VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 94620

Last change on this file since 94620 was 94619, checked in by vboxsync, 3 years ago

VMM/*.cpp.h: Doxygen fixes.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 336.8 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 94619 2022-04-15 13:51:50Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18#include "IEMAllCImplSvmInstr.cpp.h"
19#include "IEMAllCImplVmxInstr.cpp.h"
20
21
22/** @name Misc Helpers
23 * @{
24 */
25
26
27/**
28 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
29 *
30 * @returns Strict VBox status code.
31 *
32 * @param pVCpu The cross context virtual CPU structure of the calling thread.
33 * @param u16Port The port number.
34 * @param cbOperand The operand size.
35 */
36static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
37{
38 /* The TSS bits we're interested in are the same on 386 and AMD64. */
39 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
40 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
41 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
42 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
43
44 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
45
46 /*
47 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
48 */
49 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
50 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
51 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
52 {
53 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
54 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
55 return iemRaiseGeneralProtectionFault0(pVCpu);
56 }
57
58 /*
59 * Read the bitmap offset (may #PF).
60 */
61 uint16_t offBitmap;
62 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
63 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
64 if (rcStrict != VINF_SUCCESS)
65 {
66 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
67 return rcStrict;
68 }
69
70 /*
71 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
72 * describes the CPU actually reading two bytes regardless of whether the
73 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
74 */
75 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
76 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
77 * for instance sizeof(X86TSS32). */
78 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
79 {
80 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
81 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
82 return iemRaiseGeneralProtectionFault0(pVCpu);
83 }
84
85 /*
86 * Read the necessary bits.
87 */
88 /** @todo Test the assertion in the intel manual that the CPU reads two
89 * bytes. The question is how this works wrt to \#PF and \#GP on the
90 * 2nd byte when it's not required. */
91 uint16_t bmBytes = UINT16_MAX;
92 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
93 if (rcStrict != VINF_SUCCESS)
94 {
95 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
96 return rcStrict;
97 }
98
99 /*
100 * Perform the check.
101 */
102 uint16_t fPortMask = (1 << cbOperand) - 1;
103 bmBytes >>= (u16Port & 7);
104 if (bmBytes & fPortMask)
105 {
106 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
107 u16Port, cbOperand, bmBytes, fPortMask));
108 return iemRaiseGeneralProtectionFault0(pVCpu);
109 }
110
111 return VINF_SUCCESS;
112}
113
114
115/**
116 * Checks if we are allowed to access the given I/O port, raising the
117 * appropriate exceptions if we aren't (or if the I/O bitmap is not
118 * accessible).
119 *
120 * @returns Strict VBox status code.
121 *
122 * @param pVCpu The cross context virtual CPU structure of the calling thread.
123 * @param u16Port The port number.
124 * @param cbOperand The operand size.
125 */
126DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
127{
128 X86EFLAGS Efl;
129 Efl.u = IEMMISC_GET_EFL(pVCpu);
130 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
131 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
132 || Efl.Bits.u1VM) )
133 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
134 return VINF_SUCCESS;
135}
136
137
138#if 0
139/**
140 * Calculates the parity bit.
141 *
142 * @returns true if the bit is set, false if not.
143 * @param u8Result The least significant byte of the result.
144 */
145static bool iemHlpCalcParityFlag(uint8_t u8Result)
146{
147 /*
148 * Parity is set if the number of bits in the least significant byte of
149 * the result is even.
150 */
151 uint8_t cBits;
152 cBits = u8Result & 1; /* 0 */
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1;
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1; /* 4 */
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 u8Result >>= 1;
164 cBits += u8Result & 1;
165 u8Result >>= 1;
166 cBits += u8Result & 1;
167 return !(cBits & 1);
168}
169#endif /* not used */
170
171
172/**
173 * Updates the specified flags according to a 8-bit result.
174 *
175 * @param pVCpu The cross context virtual CPU structure of the calling thread.
176 * @param u8Result The result to set the flags according to.
177 * @param fToUpdate The flags to update.
178 * @param fUndefined The flags that are specified as undefined.
179 */
180static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
181{
182 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
183 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
184 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
185 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
186}
187
188
189/**
190 * Updates the specified flags according to a 16-bit result.
191 *
192 * @param pVCpu The cross context virtual CPU structure of the calling thread.
193 * @param u16Result The result to set the flags according to.
194 * @param fToUpdate The flags to update.
195 * @param fUndefined The flags that are specified as undefined.
196 */
197static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
198{
199 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
200 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
201 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
202 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
203}
204
205
206/**
207 * Helper used by iret.
208 *
209 * @param pVCpu The cross context virtual CPU structure of the calling thread.
210 * @param uCpl The new CPL.
211 * @param pSReg Pointer to the segment register.
212 */
213static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
214{
215 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
216 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
217
218 if ( uCpl > pSReg->Attr.n.u2Dpl
219 && pSReg->Attr.n.u1DescType /* code or data, not system */
220 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
221 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
222 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
223}
224
225
226/**
227 * Indicates that we have modified the FPU state.
228 *
229 * @param pVCpu The cross context virtual CPU structure of the calling thread.
230 */
231DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
232{
233 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
234}
235
236/** @} */
237
238/** @name C Implementations
239 * @{
240 */
241
242/**
243 * Implements a 16-bit popa.
244 */
245IEM_CIMPL_DEF_0(iemCImpl_popa_16)
246{
247 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
248 RTGCPTR GCPtrLast = GCPtrStart + 15;
249 VBOXSTRICTRC rcStrict;
250
251 /*
252 * The docs are a bit hard to comprehend here, but it looks like we wrap
253 * around in real mode as long as none of the individual "popa" crosses the
254 * end of the stack segment. In protected mode we check the whole access
255 * in one go. For efficiency, only do the word-by-word thing if we're in
256 * danger of wrapping around.
257 */
258 /** @todo do popa boundary / wrap-around checks. */
259 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
260 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
261 {
262 /* word-by-word */
263 RTUINT64U TmpRsp;
264 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
265 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
266 if (rcStrict == VINF_SUCCESS)
267 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 {
272 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
273 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
274 }
275 if (rcStrict == VINF_SUCCESS)
276 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
277 if (rcStrict == VINF_SUCCESS)
278 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
279 if (rcStrict == VINF_SUCCESS)
280 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
281 if (rcStrict == VINF_SUCCESS)
282 {
283 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
284 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
285 }
286 }
287 else
288 {
289 uint16_t const *pa16Mem = NULL;
290 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
291 if (rcStrict == VINF_SUCCESS)
292 {
293 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
294 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
295 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
296 /* skip sp */
297 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
298 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
299 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
300 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
301 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
302 if (rcStrict == VINF_SUCCESS)
303 {
304 iemRegAddToRsp(pVCpu, 16);
305 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
306 }
307 }
308 }
309 return rcStrict;
310}
311
312
313/**
314 * Implements a 32-bit popa.
315 */
316IEM_CIMPL_DEF_0(iemCImpl_popa_32)
317{
318 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
319 RTGCPTR GCPtrLast = GCPtrStart + 31;
320 VBOXSTRICTRC rcStrict;
321
322 /*
323 * The docs are a bit hard to comprehend here, but it looks like we wrap
324 * around in real mode as long as none of the individual "popa" crosses the
325 * end of the stack segment. In protected mode we check the whole access
326 * in one go. For efficiency, only do the word-by-word thing if we're in
327 * danger of wrapping around.
328 */
329 /** @todo do popa boundary / wrap-around checks. */
330 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
331 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
332 {
333 /* word-by-word */
334 RTUINT64U TmpRsp;
335 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
336 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
337 if (rcStrict == VINF_SUCCESS)
338 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
339 if (rcStrict == VINF_SUCCESS)
340 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
341 if (rcStrict == VINF_SUCCESS)
342 {
343 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
344 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
345 }
346 if (rcStrict == VINF_SUCCESS)
347 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
348 if (rcStrict == VINF_SUCCESS)
349 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
350 if (rcStrict == VINF_SUCCESS)
351 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
352 if (rcStrict == VINF_SUCCESS)
353 {
354#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
355 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
356 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
357 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
358 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
359 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
360 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
361 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
362#endif
363 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
364 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
365 }
366 }
367 else
368 {
369 uint32_t const *pa32Mem;
370 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
371 if (rcStrict == VINF_SUCCESS)
372 {
373 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
374 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
375 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
376 /* skip esp */
377 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
378 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
379 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
380 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
381 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
382 if (rcStrict == VINF_SUCCESS)
383 {
384 iemRegAddToRsp(pVCpu, 32);
385 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
386 }
387 }
388 }
389 return rcStrict;
390}
391
392
393/**
394 * Implements a 16-bit pusha.
395 */
396IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
397{
398 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
399 RTGCPTR GCPtrBottom = GCPtrTop - 15;
400 VBOXSTRICTRC rcStrict;
401
402 /*
403 * The docs are a bit hard to comprehend here, but it looks like we wrap
404 * around in real mode as long as none of the individual "pushd" crosses the
405 * end of the stack segment. In protected mode we check the whole access
406 * in one go. For efficiency, only do the word-by-word thing if we're in
407 * danger of wrapping around.
408 */
409 /** @todo do pusha boundary / wrap-around checks. */
410 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
411 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
412 {
413 /* word-by-word */
414 RTUINT64U TmpRsp;
415 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
416 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
417 if (rcStrict == VINF_SUCCESS)
418 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
419 if (rcStrict == VINF_SUCCESS)
420 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
421 if (rcStrict == VINF_SUCCESS)
422 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
423 if (rcStrict == VINF_SUCCESS)
424 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
425 if (rcStrict == VINF_SUCCESS)
426 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
427 if (rcStrict == VINF_SUCCESS)
428 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
429 if (rcStrict == VINF_SUCCESS)
430 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
431 if (rcStrict == VINF_SUCCESS)
432 {
433 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
434 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
435 }
436 }
437 else
438 {
439 GCPtrBottom--;
440 uint16_t *pa16Mem = NULL;
441 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
442 if (rcStrict == VINF_SUCCESS)
443 {
444 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
445 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
446 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
447 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
448 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
449 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
450 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
451 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
452 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
453 if (rcStrict == VINF_SUCCESS)
454 {
455 iemRegSubFromRsp(pVCpu, 16);
456 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
457 }
458 }
459 }
460 return rcStrict;
461}
462
463
464/**
465 * Implements a 32-bit pusha.
466 */
467IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
468{
469 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
470 RTGCPTR GCPtrBottom = GCPtrTop - 31;
471 VBOXSTRICTRC rcStrict;
472
473 /*
474 * The docs are a bit hard to comprehend here, but it looks like we wrap
475 * around in real mode as long as none of the individual "pusha" crosses the
476 * end of the stack segment. In protected mode we check the whole access
477 * in one go. For efficiency, only do the word-by-word thing if we're in
478 * danger of wrapping around.
479 */
480 /** @todo do pusha boundary / wrap-around checks. */
481 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
482 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
483 {
484 /* word-by-word */
485 RTUINT64U TmpRsp;
486 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
487 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
490 if (rcStrict == VINF_SUCCESS)
491 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
496 if (rcStrict == VINF_SUCCESS)
497 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
498 if (rcStrict == VINF_SUCCESS)
499 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
500 if (rcStrict == VINF_SUCCESS)
501 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
502 if (rcStrict == VINF_SUCCESS)
503 {
504 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
505 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
506 }
507 }
508 else
509 {
510 GCPtrBottom--;
511 uint32_t *pa32Mem;
512 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
513 if (rcStrict == VINF_SUCCESS)
514 {
515 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
516 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
517 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
518 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
519 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
520 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
521 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
522 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
523 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
524 if (rcStrict == VINF_SUCCESS)
525 {
526 iemRegSubFromRsp(pVCpu, 32);
527 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
528 }
529 }
530 }
531 return rcStrict;
532}
533
534
535/**
536 * Implements pushf.
537 *
538 *
539 * @param enmEffOpSize The effective operand size.
540 */
541IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
542{
543 VBOXSTRICTRC rcStrict;
544
545 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
546 {
547 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
548 IEM_SVM_UPDATE_NRIP(pVCpu);
549 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
550 }
551
552 /*
553 * If we're in V8086 mode some care is required (which is why we're in
554 * doing this in a C implementation).
555 */
556 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
557 if ( (fEfl & X86_EFL_VM)
558 && X86_EFL_GET_IOPL(fEfl) != 3 )
559 {
560 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
561 if ( enmEffOpSize != IEMMODE_16BIT
562 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
563 return iemRaiseGeneralProtectionFault0(pVCpu);
564 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
565 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
566 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
567 }
568 else
569 {
570
571 /*
572 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
573 */
574 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
575
576 switch (enmEffOpSize)
577 {
578 case IEMMODE_16BIT:
579 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
580 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
581 fEfl |= UINT16_C(0xf000);
582 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
583 break;
584 case IEMMODE_32BIT:
585 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
586 break;
587 case IEMMODE_64BIT:
588 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
589 break;
590 IEM_NOT_REACHED_DEFAULT_CASE_RET();
591 }
592 }
593 if (rcStrict != VINF_SUCCESS)
594 return rcStrict;
595
596 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
597 return VINF_SUCCESS;
598}
599
600
601/**
602 * Implements popf.
603 *
604 * @param enmEffOpSize The effective operand size.
605 */
606IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
607{
608 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
609 VBOXSTRICTRC rcStrict;
610 uint32_t fEflNew;
611
612 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
613 {
614 Log2(("popf: Guest intercept -> #VMEXIT\n"));
615 IEM_SVM_UPDATE_NRIP(pVCpu);
616 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
617 }
618
619 /*
620 * V8086 is special as usual.
621 */
622 if (fEflOld & X86_EFL_VM)
623 {
624 /*
625 * Almost anything goes if IOPL is 3.
626 */
627 if (X86_EFL_GET_IOPL(fEflOld) == 3)
628 {
629 switch (enmEffOpSize)
630 {
631 case IEMMODE_16BIT:
632 {
633 uint16_t u16Value;
634 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
635 if (rcStrict != VINF_SUCCESS)
636 return rcStrict;
637 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
638 break;
639 }
640 case IEMMODE_32BIT:
641 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
642 if (rcStrict != VINF_SUCCESS)
643 return rcStrict;
644 break;
645 IEM_NOT_REACHED_DEFAULT_CASE_RET();
646 }
647
648 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
649 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
650 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
651 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
652 }
653 /*
654 * Interrupt flag virtualization with CR4.VME=1.
655 */
656 else if ( enmEffOpSize == IEMMODE_16BIT
657 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
658 {
659 uint16_t u16Value;
660 RTUINT64U TmpRsp;
661 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
662 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
663 if (rcStrict != VINF_SUCCESS)
664 return rcStrict;
665
666 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
667 * or before? */
668 if ( ( (u16Value & X86_EFL_IF)
669 && (fEflOld & X86_EFL_VIP))
670 || (u16Value & X86_EFL_TF) )
671 return iemRaiseGeneralProtectionFault0(pVCpu);
672
673 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
674 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
675 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
676 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
677
678 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
679 }
680 else
681 return iemRaiseGeneralProtectionFault0(pVCpu);
682
683 }
684 /*
685 * Not in V8086 mode.
686 */
687 else
688 {
689 /* Pop the flags. */
690 switch (enmEffOpSize)
691 {
692 case IEMMODE_16BIT:
693 {
694 uint16_t u16Value;
695 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
696 if (rcStrict != VINF_SUCCESS)
697 return rcStrict;
698 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
699
700 /*
701 * Ancient CPU adjustments:
702 * - 8086, 80186, V20/30:
703 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
704 * practical reasons (masking below). We add them when pushing flags.
705 * - 80286:
706 * The NT and IOPL flags cannot be popped from real mode and are
707 * therefore always zero (since a 286 can never exit from PM and
708 * their initial value is zero). This changed on a 386 and can
709 * therefore be used to detect 286 or 386 CPU in real mode.
710 */
711 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
712 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
713 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
714 break;
715 }
716 case IEMMODE_32BIT:
717 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
718 if (rcStrict != VINF_SUCCESS)
719 return rcStrict;
720 break;
721 case IEMMODE_64BIT:
722 {
723 uint64_t u64Value;
724 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
725 if (rcStrict != VINF_SUCCESS)
726 return rcStrict;
727 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
728 break;
729 }
730 IEM_NOT_REACHED_DEFAULT_CASE_RET();
731 }
732
733 /* Merge them with the current flags. */
734 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
735 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
736 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
737 || pVCpu->iem.s.uCpl == 0)
738 {
739 fEflNew &= fPopfBits;
740 fEflNew |= ~fPopfBits & fEflOld;
741 }
742 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
743 {
744 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
745 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
746 }
747 else
748 {
749 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
750 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
751 }
752 }
753
754 /*
755 * Commit the flags.
756 */
757 Assert(fEflNew & RT_BIT_32(1));
758 IEMMISC_SET_EFL(pVCpu, fEflNew);
759 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
760
761 return VINF_SUCCESS;
762}
763
764
765/**
766 * Implements an indirect call.
767 *
768 * @param uNewPC The new program counter (RIP) value (loaded from the
769 * operand).
770 */
771IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
772{
773 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
774 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
775 return iemRaiseGeneralProtectionFault0(pVCpu);
776
777 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
778 if (rcStrict != VINF_SUCCESS)
779 return rcStrict;
780
781 pVCpu->cpum.GstCtx.rip = uNewPC;
782 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
783
784#ifndef IEM_WITH_CODE_TLB
785 /* Flush the prefetch buffer. */
786 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
787#endif
788 return VINF_SUCCESS;
789}
790
791
792/**
793 * Implements a 16-bit relative call.
794 *
795 * @param offDisp The displacment offset.
796 */
797IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
798{
799 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
800 uint16_t uNewPC = uOldPC + offDisp;
801 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
802 return iemRaiseGeneralProtectionFault0(pVCpu);
803
804 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
805 if (rcStrict != VINF_SUCCESS)
806 return rcStrict;
807
808 pVCpu->cpum.GstCtx.rip = uNewPC;
809 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
810
811#ifndef IEM_WITH_CODE_TLB
812 /* Flush the prefetch buffer. */
813 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
814#endif
815 return VINF_SUCCESS;
816}
817
818
819/**
820 * Implements a 32-bit indirect call.
821 *
822 * @param uNewPC The new program counter (RIP) value (loaded from the
823 * operand).
824 */
825IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
826{
827 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
828 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
829 return iemRaiseGeneralProtectionFault0(pVCpu);
830
831 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
832 if (rcStrict != VINF_SUCCESS)
833 return rcStrict;
834
835 pVCpu->cpum.GstCtx.rip = uNewPC;
836 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
837
838#ifndef IEM_WITH_CODE_TLB
839 /* Flush the prefetch buffer. */
840 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
841#endif
842 return VINF_SUCCESS;
843}
844
845
846/**
847 * Implements a 32-bit relative call.
848 *
849 * @param offDisp The displacment offset.
850 */
851IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
852{
853 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
854 uint32_t uNewPC = uOldPC + offDisp;
855 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
856 return iemRaiseGeneralProtectionFault0(pVCpu);
857
858 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
859 if (rcStrict != VINF_SUCCESS)
860 return rcStrict;
861
862 pVCpu->cpum.GstCtx.rip = uNewPC;
863 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
864
865#ifndef IEM_WITH_CODE_TLB
866 /* Flush the prefetch buffer. */
867 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
868#endif
869 return VINF_SUCCESS;
870}
871
872
873/**
874 * Implements a 64-bit indirect call.
875 *
876 * @param uNewPC The new program counter (RIP) value (loaded from the
877 * operand).
878 */
879IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
880{
881 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
882 if (!IEM_IS_CANONICAL(uNewPC))
883 return iemRaiseGeneralProtectionFault0(pVCpu);
884
885 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
886 if (rcStrict != VINF_SUCCESS)
887 return rcStrict;
888
889 pVCpu->cpum.GstCtx.rip = uNewPC;
890 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
891
892#ifndef IEM_WITH_CODE_TLB
893 /* Flush the prefetch buffer. */
894 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
895#endif
896 return VINF_SUCCESS;
897}
898
899
900/**
901 * Implements a 64-bit relative call.
902 *
903 * @param offDisp The displacment offset.
904 */
905IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
906{
907 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
908 uint64_t uNewPC = uOldPC + offDisp;
909 if (!IEM_IS_CANONICAL(uNewPC))
910 return iemRaiseNotCanonical(pVCpu);
911
912 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
913 if (rcStrict != VINF_SUCCESS)
914 return rcStrict;
915
916 pVCpu->cpum.GstCtx.rip = uNewPC;
917 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
918
919#ifndef IEM_WITH_CODE_TLB
920 /* Flush the prefetch buffer. */
921 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
922#endif
923
924 return VINF_SUCCESS;
925}
926
927
928/**
929 * Implements far jumps and calls thru task segments (TSS).
930 *
931 * @param uSel The selector.
932 * @param enmBranch The kind of branching we're performing.
933 * @param enmEffOpSize The effective operand size.
934 * @param pDesc The descriptor corresponding to @a uSel. The type is
935 * task gate.
936 */
937IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
938{
939#ifndef IEM_IMPLEMENTS_TASKSWITCH
940 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
941#else
942 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
943 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
944 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
945 RT_NOREF_PV(enmEffOpSize);
946 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
947
948 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
949 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
950 {
951 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
952 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
953 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
954 }
955
956 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
957 * far calls (see iemCImpl_callf). Most likely in both cases it should be
958 * checked here, need testcases. */
959 if (!pDesc->Legacy.Gen.u1Present)
960 {
961 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
962 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
963 }
964
965 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
966 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
967 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
968#endif
969}
970
971
972/**
973 * Implements far jumps and calls thru task gates.
974 *
975 * @param uSel The selector.
976 * @param enmBranch The kind of branching we're performing.
977 * @param enmEffOpSize The effective operand size.
978 * @param pDesc The descriptor corresponding to @a uSel. The type is
979 * task gate.
980 */
981IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
982{
983#ifndef IEM_IMPLEMENTS_TASKSWITCH
984 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
985#else
986 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
987 RT_NOREF_PV(enmEffOpSize);
988 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
989
990 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
991 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
992 {
993 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
994 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
995 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
996 }
997
998 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
999 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1000 * checked here, need testcases. */
1001 if (!pDesc->Legacy.Gen.u1Present)
1002 {
1003 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1004 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1005 }
1006
1007 /*
1008 * Fetch the new TSS descriptor from the GDT.
1009 */
1010 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1011 if (uSelTss & X86_SEL_LDT)
1012 {
1013 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1014 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1015 }
1016
1017 IEMSELDESC TssDesc;
1018 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1019 if (rcStrict != VINF_SUCCESS)
1020 return rcStrict;
1021
1022 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1023 {
1024 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1025 TssDesc.Legacy.Gate.u4Type));
1026 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1027 }
1028
1029 if (!TssDesc.Legacy.Gate.u1Present)
1030 {
1031 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1032 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1033 }
1034
1035 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1036 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1037 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1038#endif
1039}
1040
1041
1042/**
1043 * Implements far jumps and calls thru call gates.
1044 *
1045 * @param uSel The selector.
1046 * @param enmBranch The kind of branching we're performing.
1047 * @param enmEffOpSize The effective operand size.
1048 * @param pDesc The descriptor corresponding to @a uSel. The type is
1049 * call gate.
1050 */
1051IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1052{
1053#define IEM_IMPLEMENTS_CALLGATE
1054#ifndef IEM_IMPLEMENTS_CALLGATE
1055 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1056#else
1057 RT_NOREF_PV(enmEffOpSize);
1058 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1059
1060 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1061 * inter-privilege calls and are much more complex.
1062 *
1063 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1064 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1065 * must be 16-bit or 32-bit.
1066 */
1067 /** @todo effective operand size is probably irrelevant here, only the
1068 * call gate bitness matters??
1069 */
1070 VBOXSTRICTRC rcStrict;
1071 RTPTRUNION uPtrRet;
1072 uint64_t uNewRsp;
1073 uint64_t uNewRip;
1074 uint64_t u64Base;
1075 uint32_t cbLimit;
1076 RTSEL uNewCS;
1077 IEMSELDESC DescCS;
1078
1079 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1080 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1081 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1082 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1083
1084 /* Determine the new instruction pointer from the gate descriptor. */
1085 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1086 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1087 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1088
1089 /* Perform DPL checks on the gate descriptor. */
1090 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1091 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1092 {
1093 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1094 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1095 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1096 }
1097
1098 /** @todo does this catch NULL selectors, too? */
1099 if (!pDesc->Legacy.Gen.u1Present)
1100 {
1101 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1102 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1103 }
1104
1105 /*
1106 * Fetch the target CS descriptor from the GDT or LDT.
1107 */
1108 uNewCS = pDesc->Legacy.Gate.u16Sel;
1109 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1110 if (rcStrict != VINF_SUCCESS)
1111 return rcStrict;
1112
1113 /* Target CS must be a code selector. */
1114 if ( !DescCS.Legacy.Gen.u1DescType
1115 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1116 {
1117 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1118 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1119 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1120 }
1121
1122 /* Privilege checks on target CS. */
1123 if (enmBranch == IEMBRANCH_JUMP)
1124 {
1125 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1126 {
1127 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1128 {
1129 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1130 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1131 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1132 }
1133 }
1134 else
1135 {
1136 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1137 {
1138 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1139 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1140 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1141 }
1142 }
1143 }
1144 else
1145 {
1146 Assert(enmBranch == IEMBRANCH_CALL);
1147 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1148 {
1149 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1150 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1151 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1152 }
1153 }
1154
1155 /* Additional long mode checks. */
1156 if (IEM_IS_LONG_MODE(pVCpu))
1157 {
1158 if (!DescCS.Legacy.Gen.u1Long)
1159 {
1160 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1161 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1162 }
1163
1164 /* L vs D. */
1165 if ( DescCS.Legacy.Gen.u1Long
1166 && DescCS.Legacy.Gen.u1DefBig)
1167 {
1168 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1169 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1170 }
1171 }
1172
1173 if (!DescCS.Legacy.Gate.u1Present)
1174 {
1175 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1176 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1177 }
1178
1179 if (enmBranch == IEMBRANCH_JUMP)
1180 {
1181 /** @todo This is very similar to regular far jumps; merge! */
1182 /* Jumps are fairly simple... */
1183
1184 /* Chop the high bits off if 16-bit gate (Intel says so). */
1185 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1186 uNewRip = (uint16_t)uNewRip;
1187
1188 /* Limit check for non-long segments. */
1189 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1190 if (DescCS.Legacy.Gen.u1Long)
1191 u64Base = 0;
1192 else
1193 {
1194 if (uNewRip > cbLimit)
1195 {
1196 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1197 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1198 }
1199 u64Base = X86DESC_BASE(&DescCS.Legacy);
1200 }
1201
1202 /* Canonical address check. */
1203 if (!IEM_IS_CANONICAL(uNewRip))
1204 {
1205 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1206 return iemRaiseNotCanonical(pVCpu);
1207 }
1208
1209 /*
1210 * Ok, everything checked out fine. Now set the accessed bit before
1211 * committing the result into CS, CSHID and RIP.
1212 */
1213 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1214 {
1215 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1216 if (rcStrict != VINF_SUCCESS)
1217 return rcStrict;
1218 /** @todo check what VT-x and AMD-V does. */
1219 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1220 }
1221
1222 /* commit */
1223 pVCpu->cpum.GstCtx.rip = uNewRip;
1224 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1225 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1226 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1227 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1228 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1229 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1230 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1231 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1232 }
1233 else
1234 {
1235 Assert(enmBranch == IEMBRANCH_CALL);
1236 /* Calls are much more complicated. */
1237
1238 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1239 {
1240 uint16_t offNewStack; /* Offset of new stack in TSS. */
1241 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1242 uint8_t uNewCSDpl;
1243 uint8_t cbWords;
1244 RTSEL uNewSS;
1245 RTSEL uOldSS;
1246 uint64_t uOldRsp;
1247 IEMSELDESC DescSS;
1248 RTPTRUNION uPtrTSS;
1249 RTGCPTR GCPtrTSS;
1250 RTPTRUNION uPtrParmWds;
1251 RTGCPTR GCPtrParmWds;
1252
1253 /* More privilege. This is the fun part. */
1254 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1255
1256 /*
1257 * Determine new SS:rSP from the TSS.
1258 */
1259 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1260
1261 /* Figure out where the new stack pointer is stored in the TSS. */
1262 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1263 if (!IEM_IS_LONG_MODE(pVCpu))
1264 {
1265 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1266 {
1267 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1268 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1269 }
1270 else
1271 {
1272 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1273 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1274 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1275 }
1276 }
1277 else
1278 {
1279 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1280 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1281 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1282 }
1283
1284 /* Check against TSS limit. */
1285 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1286 {
1287 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1288 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1289 }
1290
1291 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1292 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1293 if (rcStrict != VINF_SUCCESS)
1294 {
1295 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1296 return rcStrict;
1297 }
1298
1299 if (!IEM_IS_LONG_MODE(pVCpu))
1300 {
1301 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1302 {
1303 uNewRsp = uPtrTSS.pu32[0];
1304 uNewSS = uPtrTSS.pu16[2];
1305 }
1306 else
1307 {
1308 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1309 uNewRsp = uPtrTSS.pu16[0];
1310 uNewSS = uPtrTSS.pu16[1];
1311 }
1312 }
1313 else
1314 {
1315 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1316 /* SS will be a NULL selector, but that's valid. */
1317 uNewRsp = uPtrTSS.pu64[0];
1318 uNewSS = uNewCSDpl;
1319 }
1320
1321 /* Done with the TSS now. */
1322 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1323 if (rcStrict != VINF_SUCCESS)
1324 {
1325 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1326 return rcStrict;
1327 }
1328
1329 /* Only used outside of long mode. */
1330 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1331
1332 /* If EFER.LMA is 0, there's extra work to do. */
1333 if (!IEM_IS_LONG_MODE(pVCpu))
1334 {
1335 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1336 {
1337 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1338 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1339 }
1340
1341 /* Grab the new SS descriptor. */
1342 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1343 if (rcStrict != VINF_SUCCESS)
1344 return rcStrict;
1345
1346 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1347 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1348 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1349 {
1350 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1351 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1352 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1353 }
1354
1355 /* Ensure new SS is a writable data segment. */
1356 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1357 {
1358 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1359 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1360 }
1361
1362 if (!DescSS.Legacy.Gen.u1Present)
1363 {
1364 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1365 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1366 }
1367 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1368 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1369 else
1370 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1371 }
1372 else
1373 {
1374 /* Just grab the new (NULL) SS descriptor. */
1375 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1376 * like we do... */
1377 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1378 if (rcStrict != VINF_SUCCESS)
1379 return rcStrict;
1380
1381 cbNewStack = sizeof(uint64_t) * 4;
1382 }
1383
1384 /** @todo According to Intel, new stack is checked for enough space first,
1385 * then switched. According to AMD, the stack is switched first and
1386 * then pushes might fault!
1387 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1388 * incoming stack \#PF happens before actual stack switch. AMD is
1389 * either lying or implicitly assumes that new state is committed
1390 * only if and when an instruction doesn't fault.
1391 */
1392
1393 /** @todo According to AMD, CS is loaded first, then SS.
1394 * According to Intel, it's the other way around!?
1395 */
1396
1397 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1398
1399 /* Set the accessed bit before committing new SS. */
1400 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1401 {
1402 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1403 if (rcStrict != VINF_SUCCESS)
1404 return rcStrict;
1405 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1406 }
1407
1408 /* Remember the old SS:rSP and their linear address. */
1409 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1410 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1411
1412 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1413
1414 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1415 or #PF, the former is not implemented in this workaround. */
1416 /** @todo Proper fix callgate target stack exceptions. */
1417 /** @todo testcase: Cover callgates with partially or fully inaccessible
1418 * target stacks. */
1419 void *pvNewFrame;
1420 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1421 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1422 if (rcStrict != VINF_SUCCESS)
1423 {
1424 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1425 return rcStrict;
1426 }
1427 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1428 if (rcStrict != VINF_SUCCESS)
1429 {
1430 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1431 return rcStrict;
1432 }
1433
1434 /* Commit new SS:rSP. */
1435 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1436 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1437 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1438 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1439 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1440 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1441 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1442 pVCpu->iem.s.uCpl = uNewCSDpl;
1443 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1444 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1445
1446 /* At this point the stack access must not fail because new state was already committed. */
1447 /** @todo this can still fail due to SS.LIMIT not check. */
1448 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1449 &uPtrRet.pv, &uNewRsp);
1450 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1451 VERR_INTERNAL_ERROR_5);
1452
1453 if (!IEM_IS_LONG_MODE(pVCpu))
1454 {
1455 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1456 {
1457 /* Push the old CS:rIP. */
1458 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1459 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1460
1461 if (cbWords)
1462 {
1463 /* Map the relevant chunk of the old stack. */
1464 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1465 if (rcStrict != VINF_SUCCESS)
1466 {
1467 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1468 return rcStrict;
1469 }
1470
1471 /* Copy the parameter (d)words. */
1472 for (int i = 0; i < cbWords; ++i)
1473 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1474
1475 /* Unmap the old stack. */
1476 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1477 if (rcStrict != VINF_SUCCESS)
1478 {
1479 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1480 return rcStrict;
1481 }
1482 }
1483
1484 /* Push the old SS:rSP. */
1485 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1486 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1487 }
1488 else
1489 {
1490 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1491
1492 /* Push the old CS:rIP. */
1493 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1494 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1495
1496 if (cbWords)
1497 {
1498 /* Map the relevant chunk of the old stack. */
1499 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1500 if (rcStrict != VINF_SUCCESS)
1501 {
1502 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1503 return rcStrict;
1504 }
1505
1506 /* Copy the parameter words. */
1507 for (int i = 0; i < cbWords; ++i)
1508 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1509
1510 /* Unmap the old stack. */
1511 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1512 if (rcStrict != VINF_SUCCESS)
1513 {
1514 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1515 return rcStrict;
1516 }
1517 }
1518
1519 /* Push the old SS:rSP. */
1520 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1521 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1522 }
1523 }
1524 else
1525 {
1526 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1527
1528 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1529 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1530 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1531 uPtrRet.pu64[2] = uOldRsp;
1532 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1533 }
1534
1535 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1536 if (rcStrict != VINF_SUCCESS)
1537 {
1538 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1539 return rcStrict;
1540 }
1541
1542 /* Chop the high bits off if 16-bit gate (Intel says so). */
1543 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1544 uNewRip = (uint16_t)uNewRip;
1545
1546 /* Limit / canonical check. */
1547 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1548 if (!IEM_IS_LONG_MODE(pVCpu))
1549 {
1550 if (uNewRip > cbLimit)
1551 {
1552 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1553 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1554 }
1555 u64Base = X86DESC_BASE(&DescCS.Legacy);
1556 }
1557 else
1558 {
1559 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1560 if (!IEM_IS_CANONICAL(uNewRip))
1561 {
1562 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1563 return iemRaiseNotCanonical(pVCpu);
1564 }
1565 u64Base = 0;
1566 }
1567
1568 /*
1569 * Now set the accessed bit before
1570 * writing the return address to the stack and committing the result into
1571 * CS, CSHID and RIP.
1572 */
1573 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1574 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1575 {
1576 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1577 if (rcStrict != VINF_SUCCESS)
1578 return rcStrict;
1579 /** @todo check what VT-x and AMD-V does. */
1580 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1581 }
1582
1583 /* Commit new CS:rIP. */
1584 pVCpu->cpum.GstCtx.rip = uNewRip;
1585 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1586 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1587 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1588 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1589 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1590 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1591 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1592 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1593 }
1594 else
1595 {
1596 /* Same privilege. */
1597 /** @todo This is very similar to regular far calls; merge! */
1598
1599 /* Check stack first - may #SS(0). */
1600 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1601 * 16-bit code cause a two or four byte CS to be pushed? */
1602 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1603 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1604 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1605 &uPtrRet.pv, &uNewRsp);
1606 if (rcStrict != VINF_SUCCESS)
1607 return rcStrict;
1608
1609 /* Chop the high bits off if 16-bit gate (Intel says so). */
1610 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1611 uNewRip = (uint16_t)uNewRip;
1612
1613 /* Limit / canonical check. */
1614 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1615 if (!IEM_IS_LONG_MODE(pVCpu))
1616 {
1617 if (uNewRip > cbLimit)
1618 {
1619 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1620 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1621 }
1622 u64Base = X86DESC_BASE(&DescCS.Legacy);
1623 }
1624 else
1625 {
1626 if (!IEM_IS_CANONICAL(uNewRip))
1627 {
1628 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1629 return iemRaiseNotCanonical(pVCpu);
1630 }
1631 u64Base = 0;
1632 }
1633
1634 /*
1635 * Now set the accessed bit before
1636 * writing the return address to the stack and committing the result into
1637 * CS, CSHID and RIP.
1638 */
1639 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1640 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1641 {
1642 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1643 if (rcStrict != VINF_SUCCESS)
1644 return rcStrict;
1645 /** @todo check what VT-x and AMD-V does. */
1646 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1647 }
1648
1649 /* stack */
1650 if (!IEM_IS_LONG_MODE(pVCpu))
1651 {
1652 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1653 {
1654 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1655 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1656 }
1657 else
1658 {
1659 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1660 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1661 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1662 }
1663 }
1664 else
1665 {
1666 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1667 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1668 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1669 }
1670
1671 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1672 if (rcStrict != VINF_SUCCESS)
1673 return rcStrict;
1674
1675 /* commit */
1676 pVCpu->cpum.GstCtx.rip = uNewRip;
1677 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1678 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1679 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1680 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1681 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1682 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1683 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1684 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1685 }
1686 }
1687 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1688
1689 /* Flush the prefetch buffer. */
1690# ifdef IEM_WITH_CODE_TLB
1691 pVCpu->iem.s.pbInstrBuf = NULL;
1692# else
1693 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1694# endif
1695 return VINF_SUCCESS;
1696#endif
1697}
1698
1699
1700/**
1701 * Implements far jumps and calls thru system selectors.
1702 *
1703 * @param uSel The selector.
1704 * @param enmBranch The kind of branching we're performing.
1705 * @param enmEffOpSize The effective operand size.
1706 * @param pDesc The descriptor corresponding to @a uSel.
1707 */
1708IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1709{
1710 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1711 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1712 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1713
1714 if (IEM_IS_LONG_MODE(pVCpu))
1715 switch (pDesc->Legacy.Gen.u4Type)
1716 {
1717 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1718 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1719
1720 default:
1721 case AMD64_SEL_TYPE_SYS_LDT:
1722 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1723 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1724 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1725 case AMD64_SEL_TYPE_SYS_INT_GATE:
1726 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1727 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1728 }
1729
1730 switch (pDesc->Legacy.Gen.u4Type)
1731 {
1732 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1733 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1734 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1735
1736 case X86_SEL_TYPE_SYS_TASK_GATE:
1737 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1738
1739 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1740 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1741 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1742
1743 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1744 Log(("branch %04x -> busy 286 TSS\n", uSel));
1745 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1746
1747 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1748 Log(("branch %04x -> busy 386 TSS\n", uSel));
1749 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1750
1751 default:
1752 case X86_SEL_TYPE_SYS_LDT:
1753 case X86_SEL_TYPE_SYS_286_INT_GATE:
1754 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1755 case X86_SEL_TYPE_SYS_386_INT_GATE:
1756 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1757 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1758 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1759 }
1760}
1761
1762
1763/**
1764 * Implements far jumps.
1765 *
1766 * @param uSel The selector.
1767 * @param offSeg The segment offset.
1768 * @param enmEffOpSize The effective operand size.
1769 */
1770IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1771{
1772 NOREF(cbInstr);
1773 Assert(offSeg <= UINT32_MAX);
1774
1775 /*
1776 * Real mode and V8086 mode are easy. The only snag seems to be that
1777 * CS.limit doesn't change and the limit check is done against the current
1778 * limit.
1779 */
1780 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1781 * 1998) that up to and including the Intel 486, far control
1782 * transfers in real mode set default CS attributes (0x93) and also
1783 * set a 64K segment limit. Starting with the Pentium, the
1784 * attributes and limit are left alone but the access rights are
1785 * ignored. We only implement the Pentium+ behavior.
1786 * */
1787 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1788 {
1789 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1790 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1791 {
1792 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1793 return iemRaiseGeneralProtectionFault0(pVCpu);
1794 }
1795
1796 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1797 pVCpu->cpum.GstCtx.rip = offSeg;
1798 else
1799 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1800 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1801 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1802 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1803 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1804 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1805 return VINF_SUCCESS;
1806 }
1807
1808 /*
1809 * Protected mode. Need to parse the specified descriptor...
1810 */
1811 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1812 {
1813 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1814 return iemRaiseGeneralProtectionFault0(pVCpu);
1815 }
1816
1817 /* Fetch the descriptor. */
1818 IEMSELDESC Desc;
1819 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1820 if (rcStrict != VINF_SUCCESS)
1821 return rcStrict;
1822
1823 /* Is it there? */
1824 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1825 {
1826 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1827 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1828 }
1829
1830 /*
1831 * Deal with it according to its type. We do the standard code selectors
1832 * here and dispatch the system selectors to worker functions.
1833 */
1834 if (!Desc.Legacy.Gen.u1DescType)
1835 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1836
1837 /* Only code segments. */
1838 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1839 {
1840 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1842 }
1843
1844 /* L vs D. */
1845 if ( Desc.Legacy.Gen.u1Long
1846 && Desc.Legacy.Gen.u1DefBig
1847 && IEM_IS_LONG_MODE(pVCpu))
1848 {
1849 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1850 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1851 }
1852
1853 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1854 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1855 {
1856 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1857 {
1858 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1859 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1860 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1861 }
1862 }
1863 else
1864 {
1865 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1866 {
1867 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1868 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1869 }
1870 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1871 {
1872 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1873 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1874 }
1875 }
1876
1877 /* Chop the high bits if 16-bit (Intel says so). */
1878 if (enmEffOpSize == IEMMODE_16BIT)
1879 offSeg &= UINT16_MAX;
1880
1881 /* Limit check. (Should alternatively check for non-canonical addresses
1882 here, but that is ruled out by offSeg being 32-bit, right?) */
1883 uint64_t u64Base;
1884 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1885 if (Desc.Legacy.Gen.u1Long)
1886 u64Base = 0;
1887 else
1888 {
1889 if (offSeg > cbLimit)
1890 {
1891 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1892 /** @todo Intel says this is \#GP(0)! */
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895 u64Base = X86DESC_BASE(&Desc.Legacy);
1896 }
1897
1898 /*
1899 * Ok, everything checked out fine. Now set the accessed bit before
1900 * committing the result into CS, CSHID and RIP.
1901 */
1902 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1903 {
1904 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1905 if (rcStrict != VINF_SUCCESS)
1906 return rcStrict;
1907 /** @todo check what VT-x and AMD-V does. */
1908 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1909 }
1910
1911 /* commit */
1912 pVCpu->cpum.GstCtx.rip = offSeg;
1913 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1914 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1915 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1916 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1917 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1918 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1919 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1920 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1921 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1922 /** @todo check if the hidden bits are loaded correctly for 64-bit
1923 * mode. */
1924
1925 /* Flush the prefetch buffer. */
1926#ifdef IEM_WITH_CODE_TLB
1927 pVCpu->iem.s.pbInstrBuf = NULL;
1928#else
1929 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1930#endif
1931
1932 return VINF_SUCCESS;
1933}
1934
1935
1936/**
1937 * Implements far calls.
1938 *
1939 * This very similar to iemCImpl_FarJmp.
1940 *
1941 * @param uSel The selector.
1942 * @param offSeg The segment offset.
1943 * @param enmEffOpSize The operand size (in case we need it).
1944 */
1945IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1946{
1947 VBOXSTRICTRC rcStrict;
1948 uint64_t uNewRsp;
1949 RTPTRUNION uPtrRet;
1950
1951 /*
1952 * Real mode and V8086 mode are easy. The only snag seems to be that
1953 * CS.limit doesn't change and the limit check is done against the current
1954 * limit.
1955 */
1956 /** @todo See comment for similar code in iemCImpl_FarJmp */
1957 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1958 {
1959 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1960
1961 /* Check stack first - may #SS(0). */
1962 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1963 &uPtrRet.pv, &uNewRsp);
1964 if (rcStrict != VINF_SUCCESS)
1965 return rcStrict;
1966
1967 /* Check the target address range. */
1968 if (offSeg > UINT32_MAX)
1969 return iemRaiseGeneralProtectionFault0(pVCpu);
1970
1971 /* Everything is fine, push the return address. */
1972 if (enmEffOpSize == IEMMODE_16BIT)
1973 {
1974 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1975 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1976 }
1977 else
1978 {
1979 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1980 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
1981 }
1982 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1983 if (rcStrict != VINF_SUCCESS)
1984 return rcStrict;
1985
1986 /* Branch. */
1987 pVCpu->cpum.GstCtx.rip = offSeg;
1988 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1989 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1990 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1991 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1992 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1993 return VINF_SUCCESS;
1994 }
1995
1996 /*
1997 * Protected mode. Need to parse the specified descriptor...
1998 */
1999 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2000 {
2001 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2002 return iemRaiseGeneralProtectionFault0(pVCpu);
2003 }
2004
2005 /* Fetch the descriptor. */
2006 IEMSELDESC Desc;
2007 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2008 if (rcStrict != VINF_SUCCESS)
2009 return rcStrict;
2010
2011 /*
2012 * Deal with it according to its type. We do the standard code selectors
2013 * here and dispatch the system selectors to worker functions.
2014 */
2015 if (!Desc.Legacy.Gen.u1DescType)
2016 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2017
2018 /* Only code segments. */
2019 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2020 {
2021 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2022 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2023 }
2024
2025 /* L vs D. */
2026 if ( Desc.Legacy.Gen.u1Long
2027 && Desc.Legacy.Gen.u1DefBig
2028 && IEM_IS_LONG_MODE(pVCpu))
2029 {
2030 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2031 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2032 }
2033
2034 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2035 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2036 {
2037 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2038 {
2039 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2040 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2041 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2042 }
2043 }
2044 else
2045 {
2046 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2047 {
2048 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2049 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2050 }
2051 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2052 {
2053 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2054 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2055 }
2056 }
2057
2058 /* Is it there? */
2059 if (!Desc.Legacy.Gen.u1Present)
2060 {
2061 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2062 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2063 }
2064
2065 /* Check stack first - may #SS(0). */
2066 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2067 * 16-bit code cause a two or four byte CS to be pushed? */
2068 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2069 enmEffOpSize == IEMMODE_64BIT ? 8+8
2070 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2071 &uPtrRet.pv, &uNewRsp);
2072 if (rcStrict != VINF_SUCCESS)
2073 return rcStrict;
2074
2075 /* Chop the high bits if 16-bit (Intel says so). */
2076 if (enmEffOpSize == IEMMODE_16BIT)
2077 offSeg &= UINT16_MAX;
2078
2079 /* Limit / canonical check. */
2080 uint64_t u64Base;
2081 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2082 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2083 {
2084 if (!IEM_IS_CANONICAL(offSeg))
2085 {
2086 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2087 return iemRaiseNotCanonical(pVCpu);
2088 }
2089 u64Base = 0;
2090 }
2091 else
2092 {
2093 if (offSeg > cbLimit)
2094 {
2095 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2096 /** @todo Intel says this is \#GP(0)! */
2097 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2098 }
2099 u64Base = X86DESC_BASE(&Desc.Legacy);
2100 }
2101
2102 /*
2103 * Now set the accessed bit before
2104 * writing the return address to the stack and committing the result into
2105 * CS, CSHID and RIP.
2106 */
2107 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2108 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2109 {
2110 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2111 if (rcStrict != VINF_SUCCESS)
2112 return rcStrict;
2113 /** @todo check what VT-x and AMD-V does. */
2114 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2115 }
2116
2117 /* stack */
2118 if (enmEffOpSize == IEMMODE_16BIT)
2119 {
2120 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2121 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2122 }
2123 else if (enmEffOpSize == IEMMODE_32BIT)
2124 {
2125 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2126 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2127 }
2128 else
2129 {
2130 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2131 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2132 }
2133 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2134 if (rcStrict != VINF_SUCCESS)
2135 return rcStrict;
2136
2137 /* commit */
2138 pVCpu->cpum.GstCtx.rip = offSeg;
2139 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2140 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2141 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2142 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2143 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2144 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2145 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2146 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2147 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2148 /** @todo check if the hidden bits are loaded correctly for 64-bit
2149 * mode. */
2150
2151 /* Flush the prefetch buffer. */
2152#ifdef IEM_WITH_CODE_TLB
2153 pVCpu->iem.s.pbInstrBuf = NULL;
2154#else
2155 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2156#endif
2157 return VINF_SUCCESS;
2158}
2159
2160
2161/**
2162 * Implements retf.
2163 *
2164 * @param enmEffOpSize The effective operand size.
2165 * @param cbPop The amount of arguments to pop from the stack
2166 * (bytes).
2167 */
2168IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2169{
2170 VBOXSTRICTRC rcStrict;
2171 RTCPTRUNION uPtrFrame;
2172 uint64_t uNewRsp;
2173 uint64_t uNewRip;
2174 uint16_t uNewCs;
2175 NOREF(cbInstr);
2176
2177 /*
2178 * Read the stack values first.
2179 */
2180 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2181 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2182 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2183 if (rcStrict != VINF_SUCCESS)
2184 return rcStrict;
2185 if (enmEffOpSize == IEMMODE_16BIT)
2186 {
2187 uNewRip = uPtrFrame.pu16[0];
2188 uNewCs = uPtrFrame.pu16[1];
2189 }
2190 else if (enmEffOpSize == IEMMODE_32BIT)
2191 {
2192 uNewRip = uPtrFrame.pu32[0];
2193 uNewCs = uPtrFrame.pu16[2];
2194 }
2195 else
2196 {
2197 uNewRip = uPtrFrame.pu64[0];
2198 uNewCs = uPtrFrame.pu16[4];
2199 }
2200 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2201 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2202 { /* extremely likely */ }
2203 else
2204 return rcStrict;
2205
2206 /*
2207 * Real mode and V8086 mode are easy.
2208 */
2209 /** @todo See comment for similar code in iemCImpl_FarJmp */
2210 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2211 {
2212 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2213 /** @todo check how this is supposed to work if sp=0xfffe. */
2214
2215 /* Check the limit of the new EIP. */
2216 /** @todo Intel pseudo code only does the limit check for 16-bit
2217 * operands, AMD does not make any distinction. What is right? */
2218 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2219 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2220
2221 /* commit the operation. */
2222 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2223 pVCpu->cpum.GstCtx.rip = uNewRip;
2224 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2225 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2226 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2227 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2228 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2229 if (cbPop)
2230 iemRegAddToRsp(pVCpu, cbPop);
2231 return VINF_SUCCESS;
2232 }
2233
2234 /*
2235 * Protected mode is complicated, of course.
2236 */
2237 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2238 {
2239 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2240 return iemRaiseGeneralProtectionFault0(pVCpu);
2241 }
2242
2243 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2244
2245 /* Fetch the descriptor. */
2246 IEMSELDESC DescCs;
2247 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2248 if (rcStrict != VINF_SUCCESS)
2249 return rcStrict;
2250
2251 /* Can only return to a code selector. */
2252 if ( !DescCs.Legacy.Gen.u1DescType
2253 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2254 {
2255 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2256 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2257 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2258 }
2259
2260 /* L vs D. */
2261 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2262 && DescCs.Legacy.Gen.u1DefBig
2263 && IEM_IS_LONG_MODE(pVCpu))
2264 {
2265 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2266 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2267 }
2268
2269 /* DPL/RPL/CPL checks. */
2270 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2271 {
2272 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2273 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2274 }
2275
2276 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2277 {
2278 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2279 {
2280 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2281 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2282 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2283 }
2284 }
2285 else
2286 {
2287 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2288 {
2289 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2290 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2291 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2292 }
2293 }
2294
2295 /* Is it there? */
2296 if (!DescCs.Legacy.Gen.u1Present)
2297 {
2298 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2299 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2300 }
2301
2302 /*
2303 * Return to outer privilege? (We'll typically have entered via a call gate.)
2304 */
2305 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2306 {
2307 /* Read the outer stack pointer stored *after* the parameters. */
2308 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2309 if (rcStrict != VINF_SUCCESS)
2310 return rcStrict;
2311
2312 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2313
2314 uint16_t uNewOuterSs;
2315 uint64_t uNewOuterRsp;
2316 if (enmEffOpSize == IEMMODE_16BIT)
2317 {
2318 uNewOuterRsp = uPtrFrame.pu16[0];
2319 uNewOuterSs = uPtrFrame.pu16[1];
2320 }
2321 else if (enmEffOpSize == IEMMODE_32BIT)
2322 {
2323 uNewOuterRsp = uPtrFrame.pu32[0];
2324 uNewOuterSs = uPtrFrame.pu16[2];
2325 }
2326 else
2327 {
2328 uNewOuterRsp = uPtrFrame.pu64[0];
2329 uNewOuterSs = uPtrFrame.pu16[4];
2330 }
2331 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2332 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2333 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2334 { /* extremely likely */ }
2335 