEffOpSize == IEMMODE_32BIT)
3321 {
3322 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3323 if (rcStrict != VINF_SUCCESS)
3324 return rcStrict;
3325/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3326 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3327 * bit of the popped SS selector it turns out. */
3328 uNewESP = uFrame.pu32[0];
3329 uNewSS = (uint16_t)uFrame.pu32[1];
3330 }
3331 else
3332 {
3333 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3334 if (rcStrict != VINF_SUCCESS)
3335 return rcStrict;
3336 uNewESP = uFrame.pu16[0];
3337 uNewSS = uFrame.pu16[1];
3338 }
3339 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3340 if (rcStrict != VINF_SUCCESS)
3341 return rcStrict;
3342 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3343
3344 /* Read the SS descriptor. */
3345 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3346 {
3347 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3348 return iemRaiseGeneralProtectionFault0(pVCpu);
3349 }
3350
3351 IEMSELDESC DescSS;
3352 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3353 if (rcStrict != VINF_SUCCESS)
3354 {
3355 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3356 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3357 return rcStrict;
3358 }
3359
3360 /* Privilege checks. */
3361 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3362 {
3363 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3364 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3365 }
3366 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3367 {
3368 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3369 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3370 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3371 }
3372
3373 /* Must be a writeable data segment descriptor. */
3374 if (!DescSS.Legacy.Gen.u1DescType)
3375 {
3376 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3377 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3378 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3379 }
3380 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3381 {
3382 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3383 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3384 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3385 }
3386
3387 /* Present? */
3388 if (!DescSS.Legacy.Gen.u1Present)
3389 {
3390 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3391 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3392 }
3393
3394 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3395
3396 /* Check EIP. */
3397 if (uNewEip > cbLimitCS)
3398 {
3399 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3400 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3401 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3402 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3403 }
3404
3405 /*
3406 * Commit the changes, marking CS and SS accessed first since
3407 * that may fail.
3408 */
3409 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3410 {
3411 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3412 if (rcStrict != VINF_SUCCESS)
3413 return rcStrict;
3414 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3415 }
3416 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3417 {
3418 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3419 if (rcStrict != VINF_SUCCESS)
3420 return rcStrict;
3421 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3422 }
3423
3424 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3425 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3426 if (enmEffOpSize != IEMMODE_16BIT)
3427 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3428 if (pVCpu->iem.s.uCpl == 0)
3429 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3430 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3431 fEFlagsMask |= X86_EFL_IF;
3432 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3433 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3434 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3435 fEFlagsNew &= ~fEFlagsMask;
3436 fEFlagsNew |= uNewFlags & fEFlagsMask;
3437#ifdef DBGFTRACE_ENABLED
3438 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3439 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3440 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3441#endif
3442
3443 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3444 pVCpu->cpum.GstCtx.rip = uNewEip;
3445 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3446 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3447 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3448 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3449 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3450 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3451 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3452
3453 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3454 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3455 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3456 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3457 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3458 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3459 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3460 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3461 else
3462 pVCpu->cpum.GstCtx.rsp = uNewESP;
3463
3464 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3465 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3466 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3467 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3468 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3469
3470 /* Done! */
3471
3472 }
3473 /*
3474 * Return to the same level.
3475 */
3476 else
3477 {
3478 /* Check EIP. */
3479 if (uNewEip > cbLimitCS)
3480 {
3481 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3482 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3483 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3484 }
3485
3486 /*
3487 * Commit the changes, marking CS first since it may fail.
3488 */
3489 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3490 {
3491 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3492 if (rcStrict != VINF_SUCCESS)
3493 return rcStrict;
3494 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3495 }
3496
3497 X86EFLAGS NewEfl;
3498 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3499 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3500 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3501 if (enmEffOpSize != IEMMODE_16BIT)
3502 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3503 if (pVCpu->iem.s.uCpl == 0)
3504 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3505 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3506 fEFlagsMask |= X86_EFL_IF;
3507 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3508 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3509 NewEfl.u &= ~fEFlagsMask;
3510 NewEfl.u |= fEFlagsMask & uNewFlags;
3511#ifdef DBGFTRACE_ENABLED
3512 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3513 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3514 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3515#endif
3516
3517 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3518 pVCpu->cpum.GstCtx.rip = uNewEip;
3519 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3520 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3521 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3522 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3523 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3524 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3525 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3526 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3527 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3528 else
3529 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3530 /* Done! */
3531 }
3532
3533 /* Flush the prefetch buffer. */
3534#ifdef IEM_WITH_CODE_TLB
3535 pVCpu->iem.s.pbInstrBuf = NULL;
3536#else
3537 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3538#endif
3539
3540 return VINF_SUCCESS;
3541}
3542
3543
3544/**
3545 * Implements iret for long mode
3546 *
3547 * @param enmEffOpSize The effective operand size.
3548 */
3549IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3550{
3551 NOREF(cbInstr);
3552
3553 /*
3554 * Nested task return is not supported in long mode.
3555 */
3556 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3557 {
3558 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3559 return iemRaiseGeneralProtectionFault0(pVCpu);
3560 }
3561
3562 /*
3563 * Normal return.
3564 *
3565 * Do the stack bits, but don't commit RSP before everything checks
3566 * out right.
3567 */
3568 VBOXSTRICTRC rcStrict;
3569 RTCPTRUNION uFrame;
3570 uint64_t uNewRip;
3571 uint16_t uNewCs;
3572 uint16_t uNewSs;
3573 uint32_t uNewFlags;
3574 uint64_t uNewRsp;
3575 if (enmEffOpSize == IEMMODE_64BIT)
3576 {
3577 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
3578 if (rcStrict != VINF_SUCCESS)
3579 return rcStrict;
3580 uNewRip = uFrame.pu64[0];
3581 uNewCs = (uint16_t)uFrame.pu64[1];
3582 uNewFlags = (uint32_t)uFrame.pu64[2];
3583 uNewRsp = uFrame.pu64[3];
3584 uNewSs = (uint16_t)uFrame.pu64[4];
3585 }
3586 else if (enmEffOpSize == IEMMODE_32BIT)
3587 {
3588 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
3589 if (rcStrict != VINF_SUCCESS)
3590 return rcStrict;
3591 uNewRip = uFrame.pu32[0];
3592 uNewCs = (uint16_t)uFrame.pu32[1];
3593 uNewFlags = uFrame.pu32[2];
3594 uNewRsp = uFrame.pu32[3];
3595 uNewSs = (uint16_t)uFrame.pu32[4];
3596 }
3597 else
3598 {
3599 Assert(enmEffOpSize == IEMMODE_16BIT);
3600 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
3601 if (rcStrict != VINF_SUCCESS)
3602 return rcStrict;
3603 uNewRip = uFrame.pu16[0];
3604 uNewCs = uFrame.pu16[1];
3605 uNewFlags = uFrame.pu16[2];
3606 uNewRsp = uFrame.pu16[3];
3607 uNewSs = uFrame.pu16[4];
3608 }
3609 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3610 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3611 { /* extremely like */ }
3612 else
3613 return rcStrict;
3614 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3615
3616 /*
3617 * Check stuff.
3618 */
3619 /* Read the CS descriptor. */
3620 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3621 {
3622 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3623 return iemRaiseGeneralProtectionFault0(pVCpu);
3624 }
3625
3626 IEMSELDESC DescCS;
3627 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3628 if (rcStrict != VINF_SUCCESS)
3629 {
3630 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3631 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3632 return rcStrict;
3633 }
3634
3635 /* Must be a code descriptor. */
3636 if ( !DescCS.Legacy.Gen.u1DescType
3637 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3638 {
3639 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3640 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3641 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3642 }
3643
3644 /* Privilege checks. */
3645 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3646 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3647 {
3648 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3649 {
3650 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3651 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3652 }
3653 }
3654 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3655 {
3656 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3657 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3658 }
3659 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3660 {
3661 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3662 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3663 }
3664
3665 /* Present? */
3666 if (!DescCS.Legacy.Gen.u1Present)
3667 {
3668 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3669 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3670 }
3671
3672 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3673
3674 /* Read the SS descriptor. */
3675 IEMSELDESC DescSS;
3676 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3677 {
3678 if ( !DescCS.Legacy.Gen.u1Long
3679 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3680 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3681 {
3682 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3683 return iemRaiseGeneralProtectionFault0(pVCpu);
3684 }
3685 DescSS.Legacy.u = 0;
3686 }
3687 else
3688 {
3689 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3690 if (rcStrict != VINF_SUCCESS)
3691 {
3692 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3693 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3694 return rcStrict;
3695 }
3696 }
3697
3698 /* Privilege checks. */
3699 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3700 {
3701 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3702 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3703 }
3704
3705 uint32_t cbLimitSs;
3706 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3707 cbLimitSs = UINT32_MAX;
3708 else
3709 {
3710 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3711 {
3712 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3713 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3714 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3715 }
3716
3717 /* Must be a writeable data segment descriptor. */
3718 if (!DescSS.Legacy.Gen.u1DescType)
3719 {
3720 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3721 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3722 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3723 }
3724 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3725 {
3726 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3727 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3728 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3729 }
3730
3731 /* Present? */
3732 if (!DescSS.Legacy.Gen.u1Present)
3733 {
3734 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3735 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3736 }
3737 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3738 }
3739
3740 /* Check EIP. */
3741 if (DescCS.Legacy.Gen.u1Long)
3742 {
3743 if (!IEM_IS_CANONICAL(uNewRip))
3744 {
3745 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3746 uNewCs, uNewRip, uNewSs, uNewRsp));
3747 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3748 }
3749 }
3750 else
3751 {
3752 if (uNewRip > cbLimitCS)
3753 {
3754 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3755 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3756 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3757 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3758 }
3759 }
3760
3761 /*
3762 * Commit the changes, marking CS and SS accessed first since
3763 * that may fail.
3764 */
3765 /** @todo where exactly are these actually marked accessed by a real CPU? */
3766 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3767 {
3768 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3769 if (rcStrict != VINF_SUCCESS)
3770 return rcStrict;
3771 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3772 }
3773 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3774 {
3775 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3776 if (rcStrict != VINF_SUCCESS)
3777 return rcStrict;
3778 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3779 }
3780
3781 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3782 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3783 if (enmEffOpSize != IEMMODE_16BIT)
3784 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3785 if (pVCpu->iem.s.uCpl == 0)
3786 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3787 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3788 fEFlagsMask |= X86_EFL_IF;
3789 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3790 fEFlagsNew &= ~fEFlagsMask;
3791 fEFlagsNew |= uNewFlags & fEFlagsMask;
3792#ifdef DBGFTRACE_ENABLED
3793 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3794 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3795#endif
3796
3797 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3798 pVCpu->cpum.GstCtx.rip = uNewRip;
3799 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3800 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3801 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3802 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3803 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3804 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3805 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3806 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3807 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3808 else
3809 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3810 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3811 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3812 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3813 {
3814 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3815 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3816 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3817 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3818 Log2(("iretq new SS: NULL\n"));
3819 }
3820 else
3821 {
3822 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3823 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3824 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3825 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3826 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3827 }
3828
3829 if (pVCpu->iem.s.uCpl != uNewCpl)
3830 {
3831 pVCpu->iem.s.uCpl = uNewCpl;
3832 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3833 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3834 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3835 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3836 }
3837
3838 /* Flush the prefetch buffer. */
3839#ifdef IEM_WITH_CODE_TLB
3840 pVCpu->iem.s.pbInstrBuf = NULL;
3841#else
3842 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3843#endif
3844
3845 return VINF_SUCCESS;
3846}
3847
3848
3849/**
3850 * Implements iret.
3851 *
3852 * @param enmEffOpSize The effective operand size.
3853 */
3854IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3855{
3856 bool fBlockingNmi = VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
3857
3858#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3859 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3860 {
3861 /*
3862 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3863 * of this IRET instruction. We need to provide this information as part of some
3864 * VM-exits.
3865 *
3866 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3867 */
3868 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3869 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3870 else
3871 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3872
3873 /*
3874 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3875 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3876 */
3877 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3878 fBlockingNmi = false;
3879
3880 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3881 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3882 }
3883#endif
3884
3885 /*
3886 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3887 * The NMI is still held pending (which I assume means blocking of further NMIs
3888 * is in effect).
3889 *
3890 * See AMD spec. 15.9 "Instruction Intercepts".
3891 * See AMD spec. 15.21.9 "NMI Support".
3892 */
3893 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3894 {
3895 Log(("iret: Guest intercept -> #VMEXIT\n"));
3896 IEM_SVM_UPDATE_NRIP(pVCpu);
3897 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3898 }
3899
3900 /*
3901 * Clear NMI blocking, if any, before causing any further exceptions.
3902 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3903 */
3904 if (fBlockingNmi)
3905 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3906
3907 /*
3908 * Call a mode specific worker.
3909 */
3910 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3911 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3912 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3913 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3914 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3915 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3916}
3917
3918
3919static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3920{
3921 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3922
3923 pHid->Sel = uSel;
3924 pHid->ValidSel = uSel;
3925 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3926}
3927
3928
3929static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3930{
3931 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3932
3933 /* The base is in the first three bytes. */
3934 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3935 /* The attributes are in the fourth byte. */
3936 pHid->Attr.u = pbMem[3];
3937 /* The limit is in the last two bytes. */
3938 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3939}
3940
3941
3942/**
3943 * Implements 286 LOADALL (286 CPUs only).
3944 */
3945IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3946{
3947 NOREF(cbInstr);
3948
3949 /* Data is loaded from a buffer at 800h. No checks are done on the
3950 * validity of loaded state.
3951 *
3952 * LOADALL only loads the internal CPU state, it does not access any
3953 * GDT, LDT, or similar tables.
3954 */
3955
3956 if (pVCpu->iem.s.uCpl != 0)
3957 {
3958 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3959 return iemRaiseGeneralProtectionFault0(pVCpu);
3960 }
3961
3962 uint8_t const *pbMem = NULL;
3963 uint16_t const *pa16Mem;
3964 uint8_t const *pa8Mem;
3965 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3966 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
3967 if (rcStrict != VINF_SUCCESS)
3968 return rcStrict;
3969
3970 /* The MSW is at offset 0x06. */
3971 pa16Mem = (uint16_t const *)(pbMem + 0x06);
3972 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3973 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3974 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3975 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3976
3977 CPUMSetGuestCR0(pVCpu, uNewCr0);
3978 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3979
3980 /* Inform PGM if mode changed. */
3981 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3982 {
3983 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3984 AssertRCReturn(rc, rc);
3985 /* ignore informational status codes */
3986 }
3987 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
3988 false /* fForce */);
3989
3990 /* TR selector is at offset 0x16. */
3991 pa16Mem = (uint16_t const *)(pbMem + 0x16);
3992 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
3993 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
3994 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
3995
3996 /* Followed by FLAGS... */
3997 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
3998 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
3999
4000 /* LDT is at offset 0x1C. */
4001 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
4002 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
4003 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
4004 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4005
4006 /* Segment registers are at offset 0x1E. */
4007 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
4008 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
4009 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
4010 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
4011 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
4012
4013 /* GPRs are at offset 0x26. */
4014 pa16Mem = (uint16_t const *)(pbMem + 0x26);
4015 pVCpu->cpum.GstCtx.di = pa16Mem[0];
4016 pVCpu->cpum.GstCtx.si = pa16Mem[1];
4017 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
4018 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
4019 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
4020 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
4021 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
4022 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
4023
4024 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4025 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4026 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4027 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4028 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4029
4030 /* GDTR contents are at offset 0x4E, 6 bytes. */
4031 RTGCPHYS GCPtrBase;
4032 uint16_t cbLimit;
4033 pa8Mem = pbMem + 0x4E;
4034 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4035 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4036 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4037 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4038
4039 /* IDTR contents are at offset 0x5A, 6 bytes. */
4040 pa8Mem = pbMem + 0x5A;
4041 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4042 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4043 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4044
4045 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4046 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4047 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4048 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4049 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4050 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4051
4052 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4053 if (rcStrict != VINF_SUCCESS)
4054 return rcStrict;
4055
4056 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4057 * descriptor caches" but there is no word as to what happens if those are
4058 * not identical (probably bad things).
4059 */
4060 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4061
4062 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4063
4064 /* Flush the prefetch buffer. */
4065#ifdef IEM_WITH_CODE_TLB
4066 pVCpu->iem.s.pbInstrBuf = NULL;
4067#else
4068 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4069#endif
4070 return rcStrict;
4071}
4072
4073
4074/**
4075 * Implements SYSCALL (AMD and Intel64).
4076 */
4077IEM_CIMPL_DEF_0(iemCImpl_syscall)
4078{
4079 /** @todo hack, LOADALL should be decoded as such on a 286. */
4080 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4081 return iemCImpl_loadall286(pVCpu, cbInstr);
4082
4083 /*
4084 * Check preconditions.
4085 *
4086 * Note that CPUs described in the documentation may load a few odd values
4087 * into CS and SS than we allow here. This has yet to be checked on real
4088 * hardware.
4089 */
4090 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4091 {
4092 Log(("syscall: Not enabled in EFER -> #UD\n"));
4093 return iemRaiseUndefinedOpcode(pVCpu);
4094 }
4095 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4096 {
4097 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4098 return iemRaiseGeneralProtectionFault0(pVCpu);
4099 }
4100 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4101 {
4102 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4103 return iemRaiseUndefinedOpcode(pVCpu);
4104 }
4105
4106 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4107
4108 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4109 /** @todo what about LDT selectors? Shouldn't matter, really. */
4110 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4111 uint16_t uNewSs = uNewCs + 8;
4112 if (uNewCs == 0 || uNewSs == 0)
4113 {
4114 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4115 return iemRaiseGeneralProtectionFault0(pVCpu);
4116 }
4117
4118 /* Long mode and legacy mode differs. */
4119 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4120 {
4121 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4122
4123 /* This test isn't in the docs, but I'm not trusting the guys writing
4124 the MSRs to have validated the values as canonical like they should. */
4125 if (!IEM_IS_CANONICAL(uNewRip))
4126 {
4127 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4128 return iemRaiseUndefinedOpcode(pVCpu);
4129 }
4130
4131 /*
4132 * Commit it.
4133 */
4134 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4135 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4136 pVCpu->cpum.GstCtx.rip = uNewRip;
4137
4138 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4139 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4140 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4141 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4142
4143 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4144 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4145 }
4146 else
4147 {
4148 /*
4149 * Commit it.
4150 */
4151 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
4152 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4153 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4154 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4155 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4156
4157 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4158 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4159 }
4160 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4161 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4162 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4163 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4164 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4165
4166 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4167 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4168 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4169 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4170 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4171
4172 /* Flush the prefetch buffer. */
4173#ifdef IEM_WITH_CODE_TLB
4174 pVCpu->iem.s.pbInstrBuf = NULL;
4175#else
4176 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4177#endif
4178
4179 return VINF_SUCCESS;
4180}
4181
4182
4183/**
4184 * Implements SYSRET (AMD and Intel64).
4185 */
4186IEM_CIMPL_DEF_0(iemCImpl_sysret)
4187
4188{
4189 RT_NOREF_PV(cbInstr);
4190
4191 /*
4192 * Check preconditions.
4193 *
4194 * Note that CPUs described in the documentation may load a few odd values
4195 * into CS and SS than we allow here. This has yet to be checked on real
4196 * hardware.
4197 */
4198 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4199 {
4200 Log(("sysret: Not enabled in EFER -> #UD\n"));
4201 return iemRaiseUndefinedOpcode(pVCpu);
4202 }
4203 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4204 {
4205 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4206 return iemRaiseUndefinedOpcode(pVCpu);
4207 }
4208 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4209 {
4210 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4211 return iemRaiseGeneralProtectionFault0(pVCpu);
4212 }
4213 if (pVCpu->iem.s.uCpl != 0)
4214 {
4215 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4216 return iemRaiseGeneralProtectionFault0(pVCpu);
4217 }
4218
4219 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4220
4221 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4222 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4223 uint16_t uNewSs = uNewCs + 8;
4224 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4225 uNewCs += 16;
4226 if (uNewCs == 0 || uNewSs == 0)
4227 {
4228 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4229 return iemRaiseGeneralProtectionFault0(pVCpu);
4230 }
4231
4232 /*
4233 * Commit it.
4234 */
4235 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4236 {
4237 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4238 {
4239 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4240 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4241 /* Note! We disregard intel manual regarding the RCX cananonical
4242 check, ask intel+xen why AMD doesn't do it. */
4243 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4244 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4245 | (3 << X86DESCATTR_DPL_SHIFT);
4246 }
4247 else
4248 {
4249 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4250 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4251 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4252 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4253 | (3 << X86DESCATTR_DPL_SHIFT);
4254 }
4255 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4256 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4257 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4258 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4259 }
4260 else
4261 {
4262 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4263 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4264 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4265 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4266 | (3 << X86DESCATTR_DPL_SHIFT);
4267 }
4268 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4269 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4270 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4271 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4272 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4273
4274 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4275 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4276 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4277 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4278 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4279 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4280 * on sysret. */
4281
4282 /* Flush the prefetch buffer. */
4283#ifdef IEM_WITH_CODE_TLB
4284 pVCpu->iem.s.pbInstrBuf = NULL;
4285#else
4286 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4287#endif
4288
4289 return VINF_SUCCESS;
4290}
4291
4292
4293/**
4294 * Implements SYSENTER (Intel, 32-bit AMD).
4295 */
4296IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4297{
4298 RT_NOREF(cbInstr);
4299
4300 /*
4301 * Check preconditions.
4302 *
4303 * Note that CPUs described in the documentation may load a few odd values
4304 * into CS and SS than we allow here. This has yet to be checked on real
4305 * hardware.
4306 */
4307 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4308 {
4309 Log(("sysenter: not supported -=> #UD\n"));
4310 return iemRaiseUndefinedOpcode(pVCpu);
4311 }
4312 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4313 {
4314 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4315 return iemRaiseGeneralProtectionFault0(pVCpu);
4316 }
4317 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4318 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && !fIsLongMode)
4319 {
4320 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4321 return iemRaiseUndefinedOpcode(pVCpu);
4322 }
4323 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4324 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4325 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4326 {
4327 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4328 return iemRaiseGeneralProtectionFault0(pVCpu);
4329 }
4330
4331 /* This test isn't in the docs, it's just a safeguard against missing
4332 canonical checks when writing the registers. */
4333 if (RT_LIKELY( !fIsLongMode
4334 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4335 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4336 { /* likely */ }
4337 else
4338 {
4339 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4340 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4341 return iemRaiseUndefinedOpcode(pVCpu);
4342 }
4343
4344/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4345
4346 /*
4347 * Update registers and commit.
4348 */
4349 if (fIsLongMode)
4350 {
4351 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4352 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4353 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4354 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4355 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4356 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4357 }
4358 else
4359 {
4360 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, (uint32_t)pVCpu->cpum.GstCtx.rip,
4361 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4362 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4363 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4364 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4365 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4366 }
4367 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4368 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4369 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4370 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4371 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4372
4373 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4374 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4375 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4376 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4377 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4378 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4379 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4380
4381 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4382 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4383 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4384
4385 pVCpu->iem.s.uCpl = 0;
4386
4387 /* Flush the prefetch buffer. */
4388#ifdef IEM_WITH_CODE_TLB
4389 pVCpu->iem.s.pbInstrBuf = NULL;
4390#else
4391 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4392#endif
4393
4394 return VINF_SUCCESS;
4395}
4396
4397
4398/**
4399 * Implements SYSEXIT (Intel, 32-bit AMD).
4400 *
4401 * @param enmEffOpSize The effective operand size.
4402 */
4403IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4404{
4405 RT_NOREF(cbInstr);
4406
4407 /*
4408 * Check preconditions.
4409 *
4410 * Note that CPUs described in the documentation may load a few odd values
4411 * into CS and SS than we allow here. This has yet to be checked on real
4412 * hardware.
4413 */
4414 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4415 {
4416 Log(("sysexit: not supported -=> #UD\n"));
4417 return iemRaiseUndefinedOpcode(pVCpu);
4418 }
4419 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4420 {
4421 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4422 return iemRaiseGeneralProtectionFault0(pVCpu);
4423 }
4424 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4425 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && !fIsLongMode)
4426 {
4427 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4428 return iemRaiseUndefinedOpcode(pVCpu);
4429 }
4430 if (pVCpu->iem.s.uCpl != 0)
4431 {
4432 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", pVCpu->iem.s.uCpl));
4433 return iemRaiseGeneralProtectionFault0(pVCpu);
4434 }
4435 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4436 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4437 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4438 {
4439 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4440 return iemRaiseGeneralProtectionFault0(pVCpu);
4441 }
4442
4443 /*
4444 * Update registers and commit.
4445 */
4446 if (enmEffOpSize == IEMMODE_64BIT)
4447 {
4448 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4449 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4450 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4451 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4452 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4453 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4454 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4455 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4456 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4457 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4458 }
4459 else
4460 {
4461 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4462 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4463 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4464 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4465 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4466 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4467 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4468 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4469 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4470 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4471 }
4472 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4473 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4474 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4475
4476 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4477 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4478 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4479 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4480 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4481 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4482
4483 pVCpu->iem.s.uCpl = 3;
4484
4485 /* Flush the prefetch buffer. */
4486#ifdef IEM_WITH_CODE_TLB
4487 pVCpu->iem.s.pbInstrBuf = NULL;
4488#else
4489 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4490#endif
4491
4492 return VINF_SUCCESS;
4493}
4494
4495
4496/**
4497 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4498 *
4499 * @param iSegReg The segment register number (valid).
4500 * @param uSel The new selector value.
4501 */
4502IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4503{
4504 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4505 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4506 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4507
4508 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4509
4510 /*
4511 * Real mode and V8086 mode are easy.
4512 */
4513 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4514 {
4515 *pSel = uSel;
4516 pHid->u64Base = (uint32_t)uSel << 4;
4517 pHid->ValidSel = uSel;
4518 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4519#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4520 /** @todo Does the CPU actually load limits and attributes in the
4521 * real/V8086 mode segment load case? It doesn't for CS in far
4522 * jumps... Affects unreal mode. */
4523 pHid->u32Limit = 0xffff;
4524 pHid->Attr.u = 0;
4525 pHid->Attr.n.u1Present = 1;
4526 pHid->Attr.n.u1DescType = 1;
4527 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4528 ? X86_SEL_TYPE_RW
4529 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4530#endif
4531 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4532 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4533 return VINF_SUCCESS;
4534 }
4535
4536 /*
4537 * Protected mode.
4538 *
4539 * Check if it's a null segment selector value first, that's OK for DS, ES,
4540 * FS and GS. If not null, then we have to load and parse the descriptor.
4541 */
4542 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4543 {
4544 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4545 if (iSegReg == X86_SREG_SS)
4546 {
4547 /* In 64-bit kernel mode, the stack can be 0 because of the way
4548 interrupts are dispatched. AMD seems to have a slighly more
4549 relaxed relationship to SS.RPL than intel does. */
4550 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4551 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4552 || pVCpu->iem.s.uCpl > 2
4553 || ( uSel != pVCpu->iem.s.uCpl
4554 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4555 {
4556 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4557 return iemRaiseGeneralProtectionFault0(pVCpu);
4558 }
4559 }
4560
4561 *pSel = uSel; /* Not RPL, remember :-) */
4562 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4563 if (iSegReg == X86_SREG_SS)
4564 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4565
4566 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4567 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4568
4569 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4570 return VINF_SUCCESS;
4571 }
4572
4573 /* Fetch the descriptor. */
4574 IEMSELDESC Desc;
4575 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4576 if (rcStrict != VINF_SUCCESS)
4577 return rcStrict;
4578
4579 /* Check GPs first. */
4580 if (!Desc.Legacy.Gen.u1DescType)
4581 {
4582 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4583 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4584 }
4585 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4586 {
4587 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4588 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4589 {
4590 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4591 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4592 }
4593 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4594 {
4595 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4596 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4597 }
4598 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4599 {
4600 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4601 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4602 }
4603 }
4604 else
4605 {
4606 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4607 {
4608 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4609 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4610 }
4611 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4612 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4613 {
4614#if 0 /* this is what intel says. */
4615 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4616 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4617 {
4618 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4619 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4620 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4621 }
4622#else /* this is what makes more sense. */
4623 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4624 {
4625 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4626 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4627 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4628 }
4629 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4630 {
4631 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4632 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4633 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4634 }
4635#endif
4636 }
4637 }
4638
4639 /* Is it there? */
4640 if (!Desc.Legacy.Gen.u1Present)
4641 {
4642 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4643 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4644 }
4645
4646 /* The base and limit. */
4647 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4648 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4649
4650 /*
4651 * Ok, everything checked out fine. Now set the accessed bit before
4652 * committing the result into the registers.
4653 */
4654 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4655 {
4656 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4657 if (rcStrict != VINF_SUCCESS)
4658 return rcStrict;
4659 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4660 }
4661
4662 /* commit */
4663 *pSel = uSel;
4664 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4665 pHid->u32Limit = cbLimit;
4666 pHid->u64Base = u64Base;
4667 pHid->ValidSel = uSel;
4668 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4669
4670 /** @todo check if the hidden bits are loaded correctly for 64-bit
4671 * mode. */
4672 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4673
4674 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4675 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4676 return VINF_SUCCESS;
4677}
4678
4679
4680/**
4681 * Implements 'mov SReg, r/m'.
4682 *
4683 * @param iSegReg The segment register number (valid).
4684 * @param uSel The new selector value.
4685 */
4686IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4687{
4688 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4689 if (rcStrict == VINF_SUCCESS)
4690 {
4691 if (iSegReg == X86_SREG_SS)
4692 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4693 }
4694 return rcStrict;
4695}
4696
4697
4698/**
4699 * Implements 'pop SReg'.
4700 *
4701 * @param iSegReg The segment register number (valid).
4702 * @param enmEffOpSize The efficient operand size (valid).
4703 */
4704IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4705{
4706 VBOXSTRICTRC rcStrict;
4707
4708 /*
4709 * Read the selector off the stack and join paths with mov ss, reg.
4710 */
4711 RTUINT64U TmpRsp;
4712 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4713 switch (enmEffOpSize)
4714 {
4715 case IEMMODE_16BIT:
4716 {
4717 uint16_t uSel;
4718 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4719 if (rcStrict == VINF_SUCCESS)
4720 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4721 break;
4722 }
4723
4724 case IEMMODE_32BIT:
4725 {
4726 uint32_t u32Value;
4727 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4728 if (rcStrict == VINF_SUCCESS)
4729 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4730 break;
4731 }
4732
4733 case IEMMODE_64BIT:
4734 {
4735 uint64_t u64Value;
4736 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4737 if (rcStrict == VINF_SUCCESS)
4738 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4739 break;
4740 }
4741 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4742 }
4743
4744 /*
4745 * Commit the stack on success.
4746 */
4747 if (rcStrict == VINF_SUCCESS)
4748 {
4749 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4750 if (iSegReg == X86_SREG_SS)
4751 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4752 }
4753 return rcStrict;
4754}
4755
4756
4757/**
4758 * Implements lgs, lfs, les, lds & lss.
4759 */
4760IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
4761{
4762 /*
4763 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4764 */
4765 /** @todo verify and test that mov, pop and lXs works the segment
4766 * register loading in the exact same way. */
4767 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4768 if (rcStrict == VINF_SUCCESS)
4769 {
4770 switch (enmEffOpSize)
4771 {
4772 case IEMMODE_16BIT:
4773 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4774 break;
4775 case IEMMODE_32BIT:
4776 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4777 break;
4778 case IEMMODE_64BIT:
4779 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4780 break;
4781 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4782 }
4783 }
4784
4785 return rcStrict;
4786}
4787
4788
4789/**
4790 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4791 *
4792 * @retval VINF_SUCCESS on success.
4793 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4794 * @retval iemMemFetchSysU64 return value.
4795 *
4796 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4797 * @param uSel The selector value.
4798 * @param fAllowSysDesc Whether system descriptors are OK or not.
4799 * @param pDesc Where to return the descriptor on success.
4800 */
4801static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4802{
4803 pDesc->Long.au64[0] = 0;
4804 pDesc->Long.au64[1] = 0;
4805
4806 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4807 return VINF_IEM_SELECTOR_NOT_OK;
4808
4809 /* Within the table limits? */
4810 RTGCPTR GCPtrBase;
4811 if (uSel & X86_SEL_LDT)
4812 {
4813 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4814 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4815 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4816 return VINF_IEM_SELECTOR_NOT_OK;
4817 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4818 }
4819 else
4820 {
4821 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4822 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4823 return VINF_IEM_SELECTOR_NOT_OK;
4824 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4825 }
4826
4827 /* Fetch the descriptor. */
4828 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4829 if (rcStrict != VINF_SUCCESS)
4830 return rcStrict;
4831 if (!pDesc->Legacy.Gen.u1DescType)
4832 {
4833 if (!fAllowSysDesc)
4834 return VINF_IEM_SELECTOR_NOT_OK;
4835 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4836 {
4837 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4838 if (rcStrict != VINF_SUCCESS)
4839 return rcStrict;
4840 }
4841
4842 }
4843
4844 return VINF_SUCCESS;
4845}
4846
4847
4848/**
4849 * Implements verr (fWrite = false) and verw (fWrite = true).
4850 */
4851IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4852{
4853 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4854
4855 /** @todo figure whether the accessed bit is set or not. */
4856
4857 bool fAccessible = true;
4858 IEMSELDESC Desc;
4859 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4860 if (rcStrict == VINF_SUCCESS)
4861 {
4862 /* Check the descriptor, order doesn't matter much here. */
4863 if ( !Desc.Legacy.Gen.u1DescType
4864 || !Desc.Legacy.Gen.u1Present)
4865 fAccessible = false;
4866 else
4867 {
4868 if ( fWrite
4869 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4870 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4871 fAccessible = false;
4872
4873 /** @todo testcase for the conforming behavior. */
4874 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4875 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4876 {
4877 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4878 fAccessible = false;
4879 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4880 fAccessible = false;
4881 }
4882 }
4883
4884 }
4885 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4886 fAccessible = false;
4887 else
4888 return rcStrict;
4889
4890 /* commit */
4891 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4892
4893 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4894 return VINF_SUCCESS;
4895}
4896
4897
4898/**
4899 * Implements LAR and LSL with 64-bit operand size.
4900 *
4901 * @returns VINF_SUCCESS.
4902 * @param pu64Dst Pointer to the destination register.
4903 * @param uSel The selector to load details for.
4904 * @param fIsLar true = LAR, false = LSL.
4905 */
4906IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4907{
4908 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4909
4910 /** @todo figure whether the accessed bit is set or not. */
4911
4912 bool fDescOk = true;
4913 IEMSELDESC Desc;
4914 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4915 if (rcStrict == VINF_SUCCESS)
4916 {
4917 /*
4918 * Check the descriptor type.
4919 */
4920 if (!Desc.Legacy.Gen.u1DescType)
4921 {
4922 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4923 {
4924 if (Desc.Long.Gen.u5Zeros)
4925 fDescOk = false;
4926 else
4927 switch (Desc.Long.Gen.u4Type)
4928 {
4929 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4930 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4931 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4932 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4933 break;
4934 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4935 fDescOk = fIsLar;
4936 break;
4937 default:
4938 fDescOk = false;
4939 break;
4940 }
4941 }
4942 else
4943 {
4944 switch (Desc.Long.Gen.u4Type)
4945 {
4946 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4947 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4948 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4949 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4950 case X86_SEL_TYPE_SYS_LDT:
4951 break;
4952 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4953 case X86_SEL_TYPE_SYS_TASK_GATE:
4954 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4955 fDescOk = fIsLar;
4956 break;
4957 default:
4958 fDescOk = false;
4959 break;
4960 }
4961 }
4962 }
4963 if (fDescOk)
4964 {
4965 /*
4966 * Check the RPL/DPL/CPL interaction..
4967 */
4968 /** @todo testcase for the conforming behavior. */
4969 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4970 || !Desc.Legacy.Gen.u1DescType)
4971 {
4972 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4973 fDescOk = false;
4974 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4975 fDescOk = false;
4976 }
4977 }
4978
4979 if (fDescOk)
4980 {
4981 /*
4982 * All fine, start committing the result.
4983 */
4984 if (fIsLar)
4985 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4986 else
4987 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4988 }
4989
4990 }
4991 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4992 fDescOk = false;
4993 else
4994 return rcStrict;
4995
4996 /* commit flags value and advance rip. */
4997 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
4998 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4999
5000 return VINF_SUCCESS;
5001}
5002
5003
5004/**
5005 * Implements LAR and LSL with 16-bit operand size.
5006 *
5007 * @returns VINF_SUCCESS.
5008 * @param pu16Dst Pointer to the destination register.
5009 * @param uSel The selector to load details for.
5010 * @param fIsLar true = LAR, false = LSL.
5011 */
5012IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5013{
5014 uint64_t u64TmpDst = *pu16Dst;
5015 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5016 *pu16Dst = u64TmpDst;
5017 return VINF_SUCCESS;
5018}
5019
5020
5021/**
5022 * Implements lgdt.
5023 *
5024 * @param iEffSeg The segment of the new gdtr contents
5025 * @param GCPtrEffSrc The address of the new gdtr contents.
5026 * @param enmEffOpSize The effective operand size.
5027 */
5028IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5029{
5030 if (pVCpu->iem.s.uCpl != 0)
5031 return iemRaiseGeneralProtectionFault0(pVCpu);
5032 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5033
5034 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5035 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5036 {
5037 Log(("lgdt: Guest intercept -> VM-exit\n"));
5038 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5039 }
5040
5041 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5042 {
5043 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5044 IEM_SVM_UPDATE_NRIP(pVCpu);
5045 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5046 }
5047
5048 /*
5049 * Fetch the limit and base address.
5050 */
5051 uint16_t cbLimit;
5052 RTGCPTR GCPtrBase;
5053 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5054 if (rcStrict == VINF_SUCCESS)
5055 {
5056 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5057 || X86_IS_CANONICAL(GCPtrBase))
5058 {
5059 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5060 if (rcStrict == VINF_SUCCESS)
5061 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5062 }
5063 else
5064 {
5065 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5066 return iemRaiseGeneralProtectionFault0(pVCpu);
5067 }
5068 }
5069 return rcStrict;
5070}
5071
5072
5073/**
5074 * Implements sgdt.
5075 *
5076 * @param iEffSeg The segment where to store the gdtr content.
5077 * @param GCPtrEffDst The address where to store the gdtr content.
5078 */
5079IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5080{
5081 /*
5082 * Join paths with sidt.
5083 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5084 * you really must know.
5085 */
5086 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5087 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5088 {
5089 Log(("sgdt: Guest intercept -> VM-exit\n"));
5090 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5091 }
5092
5093 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5094 {
5095 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5096 IEM_SVM_UPDATE_NRIP(pVCpu);
5097 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5098 }
5099
5100 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5101 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5102 if (rcStrict == VINF_SUCCESS)
5103 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5104 return rcStrict;
5105}
5106
5107
5108/**
5109 * Implements lidt.
5110 *
5111 * @param iEffSeg The segment of the new idtr contents
5112 * @param GCPtrEffSrc The address of the new idtr contents.
5113 * @param enmEffOpSize The effective operand size.
5114 */
5115IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5116{
5117 if (pVCpu->iem.s.uCpl != 0)
5118 return iemRaiseGeneralProtectionFault0(pVCpu);
5119 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5120
5121 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5122 {
5123 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5124 IEM_SVM_UPDATE_NRIP(pVCpu);
5125 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5126 }
5127
5128 /*
5129 * Fetch the limit and base address.
5130 */
5131 uint16_t cbLimit;
5132 RTGCPTR GCPtrBase;
5133 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5134 if (rcStrict == VINF_SUCCESS)
5135 {
5136 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5137 || X86_IS_CANONICAL(GCPtrBase))
5138 {
5139 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5140 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5141 }
5142 else
5143 {
5144 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5145 return iemRaiseGeneralProtectionFault0(pVCpu);
5146 }
5147 }
5148 return rcStrict;
5149}
5150
5151
5152/**
5153 * Implements sidt.
5154 *
5155 * @param iEffSeg The segment where to store the idtr content.
5156 * @param GCPtrEffDst The address where to store the idtr content.
5157 */
5158IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5159{
5160 /*
5161 * Join paths with sgdt.
5162 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5163 * you really must know.
5164 */
5165 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5166 {
5167 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5168 IEM_SVM_UPDATE_NRIP(pVCpu);
5169 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5170 }
5171
5172 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5173 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5174 if (rcStrict == VINF_SUCCESS)
5175 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5176 return rcStrict;
5177}
5178
5179
5180/**
5181 * Implements lldt.
5182 *
5183 * @param uNewLdt The new LDT selector value.
5184 */
5185IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5186{
5187 /*
5188 * Check preconditions.
5189 */
5190 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5191 {
5192 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5193 return iemRaiseUndefinedOpcode(pVCpu);
5194 }
5195 if (pVCpu->iem.s.uCpl != 0)
5196 {
5197 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
5198 return iemRaiseGeneralProtectionFault0(pVCpu);
5199 }
5200 /* Nested-guest VMX intercept. */
5201 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5202 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5203 {
5204 Log(("lldt: Guest intercept -> VM-exit\n"));
5205 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5206 }
5207 if (uNewLdt & X86_SEL_LDT)
5208 {
5209 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5210 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5211 }
5212
5213 /*
5214 * Now, loading a NULL selector is easy.
5215 */
5216 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5217 {
5218 /* Nested-guest SVM intercept. */
5219 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5220 {
5221 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5222 IEM_SVM_UPDATE_NRIP(pVCpu);
5223 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5224 }
5225
5226 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5227 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5228 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5229 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5230 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5231 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5232 {
5233 /* AMD-V seems to leave the base and limit alone. */
5234 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5235 }
5236 else
5237 {
5238 /* VT-x (Intel 3960x) seems to be doing the following. */
5239 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5240 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5241 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5242 }
5243
5244 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5245 return VINF_SUCCESS;
5246 }
5247
5248 /*
5249 * Read the descriptor.
5250 */
5251 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5252 IEMSELDESC Desc;
5253 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5254 if (rcStrict != VINF_SUCCESS)
5255 return rcStrict;
5256
5257 /* Check GPs first. */
5258 if (Desc.Legacy.Gen.u1DescType)
5259 {
5260 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5261 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5262 }
5263 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5264 {
5265 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5266 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5267 }
5268 uint64_t u64Base;
5269 if (!IEM_IS_LONG_MODE(pVCpu))
5270 u64Base = X86DESC_BASE(&Desc.Legacy);
5271 else
5272 {
5273 if (Desc.Long.Gen.u5Zeros)
5274 {
5275 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5276 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5277 }
5278
5279 u64Base = X86DESC64_BASE(&Desc.Long);
5280 if (!IEM_IS_CANONICAL(u64Base))
5281 {
5282 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5283 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5284 }
5285 }
5286
5287 /* NP */
5288 if (!Desc.Legacy.Gen.u1Present)
5289 {
5290 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5291 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5292 }
5293
5294 /* Nested-guest SVM intercept. */
5295 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5296 {
5297 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5298 IEM_SVM_UPDATE_NRIP(pVCpu);
5299 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5300 }
5301
5302 /*
5303 * It checks out alright, update the registers.
5304 */
5305/** @todo check if the actual value is loaded or if the RPL is dropped */
5306 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5307 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5308 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5309 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5310 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5311 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5312
5313 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5314 return VINF_SUCCESS;
5315}
5316
5317
5318/**
5319 * Implements sldt GReg
5320 *
5321 * @param iGReg The general register to store the CRx value in.
5322 * @param enmEffOpSize The operand size.
5323 */
5324IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5325{
5326 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5327 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5328 {
5329 Log(("sldt: Guest intercept -> VM-exit\n"));
5330 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5331 }
5332
5333 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5334
5335 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5336 switch (enmEffOpSize)
5337 {
5338 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5339 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5340 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5341 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5342 }
5343 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5344 return VINF_SUCCESS;
5345}
5346
5347
5348/**
5349 * Implements sldt mem.
5350 *
5351 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5352 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5353 */
5354IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5355{
5356 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5357
5358 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5359 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5360 if (rcStrict == VINF_SUCCESS)
5361 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5362 return rcStrict;
5363}
5364
5365
5366/**
5367 * Implements ltr.
5368 *
5369 * @param uNewTr The new TSS selector value.
5370 */
5371IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5372{
5373 /*
5374 * Check preconditions.
5375 */
5376 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5377 {
5378 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5379 return iemRaiseUndefinedOpcode(pVCpu);
5380 }
5381 if (pVCpu->iem.s.uCpl != 0)
5382 {
5383 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5384 return iemRaiseGeneralProtectionFault0(pVCpu);
5385 }
5386 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5387 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5388 {
5389 Log(("ltr: Guest intercept -> VM-exit\n"));
5390 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5391 }
5392 if (uNewTr & X86_SEL_LDT)
5393 {
5394 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5395 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5396 }
5397 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5398 {
5399 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5400 return iemRaiseGeneralProtectionFault0(pVCpu);
5401 }
5402 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5403 {
5404 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5405 IEM_SVM_UPDATE_NRIP(pVCpu);
5406 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5407 }
5408
5409 /*
5410 * Read the descriptor.
5411 */
5412 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5413 IEMSELDESC Desc;
5414 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5415 if (rcStrict != VINF_SUCCESS)
5416 return rcStrict;
5417
5418 /* Check GPs first. */
5419 if (Desc.Legacy.Gen.u1DescType)
5420 {
5421 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5422 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5423 }
5424 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5425 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5426 || IEM_IS_LONG_MODE(pVCpu)) )
5427 {
5428 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5429 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5430 }
5431 uint64_t u64Base;
5432 if (!IEM_IS_LONG_MODE(pVCpu))
5433 u64Base = X86DESC_BASE(&Desc.Legacy);
5434 else
5435 {
5436 if (Desc.Long.Gen.u5Zeros)
5437 {
5438 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5439 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5440 }
5441
5442 u64Base = X86DESC64_BASE(&Desc.Long);
5443 if (!IEM_IS_CANONICAL(u64Base))
5444 {
5445 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5446 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5447 }
5448 }
5449
5450 /* NP */
5451 if (!Desc.Legacy.Gen.u1Present)
5452 {
5453 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5454 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5455 }
5456
5457 /*
5458 * Set it busy.
5459 * Note! Intel says this should lock down the whole descriptor, but we'll
5460 * restrict our selves to 32-bit for now due to lack of inline
5461 * assembly and such.
5462 */
5463 void *pvDesc;
5464 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
5465 IEM_ACCESS_DATA_RW, 0);
5466 if (rcStrict != VINF_SUCCESS)
5467 return rcStrict;
5468 switch ((uintptr_t)pvDesc & 3)
5469 {
5470 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5471 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5472 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5473 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5474 }
5475 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5476 if (rcStrict != VINF_SUCCESS)
5477 return rcStrict;
5478 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5479
5480 /*
5481 * It checks out alright, update the registers.
5482 */
5483/** @todo check if the actual value is loaded or if the RPL is dropped */
5484 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5485 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5486 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5487 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5488 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5489 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5490
5491 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5492 return VINF_SUCCESS;
5493}
5494
5495
5496/**
5497 * Implements str GReg
5498 *
5499 * @param iGReg The general register to store the CRx value in.
5500 * @param enmEffOpSize The operand size.
5501 */
5502IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5503{
5504 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5505 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5506 {
5507 Log(("str_reg: Guest intercept -> VM-exit\n"));
5508 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5509 }
5510
5511 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5512
5513 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5514 switch (enmEffOpSize)
5515 {
5516 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5517 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5518 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5519 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5520 }
5521 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5522 return VINF_SUCCESS;
5523}
5524
5525
5526/**
5527 * Implements str mem.
5528 *
5529 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5530 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5531 */
5532IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5533{
5534 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5535 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5536 {
5537 Log(("str_mem: Guest intercept -> VM-exit\n"));
5538 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5539 }
5540
5541 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5542
5543 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5544 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5545 if (rcStrict == VINF_SUCCESS)
5546 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5547 return rcStrict;
5548}
5549
5550
5551/**
5552 * Implements mov GReg,CRx.
5553 *
5554 * @param iGReg The general register to store the CRx value in.
5555 * @param iCrReg The CRx register to read (valid).
5556 */
5557IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5558{
5559 if (pVCpu->iem.s.uCpl != 0)
5560 return iemRaiseGeneralProtectionFault0(pVCpu);
5561 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5562
5563 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5564 {
5565 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5566 IEM_SVM_UPDATE_NRIP(pVCpu);
5567 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5568 }
5569
5570 /* Read it. */
5571 uint64_t crX;
5572 switch (iCrReg)
5573 {
5574 case 0:
5575 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5576 crX = pVCpu->cpum.GstCtx.cr0;
5577 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5578 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5579 break;
5580 case 2:
5581 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5582 crX = pVCpu->cpum.GstCtx.cr2;
5583 break;
5584 case 3:
5585 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5586 crX = pVCpu->cpum.GstCtx.cr3;
5587 break;
5588 case 4:
5589 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5590 crX = pVCpu->cpum.GstCtx.cr4;
5591 break;
5592 case 8:
5593 {
5594 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5595#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5596 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5597 {
5598 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5599 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5600 return rcStrict;
5601
5602 /*
5603 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5604 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5605 * are cleared.
5606 *
5607 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5608 */
5609 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5610 {
5611 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5612 crX = (uTpr >> 4) & 0xf;
5613 break;
5614 }
5615 }
5616#endif
5617#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5618 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5619 {
5620 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5621 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5622 {
5623 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5624 break;
5625 }
5626 }
5627#endif
5628 uint8_t uTpr;
5629 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5630 if (RT_SUCCESS(rc))
5631 crX = uTpr >> 4;
5632 else
5633 crX = 0;
5634 break;
5635 }
5636 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5637 }
5638
5639#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5640 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5641 {
5642 switch (iCrReg)
5643 {
5644 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5645 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5646 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5647
5648 case 3:
5649 {
5650 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5651 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5652 return rcStrict;
5653 break;
5654 }
5655 }
5656 }
5657#endif
5658
5659 /* Store it. */
5660 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5661 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5662 else
5663 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5664
5665 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5666 return VINF_SUCCESS;
5667}
5668
5669
5670/**
5671 * Implements smsw GReg.
5672 *
5673 * @param iGReg The general register to store the CRx value in.
5674 * @param enmEffOpSize The operand size.
5675 */
5676IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5677{
5678 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5679
5680#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5681 uint64_t u64MaskedCr0;
5682 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5683 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5684 else
5685 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5686 uint64_t const u64GuestCr0 = u64MaskedCr0;
5687#else
5688 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5689#endif
5690
5691 switch (enmEffOpSize)
5692 {
5693 case IEMMODE_16BIT:
5694 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5695 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5696 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5697 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5698 else
5699 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5700 break;
5701
5702 case IEMMODE_32BIT:
5703 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5704 break;
5705
5706 case IEMMODE_64BIT:
5707 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5708 break;
5709
5710 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5711 }
5712
5713 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5714 return VINF_SUCCESS;
5715}
5716
5717
5718/**
5719 * Implements smsw mem.
5720 *
5721 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5722 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5723 */
5724IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5725{
5726 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5727
5728#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5729 uint64_t u64MaskedCr0;
5730 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5731 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5732 else
5733 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5734 uint64_t const u64GuestCr0 = u64MaskedCr0;
5735#else
5736 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5737#endif
5738
5739 uint16_t u16Value;
5740 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5741 u16Value = (uint16_t)u64GuestCr0;
5742 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5743 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5744 else
5745 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5746
5747 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5748 if (rcStrict == VINF_SUCCESS)
5749 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5750 return rcStrict;
5751}
5752
5753
5754/**
5755 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5756 */
5757#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5758 do \
5759 { \
5760 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5761 if (RT_SUCCESS(rcX)) \
5762 { /* likely */ } \
5763 else \
5764 { \
5765 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5766 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5767 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5768 } \
5769 } while (0)
5770
5771
5772/**
5773 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5774 *
5775 * @param iCrReg The CRx register to write (valid).
5776 * @param uNewCrX The new value.
5777 * @param enmAccessCrX The instruction that caused the CrX load.
5778 * @param iGReg The general register in case of a 'mov CRx,GReg'
5779 * instruction.
5780 */
5781IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5782{
5783 VBOXSTRICTRC rcStrict;
5784 int rc;
5785#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5786 RT_NOREF2(iGReg, enmAccessCrX);
5787#endif
5788
5789 /*
5790 * Try store it.
5791 * Unfortunately, CPUM only does a tiny bit of the work.
5792 */
5793 switch (iCrReg)
5794 {
5795 case 0:
5796 {
5797 /*
5798 * Perform checks.
5799 */
5800 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5801
5802 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5803 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5804
5805 /* ET is hardcoded on 486 and later. */
5806 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5807 uNewCrX |= X86_CR0_ET;
5808 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5809 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5810 {
5811 uNewCrX &= fValid;
5812 uNewCrX |= X86_CR0_ET;
5813 }
5814 else
5815 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5816
5817 /* Check for reserved bits. */
5818 if (uNewCrX & ~(uint64_t)fValid)
5819 {
5820 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5821 return iemRaiseGeneralProtectionFault0(pVCpu);
5822 }
5823
5824 /* Check for invalid combinations. */
5825 if ( (uNewCrX & X86_CR0_PG)
5826 && !(uNewCrX & X86_CR0_PE) )
5827 {
5828 Log(("Trying to set CR0.PG without CR0.PE\n"));
5829 return iemRaiseGeneralProtectionFault0(pVCpu);
5830 }
5831
5832 if ( !(uNewCrX & X86_CR0_CD)
5833 && (uNewCrX & X86_CR0_NW) )
5834 {
5835 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5836 return iemRaiseGeneralProtectionFault0(pVCpu);
5837 }
5838
5839 if ( !(uNewCrX & X86_CR0_PG)
5840 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5841 {
5842 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5843 return iemRaiseGeneralProtectionFault0(pVCpu);
5844 }
5845
5846 /* Long mode consistency checks. */
5847 if ( (uNewCrX & X86_CR0_PG)
5848 && !(uOldCrX & X86_CR0_PG)
5849 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5850 {
5851 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5852 {
5853 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5854 return iemRaiseGeneralProtectionFault0(pVCpu);
5855 }
5856 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5857 {
5858 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5859 return iemRaiseGeneralProtectionFault0(pVCpu);
5860 }
5861 }
5862
5863 /* Check for bits that must remain set or cleared in VMX operation,
5864 see Intel spec. 23.8 "Restrictions on VMX operation". */
5865 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5866 {
5867#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5868 uint64_t const uCr0Fixed0 = IEM_VMX_IS_NON_ROOT_MODE(pVCpu) ? iemVmxGetCr0Fixed0(pVCpu) : VMX_V_CR0_FIXED0;
5869#else
5870 uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
5871#endif
5872 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5873 {
5874 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5875 return iemRaiseGeneralProtectionFault0(pVCpu);
5876 }
5877
5878 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5879 if (uNewCrX & ~uCr0Fixed1)
5880 {
5881 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5882 return iemRaiseGeneralProtectionFault0(pVCpu);
5883 }
5884 }
5885
5886 /*
5887 * SVM nested-guest CR0 write intercepts.
5888 */
5889 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5890 {
5891 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5892 IEM_SVM_UPDATE_NRIP(pVCpu);
5893 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5894 }
5895 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5896 {
5897 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5898 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5899 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5900 {
5901 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5902 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5903 IEM_SVM_UPDATE_NRIP(pVCpu);
5904 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5905 }
5906 }
5907
5908 /*
5909 * Change EFER.LMA if entering or leaving long mode.
5910 */
5911 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5912 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5913 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5914 {
5915 if (uNewCrX & X86_CR0_PG)
5916 NewEFER |= MSR_K6_EFER_LMA;
5917 else
5918 NewEFER &= ~MSR_K6_EFER_LMA;
5919
5920 CPUMSetGuestEFER(pVCpu, NewEFER);
5921 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5922 }
5923
5924 /*
5925 * Inform PGM.
5926 */
5927 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5928 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5929 {
5930 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
5931 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
5932 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5933 { /* likely */ }
5934 else
5935 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
5936 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5937 AssertRCReturn(rc, rc);
5938 /* ignore informational status codes */
5939 }
5940
5941 /*
5942 * Change CR0.
5943 */
5944 CPUMSetGuestCR0(pVCpu, uNewCrX);
5945 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
5946
5947 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
5948 false /* fForce */);
5949 break;
5950 }
5951
5952 /*
5953 * CR2 can be changed without any restrictions.
5954 */
5955 case 2:
5956 {
5957 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5958 {
5959 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5960 IEM_SVM_UPDATE_NRIP(pVCpu);
5961 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5962 }
5963 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
5964 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
5965 rcStrict = VINF_SUCCESS;
5966 break;
5967 }
5968
5969 /*
5970 * CR3 is relatively simple, although AMD and Intel have different
5971 * accounts of how setting reserved bits are handled. We take intel's
5972 * word for the lower bits and AMD's for the high bits (63:52). The
5973 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5974 * on this.
5975 */
5976 /** @todo Testcase: Setting reserved bits in CR3, especially before
5977 * enabling paging. */
5978 case 3:
5979 {
5980 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5981
5982 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
5983 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
5984 && (uNewCrX & RT_BIT_64(63)))
5985 {
5986 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5987 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5988 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5989 * Paging-Structure Caches". */
5990 uNewCrX &= ~RT_BIT_64(63);
5991 }
5992
5993 /* Check / mask the value. */
5994#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
5995 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
5996 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
5997 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
5998 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
5999#else
6000 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6001#endif
6002 if (uNewCrX & fInvPhysMask)
6003 {
6004 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6005 * very vague in this area. As mentioned above, need testcase on real
6006 * hardware... Sigh. */
6007 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6008 return iemRaiseGeneralProtectionFault0(pVCpu);
6009 }
6010
6011 uint64_t fValid;
6012 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6013 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6014 {
6015 /** @todo Redundant? This value has already been validated above. */
6016 fValid = UINT64_C(0x000fffffffffffff);
6017 }
6018 else
6019 fValid = UINT64_C(0xffffffff);
6020 if (uNewCrX & ~fValid)
6021 {
6022 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6023 uNewCrX, uNewCrX & ~fValid));
6024 uNewCrX &= fValid;
6025 }
6026
6027 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6028 {
6029 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6030 IEM_SVM_UPDATE_NRIP(pVCpu);
6031 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6032 }
6033
6034 /* Inform PGM. */
6035 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6036 {
6037 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6038 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6039 { /* likely */ }
6040 else
6041 {
6042 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6043 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6044 }
6045 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6046 AssertRCReturn(rc, rc);
6047 /* ignore informational status codes */
6048 }
6049
6050 /* Make the change. */
6051 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6052 AssertRCSuccessReturn(rc, rc);
6053
6054 rcStrict = VINF_SUCCESS;
6055 break;
6056 }
6057
6058 /*
6059 * CR4 is a bit more tedious as there are bits which cannot be cleared
6060 * under some circumstances and such.
6061 */
6062 case 4:
6063 {
6064 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6065 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6066
6067 /* Reserved bits. */
6068 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6069 if (uNewCrX & ~(uint64_t)fValid)
6070 {
6071 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6072 return iemRaiseGeneralProtectionFault0(pVCpu);
6073 }
6074
6075 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6076 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6077
6078 /* PCIDE check. */
6079 if ( fPcide
6080 && ( !fLongMode
6081 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6082 {
6083 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6084 return iemRaiseGeneralProtectionFault0(pVCpu);
6085 }
6086
6087 /* PAE check. */
6088 if ( fLongMode
6089 && (uOldCrX & X86_CR4_PAE)
6090 && !(uNewCrX & X86_CR4_PAE))
6091 {
6092 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6093 return iemRaiseGeneralProtectionFault0(pVCpu);
6094 }
6095
6096 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6097 {
6098 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6099 IEM_SVM_UPDATE_NRIP(pVCpu);
6100 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6101 }
6102
6103 /* Check for bits that must remain set or cleared in VMX operation,
6104 see Intel spec. 23.8 "Restrictions on VMX operation". */
6105 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6106 {
6107 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6108 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6109 {
6110 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6111 return iemRaiseGeneralProtectionFault0(pVCpu);
6112 }
6113
6114 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6115 if (uNewCrX & ~uCr4Fixed1)
6116 {
6117 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6118 return iemRaiseGeneralProtectionFault0(pVCpu);
6119 }
6120 }
6121
6122 /*
6123 * Notify PGM.
6124 */
6125 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6126 {
6127 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6128 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6129 { /* likely */ }
6130 else
6131 {
6132 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6133 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6134 }
6135 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6136 AssertRCReturn(rc, rc);
6137 /* ignore informational status codes */
6138 }
6139
6140 /*
6141 * Change it.
6142 */
6143 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6144 AssertRCSuccessReturn(rc, rc);
6145 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6146
6147 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6148 false /* fForce */);
6149 break;
6150 }
6151
6152 /*
6153 * CR8 maps to the APIC TPR.
6154 */
6155 case 8:
6156 {
6157 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6158 if (uNewCrX & ~(uint64_t)0xf)
6159 {
6160 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6161 return iemRaiseGeneralProtectionFault0(pVCpu);
6162 }
6163
6164#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6165 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6166 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6167 {
6168 /*
6169 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6170 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6171 * cleared. Following this the processor performs TPR virtualization.
6172 *
6173 * However, we should not perform TPR virtualization immediately here but
6174 * after this instruction has completed.
6175 *
6176 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6177 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6178 */
6179 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6180 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6181 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6182 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6183 rcStrict = VINF_SUCCESS;
6184 break;
6185 }
6186#endif
6187
6188#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6189 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6190 {
6191 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6192 {
6193 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6194 IEM_SVM_UPDATE_NRIP(pVCpu);
6195 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6196 }
6197
6198 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6199 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6200 {
6201 rcStrict = VINF_SUCCESS;
6202 break;
6203 }
6204 }
6205#endif
6206 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6207 APICSetTpr(pVCpu, u8Tpr);
6208 rcStrict = VINF_SUCCESS;
6209 break;
6210 }
6211
6212 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6213 }
6214
6215 /*
6216 * Advance the RIP on success.
6217 */
6218 if (RT_SUCCESS(rcStrict))
6219 {
6220 if (rcStrict != VINF_SUCCESS)
6221 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6222 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6223 }
6224
6225 return rcStrict;
6226}
6227
6228
6229/**
6230 * Implements mov CRx,GReg.
6231 *
6232 * @param iCrReg The CRx register to write (valid).
6233 * @param iGReg The general register to load the CRx value from.
6234 */
6235IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6236{
6237 if (pVCpu->iem.s.uCpl != 0)
6238 return iemRaiseGeneralProtectionFault0(pVCpu);
6239 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6240
6241 /*
6242 * Read the new value from the source register and call common worker.
6243 */
6244 uint64_t uNewCrX;
6245 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6246 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6247 else
6248 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6249
6250#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6251 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6252 {
6253 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6254 switch (iCrReg)
6255 {
6256 case 0:
6257 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6258 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6259 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6260 }
6261 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6262 return rcStrict;
6263 }
6264#endif
6265
6266 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6267}
6268
6269
6270/**
6271 * Implements 'LMSW r/m16'
6272 *
6273 * @param u16NewMsw The new value.
6274 * @param GCPtrEffDst The guest-linear address of the source operand in case
6275 * of a memory operand. For register operand, pass
6276 * NIL_RTGCPTR.
6277 */
6278IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6279{
6280 if (pVCpu->iem.s.uCpl != 0)
6281 return iemRaiseGeneralProtectionFault0(pVCpu);
6282 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6283 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6284
6285#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6286 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6287 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6288 {
6289 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6290 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6291 return rcStrict;
6292 }
6293#else
6294 RT_NOREF_PV(GCPtrEffDst);
6295#endif
6296
6297 /*
6298 * Compose the new CR0 value and call common worker.
6299 */
6300 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6301 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6302 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6303}
6304
6305
6306/**
6307 * Implements 'CLTS'.
6308 */
6309IEM_CIMPL_DEF_0(iemCImpl_clts)
6310{
6311 if (pVCpu->iem.s.uCpl != 0)
6312 return iemRaiseGeneralProtectionFault0(pVCpu);
6313
6314 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6315 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6316 uNewCr0 &= ~X86_CR0_TS;
6317
6318#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6319 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6320 {
6321 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6322 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6323 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6324 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6325 return rcStrict;
6326 }
6327#endif
6328
6329 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6330}
6331
6332
6333/**
6334 * Implements mov GReg,DRx.
6335 *
6336 * @param iGReg The general register to store the DRx value in.
6337 * @param iDrReg The DRx register to read (0-7).
6338 */
6339IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6340{
6341#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6342 /*
6343 * Check nested-guest VMX intercept.
6344 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6345 * over CPL and CR4.DE and even DR4/DR5 checks.
6346 *
6347 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6348 */
6349 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6350 {
6351 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6352 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6353 return rcStrict;
6354 }
6355#endif
6356
6357 /*
6358 * Check preconditions.
6359 */
6360 /* Raise GPs. */
6361 if (pVCpu->iem.s.uCpl != 0)
6362 return iemRaiseGeneralProtectionFault0(pVCpu);
6363 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6364 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR0);
6365
6366 if ( (iDrReg == 4 || iDrReg == 5)
6367 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE) )
6368 {
6369 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6370 return iemRaiseGeneralProtectionFault0(pVCpu);
6371 }
6372
6373 /* Raise #DB if general access detect is enabled. */
6374 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6375 {
6376 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6377 return iemRaiseDebugException(pVCpu);
6378 }
6379
6380 /*
6381 * Read the debug register and store it in the specified general register.
6382 */
6383 uint64_t drX;
6384 switch (iDrReg)
6385 {
6386 case 0:
6387 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6388 drX = pVCpu->cpum.GstCtx.dr[0];
6389 break;
6390 case 1:
6391 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6392 drX = pVCpu->cpum.GstCtx.dr[1];
6393 break;
6394 case 2:
6395 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6396 drX = pVCpu->cpum.GstCtx.dr[2];
6397 break;
6398 case 3:
6399 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6400 drX = pVCpu->cpum.GstCtx.dr[3];
6401 break;
6402 case 6:
6403 case 4:
6404 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6405 drX = pVCpu->cpum.GstCtx.dr[6];
6406 drX |= X86_DR6_RA1_MASK;
6407 drX &= ~X86_DR6_RAZ_MASK;
6408 break;
6409 case 7:
6410 case 5:
6411 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6412 drX = pVCpu->cpum.GstCtx.dr[7];
6413 drX |=X86_DR7_RA1_MASK;
6414 drX &= ~X86_DR7_RAZ_MASK;
6415 break;
6416 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6417 }
6418
6419 /** @todo SVM nested-guest intercept for DR8-DR15? */
6420 /*
6421 * Check for any SVM nested-guest intercepts for the DRx read.
6422 */
6423 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6424 {
6425 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6426 IEM_SVM_UPDATE_NRIP(pVCpu);
6427 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6428 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6429 }
6430
6431 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6432 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6433 else
6434 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6435
6436 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6437 return VINF_SUCCESS;
6438}
6439
6440
6441/**
6442 * Implements mov DRx,GReg.
6443 *
6444 * @param iDrReg The DRx register to write (valid).
6445 * @param iGReg The general register to load the DRx value from.
6446 */
6447IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6448{
6449#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6450 /*
6451 * Check nested-guest VMX intercept.
6452 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6453 * over CPL and CR4.DE and even DR4/DR5 checks.
6454 *
6455 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6456 */
6457 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6458 {
6459 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6460 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6461 return rcStrict;
6462 }
6463#endif
6464
6465 /*
6466 * Check preconditions.
6467 */
6468 if (pVCpu->iem.s.uCpl != 0)
6469 return iemRaiseGeneralProtectionFault0(pVCpu);
6470 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6471 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR4);
6472
6473 if (iDrReg == 4 || iDrReg == 5)
6474 {
6475 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6476 {
6477 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6478 return iemRaiseGeneralProtectionFault0(pVCpu);
6479 }
6480 iDrReg += 2;
6481 }
6482
6483 /* Raise #DB if general access detect is enabled. */
6484 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6485 * \#GP? */
6486 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6487 {
6488 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6489 return iemRaiseDebugException(pVCpu);
6490 }
6491
6492 /*
6493 * Read the new value from the source register.
6494 */
6495 uint64_t uNewDrX;
6496 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6497 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6498 else
6499 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6500
6501 /*
6502 * Adjust it.
6503 */
6504 switch (iDrReg)
6505 {
6506 case 0:
6507 case 1:
6508 case 2:
6509 case 3:
6510 /* nothing to adjust */
6511 break;
6512
6513 case 6:
6514 if (uNewDrX & X86_DR6_MBZ_MASK)
6515 {
6516 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6517 return iemRaiseGeneralProtectionFault0(pVCpu);
6518 }
6519 uNewDrX |= X86_DR6_RA1_MASK;
6520 uNewDrX &= ~X86_DR6_RAZ_MASK;
6521 break;
6522
6523 case 7:
6524 if (uNewDrX & X86_DR7_MBZ_MASK)
6525 {
6526 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6527 return iemRaiseGeneralProtectionFault0(pVCpu);
6528 }
6529 uNewDrX |= X86_DR7_RA1_MASK;
6530 uNewDrX &= ~X86_DR7_RAZ_MASK;
6531 break;
6532
6533 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6534 }
6535
6536 /** @todo SVM nested-guest intercept for DR8-DR15? */
6537 /*
6538 * Check for any SVM nested-guest intercepts for the DRx write.
6539 */
6540 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6541 {
6542 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6543 IEM_SVM_UPDATE_NRIP(pVCpu);
6544 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6545 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6546 }
6547
6548 /*
6549 * Do the actual setting.
6550 */
6551 if (iDrReg < 4)
6552 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6553 else if (iDrReg == 6)
6554 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6555
6556 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6557 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6558
6559 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6560 return VINF_SUCCESS;
6561}
6562
6563
6564/**
6565 * Implements mov GReg,TRx.
6566 *
6567 * @param iGReg The general register to store the
6568 * TRx value in.
6569 * @param iTrReg The TRx register to read (6/7).
6570 */
6571IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6572{
6573 /*
6574 * Check preconditions. NB: This instruction is 386/486 only.
6575 */
6576
6577 /* Raise GPs. */
6578 if (pVCpu->iem.s.uCpl != 0)
6579 return iemRaiseGeneralProtectionFault0(pVCpu);
6580 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6581
6582 if (iTrReg < 6 || iTrReg > 7)
6583 {
6584 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6585 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6586 return iemRaiseGeneralProtectionFault0(pVCpu);
6587 }
6588
6589 /*
6590 * Read the test register and store it in the specified general register.
6591 * This is currently a dummy implementation that only exists to satisfy
6592 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6593 * TR6/TR7 registers. Software which actually depends on the TR values
6594 * (different on 386/486) is exceedingly rare.
6595 */
6596 uint64_t trX;
6597 switch (iTrReg)
6598 {
6599 case 6:
6600 trX = 0; /* Currently a dummy. */
6601 break;
6602 case 7:
6603 trX = 0; /* Currently a dummy. */
6604 break;
6605 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6606 }
6607
6608 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)trX;
6609
6610 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6611 return VINF_SUCCESS;
6612}
6613
6614
6615/**
6616 * Implements mov TRx,GReg.
6617 *
6618 * @param iTrReg The TRx register to write (valid).
6619 * @param iGReg The general register to load the TRx
6620 * value from.
6621 */
6622IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6623{
6624 /*
6625 * Check preconditions. NB: This instruction is 386/486 only.
6626 */
6627
6628 /* Raise GPs. */
6629 if (pVCpu->iem.s.uCpl != 0)
6630 return iemRaiseGeneralProtectionFault0(pVCpu);
6631 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6632
6633 if (iTrReg < 6 || iTrReg > 7)
6634 {
6635 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6636 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6637 return iemRaiseGeneralProtectionFault0(pVCpu);
6638 }
6639
6640 /*
6641 * Read the new value from the source register.
6642 */
6643 uint64_t uNewTrX;
6644 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6645 uNewTrX = iemGRegFetchU64(pVCpu, iGReg);
6646 else
6647 uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6648
6649 /*
6650 * Here we would do the actual setting if this weren't a dummy implementation.
6651 * This is currently a dummy implementation that only exists to prevent
6652 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6653 */
6654 RT_NOREF(uNewTrX);
6655
6656 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6657 return VINF_SUCCESS;
6658}
6659
6660
6661/**
6662 * Implements 'INVLPG m'.
6663 *
6664 * @param GCPtrPage The effective address of the page to invalidate.
6665 * @remarks Updates the RIP.
6666 */
6667IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6668{
6669 /* ring-0 only. */
6670 if (pVCpu->iem.s.uCpl != 0)
6671 return iemRaiseGeneralProtectionFault0(pVCpu);
6672 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6673 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6674
6675#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6676 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6677 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6678 {
6679 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6680 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6681 }
6682#endif
6683
6684 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6685 {
6686 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6687 IEM_SVM_UPDATE_NRIP(pVCpu);
6688 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6689 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6690 }
6691
6692 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6693 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6694
6695 if (rc == VINF_SUCCESS)
6696 return VINF_SUCCESS;
6697 if (rc == VINF_PGM_SYNC_CR3)
6698 return iemSetPassUpStatus(pVCpu, rc);
6699
6700 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6701 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6702 return rc;
6703}
6704
6705
6706/**
6707 * Implements INVPCID.
6708 *
6709 * @param iEffSeg The segment of the invpcid descriptor.
6710 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6711 * @param uInvpcidType The invalidation type.
6712 * @remarks Updates the RIP.
6713 */
6714IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6715{
6716 /*
6717 * Check preconditions.
6718 */
6719 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6720 return iemRaiseUndefinedOpcode(pVCpu);
6721
6722 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6723 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6724 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6725 {
6726 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6727 return iemRaiseUndefinedOpcode(pVCpu);
6728 }
6729
6730 if (pVCpu->iem.s.uCpl != 0)
6731 {
6732 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6733 return iemRaiseGeneralProtectionFault0(pVCpu);
6734 }
6735
6736 if (IEM_IS_V86_MODE(pVCpu))
6737 {
6738 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6739 return iemRaiseGeneralProtectionFault0(pVCpu);
6740 }
6741
6742 /*
6743 * Check nested-guest intercept.
6744 *
6745 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6746 * both set. We have already checked the former earlier in this function.
6747 *
6748 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6749 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6750 */
6751 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6752 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6753 {
6754 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6755 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6756 }
6757
6758 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6759 {
6760 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6761 return iemRaiseGeneralProtectionFault0(pVCpu);
6762 }
6763 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6764
6765 /*
6766 * Fetch the invpcid descriptor from guest memory.
6767 */
6768 RTUINT128U uDesc;
6769 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6770 if (rcStrict == VINF_SUCCESS)
6771 {
6772 /*
6773 * Validate the descriptor.
6774 */
6775 if (uDesc.s.Lo > 0xfff)
6776 {
6777 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6778 return iemRaiseGeneralProtectionFault0(pVCpu);
6779 }
6780
6781 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6782 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6783 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6784 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6785 switch (uInvpcidType)
6786 {
6787 case X86_INVPCID_TYPE_INDV_ADDR:
6788 {
6789 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6790 {
6791 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6792 return iemRaiseGeneralProtectionFault0(pVCpu);
6793 }
6794 if ( !(uCr4 & X86_CR4_PCIDE)
6795 && uPcid != 0)
6796 {
6797 Log(("invpcid: invalid pcid %#x\n", uPcid));
6798 return iemRaiseGeneralProtectionFault0(pVCpu);
6799 }
6800
6801 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6802 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6803 break;
6804 }
6805
6806 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6807 {
6808 if ( !(uCr4 & X86_CR4_PCIDE)
6809 && uPcid != 0)
6810 {
6811 Log(("invpcid: invalid pcid %#x\n", uPcid));
6812 return iemRaiseGeneralProtectionFault0(pVCpu);
6813 }
6814 /* Invalidate all mappings associated with PCID except global translations. */
6815 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6816 break;
6817 }
6818
6819 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6820 {
6821 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6822 break;
6823 }
6824
6825 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6826 {
6827 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6828 break;
6829 }
6830 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6831 }
6832 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6833 }
6834 return rcStrict;
6835}
6836
6837
6838/**
6839 * Implements INVD.
6840 */
6841IEM_CIMPL_DEF_0(iemCImpl_invd)
6842{
6843 if (pVCpu->iem.s.uCpl != 0)
6844 {
6845 Log(("invd: CPL != 0 -> #GP(0)\n"));
6846 return iemRaiseGeneralProtectionFault0(pVCpu);
6847 }
6848
6849 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6850 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6851
6852 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6853
6854 /* We currently take no action here. */
6855 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6856 return VINF_SUCCESS;
6857}
6858
6859
6860/**
6861 * Implements WBINVD.
6862 */
6863IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6864{
6865 if (pVCpu->iem.s.uCpl != 0)
6866 {
6867 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6868 return iemRaiseGeneralProtectionFault0(pVCpu);
6869 }
6870
6871 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6872 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6873
6874 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6875
6876 /* We currently take no action here. */
6877 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6878 return VINF_SUCCESS;
6879}
6880
6881
6882/** Opcode 0x0f 0xaa. */
6883IEM_CIMPL_DEF_0(iemCImpl_rsm)
6884{
6885 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6886 NOREF(cbInstr);
6887 return iemRaiseUndefinedOpcode(pVCpu);
6888}
6889
6890
6891/**
6892 * Implements RDTSC.
6893 */
6894IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6895{
6896 /*
6897 * Check preconditions.
6898 */
6899 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6900 return iemRaiseUndefinedOpcode(pVCpu);
6901
6902 if (pVCpu->iem.s.uCpl != 0)
6903 {
6904 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6905 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6906 {
6907 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6908 return iemRaiseGeneralProtectionFault0(pVCpu);
6909 }
6910 }
6911
6912 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6913 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6914 {
6915 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6916 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6917 }
6918
6919 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6920 {
6921 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6922 IEM_SVM_UPDATE_NRIP(pVCpu);
6923 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6924 }
6925
6926 /*
6927 * Do the job.
6928 */
6929 uint64_t uTicks = TMCpuTickGet(pVCpu);
6930#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6931 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6932#endif
6933 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6934 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6935 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
6936 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6937 return VINF_SUCCESS;
6938}
6939
6940
6941/**
6942 * Implements RDTSC.
6943 */
6944IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
6945{
6946 /*
6947 * Check preconditions.
6948 */
6949 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6950 return iemRaiseUndefinedOpcode(pVCpu);
6951
6952 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6953 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
6954 {
6955 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
6956 return iemRaiseUndefinedOpcode(pVCpu);
6957 }
6958
6959 if (pVCpu->iem.s.uCpl != 0)
6960 {
6961 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6962 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6963 {
6964 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6965 return iemRaiseGeneralProtectionFault0(pVCpu);
6966 }
6967 }
6968
6969 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6970 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6971 {
6972 Log(("rdtscp: Guest intercept -> VM-exit\n"));
6973 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
6974 }
6975 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6976 {
6977 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6978 IEM_SVM_UPDATE_NRIP(pVCpu);
6979 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6980 }
6981
6982 /*
6983 * Do the job.
6984 * Query the MSR first in case of trips to ring-3.
6985 */
6986 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
6987 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
6988 if (rcStrict == VINF_SUCCESS)
6989 {
6990 /* Low dword of the TSC_AUX msr only. */
6991 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
6992
6993 uint64_t uTicks = TMCpuTickGet(pVCpu);
6994#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6995 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6996#endif
6997 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6998 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6999 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7000 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7001 }
7002 return rcStrict;
7003}
7004
7005
7006/**
7007 * Implements RDPMC.
7008 */
7009IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7010{
7011 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7012
7013 if ( pVCpu->iem.s.uCpl != 0
7014 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7015 return iemRaiseGeneralProtectionFault0(pVCpu);
7016
7017 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7018 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7019 {
7020 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7021 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7022 }
7023
7024 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7025 {
7026 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7027 IEM_SVM_UPDATE_NRIP(pVCpu);
7028 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7029 }
7030
7031 /** @todo Emulate performance counters, for now just return 0. */
7032 pVCpu->cpum.GstCtx.rax = 0;
7033 pVCpu->cpum.GstCtx.rdx = 0;
7034 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7035 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7036 * ecx but see @bugref{3472}! */
7037
7038 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7039 return VINF_SUCCESS;
7040}
7041
7042
7043/**
7044 * Implements RDMSR.
7045 */
7046IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7047{
7048 /*
7049 * Check preconditions.
7050 */
7051 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7052 return iemRaiseUndefinedOpcode(pVCpu);
7053 if (pVCpu->iem.s.uCpl != 0)
7054 return iemRaiseGeneralProtectionFault0(pVCpu);
7055
7056 /*
7057 * Check nested-guest intercepts.
7058 */
7059#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7060 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7061 {
7062 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7063 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7064 }
7065#endif
7066
7067#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7068 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7069 {
7070 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
7071 if (rcStrict == VINF_SVM_VMEXIT)
7072 return VINF_SUCCESS;
7073 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7074 {
7075 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7076 return rcStrict;
7077 }
7078 }
7079#endif
7080
7081 /*
7082 * Do the job.
7083 */
7084 RTUINT64U uValue;
7085 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7086 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7087
7088 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7089 if (rcStrict == VINF_SUCCESS)
7090 {
7091 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7092 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7093 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7094
7095 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7096 return VINF_SUCCESS;
7097 }
7098
7099#ifndef IN_RING3
7100 /* Deferred to ring-3. */
7101 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7102 {
7103 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7104 return rcStrict;
7105 }
7106#endif
7107
7108 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7109 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7110 {
7111 pVCpu->iem.s.cLogRelRdMsr++;
7112 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7113 }
7114 else
7115 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7116 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7117 return iemRaiseGeneralProtectionFault0(pVCpu);
7118}
7119
7120
7121/**
7122 * Implements WRMSR.
7123 */
7124IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7125{
7126 /*
7127 * Check preconditions.
7128 */
7129 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7130 return iemRaiseUndefinedOpcode(pVCpu);
7131 if (pVCpu->iem.s.uCpl != 0)
7132 return iemRaiseGeneralProtectionFault0(pVCpu);
7133
7134 RTUINT64U uValue;
7135 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7136 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7137
7138 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7139
7140 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7141 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7142
7143 /*
7144 * Check nested-guest intercepts.
7145 */
7146#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7147 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7148 {
7149 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7150 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7151 }
7152#endif
7153
7154#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7155 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7156 {
7157 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
7158 if (rcStrict == VINF_SVM_VMEXIT)
7159 return VINF_SUCCESS;
7160 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7161 {
7162 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7163 return rcStrict;
7164 }
7165 }
7166#endif
7167
7168 /*
7169 * Do the job.
7170 */
7171 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7172 if (rcStrict == VINF_SUCCESS)
7173 {
7174 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7175 return VINF_SUCCESS;
7176 }
7177
7178#ifndef IN_RING3
7179 /* Deferred to ring-3. */
7180 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7181 {
7182 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7183 return rcStrict;
7184 }
7185#endif
7186
7187 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7188 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7189 {
7190 pVCpu->iem.s.cLogRelWrMsr++;
7191 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7192 }
7193 else
7194 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7195 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7196 return iemRaiseGeneralProtectionFault0(pVCpu);
7197}
7198
7199
7200/**
7201 * Implements 'IN eAX, port'.
7202 *
7203 * @param u16Port The source port.
7204 * @param fImm Whether the port was specified through an immediate operand
7205 * or the implicit DX register.
7206 * @param cbReg The register size.
7207 */
7208IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7209{
7210 /*
7211 * CPL check
7212 */
7213 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7214 if (rcStrict != VINF_SUCCESS)
7215 return rcStrict;
7216
7217 /*
7218 * Check VMX nested-guest IO intercept.
7219 */
7220#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7221 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7222 {
7223 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
7224 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7225 return rcStrict;
7226 }
7227#else
7228 RT_NOREF(fImm);
7229#endif
7230
7231 /*
7232 * Check SVM nested-guest IO intercept.
7233 */
7234#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7235 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7236 {
7237 uint8_t cAddrSizeBits;
7238 switch (pVCpu->iem.s.enmEffAddrMode)
7239 {
7240 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7241 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7242 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7243 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7244 }
7245 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7246 false /* fRep */, false /* fStrIo */, cbInstr);
7247 if (rcStrict == VINF_SVM_VMEXIT)
7248 return VINF_SUCCESS;
7249 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7250 {
7251 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7252 VBOXSTRICTRC_VAL(rcStrict)));
7253 return rcStrict;
7254 }
7255 }
7256#endif
7257
7258 /*
7259 * Perform the I/O.
7260 */
7261 uint32_t u32Value = 0;
7262 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
7263 if (IOM_SUCCESS(rcStrict))
7264 {
7265 switch (cbReg)
7266 {
7267 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7268 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7269 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7270 default: AssertFailedReturn(VERR_IEM_IPE_3);
7271 }
7272 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7273 pVCpu->iem.s.cPotentialExits++;
7274 if (rcStrict != VINF_SUCCESS)
7275 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7276 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7277
7278 /*
7279 * Check for I/O breakpoints.
7280 */
7281 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7282 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7283 && X86_DR7_ANY_RW_IO(uDr7)
7284 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7285 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7286 {
7287 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7288 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7289 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7290 rcStrict = iemRaiseDebugException(pVCpu);
7291 }
7292 }
7293
7294 return rcStrict;
7295}
7296
7297
7298/**
7299 * Implements 'IN eAX, DX'.
7300 *
7301 * @param cbReg The register size.
7302 */
7303IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
7304{
7305 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7306}
7307
7308
7309/**
7310 * Implements 'OUT port, eAX'.
7311 *
7312 * @param u16Port The destination port.
7313 * @param fImm Whether the port was specified through an immediate operand
7314 * or the implicit DX register.
7315 * @param cbReg The register size.
7316 */
7317IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7318{
7319 /*
7320 * CPL check
7321 */
7322 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7323 if (rcStrict != VINF_SUCCESS)
7324 return rcStrict;
7325
7326 /*
7327 * Check VMX nested-guest I/O intercept.
7328 */
7329#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7330 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7331 {
7332 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
7333 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7334 return rcStrict;
7335 }
7336#else
7337 RT_NOREF(fImm);
7338#endif
7339
7340 /*
7341 * Check SVM nested-guest I/O intercept.
7342 */
7343#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7344 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7345 {
7346 uint8_t cAddrSizeBits;
7347 switch (pVCpu->iem.s.enmEffAddrMode)
7348 {
7349 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7350 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7351 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7352 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7353 }
7354 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7355 false /* fRep */, false /* fStrIo */, cbInstr);
7356 if (rcStrict == VINF_SVM_VMEXIT)
7357 return VINF_SUCCESS;
7358 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7359 {
7360 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7361 VBOXSTRICTRC_VAL(rcStrict)));
7362 return rcStrict;
7363 }
7364 }
7365#endif
7366
7367 /*
7368 * Perform the I/O.
7369 */
7370 uint32_t u32Value;
7371 switch (cbReg)
7372 {
7373 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7374 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7375 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7376 default: AssertFailedReturn(VERR_IEM_IPE_4);
7377 }
7378 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
7379 if (IOM_SUCCESS(rcStrict))
7380 {
7381 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7382 pVCpu->iem.s.cPotentialExits++;
7383 if (rcStrict != VINF_SUCCESS)
7384 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7385 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7386
7387 /*
7388 * Check for I/O breakpoints.
7389 */
7390 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7391 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7392 && X86_DR7_ANY_RW_IO(uDr7)
7393 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7394 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7395 {
7396 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7397 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7398 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7399 rcStrict = iemRaiseDebugException(pVCpu);
7400 }
7401 }
7402 return rcStrict;
7403}
7404
7405
7406/**
7407 * Implements 'OUT DX, eAX'.
7408 *
7409 * @param cbReg The register size.
7410 */
7411IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7412{
7413 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7414}
7415
7416
7417/**
7418 * Implements 'CLI'.
7419 */
7420IEM_CIMPL_DEF_0(iemCImpl_cli)
7421{
7422 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7423 uint32_t const fEflOld = fEfl;
7424
7425 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7426 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7427 {
7428 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7429 if (!(fEfl & X86_EFL_VM))
7430 {
7431 if (pVCpu->iem.s.uCpl <= uIopl)
7432 fEfl &= ~X86_EFL_IF;
7433 else if ( pVCpu->iem.s.uCpl == 3
7434 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7435 fEfl &= ~X86_EFL_VIF;
7436 else
7437 return iemRaiseGeneralProtectionFault0(pVCpu);
7438 }
7439 /* V8086 */
7440 else if (uIopl == 3)
7441 fEfl &= ~X86_EFL_IF;
7442 else if ( uIopl < 3
7443 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7444 fEfl &= ~X86_EFL_VIF;
7445 else
7446 return iemRaiseGeneralProtectionFault0(pVCpu);
7447 }
7448 /* real mode */
7449 else
7450 fEfl &= ~X86_EFL_IF;
7451
7452 /* Commit. */
7453 IEMMISC_SET_EFL(pVCpu, fEfl);
7454 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7455 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
7456 return VINF_SUCCESS;
7457}
7458
7459
7460/**
7461 * Implements 'STI'.
7462 */
7463IEM_CIMPL_DEF_0(iemCImpl_sti)
7464{
7465 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7466 uint32_t const fEflOld = fEfl;
7467
7468 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7469 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7470 {
7471 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7472 if (!(fEfl & X86_EFL_VM))
7473 {
7474 if (pVCpu->iem.s.uCpl <= uIopl)
7475 fEfl |= X86_EFL_IF;
7476 else if ( pVCpu->iem.s.uCpl == 3
7477 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7478 && !(fEfl & X86_EFL_VIP) )
7479 fEfl |= X86_EFL_VIF;
7480 else
7481 return iemRaiseGeneralProtectionFault0(pVCpu);
7482 }
7483 /* V8086 */
7484 else if (uIopl == 3)
7485 fEfl |= X86_EFL_IF;
7486 else if ( uIopl < 3
7487 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7488 && !(fEfl & X86_EFL_VIP) )
7489 fEfl |= X86_EFL_VIF;
7490 else
7491 return iemRaiseGeneralProtectionFault0(pVCpu);
7492 }
7493 /* real mode */
7494 else
7495 fEfl |= X86_EFL_IF;
7496
7497 /* Commit. */
7498 IEMMISC_SET_EFL(pVCpu, fEfl);
7499 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7500 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7501 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
7502 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7503 return VINF_SUCCESS;
7504}
7505
7506
7507/**
7508 * Implements 'HLT'.
7509 */
7510IEM_CIMPL_DEF_0(iemCImpl_hlt)
7511{
7512 if (pVCpu->iem.s.uCpl != 0)
7513 return iemRaiseGeneralProtectionFault0(pVCpu);
7514
7515 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7516 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7517 {
7518 Log2(("hlt: Guest intercept -> VM-exit\n"));
7519 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7520 }
7521
7522 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7523 {
7524 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7525 IEM_SVM_UPDATE_NRIP(pVCpu);
7526 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7527 }
7528
7529 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7530 return VINF_EM_HALT;
7531}
7532
7533
7534/**
7535 * Implements 'MONITOR'.
7536 */
7537IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7538{
7539 /*
7540 * Permission checks.
7541 */
7542 if (pVCpu->iem.s.uCpl != 0)
7543 {
7544 Log2(("monitor: CPL != 0\n"));
7545 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7546 }
7547 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7548 {
7549 Log2(("monitor: Not in CPUID\n"));
7550 return iemRaiseUndefinedOpcode(pVCpu);
7551 }
7552
7553 /*
7554 * Check VMX guest-intercept.
7555 * This should be considered a fault-like VM-exit.
7556 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7557 */
7558 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7559 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7560 {
7561 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7562 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7563 }
7564
7565 /*
7566 * Gather the operands and validate them.
7567 */
7568 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7569 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7570 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7571/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7572 * \#GP first. */
7573 if (uEcx != 0)
7574 {
7575 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7576 return iemRaiseGeneralProtectionFault0(pVCpu);
7577 }
7578
7579 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7580 if (rcStrict != VINF_SUCCESS)
7581 return rcStrict;
7582
7583 RTGCPHYS GCPhysMem;
7584 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7585 if (rcStrict != VINF_SUCCESS)
7586 return rcStrict;
7587
7588#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7589 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7590 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7591 {
7592 /*
7593 * MONITOR does not access the memory, just monitors the address. However,
7594 * if the address falls in the APIC-access page, the address monitored must
7595 * instead be the corresponding address in the virtual-APIC page.
7596 *
7597 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7598 */
7599 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7600 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7601 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7602 return rcStrict;
7603 }
7604#endif
7605
7606 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7607 {
7608 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7609 IEM_SVM_UPDATE_NRIP(pVCpu);
7610 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7611 }
7612
7613 /*
7614 * Call EM to prepare the monitor/wait.
7615 */
7616 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7617 Assert(rcStrict == VINF_SUCCESS);
7618
7619 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7620 return rcStrict;
7621}
7622
7623
7624/**
7625 * Implements 'MWAIT'.
7626 */
7627IEM_CIMPL_DEF_0(iemCImpl_mwait)
7628{
7629 /*
7630 * Permission checks.
7631 */
7632 if (pVCpu->iem.s.uCpl != 0)
7633 {
7634 Log2(("mwait: CPL != 0\n"));
7635 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7636 * EFLAGS.VM then.) */
7637 return iemRaiseUndefinedOpcode(pVCpu);
7638 }
7639 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7640 {
7641 Log2(("mwait: Not in CPUID\n"));
7642 return iemRaiseUndefinedOpcode(pVCpu);
7643 }
7644
7645 /* Check VMX nested-guest intercept. */
7646 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7647 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7648 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7649
7650 /*
7651 * Gather the operands and validate them.
7652 */
7653 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7654 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7655 if (uEcx != 0)
7656 {
7657 /* Only supported extension is break on IRQ when IF=0. */
7658 if (uEcx > 1)
7659 {
7660 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7661 return iemRaiseGeneralProtectionFault0(pVCpu);
7662 }
7663 uint32_t fMWaitFeatures = 0;
7664 uint32_t uIgnore = 0;
7665 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7666 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7667 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7668 {
7669 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7670 return iemRaiseGeneralProtectionFault0(pVCpu);
7671 }
7672
7673#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7674 /*
7675 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7676 * for delivery; and interrupts are disabled the processor does not enter its
7677 * mwait state but rather passes control to the next instruction.
7678 *
7679 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7680 */
7681 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7682 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7683 {
7684 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7685 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7686 {
7687 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7688 return VINF_SUCCESS;
7689 }
7690 }
7691#endif
7692 }
7693
7694 /*
7695 * Check SVM nested-guest mwait intercepts.
7696 */
7697 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7698 && EMMonitorIsArmed(pVCpu))
7699 {
7700 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7701 IEM_SVM_UPDATE_NRIP(pVCpu);
7702 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7703 }
7704 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7705 {
7706 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7707 IEM_SVM_UPDATE_NRIP(pVCpu);
7708 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7709 }
7710
7711 /*
7712 * Call EM to prepare the monitor/wait.
7713 */
7714 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7715
7716 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7717 return rcStrict;
7718}
7719
7720
7721/**
7722 * Implements 'SWAPGS'.
7723 */
7724IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7725{
7726 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7727
7728 /*
7729 * Permission checks.
7730 */
7731 if (pVCpu->iem.s.uCpl != 0)
7732 {
7733 Log2(("swapgs: CPL != 0\n"));
7734 return iemRaiseUndefinedOpcode(pVCpu);
7735 }
7736
7737 /*
7738 * Do the job.
7739 */
7740 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7741 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7742 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7743 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7744
7745 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7746 return VINF_SUCCESS;
7747}
7748
7749
7750/**
7751 * Implements 'CPUID'.
7752 */
7753IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7754{
7755 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7756 {
7757 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7758 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7759 }
7760
7761 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7762 {
7763 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7764 IEM_SVM_UPDATE_NRIP(pVCpu);
7765 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7766 }
7767
7768 CPUMGetGuestCpuId(pVCpu, pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
7769 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7770 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7771 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7772 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7773 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7774 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7775
7776 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7777 pVCpu->iem.s.cPotentialExits++;
7778 return VINF_SUCCESS;
7779}
7780
7781
7782/**
7783 * Implements 'AAD'.
7784 *
7785 * @param bImm The immediate operand.
7786 */
7787IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7788{
7789 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7790 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7791 pVCpu->cpum.GstCtx.ax = al;
7792 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7793 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7794 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7795
7796 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7797 return VINF_SUCCESS;
7798}
7799
7800
7801/**
7802 * Implements 'AAM'.
7803 *
7804 * @param bImm The immediate operand. Cannot be 0.
7805 */
7806IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
7807{
7808 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
7809
7810 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7811 uint8_t const al = (uint8_t)ax % bImm;
7812 uint8_t const ah = (uint8_t)ax / bImm;
7813 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
7814 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7815 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7816 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7817
7818 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7819 return VINF_SUCCESS;
7820}
7821
7822
7823/**
7824 * Implements 'DAA'.
7825 */
7826IEM_CIMPL_DEF_0(iemCImpl_daa)
7827{
7828 uint8_t const al = pVCpu->cpum.GstCtx.al;
7829 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7830
7831 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7832 || (al & 0xf) >= 10)
7833 {
7834 pVCpu->cpum.GstCtx.al = al + 6;
7835 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7836 }
7837 else
7838 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7839
7840 if (al >= 0x9a || fCarry)
7841 {
7842 pVCpu->cpum.GstCtx.al += 0x60;
7843 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7844 }
7845 else
7846 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7847
7848 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7849 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7850 return VINF_SUCCESS;
7851}
7852
7853
7854/**
7855 * Implements 'DAS'.
7856 */
7857IEM_CIMPL_DEF_0(iemCImpl_das)
7858{
7859 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
7860 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7861
7862 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7863 || (uInputAL & 0xf) >= 10)
7864 {
7865 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7866 if (uInputAL < 6)
7867 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7868 pVCpu->cpum.GstCtx.al = uInputAL - 6;
7869 }
7870 else
7871 {
7872 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7873 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7874 }
7875
7876 if (uInputAL >= 0x9a || fCarry)
7877 {
7878 pVCpu->cpum.GstCtx.al -= 0x60;
7879 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7880 }
7881
7882 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7883 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7884 return VINF_SUCCESS;
7885}
7886
7887
7888/**
7889 * Implements 'AAA'.
7890 */
7891IEM_CIMPL_DEF_0(iemCImpl_aaa)
7892{
7893 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7894 {
7895 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7896 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7897 {
7898 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7899 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7900 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7901 }
7902 else
7903 {
7904 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7905 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7906 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7907 }
7908 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7909 }
7910 else
7911 {
7912 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7913 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7914 {
7915 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
7916 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7917 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7918 }
7919 else
7920 {
7921 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7922 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7923 }
7924 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7925 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7926 }
7927
7928 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7929 return VINF_SUCCESS;
7930}
7931
7932
7933/**
7934 * Implements 'AAS'.
7935 */
7936IEM_CIMPL_DEF_0(iemCImpl_aas)
7937{
7938 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7939 {
7940 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7941 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7942 {
7943 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7944 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7945 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7946 }
7947 else
7948 {
7949 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7950 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7951 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7952 }
7953 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7954 }
7955 else
7956 {
7957 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7958 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7959 {
7960 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
7961 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7962 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7963 }
7964 else
7965 {
7966 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7967 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7968 }
7969 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7970 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7971 }
7972
7973 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7974 return VINF_SUCCESS;
7975}
7976
7977
7978/**
7979 * Implements the 16-bit version of 'BOUND'.
7980 *
7981 * @note We have separate 16-bit and 32-bit variants of this function due to
7982 * the decoder using unsigned parameters, whereas we want signed one to
7983 * do the job. This is significant for a recompiler.
7984 */
7985IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
7986{
7987 /*
7988 * Check if the index is inside the bounds, otherwise raise #BR.
7989 */
7990 if ( idxArray >= idxLowerBound
7991 && idxArray <= idxUpperBound)
7992 {
7993 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7994 return VINF_SUCCESS;
7995 }
7996
7997 return iemRaiseBoundRangeExceeded(pVCpu);
7998}
7999
8000
8001/**
8002 * Implements the 32-bit version of 'BOUND'.
8003 */
8004IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8005{
8006 /*
8007 * Check if the index is inside the bounds, otherwise raise #BR.
8008 */
8009 if ( idxArray >= idxLowerBound
8010 && idxArray <= idxUpperBound)
8011 {
8012 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8013 return VINF_SUCCESS;
8014 }
8015
8016 return iemRaiseBoundRangeExceeded(pVCpu);
8017}
8018
8019
8020
8021/*
8022 * Instantiate the various string operation combinations.
8023 */
8024#define OP_SIZE 8
8025#define ADDR_SIZE 16
8026#include "IEMAllCImplStrInstr.cpp.h"
8027#define OP_SIZE 8
8028#define ADDR_SIZE 32
8029#include "IEMAllCImplStrInstr.cpp.h"
8030#define OP_SIZE 8
8031#define ADDR_SIZE 64
8032#include "IEMAllCImplStrInstr.cpp.h"
8033
8034#define OP_SIZE 16
8035#define ADDR_SIZE 16
8036#include "IEMAllCImplStrInstr.cpp.h"
8037#define OP_SIZE 16
8038#define ADDR_SIZE 32
8039#include "IEMAllCImplStrInstr.cpp.h"
8040#define OP_SIZE 16
8041#define ADDR_SIZE 64
8042#include "IEMAllCImplStrInstr.cpp.h"
8043
8044#define OP_SIZE 32
8045#define ADDR_SIZE 16
8046#include "IEMAllCImplStrInstr.cpp.h"
8047#define OP_SIZE 32
8048#define ADDR_SIZE 32
8049#include "IEMAllCImplStrInstr.cpp.h"
8050#define OP_SIZE 32
8051#define ADDR_SIZE 64
8052#include "IEMAllCImplStrInstr.cpp.h"
8053
8054#define OP_SIZE 64
8055#define ADDR_SIZE 32
8056#include "IEMAllCImplStrInstr.cpp.h"
8057#define OP_SIZE 64
8058#define ADDR_SIZE 64
8059#include "IEMAllCImplStrInstr.cpp.h"
8060
8061
8062/**
8063 * Implements 'XGETBV'.
8064 */
8065IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8066{
8067 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8068 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8069 {
8070 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8071 switch (uEcx)
8072 {
8073 case 0:
8074 break;
8075
8076 case 1: /** @todo Implement XCR1 support. */
8077 default:
8078 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8079 return iemRaiseGeneralProtectionFault0(pVCpu);
8080
8081 }
8082 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8083 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8084 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8085
8086 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8087 return VINF_SUCCESS;
8088 }
8089 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8090 return iemRaiseUndefinedOpcode(pVCpu);
8091}
8092
8093
8094/**
8095 * Implements 'XSETBV'.
8096 */
8097IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8098{
8099 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8100 {
8101 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8102 {
8103 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8104 IEM_SVM_UPDATE_NRIP(pVCpu);
8105 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8106 }
8107
8108 if (pVCpu->iem.s.uCpl == 0)
8109 {
8110 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8111
8112 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8113 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8114
8115 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8116 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8117 switch (uEcx)
8118 {
8119 case 0:
8120 {
8121 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8122 if (rc == VINF_SUCCESS)
8123 break;
8124 Assert(rc == VERR_CPUM_RAISE_GP_0);
8125 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8126 return iemRaiseGeneralProtectionFault0(pVCpu);
8127 }
8128
8129 case 1: /** @todo Implement XCR1 support. */
8130 default:
8131 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8132 return iemRaiseGeneralProtectionFault0(pVCpu);
8133
8134 }
8135
8136 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8137 return VINF_SUCCESS;
8138 }
8139
8140 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
8141 return iemRaiseGeneralProtectionFault0(pVCpu);
8142 }
8143 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8144 return iemRaiseUndefinedOpcode(pVCpu);
8145}
8146
8147#ifndef RT_ARCH_ARM64
8148# ifdef IN_RING3
8149
8150/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8151struct IEMCIMPLCX16ARGS
8152{
8153 PRTUINT128U pu128Dst;
8154 PRTUINT128U pu128RaxRdx;
8155 PRTUINT128U pu128RbxRcx;
8156 uint32_t *pEFlags;
8157# ifdef VBOX_STRICT
8158 uint32_t cCalls;
8159# endif
8160};
8161
8162/**
8163 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8164 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8165 */
8166static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8167{
8168 RT_NOREF(pVM, pVCpu);
8169 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8170# ifdef VBOX_STRICT
8171 Assert(pArgs->cCalls == 0);
8172 pArgs->cCalls++;
8173# endif
8174
8175 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8176 return VINF_SUCCESS;
8177}
8178
8179# endif /* IN_RING3 */
8180
8181/**
8182 * Implements 'CMPXCHG16B' fallback using rendezvous.
8183 */
8184IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8185 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8186{
8187# ifdef IN_RING3
8188 struct IEMCIMPLCX16ARGS Args;
8189 Args.pu128Dst = pu128Dst;
8190 Args.pu128RaxRdx = pu128RaxRdx;
8191 Args.pu128RbxRcx = pu128RbxRcx;
8192 Args.pEFlags = pEFlags;
8193# ifdef VBOX_STRICT
8194 Args.cCalls = 0;
8195# endif
8196 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8197 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8198 Assert(Args.cCalls == 1);
8199 if (rcStrict == VINF_SUCCESS)
8200 {
8201 /* Duplicated tail code. */
8202 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8203 if (rcStrict == VINF_SUCCESS)
8204 {
8205 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8206 if (!(*pEFlags & X86_EFL_ZF))
8207 {
8208 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8209 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8210 }
8211 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8212 }
8213 }
8214 return rcStrict;
8215# else
8216 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8217 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8218# endif
8219}
8220
8221#endif /* RT_ARCH_ARM64 */
8222
8223/**
8224 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8225 *
8226 * This is implemented in C because it triggers a load like behaviour without
8227 * actually reading anything. Since that's not so common, it's implemented
8228 * here.
8229 *
8230 * @param iEffSeg The effective segment.
8231 * @param GCPtrEff The address of the image.
8232 */
8233IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8234{
8235 /*
8236 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8237 */
8238 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8239 if (rcStrict == VINF_SUCCESS)
8240 {
8241 RTGCPHYS GCPhysMem;
8242 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8243 if (rcStrict == VINF_SUCCESS)
8244 {
8245#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8246 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8247 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8248 {
8249 /*
8250 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8251 * that contains the address. However, if the address falls in the APIC-access
8252 * page, the address flushed must instead be the corresponding address in the
8253 * virtual-APIC page.
8254 *
8255 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8256 */
8257 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8258 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8259 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8260 return rcStrict;
8261 }
8262#endif
8263 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8264 return VINF_SUCCESS;
8265 }
8266 }
8267
8268 return rcStrict;
8269}
8270
8271
8272/**
8273 * Implements 'FINIT' and 'FNINIT'.
8274 *
8275 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8276 * not.
8277 */
8278IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8279{
8280 /*
8281 * Exceptions.
8282 */
8283 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8284 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8285 return iemRaiseDeviceNotAvailable(pVCpu);
8286
8287 iemFpuActualizeStateForChange(pVCpu);
8288 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8289
8290 /* FINIT: Raise #MF on pending exception(s): */
8291 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8292 return iemRaiseMathFault(pVCpu);
8293
8294 /*
8295 * Reset the state.
8296 */
8297 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8298 pXState->x87.FCW = 0x37f;
8299 pXState->x87.FSW = 0;
8300 pXState->x87.FTW = 0x00; /* 0 - empty. */
8301 /** @todo Intel says the instruction and data pointers are not cleared on
8302 * 387, presume that 8087 and 287 doesn't do so either. */
8303 /** @todo test this stuff. */
8304 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8305 {
8306 pXState->x87.FPUDP = 0;
8307 pXState->x87.DS = 0; //??
8308 pXState->x87.Rsrvd2 = 0;
8309 pXState->x87.FPUIP = 0;
8310 pXState->x87.CS = 0; //??
8311 pXState->x87.Rsrvd1 = 0;
8312 }
8313 pXState->x87.FOP = 0;
8314
8315 iemHlpUsedFpu(pVCpu);
8316 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8317 return VINF_SUCCESS;
8318}
8319
8320
8321/**
8322 * Implements 'FXSAVE'.
8323 *
8324 * @param iEffSeg The effective segment.
8325 * @param GCPtrEff The address of the image.
8326 * @param enmEffOpSize The operand size (only REX.W really matters).
8327 */
8328IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8329{
8330 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8331
8332 /*
8333 * Raise exceptions.
8334 */
8335 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8336 return iemRaiseUndefinedOpcode(pVCpu);
8337 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8338 return iemRaiseDeviceNotAvailable(pVCpu);
8339
8340 /*
8341 * Access the memory.
8342 */
8343 void *pvMem512;
8344 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8345 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8346 if (rcStrict != VINF_SUCCESS)
8347 return rcStrict;
8348 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8349 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8350
8351 /*
8352 * Store the registers.
8353 */
8354 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8355 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8356
8357 /* common for all formats */
8358 pDst->FCW = pSrc->FCW;
8359 pDst->FSW = pSrc->FSW;
8360 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8361 pDst->FOP = pSrc->FOP;
8362 pDst->MXCSR = pSrc->MXCSR;
8363 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8364 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8365 {
8366 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8367 * them for now... */
8368 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8369 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8370 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8371 pDst->aRegs[i].au32[3] = 0;
8372 }
8373
8374 /* FPU IP, CS, DP and DS. */
8375 pDst->FPUIP = pSrc->FPUIP;
8376 pDst->CS = pSrc->CS;
8377 pDst->FPUDP = pSrc->FPUDP;
8378 pDst->DS = pSrc->DS;
8379 if (enmEffOpSize == IEMMODE_64BIT)
8380 {
8381 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8382 pDst->Rsrvd1 = pSrc->Rsrvd1;
8383 pDst->Rsrvd2 = pSrc->Rsrvd2;
8384 }
8385 else
8386 {
8387 pDst->Rsrvd1 = 0;
8388 pDst->Rsrvd2 = 0;
8389 }
8390
8391 /* XMM registers. */
8392 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8393 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8394 || pVCpu->iem.s.uCpl != 0)
8395 {
8396 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8397 for (uint32_t i = 0; i < cXmmRegs; i++)
8398 pDst->aXMM[i] = pSrc->aXMM[i];
8399 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8400 * right? */
8401 }
8402
8403 /*
8404 * Commit the memory.
8405 */
8406 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8407 if (rcStrict != VINF_SUCCESS)
8408 return rcStrict;
8409
8410 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8411 return VINF_SUCCESS;
8412}
8413
8414
8415/**
8416 * Implements 'FXRSTOR'.
8417 *
8418 * @param iEffSeg The effective segment register for @a GCPtrEff.
8419 * @param GCPtrEff The address of the image.
8420 * @param enmEffOpSize The operand size (only REX.W really matters).
8421 */
8422IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8423{
8424 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8425
8426 /*
8427 * Raise exceptions.
8428 */
8429 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8430 return iemRaiseUndefinedOpcode(pVCpu);
8431 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8432 return iemRaiseDeviceNotAvailable(pVCpu);
8433
8434 /*
8435 * Access the memory.
8436 */
8437 void *pvMem512;
8438 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8439 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8440 if (rcStrict != VINF_SUCCESS)
8441 return rcStrict;
8442 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8443 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8444
8445 /*
8446 * Check the state for stuff which will #GP(0).
8447 */
8448 uint32_t const fMXCSR = pSrc->MXCSR;
8449 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8450 if (fMXCSR & ~fMXCSR_MASK)
8451 {
8452 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8453 return iemRaiseGeneralProtectionFault0(pVCpu);
8454 }
8455
8456 /*
8457 * Load the registers.
8458 */
8459 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8460 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
8461
8462 /* common for all formats */
8463 pDst->FCW = pSrc->FCW;
8464 pDst->FSW = pSrc->FSW;
8465 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8466 pDst->FOP = pSrc->FOP;
8467 pDst->MXCSR = fMXCSR;
8468 /* (MXCSR_MASK is read-only) */
8469 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8470 {
8471 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8472 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8473 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8474 pDst->aRegs[i].au32[3] = 0;
8475 }
8476
8477 /* FPU IP, CS, DP and DS. */
8478 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8479 {
8480 pDst->FPUIP = pSrc->FPUIP;
8481 pDst->CS = pSrc->CS;
8482 pDst->Rsrvd1 = pSrc->Rsrvd1;
8483 pDst->FPUDP = pSrc->FPUDP;
8484 pDst->DS = pSrc->DS;
8485 pDst->Rsrvd2 = pSrc->Rsrvd2;
8486 }
8487 else
8488 {
8489 pDst->FPUIP = pSrc->FPUIP;
8490 pDst->CS = pSrc->CS;
8491 pDst->Rsrvd1 = 0;
8492 pDst->FPUDP = pSrc->FPUDP;
8493 pDst->DS = pSrc->DS;
8494 pDst->Rsrvd2 = 0;
8495 }
8496
8497 /* XMM registers. */
8498 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8499 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8500 || pVCpu->iem.s.uCpl != 0)
8501 {
8502 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8503 for (uint32_t i = 0; i < cXmmRegs; i++)
8504 pDst->aXMM[i] = pSrc->aXMM[i];
8505 }
8506
8507 /*
8508 * Commit the memory.
8509 */
8510 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8511 if (rcStrict != VINF_SUCCESS)
8512 return rcStrict;
8513
8514 iemHlpUsedFpu(pVCpu);
8515 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8516 return VINF_SUCCESS;
8517}
8518
8519
8520/**
8521 * Implements 'XSAVE'.
8522 *
8523 * @param iEffSeg The effective segment.
8524 * @param GCPtrEff The address of the image.
8525 * @param enmEffOpSize The operand size (only REX.W really matters).
8526 */
8527IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8528{
8529 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8530
8531 /*
8532 * Raise exceptions.
8533 */
8534 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8535 return iemRaiseUndefinedOpcode(pVCpu);
8536 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8537 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8538 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8539 {
8540 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8541 return iemRaiseUndefinedOpcode(pVCpu);
8542 }
8543 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8544 return iemRaiseDeviceNotAvailable(pVCpu);
8545
8546 /*
8547 * Calc the requested mask.
8548 */
8549 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8550 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8551 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8552
8553/** @todo figure out the exact protocol for the memory access. Currently we
8554 * just need this crap to work halfways to make it possible to test
8555 * AVX instructions. */
8556/** @todo figure out the XINUSE and XMODIFIED */
8557
8558 /*
8559 * Access the x87 memory state.
8560 */
8561 /* The x87+SSE state. */
8562 void *pvMem512;
8563 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8564 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8565 if (rcStrict != VINF_SUCCESS)
8566 return rcStrict;
8567 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8568 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8569
8570 /* The header. */
8571 PX86XSAVEHDR pHdr;
8572 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
8573 if (rcStrict != VINF_SUCCESS)
8574 return rcStrict;
8575
8576 /*
8577 * Store the X87 state.
8578 */
8579 if (fReqComponents & XSAVE_C_X87)
8580 {
8581 /* common for all formats */
8582 pDst->FCW = pSrc->FCW;
8583 pDst->FSW = pSrc->FSW;
8584 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8585 pDst->FOP = pSrc->FOP;
8586 pDst->FPUIP = pSrc->FPUIP;
8587 pDst->CS = pSrc->CS;
8588 pDst->FPUDP = pSrc->FPUDP;
8589 pDst->DS = pSrc->DS;
8590 if (enmEffOpSize == IEMMODE_64BIT)
8591 {
8592 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8593 pDst->Rsrvd1 = pSrc->Rsrvd1;
8594 pDst->Rsrvd2 = pSrc->Rsrvd2;
8595 }
8596 else
8597 {
8598 pDst->Rsrvd1 = 0;
8599 pDst->Rsrvd2 = 0;
8600 }
8601 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8602 {
8603 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8604 * them for now... */
8605 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8606 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8607 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8608 pDst->aRegs[i].au32[3] = 0;
8609 }
8610
8611 }
8612
8613 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8614 {
8615 pDst->MXCSR = pSrc->MXCSR;
8616 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8617 }
8618
8619 if (fReqComponents & XSAVE_C_SSE)
8620 {
8621 /* XMM registers. */
8622 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8623 for (uint32_t i = 0; i < cXmmRegs; i++)
8624 pDst->aXMM[i] = pSrc->aXMM[i];
8625 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8626 * right? */
8627 }
8628
8629 /* Commit the x87 state bits. (probably wrong) */
8630 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8631 if (rcStrict != VINF_SUCCESS)
8632 return rcStrict;
8633
8634 /*
8635 * Store AVX state.
8636 */
8637 if (fReqComponents & XSAVE_C_YMM)
8638 {
8639 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8640 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8641 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8642 PX86XSAVEYMMHI pCompDst;
8643 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8644 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
8645 if (rcStrict != VINF_SUCCESS)
8646 return rcStrict;
8647
8648 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8649 for (uint32_t i = 0; i < cXmmRegs; i++)
8650 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8651
8652 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8653 if (rcStrict != VINF_SUCCESS)
8654 return rcStrict;
8655 }
8656
8657 /*
8658 * Update the header.
8659 */
8660 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8661 | (fReqComponents & fXInUse);
8662
8663 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8664 if (rcStrict != VINF_SUCCESS)
8665 return rcStrict;
8666
8667 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8668 return VINF_SUCCESS;
8669}
8670
8671
8672/**
8673 * Implements 'XRSTOR'.
8674 *
8675 * @param iEffSeg The effective segment.
8676 * @param GCPtrEff The address of the image.
8677 * @param enmEffOpSize The operand size (only REX.W really matters).
8678 */
8679IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8680{
8681 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8682
8683 /*
8684 * Raise exceptions.
8685 */
8686 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8687 return iemRaiseUndefinedOpcode(pVCpu);
8688 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8689 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8690 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8691 {
8692 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8693 return iemRaiseUndefinedOpcode(pVCpu);
8694 }
8695 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8696 return iemRaiseDeviceNotAvailable(pVCpu);
8697 if (GCPtrEff & 63)
8698 {
8699 /** @todo CPU/VM detection possible! \#AC might not be signal for
8700 * all/any misalignment sizes, intel says its an implementation detail. */
8701 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8702 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8703 && pVCpu->iem.s.uCpl == 3)
8704 return iemRaiseAlignmentCheckException(pVCpu);
8705 return iemRaiseGeneralProtectionFault0(pVCpu);
8706 }
8707
8708/** @todo figure out the exact protocol for the memory access. Currently we
8709 * just need this crap to work halfways to make it possible to test
8710 * AVX instructions. */
8711/** @todo figure out the XINUSE and XMODIFIED */
8712
8713 /*
8714 * Access the x87 memory state.
8715 */
8716 /* The x87+SSE state. */
8717 void *pvMem512;
8718 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8719 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8720 if (rcStrict != VINF_SUCCESS)
8721 return rcStrict;
8722 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8723 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8724
8725 /*
8726 * Calc the requested mask
8727 */
8728 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
8729 PCX86XSAVEHDR pHdrSrc;
8730 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
8731 IEM_ACCESS_DATA_R, 0 /* checked above */);
8732 if (rcStrict != VINF_SUCCESS)
8733 return rcStrict;
8734
8735 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8736 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8737 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8738 uint64_t const fRstorMask = pHdrSrc->bmXState;
8739 uint64_t const fCompMask = pHdrSrc->bmXComp;
8740
8741 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8742
8743 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8744
8745 /* We won't need this any longer. */
8746 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8747 if (rcStrict != VINF_SUCCESS)
8748 return rcStrict;
8749
8750 /*
8751 * Store the X87 state.
8752 */
8753 if (fReqComponents & XSAVE_C_X87)
8754 {
8755 if (fRstorMask & XSAVE_C_X87)
8756 {
8757 pDst->FCW = pSrc->FCW;
8758 pDst->FSW = pSrc->FSW;
8759 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8760 pDst->FOP = pSrc->FOP;
8761 pDst->FPUIP = pSrc->FPUIP;
8762 pDst->CS = pSrc->CS;
8763 pDst->FPUDP = pSrc->FPUDP;
8764 pDst->DS = pSrc->DS;
8765 if (enmEffOpSize == IEMMODE_64BIT)
8766 {
8767 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8768 pDst->Rsrvd1 = pSrc->Rsrvd1;
8769 pDst->Rsrvd2 = pSrc->Rsrvd2;
8770 }
8771 else
8772 {
8773 pDst->Rsrvd1 = 0;
8774 pDst->Rsrvd2 = 0;
8775 }
8776 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8777 {
8778 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8779 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8780 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8781 pDst->aRegs[i].au32[3] = 0;
8782 }
8783 }
8784 else
8785 {
8786 pDst->FCW = 0x37f;
8787 pDst->FSW = 0;
8788 pDst->FTW = 0x00; /* 0 - empty. */
8789 pDst->FPUDP = 0;
8790 pDst->DS = 0; //??
8791 pDst->Rsrvd2= 0;
8792 pDst->FPUIP = 0;
8793 pDst->CS = 0; //??
8794 pDst->Rsrvd1= 0;
8795 pDst->FOP = 0;
8796 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8797 {
8798 pDst->aRegs[i].au32[0] = 0;
8799 pDst->aRegs[i].au32[1] = 0;
8800 pDst->aRegs[i].au32[2] = 0;
8801 pDst->aRegs[i].au32[3] = 0;
8802 }
8803 }
8804 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
8805 }
8806
8807 /* MXCSR */
8808 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8809 {
8810 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
8811 pDst->MXCSR = pSrc->MXCSR;
8812 else
8813 pDst->MXCSR = 0x1f80;
8814 }
8815
8816 /* XMM registers. */
8817 if (fReqComponents & XSAVE_C_SSE)
8818 {
8819 if (fRstorMask & XSAVE_C_SSE)
8820 {
8821 for (uint32_t i = 0; i < cXmmRegs; i++)
8822 pDst->aXMM[i] = pSrc->aXMM[i];
8823 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8824 * right? */
8825 }
8826 else
8827 {
8828 for (uint32_t i = 0; i < cXmmRegs; i++)
8829 {
8830 pDst->aXMM[i].au64[0] = 0;
8831 pDst->aXMM[i].au64[1] = 0;
8832 }
8833 }
8834 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
8835 }
8836
8837 /* Unmap the x87 state bits (so we've don't run out of mapping). */
8838 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8839 if (rcStrict != VINF_SUCCESS)
8840 return rcStrict;
8841
8842 /*
8843 * Restore AVX state.
8844 */
8845 if (fReqComponents & XSAVE_C_YMM)
8846 {
8847 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8848 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
8849
8850 if (fRstorMask & XSAVE_C_YMM)
8851 {
8852 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8853 PCX86XSAVEYMMHI pCompSrc;
8854 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
8855 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8856 IEM_ACCESS_DATA_R, 0 /* checked above */);
8857 if (rcStrict != VINF_SUCCESS)
8858 return rcStrict;
8859
8860 for (uint32_t i = 0; i < cXmmRegs; i++)
8861 {
8862 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
8863 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
8864 }
8865
8866 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
8867 if (rcStrict != VINF_SUCCESS)
8868 return rcStrict;
8869 }
8870 else
8871 {
8872 for (uint32_t i = 0; i < cXmmRegs; i++)
8873 {
8874 pCompDst->aYmmHi[i].au64[0] = 0;
8875 pCompDst->aYmmHi[i].au64[1] = 0;
8876 }
8877 }
8878 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
8879 }
8880
8881 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8882 return VINF_SUCCESS;
8883}
8884
8885
8886
8887
8888/**
8889 * Implements 'STMXCSR'.
8890 *
8891 * @param iEffSeg The effective segment register for @a GCPtrEff.
8892 * @param GCPtrEff The address of the image.
8893 */
8894IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8895{
8896 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8897
8898 /*
8899 * Raise exceptions.
8900 */
8901 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8902 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8903 {
8904 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8905 {
8906 /*
8907 * Do the job.
8908 */
8909 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
8910 if (rcStrict == VINF_SUCCESS)
8911 {
8912 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8913 return VINF_SUCCESS;
8914 }
8915 return rcStrict;
8916 }
8917 return iemRaiseDeviceNotAvailable(pVCpu);
8918 }
8919 return iemRaiseUndefinedOpcode(pVCpu);
8920}
8921
8922
8923/**
8924 * Implements 'VSTMXCSR'.
8925 *
8926 * @param iEffSeg The effective segment register for @a GCPtrEff.
8927 * @param GCPtrEff The address of the image.
8928 */
8929IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8930{
8931 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
8932
8933 /*
8934 * Raise exceptions.
8935 */
8936 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
8937 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
8938 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
8939 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8940 {
8941 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8942 {
8943 /*
8944 * Do the job.
8945 */
8946 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
8947 if (rcStrict == VINF_SUCCESS)
8948 {
8949 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8950 return VINF_SUCCESS;
8951 }
8952 return rcStrict;
8953 }
8954 return iemRaiseDeviceNotAvailable(pVCpu);
8955 }
8956 return iemRaiseUndefinedOpcode(pVCpu);
8957}
8958
8959
8960/**
8961 * Implements 'LDMXCSR'.
8962 *
8963 * @param iEffSeg The effective segment register for @a GCPtrEff.
8964 * @param GCPtrEff The address of the image.
8965 */
8966IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8967{
8968 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8969
8970 /*
8971 * Raise exceptions.
8972 */
8973 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
8974 * happen after or before \#UD and \#EM? */
8975 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8976 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8977 {
8978 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8979 {
8980 /*
8981 * Do the job.
8982 */
8983 uint32_t fNewMxCsr;
8984 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
8985 if (rcStrict == VINF_SUCCESS)
8986 {
8987 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8988 if (!(fNewMxCsr & ~fMxCsrMask))
8989 {
8990 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
8991 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8992 return VINF_SUCCESS;
8993 }
8994 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
8995 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
8996 return iemRaiseGeneralProtectionFault0(pVCpu);
8997 }
8998 return rcStrict;
8999 }
9000 return iemRaiseDeviceNotAvailable(pVCpu);
9001 }
9002 return iemRaiseUndefinedOpcode(pVCpu);
9003}
9004
9005
9006/**
9007 * Commmon routine for fnstenv and fnsave.
9008 *
9009 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9010 * @param enmEffOpSize The effective operand size.
9011 * @param uPtr Where to store the state.
9012 */
9013static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9014{
9015 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9016 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9017 if (enmEffOpSize == IEMMODE_16BIT)
9018 {
9019 uPtr.pu16[0] = pSrcX87->FCW;
9020 uPtr.pu16[1] = pSrcX87->FSW;
9021 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9022 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9023 {
9024 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9025 * protected mode or long mode and we save it in real mode? And vice
9026 * versa? And with 32-bit operand size? I think CPU is storing the
9027 * effective address ((CS << 4) + IP) in the offset register and not
9028 * doing any address calculations here. */
9029 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9030 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9031 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9032 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9033 }
9034 else
9035 {
9036 uPtr.pu16[3] = pSrcX87->FPUIP;
9037 uPtr.pu16[4] = pSrcX87->CS;
9038 uPtr.pu16[5] = pSrcX87->FPUDP;
9039 uPtr.pu16[6] = pSrcX87->DS;
9040 }
9041 }
9042 else
9043 {
9044 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9045 uPtr.pu16[0*2] = pSrcX87->FCW;
9046 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9047 uPtr.pu16[1*2] = pSrcX87->FSW;
9048 uPtr.pu16[1*2+1] = 0xffff;
9049 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9050 uPtr.pu16[2*2+1] = 0xffff;
9051 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9052 {
9053 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9054 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9055 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9056 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9057 }
9058 else
9059 {
9060 uPtr.pu32[3] = pSrcX87->FPUIP;
9061 uPtr.pu16[4*2] = pSrcX87->CS;
9062 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9063 uPtr.pu32[5] = pSrcX87->FPUDP;
9064 uPtr.pu16[6*2] = pSrcX87->DS;
9065 uPtr.pu16[6*2+1] = 0xffff;
9066 }
9067 }
9068}
9069
9070
9071/**
9072 * Commmon routine for fldenv and frstor
9073 *
9074 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9075 * @param enmEffOpSize The effective operand size.
9076 * @param uPtr Where to store the state.
9077 */
9078static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9079{
9080 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9081 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9082 if (enmEffOpSize == IEMMODE_16BIT)
9083 {
9084 pDstX87->FCW = uPtr.pu16[0];
9085 pDstX87->FSW = uPtr.pu16[1];
9086 pDstX87->FTW = uPtr.pu16[2];
9087 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9088 {
9089 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9090 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9091 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9092 pDstX87->CS = 0;
9093 pDstX87->Rsrvd1= 0;
9094 pDstX87->DS = 0;
9095 pDstX87->Rsrvd2= 0;
9096 }
9097 else
9098 {
9099 pDstX87->FPUIP = uPtr.pu16[3];
9100 pDstX87->CS = uPtr.pu16[4];
9101 pDstX87->Rsrvd1= 0;
9102 pDstX87->FPUDP = uPtr.pu16[5];
9103 pDstX87->DS = uPtr.pu16[6];
9104 pDstX87->Rsrvd2= 0;
9105 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9106 }
9107 }
9108 else
9109 {
9110 pDstX87->FCW = uPtr.pu16[0*2];
9111 pDstX87->FSW = uPtr.pu16[1*2];
9112 pDstX87->FTW = uPtr.pu16[2*2];
9113 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9114 {
9115 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9116 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9117 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9118 pDstX87->CS = 0;
9119 pDstX87->Rsrvd1= 0;
9120 pDstX87->DS = 0;
9121 pDstX87->Rsrvd2= 0;
9122 }
9123 else
9124 {
9125 pDstX87->FPUIP = uPtr.pu32[3];
9126 pDstX87->CS = uPtr.pu16[4*2];
9127 pDstX87->Rsrvd1= 0;
9128 pDstX87->FOP = uPtr.pu16[4*2+1];
9129 pDstX87->FPUDP = uPtr.pu32[5];
9130 pDstX87->DS = uPtr.pu16[6*2];
9131 pDstX87->Rsrvd2= 0;
9132 }
9133 }
9134
9135 /* Make adjustments. */
9136 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9137 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
9138 iemFpuRecalcExceptionStatus(pDstX87);
9139 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9140 * exceptions are pending after loading the saved state? */
9141}
9142
9143
9144/**
9145 * Implements 'FNSTENV'.
9146 *
9147 * @param enmEffOpSize The operand size (only REX.W really matters).
9148 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9149 * @param GCPtrEffDst The address of the image.
9150 */
9151IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9152{
9153 RTPTRUNION uPtr;
9154 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9155 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9156 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9157 if (rcStrict != VINF_SUCCESS)
9158 return rcStrict;
9159
9160 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9161
9162 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9163 if (rcStrict != VINF_SUCCESS)
9164 return rcStrict;
9165
9166 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9167 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9168 return VINF_SUCCESS;
9169}
9170
9171
9172/**
9173 * Implements 'FNSAVE'.
9174 *
9175 * @param enmEffOpSize The operand size.
9176 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9177 * @param GCPtrEffDst The address of the image.
9178 */
9179IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9180{
9181 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9182
9183 RTPTRUNION uPtr;
9184 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9185 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9186 if (rcStrict != VINF_SUCCESS)
9187 return rcStrict;
9188
9189 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9190 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9191 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9192 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9193 {
9194 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9195 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9196 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9197 }
9198
9199 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9200 if (rcStrict != VINF_SUCCESS)
9201 return rcStrict;
9202
9203 /*
9204 * Re-initialize the FPU context.
9205 */
9206 pFpuCtx->FCW = 0x37f;
9207 pFpuCtx->FSW = 0;
9208 pFpuCtx->FTW = 0x00; /* 0 - empty */
9209 pFpuCtx->FPUDP = 0;
9210 pFpuCtx->DS = 0;
9211 pFpuCtx->Rsrvd2= 0;
9212 pFpuCtx->FPUIP = 0;
9213 pFpuCtx->CS = 0;
9214 pFpuCtx->Rsrvd1= 0;
9215 pFpuCtx->FOP = 0;
9216
9217 iemHlpUsedFpu(pVCpu);
9218 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9219 return VINF_SUCCESS;
9220}
9221
9222
9223
9224/**
9225 * Implements 'FLDENV'.
9226 *
9227 * @param enmEffOpSize The operand size (only REX.W really matters).
9228 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9229 * @param GCPtrEffSrc The address of the image.
9230 */
9231IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9232{
9233 RTCPTRUNION uPtr;
9234 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9235 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9236 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9237 if (rcStrict != VINF_SUCCESS)
9238 return rcStrict;
9239
9240 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9241
9242 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9243 if (rcStrict != VINF_SUCCESS)
9244 return rcStrict;
9245
9246 iemHlpUsedFpu(pVCpu);
9247 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9248 return VINF_SUCCESS;
9249}
9250
9251
9252/**
9253 * Implements 'FRSTOR'.
9254 *
9255 * @param enmEffOpSize The operand size.
9256 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9257 * @param GCPtrEffSrc The address of the image.
9258 */
9259IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9260{
9261 RTCPTRUNION uPtr;
9262 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9263 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9264 if (rcStrict != VINF_SUCCESS)
9265 return rcStrict;
9266
9267 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9268 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9269 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9270 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9271 {
9272 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9273 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9274 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9275 pFpuCtx->aRegs[i].au32[3] = 0;
9276 }
9277
9278 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9279 if (rcStrict != VINF_SUCCESS)
9280 return rcStrict;
9281
9282 iemHlpUsedFpu(pVCpu);
9283 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9284 return VINF_SUCCESS;
9285}
9286
9287
9288/**
9289 * Implements 'FLDCW'.
9290 *
9291 * @param u16Fcw The new FCW.
9292 */
9293IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9294{
9295 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9296
9297 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9298 /** @todo Testcase: Try see what happens when trying to set undefined bits
9299 * (other than 6 and 7). Currently ignoring them. */
9300 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9301 * according to FSW. (This is was is currently implemented.) */
9302 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9303 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
9304 iemFpuRecalcExceptionStatus(pFpuCtx);
9305
9306 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9307 iemHlpUsedFpu(pVCpu);
9308 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9309 return VINF_SUCCESS;
9310}
9311
9312
9313
9314/**
9315 * Implements the underflow case of fxch.
9316 *
9317 * @param iStReg The other stack register.
9318 */
9319IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
9320{
9321 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9322
9323 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9324 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9325 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9326 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9327
9328 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9329 * registers are read as QNaN and then exchanged. This could be
9330 * wrong... */
9331 if (pFpuCtx->FCW & X86_FCW_IM)
9332 {
9333 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9334 {
9335 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9336 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9337 else
9338 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9339 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9340 }
9341 else
9342 {
9343 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9344 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9345 }
9346 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9347 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9348 }
9349 else
9350 {
9351 /* raise underflow exception, don't change anything. */
9352 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9353 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9354 }
9355
9356 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9357 iemHlpUsedFpu(pVCpu);
9358 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9359 return VINF_SUCCESS;
9360}
9361
9362
9363/**
9364 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9365 *
9366 * @param iStReg The other stack register.
9367 * @param pfnAImpl The assembly comparison implementation.
9368 * @param fPop Whether we should pop the stack when done or not.
9369 */
9370IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9371{
9372 Assert(iStReg < 8);
9373 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9374
9375 /*
9376 * Raise exceptions.
9377 */
9378 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9379 return iemRaiseDeviceNotAvailable(pVCpu);
9380
9381 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9382 uint16_t u16Fsw = pFpuCtx->FSW;
9383 if (u16Fsw & X86_FSW_ES)
9384 return iemRaiseMathFault(pVCpu);
9385
9386 /*
9387 * Check if any of the register accesses causes #SF + #IA.
9388 */
9389 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9390 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9391 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9392 {
9393 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9394 NOREF(u32Eflags);
9395
9396 pFpuCtx->FSW &= ~X86_FSW_C1;
9397 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9398 if ( !(u16Fsw & X86_FSW_IE)
9399 || (pFpuCtx->FCW & X86_FCW_IM) )
9400 {
9401 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9402 pVCpu->cpum.GstCtx.eflags.u |= pVCpu->cpum.GstCtx.eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9403 }
9404 }
9405 else if (pFpuCtx->FCW & X86_FCW_IM)
9406 {
9407 /* Masked underflow. */
9408 pFpuCtx->FSW &= ~X86_FSW_C1;
9409 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9410 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9411 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9412 }
9413 else
9414 {
9415 /* Raise underflow - don't touch EFLAGS or TOP. */
9416 pFpuCtx->FSW &= ~X86_FSW_C1;
9417 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9418 fPop = false;
9419 }
9420
9421 /*
9422 * Pop if necessary.
9423 */
9424 if (fPop)
9425 {
9426 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9427 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
9428 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
9429 }
9430
9431 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9432 iemHlpUsedFpu(pVCpu);
9433 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9434 return VINF_SUCCESS;
9435}
9436
9437/** @} */
9438
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette