VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 99327

Last change on this file since 99327 was 99220, checked in by vboxsync, 21 months ago

Disassember,*: Start separating the disassembler into a architecture specific and common part, bugref:10394
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 353.0 KB
Line 
1/* $Id: IEMAllCImpl.cpp 99220 2023-03-30 12:40:46Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#include <VBox/vmm/iem.h>
35#include <VBox/vmm/cpum.h>
36#include <VBox/vmm/apic.h>
37#include <VBox/vmm/pdm.h>
38#include <VBox/vmm/pgm.h>
39#include <VBox/vmm/iom.h>
40#include <VBox/vmm/em.h>
41#include <VBox/vmm/hm.h>
42#include <VBox/vmm/nem.h>
43#include <VBox/vmm/gim.h>
44#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
45# include <VBox/vmm/em.h>
46# include <VBox/vmm/hm_svm.h>
47#endif
48#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
49# include <VBox/vmm/hmvmxinline.h>
50#endif
51#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
52# include <VBox/vmm/cpuidcall.h>
53#endif
54#include <VBox/vmm/tm.h>
55#include <VBox/vmm/dbgf.h>
56#include <VBox/vmm/dbgftrace.h>
57#include "IEMInternal.h"
58#include <VBox/vmm/vmcc.h>
59#include <VBox/log.h>
60#include <VBox/err.h>
61#include <VBox/param.h>
62#include <VBox/dis.h>
63#include <iprt/asm-math.h>
64#include <iprt/assert.h>
65#include <iprt/string.h>
66#include <iprt/x86.h>
67
68#include "IEMInline.h"
69
70
71/*********************************************************************************************************************************
72* Defined Constants And Macros *
73*********************************************************************************************************************************/
74/**
75 * Flushes the prefetch buffer, light version.
76 */
77#ifndef IEM_WITH_CODE_TLB
78# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { (a_pVCpu)->iem.s.cbOpcode = (a_cbInstr); } while (0)
79#else
80# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { } while (0)
81#endif
82
83/**
84 * Flushes the prefetch buffer, heavy version.
85 */
86#ifndef IEM_WITH_CODE_TLB
87# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { (a_pVCpu)->iem.s.cbOpcode = (a_cbInstr); } while (0)
88#else
89# if 1
90# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { (a_pVCpu)->iem.s.pbInstrBuf = NULL; } while (0)
91# else
92# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { } while (0)
93# endif
94#endif
95
96
97
98/** @name Misc Helpers
99 * @{
100 */
101
102
103/**
104 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
105 *
106 * @returns Strict VBox status code.
107 *
108 * @param pVCpu The cross context virtual CPU structure of the calling thread.
109 * @param u16Port The port number.
110 * @param cbOperand The operand size.
111 */
112static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
113{
114 /* The TSS bits we're interested in are the same on 386 and AMD64. */
115 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
116 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
117 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
118 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
119
120 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
121
122 /*
123 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
124 */
125 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
126 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
127 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
128 {
129 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
130 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
131 return iemRaiseGeneralProtectionFault0(pVCpu);
132 }
133
134 /*
135 * Read the bitmap offset (may #PF).
136 */
137 uint16_t offBitmap;
138 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
139 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
140 if (rcStrict != VINF_SUCCESS)
141 {
142 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
143 return rcStrict;
144 }
145
146 /*
147 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
148 * describes the CPU actually reading two bytes regardless of whether the
149 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
150 */
151 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
152 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
153 * for instance sizeof(X86TSS32). */
154 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
155 {
156 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
157 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
158 return iemRaiseGeneralProtectionFault0(pVCpu);
159 }
160
161 /*
162 * Read the necessary bits.
163 */
164 /** @todo Test the assertion in the intel manual that the CPU reads two
165 * bytes. The question is how this works wrt to \#PF and \#GP on the
166 * 2nd byte when it's not required. */
167 uint16_t bmBytes = UINT16_MAX;
168 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
169 if (rcStrict != VINF_SUCCESS)
170 {
171 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
172 return rcStrict;
173 }
174
175 /*
176 * Perform the check.
177 */
178 uint16_t fPortMask = (1 << cbOperand) - 1;
179 bmBytes >>= (u16Port & 7);
180 if (bmBytes & fPortMask)
181 {
182 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
183 u16Port, cbOperand, bmBytes, fPortMask));
184 return iemRaiseGeneralProtectionFault0(pVCpu);
185 }
186
187 return VINF_SUCCESS;
188}
189
190
191/**
192 * Checks if we are allowed to access the given I/O port, raising the
193 * appropriate exceptions if we aren't (or if the I/O bitmap is not
194 * accessible).
195 *
196 * @returns Strict VBox status code.
197 *
198 * @param pVCpu The cross context virtual CPU structure of the calling thread.
199 * @param u16Port The port number.
200 * @param cbOperand The operand size.
201 */
202DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
203{
204 X86EFLAGS Efl;
205 Efl.u = IEMMISC_GET_EFL(pVCpu);
206 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
207 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
208 || Efl.Bits.u1VM) )
209 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
210 return VINF_SUCCESS;
211}
212
213
214#if 0
215/**
216 * Calculates the parity bit.
217 *
218 * @returns true if the bit is set, false if not.
219 * @param u8Result The least significant byte of the result.
220 */
221static bool iemHlpCalcParityFlag(uint8_t u8Result)
222{
223 /*
224 * Parity is set if the number of bits in the least significant byte of
225 * the result is even.
226 */
227 uint8_t cBits;
228 cBits = u8Result & 1; /* 0 */
229 u8Result >>= 1;
230 cBits += u8Result & 1;
231 u8Result >>= 1;
232 cBits += u8Result & 1;
233 u8Result >>= 1;
234 cBits += u8Result & 1;
235 u8Result >>= 1;
236 cBits += u8Result & 1; /* 4 */
237 u8Result >>= 1;
238 cBits += u8Result & 1;
239 u8Result >>= 1;
240 cBits += u8Result & 1;
241 u8Result >>= 1;
242 cBits += u8Result & 1;
243 return !(cBits & 1);
244}
245#endif /* not used */
246
247
248/**
249 * Updates the specified flags according to a 8-bit result.
250 *
251 * @param pVCpu The cross context virtual CPU structure of the calling thread.
252 * @param u8Result The result to set the flags according to.
253 * @param fToUpdate The flags to update.
254 * @param fUndefined The flags that are specified as undefined.
255 */
256static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
257{
258 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
259 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
260 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
261 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
262}
263
264
265/**
266 * Updates the specified flags according to a 16-bit result.
267 *
268 * @param pVCpu The cross context virtual CPU structure of the calling thread.
269 * @param u16Result The result to set the flags according to.
270 * @param fToUpdate The flags to update.
271 * @param fUndefined The flags that are specified as undefined.
272 */
273static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
274{
275 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
276 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
277 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
278 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
279}
280
281
282/**
283 * Helper used by iret.
284 *
285 * @param pVCpu The cross context virtual CPU structure of the calling thread.
286 * @param uCpl The new CPL.
287 * @param pSReg Pointer to the segment register.
288 */
289static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
290{
291 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
292 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
293
294 if ( uCpl > pSReg->Attr.n.u2Dpl
295 && pSReg->Attr.n.u1DescType /* code or data, not system */
296 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
297 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
298 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
299}
300
301
302/**
303 * Indicates that we have modified the FPU state.
304 *
305 * @param pVCpu The cross context virtual CPU structure of the calling thread.
306 */
307DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
308{
309 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
310}
311
312/** @} */
313
314/** @name C Implementations
315 * @{
316 */
317
318/**
319 * Implements a 16-bit popa.
320 */
321IEM_CIMPL_DEF_0(iemCImpl_popa_16)
322{
323 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
324 RTGCPTR GCPtrLast = GCPtrStart + 15;
325 VBOXSTRICTRC rcStrict;
326
327 /*
328 * The docs are a bit hard to comprehend here, but it looks like we wrap
329 * around in real mode as long as none of the individual "popa" crosses the
330 * end of the stack segment. In protected mode we check the whole access
331 * in one go. For efficiency, only do the word-by-word thing if we're in
332 * danger of wrapping around.
333 */
334 /** @todo do popa boundary / wrap-around checks. */
335 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
336 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
337 {
338 /* word-by-word */
339 RTUINT64U TmpRsp;
340 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
341 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
344 if (rcStrict == VINF_SUCCESS)
345 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
346 if (rcStrict == VINF_SUCCESS)
347 {
348 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
349 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
350 }
351 if (rcStrict == VINF_SUCCESS)
352 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
353 if (rcStrict == VINF_SUCCESS)
354 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
355 if (rcStrict == VINF_SUCCESS)
356 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
357 if (rcStrict == VINF_SUCCESS)
358 {
359 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
360 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
361 }
362 }
363 else
364 {
365 uint16_t const *pa16Mem = NULL;
366 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
367 if (rcStrict == VINF_SUCCESS)
368 {
369 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
370 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
371 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
372 /* skip sp */
373 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
374 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
375 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
376 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
377 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
378 if (rcStrict == VINF_SUCCESS)
379 {
380 iemRegAddToRsp(pVCpu, 16);
381 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
382 }
383 }
384 }
385 return rcStrict;
386}
387
388
389/**
390 * Implements a 32-bit popa.
391 */
392IEM_CIMPL_DEF_0(iemCImpl_popa_32)
393{
394 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
395 RTGCPTR GCPtrLast = GCPtrStart + 31;
396 VBOXSTRICTRC rcStrict;
397
398 /*
399 * The docs are a bit hard to comprehend here, but it looks like we wrap
400 * around in real mode as long as none of the individual "popa" crosses the
401 * end of the stack segment. In protected mode we check the whole access
402 * in one go. For efficiency, only do the word-by-word thing if we're in
403 * danger of wrapping around.
404 */
405 /** @todo do popa boundary / wrap-around checks. */
406 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
407 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
408 {
409 /* word-by-word */
410 RTUINT64U TmpRsp;
411 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
412 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
413 if (rcStrict == VINF_SUCCESS)
414 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
415 if (rcStrict == VINF_SUCCESS)
416 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
417 if (rcStrict == VINF_SUCCESS)
418 {
419 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
420 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
421 }
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
426 if (rcStrict == VINF_SUCCESS)
427 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
428 if (rcStrict == VINF_SUCCESS)
429 {
430#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
431 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
432 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
433 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
434 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
435 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
436 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
437 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
438#endif
439 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
440 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
441 }
442 }
443 else
444 {
445 uint32_t const *pa32Mem;
446 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
447 if (rcStrict == VINF_SUCCESS)
448 {
449 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
450 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
451 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
452 /* skip esp */
453 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
454 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
455 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
456 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
457 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
458 if (rcStrict == VINF_SUCCESS)
459 {
460 iemRegAddToRsp(pVCpu, 32);
461 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
462 }
463 }
464 }
465 return rcStrict;
466}
467
468
469/**
470 * Implements a 16-bit pusha.
471 */
472IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
473{
474 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
475 RTGCPTR GCPtrBottom = GCPtrTop - 15;
476 VBOXSTRICTRC rcStrict;
477
478 /*
479 * The docs are a bit hard to comprehend here, but it looks like we wrap
480 * around in real mode as long as none of the individual "pushd" crosses the
481 * end of the stack segment. In protected mode we check the whole access
482 * in one go. For efficiency, only do the word-by-word thing if we're in
483 * danger of wrapping around.
484 */
485 /** @todo do pusha boundary / wrap-around checks. */
486 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
487 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
488 {
489 /* word-by-word */
490 RTUINT64U TmpRsp;
491 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
492 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
493 if (rcStrict == VINF_SUCCESS)
494 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
495 if (rcStrict == VINF_SUCCESS)
496 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
497 if (rcStrict == VINF_SUCCESS)
498 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
499 if (rcStrict == VINF_SUCCESS)
500 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
501 if (rcStrict == VINF_SUCCESS)
502 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
503 if (rcStrict == VINF_SUCCESS)
504 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
505 if (rcStrict == VINF_SUCCESS)
506 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
507 if (rcStrict == VINF_SUCCESS)
508 {
509 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
510 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
511 }
512 }
513 else
514 {
515 GCPtrBottom--;
516 uint16_t *pa16Mem = NULL;
517 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
518 if (rcStrict == VINF_SUCCESS)
519 {
520 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
521 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
522 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
523 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
524 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
525 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
526 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
527 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
528 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
529 if (rcStrict == VINF_SUCCESS)
530 {
531 iemRegSubFromRsp(pVCpu, 16);
532 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
533 }
534 }
535 }
536 return rcStrict;
537}
538
539
540/**
541 * Implements a 32-bit pusha.
542 */
543IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
544{
545 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
546 RTGCPTR GCPtrBottom = GCPtrTop - 31;
547 VBOXSTRICTRC rcStrict;
548
549 /*
550 * The docs are a bit hard to comprehend here, but it looks like we wrap
551 * around in real mode as long as none of the individual "pusha" crosses the
552 * end of the stack segment. In protected mode we check the whole access
553 * in one go. For efficiency, only do the word-by-word thing if we're in
554 * danger of wrapping around.
555 */
556 /** @todo do pusha boundary / wrap-around checks. */
557 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
558 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
559 {
560 /* word-by-word */
561 RTUINT64U TmpRsp;
562 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
563 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
564 if (rcStrict == VINF_SUCCESS)
565 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
566 if (rcStrict == VINF_SUCCESS)
567 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
568 if (rcStrict == VINF_SUCCESS)
569 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
570 if (rcStrict == VINF_SUCCESS)
571 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
572 if (rcStrict == VINF_SUCCESS)
573 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
574 if (rcStrict == VINF_SUCCESS)
575 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
576 if (rcStrict == VINF_SUCCESS)
577 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
578 if (rcStrict == VINF_SUCCESS)
579 {
580 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
581 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
582 }
583 }
584 else
585 {
586 GCPtrBottom--;
587 uint32_t *pa32Mem;
588 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
589 if (rcStrict == VINF_SUCCESS)
590 {
591 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
592 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
593 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
594 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
595 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
596 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
597 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
598 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
599 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
600 if (rcStrict == VINF_SUCCESS)
601 {
602 iemRegSubFromRsp(pVCpu, 32);
603 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
604 }
605 }
606 }
607 return rcStrict;
608}
609
610
611/**
612 * Implements pushf.
613 *
614 *
615 * @param enmEffOpSize The effective operand size.
616 */
617IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
618{
619 VBOXSTRICTRC rcStrict;
620
621 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
622 {
623 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
624 IEM_SVM_UPDATE_NRIP(pVCpu);
625 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
626 }
627
628 /*
629 * If we're in V8086 mode some care is required (which is why we're in
630 * doing this in a C implementation).
631 */
632 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
633 if ( (fEfl & X86_EFL_VM)
634 && X86_EFL_GET_IOPL(fEfl) != 3 )
635 {
636 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
637 if ( enmEffOpSize != IEMMODE_16BIT
638 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
639 return iemRaiseGeneralProtectionFault0(pVCpu);
640 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
641 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
642 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
643 }
644 else
645 {
646
647 /*
648 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
649 */
650 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
651
652 switch (enmEffOpSize)
653 {
654 case IEMMODE_16BIT:
655 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
656 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
657 fEfl |= UINT16_C(0xf000);
658 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
659 break;
660 case IEMMODE_32BIT:
661 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
662 break;
663 case IEMMODE_64BIT:
664 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
665 break;
666 IEM_NOT_REACHED_DEFAULT_CASE_RET();
667 }
668 }
669
670 if (rcStrict == VINF_SUCCESS)
671 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
672 return rcStrict;
673}
674
675
676/**
677 * Implements popf.
678 *
679 * @param enmEffOpSize The effective operand size.
680 */
681IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
682{
683 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
684 VBOXSTRICTRC rcStrict;
685 uint32_t fEflNew;
686
687 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
688 {
689 Log2(("popf: Guest intercept -> #VMEXIT\n"));
690 IEM_SVM_UPDATE_NRIP(pVCpu);
691 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
692 }
693
694 /*
695 * V8086 is special as usual.
696 */
697 if (fEflOld & X86_EFL_VM)
698 {
699 /*
700 * Almost anything goes if IOPL is 3.
701 */
702 if (X86_EFL_GET_IOPL(fEflOld) == 3)
703 {
704 switch (enmEffOpSize)
705 {
706 case IEMMODE_16BIT:
707 {
708 uint16_t u16Value;
709 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
710 if (rcStrict != VINF_SUCCESS)
711 return rcStrict;
712 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
713 break;
714 }
715 case IEMMODE_32BIT:
716 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
717 if (rcStrict != VINF_SUCCESS)
718 return rcStrict;
719 break;
720 IEM_NOT_REACHED_DEFAULT_CASE_RET();
721 }
722
723 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
724 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
725 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
726 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
727 }
728 /*
729 * Interrupt flag virtualization with CR4.VME=1.
730 */
731 else if ( enmEffOpSize == IEMMODE_16BIT
732 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
733 {
734 uint16_t u16Value;
735 RTUINT64U TmpRsp;
736 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
737 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
738 if (rcStrict != VINF_SUCCESS)
739 return rcStrict;
740
741 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
742 * or before? */
743 if ( ( (u16Value & X86_EFL_IF)
744 && (fEflOld & X86_EFL_VIP))
745 || (u16Value & X86_EFL_TF) )
746 return iemRaiseGeneralProtectionFault0(pVCpu);
747
748 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
749 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
750 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
751 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
752
753 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
754 }
755 else
756 return iemRaiseGeneralProtectionFault0(pVCpu);
757
758 }
759 /*
760 * Not in V8086 mode.
761 */
762 else
763 {
764 /* Pop the flags. */
765 switch (enmEffOpSize)
766 {
767 case IEMMODE_16BIT:
768 {
769 uint16_t u16Value;
770 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
771 if (rcStrict != VINF_SUCCESS)
772 return rcStrict;
773 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
774
775 /*
776 * Ancient CPU adjustments:
777 * - 8086, 80186, V20/30:
778 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
779 * practical reasons (masking below). We add them when pushing flags.
780 * - 80286:
781 * The NT and IOPL flags cannot be popped from real mode and are
782 * therefore always zero (since a 286 can never exit from PM and
783 * their initial value is zero). This changed on a 386 and can
784 * therefore be used to detect 286 or 386 CPU in real mode.
785 */
786 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
787 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
788 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
789 break;
790 }
791 case IEMMODE_32BIT:
792 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
793 if (rcStrict != VINF_SUCCESS)
794 return rcStrict;
795 break;
796 case IEMMODE_64BIT:
797 {
798 uint64_t u64Value;
799 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
800 if (rcStrict != VINF_SUCCESS)
801 return rcStrict;
802 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
803 break;
804 }
805 IEM_NOT_REACHED_DEFAULT_CASE_RET();
806 }
807
808 /* Merge them with the current flags. */
809 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
810 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
811 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
812 || pVCpu->iem.s.uCpl == 0)
813 {
814 fEflNew &= fPopfBits;
815 fEflNew |= ~fPopfBits & fEflOld;
816 }
817 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
818 {
819 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
820 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
821 }
822 else
823 {
824 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
825 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
826 }
827 }
828
829 /*
830 * Commit the flags.
831 */
832 Assert(fEflNew & RT_BIT_32(1));
833 IEMMISC_SET_EFL(pVCpu, fEflNew);
834 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
835}
836
837
838/**
839 * Implements an indirect call.
840 *
841 * @param uNewPC The new program counter (RIP) value (loaded from the
842 * operand).
843 */
844IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
845{
846 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
847 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
848 {
849 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
850 if (rcStrict == VINF_SUCCESS)
851 {
852 pVCpu->cpum.GstCtx.rip = uNewPC;
853 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
854 return iemRegFinishClearingRF(pVCpu);
855 }
856 return rcStrict;
857 }
858 return iemRaiseGeneralProtectionFault0(pVCpu);
859}
860
861
862/**
863 * Implements a 16-bit relative call.
864 *
865 * @param offDisp The displacment offset.
866 */
867IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
868{
869 uint16_t const uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
870 uint16_t const uNewPC = uOldPC + offDisp;
871 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
872 {
873 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
874 if (rcStrict == VINF_SUCCESS)
875 {
876 pVCpu->cpum.GstCtx.rip = uNewPC;
877 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
878 return iemRegFinishClearingRF(pVCpu);
879 }
880 return rcStrict;
881 }
882 return iemRaiseGeneralProtectionFault0(pVCpu);
883}
884
885
886/**
887 * Implements a 32-bit indirect call.
888 *
889 * @param uNewPC The new program counter (RIP) value (loaded from the
890 * operand).
891 */
892IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
893{
894 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
895 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
896 {
897 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
898 if (rcStrict == VINF_SUCCESS)
899 {
900 pVCpu->cpum.GstCtx.rip = uNewPC;
901 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
902 return iemRegFinishClearingRF(pVCpu);
903 }
904 return rcStrict;
905 }
906 return iemRaiseGeneralProtectionFault0(pVCpu);
907}
908
909
910/**
911 * Implements a 32-bit relative call.
912 *
913 * @param offDisp The displacment offset.
914 */
915IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
916{
917 uint32_t const uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
918 uint32_t const uNewPC = uOldPC + offDisp;
919 if (uNewPC <= pVCpu->cpum.GstCtx.cs.u32Limit)
920 {
921 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
922 if (rcStrict == VINF_SUCCESS)
923 {
924 pVCpu->cpum.GstCtx.rip = uNewPC;
925 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
926 return iemRegFinishClearingRF(pVCpu);
927 }
928 return rcStrict;
929 }
930 return iemRaiseGeneralProtectionFault0(pVCpu);
931}
932
933
934/**
935 * Implements a 64-bit indirect call.
936 *
937 * @param uNewPC The new program counter (RIP) value (loaded from the
938 * operand).
939 */
940IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
941{
942 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
943 if (IEM_IS_CANONICAL(uNewPC))
944 {
945 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
946 if (rcStrict == VINF_SUCCESS)
947 {
948 pVCpu->cpum.GstCtx.rip = uNewPC;
949 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
950 return iemRegFinishClearingRF(pVCpu);
951 }
952 return rcStrict;
953 }
954 return iemRaiseGeneralProtectionFault0(pVCpu);
955}
956
957
958/**
959 * Implements a 64-bit relative call.
960 *
961 * @param offDisp The displacment offset.
962 */
963IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
964{
965 uint64_t const uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
966 uint64_t const uNewPC = uOldPC + offDisp;
967 if (IEM_IS_CANONICAL(uNewPC))
968 {
969 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
970 if (rcStrict == VINF_SUCCESS)
971 {
972 pVCpu->cpum.GstCtx.rip = uNewPC;
973 IEM_FLUSH_PREFETCH_LIGHT(pVCpu, cbInstr);
974 return iemRegFinishClearingRF(pVCpu);
975 }
976 return rcStrict;
977 }
978 return iemRaiseNotCanonical(pVCpu);
979}
980
981
982/**
983 * Implements far jumps and calls thru task segments (TSS).
984 *
985 * @returns VBox strict status code.
986 * @param pVCpu The cross context virtual CPU structure of the
987 * calling thread.
988 * @param cbInstr The current instruction length.
989 * @param uSel The selector.
990 * @param enmBranch The kind of branching we're performing.
991 * @param enmEffOpSize The effective operand size.
992 * @param pDesc The descriptor corresponding to @a uSel. The type is
993 * task gate.
994 */
995static VBOXSTRICTRC iemCImpl_BranchTaskSegment(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
996 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
997{
998#ifndef IEM_IMPLEMENTS_TASKSWITCH
999 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1000#else
1001 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1002 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
1003 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
1004 RT_NOREF_PV(enmEffOpSize);
1005 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1006
1007 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1008 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1009 {
1010 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1011 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1012 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1013 }
1014
1015 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1016 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1017 * checked here, need testcases. */
1018 if (!pDesc->Legacy.Gen.u1Present)
1019 {
1020 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1021 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1022 }
1023
1024 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1025 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1026 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1027#endif
1028}
1029
1030
1031/**
1032 * Implements far jumps and calls thru task gates.
1033 *
1034 * @returns VBox strict status code.
1035 * @param pVCpu The cross context virtual CPU structure of the
1036 * calling thread.
1037 * @param cbInstr The current instruction length.
1038 * @param uSel The selector.
1039 * @param enmBranch The kind of branching we're performing.
1040 * @param enmEffOpSize The effective operand size.
1041 * @param pDesc The descriptor corresponding to @a uSel. The type is
1042 * task gate.
1043 */
1044static VBOXSTRICTRC iemCImpl_BranchTaskGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1045 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1046{
1047#ifndef IEM_IMPLEMENTS_TASKSWITCH
1048 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1049#else
1050 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1051 RT_NOREF_PV(enmEffOpSize);
1052 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1053
1054 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1055 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1056 {
1057 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1058 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1059 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1060 }
1061
1062 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1063 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1064 * checked here, need testcases. */
1065 if (!pDesc->Legacy.Gen.u1Present)
1066 {
1067 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1068 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1069 }
1070
1071 /*
1072 * Fetch the new TSS descriptor from the GDT.
1073 */
1074 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1075 if (uSelTss & X86_SEL_LDT)
1076 {
1077 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1078 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1079 }
1080
1081 IEMSELDESC TssDesc;
1082 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1083 if (rcStrict != VINF_SUCCESS)
1084 return rcStrict;
1085
1086 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1087 {
1088 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1089 TssDesc.Legacy.Gate.u4Type));
1090 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1091 }
1092
1093 if (!TssDesc.Legacy.Gate.u1Present)
1094 {
1095 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1096 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1097 }
1098
1099 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1100 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1101 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1102#endif
1103}
1104
1105
1106/**
1107 * Implements far jumps and calls thru call gates.
1108 *
1109 * @returns VBox strict status code.
1110 * @param pVCpu The cross context virtual CPU structure of the
1111 * calling thread.
1112 * @param cbInstr The current instruction length.
1113 * @param uSel The selector.
1114 * @param enmBranch The kind of branching we're performing.
1115 * @param enmEffOpSize The effective operand size.
1116 * @param pDesc The descriptor corresponding to @a uSel. The type is
1117 * call gate.
1118 */
1119static VBOXSTRICTRC iemCImpl_BranchCallGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1120 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1121{
1122#define IEM_IMPLEMENTS_CALLGATE
1123#ifndef IEM_IMPLEMENTS_CALLGATE
1124 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1125#else
1126 RT_NOREF_PV(enmEffOpSize);
1127 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1128
1129 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1130 * inter-privilege calls and are much more complex.
1131 *
1132 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1133 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1134 * must be 16-bit or 32-bit.
1135 */
1136 /** @todo effective operand size is probably irrelevant here, only the
1137 * call gate bitness matters??
1138 */
1139 VBOXSTRICTRC rcStrict;
1140 RTPTRUNION uPtrRet;
1141 uint64_t uNewRsp;
1142 uint64_t uNewRip;
1143 uint64_t u64Base;
1144 uint32_t cbLimit;
1145 RTSEL uNewCS;
1146 IEMSELDESC DescCS;
1147
1148 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1149 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1150 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1151 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1152
1153 /* Determine the new instruction pointer from the gate descriptor. */
1154 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1155 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1156 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1157
1158 /* Perform DPL checks on the gate descriptor. */
1159 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1160 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1161 {
1162 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1163 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1164 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1165 }
1166
1167 /** @todo does this catch NULL selectors, too? */
1168 if (!pDesc->Legacy.Gen.u1Present)
1169 {
1170 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1171 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1172 }
1173
1174 /*
1175 * Fetch the target CS descriptor from the GDT or LDT.
1176 */
1177 uNewCS = pDesc->Legacy.Gate.u16Sel;
1178 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1179 if (rcStrict != VINF_SUCCESS)
1180 return rcStrict;
1181
1182 /* Target CS must be a code selector. */
1183 if ( !DescCS.Legacy.Gen.u1DescType
1184 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1185 {
1186 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1187 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1188 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1189 }
1190
1191 /* Privilege checks on target CS. */
1192 if (enmBranch == IEMBRANCH_JUMP)
1193 {
1194 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1195 {
1196 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1197 {
1198 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1199 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1200 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1201 }
1202 }
1203 else
1204 {
1205 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1206 {
1207 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1208 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1209 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1210 }
1211 }
1212 }
1213 else
1214 {
1215 Assert(enmBranch == IEMBRANCH_CALL);
1216 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1217 {
1218 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1219 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1220 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1221 }
1222 }
1223
1224 /* Additional long mode checks. */
1225 if (IEM_IS_LONG_MODE(pVCpu))
1226 {
1227 if (!DescCS.Legacy.Gen.u1Long)
1228 {
1229 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1230 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1231 }
1232
1233 /* L vs D. */
1234 if ( DescCS.Legacy.Gen.u1Long
1235 && DescCS.Legacy.Gen.u1DefBig)
1236 {
1237 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1238 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1239 }
1240 }
1241
1242 if (!DescCS.Legacy.Gate.u1Present)
1243 {
1244 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1245 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1246 }
1247
1248 if (enmBranch == IEMBRANCH_JUMP)
1249 {
1250 /** @todo This is very similar to regular far jumps; merge! */
1251 /* Jumps are fairly simple... */
1252
1253 /* Chop the high bits off if 16-bit gate (Intel says so). */
1254 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1255 uNewRip = (uint16_t)uNewRip;
1256
1257 /* Limit check for non-long segments. */
1258 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1259 if (DescCS.Legacy.Gen.u1Long)
1260 u64Base = 0;
1261 else
1262 {
1263 if (uNewRip > cbLimit)
1264 {
1265 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1266 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1267 }
1268 u64Base = X86DESC_BASE(&DescCS.Legacy);
1269 }
1270
1271 /* Canonical address check. */
1272 if (!IEM_IS_CANONICAL(uNewRip))
1273 {
1274 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1275 return iemRaiseNotCanonical(pVCpu);
1276 }
1277
1278 /*
1279 * Ok, everything checked out fine. Now set the accessed bit before
1280 * committing the result into CS, CSHID and RIP.
1281 */
1282 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1283 {
1284 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1285 if (rcStrict != VINF_SUCCESS)
1286 return rcStrict;
1287 /** @todo check what VT-x and AMD-V does. */
1288 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1289 }
1290
1291 /* commit */
1292 pVCpu->cpum.GstCtx.rip = uNewRip;
1293 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1294 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1295 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1296 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1297 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1298 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1299 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1300 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1301 }
1302 else
1303 {
1304 Assert(enmBranch == IEMBRANCH_CALL);
1305 /* Calls are much more complicated. */
1306
1307 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1308 {
1309 uint16_t offNewStack; /* Offset of new stack in TSS. */
1310 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1311 uint8_t uNewCSDpl;
1312 uint8_t cbWords;
1313 RTSEL uNewSS;
1314 RTSEL uOldSS;
1315 uint64_t uOldRsp;
1316 IEMSELDESC DescSS;
1317 RTPTRUNION uPtrTSS;
1318 RTGCPTR GCPtrTSS;
1319 RTPTRUNION uPtrParmWds;
1320 RTGCPTR GCPtrParmWds;
1321
1322 /* More privilege. This is the fun part. */
1323 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1324
1325 /*
1326 * Determine new SS:rSP from the TSS.
1327 */
1328 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1329
1330 /* Figure out where the new stack pointer is stored in the TSS. */
1331 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1332 if (!IEM_IS_LONG_MODE(pVCpu))
1333 {
1334 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1335 {
1336 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1337 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1338 }
1339 else
1340 {
1341 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1342 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1343 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1344 }
1345 }
1346 else
1347 {
1348 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1349 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1350 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1351 }
1352
1353 /* Check against TSS limit. */
1354 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1355 {
1356 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1357 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1358 }
1359
1360 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1361 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
1362 if (rcStrict != VINF_SUCCESS)
1363 {
1364 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1365 return rcStrict;
1366 }
1367
1368 if (!IEM_IS_LONG_MODE(pVCpu))
1369 {
1370 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1371 {
1372 uNewRsp = uPtrTSS.pu32[0];
1373 uNewSS = uPtrTSS.pu16[2];
1374 }
1375 else
1376 {
1377 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1378 uNewRsp = uPtrTSS.pu16[0];
1379 uNewSS = uPtrTSS.pu16[1];
1380 }
1381 }
1382 else
1383 {
1384 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1385 /* SS will be a NULL selector, but that's valid. */
1386 uNewRsp = uPtrTSS.pu64[0];
1387 uNewSS = uNewCSDpl;
1388 }
1389
1390 /* Done with the TSS now. */
1391 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1392 if (rcStrict != VINF_SUCCESS)
1393 {
1394 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1395 return rcStrict;
1396 }
1397
1398 /* Only used outside of long mode. */
1399 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1400
1401 /* If EFER.LMA is 0, there's extra work to do. */
1402 if (!IEM_IS_LONG_MODE(pVCpu))
1403 {
1404 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1405 {
1406 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1407 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1408 }
1409
1410 /* Grab the new SS descriptor. */
1411 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1412 if (rcStrict != VINF_SUCCESS)
1413 return rcStrict;
1414
1415 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1416 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1417 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1418 {
1419 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1420 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1421 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1422 }
1423
1424 /* Ensure new SS is a writable data segment. */
1425 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1426 {
1427 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1428 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1429 }
1430
1431 if (!DescSS.Legacy.Gen.u1Present)
1432 {
1433 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1434 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1435 }
1436 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1437 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1438 else
1439 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1440 }
1441 else
1442 {
1443 /* Just grab the new (NULL) SS descriptor. */
1444 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1445 * like we do... */
1446 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1447 if (rcStrict != VINF_SUCCESS)
1448 return rcStrict;
1449
1450 cbNewStack = sizeof(uint64_t) * 4;
1451 }
1452
1453 /** @todo According to Intel, new stack is checked for enough space first,
1454 * then switched. According to AMD, the stack is switched first and
1455 * then pushes might fault!
1456 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1457 * incoming stack \#PF happens before actual stack switch. AMD is
1458 * either lying or implicitly assumes that new state is committed
1459 * only if and when an instruction doesn't fault.
1460 */
1461
1462 /** @todo According to AMD, CS is loaded first, then SS.
1463 * According to Intel, it's the other way around!?
1464 */
1465
1466 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1467
1468 /* Set the accessed bit before committing new SS. */
1469 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1470 {
1471 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1472 if (rcStrict != VINF_SUCCESS)
1473 return rcStrict;
1474 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1475 }
1476
1477 /* Remember the old SS:rSP and their linear address. */
1478 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1479 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1480
1481 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1482
1483 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1484 or #PF, the former is not implemented in this workaround. */
1485 /** @todo Proper fix callgate target stack exceptions. */
1486 /** @todo testcase: Cover callgates with partially or fully inaccessible
1487 * target stacks. */
1488 void *pvNewFrame;
1489 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1490 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1491 if (rcStrict != VINF_SUCCESS)
1492 {
1493 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1494 return rcStrict;
1495 }
1496 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1497 if (rcStrict != VINF_SUCCESS)
1498 {
1499 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1500 return rcStrict;
1501 }
1502
1503 /* Commit new SS:rSP. */
1504 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1505 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1506 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1507 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1508 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1509 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1510 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1511 pVCpu->iem.s.uCpl = uNewCSDpl; /** @todo is the parameter words accessed using the new CPL or the old CPL? */
1512 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1513 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1514
1515 /* At this point the stack access must not fail because new state was already committed. */
1516 /** @todo this can still fail due to SS.LIMIT not check. */
1517 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1518 IEM_IS_LONG_MODE(pVCpu) ? 7
1519 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1520 &uPtrRet.pv, &uNewRsp);
1521 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1522 VERR_INTERNAL_ERROR_5);
1523
1524 if (!IEM_IS_LONG_MODE(pVCpu))
1525 {
1526 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1527 {
1528 if (cbWords)
1529 {
1530 /* Map the relevant chunk of the old stack. */
1531 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1532 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1533 if (rcStrict != VINF_SUCCESS)
1534 {
1535 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1536 return rcStrict;
1537 }
1538
1539 /* Copy the parameter (d)words. */
1540 for (int i = 0; i < cbWords; ++i)
1541 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1542
1543 /* Unmap the old stack. */
1544 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1545 if (rcStrict != VINF_SUCCESS)
1546 {
1547 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1548 return rcStrict;
1549 }
1550 }
1551
1552 /* Push the old CS:rIP. */
1553 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1554 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1555
1556 /* Push the old SS:rSP. */
1557 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1558 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1559 }
1560 else
1561 {
1562 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1563
1564 if (cbWords)
1565 {
1566 /* Map the relevant chunk of the old stack. */
1567 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1568 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1569 if (rcStrict != VINF_SUCCESS)
1570 {
1571 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1572 return rcStrict;
1573 }
1574
1575 /* Copy the parameter words. */
1576 for (int i = 0; i < cbWords; ++i)
1577 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1578
1579 /* Unmap the old stack. */
1580 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1581 if (rcStrict != VINF_SUCCESS)
1582 {
1583 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1584 return rcStrict;
1585 }
1586 }
1587
1588 /* Push the old CS:rIP. */
1589 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1590 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1591
1592 /* Push the old SS:rSP. */
1593 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1594 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1595 }
1596 }
1597 else
1598 {
1599 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1600
1601 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1602 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1603 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1604 uPtrRet.pu64[2] = uOldRsp;
1605 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1606 }
1607
1608 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1609 if (rcStrict != VINF_SUCCESS)
1610 {
1611 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1612 return rcStrict;
1613 }
1614
1615 /* Chop the high bits off if 16-bit gate (Intel says so). */
1616 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1617 uNewRip = (uint16_t)uNewRip;
1618
1619 /* Limit / canonical check. */
1620 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1621 if (!IEM_IS_LONG_MODE(pVCpu))
1622 {
1623 if (uNewRip > cbLimit)
1624 {
1625 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1626 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1627 }
1628 u64Base = X86DESC_BASE(&DescCS.Legacy);
1629 }
1630 else
1631 {
1632 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1633 if (!IEM_IS_CANONICAL(uNewRip))
1634 {
1635 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1636 return iemRaiseNotCanonical(pVCpu);
1637 }
1638 u64Base = 0;
1639 }
1640
1641 /*
1642 * Now set the accessed bit before
1643 * writing the return address to the stack and committing the result into
1644 * CS, CSHID and RIP.
1645 */
1646 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1647 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1648 {
1649 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1650 if (rcStrict != VINF_SUCCESS)
1651 return rcStrict;
1652 /** @todo check what VT-x and AMD-V does. */
1653 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1654 }
1655
1656 /* Commit new CS:rIP. */
1657 pVCpu->cpum.GstCtx.rip = uNewRip;
1658 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1659 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1660 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1661 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1662 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1663 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1664 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1665 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1666 }
1667 else
1668 {
1669 /* Same privilege. */
1670 /** @todo This is very similar to regular far calls; merge! */
1671
1672 /* Check stack first - may #SS(0). */
1673 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1674 * 16-bit code cause a two or four byte CS to be pushed? */
1675 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1676 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1677 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1678 IEM_IS_LONG_MODE(pVCpu) ? 7
1679 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1680 &uPtrRet.pv, &uNewRsp);
1681 if (rcStrict != VINF_SUCCESS)
1682 return rcStrict;
1683
1684 /* Chop the high bits off if 16-bit gate (Intel says so). */
1685 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1686 uNewRip = (uint16_t)uNewRip;
1687
1688 /* Limit / canonical check. */
1689 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1690 if (!IEM_IS_LONG_MODE(pVCpu))
1691 {
1692 if (uNewRip > cbLimit)
1693 {
1694 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1695 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1696 }
1697 u64Base = X86DESC_BASE(&DescCS.Legacy);
1698 }
1699 else
1700 {
1701 if (!IEM_IS_CANONICAL(uNewRip))
1702 {
1703 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1704 return iemRaiseNotCanonical(pVCpu);
1705 }
1706 u64Base = 0;
1707 }
1708
1709 /*
1710 * Now set the accessed bit before
1711 * writing the return address to the stack and committing the result into
1712 * CS, CSHID and RIP.
1713 */
1714 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1715 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1716 {
1717 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1718 if (rcStrict != VINF_SUCCESS)
1719 return rcStrict;
1720 /** @todo check what VT-x and AMD-V does. */
1721 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1722 }
1723
1724 /* stack */
1725 if (!IEM_IS_LONG_MODE(pVCpu))
1726 {
1727 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1728 {
1729 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1730 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1731 }
1732 else
1733 {
1734 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1735 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1736 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1737 }
1738 }
1739 else
1740 {
1741 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1742 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1743 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1744 }
1745
1746 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1747 if (rcStrict != VINF_SUCCESS)
1748 return rcStrict;
1749
1750 /* commit */
1751 pVCpu->cpum.GstCtx.rip = uNewRip;
1752 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1753 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1754 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1755 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1756 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1757 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1758 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1759 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1760 }
1761 }
1762 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1763/** @todo single stepping */
1764
1765 /* Flush the prefetch buffer. */
1766 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1767 return VINF_SUCCESS;
1768#endif /* IEM_IMPLEMENTS_CALLGATE */
1769}
1770
1771
1772/**
1773 * Implements far jumps and calls thru system selectors.
1774 *
1775 * @returns VBox strict status code.
1776 * @param pVCpu The cross context virtual CPU structure of the
1777 * calling thread.
1778 * @param cbInstr The current instruction length.
1779 * @param uSel The selector.
1780 * @param enmBranch The kind of branching we're performing.
1781 * @param enmEffOpSize The effective operand size.
1782 * @param pDesc The descriptor corresponding to @a uSel.
1783 */
1784static VBOXSTRICTRC iemCImpl_BranchSysSel(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1785 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1786{
1787 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1788 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1789 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1790
1791 if (IEM_IS_LONG_MODE(pVCpu))
1792 switch (pDesc->Legacy.Gen.u4Type)
1793 {
1794 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1795 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1796
1797 default:
1798 case AMD64_SEL_TYPE_SYS_LDT:
1799 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1800 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1801 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1802 case AMD64_SEL_TYPE_SYS_INT_GATE:
1803 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1804 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1805 }
1806
1807 switch (pDesc->Legacy.Gen.u4Type)
1808 {
1809 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1810 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1811 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1812
1813 case X86_SEL_TYPE_SYS_TASK_GATE:
1814 return iemCImpl_BranchTaskGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1815
1816 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1817 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1818 return iemCImpl_BranchTaskSegment(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1819
1820 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1821 Log(("branch %04x -> busy 286 TSS\n", uSel));
1822 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1823
1824 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1825 Log(("branch %04x -> busy 386 TSS\n", uSel));
1826 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1827
1828 default:
1829 case X86_SEL_TYPE_SYS_LDT:
1830 case X86_SEL_TYPE_SYS_286_INT_GATE:
1831 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1832 case X86_SEL_TYPE_SYS_386_INT_GATE:
1833 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1834 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1835 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1836 }
1837}
1838
1839
1840/**
1841 * Implements far jumps.
1842 *
1843 * @param uSel The selector.
1844 * @param offSeg The segment offset.
1845 * @param enmEffOpSize The effective operand size.
1846 */
1847IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1848{
1849 NOREF(cbInstr);
1850 Assert(offSeg <= UINT32_MAX || (!IEM_IS_GUEST_CPU_AMD(pVCpu) && pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT));
1851
1852 /*
1853 * Real mode and V8086 mode are easy. The only snag seems to be that
1854 * CS.limit doesn't change and the limit check is done against the current
1855 * limit.
1856 */
1857 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1858 * 1998) that up to and including the Intel 486, far control
1859 * transfers in real mode set default CS attributes (0x93) and also
1860 * set a 64K segment limit. Starting with the Pentium, the
1861 * attributes and limit are left alone but the access rights are
1862 * ignored. We only implement the Pentium+ behavior.
1863 * */
1864 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1865 {
1866 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1867 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1868 {
1869 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1870 return iemRaiseGeneralProtectionFault0(pVCpu);
1871 }
1872
1873 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1874 pVCpu->cpum.GstCtx.rip = offSeg;
1875 else
1876 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1877 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1878 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1879 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1880 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1881
1882 return iemRegFinishClearingRF(pVCpu);
1883 }
1884
1885 /*
1886 * Protected mode. Need to parse the specified descriptor...
1887 */
1888 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1889 {
1890 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1891 return iemRaiseGeneralProtectionFault0(pVCpu);
1892 }
1893
1894 /* Fetch the descriptor. */
1895 IEMSELDESC Desc;
1896 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1897 if (rcStrict != VINF_SUCCESS)
1898 return rcStrict;
1899
1900 /* Is it there? */
1901 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1902 {
1903 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1904 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1905 }
1906
1907 /*
1908 * Deal with it according to its type. We do the standard code selectors
1909 * here and dispatch the system selectors to worker functions.
1910 */
1911 if (!Desc.Legacy.Gen.u1DescType)
1912 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1913
1914 /* Only code segments. */
1915 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1916 {
1917 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1918 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1919 }
1920
1921 /* L vs D. */
1922 if ( Desc.Legacy.Gen.u1Long
1923 && Desc.Legacy.Gen.u1DefBig
1924 && IEM_IS_LONG_MODE(pVCpu))
1925 {
1926 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1927 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1928 }
1929
1930 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1931 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1932 {
1933 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1934 {
1935 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1936 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1937 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1938 }
1939 }
1940 else
1941 {
1942 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1943 {
1944 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1945 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1946 }
1947 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1948 {
1949 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1950 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1951 }
1952 }
1953
1954 /* Chop the high bits if 16-bit (Intel says so). */
1955 if (enmEffOpSize == IEMMODE_16BIT)
1956 offSeg &= UINT16_MAX;
1957
1958 /* Limit check and get the base. */
1959 uint64_t u64Base;
1960 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1961 if ( !Desc.Legacy.Gen.u1Long
1962 || !IEM_IS_LONG_MODE(pVCpu))
1963 {
1964 if (RT_LIKELY(offSeg <= cbLimit))
1965 u64Base = X86DESC_BASE(&Desc.Legacy);
1966 else
1967 {
1968 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1969 /** @todo Intel says this is \#GP(0)! */
1970 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1971 }
1972 }
1973 else
1974 u64Base = 0;
1975
1976 /*
1977 * Ok, everything checked out fine. Now set the accessed bit before
1978 * committing the result into CS, CSHID and RIP.
1979 */
1980 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1981 {
1982 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1983 if (rcStrict != VINF_SUCCESS)
1984 return rcStrict;
1985 /** @todo check what VT-x and AMD-V does. */
1986 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1987 }
1988
1989 /* commit */
1990 pVCpu->cpum.GstCtx.rip = offSeg;
1991 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1992 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1993 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1994 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1995 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1996 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1997 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1998 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1999 /** @todo check if the hidden bits are loaded correctly for 64-bit
2000 * mode. */
2001
2002 /* Flush the prefetch buffer. */
2003 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2004
2005 return iemRegFinishClearingRF(pVCpu);
2006}
2007
2008
2009/**
2010 * Implements far calls.
2011 *
2012 * This very similar to iemCImpl_FarJmp.
2013 *
2014 * @param uSel The selector.
2015 * @param offSeg The segment offset.
2016 * @param enmEffOpSize The operand size (in case we need it).
2017 */
2018IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
2019{
2020 VBOXSTRICTRC rcStrict;
2021 uint64_t uNewRsp;
2022 RTPTRUNION uPtrRet;
2023
2024 /*
2025 * Real mode and V8086 mode are easy. The only snag seems to be that
2026 * CS.limit doesn't change and the limit check is done against the current
2027 * limit.
2028 */
2029 /** @todo See comment for similar code in iemCImpl_FarJmp */
2030 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2031 {
2032 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2033
2034 /* Check stack first - may #SS(0). */
2035 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2036 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2037 &uPtrRet.pv, &uNewRsp);
2038 if (rcStrict != VINF_SUCCESS)
2039 return rcStrict;
2040
2041 /* Check the target address range. */
2042/** @todo this must be wrong! Write unreal mode tests! */
2043 if (offSeg > UINT32_MAX)
2044 return iemRaiseGeneralProtectionFault0(pVCpu);
2045
2046 /* Everything is fine, push the return address. */
2047 if (enmEffOpSize == IEMMODE_16BIT)
2048 {
2049 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2050 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2051 }
2052 else
2053 {
2054 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2055 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2056 }
2057 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2058 if (rcStrict != VINF_SUCCESS)
2059 return rcStrict;
2060
2061 /* Branch. */
2062 pVCpu->cpum.GstCtx.rip = offSeg;
2063 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2064 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2065 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2066 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2067
2068 return iemRegFinishClearingRF(pVCpu);
2069 }
2070
2071 /*
2072 * Protected mode. Need to parse the specified descriptor...
2073 */
2074 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2075 {
2076 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2077 return iemRaiseGeneralProtectionFault0(pVCpu);
2078 }
2079
2080 /* Fetch the descriptor. */
2081 IEMSELDESC Desc;
2082 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2083 if (rcStrict != VINF_SUCCESS)
2084 return rcStrict;
2085
2086 /*
2087 * Deal with it according to its type. We do the standard code selectors
2088 * here and dispatch the system selectors to worker functions.
2089 */
2090 if (!Desc.Legacy.Gen.u1DescType)
2091 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2092
2093 /* Only code segments. */
2094 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2095 {
2096 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2097 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2098 }
2099
2100 /* L vs D. */
2101 if ( Desc.Legacy.Gen.u1Long
2102 && Desc.Legacy.Gen.u1DefBig
2103 && IEM_IS_LONG_MODE(pVCpu))
2104 {
2105 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2106 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2107 }
2108
2109 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2110 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2111 {
2112 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2113 {
2114 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2115 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2116 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2117 }
2118 }
2119 else
2120 {
2121 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2122 {
2123 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2124 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2125 }
2126 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2127 {
2128 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2129 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2130 }
2131 }
2132
2133 /* Is it there? */
2134 if (!Desc.Legacy.Gen.u1Present)
2135 {
2136 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2137 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2138 }
2139
2140 /* Check stack first - may #SS(0). */
2141 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2142 * 16-bit code cause a two or four byte CS to be pushed? */
2143 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2144 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2145 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2146 &uPtrRet.pv, &uNewRsp);
2147 if (rcStrict != VINF_SUCCESS)
2148 return rcStrict;
2149
2150 /* Chop the high bits if 16-bit (Intel says so). */
2151 if (enmEffOpSize == IEMMODE_16BIT)
2152 offSeg &= UINT16_MAX;
2153
2154 /* Limit / canonical check. */
2155 uint64_t u64Base;
2156 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2157 if ( !Desc.Legacy.Gen.u1Long
2158 || !IEM_IS_LONG_MODE(pVCpu))
2159 {
2160 if (RT_LIKELY(offSeg <= cbLimit))
2161 u64Base = X86DESC_BASE(&Desc.Legacy);
2162 else
2163 {
2164 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2165 /** @todo Intel says this is \#GP(0)! */
2166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2167 }
2168 }
2169 else if (IEM_IS_CANONICAL(offSeg))
2170 u64Base = 0;
2171 else
2172 {
2173 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2174 return iemRaiseNotCanonical(pVCpu);
2175 }
2176
2177 /*
2178 * Now set the accessed bit before
2179 * writing the return address to the stack and committing the result into
2180 * CS, CSHID and RIP.
2181 */
2182 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2183 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2184 {
2185 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2186 if (rcStrict != VINF_SUCCESS)
2187 return rcStrict;
2188 /** @todo check what VT-x and AMD-V does. */
2189 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2190 }
2191
2192 /* stack */
2193 if (enmEffOpSize == IEMMODE_16BIT)
2194 {
2195 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2196 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2197 }
2198 else if (enmEffOpSize == IEMMODE_32BIT)
2199 {
2200 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2201 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2202 }
2203 else
2204 {
2205 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2206 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2207 }
2208 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2209 if (rcStrict != VINF_SUCCESS)
2210 return rcStrict;
2211
2212 /* commit */
2213 pVCpu->cpum.GstCtx.rip = offSeg;
2214 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2215 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2216 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2217 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2218 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2219 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2220 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2221 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2222 /** @todo check if the hidden bits are loaded correctly for 64-bit
2223 * mode. */
2224
2225 /* Flush the prefetch buffer. */
2226 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2227
2228 return iemRegFinishClearingRF(pVCpu);
2229}
2230
2231
2232/**
2233 * Implements retf.
2234 *
2235 * @param enmEffOpSize The effective operand size.
2236 * @param cbPop The amount of arguments to pop from the stack
2237 * (bytes).
2238 */
2239IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2240{
2241 VBOXSTRICTRC rcStrict;
2242 RTCPTRUNION uPtrFrame;
2243 RTUINT64U NewRsp;
2244 uint64_t uNewRip;
2245 uint16_t uNewCs;
2246 NOREF(cbInstr);
2247
2248 /*
2249 * Read the stack values first.
2250 */
2251 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2252 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2253 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2254 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2255 &uPtrFrame.pv, &NewRsp.u);
2256 if (rcStrict != VINF_SUCCESS)
2257 return rcStrict;
2258 if (enmEffOpSize == IEMMODE_16BIT)
2259 {
2260 uNewRip = uPtrFrame.pu16[0];
2261 uNewCs = uPtrFrame.pu16[1];
2262 }
2263 else if (enmEffOpSize == IEMMODE_32BIT)
2264 {
2265 uNewRip = uPtrFrame.pu32[0];
2266 uNewCs = uPtrFrame.pu16[2];
2267 }
2268 else
2269 {
2270 uNewRip = uPtrFrame.pu64[0];
2271 uNewCs = uPtrFrame.pu16[4];
2272 }
2273 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2274 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2275 { /* extremely likely */ }
2276 else
2277 return rcStrict;
2278
2279 /*
2280 * Real mode and V8086 mode are easy.
2281 */
2282 /** @todo See comment for similar code in iemCImpl_FarJmp */
2283 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2284 {
2285 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2286 /** @todo check how this is supposed to work if sp=0xfffe. */
2287
2288 /* Check the limit of the new EIP. */
2289 /** @todo Intel pseudo code only does the limit check for 16-bit
2290 * operands, AMD does not make any distinction. What is right? */
2291 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2292 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2293
2294 /* commit the operation. */
2295 if (cbPop)
2296 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2297 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2298 pVCpu->cpum.GstCtx.rip = uNewRip;
2299 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2300 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2301 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2302 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2303 return iemRegFinishClearingRF(pVCpu);
2304 }
2305
2306 /*
2307 * Protected mode is complicated, of course.
2308 */
2309 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2310 {
2311 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2312 return iemRaiseGeneralProtectionFault0(pVCpu);
2313 }
2314
2315 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2316
2317 /* Fetch the descriptor. */
2318 IEMSELDESC DescCs;
2319 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2320 if (rcStrict != VINF_SUCCESS)
2321 return rcStrict;
2322
2323 /* Can only return to a code selector. */
2324 if ( !DescCs.Legacy.Gen.u1DescType
2325 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2326 {
2327 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2328 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2329 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2330 }
2331
2332 /* L vs D. */
2333 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2334 && DescCs.Legacy.Gen.u1DefBig
2335 && IEM_IS_LONG_MODE(pVCpu))
2336 {
2337 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2338 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2339 }
2340
2341 /* DPL/RPL/CPL checks. */
2342 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2343 {
2344 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2345 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2346 }
2347
2348 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2349 {
2350 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2351 {
2352 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2353 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2354 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2355 }
2356 }
2357 else
2358 {
2359 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2360 {
2361 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2362 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2363 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2364 }
2365 }
2366
2367 /* Is it there? */
2368 if (!DescCs.Legacy.Gen.u1Present)
2369 {
2370 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2371 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2372 }
2373
2374 /*
2375 * Return to outer privilege? (We'll typically have entered via a call gate.)
2376 */
2377 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2378 {
2379 /* Read the outer stack pointer stored *after* the parameters. */
2380 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, NewRsp.u);
2381 if (rcStrict != VINF_SUCCESS)
2382 return rcStrict;
2383
2384 uint16_t uNewOuterSs;
2385 RTUINT64U NewOuterRsp;
2386 if (enmEffOpSize == IEMMODE_16BIT)
2387 {
2388 NewOuterRsp.u = uPtrFrame.pu16[0];
2389 uNewOuterSs = uPtrFrame.pu16[1];
2390 }
2391 else if (enmEffOpSize == IEMMODE_32BIT)
2392 {
2393 NewOuterRsp.u = uPtrFrame.pu32[0];
2394 uNewOuterSs = uPtrFrame.pu16[2];
2395 }
2396 else
2397 {
2398 NewOuterRsp.u = uPtrFrame.pu64[0];
2399 uNewOuterSs = uPtrFrame.pu16[4];
2400 }
2401 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2402 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2403 { /* extremely likely */ }
2404 else
2405 return rcStrict;
2406
2407 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2408 and read the selector. */
2409 IEMSELDESC DescSs;
2410 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2411 {
2412 if ( !DescCs.Legacy.Gen.u1Long
2413 || (uNewOuterSs & X86_SEL_RPL) == 3)
2414 {
2415 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2416 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2417 return iemRaiseGeneralProtectionFault0(pVCpu);
2418 }
2419 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2420 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2421 }
2422 else
2423 {
2424 /* Fetch the descriptor for the new stack segment. */
2425 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2426 if (rcStrict != VINF_SUCCESS)
2427 return rcStrict;
2428 }
2429
2430 /* Check that RPL of stack and code selectors match. */
2431 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2432 {
2433 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2434 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2435 }
2436
2437 /* Must be a writable data segment. */
2438 if ( !DescSs.Legacy.Gen.u1DescType
2439 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2440 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2441 {
2442 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2443 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2444 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2445 }
2446
2447 /* L vs D. (Not mentioned by intel.) */
2448 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2449 && DescSs.Legacy.Gen.u1DefBig
2450 && IEM_IS_LONG_MODE(pVCpu))
2451 {
2452 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2453 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2454 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2455 }
2456
2457 /* DPL/RPL/CPL checks. */
2458 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2459 {
2460 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2461 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2462 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2463 }
2464
2465 /* Is it there? */
2466 if (!DescSs.Legacy.Gen.u1Present)
2467 {
2468 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2469 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2470 }
2471
2472 /* Calc SS limit.*/
2473 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2474
2475 /* Is RIP canonical or within CS.limit? */
2476 uint64_t u64Base;
2477 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2478
2479 /** @todo Testcase: Is this correct? */
2480 if ( DescCs.Legacy.Gen.u1Long
2481 && IEM_IS_LONG_MODE(pVCpu) )
2482 {
2483 if (!IEM_IS_CANONICAL(uNewRip))
2484 {
2485 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2486 return iemRaiseNotCanonical(pVCpu);
2487 }
2488 u64Base = 0;
2489 }
2490 else
2491 {
2492 if (uNewRip > cbLimitCs)
2493 {
2494 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2495 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
2496 /** @todo Intel says this is \#GP(0)! */
2497 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2498 }
2499 u64Base = X86DESC_BASE(&DescCs.Legacy);
2500 }
2501
2502 /*
2503 * Now set the accessed bit before
2504 * writing the return address to the stack and committing the result into
2505 * CS, CSHID and RIP.
2506 */
2507 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2508 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2509 {
2510 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2511 if (rcStrict != VINF_SUCCESS)
2512 return rcStrict;
2513 /** @todo check what VT-x and AMD-V does. */
2514 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2515 }
2516 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2517 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2518 {
2519 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2520 if (rcStrict != VINF_SUCCESS)
2521 return rcStrict;
2522 /** @todo check what VT-x and AMD-V does. */
2523 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2524 }
2525
2526 /* commit */
2527 if (enmEffOpSize == IEMMODE_16BIT)
2528 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2529 else
2530 pVCpu->cpum.GstCtx.rip = uNewRip;
2531 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2532 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2533 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2534 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2535 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2536 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2537 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2538 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2539 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2540 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2541 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2542 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2543 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2544 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2545 else
2546 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2547 if (cbPop)
2548 iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
2549 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2550 pVCpu->cpum.GstCtx.rsp = NewOuterRsp.u;
2551 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2552 pVCpu->cpum.GstCtx.rsp = (uint32_t)NewOuterRsp.u;
2553 else
2554 pVCpu->cpum.GstCtx.sp = (uint16_t)NewOuterRsp.u;
2555
2556 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2557 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2558 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2559 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2560 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2561
2562 /** @todo check if the hidden bits are loaded correctly for 64-bit
2563 * mode. */
2564 }
2565 /*
2566 * Return to the same privilege level
2567 */
2568 else
2569 {
2570 /* Limit / canonical check. */
2571 uint64_t u64Base;
2572 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2573
2574 /** @todo Testcase: Is this correct? */
2575 if ( DescCs.Legacy.Gen.u1Long
2576 && IEM_IS_LONG_MODE(pVCpu) )
2577 {
2578 if (!IEM_IS_CANONICAL(uNewRip))
2579 {
2580 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2581 return iemRaiseNotCanonical(pVCpu);
2582 }
2583 u64Base = 0;
2584 }
2585 else
2586 {
2587 if (uNewRip > cbLimitCs)
2588 {
2589 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2590 /** @todo Intel says this is \#GP(0)! */
2591 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2592 }
2593 u64Base = X86DESC_BASE(&DescCs.Legacy);
2594 }
2595
2596 /*
2597 * Now set the accessed bit before
2598 * writing the return address to the stack and committing the result into
2599 * CS, CSHID and RIP.
2600 */
2601 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2602 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2603 {
2604 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2605 if (rcStrict != VINF_SUCCESS)
2606 return rcStrict;
2607 /** @todo check what VT-x and AMD-V does. */
2608 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2609 }
2610
2611 /* commit */
2612 if (cbPop)
2613 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2614 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2615 pVCpu->cpum.GstCtx.sp = (uint16_t)NewRsp.u;
2616 else
2617 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2618 if (enmEffOpSize == IEMMODE_16BIT)
2619 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2620 else
2621 pVCpu->cpum.GstCtx.rip = uNewRip;
2622 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2623 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2624 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2625 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2626 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2627 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2628 /** @todo check if the hidden bits are loaded correctly for 64-bit
2629 * mode. */
2630 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2631 }
2632
2633 /* Flush the prefetch buffer. */
2634 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo use light flush for same privlege? */
2635
2636 return iemRegFinishClearingRF(pVCpu);
2637}
2638
2639
2640/**
2641 * Implements retn and retn imm16.
2642 *
2643 * We're doing this in C because of the \#GP that might be raised if the popped
2644 * program counter is out of bounds.
2645 *
2646 * The hope with this forced inline worker function, is that the compiler will
2647 * be clever enough to eliminate unused code for the constant enmEffOpSize and
2648 * maybe cbPop parameters.
2649 *
2650 * @param pVCpu The cross context virtual CPU structure of the
2651 * calling thread.
2652 * @param cbInstr The current instruction length.
2653 * @param enmEffOpSize The effective operand size. This is constant.
2654 * @param cbPop The amount of arguments to pop from the stack
2655 * (bytes). This can be constant (zero).
2656 */
2657DECL_FORCE_INLINE(VBOXSTRICTRC) iemCImpl_ReturnNearCommon(PVMCPUCC pVCpu, uint8_t cbInstr, IEMMODE enmEffOpSize, uint16_t cbPop)
2658{
2659 /* Fetch the RSP from the stack. */
2660 VBOXSTRICTRC rcStrict;
2661 RTUINT64U NewRip;
2662 RTUINT64U NewRsp;
2663 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2664
2665 switch (enmEffOpSize)
2666 {
2667 case IEMMODE_16BIT:
2668 NewRip.u = 0;
2669 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2670 break;
2671 case IEMMODE_32BIT:
2672 NewRip.u = 0;
2673 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2674 break;
2675 case IEMMODE_64BIT:
2676 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2677 break;
2678 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2679 }
2680 if (rcStrict != VINF_SUCCESS)
2681 return rcStrict;
2682
2683 /* Check the new RSP before loading it. */
2684 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2685 * of it. The canonical test is performed here and for call. */
2686 if (enmEffOpSize != IEMMODE_64BIT)
2687 {
2688 if (RT_LIKELY(NewRip.DWords.dw0 <= pVCpu->cpum.GstCtx.cs.u32Limit))
2689 { /* likely */ }
2690 else
2691 {
2692 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2693 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2694 }
2695 }
2696 else
2697 {
2698 if (RT_LIKELY(IEM_IS_CANONICAL(NewRip.u)))
2699 { /* likely */ }
2700 else
2701 {
2702 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2703 return iemRaiseNotCanonical(pVCpu);
2704 }
2705 }
2706
2707 /* Apply cbPop */
2708 if (cbPop)
2709 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2710
2711 /* Commit it. */
2712 pVCpu->cpum.GstCtx.rip = NewRip.u;
2713 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2714
2715 /* Flush the prefetch buffer. */
2716 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo only need a light flush here, don't we? We don't really need any flushing... */
2717 RT_NOREF(cbInstr);
2718
2719 return iemRegFinishClearingRF(pVCpu);
2720}
2721
2722
2723/**
2724 * Implements retn imm16 with 16-bit effective operand size.
2725 *
2726 * @param cbPop The amount of arguments to pop from the stack (bytes).
2727 */
2728IEM_CIMPL_DEF_1(iemCImpl_retn_iw_16, uint16_t, cbPop)
2729{
2730 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, cbPop);
2731}
2732
2733
2734/**
2735 * Implements retn imm16 with 32-bit effective operand size.
2736 *
2737 * @param cbPop The amount of arguments to pop from the stack (bytes).
2738 */
2739IEM_CIMPL_DEF_1(iemCImpl_retn_iw_32, uint16_t, cbPop)
2740{
2741 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, cbPop);
2742}
2743
2744
2745/**
2746 * Implements retn imm16 with 64-bit effective operand size.
2747 *
2748 * @param cbPop The amount of arguments to pop from the stack (bytes).
2749 */
2750IEM_CIMPL_DEF_1(iemCImpl_retn_iw_64, uint16_t, cbPop)
2751{
2752 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, cbPop);
2753}
2754
2755
2756/**
2757 * Implements retn with 16-bit effective operand size.
2758 */
2759IEM_CIMPL_DEF_0(iemCImpl_retn_16)
2760{
2761 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_16BIT, 0);
2762}
2763
2764
2765/**
2766 * Implements retn with 32-bit effective operand size.
2767 */
2768IEM_CIMPL_DEF_0(iemCImpl_retn_32)
2769{
2770 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_32BIT, 0);
2771}
2772
2773
2774/**
2775 * Implements retn with 64-bit effective operand size.
2776 */
2777IEM_CIMPL_DEF_0(iemCImpl_retn_64)
2778{
2779 return iemCImpl_ReturnNearCommon(pVCpu, cbInstr, IEMMODE_64BIT, 0);
2780}
2781
2782
2783/**
2784 * Implements enter.
2785 *
2786 * We're doing this in C because the instruction is insane, even for the
2787 * u8NestingLevel=0 case dealing with the stack is tedious.
2788 *
2789 * @param enmEffOpSize The effective operand size.
2790 * @param cbFrame Frame size.
2791 * @param cParameters Frame parameter count.
2792 */
2793IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2794{
2795 /* Push RBP, saving the old value in TmpRbp. */
2796 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2797 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2798 RTUINT64U NewRbp;
2799 VBOXSTRICTRC rcStrict;
2800 if (enmEffOpSize == IEMMODE_64BIT)
2801 {
2802 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2803 NewRbp = NewRsp;
2804 }
2805 else if (enmEffOpSize == IEMMODE_32BIT)
2806 {
2807 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2808 NewRbp = NewRsp;
2809 }
2810 else
2811 {
2812 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2813 NewRbp = TmpRbp;
2814 NewRbp.Words.w0 = NewRsp.Words.w0;
2815 }
2816 if (rcStrict != VINF_SUCCESS)
2817 return rcStrict;
2818
2819 /* Copy the parameters (aka nesting levels by Intel). */
2820 cParameters &= 0x1f;
2821 if (cParameters > 0)
2822 {
2823 switch (enmEffOpSize)
2824 {
2825 case IEMMODE_16BIT:
2826 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2827 TmpRbp.DWords.dw0 -= 2;
2828 else
2829 TmpRbp.Words.w0 -= 2;
2830 do
2831 {
2832 uint16_t u16Tmp;
2833 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2834 if (rcStrict != VINF_SUCCESS)
2835 break;
2836 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2837 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2838 break;
2839
2840 case IEMMODE_32BIT:
2841 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2842 TmpRbp.DWords.dw0 -= 4;
2843 else
2844 TmpRbp.Words.w0 -= 4;
2845 do
2846 {
2847 uint32_t u32Tmp;
2848 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2849 if (rcStrict != VINF_SUCCESS)
2850 break;
2851 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2852 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2853 break;
2854
2855 case IEMMODE_64BIT:
2856 TmpRbp.u -= 8;
2857 do
2858 {
2859 uint64_t u64Tmp;
2860 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2861 if (rcStrict != VINF_SUCCESS)
2862 break;
2863 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2864 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2865 break;
2866
2867 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2868 }
2869 if (rcStrict != VINF_SUCCESS)
2870 return VINF_SUCCESS;
2871
2872 /* Push the new RBP */
2873 if (enmEffOpSize == IEMMODE_64BIT)
2874 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2875 else if (enmEffOpSize == IEMMODE_32BIT)
2876 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2877 else
2878 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2879 if (rcStrict != VINF_SUCCESS)
2880 return rcStrict;
2881
2882 }
2883
2884 /* Recalc RSP. */
2885 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2886
2887 /** @todo Should probe write access at the new RSP according to AMD. */
2888 /** @todo Should handle accesses to the VMX APIC-access page. */
2889
2890 /* Commit it. */
2891 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2892 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2893 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2894}
2895
2896
2897
2898/**
2899 * Implements leave.
2900 *
2901 * We're doing this in C because messing with the stack registers is annoying
2902 * since they depends on SS attributes.
2903 *
2904 * @param enmEffOpSize The effective operand size.
2905 */
2906IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2907{
2908 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2909 RTUINT64U NewRsp;
2910 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2911 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2912 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2913 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2914 else
2915 {
2916 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2917 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2918 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2919 }
2920
2921 /* Pop RBP according to the operand size. */
2922 VBOXSTRICTRC rcStrict;
2923 RTUINT64U NewRbp;
2924 switch (enmEffOpSize)
2925 {
2926 case IEMMODE_16BIT:
2927 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2928 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2929 break;
2930 case IEMMODE_32BIT:
2931 NewRbp.u = 0;
2932 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2933 break;
2934 case IEMMODE_64BIT:
2935 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2936 break;
2937 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2938 }
2939 if (rcStrict != VINF_SUCCESS)
2940 return rcStrict;
2941
2942
2943 /* Commit it. */
2944 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2945 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2946 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2947}
2948
2949
2950/**
2951 * Implements int3 and int XX.
2952 *
2953 * @param u8Int The interrupt vector number.
2954 * @param enmInt The int instruction type.
2955 */
2956IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2957{
2958 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2959
2960 /*
2961 * We must check if this INT3 might belong to DBGF before raising a #BP.
2962 */
2963 if (u8Int == 3)
2964 {
2965 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2966 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2967 { /* likely: No vbox debugger breakpoints */ }
2968 else
2969 {
2970 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
2971 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2972 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2973 return iemSetPassUpStatus(pVCpu, rcStrict);
2974 }
2975 }
2976/** @todo single stepping */
2977 return iemRaiseXcptOrInt(pVCpu,
2978 cbInstr,
2979 u8Int,
2980 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2981 0,
2982 0);
2983}
2984
2985
2986/**
2987 * Implements iret for real mode and V8086 mode.
2988 *
2989 * @param enmEffOpSize The effective operand size.
2990 */
2991IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2992{
2993 X86EFLAGS Efl;
2994 Efl.u = IEMMISC_GET_EFL(pVCpu);
2995 NOREF(cbInstr);
2996
2997 /*
2998 * iret throws an exception if VME isn't enabled.
2999 */
3000 if ( Efl.Bits.u1VM
3001 && Efl.Bits.u2IOPL != 3
3002 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
3003 return iemRaiseGeneralProtectionFault0(pVCpu);
3004
3005 /*
3006 * Do the stack bits, but don't commit RSP before everything checks
3007 * out right.
3008 */
3009 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3010 VBOXSTRICTRC rcStrict;
3011 RTCPTRUNION uFrame;
3012 uint16_t uNewCs;
3013 uint32_t uNewEip;
3014 uint32_t uNewFlags;
3015 uint64_t uNewRsp;
3016 if (enmEffOpSize == IEMMODE_32BIT)
3017 {
3018 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
3019 if (rcStrict != VINF_SUCCESS)
3020 return rcStrict;
3021 uNewEip = uFrame.pu32[0];
3022 if (uNewEip > UINT16_MAX)
3023 return iemRaiseGeneralProtectionFault0(pVCpu);
3024
3025 uNewCs = (uint16_t)uFrame.pu32[1];
3026 uNewFlags = uFrame.pu32[2];
3027 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3028 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
3029 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
3030 | X86_EFL_ID;
3031 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3032 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3033 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
3034 }
3035 else
3036 {
3037 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3038 if (rcStrict != VINF_SUCCESS)
3039 return rcStrict;
3040 uNewEip = uFrame.pu16[0];
3041 uNewCs = uFrame.pu16[1];
3042 uNewFlags = uFrame.pu16[2];
3043 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3044 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
3045 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
3046 /** @todo The intel pseudo code does not indicate what happens to
3047 * reserved flags. We just ignore them. */
3048 /* Ancient CPU adjustments: See iemCImpl_popf. */
3049 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
3050 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
3051 }
3052 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
3053 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3054 { /* extremely likely */ }
3055 else
3056 return rcStrict;
3057
3058 /** @todo Check how this is supposed to work if sp=0xfffe. */
3059 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
3060 uNewCs, uNewEip, uNewFlags, uNewRsp));
3061
3062 /*
3063 * Check the limit of the new EIP.
3064 */
3065 /** @todo Only the AMD pseudo code check the limit here, what's
3066 * right? */
3067 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
3068 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
3069
3070 /*
3071 * V8086 checks and flag adjustments
3072 */
3073 if (Efl.Bits.u1VM)
3074 {
3075 if (Efl.Bits.u2IOPL == 3)
3076 {
3077 /* Preserve IOPL and clear RF. */
3078 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3079 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3080 }
3081 else if ( enmEffOpSize == IEMMODE_16BIT
3082 && ( !(uNewFlags & X86_EFL_IF)
3083 || !Efl.Bits.u1VIP )
3084 && !(uNewFlags & X86_EFL_TF) )
3085 {
3086 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3087 uNewFlags &= ~X86_EFL_VIF;
3088 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3089 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3090 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3091 }
3092 else
3093 return iemRaiseGeneralProtectionFault0(pVCpu);
3094 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3095 }
3096
3097 /*
3098 * Commit the operation.
3099 */
3100#ifdef DBGFTRACE_ENABLED
3101 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3102 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3103#endif
3104 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3105 pVCpu->cpum.GstCtx.rip = uNewEip;
3106 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3107 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3108 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3109 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3110 /** @todo do we load attribs and limit as well? */
3111 Assert(uNewFlags & X86_EFL_1);
3112 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3113
3114 /* Flush the prefetch buffer. */
3115 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo can do light flush in real mode at least */
3116
3117/** @todo single stepping */
3118 return VINF_SUCCESS;
3119}
3120
3121
3122/**
3123 * Loads a segment register when entering V8086 mode.
3124 *
3125 * @param pSReg The segment register.
3126 * @param uSeg The segment to load.
3127 */
3128static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3129{
3130 pSReg->Sel = uSeg;
3131 pSReg->ValidSel = uSeg;
3132 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3133 pSReg->u64Base = (uint32_t)uSeg << 4;
3134 pSReg->u32Limit = 0xffff;
3135 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3136 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3137 * IRET'ing to V8086. */
3138}
3139
3140
3141/**
3142 * Implements iret for protected mode returning to V8086 mode.
3143 *
3144 * @param uNewEip The new EIP.
3145 * @param uNewCs The new CS.
3146 * @param uNewFlags The new EFLAGS.
3147 * @param uNewRsp The RSP after the initial IRET frame.
3148 *
3149 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3150 */
3151IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3152{
3153 RT_NOREF_PV(cbInstr);
3154 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3155
3156 /*
3157 * Pop the V8086 specific frame bits off the stack.
3158 */
3159 VBOXSTRICTRC rcStrict;
3160 RTCPTRUNION uFrame;
3161 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, uNewRsp);
3162 if (rcStrict != VINF_SUCCESS)
3163 return rcStrict;
3164 uint32_t uNewEsp = uFrame.pu32[0];
3165 uint16_t uNewSs = uFrame.pu32[1];
3166 uint16_t uNewEs = uFrame.pu32[2];
3167 uint16_t uNewDs = uFrame.pu32[3];
3168 uint16_t uNewFs = uFrame.pu32[4];
3169 uint16_t uNewGs = uFrame.pu32[5];
3170 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3171 if (rcStrict != VINF_SUCCESS)
3172 return rcStrict;
3173
3174 /*
3175 * Commit the operation.
3176 */
3177 uNewFlags &= X86_EFL_LIVE_MASK;
3178 uNewFlags |= X86_EFL_RA1_MASK;
3179#ifdef DBGFTRACE_ENABLED
3180 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3181 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3182#endif
3183 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3184
3185 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3186 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3187 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3188 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3189 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3190 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3191 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3192 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3193 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3194 pVCpu->iem.s.uCpl = 3;
3195
3196 /* Flush the prefetch buffer. */
3197 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3198
3199/** @todo single stepping */
3200 return VINF_SUCCESS;
3201}
3202
3203
3204/**
3205 * Implements iret for protected mode returning via a nested task.
3206 *
3207 * @param enmEffOpSize The effective operand size.
3208 */
3209IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3210{
3211 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3212#ifndef IEM_IMPLEMENTS_TASKSWITCH
3213 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3214#else
3215 RT_NOREF_PV(enmEffOpSize);
3216
3217 /*
3218 * Read the segment selector in the link-field of the current TSS.
3219 */
3220 RTSEL uSelRet;
3221 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3222 if (rcStrict != VINF_SUCCESS)
3223 return rcStrict;
3224
3225 /*
3226 * Fetch the returning task's TSS descriptor from the GDT.
3227 */
3228 if (uSelRet & X86_SEL_LDT)
3229 {
3230 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3231 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3232 }
3233
3234 IEMSELDESC TssDesc;
3235 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3236 if (rcStrict != VINF_SUCCESS)
3237 return rcStrict;
3238
3239 if (TssDesc.Legacy.Gate.u1DescType)
3240 {
3241 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3242 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3243 }
3244
3245 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3246 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3247 {
3248 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3249 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3250 }
3251
3252 if (!TssDesc.Legacy.Gate.u1Present)
3253 {
3254 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3255 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3256 }
3257
3258 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3259 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3260 0 /* uCr2 */, uSelRet, &TssDesc);
3261#endif
3262}
3263
3264
3265/**
3266 * Implements iret for protected mode
3267 *
3268 * @param enmEffOpSize The effective operand size.
3269 */
3270IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3271{
3272 NOREF(cbInstr);
3273 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3274
3275 /*
3276 * Nested task return.
3277 */
3278 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3279 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3280
3281 /*
3282 * Normal return.
3283 *
3284 * Do the stack bits, but don't commit RSP before everything checks
3285 * out right.
3286 */
3287 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3288 VBOXSTRICTRC rcStrict;
3289 RTCPTRUNION uFrame;
3290 uint16_t uNewCs;
3291 uint32_t uNewEip;
3292 uint32_t uNewFlags;
3293 uint64_t uNewRsp;
3294 if (enmEffOpSize == IEMMODE_32BIT)
3295 {
3296 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
3297 if (rcStrict != VINF_SUCCESS)
3298 return rcStrict;
3299 uNewEip = uFrame.pu32[0];
3300 uNewCs = (uint16_t)uFrame.pu32[1];
3301 uNewFlags = uFrame.pu32[2];
3302 }
3303 else
3304 {
3305 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3306 if (rcStrict != VINF_SUCCESS)
3307 return rcStrict;
3308 uNewEip = uFrame.pu16[0];
3309 uNewCs = uFrame.pu16[1];
3310 uNewFlags = uFrame.pu16[2];
3311 }
3312 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3313 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3314 { /* extremely likely */ }
3315 else
3316 return rcStrict;
3317 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3318
3319 /*
3320 * We're hopefully not returning to V8086 mode...
3321 */
3322 if ( (uNewFlags & X86_EFL_VM)
3323 && pVCpu->iem.s.uCpl == 0)
3324 {
3325 Assert(enmEffOpSize == IEMMODE_32BIT);
3326 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3327 }
3328
3329 /*
3330 * Protected mode.
3331 */
3332 /* Read the CS descriptor. */
3333 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3334 {
3335 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3336 return iemRaiseGeneralProtectionFault0(pVCpu);
3337 }
3338
3339 IEMSELDESC DescCS;
3340 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3341 if (rcStrict != VINF_SUCCESS)
3342 {
3343 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3344 return rcStrict;
3345 }
3346
3347 /* Must be a code descriptor. */
3348 if (!DescCS.Legacy.Gen.u1DescType)
3349 {
3350 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3351 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3352 }
3353 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3354 {
3355 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3356 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3357 }
3358
3359 /* Privilege checks. */
3360 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3361 {
3362 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3363 {
3364 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3365 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3366 }
3367 }
3368 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3369 {
3370 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3371 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3372 }
3373 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3374 {
3375 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3376 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3377 }
3378
3379 /* Present? */
3380 if (!DescCS.Legacy.Gen.u1Present)
3381 {
3382 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3383 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3384 }
3385
3386 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3387
3388 /*
3389 * Return to outer level?
3390 */
3391 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3392 {
3393 uint16_t uNewSS;
3394 uint32_t uNewESP;
3395 if (enmEffOpSize == IEMMODE_32BIT)
3396 {
3397 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, uNewRsp);
3398 if (rcStrict != VINF_SUCCESS)
3399 return rcStrict;
3400/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3401 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3402 * bit of the popped SS selector it turns out. */
3403 uNewESP = uFrame.pu32[0];
3404 uNewSS = (uint16_t)uFrame.pu32[1];
3405 }
3406 else
3407 {
3408 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, uNewRsp);
3409 if (rcStrict != VINF_SUCCESS)
3410 return rcStrict;
3411 uNewESP = uFrame.pu16[0];
3412 uNewSS = uFrame.pu16[1];
3413 }
3414 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3415 if (rcStrict != VINF_SUCCESS)
3416 return rcStrict;
3417 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3418
3419 /* Read the SS descriptor. */
3420 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3421 {
3422 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3423 return iemRaiseGeneralProtectionFault0(pVCpu);
3424 }
3425
3426 IEMSELDESC DescSS;
3427 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3428 if (rcStrict != VINF_SUCCESS)
3429 {
3430 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3431 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3432 return rcStrict;
3433 }
3434
3435 /* Privilege checks. */
3436 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3437 {
3438 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3439 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3440 }
3441 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3442 {
3443 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3444 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3445 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3446 }
3447
3448 /* Must be a writeable data segment descriptor. */
3449 if (!DescSS.Legacy.Gen.u1DescType)
3450 {
3451 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3452 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3453 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3454 }
3455 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3456 {
3457 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3458 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3459 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3460 }
3461
3462 /* Present? */
3463 if (!DescSS.Legacy.Gen.u1Present)
3464 {
3465 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3466 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3467 }
3468
3469 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3470
3471 /* Check EIP. */
3472 if (uNewEip > cbLimitCS)
3473 {
3474 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3475 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3476 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3477 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3478 }
3479
3480 /*
3481 * Commit the changes, marking CS and SS accessed first since
3482 * that may fail.
3483 */
3484 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3485 {
3486 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3487 if (rcStrict != VINF_SUCCESS)
3488 return rcStrict;
3489 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3490 }
3491 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3492 {
3493 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3494 if (rcStrict != VINF_SUCCESS)
3495 return rcStrict;
3496 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3497 }
3498
3499 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3500 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3501 if (enmEffOpSize != IEMMODE_16BIT)
3502 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3503 if (pVCpu->iem.s.uCpl == 0)
3504 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3505 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3506 fEFlagsMask |= X86_EFL_IF;
3507 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3508 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3509 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3510 fEFlagsNew &= ~fEFlagsMask;
3511 fEFlagsNew |= uNewFlags & fEFlagsMask;
3512#ifdef DBGFTRACE_ENABLED
3513 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3514 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3515 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3516#endif
3517
3518 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3519 pVCpu->cpum.GstCtx.rip = uNewEip;
3520 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3521 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3522 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3523 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3524 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3525 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3526 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3527
3528 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3529 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3530 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3531 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3532 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3533 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3534 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3535 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3536 else
3537 pVCpu->cpum.GstCtx.rsp = uNewESP;
3538
3539 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3540 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3541 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3542 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3543 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3544
3545 /* Done! */
3546
3547 }
3548 /*
3549 * Return to the same level.
3550 */
3551 else
3552 {
3553 /* Check EIP. */
3554 if (uNewEip > cbLimitCS)
3555 {
3556 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3557 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3558 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3559 }
3560
3561 /*
3562 * Commit the changes, marking CS first since it may fail.
3563 */
3564 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3565 {
3566 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3567 if (rcStrict != VINF_SUCCESS)
3568 return rcStrict;
3569 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3570 }
3571
3572 X86EFLAGS NewEfl;
3573 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3574 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3575 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3576 if (enmEffOpSize != IEMMODE_16BIT)
3577 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3578 if (pVCpu->iem.s.uCpl == 0)
3579 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3580 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3581 fEFlagsMask |= X86_EFL_IF;
3582 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3583 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3584 NewEfl.u &= ~fEFlagsMask;
3585 NewEfl.u |= fEFlagsMask & uNewFlags;
3586#ifdef DBGFTRACE_ENABLED
3587 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3588 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3589 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3590#endif
3591
3592 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3593 pVCpu->cpum.GstCtx.rip = uNewEip;
3594 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3595 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3596 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3597 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3598 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3599 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3600 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3601 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3602 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3603 else
3604 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3605 /* Done! */
3606 }
3607
3608 /* Flush the prefetch buffer. */
3609 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if same ring? */
3610
3611/** @todo single stepping */
3612 return VINF_SUCCESS;
3613}
3614
3615
3616/**
3617 * Implements iret for long mode
3618 *
3619 * @param enmEffOpSize The effective operand size.
3620 */
3621IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3622{
3623 NOREF(cbInstr);
3624
3625 /*
3626 * Nested task return is not supported in long mode.
3627 */
3628 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3629 {
3630 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3631 return iemRaiseGeneralProtectionFault0(pVCpu);
3632 }
3633
3634 /*
3635 * Normal return.
3636 *
3637 * Do the stack bits, but don't commit RSP before everything checks
3638 * out right.
3639 */
3640 VBOXSTRICTRC rcStrict;
3641 RTCPTRUNION uFrame;
3642 uint64_t uNewRip;
3643 uint16_t uNewCs;
3644 uint16_t uNewSs;
3645 uint32_t uNewFlags;
3646 uint64_t uNewRsp;
3647 if (enmEffOpSize == IEMMODE_64BIT)
3648 {
3649 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
3650 if (rcStrict != VINF_SUCCESS)
3651 return rcStrict;
3652 uNewRip = uFrame.pu64[0];
3653 uNewCs = (uint16_t)uFrame.pu64[1];
3654 uNewFlags = (uint32_t)uFrame.pu64[2];
3655 uNewRsp = uFrame.pu64[3];
3656 uNewSs = (uint16_t)uFrame.pu64[4];
3657 }
3658 else if (enmEffOpSize == IEMMODE_32BIT)
3659 {
3660 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
3661 if (rcStrict != VINF_SUCCESS)
3662 return rcStrict;
3663 uNewRip = uFrame.pu32[0];
3664 uNewCs = (uint16_t)uFrame.pu32[1];
3665 uNewFlags = uFrame.pu32[2];
3666 uNewRsp = uFrame.pu32[3];
3667 uNewSs = (uint16_t)uFrame.pu32[4];
3668 }
3669 else
3670 {
3671 Assert(enmEffOpSize == IEMMODE_16BIT);
3672 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
3673 if (rcStrict != VINF_SUCCESS)
3674 return rcStrict;
3675 uNewRip = uFrame.pu16[0];
3676 uNewCs = uFrame.pu16[1];
3677 uNewFlags = uFrame.pu16[2];
3678 uNewRsp = uFrame.pu16[3];
3679 uNewSs = uFrame.pu16[4];
3680 }
3681 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3682 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3683 { /* extremely like */ }
3684 else
3685 return rcStrict;
3686 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3687
3688 /*
3689 * Check stuff.
3690 */
3691 /* Read the CS descriptor. */
3692 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3693 {
3694 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3695 return iemRaiseGeneralProtectionFault0(pVCpu);
3696 }
3697
3698 IEMSELDESC DescCS;
3699 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3700 if (rcStrict != VINF_SUCCESS)
3701 {
3702 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3703 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3704 return rcStrict;
3705 }
3706
3707 /* Must be a code descriptor. */
3708 if ( !DescCS.Legacy.Gen.u1DescType
3709 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3710 {
3711 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3712 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3713 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3714 }
3715
3716 /* Privilege checks. */
3717 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3718 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3719 {
3720 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3721 {
3722 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3723 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3724 }
3725 }
3726 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3727 {
3728 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3729 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3730 }
3731 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3732 {
3733 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3734 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3735 }
3736
3737 /* Present? */
3738 if (!DescCS.Legacy.Gen.u1Present)
3739 {
3740 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3741 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3742 }
3743
3744 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3745
3746 /* Read the SS descriptor. */
3747 IEMSELDESC DescSS;
3748 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3749 {
3750 if ( !DescCS.Legacy.Gen.u1Long
3751 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3752 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3753 {
3754 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3755 return iemRaiseGeneralProtectionFault0(pVCpu);
3756 }
3757 /* Make sure SS is sensible, marked as accessed etc. */
3758 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3759 }
3760 else
3761 {
3762 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3763 if (rcStrict != VINF_SUCCESS)
3764 {
3765 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3766 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3767 return rcStrict;
3768 }
3769 }
3770
3771 /* Privilege checks. */
3772 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3773 {
3774 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3775 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3776 }
3777
3778 uint32_t cbLimitSs;
3779 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3780 cbLimitSs = UINT32_MAX;
3781 else
3782 {
3783 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3784 {
3785 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3786 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3787 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3788 }
3789
3790 /* Must be a writeable data segment descriptor. */
3791 if (!DescSS.Legacy.Gen.u1DescType)
3792 {
3793 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3794 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3795 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3796 }
3797 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3798 {
3799 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3800 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3801 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3802 }
3803
3804 /* Present? */
3805 if (!DescSS.Legacy.Gen.u1Present)
3806 {
3807 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3808 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3809 }
3810 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3811 }
3812
3813 /* Check EIP. */
3814 if (DescCS.Legacy.Gen.u1Long)
3815 {
3816 if (!IEM_IS_CANONICAL(uNewRip))
3817 {
3818 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3819 uNewCs, uNewRip, uNewSs, uNewRsp));
3820 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3821 }
3822 }
3823 else
3824 {
3825 if (uNewRip > cbLimitCS)
3826 {
3827 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3828 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3829 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3830 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3831 }
3832 }
3833
3834 /*
3835 * Commit the changes, marking CS and SS accessed first since
3836 * that may fail.
3837 */
3838 /** @todo where exactly are these actually marked accessed by a real CPU? */
3839 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3840 {
3841 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3842 if (rcStrict != VINF_SUCCESS)
3843 return rcStrict;
3844 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3845 }
3846 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3847 {
3848 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3849 if (rcStrict != VINF_SUCCESS)
3850 return rcStrict;
3851 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3852 }
3853
3854 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3855 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3856 if (enmEffOpSize != IEMMODE_16BIT)
3857 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3858 if (pVCpu->iem.s.uCpl == 0)
3859 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3860 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3861 fEFlagsMask |= X86_EFL_IF;
3862 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3863 fEFlagsNew &= ~fEFlagsMask;
3864 fEFlagsNew |= uNewFlags & fEFlagsMask;
3865#ifdef DBGFTRACE_ENABLED
3866 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3867 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3868#endif
3869
3870 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3871 pVCpu->cpum.GstCtx.rip = uNewRip;
3872 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3873 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3874 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3875 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3876 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3877 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3878 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3879 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3880 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3881 else
3882 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3883 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3884 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3885 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3886 {
3887 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3888 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3889 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3890 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3891 Log2(("iretq new SS: NULL\n"));
3892 }
3893 else
3894 {
3895 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3896 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3897 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3898 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3899 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3900 }
3901
3902 if (pVCpu->iem.s.uCpl != uNewCpl)
3903 {
3904 pVCpu->iem.s.uCpl = uNewCpl;
3905 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3906 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3907 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3908 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3909 }
3910
3911 /* Flush the prefetch buffer. */
3912 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if the ring + mode doesn't change */
3913
3914/** @todo single stepping */
3915 return VINF_SUCCESS;
3916}
3917
3918
3919/**
3920 * Implements iret.
3921 *
3922 * @param enmEffOpSize The effective operand size.
3923 */
3924IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3925{
3926 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
3927
3928#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3929 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3930 {
3931 /*
3932 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3933 * of this IRET instruction. We need to provide this information as part of some
3934 * VM-exits.
3935 *
3936 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3937 */
3938 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3939 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3940 else
3941 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3942
3943 /*
3944 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3945 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3946 */
3947 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3948 fBlockingNmi = false;
3949
3950 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3951 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3952 }
3953#endif
3954
3955 /*
3956 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3957 * The NMI is still held pending (which I assume means blocking of further NMIs
3958 * is in effect).
3959 *
3960 * See AMD spec. 15.9 "Instruction Intercepts".
3961 * See AMD spec. 15.21.9 "NMI Support".
3962 */
3963 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3964 {
3965 Log(("iret: Guest intercept -> #VMEXIT\n"));
3966 IEM_SVM_UPDATE_NRIP(pVCpu);
3967 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3968 }
3969
3970 /*
3971 * Clear NMI blocking, if any, before causing any further exceptions.
3972 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3973 */
3974 if (fBlockingNmi)
3975 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
3976
3977 /*
3978 * Call a mode specific worker.
3979 */
3980 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3981 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3982 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3983 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3984 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3985 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3986}
3987
3988
3989static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3990{
3991 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3992
3993 pHid->Sel = uSel;
3994 pHid->ValidSel = uSel;
3995 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3996}
3997
3998
3999static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
4000{
4001 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4002
4003 /* The base is in the first three bytes. */
4004 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
4005 /* The attributes are in the fourth byte. */
4006 pHid->Attr.u = pbMem[3];
4007 /* The limit is in the last two bytes. */
4008 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
4009}
4010
4011
4012/**
4013 * Implements 286 LOADALL (286 CPUs only).
4014 */
4015IEM_CIMPL_DEF_0(iemCImpl_loadall286)
4016{
4017 NOREF(cbInstr);
4018
4019 /* Data is loaded from a buffer at 800h. No checks are done on the
4020 * validity of loaded state.
4021 *
4022 * LOADALL only loads the internal CPU state, it does not access any
4023 * GDT, LDT, or similar tables.
4024 */
4025
4026 if (pVCpu->iem.s.uCpl != 0)
4027 {
4028 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4029 return iemRaiseGeneralProtectionFault0(pVCpu);
4030 }
4031
4032 uint8_t const *pbMem = NULL;
4033 uint16_t const *pa16Mem;
4034 uint8_t const *pa8Mem;
4035 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
4036 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
4037 if (rcStrict != VINF_SUCCESS)
4038 return rcStrict;
4039
4040 /* The MSW is at offset 0x06. */
4041 pa16Mem = (uint16_t const *)(pbMem + 0x06);
4042 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
4043 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4044 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4045 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
4046
4047 CPUMSetGuestCR0(pVCpu, uNewCr0);
4048 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
4049
4050 /* Inform PGM if mode changed. */
4051 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
4052 {
4053 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
4054 AssertRCReturn(rc, rc);
4055 /* ignore informational status codes */
4056 }
4057 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
4058 false /* fForce */);
4059
4060 /* TR selector is at offset 0x16. */
4061 pa16Mem = (uint16_t const *)(pbMem + 0x16);
4062 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
4063 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
4064 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
4065
4066 /* Followed by FLAGS... */
4067 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
4068 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
4069
4070 /* LDT is at offset 0x1C. */
4071 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
4072 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
4073 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
4074 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4075
4076 /* Segment registers are at offset 0x1E. */
4077 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
4078 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
4079 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
4080 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
4081 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
4082
4083 /* GPRs are at offset 0x26. */
4084 pa16Mem = (uint16_t const *)(pbMem + 0x26);
4085 pVCpu->cpum.GstCtx.di = pa16Mem[0];
4086 pVCpu->cpum.GstCtx.si = pa16Mem[1];
4087 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
4088 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
4089 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
4090 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
4091 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
4092 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
4093
4094 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4095 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4096 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4097 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4098 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4099
4100 /* GDTR contents are at offset 0x4E, 6 bytes. */
4101 RTGCPHYS GCPtrBase;
4102 uint16_t cbLimit;
4103 pa8Mem = pbMem + 0x4E;
4104 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4105 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4106 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4107 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4108
4109 /* IDTR contents are at offset 0x5A, 6 bytes. */
4110 pa8Mem = pbMem + 0x5A;
4111 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4112 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4113 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4114
4115 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4116 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4117 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4118 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4119 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4120 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4121
4122 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4123 if (rcStrict != VINF_SUCCESS)
4124 return rcStrict;
4125
4126 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4127 * descriptor caches" but there is no word as to what happens if those are
4128 * not identical (probably bad things).
4129 */
4130 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4131
4132 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4133
4134 /* Flush the prefetch buffer. */
4135 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4136
4137/** @todo single stepping */
4138 return rcStrict;
4139}
4140
4141
4142/**
4143 * Implements SYSCALL (AMD and Intel64).
4144 */
4145IEM_CIMPL_DEF_0(iemCImpl_syscall)
4146{
4147 /** @todo hack, LOADALL should be decoded as such on a 286. */
4148 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4149 return iemCImpl_loadall286(pVCpu, cbInstr);
4150
4151 /*
4152 * Check preconditions.
4153 *
4154 * Note that CPUs described in the documentation may load a few odd values
4155 * into CS and SS than we allow here. This has yet to be checked on real
4156 * hardware.
4157 */
4158 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4159 {
4160 Log(("syscall: Not enabled in EFER -> #UD\n"));
4161 return iemRaiseUndefinedOpcode(pVCpu);
4162 }
4163 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4164 {
4165 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4166 return iemRaiseGeneralProtectionFault0(pVCpu);
4167 }
4168 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4169 {
4170 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4171 return iemRaiseUndefinedOpcode(pVCpu);
4172 }
4173
4174 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4175
4176 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4177 /** @todo what about LDT selectors? Shouldn't matter, really. */
4178 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4179 uint16_t uNewSs = uNewCs + 8;
4180 if (uNewCs == 0 || uNewSs == 0)
4181 {
4182 /** @todo Neither Intel nor AMD document this check. */
4183 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4184 return iemRaiseGeneralProtectionFault0(pVCpu);
4185 }
4186
4187 /* Long mode and legacy mode differs. */
4188 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4189 {
4190 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4191
4192 /* This test isn't in the docs, but I'm not trusting the guys writing
4193 the MSRs to have validated the values as canonical like they should. */
4194 if (!IEM_IS_CANONICAL(uNewRip))
4195 {
4196 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4197 Log(("syscall: New RIP not canonical -> #UD\n"));
4198 return iemRaiseUndefinedOpcode(pVCpu);
4199 }
4200
4201 /*
4202 * Commit it.
4203 */
4204 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4205 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4206 pVCpu->cpum.GstCtx.rip = uNewRip;
4207
4208 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4209 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4210 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4211 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4212
4213 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4214 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4215 }
4216 else
4217 {
4218 /*
4219 * Commit it.
4220 */
4221 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4222 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4223 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4224 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4225
4226 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4227 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4228 }
4229 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4230 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4231 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4232 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4233 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4234
4235 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4236 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4237 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4238 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4239 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4240
4241 pVCpu->iem.s.uCpl = 0;
4242 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4243
4244 /* Flush the prefetch buffer. */
4245 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4246
4247/** @todo single step */
4248 return VINF_SUCCESS;
4249}
4250
4251
4252/**
4253 * Implements SYSRET (AMD and Intel64).
4254 */
4255IEM_CIMPL_DEF_0(iemCImpl_sysret)
4256
4257{
4258 RT_NOREF_PV(cbInstr);
4259
4260 /*
4261 * Check preconditions.
4262 *
4263 * Note that CPUs described in the documentation may load a few odd values
4264 * into CS and SS than we allow here. This has yet to be checked on real
4265 * hardware.
4266 */
4267 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4268 {
4269 Log(("sysret: Not enabled in EFER -> #UD\n"));
4270 return iemRaiseUndefinedOpcode(pVCpu);
4271 }
4272 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4273 {
4274 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4275 return iemRaiseUndefinedOpcode(pVCpu);
4276 }
4277 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4278 {
4279 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4280 return iemRaiseGeneralProtectionFault0(pVCpu);
4281 }
4282 if (pVCpu->iem.s.uCpl != 0)
4283 {
4284 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4285 return iemRaiseGeneralProtectionFault0(pVCpu);
4286 }
4287
4288 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4289
4290 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4291 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4292 uint16_t uNewSs = uNewCs + 8;
4293 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4294 uNewCs += 16;
4295 if (uNewCs == 0 || uNewSs == 0)
4296 {
4297 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4298 return iemRaiseGeneralProtectionFault0(pVCpu);
4299 }
4300
4301 /*
4302 * Commit it.
4303 */
4304 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4305 {
4306 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4307 {
4308 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4309 /* Note! We disregard intel manual regarding the RCX canonical
4310 check, ask intel+xen why AMD doesn't do it. */
4311 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4312 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4313 | (3 << X86DESCATTR_DPL_SHIFT);
4314 }
4315 else
4316 {
4317 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4318 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4319 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4320 | (3 << X86DESCATTR_DPL_SHIFT);
4321 }
4322 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4323 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4324 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4325 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4326 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4327 }
4328 else
4329 {
4330 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4331 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4332 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4333 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4334 | (3 << X86DESCATTR_DPL_SHIFT);
4335 }
4336 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4337 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4338 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4339 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4340 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4341
4342 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4343 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4344 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4345 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4346 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4347 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4348 * on sysret. */
4349
4350 pVCpu->iem.s.uCpl = 3;
4351 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4352
4353 /* Flush the prefetch buffer. */
4354 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4355
4356/** @todo single step */
4357 return VINF_SUCCESS;
4358}
4359
4360
4361/**
4362 * Implements SYSENTER (Intel, 32-bit AMD).
4363 */
4364IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4365{
4366 RT_NOREF(cbInstr);
4367
4368 /*
4369 * Check preconditions.
4370 *
4371 * Note that CPUs described in the documentation may load a few odd values
4372 * into CS and SS than we allow here. This has yet to be checked on real
4373 * hardware.
4374 */
4375 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4376 {
4377 Log(("sysenter: not supported -=> #UD\n"));
4378 return iemRaiseUndefinedOpcode(pVCpu);
4379 }
4380 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4381 {
4382 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4383 return iemRaiseGeneralProtectionFault0(pVCpu);
4384 }
4385 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4386 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4387 {
4388 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4389 return iemRaiseUndefinedOpcode(pVCpu);
4390 }
4391 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4392 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4393 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4394 {
4395 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4396 return iemRaiseGeneralProtectionFault0(pVCpu);
4397 }
4398
4399 /* This test isn't in the docs, it's just a safeguard against missing
4400 canonical checks when writing the registers. */
4401 if (RT_LIKELY( !fIsLongMode
4402 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4403 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4404 { /* likely */ }
4405 else
4406 {
4407 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4408 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4409 return iemRaiseUndefinedOpcode(pVCpu);
4410 }
4411
4412/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4413
4414 /*
4415 * Update registers and commit.
4416 */
4417 if (fIsLongMode)
4418 {
4419 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4420 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4421 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4422 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4423 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4424 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4425 }
4426 else
4427 {
4428 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, (uint32_t)pVCpu->cpum.GstCtx.rip,
4429 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4430 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4431 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4432 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4433 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4434 }
4435 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4436 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4437 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4438 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4439 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4440
4441 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4442 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4443 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4444 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4445 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4446 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4447 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4448
4449 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4450 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4451 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4452
4453 pVCpu->iem.s.uCpl = 0;
4454
4455 /* Flush the prefetch buffer. */
4456 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4457
4458/** @todo single stepping */
4459 return VINF_SUCCESS;
4460}
4461
4462
4463/**
4464 * Implements SYSEXIT (Intel, 32-bit AMD).
4465 *
4466 * @param enmEffOpSize The effective operand size.
4467 */
4468IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4469{
4470 RT_NOREF(cbInstr);
4471
4472 /*
4473 * Check preconditions.
4474 *
4475 * Note that CPUs described in the documentation may load a few odd values
4476 * into CS and SS than we allow here. This has yet to be checked on real
4477 * hardware.
4478 */
4479 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4480 {
4481 Log(("sysexit: not supported -=> #UD\n"));
4482 return iemRaiseUndefinedOpcode(pVCpu);
4483 }
4484 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4485 {
4486 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4487 return iemRaiseGeneralProtectionFault0(pVCpu);
4488 }
4489 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4490 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4491 {
4492 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4493 return iemRaiseUndefinedOpcode(pVCpu);
4494 }
4495 if (pVCpu->iem.s.uCpl != 0)
4496 {
4497 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", pVCpu->iem.s.uCpl));
4498 return iemRaiseGeneralProtectionFault0(pVCpu);
4499 }
4500 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4501 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4502 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4503 {
4504 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4505 return iemRaiseGeneralProtectionFault0(pVCpu);
4506 }
4507
4508 /*
4509 * Update registers and commit.
4510 */
4511 if (enmEffOpSize == IEMMODE_64BIT)
4512 {
4513 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4514 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4515 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4516 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4517 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4518 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4519 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4520 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4521 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4522 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4523 }
4524 else
4525 {
4526 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4527 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4528 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4529 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4530 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4531 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4532 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4533 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4534 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4535 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4536 }
4537 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4538 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4539 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4540
4541 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4542 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4543 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4544 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4545 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4546 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4547
4548 pVCpu->iem.s.uCpl = 3;
4549/** @todo single stepping */
4550
4551 /* Flush the prefetch buffer. */
4552 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4553
4554 return VINF_SUCCESS;
4555}
4556
4557
4558/**
4559 * Completes a MOV SReg,XXX or POP SReg instruction.
4560 *
4561 * When not modifying SS or when we're already in an interrupt shadow we
4562 * can update RIP and finish the instruction the normal way.
4563 *
4564 * Otherwise, the MOV/POP SS interrupt shadow that we now enable will block
4565 * both TF and DBx events. The TF will be ignored while the DBx ones will
4566 * be delayed till the next instruction boundrary. For more details see
4567 * @sdmv3{077,200,6.8.3,Masking Exceptions and Interrupts When Switching Stacks}.
4568 */
4569DECLINLINE(VBOXSTRICTRC) iemCImpl_LoadSRegFinish(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iSegReg)
4570{
4571 if (iSegReg != X86_SREG_SS || CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
4572 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4573
4574 iemRegAddToRip(pVCpu, cbInstr);
4575 pVCpu->cpum.GstCtx.eflags.uBoth &= ~X86_EFL_RF; /* Shadow int isn't set and DRx is delayed, so only clear RF. */
4576 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4577
4578 return VINF_SUCCESS;
4579}
4580
4581
4582/**
4583 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4584 *
4585 * @param pVCpu The cross context virtual CPU structure of the calling
4586 * thread.
4587 * @param iSegReg The segment register number (valid).
4588 * @param uSel The new selector value.
4589 */
4590static VBOXSTRICTRC iemCImpl_LoadSRegWorker(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4591{
4592 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4593 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4594 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4595
4596 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4597
4598 /*
4599 * Real mode and V8086 mode are easy.
4600 */
4601 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4602 {
4603 *pSel = uSel;
4604 pHid->u64Base = (uint32_t)uSel << 4;
4605 pHid->ValidSel = uSel;
4606 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4607#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4608 /** @todo Does the CPU actually load limits and attributes in the
4609 * real/V8086 mode segment load case? It doesn't for CS in far
4610 * jumps... Affects unreal mode. */
4611 pHid->u32Limit = 0xffff;
4612 pHid->Attr.u = 0;
4613 pHid->Attr.n.u1Present = 1;
4614 pHid->Attr.n.u1DescType = 1;
4615 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4616 ? X86_SEL_TYPE_RW
4617 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4618#endif
4619 }
4620 /*
4621 * Protected mode.
4622 *
4623 * Check if it's a null segment selector value first, that's OK for DS, ES,
4624 * FS and GS. If not null, then we have to load and parse the descriptor.
4625 */
4626 else if (!(uSel & X86_SEL_MASK_OFF_RPL))
4627 {
4628 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4629 if (iSegReg == X86_SREG_SS)
4630 {
4631 /* In 64-bit kernel mode, the stack can be 0 because of the way
4632 interrupts are dispatched. AMD seems to have a slighly more
4633 relaxed relationship to SS.RPL than intel does. */
4634 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4635 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4636 || pVCpu->iem.s.uCpl > 2
4637 || ( uSel != pVCpu->iem.s.uCpl
4638 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4639 {
4640 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4641 return iemRaiseGeneralProtectionFault0(pVCpu);
4642 }
4643 }
4644
4645 *pSel = uSel; /* Not RPL, remember :-) */
4646 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4647 if (iSegReg == X86_SREG_SS)
4648 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4649 }
4650 else
4651 {
4652
4653 /* Fetch the descriptor. */
4654 IEMSELDESC Desc;
4655 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4656 if (rcStrict != VINF_SUCCESS)
4657 return rcStrict;
4658
4659 /* Check GPs first. */
4660 if (!Desc.Legacy.Gen.u1DescType)
4661 {
4662 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4663 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4664 }
4665 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4666 {
4667 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4668 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4669 {
4670 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4671 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4672 }
4673 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4674 {
4675 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4676 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4677 }
4678 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4679 {
4680 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4681 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4682 }
4683 }
4684 else
4685 {
4686 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4687 {
4688 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4689 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4690 }
4691 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4692 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4693 {
4694#if 0 /* this is what intel says. */
4695 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4696 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4697 {
4698 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4699 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4700 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4701 }
4702#else /* this is what makes more sense. */
4703 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4704 {
4705 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4706 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4707 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4708 }
4709 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4710 {
4711 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4712 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4713 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4714 }
4715#endif
4716 }
4717 }
4718
4719 /* Is it there? */
4720 if (!Desc.Legacy.Gen.u1Present)
4721 {
4722 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4723 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4724 }
4725
4726 /* The base and limit. */
4727 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4728 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4729
4730 /*
4731 * Ok, everything checked out fine. Now set the accessed bit before
4732 * committing the result into the registers.
4733 */
4734 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4735 {
4736 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4737 if (rcStrict != VINF_SUCCESS)
4738 return rcStrict;
4739 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4740 }
4741
4742 /* commit */
4743 *pSel = uSel;
4744 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4745 pHid->u32Limit = cbLimit;
4746 pHid->u64Base = u64Base;
4747 pHid->ValidSel = uSel;
4748 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4749
4750 /** @todo check if the hidden bits are loaded correctly for 64-bit
4751 * mode. */
4752 }
4753
4754 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4755 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4756 return VINF_SUCCESS;
4757}
4758
4759
4760/**
4761 * Implements 'mov SReg, r/m'.
4762 *
4763 * @param iSegReg The segment register number (valid).
4764 * @param uSel The new selector value.
4765 */
4766IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4767{
4768 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4769 if (rcStrict == VINF_SUCCESS)
4770 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4771 return rcStrict;
4772}
4773
4774
4775/**
4776 * Implements 'pop SReg'.
4777 *
4778 * @param iSegReg The segment register number (valid).
4779 * @param enmEffOpSize The efficient operand size (valid).
4780 */
4781IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4782{
4783 VBOXSTRICTRC rcStrict;
4784
4785 /*
4786 * Read the selector off the stack and join paths with mov ss, reg.
4787 */
4788 RTUINT64U TmpRsp;
4789 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4790 switch (enmEffOpSize)
4791 {
4792 case IEMMODE_16BIT:
4793 {
4794 uint16_t uSel;
4795 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4796 if (rcStrict == VINF_SUCCESS)
4797 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4798 break;
4799 }
4800
4801 case IEMMODE_32BIT:
4802 {
4803 uint32_t u32Value;
4804 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4805 if (rcStrict == VINF_SUCCESS)
4806 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u32Value);
4807 break;
4808 }
4809
4810 case IEMMODE_64BIT:
4811 {
4812 uint64_t u64Value;
4813 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4814 if (rcStrict == VINF_SUCCESS)
4815 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u64Value);
4816 break;
4817 }
4818 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4819 }
4820
4821 /*
4822 * If the load succeeded, commit the stack change and finish the instruction.
4823 */
4824 if (rcStrict == VINF_SUCCESS)
4825 {
4826 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4827 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4828 }
4829
4830 return rcStrict;
4831}
4832
4833
4834/**
4835 * Implements lgs, lfs, les, lds & lss.
4836 */
4837IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
4838{
4839 /*
4840 * Use iemCImpl_LoadSRegWorker to do the tricky segment register loading.
4841 */
4842 /** @todo verify and test that mov, pop and lXs works the segment
4843 * register loading in the exact same way. */
4844 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4845 if (rcStrict == VINF_SUCCESS)
4846 {
4847 switch (enmEffOpSize)
4848 {
4849 case IEMMODE_16BIT:
4850 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4851 break;
4852 case IEMMODE_32BIT:
4853 case IEMMODE_64BIT:
4854 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4855 break;
4856 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4857 }
4858 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4859 }
4860 return rcStrict;
4861}
4862
4863
4864/**
4865 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4866 *
4867 * @retval VINF_SUCCESS on success.
4868 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4869 * @retval iemMemFetchSysU64 return value.
4870 *
4871 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4872 * @param uSel The selector value.
4873 * @param fAllowSysDesc Whether system descriptors are OK or not.
4874 * @param pDesc Where to return the descriptor on success.
4875 */
4876static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4877{
4878 pDesc->Long.au64[0] = 0;
4879 pDesc->Long.au64[1] = 0;
4880
4881 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4882 return VINF_IEM_SELECTOR_NOT_OK;
4883
4884 /* Within the table limits? */
4885 RTGCPTR GCPtrBase;
4886 if (uSel & X86_SEL_LDT)
4887 {
4888 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4889 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4890 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4891 return VINF_IEM_SELECTOR_NOT_OK;
4892 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4893 }
4894 else
4895 {
4896 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4897 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4898 return VINF_IEM_SELECTOR_NOT_OK;
4899 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4900 }
4901
4902 /* Fetch the descriptor. */
4903 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4904 if (rcStrict != VINF_SUCCESS)
4905 return rcStrict;
4906 if (!pDesc->Legacy.Gen.u1DescType)
4907 {
4908 if (!fAllowSysDesc)
4909 return VINF_IEM_SELECTOR_NOT_OK;
4910 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4911 {
4912 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4913 if (rcStrict != VINF_SUCCESS)
4914 return rcStrict;
4915 }
4916
4917 }
4918
4919 return VINF_SUCCESS;
4920}
4921
4922
4923/**
4924 * Implements verr (fWrite = false) and verw (fWrite = true).
4925 */
4926IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4927{
4928 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4929
4930 /** @todo figure whether the accessed bit is set or not. */
4931
4932 bool fAccessible = true;
4933 IEMSELDESC Desc;
4934 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4935 if (rcStrict == VINF_SUCCESS)
4936 {
4937 /* Check the descriptor, order doesn't matter much here. */
4938 if ( !Desc.Legacy.Gen.u1DescType
4939 || !Desc.Legacy.Gen.u1Present)
4940 fAccessible = false;
4941 else
4942 {
4943 if ( fWrite
4944 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4945 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4946 fAccessible = false;
4947
4948 /** @todo testcase for the conforming behavior. */
4949 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4950 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4951 {
4952 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4953 fAccessible = false;
4954 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4955 fAccessible = false;
4956 }
4957 }
4958
4959 }
4960 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4961 fAccessible = false;
4962 else
4963 return rcStrict;
4964
4965 /* commit */
4966 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4967
4968 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4969}
4970
4971
4972/**
4973 * Implements LAR and LSL with 64-bit operand size.
4974 *
4975 * @returns VINF_SUCCESS.
4976 * @param pu64Dst Pointer to the destination register.
4977 * @param uSel The selector to load details for.
4978 * @param fIsLar true = LAR, false = LSL.
4979 */
4980IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4981{
4982 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4983
4984 /** @todo figure whether the accessed bit is set or not. */
4985
4986 bool fDescOk = true;
4987 IEMSELDESC Desc;
4988 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4989 if (rcStrict == VINF_SUCCESS)
4990 {
4991 /*
4992 * Check the descriptor type.
4993 */
4994 if (!Desc.Legacy.Gen.u1DescType)
4995 {
4996 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4997 {
4998 if (Desc.Long.Gen.u5Zeros)
4999 fDescOk = false;
5000 else
5001 switch (Desc.Long.Gen.u4Type)
5002 {
5003 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
5004 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
5005 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
5006 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
5007 break;
5008 case AMD64_SEL_TYPE_SYS_CALL_GATE:
5009 fDescOk = fIsLar;
5010 break;
5011 default:
5012 fDescOk = false;
5013 break;
5014 }
5015 }
5016 else
5017 {
5018 switch (Desc.Long.Gen.u4Type)
5019 {
5020 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
5021 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
5022 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
5023 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
5024 case X86_SEL_TYPE_SYS_LDT:
5025 break;
5026 case X86_SEL_TYPE_SYS_286_CALL_GATE:
5027 case X86_SEL_TYPE_SYS_TASK_GATE:
5028 case X86_SEL_TYPE_SYS_386_CALL_GATE:
5029 fDescOk = fIsLar;
5030 break;
5031 default:
5032 fDescOk = false;
5033 break;
5034 }
5035 }
5036 }
5037 if (fDescOk)
5038 {
5039 /*
5040 * Check the RPL/DPL/CPL interaction..
5041 */
5042 /** @todo testcase for the conforming behavior. */
5043 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
5044 || !Desc.Legacy.Gen.u1DescType)
5045 {
5046 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5047 fDescOk = false;
5048 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
5049 fDescOk = false;
5050 }
5051 }
5052
5053 if (fDescOk)
5054 {
5055 /*
5056 * All fine, start committing the result.
5057 */
5058 if (fIsLar)
5059 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5060 else
5061 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5062 }
5063
5064 }
5065 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5066 fDescOk = false;
5067 else
5068 return rcStrict;
5069
5070 /* commit flags value and advance rip. */
5071 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5072 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5073}
5074
5075
5076/**
5077 * Implements LAR and LSL with 16-bit operand size.
5078 *
5079 * @returns VINF_SUCCESS.
5080 * @param pu16Dst Pointer to the destination register.
5081 * @param uSel The selector to load details for.
5082 * @param fIsLar true = LAR, false = LSL.
5083 */
5084IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5085{
5086 uint64_t u64TmpDst = *pu16Dst;
5087 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5088 *pu16Dst = u64TmpDst;
5089 return VINF_SUCCESS;
5090}
5091
5092
5093/**
5094 * Implements lgdt.
5095 *
5096 * @param iEffSeg The segment of the new gdtr contents
5097 * @param GCPtrEffSrc The address of the new gdtr contents.
5098 * @param enmEffOpSize The effective operand size.
5099 */
5100IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5101{
5102 if (pVCpu->iem.s.uCpl != 0)
5103 return iemRaiseGeneralProtectionFault0(pVCpu);
5104 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5105
5106 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5107 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5108 {
5109 Log(("lgdt: Guest intercept -> VM-exit\n"));
5110 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5111 }
5112
5113 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5114 {
5115 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5116 IEM_SVM_UPDATE_NRIP(pVCpu);
5117 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5118 }
5119
5120 /*
5121 * Fetch the limit and base address.
5122 */
5123 uint16_t cbLimit;
5124 RTGCPTR GCPtrBase;
5125 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5126 if (rcStrict == VINF_SUCCESS)
5127 {
5128 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5129 || X86_IS_CANONICAL(GCPtrBase))
5130 {
5131 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5132 if (rcStrict == VINF_SUCCESS)
5133 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5134 }
5135 else
5136 {
5137 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5138 return iemRaiseGeneralProtectionFault0(pVCpu);
5139 }
5140 }
5141 return rcStrict;
5142}
5143
5144
5145/**
5146 * Implements sgdt.
5147 *
5148 * @param iEffSeg The segment where to store the gdtr content.
5149 * @param GCPtrEffDst The address where to store the gdtr content.
5150 */
5151IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5152{
5153 /*
5154 * Join paths with sidt.
5155 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5156 * you really must know.
5157 */
5158 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5159 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5160 {
5161 Log(("sgdt: Guest intercept -> VM-exit\n"));
5162 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5163 }
5164
5165 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5166 {
5167 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5168 IEM_SVM_UPDATE_NRIP(pVCpu);
5169 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5170 }
5171
5172 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5173 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5174 if (rcStrict == VINF_SUCCESS)
5175 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5176 return rcStrict;
5177}
5178
5179
5180/**
5181 * Implements lidt.
5182 *
5183 * @param iEffSeg The segment of the new idtr contents
5184 * @param GCPtrEffSrc The address of the new idtr contents.
5185 * @param enmEffOpSize The effective operand size.
5186 */
5187IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5188{
5189 if (pVCpu->iem.s.uCpl != 0)
5190 return iemRaiseGeneralProtectionFault0(pVCpu);
5191 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5192
5193 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5194 {
5195 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5196 IEM_SVM_UPDATE_NRIP(pVCpu);
5197 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5198 }
5199
5200 /*
5201 * Fetch the limit and base address.
5202 */
5203 uint16_t cbLimit;
5204 RTGCPTR GCPtrBase;
5205 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5206 if (rcStrict == VINF_SUCCESS)
5207 {
5208 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5209 || X86_IS_CANONICAL(GCPtrBase))
5210 {
5211 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5212 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5213 }
5214 else
5215 {
5216 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5217 return iemRaiseGeneralProtectionFault0(pVCpu);
5218 }
5219 }
5220 return rcStrict;
5221}
5222
5223
5224/**
5225 * Implements sidt.
5226 *
5227 * @param iEffSeg The segment where to store the idtr content.
5228 * @param GCPtrEffDst The address where to store the idtr content.
5229 */
5230IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5231{
5232 /*
5233 * Join paths with sgdt.
5234 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5235 * you really must know.
5236 */
5237 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5238 {
5239 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5240 IEM_SVM_UPDATE_NRIP(pVCpu);
5241 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5242 }
5243
5244 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5245 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5246 if (rcStrict == VINF_SUCCESS)
5247 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5248 return rcStrict;
5249}
5250
5251
5252/**
5253 * Implements lldt.
5254 *
5255 * @param uNewLdt The new LDT selector value.
5256 */
5257IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5258{
5259 /*
5260 * Check preconditions.
5261 */
5262 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5263 {
5264 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5265 return iemRaiseUndefinedOpcode(pVCpu);
5266 }
5267 if (pVCpu->iem.s.uCpl != 0)
5268 {
5269 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
5270 return iemRaiseGeneralProtectionFault0(pVCpu);
5271 }
5272 /* Nested-guest VMX intercept. */
5273 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5274 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5275 {
5276 Log(("lldt: Guest intercept -> VM-exit\n"));
5277 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5278 }
5279 if (uNewLdt & X86_SEL_LDT)
5280 {
5281 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5282 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5283 }
5284
5285 /*
5286 * Now, loading a NULL selector is easy.
5287 */
5288 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5289 {
5290 /* Nested-guest SVM intercept. */
5291 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5292 {
5293 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5294 IEM_SVM_UPDATE_NRIP(pVCpu);
5295 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5296 }
5297
5298 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5299 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5300 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5301 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5302 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5303 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5304 {
5305 /* AMD-V seems to leave the base and limit alone. */
5306 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5307 }
5308 else
5309 {
5310 /* VT-x (Intel 3960x) seems to be doing the following. */
5311 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5312 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5313 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5314 }
5315
5316 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5317 }
5318
5319 /*
5320 * Read the descriptor.
5321 */
5322 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5323 IEMSELDESC Desc;
5324 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5325 if (rcStrict != VINF_SUCCESS)
5326 return rcStrict;
5327
5328 /* Check GPs first. */
5329 if (Desc.Legacy.Gen.u1DescType)
5330 {
5331 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5332 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5333 }
5334 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5335 {
5336 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5337 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5338 }
5339 uint64_t u64Base;
5340 if (!IEM_IS_LONG_MODE(pVCpu))
5341 u64Base = X86DESC_BASE(&Desc.Legacy);
5342 else
5343 {
5344 if (Desc.Long.Gen.u5Zeros)
5345 {
5346 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5347 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5348 }
5349
5350 u64Base = X86DESC64_BASE(&Desc.Long);
5351 if (!IEM_IS_CANONICAL(u64Base))
5352 {
5353 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5354 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5355 }
5356 }
5357
5358 /* NP */
5359 if (!Desc.Legacy.Gen.u1Present)
5360 {
5361 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5362 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5363 }
5364
5365 /* Nested-guest SVM intercept. */
5366 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5367 {
5368 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5369 IEM_SVM_UPDATE_NRIP(pVCpu);
5370 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5371 }
5372
5373 /*
5374 * It checks out alright, update the registers.
5375 */
5376/** @todo check if the actual value is loaded or if the RPL is dropped */
5377 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5378 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5379 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5380 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5381 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5382 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5383
5384 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5385}
5386
5387
5388/**
5389 * Implements sldt GReg
5390 *
5391 * @param iGReg The general register to store the CRx value in.
5392 * @param enmEffOpSize The operand size.
5393 */
5394IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5395{
5396 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5397 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5398 {
5399 Log(("sldt: Guest intercept -> VM-exit\n"));
5400 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5401 }
5402
5403 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5404
5405 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5406 switch (enmEffOpSize)
5407 {
5408 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5409 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5410 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5411 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5412 }
5413 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5414}
5415
5416
5417/**
5418 * Implements sldt mem.
5419 *
5420 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5421 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5422 */
5423IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5424{
5425 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5426
5427 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5428 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5429 if (rcStrict == VINF_SUCCESS)
5430 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5431 return rcStrict;
5432}
5433
5434
5435/**
5436 * Implements ltr.
5437 *
5438 * @param uNewTr The new TSS selector value.
5439 */
5440IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5441{
5442 /*
5443 * Check preconditions.
5444 */
5445 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5446 {
5447 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5448 return iemRaiseUndefinedOpcode(pVCpu);
5449 }
5450 if (pVCpu->iem.s.uCpl != 0)
5451 {
5452 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5453 return iemRaiseGeneralProtectionFault0(pVCpu);
5454 }
5455 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5456 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5457 {
5458 Log(("ltr: Guest intercept -> VM-exit\n"));
5459 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5460 }
5461 if (uNewTr & X86_SEL_LDT)
5462 {
5463 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5464 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5465 }
5466 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5467 {
5468 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5469 return iemRaiseGeneralProtectionFault0(pVCpu);
5470 }
5471 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5472 {
5473 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5474 IEM_SVM_UPDATE_NRIP(pVCpu);
5475 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5476 }
5477
5478 /*
5479 * Read the descriptor.
5480 */
5481 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5482 IEMSELDESC Desc;
5483 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5484 if (rcStrict != VINF_SUCCESS)
5485 return rcStrict;
5486
5487 /* Check GPs first. */
5488 if (Desc.Legacy.Gen.u1DescType)
5489 {
5490 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5491 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5492 }
5493 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5494 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5495 || IEM_IS_LONG_MODE(pVCpu)) )
5496 {
5497 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5498 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5499 }
5500 uint64_t u64Base;
5501 if (!IEM_IS_LONG_MODE(pVCpu))
5502 u64Base = X86DESC_BASE(&Desc.Legacy);
5503 else
5504 {
5505 if (Desc.Long.Gen.u5Zeros)
5506 {
5507 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5508 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5509 }
5510
5511 u64Base = X86DESC64_BASE(&Desc.Long);
5512 if (!IEM_IS_CANONICAL(u64Base))
5513 {
5514 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5515 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5516 }
5517 }
5518
5519 /* NP */
5520 if (!Desc.Legacy.Gen.u1Present)
5521 {
5522 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5523 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5524 }
5525
5526 /*
5527 * Set it busy.
5528 * Note! Intel says this should lock down the whole descriptor, but we'll
5529 * restrict our selves to 32-bit for now due to lack of inline
5530 * assembly and such.
5531 */
5532 void *pvDesc;
5533 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
5534 IEM_ACCESS_DATA_RW, 0);
5535 if (rcStrict != VINF_SUCCESS)
5536 return rcStrict;
5537 switch ((uintptr_t)pvDesc & 3)
5538 {
5539 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5540 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5541 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5542 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5543 }
5544 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5545 if (rcStrict != VINF_SUCCESS)
5546 return rcStrict;
5547 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5548
5549 /*
5550 * It checks out alright, update the registers.
5551 */
5552/** @todo check if the actual value is loaded or if the RPL is dropped */
5553 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5554 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5555 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5556 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5557 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5558 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5559
5560 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5561}
5562
5563
5564/**
5565 * Implements str GReg
5566 *
5567 * @param iGReg The general register to store the CRx value in.
5568 * @param enmEffOpSize The operand size.
5569 */
5570IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5571{
5572 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5573 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5574 {
5575 Log(("str_reg: Guest intercept -> VM-exit\n"));
5576 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5577 }
5578
5579 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5580
5581 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5582 switch (enmEffOpSize)
5583 {
5584 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5585 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5586 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5587 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5588 }
5589 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5590}
5591
5592
5593/**
5594 * Implements str mem.
5595 *
5596 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5597 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5598 */
5599IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5600{
5601 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5602 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5603 {
5604 Log(("str_mem: Guest intercept -> VM-exit\n"));
5605 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5606 }
5607
5608 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5609
5610 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5611 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5612 if (rcStrict == VINF_SUCCESS)
5613 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5614 return rcStrict;
5615}
5616
5617
5618/**
5619 * Implements mov GReg,CRx.
5620 *
5621 * @param iGReg The general register to store the CRx value in.
5622 * @param iCrReg The CRx register to read (valid).
5623 */
5624IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5625{
5626 if (pVCpu->iem.s.uCpl != 0)
5627 return iemRaiseGeneralProtectionFault0(pVCpu);
5628 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5629
5630 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5631 {
5632 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5633 IEM_SVM_UPDATE_NRIP(pVCpu);
5634 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5635 }
5636
5637 /* Read it. */
5638 uint64_t crX;
5639 switch (iCrReg)
5640 {
5641 case 0:
5642 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5643 crX = pVCpu->cpum.GstCtx.cr0;
5644 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5645 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5646 break;
5647 case 2:
5648 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5649 crX = pVCpu->cpum.GstCtx.cr2;
5650 break;
5651 case 3:
5652 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5653 crX = pVCpu->cpum.GstCtx.cr3;
5654 break;
5655 case 4:
5656 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5657 crX = pVCpu->cpum.GstCtx.cr4;
5658 break;
5659 case 8:
5660 {
5661 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5662#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5663 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5664 {
5665 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5666 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5667 return rcStrict;
5668
5669 /*
5670 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5671 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5672 * are cleared.
5673 *
5674 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5675 */
5676 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5677 {
5678 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5679 crX = (uTpr >> 4) & 0xf;
5680 break;
5681 }
5682 }
5683#endif
5684#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5685 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5686 {
5687 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5688 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5689 {
5690 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5691 break;
5692 }
5693 }
5694#endif
5695 uint8_t uTpr;
5696 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5697 if (RT_SUCCESS(rc))
5698 crX = uTpr >> 4;
5699 else
5700 crX = 0;
5701 break;
5702 }
5703 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5704 }
5705
5706#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5707 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5708 {
5709 switch (iCrReg)
5710 {
5711 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5712 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5713 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5714
5715 case 3:
5716 {
5717 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5718 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5719 return rcStrict;
5720 break;
5721 }
5722 }
5723 }
5724#endif
5725
5726 /* Store it. */
5727 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5728 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5729 else
5730 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5731
5732 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5733}
5734
5735
5736/**
5737 * Implements smsw GReg.
5738 *
5739 * @param iGReg The general register to store the CRx value in.
5740 * @param enmEffOpSize The operand size.
5741 */
5742IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5743{
5744 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5745
5746#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5747 uint64_t u64MaskedCr0;
5748 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5749 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5750 else
5751 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5752 uint64_t const u64GuestCr0 = u64MaskedCr0;
5753#else
5754 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5755#endif
5756
5757 switch (enmEffOpSize)
5758 {
5759 case IEMMODE_16BIT:
5760 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5761 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5762 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5763 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5764 else
5765 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5766 break;
5767
5768 case IEMMODE_32BIT:
5769 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5770 break;
5771
5772 case IEMMODE_64BIT:
5773 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5774 break;
5775
5776 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5777 }
5778
5779 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5780}
5781
5782
5783/**
5784 * Implements smsw mem.
5785 *
5786 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5787 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5788 */
5789IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5790{
5791 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5792
5793#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5794 uint64_t u64MaskedCr0;
5795 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5796 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5797 else
5798 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5799 uint64_t const u64GuestCr0 = u64MaskedCr0;
5800#else
5801 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5802#endif
5803
5804 uint16_t u16Value;
5805 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5806 u16Value = (uint16_t)u64GuestCr0;
5807 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5808 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5809 else
5810 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5811
5812 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5813 if (rcStrict == VINF_SUCCESS)
5814 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5815 return rcStrict;
5816}
5817
5818
5819/**
5820 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5821 */
5822#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5823 do \
5824 { \
5825 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5826 if (RT_SUCCESS(rcX)) \
5827 { /* likely */ } \
5828 else \
5829 { \
5830 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5831 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5832 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5833 } \
5834 } while (0)
5835
5836
5837/**
5838 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5839 *
5840 * @param iCrReg The CRx register to write (valid).
5841 * @param uNewCrX The new value.
5842 * @param enmAccessCrX The instruction that caused the CrX load.
5843 * @param iGReg The general register in case of a 'mov CRx,GReg'
5844 * instruction.
5845 */
5846IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5847{
5848 VBOXSTRICTRC rcStrict;
5849 int rc;
5850#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5851 RT_NOREF2(iGReg, enmAccessCrX);
5852#endif
5853
5854 /*
5855 * Try store it.
5856 * Unfortunately, CPUM only does a tiny bit of the work.
5857 */
5858 switch (iCrReg)
5859 {
5860 case 0:
5861 {
5862 /*
5863 * Perform checks.
5864 */
5865 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5866
5867 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5868 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5869
5870 /* ET is hardcoded on 486 and later. */
5871 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5872 uNewCrX |= X86_CR0_ET;
5873 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5874 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5875 {
5876 uNewCrX &= fValid;
5877 uNewCrX |= X86_CR0_ET;
5878 }
5879 else
5880 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5881
5882 /* Check for reserved bits. */
5883 if (uNewCrX & ~(uint64_t)fValid)
5884 {
5885 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5886 return iemRaiseGeneralProtectionFault0(pVCpu);
5887 }
5888
5889 /* Check for invalid combinations. */
5890 if ( (uNewCrX & X86_CR0_PG)
5891 && !(uNewCrX & X86_CR0_PE) )
5892 {
5893 Log(("Trying to set CR0.PG without CR0.PE\n"));
5894 return iemRaiseGeneralProtectionFault0(pVCpu);
5895 }
5896
5897 if ( !(uNewCrX & X86_CR0_CD)
5898 && (uNewCrX & X86_CR0_NW) )
5899 {
5900 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5901 return iemRaiseGeneralProtectionFault0(pVCpu);
5902 }
5903
5904 if ( !(uNewCrX & X86_CR0_PG)
5905 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5906 {
5907 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5908 return iemRaiseGeneralProtectionFault0(pVCpu);
5909 }
5910
5911 /* Long mode consistency checks. */
5912 if ( (uNewCrX & X86_CR0_PG)
5913 && !(uOldCrX & X86_CR0_PG)
5914 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5915 {
5916 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5917 {
5918 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5919 return iemRaiseGeneralProtectionFault0(pVCpu);
5920 }
5921 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5922 {
5923 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5924 return iemRaiseGeneralProtectionFault0(pVCpu);
5925 }
5926 }
5927
5928#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5929 /* Check for bits that must remain set or cleared in VMX operation,
5930 see Intel spec. 23.8 "Restrictions on VMX operation". */
5931 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5932 {
5933 uint64_t const uCr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
5934 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5935 {
5936 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5937 return iemRaiseGeneralProtectionFault0(pVCpu);
5938 }
5939
5940 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5941 if (uNewCrX & ~uCr0Fixed1)
5942 {
5943 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5944 return iemRaiseGeneralProtectionFault0(pVCpu);
5945 }
5946 }
5947#endif
5948
5949 /*
5950 * SVM nested-guest CR0 write intercepts.
5951 */
5952 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5953 {
5954 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5955 IEM_SVM_UPDATE_NRIP(pVCpu);
5956 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5957 }
5958 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5959 {
5960 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5961 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5962 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5963 {
5964 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5965 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5966 IEM_SVM_UPDATE_NRIP(pVCpu);
5967 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5968 }
5969 }
5970
5971 /*
5972 * Change EFER.LMA if entering or leaving long mode.
5973 */
5974 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5975 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5976 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5977 {
5978 if (uNewCrX & X86_CR0_PG)
5979 NewEFER |= MSR_K6_EFER_LMA;
5980 else
5981 NewEFER &= ~MSR_K6_EFER_LMA;
5982
5983 CPUMSetGuestEFER(pVCpu, NewEFER);
5984 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5985 }
5986
5987 /*
5988 * Inform PGM.
5989 */
5990 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5991 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5992 {
5993 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
5994 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
5995 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5996 { /* likely */ }
5997 else
5998 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
5999 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6000 AssertRCReturn(rc, rc);
6001 /* ignore informational status codes */
6002 }
6003
6004 /*
6005 * Change CR0.
6006 */
6007 CPUMSetGuestCR0(pVCpu, uNewCrX);
6008 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
6009
6010 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6011 false /* fForce */);
6012 break;
6013 }
6014
6015 /*
6016 * CR2 can be changed without any restrictions.
6017 */
6018 case 2:
6019 {
6020 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
6021 {
6022 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6023 IEM_SVM_UPDATE_NRIP(pVCpu);
6024 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
6025 }
6026 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
6027 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
6028 rcStrict = VINF_SUCCESS;
6029 break;
6030 }
6031
6032 /*
6033 * CR3 is relatively simple, although AMD and Intel have different
6034 * accounts of how setting reserved bits are handled. We take intel's
6035 * word for the lower bits and AMD's for the high bits (63:52). The
6036 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
6037 * on this.
6038 */
6039 /** @todo Testcase: Setting reserved bits in CR3, especially before
6040 * enabling paging. */
6041 case 3:
6042 {
6043 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6044
6045 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6046 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6047 && (uNewCrX & RT_BIT_64(63)))
6048 {
6049 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6050 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6051 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6052 * Paging-Structure Caches". */
6053 uNewCrX &= ~RT_BIT_64(63);
6054 }
6055
6056 /* Check / mask the value. */
6057#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6058 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6059 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6060 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6061 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6062#else
6063 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6064#endif
6065 if (uNewCrX & fInvPhysMask)
6066 {
6067 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6068 * very vague in this area. As mentioned above, need testcase on real
6069 * hardware... Sigh. */
6070 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6071 return iemRaiseGeneralProtectionFault0(pVCpu);
6072 }
6073
6074 uint64_t fValid;
6075 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6076 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6077 {
6078 /** @todo Redundant? This value has already been validated above. */
6079 fValid = UINT64_C(0x000fffffffffffff);
6080 }
6081 else
6082 fValid = UINT64_C(0xffffffff);
6083 if (uNewCrX & ~fValid)
6084 {
6085 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6086 uNewCrX, uNewCrX & ~fValid));
6087 uNewCrX &= fValid;
6088 }
6089
6090 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6091 {
6092 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6093 IEM_SVM_UPDATE_NRIP(pVCpu);
6094 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6095 }
6096
6097 /* Inform PGM. */
6098 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6099 {
6100 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6101 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6102 { /* likely */ }
6103 else
6104 {
6105 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6106 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6107 }
6108 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6109 AssertRCReturn(rc, rc);
6110 /* ignore informational status codes */
6111 }
6112
6113 /* Make the change. */
6114 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6115 AssertRCSuccessReturn(rc, rc);
6116
6117 rcStrict = VINF_SUCCESS;
6118 break;
6119 }
6120
6121 /*
6122 * CR4 is a bit more tedious as there are bits which cannot be cleared
6123 * under some circumstances and such.
6124 */
6125 case 4:
6126 {
6127 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6128 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6129
6130 /* Reserved bits. */
6131 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6132 if (uNewCrX & ~(uint64_t)fValid)
6133 {
6134 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6135 return iemRaiseGeneralProtectionFault0(pVCpu);
6136 }
6137
6138 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6139 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6140
6141 /* PCIDE check. */
6142 if ( fPcide
6143 && ( !fLongMode
6144 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6145 {
6146 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6147 return iemRaiseGeneralProtectionFault0(pVCpu);
6148 }
6149
6150 /* PAE check. */
6151 if ( fLongMode
6152 && (uOldCrX & X86_CR4_PAE)
6153 && !(uNewCrX & X86_CR4_PAE))
6154 {
6155 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6156 return iemRaiseGeneralProtectionFault0(pVCpu);
6157 }
6158
6159 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6160 {
6161 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6162 IEM_SVM_UPDATE_NRIP(pVCpu);
6163 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6164 }
6165
6166 /* Check for bits that must remain set or cleared in VMX operation,
6167 see Intel spec. 23.8 "Restrictions on VMX operation". */
6168 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6169 {
6170 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6171 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6172 {
6173 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6174 return iemRaiseGeneralProtectionFault0(pVCpu);
6175 }
6176
6177 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6178 if (uNewCrX & ~uCr4Fixed1)
6179 {
6180 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6181 return iemRaiseGeneralProtectionFault0(pVCpu);
6182 }
6183 }
6184
6185 /*
6186 * Notify PGM.
6187 */
6188 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6189 {
6190 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6191 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6192 { /* likely */ }
6193 else
6194 {
6195 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6196 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6197 }
6198 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6199 AssertRCReturn(rc, rc);
6200 /* ignore informational status codes */
6201 }
6202
6203 /*
6204 * Change it.
6205 */
6206 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6207 AssertRCSuccessReturn(rc, rc);
6208 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6209
6210 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6211 false /* fForce */);
6212 break;
6213 }
6214
6215 /*
6216 * CR8 maps to the APIC TPR.
6217 */
6218 case 8:
6219 {
6220 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6221 if (uNewCrX & ~(uint64_t)0xf)
6222 {
6223 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6224 return iemRaiseGeneralProtectionFault0(pVCpu);
6225 }
6226
6227#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6228 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6229 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6230 {
6231 /*
6232 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6233 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6234 * cleared. Following this the processor performs TPR virtualization.
6235 *
6236 * However, we should not perform TPR virtualization immediately here but
6237 * after this instruction has completed.
6238 *
6239 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6240 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6241 */
6242 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6243 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6244 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6245 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6246 rcStrict = VINF_SUCCESS;
6247 break;
6248 }
6249#endif
6250
6251#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6252 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6253 {
6254 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6255 {
6256 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6257 IEM_SVM_UPDATE_NRIP(pVCpu);
6258 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6259 }
6260
6261 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6262 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6263 {
6264 rcStrict = VINF_SUCCESS;
6265 break;
6266 }
6267 }
6268#endif
6269 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6270 APICSetTpr(pVCpu, u8Tpr);
6271 rcStrict = VINF_SUCCESS;
6272 break;
6273 }
6274
6275 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6276 }
6277
6278 /*
6279 * Advance the RIP on success.
6280 */
6281 if (RT_SUCCESS(rcStrict))
6282 {
6283 if (rcStrict != VINF_SUCCESS)
6284 iemSetPassUpStatus(pVCpu, rcStrict);
6285 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6286 }
6287
6288 return rcStrict;
6289}
6290
6291
6292/**
6293 * Implements mov CRx,GReg.
6294 *
6295 * @param iCrReg The CRx register to write (valid).
6296 * @param iGReg The general register to load the CRx value from.
6297 */
6298IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6299{
6300 if (pVCpu->iem.s.uCpl != 0)
6301 return iemRaiseGeneralProtectionFault0(pVCpu);
6302 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6303
6304 /*
6305 * Read the new value from the source register and call common worker.
6306 */
6307 uint64_t uNewCrX;
6308 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6309 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6310 else
6311 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6312
6313#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6314 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6315 {
6316 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6317 switch (iCrReg)
6318 {
6319 case 0:
6320 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6321 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6322 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6323 }
6324 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6325 return rcStrict;
6326 }
6327#endif
6328
6329 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6330}
6331
6332
6333/**
6334 * Implements 'LMSW r/m16'
6335 *
6336 * @param u16NewMsw The new value.
6337 * @param GCPtrEffDst The guest-linear address of the source operand in case
6338 * of a memory operand. For register operand, pass
6339 * NIL_RTGCPTR.
6340 */
6341IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6342{
6343 if (pVCpu->iem.s.uCpl != 0)
6344 return iemRaiseGeneralProtectionFault0(pVCpu);
6345 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6346 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6347
6348#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6349 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6350 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6351 {
6352 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6353 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6354 return rcStrict;
6355 }
6356#else
6357 RT_NOREF_PV(GCPtrEffDst);
6358#endif
6359
6360 /*
6361 * Compose the new CR0 value and call common worker.
6362 */
6363 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6364 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6365 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6366}
6367
6368
6369/**
6370 * Implements 'CLTS'.
6371 */
6372IEM_CIMPL_DEF_0(iemCImpl_clts)
6373{
6374 if (pVCpu->iem.s.uCpl != 0)
6375 return iemRaiseGeneralProtectionFault0(pVCpu);
6376
6377 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6378 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6379 uNewCr0 &= ~X86_CR0_TS;
6380
6381#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6382 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6383 {
6384 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6385 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6386 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6387 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6388 return rcStrict;
6389 }
6390#endif
6391
6392 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6393}
6394
6395
6396/**
6397 * Implements mov GReg,DRx.
6398 *
6399 * @param iGReg The general register to store the DRx value in.
6400 * @param iDrReg The DRx register to read (0-7).
6401 */
6402IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6403{
6404#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6405 /*
6406 * Check nested-guest VMX intercept.
6407 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6408 * over CPL and CR4.DE and even DR4/DR5 checks.
6409 *
6410 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6411 */
6412 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6413 {
6414 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6415 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6416 return rcStrict;
6417 }
6418#endif
6419
6420 /*
6421 * Check preconditions.
6422 */
6423 /* Raise GPs. */
6424 if (pVCpu->iem.s.uCpl != 0)
6425 return iemRaiseGeneralProtectionFault0(pVCpu);
6426 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6427 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6428
6429 /** @todo \#UD in outside ring-0 too? */
6430 if (iDrReg == 4 || iDrReg == 5)
6431 {
6432 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6433 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6434 {
6435 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6436 return iemRaiseGeneralProtectionFault0(pVCpu);
6437 }
6438 iDrReg += 2;
6439 }
6440
6441 /* Raise #DB if general access detect is enabled. */
6442 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6443 {
6444 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6445 return iemRaiseDebugException(pVCpu);
6446 }
6447
6448 /*
6449 * Read the debug register and store it in the specified general register.
6450 */
6451 uint64_t drX;
6452 switch (iDrReg)
6453 {
6454 case 0:
6455 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6456 drX = pVCpu->cpum.GstCtx.dr[0];
6457 break;
6458 case 1:
6459 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6460 drX = pVCpu->cpum.GstCtx.dr[1];
6461 break;
6462 case 2:
6463 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6464 drX = pVCpu->cpum.GstCtx.dr[2];
6465 break;
6466 case 3:
6467 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6468 drX = pVCpu->cpum.GstCtx.dr[3];
6469 break;
6470 case 6:
6471 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6472 drX = pVCpu->cpum.GstCtx.dr[6];
6473 drX |= X86_DR6_RA1_MASK;
6474 drX &= ~X86_DR6_RAZ_MASK;
6475 break;
6476 case 7:
6477 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6478 drX = pVCpu->cpum.GstCtx.dr[7];
6479 drX |=X86_DR7_RA1_MASK;
6480 drX &= ~X86_DR7_RAZ_MASK;
6481 break;
6482 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6483 }
6484
6485 /** @todo SVM nested-guest intercept for DR8-DR15? */
6486 /*
6487 * Check for any SVM nested-guest intercepts for the DRx read.
6488 */
6489 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6490 {
6491 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6492 IEM_SVM_UPDATE_NRIP(pVCpu);
6493 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6494 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6495 }
6496
6497 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6498 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6499 else
6500 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6501
6502 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6503}
6504
6505
6506/**
6507 * Implements mov DRx,GReg.
6508 *
6509 * @param iDrReg The DRx register to write (valid).
6510 * @param iGReg The general register to load the DRx value from.
6511 */
6512IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6513{
6514#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6515 /*
6516 * Check nested-guest VMX intercept.
6517 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6518 * over CPL and CR4.DE and even DR4/DR5 checks.
6519 *
6520 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6521 */
6522 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6523 {
6524 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6525 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6526 return rcStrict;
6527 }
6528#endif
6529
6530 /*
6531 * Check preconditions.
6532 */
6533 if (pVCpu->iem.s.uCpl != 0)
6534 return iemRaiseGeneralProtectionFault0(pVCpu);
6535 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6536 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6537
6538 if (iDrReg == 4 || iDrReg == 5)
6539 {
6540 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6541 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6542 {
6543 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6544 return iemRaiseGeneralProtectionFault0(pVCpu);
6545 }
6546 iDrReg += 2;
6547 }
6548
6549 /* Raise #DB if general access detect is enabled. */
6550 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6551 * \#GP? */
6552 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6553 {
6554 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6555 return iemRaiseDebugException(pVCpu);
6556 }
6557
6558 /*
6559 * Read the new value from the source register.
6560 */
6561 uint64_t uNewDrX;
6562 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6563 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6564 else
6565 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6566
6567 /*
6568 * Adjust it.
6569 */
6570 switch (iDrReg)
6571 {
6572 case 0:
6573 case 1:
6574 case 2:
6575 case 3:
6576 /* nothing to adjust */
6577 break;
6578
6579 case 6:
6580 if (uNewDrX & X86_DR6_MBZ_MASK)
6581 {
6582 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6583 return iemRaiseGeneralProtectionFault0(pVCpu);
6584 }
6585 uNewDrX |= X86_DR6_RA1_MASK;
6586 uNewDrX &= ~X86_DR6_RAZ_MASK;
6587 break;
6588
6589 case 7:
6590 if (uNewDrX & X86_DR7_MBZ_MASK)
6591 {
6592 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6593 return iemRaiseGeneralProtectionFault0(pVCpu);
6594 }
6595 uNewDrX |= X86_DR7_RA1_MASK;
6596 uNewDrX &= ~X86_DR7_RAZ_MASK;
6597 break;
6598
6599 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6600 }
6601
6602 /** @todo SVM nested-guest intercept for DR8-DR15? */
6603 /*
6604 * Check for any SVM nested-guest intercepts for the DRx write.
6605 */
6606 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6607 {
6608 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6609 IEM_SVM_UPDATE_NRIP(pVCpu);
6610 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6611 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6612 }
6613
6614 /*
6615 * Do the actual setting.
6616 */
6617 if (iDrReg < 4)
6618 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6619 else if (iDrReg == 6)
6620 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6621
6622 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6623 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6624
6625 /*
6626 * Re-init hardware breakpoint summary if it was DR7 that got changed.
6627 */
6628 if (iDrReg == 7)
6629 {
6630 pVCpu->iem.s.fPendingInstructionBreakpoints = false;
6631 pVCpu->iem.s.fPendingDataBreakpoints = false;
6632 pVCpu->iem.s.fPendingIoBreakpoints = false;
6633 iemInitPendingBreakpointsSlow(pVCpu);
6634 }
6635
6636 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6637}
6638
6639
6640/**
6641 * Implements mov GReg,TRx.
6642 *
6643 * @param iGReg The general register to store the
6644 * TRx value in.
6645 * @param iTrReg The TRx register to read (6/7).
6646 */
6647IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6648{
6649 /*
6650 * Check preconditions. NB: This instruction is 386/486 only.
6651 */
6652
6653 /* Raise GPs. */
6654 if (pVCpu->iem.s.uCpl != 0)
6655 return iemRaiseGeneralProtectionFault0(pVCpu);
6656 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6657
6658 if (iTrReg < 6 || iTrReg > 7)
6659 {
6660 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6661 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6662 return iemRaiseGeneralProtectionFault0(pVCpu);
6663 }
6664
6665 /*
6666 * Read the test register and store it in the specified general register.
6667 * This is currently a dummy implementation that only exists to satisfy
6668 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6669 * TR6/TR7 registers. Software which actually depends on the TR values
6670 * (different on 386/486) is exceedingly rare.
6671 */
6672 uint64_t trX;
6673 switch (iTrReg)
6674 {
6675 case 6:
6676 trX = 0; /* Currently a dummy. */
6677 break;
6678 case 7:
6679 trX = 0; /* Currently a dummy. */
6680 break;
6681 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6682 }
6683
6684 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)trX;
6685
6686 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6687}
6688
6689
6690/**
6691 * Implements mov TRx,GReg.
6692 *
6693 * @param iTrReg The TRx register to write (valid).
6694 * @param iGReg The general register to load the TRx
6695 * value from.
6696 */
6697IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6698{
6699 /*
6700 * Check preconditions. NB: This instruction is 386/486 only.
6701 */
6702
6703 /* Raise GPs. */
6704 if (pVCpu->iem.s.uCpl != 0)
6705 return iemRaiseGeneralProtectionFault0(pVCpu);
6706 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6707
6708 if (iTrReg < 6 || iTrReg > 7)
6709 {
6710 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6711 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6712 return iemRaiseGeneralProtectionFault0(pVCpu);
6713 }
6714
6715 /*
6716 * Read the new value from the source register.
6717 */
6718 uint64_t uNewTrX;
6719 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6720 uNewTrX = iemGRegFetchU64(pVCpu, iGReg);
6721 else
6722 uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6723
6724 /*
6725 * Here we would do the actual setting if this weren't a dummy implementation.
6726 * This is currently a dummy implementation that only exists to prevent
6727 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6728 */
6729 RT_NOREF(uNewTrX);
6730
6731 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6732}
6733
6734
6735/**
6736 * Implements 'INVLPG m'.
6737 *
6738 * @param GCPtrPage The effective address of the page to invalidate.
6739 * @remarks Updates the RIP.
6740 */
6741IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6742{
6743 /* ring-0 only. */
6744 if (pVCpu->iem.s.uCpl != 0)
6745 return iemRaiseGeneralProtectionFault0(pVCpu);
6746 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6747 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6748
6749#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6750 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6751 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6752 {
6753 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6754 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6755 }
6756#endif
6757
6758 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6759 {
6760 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6761 IEM_SVM_UPDATE_NRIP(pVCpu);
6762 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6763 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6764 }
6765
6766 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6767 if (rc == VINF_SUCCESS)
6768 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6769 if (rc == VINF_PGM_SYNC_CR3)
6770 {
6771 iemSetPassUpStatus(pVCpu, rc);
6772 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6773 }
6774
6775 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6776 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6777 return rc;
6778}
6779
6780
6781/**
6782 * Implements INVPCID.
6783 *
6784 * @param iEffSeg The segment of the invpcid descriptor.
6785 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6786 * @param uInvpcidType The invalidation type.
6787 * @remarks Updates the RIP.
6788 */
6789IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6790{
6791 /*
6792 * Check preconditions.
6793 */
6794 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6795 return iemRaiseUndefinedOpcode(pVCpu);
6796
6797 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6798 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6799 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6800 {
6801 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6802 return iemRaiseUndefinedOpcode(pVCpu);
6803 }
6804
6805 if (pVCpu->iem.s.uCpl != 0)
6806 {
6807 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6808 return iemRaiseGeneralProtectionFault0(pVCpu);
6809 }
6810
6811 if (IEM_IS_V86_MODE(pVCpu))
6812 {
6813 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6814 return iemRaiseGeneralProtectionFault0(pVCpu);
6815 }
6816
6817 /*
6818 * Check nested-guest intercept.
6819 *
6820 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6821 * both set. We have already checked the former earlier in this function.
6822 *
6823 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6824 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6825 */
6826 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6827 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6828 {
6829 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6830 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6831 }
6832
6833 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6834 {
6835 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6836 return iemRaiseGeneralProtectionFault0(pVCpu);
6837 }
6838 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6839
6840 /*
6841 * Fetch the invpcid descriptor from guest memory.
6842 */
6843 RTUINT128U uDesc;
6844 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6845 if (rcStrict == VINF_SUCCESS)
6846 {
6847 /*
6848 * Validate the descriptor.
6849 */
6850 if (uDesc.s.Lo > 0xfff)
6851 {
6852 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6853 return iemRaiseGeneralProtectionFault0(pVCpu);
6854 }
6855
6856 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6857 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6858 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6859 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6860 switch (uInvpcidType)
6861 {
6862 case X86_INVPCID_TYPE_INDV_ADDR:
6863 {
6864 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6865 {
6866 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6867 return iemRaiseGeneralProtectionFault0(pVCpu);
6868 }
6869 if ( !(uCr4 & X86_CR4_PCIDE)
6870 && uPcid != 0)
6871 {
6872 Log(("invpcid: invalid pcid %#x\n", uPcid));
6873 return iemRaiseGeneralProtectionFault0(pVCpu);
6874 }
6875
6876 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6877 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6878 break;
6879 }
6880
6881 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6882 {
6883 if ( !(uCr4 & X86_CR4_PCIDE)
6884 && uPcid != 0)
6885 {
6886 Log(("invpcid: invalid pcid %#x\n", uPcid));
6887 return iemRaiseGeneralProtectionFault0(pVCpu);
6888 }
6889 /* Invalidate all mappings associated with PCID except global translations. */
6890 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6891 break;
6892 }
6893
6894 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6895 {
6896 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6897 break;
6898 }
6899
6900 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6901 {
6902 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6903 break;
6904 }
6905 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6906 }
6907 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6908 }
6909 return rcStrict;
6910}
6911
6912
6913/**
6914 * Implements INVD.
6915 */
6916IEM_CIMPL_DEF_0(iemCImpl_invd)
6917{
6918 if (pVCpu->iem.s.uCpl != 0)
6919 {
6920 Log(("invd: CPL != 0 -> #GP(0)\n"));
6921 return iemRaiseGeneralProtectionFault0(pVCpu);
6922 }
6923
6924 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6925 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6926
6927 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6928
6929 /* We currently take no action here. */
6930 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6931}
6932
6933
6934/**
6935 * Implements WBINVD.
6936 */
6937IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6938{
6939 if (pVCpu->iem.s.uCpl != 0)
6940 {
6941 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6942 return iemRaiseGeneralProtectionFault0(pVCpu);
6943 }
6944
6945 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6946 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6947
6948 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6949
6950 /* We currently take no action here. */
6951 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6952}
6953
6954
6955/** Opcode 0x0f 0xaa. */
6956IEM_CIMPL_DEF_0(iemCImpl_rsm)
6957{
6958 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6959 NOREF(cbInstr);
6960 return iemRaiseUndefinedOpcode(pVCpu);
6961}
6962
6963
6964/**
6965 * Implements RDTSC.
6966 */
6967IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6968{
6969 /*
6970 * Check preconditions.
6971 */
6972 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6973 return iemRaiseUndefinedOpcode(pVCpu);
6974
6975 if (pVCpu->iem.s.uCpl != 0)
6976 {
6977 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6978 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6979 {
6980 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6981 return iemRaiseGeneralProtectionFault0(pVCpu);
6982 }
6983 }
6984
6985 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6986 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6987 {
6988 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6989 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6990 }
6991
6992 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6993 {
6994 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6995 IEM_SVM_UPDATE_NRIP(pVCpu);
6996 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6997 }
6998
6999 /*
7000 * Do the job.
7001 */
7002 uint64_t uTicks = TMCpuTickGet(pVCpu);
7003#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7004 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7005#endif
7006 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7007 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7008 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
7009 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7010}
7011
7012
7013/**
7014 * Implements RDTSC.
7015 */
7016IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
7017{
7018 /*
7019 * Check preconditions.
7020 */
7021 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
7022 return iemRaiseUndefinedOpcode(pVCpu);
7023
7024 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7025 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
7026 {
7027 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
7028 return iemRaiseUndefinedOpcode(pVCpu);
7029 }
7030
7031 if (pVCpu->iem.s.uCpl != 0)
7032 {
7033 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7034 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7035 {
7036 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
7037 return iemRaiseGeneralProtectionFault0(pVCpu);
7038 }
7039 }
7040
7041 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7042 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7043 {
7044 Log(("rdtscp: Guest intercept -> VM-exit\n"));
7045 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
7046 }
7047 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
7048 {
7049 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
7050 IEM_SVM_UPDATE_NRIP(pVCpu);
7051 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7052 }
7053
7054 /*
7055 * Do the job.
7056 * Query the MSR first in case of trips to ring-3.
7057 */
7058 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7059 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7060 if (rcStrict == VINF_SUCCESS)
7061 {
7062 /* Low dword of the TSC_AUX msr only. */
7063 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7064
7065 uint64_t uTicks = TMCpuTickGet(pVCpu);
7066#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7067 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7068#endif
7069 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7070 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7071 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7072 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7073 }
7074 return rcStrict;
7075}
7076
7077
7078/**
7079 * Implements RDPMC.
7080 */
7081IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7082{
7083 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7084
7085 if ( pVCpu->iem.s.uCpl != 0
7086 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7087 return iemRaiseGeneralProtectionFault0(pVCpu);
7088
7089 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7090 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7091 {
7092 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7093 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7094 }
7095
7096 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7097 {
7098 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7099 IEM_SVM_UPDATE_NRIP(pVCpu);
7100 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7101 }
7102
7103 /** @todo Emulate performance counters, for now just return 0. */
7104 pVCpu->cpum.GstCtx.rax = 0;
7105 pVCpu->cpum.GstCtx.rdx = 0;
7106 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7107 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7108 * ecx but see @bugref{3472}! */
7109
7110 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7111}
7112
7113
7114/**
7115 * Implements RDMSR.
7116 */
7117IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7118{
7119 /*
7120 * Check preconditions.
7121 */
7122 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7123 return iemRaiseUndefinedOpcode(pVCpu);
7124 if (pVCpu->iem.s.uCpl != 0)
7125 return iemRaiseGeneralProtectionFault0(pVCpu);
7126
7127 /*
7128 * Check nested-guest intercepts.
7129 */
7130#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7131 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7132 {
7133 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7134 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7135 }
7136#endif
7137
7138#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7139 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7140 {
7141 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
7142 if (rcStrict == VINF_SVM_VMEXIT)
7143 return VINF_SUCCESS;
7144 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7145 {
7146 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7147 return rcStrict;
7148 }
7149 }
7150#endif
7151
7152 /*
7153 * Do the job.
7154 */
7155 RTUINT64U uValue;
7156 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7157 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7158
7159 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7160 if (rcStrict == VINF_SUCCESS)
7161 {
7162 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7163 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7164 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7165
7166 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7167 }
7168
7169#ifndef IN_RING3
7170 /* Deferred to ring-3. */
7171 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7172 {
7173 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7174 return rcStrict;
7175 }
7176#endif
7177
7178 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7179 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7180 {
7181 pVCpu->iem.s.cLogRelRdMsr++;
7182 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7183 }
7184 else
7185 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7186 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7187 return iemRaiseGeneralProtectionFault0(pVCpu);
7188}
7189
7190
7191/**
7192 * Implements WRMSR.
7193 */
7194IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7195{
7196 /*
7197 * Check preconditions.
7198 */
7199 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7200 return iemRaiseUndefinedOpcode(pVCpu);
7201 if (pVCpu->iem.s.uCpl != 0)
7202 return iemRaiseGeneralProtectionFault0(pVCpu);
7203
7204 RTUINT64U uValue;
7205 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7206 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7207
7208 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7209
7210 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7211 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7212
7213 /*
7214 * Check nested-guest intercepts.
7215 */
7216#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7217 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7218 {
7219 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7220 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7221 }
7222#endif
7223
7224#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7225 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7226 {
7227 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
7228 if (rcStrict == VINF_SVM_VMEXIT)
7229 return VINF_SUCCESS;
7230 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7231 {
7232 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7233 return rcStrict;
7234 }
7235 }
7236#endif
7237
7238 /*
7239 * Do the job.
7240 */
7241 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7242 if (rcStrict == VINF_SUCCESS)
7243 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7244
7245#ifndef IN_RING3
7246 /* Deferred to ring-3. */
7247 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7248 {
7249 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7250 return rcStrict;
7251 }
7252#endif
7253
7254 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7255 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7256 {
7257 pVCpu->iem.s.cLogRelWrMsr++;
7258 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7259 }
7260 else
7261 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7262 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7263 return iemRaiseGeneralProtectionFault0(pVCpu);
7264}
7265
7266
7267/**
7268 * Implements 'IN eAX, port'.
7269 *
7270 * @param u16Port The source port.
7271 * @param fImm Whether the port was specified through an immediate operand
7272 * or the implicit DX register.
7273 * @param cbReg The register size.
7274 */
7275IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7276{
7277 /*
7278 * CPL check
7279 */
7280 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7281 if (rcStrict != VINF_SUCCESS)
7282 return rcStrict;
7283
7284 /*
7285 * Check VMX nested-guest IO intercept.
7286 */
7287#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7288 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7289 {
7290 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
7291 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7292 return rcStrict;
7293 }
7294#else
7295 RT_NOREF(fImm);
7296#endif
7297
7298 /*
7299 * Check SVM nested-guest IO intercept.
7300 */
7301#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7302 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7303 {
7304 uint8_t cAddrSizeBits;
7305 switch (pVCpu->iem.s.enmEffAddrMode)
7306 {
7307 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7308 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7309 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7310 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7311 }
7312 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7313 false /* fRep */, false /* fStrIo */, cbInstr);
7314 if (rcStrict == VINF_SVM_VMEXIT)
7315 return VINF_SUCCESS;
7316 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7317 {
7318 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7319 VBOXSTRICTRC_VAL(rcStrict)));
7320 return rcStrict;
7321 }
7322 }
7323#endif
7324
7325 /*
7326 * Perform the I/O.
7327 */
7328 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7329 uint32_t u32Value = 0;
7330 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7331 if (IOM_SUCCESS(rcStrict))
7332 {
7333 switch (cbReg)
7334 {
7335 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7336 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7337 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7338 default: AssertFailedReturn(VERR_IEM_IPE_3);
7339 }
7340
7341 pVCpu->iem.s.cPotentialExits++;
7342 if (rcStrict != VINF_SUCCESS)
7343 iemSetPassUpStatus(pVCpu, rcStrict);
7344
7345 /*
7346 * Check for I/O breakpoints before we complete the instruction.
7347 */
7348 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7349 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7350 && X86_DR7_ANY_RW_IO(fDr7)
7351 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7352 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7353 && rcStrict == VINF_SUCCESS))
7354 {
7355 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7356 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7357 }
7358
7359 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7360 }
7361
7362 return rcStrict;
7363}
7364
7365
7366/**
7367 * Implements 'IN eAX, DX'.
7368 *
7369 * @param cbReg The register size.
7370 */
7371IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
7372{
7373 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7374}
7375
7376
7377/**
7378 * Implements 'OUT port, eAX'.
7379 *
7380 * @param u16Port The destination port.
7381 * @param fImm Whether the port was specified through an immediate operand
7382 * or the implicit DX register.
7383 * @param cbReg The register size.
7384 */
7385IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7386{
7387 /*
7388 * CPL check
7389 */
7390 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7391 if (rcStrict != VINF_SUCCESS)
7392 return rcStrict;
7393
7394 /*
7395 * Check VMX nested-guest I/O intercept.
7396 */
7397#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7398 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7399 {
7400 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
7401 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7402 return rcStrict;
7403 }
7404#else
7405 RT_NOREF(fImm);
7406#endif
7407
7408 /*
7409 * Check SVM nested-guest I/O intercept.
7410 */
7411#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7412 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7413 {
7414 uint8_t cAddrSizeBits;
7415 switch (pVCpu->iem.s.enmEffAddrMode)
7416 {
7417 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7418 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7419 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7420 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7421 }
7422 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7423 false /* fRep */, false /* fStrIo */, cbInstr);
7424 if (rcStrict == VINF_SVM_VMEXIT)
7425 return VINF_SUCCESS;
7426 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7427 {
7428 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7429 VBOXSTRICTRC_VAL(rcStrict)));
7430 return rcStrict;
7431 }
7432 }
7433#endif
7434
7435 /*
7436 * Perform the I/O.
7437 */
7438 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7439 uint32_t u32Value;
7440 switch (cbReg)
7441 {
7442 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7443 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7444 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7445 default: AssertFailedReturn(VERR_IEM_IPE_4);
7446 }
7447 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7448 if (IOM_SUCCESS(rcStrict))
7449 {
7450 pVCpu->iem.s.cPotentialExits++;
7451 if (rcStrict != VINF_SUCCESS)
7452 iemSetPassUpStatus(pVCpu, rcStrict);
7453
7454 /*
7455 * Check for I/O breakpoints before we complete the instruction.
7456 */
7457 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7458 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7459 && X86_DR7_ANY_RW_IO(fDr7)
7460 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7461 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7462 && rcStrict == VINF_SUCCESS))
7463 {
7464 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7465 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7466 }
7467
7468 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7469 }
7470 return rcStrict;
7471}
7472
7473
7474/**
7475 * Implements 'OUT DX, eAX'.
7476 *
7477 * @param cbReg The register size.
7478 */
7479IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7480{
7481 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7482}
7483
7484
7485/**
7486 * Implements 'CLI'.
7487 */
7488IEM_CIMPL_DEF_0(iemCImpl_cli)
7489{
7490 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7491#ifdef LOG_ENABLED
7492 uint32_t const fEflOld = fEfl;
7493#endif
7494
7495 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7496 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7497 {
7498 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7499 if (!(fEfl & X86_EFL_VM))
7500 {
7501 if (pVCpu->iem.s.uCpl <= uIopl)
7502 fEfl &= ~X86_EFL_IF;
7503 else if ( pVCpu->iem.s.uCpl == 3
7504 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7505 fEfl &= ~X86_EFL_VIF;
7506 else
7507 return iemRaiseGeneralProtectionFault0(pVCpu);
7508 }
7509 /* V8086 */
7510 else if (uIopl == 3)
7511 fEfl &= ~X86_EFL_IF;
7512 else if ( uIopl < 3
7513 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7514 fEfl &= ~X86_EFL_VIF;
7515 else
7516 return iemRaiseGeneralProtectionFault0(pVCpu);
7517 }
7518 /* real mode */
7519 else
7520 fEfl &= ~X86_EFL_IF;
7521
7522 /* Commit. */
7523 IEMMISC_SET_EFL(pVCpu, fEfl);
7524 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7525 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7526 return rcStrict;
7527}
7528
7529
7530/**
7531 * Implements 'STI'.
7532 */
7533IEM_CIMPL_DEF_0(iemCImpl_sti)
7534{
7535 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7536 uint32_t const fEflOld = fEfl;
7537
7538 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7539 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7540 {
7541 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7542 if (!(fEfl & X86_EFL_VM))
7543 {
7544 if (pVCpu->iem.s.uCpl <= uIopl)
7545 fEfl |= X86_EFL_IF;
7546 else if ( pVCpu->iem.s.uCpl == 3
7547 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7548 && !(fEfl & X86_EFL_VIP) )
7549 fEfl |= X86_EFL_VIF;
7550 else
7551 return iemRaiseGeneralProtectionFault0(pVCpu);
7552 }
7553 /* V8086 */
7554 else if (uIopl == 3)
7555 fEfl |= X86_EFL_IF;
7556 else if ( uIopl < 3
7557 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7558 && !(fEfl & X86_EFL_VIP) )
7559 fEfl |= X86_EFL_VIF;
7560 else
7561 return iemRaiseGeneralProtectionFault0(pVCpu);
7562 }
7563 /* real mode */
7564 else
7565 fEfl |= X86_EFL_IF;
7566
7567 /*
7568 * Commit.
7569 *
7570 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7571 */
7572 IEMMISC_SET_EFL(pVCpu, fEfl);
7573 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7574 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7575 {
7576 /** @todo only set it the shadow flag if it was clear before? */
7577 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7578 }
7579 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7580 return rcStrict;
7581}
7582
7583
7584/**
7585 * Implements 'HLT'.
7586 */
7587IEM_CIMPL_DEF_0(iemCImpl_hlt)
7588{
7589 if (pVCpu->iem.s.uCpl != 0)
7590 return iemRaiseGeneralProtectionFault0(pVCpu);
7591
7592 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7593 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7594 {
7595 Log2(("hlt: Guest intercept -> VM-exit\n"));
7596 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7597 }
7598
7599 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7600 {
7601 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7602 IEM_SVM_UPDATE_NRIP(pVCpu);
7603 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7604 }
7605
7606 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7607 * be returning any status codes relating to non-guest events being raised, as
7608 * we'll mess up the guest HALT otherwise. */
7609 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7610 if (rcStrict == VINF_SUCCESS)
7611 rcStrict = VINF_EM_HALT;
7612 return rcStrict;
7613}
7614
7615
7616/**
7617 * Implements 'MONITOR'.
7618 */
7619IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7620{
7621 /*
7622 * Permission checks.
7623 */
7624 if (pVCpu->iem.s.uCpl != 0)
7625 {
7626 Log2(("monitor: CPL != 0\n"));
7627 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7628 }
7629 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7630 {
7631 Log2(("monitor: Not in CPUID\n"));
7632 return iemRaiseUndefinedOpcode(pVCpu);
7633 }
7634
7635 /*
7636 * Check VMX guest-intercept.
7637 * This should be considered a fault-like VM-exit.
7638 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7639 */
7640 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7641 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7642 {
7643 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7644 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7645 }
7646
7647 /*
7648 * Gather the operands and validate them.
7649 */
7650 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7651 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7652 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7653/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7654 * \#GP first. */
7655 if (uEcx != 0)
7656 {
7657 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7658 return iemRaiseGeneralProtectionFault0(pVCpu);
7659 }
7660
7661 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7662 if (rcStrict != VINF_SUCCESS)
7663 return rcStrict;
7664
7665 RTGCPHYS GCPhysMem;
7666 /** @todo access size */
7667 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7668 if (rcStrict != VINF_SUCCESS)
7669 return rcStrict;
7670
7671#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7672 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7673 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7674 {
7675 /*
7676 * MONITOR does not access the memory, just monitors the address. However,
7677 * if the address falls in the APIC-access page, the address monitored must
7678 * instead be the corresponding address in the virtual-APIC page.
7679 *
7680 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7681 */
7682 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7683 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7684 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7685 return rcStrict;
7686 }
7687#endif
7688
7689 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7690 {
7691 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7692 IEM_SVM_UPDATE_NRIP(pVCpu);
7693 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7694 }
7695
7696 /*
7697 * Call EM to prepare the monitor/wait.
7698 */
7699 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7700 Assert(rcStrict == VINF_SUCCESS);
7701 if (rcStrict == VINF_SUCCESS)
7702 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7703 return rcStrict;
7704}
7705
7706
7707/**
7708 * Implements 'MWAIT'.
7709 */
7710IEM_CIMPL_DEF_0(iemCImpl_mwait)
7711{
7712 /*
7713 * Permission checks.
7714 */
7715 if (pVCpu->iem.s.uCpl != 0)
7716 {
7717 Log2(("mwait: CPL != 0\n"));
7718 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7719 * EFLAGS.VM then.) */
7720 return iemRaiseUndefinedOpcode(pVCpu);
7721 }
7722 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7723 {
7724 Log2(("mwait: Not in CPUID\n"));
7725 return iemRaiseUndefinedOpcode(pVCpu);
7726 }
7727
7728 /* Check VMX nested-guest intercept. */
7729 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7730 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7731 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7732
7733 /*
7734 * Gather the operands and validate them.
7735 */
7736 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7737 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7738 if (uEcx != 0)
7739 {
7740 /* Only supported extension is break on IRQ when IF=0. */
7741 if (uEcx > 1)
7742 {
7743 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7744 return iemRaiseGeneralProtectionFault0(pVCpu);
7745 }
7746 uint32_t fMWaitFeatures = 0;
7747 uint32_t uIgnore = 0;
7748 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7749 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7750 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7751 {
7752 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7753 return iemRaiseGeneralProtectionFault0(pVCpu);
7754 }
7755
7756#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7757 /*
7758 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7759 * for delivery; and interrupts are disabled the processor does not enter its
7760 * mwait state but rather passes control to the next instruction.
7761 *
7762 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7763 */
7764 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7765 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7766 {
7767 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7768 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7769 /** @todo finish: check up this out after we move int window stuff out of the
7770 * run loop and into the instruction finishing logic here. */
7771 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7772 }
7773#endif
7774 }
7775
7776 /*
7777 * Check SVM nested-guest mwait intercepts.
7778 */
7779 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7780 && EMMonitorIsArmed(pVCpu))
7781 {
7782 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7783 IEM_SVM_UPDATE_NRIP(pVCpu);
7784 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7785 }
7786 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7787 {
7788 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7789 IEM_SVM_UPDATE_NRIP(pVCpu);
7790 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7791 }
7792
7793 /*
7794 * Call EM to prepare the monitor/wait.
7795 *
7796 * This will return VINF_EM_HALT. If there the trap flag is set, we may
7797 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
7798 * that will only return guest related events.
7799 */
7800 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7801
7802 /** @todo finish: This needs more thinking as we should suppress internal
7803 * debugger events here, or we'll bugger up the guest state even more than we
7804 * alread do around VINF_EM_HALT. */
7805 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7806 if (rcStrict2 != VINF_SUCCESS)
7807 {
7808 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
7809 rcStrict = rcStrict2;
7810 }
7811
7812 return rcStrict;
7813}
7814
7815
7816/**
7817 * Implements 'SWAPGS'.
7818 */
7819IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7820{
7821 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7822
7823 /*
7824 * Permission checks.
7825 */
7826 if (pVCpu->iem.s.uCpl != 0)
7827 {
7828 Log2(("swapgs: CPL != 0\n"));
7829 return iemRaiseUndefinedOpcode(pVCpu);
7830 }
7831
7832 /*
7833 * Do the job.
7834 */
7835 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7836 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7837 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7838 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7839
7840 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7841}
7842
7843
7844#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7845/**
7846 * Handles a CPUID call.
7847 */
7848static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
7849 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
7850{
7851 switch (iFunction)
7852 {
7853 case VBOX_CPUID_FN_ID:
7854 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
7855 *pEax = VBOX_CPUID_RESP_ID_EAX;
7856 *pEbx = VBOX_CPUID_RESP_ID_EBX;
7857 *pEcx = VBOX_CPUID_RESP_ID_ECX;
7858 *pEdx = VBOX_CPUID_RESP_ID_EDX;
7859 break;
7860
7861 case VBOX_CPUID_FN_LOG:
7862 {
7863 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
7864 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
7865
7866 /* Validate input. */
7867 uint32_t cchToLog = *pEdx;
7868 if (cchToLog <= _2M)
7869 {
7870 uint32_t const uLogPicker = *pEbx;
7871 if (uLogPicker <= 1)
7872 {
7873 /* Resolve the logger. */
7874 PRTLOGGER const pLogger = !uLogPicker
7875 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
7876 if (pLogger)
7877 {
7878 /* Copy over the data: */
7879 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
7880 while (cchToLog > 0)
7881 {
7882 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
7883 if (cbToMap > cchToLog)
7884 cbToMap = cchToLog;
7885 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
7886 * unnecessary calls & iterations per pages. */
7887 if (cbToMap > 512)
7888 cbToMap = 512;
7889 void *pvSrc = NULL;
7890 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, cbToMap, UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
7891 if (rcStrict == VINF_SUCCESS)
7892 {
7893 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
7894 rcStrict = iemMemCommitAndUnmap(pVCpu, pvSrc, IEM_ACCESS_DATA_R);
7895 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
7896 }
7897 else
7898 {
7899 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
7900 return rcStrict;
7901 }
7902
7903 /* Advance. */
7904 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
7905 *pEdx = cchToLog -= cbToMap;
7906 }
7907 *pEax = VINF_SUCCESS;
7908 }
7909 else
7910 *pEax = (uint32_t)VERR_NOT_FOUND;
7911 }
7912 else
7913 *pEax = (uint32_t)VERR_NOT_FOUND;
7914 }
7915 else
7916 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
7917 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
7918 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
7919 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
7920 break;
7921 }
7922
7923 default:
7924 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
7925 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
7926 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
7927 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
7928 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
7929 break;
7930 }
7931 return VINF_SUCCESS;
7932}
7933#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
7934
7935/**
7936 * Implements 'CPUID'.
7937 */
7938IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7939{
7940 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7941 {
7942 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7943 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7944 }
7945
7946 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7947 {
7948 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7949 IEM_SVM_UPDATE_NRIP(pVCpu);
7950 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7951 }
7952
7953
7954 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7955 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7956
7957#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7958 /*
7959 * CPUID host call backdoor.
7960 */
7961 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
7962 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
7963 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
7964 {
7965 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
7966 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
7967 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7968 if (rcStrict != VINF_SUCCESS)
7969 return rcStrict;
7970 }
7971 /*
7972 * Regular CPUID.
7973 */
7974 else
7975#endif
7976 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
7977 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7978
7979 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7980 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7981 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7982 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7983 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7984
7985 pVCpu->iem.s.cPotentialExits++;
7986 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7987}
7988
7989
7990/**
7991 * Implements 'AAD'.
7992 *
7993 * @param bImm The immediate operand.
7994 */
7995IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7996{
7997 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7998 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7999 pVCpu->cpum.GstCtx.ax = al;
8000 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8001 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8002 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8003
8004 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8005}
8006
8007
8008/**
8009 * Implements 'AAM'.
8010 *
8011 * @param bImm The immediate operand. Cannot be 0.
8012 */
8013IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
8014{
8015 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
8016
8017 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8018 uint8_t const al = (uint8_t)ax % bImm;
8019 uint8_t const ah = (uint8_t)ax / bImm;
8020 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
8021 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8022 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8023 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8024
8025 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8026}
8027
8028
8029/**
8030 * Implements 'DAA'.
8031 */
8032IEM_CIMPL_DEF_0(iemCImpl_daa)
8033{
8034 uint8_t const al = pVCpu->cpum.GstCtx.al;
8035 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8036
8037 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8038 || (al & 0xf) >= 10)
8039 {
8040 pVCpu->cpum.GstCtx.al = al + 6;
8041 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8042 }
8043 else
8044 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8045
8046 if (al >= 0x9a || fCarry)
8047 {
8048 pVCpu->cpum.GstCtx.al += 0x60;
8049 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8050 }
8051 else
8052 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8053
8054 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8055 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8056}
8057
8058
8059/**
8060 * Implements 'DAS'.
8061 */
8062IEM_CIMPL_DEF_0(iemCImpl_das)
8063{
8064 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8065 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8066
8067 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8068 || (uInputAL & 0xf) >= 10)
8069 {
8070 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8071 if (uInputAL < 6)
8072 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8073 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8074 }
8075 else
8076 {
8077 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8078 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8079 }
8080
8081 if (uInputAL >= 0x9a || fCarry)
8082 {
8083 pVCpu->cpum.GstCtx.al -= 0x60;
8084 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8085 }
8086
8087 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8088 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8089}
8090
8091
8092/**
8093 * Implements 'AAA'.
8094 */
8095IEM_CIMPL_DEF_0(iemCImpl_aaa)
8096{
8097 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8098 {
8099 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8100 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8101 {
8102 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8103 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8104 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8105 }
8106 else
8107 {
8108 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8109 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8110 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8111 }
8112 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8113 }
8114 else
8115 {
8116 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8117 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8118 {
8119 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8120 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8121 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8122 }
8123 else
8124 {
8125 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8126 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8127 }
8128 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8129 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8130 }
8131
8132 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8133}
8134
8135
8136/**
8137 * Implements 'AAS'.
8138 */
8139IEM_CIMPL_DEF_0(iemCImpl_aas)
8140{
8141 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8142 {
8143 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8144 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8145 {
8146 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8147 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8148 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8149 }
8150 else
8151 {
8152 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8153 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8154 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8155 }
8156 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8157 }
8158 else
8159 {
8160 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8161 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8162 {
8163 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8164 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8165 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8166 }
8167 else
8168 {
8169 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8170 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8171 }
8172 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8173 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8174 }
8175
8176 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8177}
8178
8179
8180/**
8181 * Implements the 16-bit version of 'BOUND'.
8182 *
8183 * @note We have separate 16-bit and 32-bit variants of this function due to
8184 * the decoder using unsigned parameters, whereas we want signed one to
8185 * do the job. This is significant for a recompiler.
8186 */
8187IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8188{
8189 /*
8190 * Check if the index is inside the bounds, otherwise raise #BR.
8191 */
8192 if ( idxArray >= idxLowerBound
8193 && idxArray <= idxUpperBound)
8194 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8195 return iemRaiseBoundRangeExceeded(pVCpu);
8196}
8197
8198
8199/**
8200 * Implements the 32-bit version of 'BOUND'.
8201 */
8202IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8203{
8204 /*
8205 * Check if the index is inside the bounds, otherwise raise #BR.
8206 */
8207 if ( idxArray >= idxLowerBound
8208 && idxArray <= idxUpperBound)
8209 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8210 return iemRaiseBoundRangeExceeded(pVCpu);
8211}
8212
8213
8214
8215/*
8216 * Instantiate the various string operation combinations.
8217 */
8218#define OP_SIZE 8
8219#define ADDR_SIZE 16
8220#include "IEMAllCImplStrInstr.cpp.h"
8221#define OP_SIZE 8
8222#define ADDR_SIZE 32
8223#include "IEMAllCImplStrInstr.cpp.h"
8224#define OP_SIZE 8
8225#define ADDR_SIZE 64
8226#include "IEMAllCImplStrInstr.cpp.h"
8227
8228#define OP_SIZE 16
8229#define ADDR_SIZE 16
8230#include "IEMAllCImplStrInstr.cpp.h"
8231#define OP_SIZE 16
8232#define ADDR_SIZE 32
8233#include "IEMAllCImplStrInstr.cpp.h"
8234#define OP_SIZE 16
8235#define ADDR_SIZE 64
8236#include "IEMAllCImplStrInstr.cpp.h"
8237
8238#define OP_SIZE 32
8239#define ADDR_SIZE 16
8240#include "IEMAllCImplStrInstr.cpp.h"
8241#define OP_SIZE 32
8242#define ADDR_SIZE 32
8243#include "IEMAllCImplStrInstr.cpp.h"
8244#define OP_SIZE 32
8245#define ADDR_SIZE 64
8246#include "IEMAllCImplStrInstr.cpp.h"
8247
8248#define OP_SIZE 64
8249#define ADDR_SIZE 32
8250#include "IEMAllCImplStrInstr.cpp.h"
8251#define OP_SIZE 64
8252#define ADDR_SIZE 64
8253#include "IEMAllCImplStrInstr.cpp.h"
8254
8255
8256/**
8257 * Implements 'XGETBV'.
8258 */
8259IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8260{
8261 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8262 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8263 {
8264 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8265 switch (uEcx)
8266 {
8267 case 0:
8268 break;
8269
8270 case 1: /** @todo Implement XCR1 support. */
8271 default:
8272 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8273 return iemRaiseGeneralProtectionFault0(pVCpu);
8274
8275 }
8276 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8277 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8278 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8279
8280 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8281 }
8282 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8283 return iemRaiseUndefinedOpcode(pVCpu);
8284}
8285
8286
8287/**
8288 * Implements 'XSETBV'.
8289 */
8290IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8291{
8292 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8293 {
8294 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8295 {
8296 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8297 IEM_SVM_UPDATE_NRIP(pVCpu);
8298 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8299 }
8300
8301 if (pVCpu->iem.s.uCpl == 0)
8302 {
8303 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8304
8305 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8306 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8307
8308 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8309 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8310 switch (uEcx)
8311 {
8312 case 0:
8313 {
8314 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8315 if (rc == VINF_SUCCESS)
8316 break;
8317 Assert(rc == VERR_CPUM_RAISE_GP_0);
8318 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8319 return iemRaiseGeneralProtectionFault0(pVCpu);
8320 }
8321
8322 case 1: /** @todo Implement XCR1 support. */
8323 default:
8324 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8325 return iemRaiseGeneralProtectionFault0(pVCpu);
8326
8327 }
8328
8329 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8330 }
8331
8332 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
8333 return iemRaiseGeneralProtectionFault0(pVCpu);
8334 }
8335 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8336 return iemRaiseUndefinedOpcode(pVCpu);
8337}
8338
8339#ifndef RT_ARCH_ARM64
8340# ifdef IN_RING3
8341
8342/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8343struct IEMCIMPLCX16ARGS
8344{
8345 PRTUINT128U pu128Dst;
8346 PRTUINT128U pu128RaxRdx;
8347 PRTUINT128U pu128RbxRcx;
8348 uint32_t *pEFlags;
8349# ifdef VBOX_STRICT
8350 uint32_t cCalls;
8351# endif
8352};
8353
8354/**
8355 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8356 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8357 */
8358static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8359{
8360 RT_NOREF(pVM, pVCpu);
8361 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8362# ifdef VBOX_STRICT
8363 Assert(pArgs->cCalls == 0);
8364 pArgs->cCalls++;
8365# endif
8366
8367 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8368 return VINF_SUCCESS;
8369}
8370
8371# endif /* IN_RING3 */
8372
8373/**
8374 * Implements 'CMPXCHG16B' fallback using rendezvous.
8375 */
8376IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8377 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8378{
8379# ifdef IN_RING3
8380 struct IEMCIMPLCX16ARGS Args;
8381 Args.pu128Dst = pu128Dst;
8382 Args.pu128RaxRdx = pu128RaxRdx;
8383 Args.pu128RbxRcx = pu128RbxRcx;
8384 Args.pEFlags = pEFlags;
8385# ifdef VBOX_STRICT
8386 Args.cCalls = 0;
8387# endif
8388 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8389 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8390 Assert(Args.cCalls == 1);
8391 if (rcStrict == VINF_SUCCESS)
8392 {
8393 /* Duplicated tail code. */
8394 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8395 if (rcStrict == VINF_SUCCESS)
8396 {
8397 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8398 if (!(*pEFlags & X86_EFL_ZF))
8399 {
8400 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8401 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8402 }
8403 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8404 }
8405 }
8406 return rcStrict;
8407# else
8408 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8409 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8410# endif
8411}
8412
8413#endif /* RT_ARCH_ARM64 */
8414
8415/**
8416 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8417 *
8418 * This is implemented in C because it triggers a load like behaviour without
8419 * actually reading anything. Since that's not so common, it's implemented
8420 * here.
8421 *
8422 * @param iEffSeg The effective segment.
8423 * @param GCPtrEff The address of the image.
8424 */
8425IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8426{
8427 /*
8428 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8429 */
8430 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8431 if (rcStrict == VINF_SUCCESS)
8432 {
8433 RTGCPHYS GCPhysMem;
8434 /** @todo access size. */
8435 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8436 if (rcStrict == VINF_SUCCESS)
8437 {
8438#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8439 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8440 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8441 {
8442 /*
8443 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8444 * that contains the address. However, if the address falls in the APIC-access
8445 * page, the address flushed must instead be the corresponding address in the
8446 * virtual-APIC page.
8447 *
8448 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8449 */
8450 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8451 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8452 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8453 return rcStrict;
8454 }
8455#endif
8456 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8457 }
8458 }
8459
8460 return rcStrict;
8461}
8462
8463
8464/**
8465 * Implements 'FINIT' and 'FNINIT'.
8466 *
8467 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8468 * not.
8469 */
8470IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8471{
8472 /*
8473 * Exceptions.
8474 */
8475 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8476 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8477 return iemRaiseDeviceNotAvailable(pVCpu);
8478
8479 iemFpuActualizeStateForChange(pVCpu);
8480 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8481
8482 /* FINIT: Raise #MF on pending exception(s): */
8483 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8484 return iemRaiseMathFault(pVCpu);
8485
8486 /*
8487 * Reset the state.
8488 */
8489 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8490
8491 /* Rotate the stack to account for changed TOS. */
8492 iemFpuRotateStackSetTop(&pXState->x87, 0);
8493
8494 pXState->x87.FCW = 0x37f;
8495 pXState->x87.FSW = 0;
8496 pXState->x87.FTW = 0x00; /* 0 - empty. */
8497 /** @todo Intel says the instruction and data pointers are not cleared on
8498 * 387, presume that 8087 and 287 doesn't do so either. */
8499 /** @todo test this stuff. */
8500 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8501 {
8502 pXState->x87.FPUDP = 0;
8503 pXState->x87.DS = 0; //??
8504 pXState->x87.Rsrvd2 = 0;
8505 pXState->x87.FPUIP = 0;
8506 pXState->x87.CS = 0; //??
8507 pXState->x87.Rsrvd1 = 0;
8508 }
8509 pXState->x87.FOP = 0;
8510
8511 iemHlpUsedFpu(pVCpu);
8512 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8513}
8514
8515
8516/**
8517 * Implements 'FXSAVE'.
8518 *
8519 * @param iEffSeg The effective segment.
8520 * @param GCPtrEff The address of the image.
8521 * @param enmEffOpSize The operand size (only REX.W really matters).
8522 */
8523IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8524{
8525 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8526
8527 /** @todo check out bugref{1529} and AMD behaviour */
8528
8529 /*
8530 * Raise exceptions.
8531 */
8532 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8533 return iemRaiseDeviceNotAvailable(pVCpu);
8534
8535 /*
8536 * Access the memory.
8537 */
8538 void *pvMem512;
8539 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8540 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8541 if (rcStrict != VINF_SUCCESS)
8542 return rcStrict;
8543 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8544 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8545
8546 /*
8547 * Store the registers.
8548 */
8549 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8550 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8551
8552 /* common for all formats */
8553 pDst->FCW = pSrc->FCW;
8554 pDst->FSW = pSrc->FSW;
8555 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8556 pDst->FOP = pSrc->FOP;
8557 pDst->MXCSR = pSrc->MXCSR;
8558 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8559 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8560 {
8561 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8562 * them for now... */
8563 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8564 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8565 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8566 pDst->aRegs[i].au32[3] = 0;
8567 }
8568
8569 /* FPU IP, CS, DP and DS. */
8570 pDst->FPUIP = pSrc->FPUIP;
8571 pDst->CS = pSrc->CS;
8572 pDst->FPUDP = pSrc->FPUDP;
8573 pDst->DS = pSrc->DS;
8574 if (enmEffOpSize == IEMMODE_64BIT)
8575 {
8576 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8577 pDst->Rsrvd1 = pSrc->Rsrvd1;
8578 pDst->Rsrvd2 = pSrc->Rsrvd2;
8579 }
8580 else
8581 {
8582 pDst->Rsrvd1 = 0;
8583 pDst->Rsrvd2 = 0;
8584 }
8585
8586 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set. */
8587 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8588 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8589 || pVCpu->iem.s.uCpl != 0)
8590 {
8591 uint32_t cXmmRegs = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? 16 : 8;
8592 for (uint32_t i = 0; i < cXmmRegs; i++)
8593 pDst->aXMM[i] = pSrc->aXMM[i];
8594 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8595 * right? */
8596 }
8597
8598 /*
8599 * Commit the memory.
8600 */
8601 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8602 if (rcStrict != VINF_SUCCESS)
8603 return rcStrict;
8604
8605 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8606}
8607
8608
8609/**
8610 * Implements 'FXRSTOR'.
8611 *
8612 * @param iEffSeg The effective segment register for @a GCPtrEff.
8613 * @param GCPtrEff The address of the image.
8614 * @param enmEffOpSize The operand size (only REX.W really matters).
8615 */
8616IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8617{
8618 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8619
8620 /** @todo check out bugref{1529} and AMD behaviour */
8621
8622 /*
8623 * Raise exceptions.
8624 */
8625 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8626 return iemRaiseDeviceNotAvailable(pVCpu);
8627
8628 /*
8629 * Access the memory.
8630 */
8631 void *pvMem512;
8632 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8633 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8634 if (rcStrict != VINF_SUCCESS)
8635 return rcStrict;
8636 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8637 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8638
8639 /*
8640 * Check the state for stuff which will #GP(0).
8641 */
8642 uint32_t const fMXCSR = pSrc->MXCSR;
8643 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8644 if (fMXCSR & ~fMXCSR_MASK)
8645 {
8646 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8647 return iemRaiseGeneralProtectionFault0(pVCpu);
8648 }
8649
8650 /*
8651 * Load the registers.
8652 */
8653 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8654 * implementation specific whether MXCSR and XMM0-XMM7 are
8655 * restored according to Intel.
8656 * AMD says MXCSR and XMM registers are never loaded if
8657 * CR4.OSFXSR=0.
8658 */
8659
8660 /* common for all formats */
8661 pDst->FCW = pSrc->FCW;
8662 pDst->FSW = pSrc->FSW;
8663 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8664 pDst->FOP = pSrc->FOP;
8665 pDst->MXCSR = fMXCSR;
8666 /* (MXCSR_MASK is read-only) */
8667 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8668 {
8669 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8670 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8671 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8672 pDst->aRegs[i].au32[3] = 0;
8673 }
8674
8675 /* FPU IP, CS, DP and DS. */
8676 /** @todo AMD says this is only done if FSW.ES is set after loading. */
8677 if (enmEffOpSize == IEMMODE_64BIT)
8678 {
8679 pDst->FPUIP = pSrc->FPUIP;
8680 pDst->CS = pSrc->CS;
8681 pDst->Rsrvd1 = pSrc->Rsrvd1;
8682 pDst->FPUDP = pSrc->FPUDP;
8683 pDst->DS = pSrc->DS;
8684 pDst->Rsrvd2 = pSrc->Rsrvd2;
8685 }
8686 else
8687 {
8688 pDst->FPUIP = pSrc->FPUIP;
8689 pDst->CS = pSrc->CS;
8690 pDst->Rsrvd1 = 0;
8691 pDst->FPUDP = pSrc->FPUDP;
8692 pDst->DS = pSrc->DS;
8693 pDst->Rsrvd2 = 0;
8694 }
8695
8696 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set.
8697 * Does not affect MXCSR, only registers.
8698 */
8699 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8700 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8701 || pVCpu->iem.s.uCpl != 0)
8702 {
8703 uint32_t cXmmRegs = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? 16 : 8;
8704 for (uint32_t i = 0; i < cXmmRegs; i++)
8705 pDst->aXMM[i] = pSrc->aXMM[i];
8706 }
8707
8708 pDst->FCW &= ~X86_FCW_ZERO_MASK;
8709 iemFpuRecalcExceptionStatus(pDst);
8710
8711 if (pDst->FSW & X86_FSW_ES)
8712 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8713 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8714
8715 /*
8716 * Unmap the memory.
8717 */
8718 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8719 if (rcStrict != VINF_SUCCESS)
8720 return rcStrict;
8721
8722 iemHlpUsedFpu(pVCpu);
8723 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8724}
8725
8726
8727/**
8728 * Implements 'XSAVE'.
8729 *
8730 * @param iEffSeg The effective segment.
8731 * @param GCPtrEff The address of the image.
8732 * @param enmEffOpSize The operand size (only REX.W really matters).
8733 */
8734IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8735{
8736 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8737
8738 /*
8739 * Raise exceptions.
8740 */
8741 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8742 return iemRaiseUndefinedOpcode(pVCpu);
8743 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8744 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8745 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8746 {
8747 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8748 return iemRaiseUndefinedOpcode(pVCpu);
8749 }
8750 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8751 return iemRaiseDeviceNotAvailable(pVCpu);
8752
8753 /*
8754 * Calc the requested mask.
8755 */
8756 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8757 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8758 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8759
8760/** @todo figure out the exact protocol for the memory access. Currently we
8761 * just need this crap to work halfways to make it possible to test
8762 * AVX instructions. */
8763/** @todo figure out the XINUSE and XMODIFIED */
8764
8765 /*
8766 * Access the x87 memory state.
8767 */
8768 /* The x87+SSE state. */
8769 void *pvMem512;
8770 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8771 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8772 if (rcStrict != VINF_SUCCESS)
8773 return rcStrict;
8774 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8775 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8776
8777 /* The header. */
8778 PX86XSAVEHDR pHdr;
8779 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
8780 if (rcStrict != VINF_SUCCESS)
8781 return rcStrict;
8782
8783 /*
8784 * Store the X87 state.
8785 */
8786 if (fReqComponents & XSAVE_C_X87)
8787 {
8788 /* common for all formats */
8789 pDst->FCW = pSrc->FCW;
8790 pDst->FSW = pSrc->FSW;
8791 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8792 pDst->FOP = pSrc->FOP;
8793 pDst->FPUIP = pSrc->FPUIP;
8794 pDst->CS = pSrc->CS;
8795 pDst->FPUDP = pSrc->FPUDP;
8796 pDst->DS = pSrc->DS;
8797 if (enmEffOpSize == IEMMODE_64BIT)
8798 {
8799 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8800 pDst->Rsrvd1 = pSrc->Rsrvd1;
8801 pDst->Rsrvd2 = pSrc->Rsrvd2;
8802 }
8803 else
8804 {
8805 pDst->Rsrvd1 = 0;
8806 pDst->Rsrvd2 = 0;
8807 }
8808 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8809 {
8810 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8811 * them for now... */
8812 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8813 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8814 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8815 pDst->aRegs[i].au32[3] = 0;
8816 }
8817
8818 }
8819
8820 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8821 {
8822 pDst->MXCSR = pSrc->MXCSR;
8823 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8824 }
8825
8826 if (fReqComponents & XSAVE_C_SSE)
8827 {
8828 /* XMM registers. */
8829 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8830 for (uint32_t i = 0; i < cXmmRegs; i++)
8831 pDst->aXMM[i] = pSrc->aXMM[i];
8832 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8833 * right? */
8834 }
8835
8836 /* Commit the x87 state bits. (probably wrong) */
8837 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8838 if (rcStrict != VINF_SUCCESS)
8839 return rcStrict;
8840
8841 /*
8842 * Store AVX state.
8843 */
8844 if (fReqComponents & XSAVE_C_YMM)
8845 {
8846 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8847 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8848 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8849 PX86XSAVEYMMHI pCompDst;
8850 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8851 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
8852 if (rcStrict != VINF_SUCCESS)
8853 return rcStrict;
8854
8855 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8856 for (uint32_t i = 0; i < cXmmRegs; i++)
8857 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8858
8859 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8860 if (rcStrict != VINF_SUCCESS)
8861 return rcStrict;
8862 }
8863
8864 /*
8865 * Update the header.
8866 */
8867 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8868 | (fReqComponents & fXInUse);
8869
8870 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8871 if (rcStrict != VINF_SUCCESS)
8872 return rcStrict;
8873
8874 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8875}
8876
8877
8878/**
8879 * Implements 'XRSTOR'.
8880 *
8881 * @param iEffSeg The effective segment.
8882 * @param GCPtrEff The address of the image.
8883 * @param enmEffOpSize The operand size (only REX.W really matters).
8884 */
8885IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8886{
8887 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8888
8889 /*
8890 * Raise exceptions.
8891 */
8892 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8893 return iemRaiseUndefinedOpcode(pVCpu);
8894 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8895 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8896 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8897 {
8898 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8899 return iemRaiseUndefinedOpcode(pVCpu);
8900 }
8901 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8902 return iemRaiseDeviceNotAvailable(pVCpu);
8903 if (GCPtrEff & 63)
8904 {
8905 /** @todo CPU/VM detection possible! \#AC might not be signal for
8906 * all/any misalignment sizes, intel says its an implementation detail. */
8907 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8908 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8909 && pVCpu->iem.s.uCpl == 3)
8910 return iemRaiseAlignmentCheckException(pVCpu);
8911 return iemRaiseGeneralProtectionFault0(pVCpu);
8912 }
8913
8914/** @todo figure out the exact protocol for the memory access. Currently we
8915 * just need this crap to work halfways to make it possible to test
8916 * AVX instructions. */
8917/** @todo figure out the XINUSE and XMODIFIED */
8918
8919 /*
8920 * Access the x87 memory state.
8921 */
8922 /* The x87+SSE state. */
8923 void *pvMem512;
8924 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8925 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8926 if (rcStrict != VINF_SUCCESS)
8927 return rcStrict;
8928 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8929 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8930
8931 /*
8932 * Calc the requested mask
8933 */
8934 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
8935 PCX86XSAVEHDR pHdrSrc;
8936 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
8937 IEM_ACCESS_DATA_R, 0 /* checked above */);
8938 if (rcStrict != VINF_SUCCESS)
8939 return rcStrict;
8940
8941 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8942 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8943 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8944 uint64_t const fRstorMask = pHdrSrc->bmXState;
8945 uint64_t const fCompMask = pHdrSrc->bmXComp;
8946
8947 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8948
8949 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8950
8951 /* We won't need this any longer. */
8952 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8953 if (rcStrict != VINF_SUCCESS)
8954 return rcStrict;
8955
8956 /*
8957 * Load the X87 state.
8958 */
8959 if (fReqComponents & XSAVE_C_X87)
8960 {
8961 if (fRstorMask & XSAVE_C_X87)
8962 {
8963 pDst->FCW = pSrc->FCW;
8964 pDst->FSW = pSrc->FSW;
8965 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8966 pDst->FOP = pSrc->FOP;
8967 pDst->FPUIP = pSrc->FPUIP;
8968 pDst->CS = pSrc->CS;
8969 pDst->FPUDP = pSrc->FPUDP;
8970 pDst->DS = pSrc->DS;
8971 if (enmEffOpSize == IEMMODE_64BIT)
8972 {
8973 /* Load upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8974 pDst->Rsrvd1 = pSrc->Rsrvd1;
8975 pDst->Rsrvd2 = pSrc->Rsrvd2;
8976 }
8977 else
8978 {
8979 pDst->Rsrvd1 = 0;
8980 pDst->Rsrvd2 = 0;
8981 }
8982 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8983 {
8984 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8985 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8986 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8987 pDst->aRegs[i].au32[3] = 0;
8988 }
8989
8990 pDst->FCW &= ~X86_FCW_ZERO_MASK;
8991 iemFpuRecalcExceptionStatus(pDst);
8992
8993 if (pDst->FSW & X86_FSW_ES)
8994 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8995 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8996 }
8997 else
8998 {
8999 pDst->FCW = 0x37f;
9000 pDst->FSW = 0;
9001 pDst->FTW = 0x00; /* 0 - empty. */
9002 pDst->FPUDP = 0;
9003 pDst->DS = 0; //??
9004 pDst->Rsrvd2= 0;
9005 pDst->FPUIP = 0;
9006 pDst->CS = 0; //??
9007 pDst->Rsrvd1= 0;
9008 pDst->FOP = 0;
9009 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9010 {
9011 pDst->aRegs[i].au32[0] = 0;
9012 pDst->aRegs[i].au32[1] = 0;
9013 pDst->aRegs[i].au32[2] = 0;
9014 pDst->aRegs[i].au32[3] = 0;
9015 }
9016 }
9017 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
9018 }
9019
9020 /* MXCSR */
9021 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9022 {
9023 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
9024 pDst->MXCSR = pSrc->MXCSR;
9025 else
9026 pDst->MXCSR = 0x1f80;
9027 }
9028
9029 /* XMM registers. */
9030 if (fReqComponents & XSAVE_C_SSE)
9031 {
9032 if (fRstorMask & XSAVE_C_SSE)
9033 {
9034 for (uint32_t i = 0; i < cXmmRegs; i++)
9035 pDst->aXMM[i] = pSrc->aXMM[i];
9036 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9037 * right? */
9038 }
9039 else
9040 {
9041 for (uint32_t i = 0; i < cXmmRegs; i++)
9042 {
9043 pDst->aXMM[i].au64[0] = 0;
9044 pDst->aXMM[i].au64[1] = 0;
9045 }
9046 }
9047 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
9048 }
9049
9050 /* Unmap the x87 state bits (so we've don't run out of mapping). */
9051 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
9052 if (rcStrict != VINF_SUCCESS)
9053 return rcStrict;
9054
9055 /*
9056 * Restore AVX state.
9057 */
9058 if (fReqComponents & XSAVE_C_YMM)
9059 {
9060 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9061 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
9062
9063 if (fRstorMask & XSAVE_C_YMM)
9064 {
9065 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9066 PCX86XSAVEYMMHI pCompSrc;
9067 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
9068 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9069 IEM_ACCESS_DATA_R, 0 /* checked above */);
9070 if (rcStrict != VINF_SUCCESS)
9071 return rcStrict;
9072
9073 for (uint32_t i = 0; i < cXmmRegs; i++)
9074 {
9075 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9076 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9077 }
9078
9079 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
9080 if (rcStrict != VINF_SUCCESS)
9081 return rcStrict;
9082 }
9083 else
9084 {
9085 for (uint32_t i = 0; i < cXmmRegs; i++)
9086 {
9087 pCompDst->aYmmHi[i].au64[0] = 0;
9088 pCompDst->aYmmHi[i].au64[1] = 0;
9089 }
9090 }
9091 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9092 }
9093
9094 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9095}
9096
9097
9098
9099
9100/**
9101 * Implements 'STMXCSR'.
9102 *
9103 * @param iEffSeg The effective segment register for @a GCPtrEff.
9104 * @param GCPtrEff The address of the image.
9105 */
9106IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9107{
9108 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9109
9110 /*
9111 * Raise exceptions.
9112 */
9113 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9114 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9115 {
9116 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9117 {
9118 /*
9119 * Do the job.
9120 */
9121 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9122 if (rcStrict == VINF_SUCCESS)
9123 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9124 return rcStrict;
9125 }
9126 return iemRaiseDeviceNotAvailable(pVCpu);
9127 }
9128 return iemRaiseUndefinedOpcode(pVCpu);
9129}
9130
9131
9132/**
9133 * Implements 'VSTMXCSR'.
9134 *
9135 * @param iEffSeg The effective segment register for @a GCPtrEff.
9136 * @param GCPtrEff The address of the image.
9137 */
9138IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9139{
9140 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9141
9142 /*
9143 * Raise exceptions.
9144 */
9145 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9146 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9147 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9148 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9149 {
9150 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9151 {
9152 /*
9153 * Do the job.
9154 */
9155 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9156 if (rcStrict == VINF_SUCCESS)
9157 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9158 return rcStrict;
9159 }
9160 return iemRaiseDeviceNotAvailable(pVCpu);
9161 }
9162 return iemRaiseUndefinedOpcode(pVCpu);
9163}
9164
9165
9166/**
9167 * Implements 'LDMXCSR'.
9168 *
9169 * @param iEffSeg The effective segment register for @a GCPtrEff.
9170 * @param GCPtrEff The address of the image.
9171 */
9172IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9173{
9174 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9175
9176 /*
9177 * Raise exceptions.
9178 */
9179 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9180 * happen after or before \#UD and \#EM? */
9181 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9182 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9183 {
9184 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9185 {
9186 /*
9187 * Do the job.
9188 */
9189 uint32_t fNewMxCsr;
9190 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9191 if (rcStrict == VINF_SUCCESS)
9192 {
9193 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9194 if (!(fNewMxCsr & ~fMxCsrMask))
9195 {
9196 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9197 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9198 }
9199 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9200 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9201 return iemRaiseGeneralProtectionFault0(pVCpu);
9202 }
9203 return rcStrict;
9204 }
9205 return iemRaiseDeviceNotAvailable(pVCpu);
9206 }
9207 return iemRaiseUndefinedOpcode(pVCpu);
9208}
9209
9210
9211/**
9212 * Commmon routine for fnstenv and fnsave.
9213 *
9214 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9215 * @param enmEffOpSize The effective operand size.
9216 * @param uPtr Where to store the state.
9217 */
9218static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9219{
9220 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9221 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9222 if (enmEffOpSize == IEMMODE_16BIT)
9223 {
9224 uPtr.pu16[0] = pSrcX87->FCW;
9225 uPtr.pu16[1] = pSrcX87->FSW;
9226 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9227 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9228 {
9229 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9230 * protected mode or long mode and we save it in real mode? And vice
9231 * versa? And with 32-bit operand size? I think CPU is storing the
9232 * effective address ((CS << 4) + IP) in the offset register and not
9233 * doing any address calculations here. */
9234 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9235 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9236 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9237 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9238 }
9239 else
9240 {
9241 uPtr.pu16[3] = pSrcX87->FPUIP;
9242 uPtr.pu16[4] = pSrcX87->CS;
9243 uPtr.pu16[5] = pSrcX87->FPUDP;
9244 uPtr.pu16[6] = pSrcX87->DS;
9245 }
9246 }
9247 else
9248 {
9249 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9250 uPtr.pu16[0*2] = pSrcX87->FCW;
9251 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9252 uPtr.pu16[1*2] = pSrcX87->FSW;
9253 uPtr.pu16[1*2+1] = 0xffff;
9254 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9255 uPtr.pu16[2*2+1] = 0xffff;
9256 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9257 {
9258 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9259 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9260 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9261 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9262 }
9263 else
9264 {
9265 uPtr.pu32[3] = pSrcX87->FPUIP;
9266 uPtr.pu16[4*2] = pSrcX87->CS;
9267 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9268 uPtr.pu32[5] = pSrcX87->FPUDP;
9269 uPtr.pu16[6*2] = pSrcX87->DS;
9270 uPtr.pu16[6*2+1] = 0xffff;
9271 }
9272 }
9273}
9274
9275
9276/**
9277 * Commmon routine for fldenv and frstor
9278 *
9279 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9280 * @param enmEffOpSize The effective operand size.
9281 * @param uPtr Where to store the state.
9282 */
9283static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9284{
9285 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9286 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9287 if (enmEffOpSize == IEMMODE_16BIT)
9288 {
9289 pDstX87->FCW = uPtr.pu16[0];
9290 pDstX87->FSW = uPtr.pu16[1];
9291 pDstX87->FTW = uPtr.pu16[2];
9292 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9293 {
9294 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9295 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9296 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9297 pDstX87->CS = 0;
9298 pDstX87->Rsrvd1= 0;
9299 pDstX87->DS = 0;
9300 pDstX87->Rsrvd2= 0;
9301 }
9302 else
9303 {
9304 pDstX87->FPUIP = uPtr.pu16[3];
9305 pDstX87->CS = uPtr.pu16[4];
9306 pDstX87->Rsrvd1= 0;
9307 pDstX87->FPUDP = uPtr.pu16[5];
9308 pDstX87->DS = uPtr.pu16[6];
9309 pDstX87->Rsrvd2= 0;
9310 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9311 }
9312 }
9313 else
9314 {
9315 pDstX87->FCW = uPtr.pu16[0*2];
9316 pDstX87->FSW = uPtr.pu16[1*2];
9317 pDstX87->FTW = uPtr.pu16[2*2];
9318 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9319 {
9320 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9321 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9322 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9323 pDstX87->CS = 0;
9324 pDstX87->Rsrvd1= 0;
9325 pDstX87->DS = 0;
9326 pDstX87->Rsrvd2= 0;
9327 }
9328 else
9329 {
9330 pDstX87->FPUIP = uPtr.pu32[3];
9331 pDstX87->CS = uPtr.pu16[4*2];
9332 pDstX87->Rsrvd1= 0;
9333 pDstX87->FOP = uPtr.pu16[4*2+1];
9334 pDstX87->FPUDP = uPtr.pu32[5];
9335 pDstX87->DS = uPtr.pu16[6*2];
9336 pDstX87->Rsrvd2= 0;
9337 }
9338 }
9339
9340 /* Make adjustments. */
9341 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9342#ifdef LOG_ENABLED
9343 uint16_t const fOldFsw = pDstX87->FSW;
9344#endif
9345 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
9346 iemFpuRecalcExceptionStatus(pDstX87);
9347#ifdef LOG_ENABLED
9348 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9349 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9350 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9351 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9352#endif
9353
9354 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9355 * exceptions are pending after loading the saved state? */
9356}
9357
9358
9359/**
9360 * Implements 'FNSTENV'.
9361 *
9362 * @param enmEffOpSize The operand size (only REX.W really matters).
9363 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9364 * @param GCPtrEffDst The address of the image.
9365 */
9366IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9367{
9368 RTPTRUNION uPtr;
9369 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9370 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9371 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9372 if (rcStrict != VINF_SUCCESS)
9373 return rcStrict;
9374
9375 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9376
9377 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9378 if (rcStrict != VINF_SUCCESS)
9379 return rcStrict;
9380
9381 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9382 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9383 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9384#ifdef LOG_ENABLED
9385 uint16_t fOldFsw = pFpuCtx->FSW;
9386#endif
9387 iemFpuRecalcExceptionStatus(pFpuCtx);
9388#ifdef LOG_ENABLED
9389 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9390 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9391 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9392#endif
9393
9394 iemHlpUsedFpu(pVCpu);
9395
9396 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9397 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9398}
9399
9400
9401/**
9402 * Implements 'FNSAVE'.
9403 *
9404 * @param enmEffOpSize The operand size.
9405 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9406 * @param GCPtrEffDst The address of the image.
9407 */
9408IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9409{
9410 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9411
9412 RTPTRUNION uPtr;
9413 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9414 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9415 if (rcStrict != VINF_SUCCESS)
9416 return rcStrict;
9417
9418 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9419 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9420 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9421 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9422 {
9423 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9424 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9425 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9426 }
9427
9428 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9429 if (rcStrict != VINF_SUCCESS)
9430 return rcStrict;
9431
9432 /* Rotate the stack to account for changed TOS. */
9433 iemFpuRotateStackSetTop(pFpuCtx, 0);
9434
9435 /*
9436 * Re-initialize the FPU context.
9437 */
9438 pFpuCtx->FCW = 0x37f;
9439 pFpuCtx->FSW = 0;
9440 pFpuCtx->FTW = 0x00; /* 0 - empty */
9441 pFpuCtx->FPUDP = 0;
9442 pFpuCtx->DS = 0;
9443 pFpuCtx->Rsrvd2= 0;
9444 pFpuCtx->FPUIP = 0;
9445 pFpuCtx->CS = 0;
9446 pFpuCtx->Rsrvd1= 0;
9447 pFpuCtx->FOP = 0;
9448
9449 iemHlpUsedFpu(pVCpu);
9450 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9451}
9452
9453
9454
9455/**
9456 * Implements 'FLDENV'.
9457 *
9458 * @param enmEffOpSize The operand size (only REX.W really matters).
9459 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9460 * @param GCPtrEffSrc The address of the image.
9461 */
9462IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9463{
9464 RTCPTRUNION uPtr;
9465 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9466 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9467 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9468 if (rcStrict != VINF_SUCCESS)
9469 return rcStrict;
9470
9471 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9472
9473 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9474 if (rcStrict != VINF_SUCCESS)
9475 return rcStrict;
9476
9477 iemHlpUsedFpu(pVCpu);
9478 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9479}
9480
9481
9482/**
9483 * Implements 'FRSTOR'.
9484 *
9485 * @param enmEffOpSize The operand size.
9486 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9487 * @param GCPtrEffSrc The address of the image.
9488 */
9489IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9490{
9491 RTCPTRUNION uPtr;
9492 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9493 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9494 if (rcStrict != VINF_SUCCESS)
9495 return rcStrict;
9496
9497 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9498 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9499 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9500 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9501 {
9502 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9503 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9504 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9505 pFpuCtx->aRegs[i].au32[3] = 0;
9506 }
9507
9508 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9509 if (rcStrict != VINF_SUCCESS)
9510 return rcStrict;
9511
9512 iemHlpUsedFpu(pVCpu);
9513 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9514}
9515
9516
9517/**
9518 * Implements 'FLDCW'.
9519 *
9520 * @param u16Fcw The new FCW.
9521 */
9522IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9523{
9524 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9525
9526 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9527 /** @todo Testcase: Try see what happens when trying to set undefined bits
9528 * (other than 6 and 7). Currently ignoring them. */
9529 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9530 * according to FSW. (This is what is currently implemented.) */
9531 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9532 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
9533#ifdef LOG_ENABLED
9534 uint16_t fOldFsw = pFpuCtx->FSW;
9535#endif
9536 iemFpuRecalcExceptionStatus(pFpuCtx);
9537#ifdef LOG_ENABLED
9538 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9539 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9540 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9541#endif
9542
9543 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9544 iemHlpUsedFpu(pVCpu);
9545 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9546}
9547
9548
9549
9550/**
9551 * Implements the underflow case of fxch.
9552 *
9553 * @param iStReg The other stack register.
9554 */
9555IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
9556{
9557 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9558
9559 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9560 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9561 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9562 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9563
9564 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9565 * registers are read as QNaN and then exchanged. This could be
9566 * wrong... */
9567 if (pFpuCtx->FCW & X86_FCW_IM)
9568 {
9569 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9570 {
9571 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9572 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9573 else
9574 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9575 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9576 }
9577 else
9578 {
9579 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9580 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9581 }
9582 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9583 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9584 }
9585 else
9586 {
9587 /* raise underflow exception, don't change anything. */
9588 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9589 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9590 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9591 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9592 }
9593
9594 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9595 iemHlpUsedFpu(pVCpu);
9596 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9597}
9598
9599
9600/**
9601 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9602 *
9603 * @param iStReg The other stack register.
9604 * @param pfnAImpl The assembly comparison implementation.
9605 * @param fPop Whether we should pop the stack when done or not.
9606 */
9607IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9608{
9609 Assert(iStReg < 8);
9610 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9611
9612 /*
9613 * Raise exceptions.
9614 */
9615 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9616 return iemRaiseDeviceNotAvailable(pVCpu);
9617
9618 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9619 uint16_t u16Fsw = pFpuCtx->FSW;
9620 if (u16Fsw & X86_FSW_ES)
9621 return iemRaiseMathFault(pVCpu);
9622
9623 /*
9624 * Check if any of the register accesses causes #SF + #IA.
9625 */
9626 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9627 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9628 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9629 {
9630 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9631
9632 pFpuCtx->FSW &= ~X86_FSW_C1;
9633 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9634 if ( !(u16Fsw & X86_FSW_IE)
9635 || (pFpuCtx->FCW & X86_FCW_IM) )
9636 {
9637 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9638 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9639 }
9640 }
9641 else if (pFpuCtx->FCW & X86_FCW_IM)
9642 {
9643 /* Masked underflow. */
9644 pFpuCtx->FSW &= ~X86_FSW_C1;
9645 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9646 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9647 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9648 }
9649 else
9650 {
9651 /* Raise underflow - don't touch EFLAGS or TOP. */
9652 pFpuCtx->FSW &= ~X86_FSW_C1;
9653 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9654 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
9655 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9656 fPop = false;
9657 }
9658
9659 /*
9660 * Pop if necessary.
9661 */
9662 if (fPop)
9663 {
9664 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9665 iemFpuStackIncTop(pVCpu);
9666 }
9667
9668 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9669 iemHlpUsedFpu(pVCpu);
9670 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9671}
9672
9673/** @} */
9674
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette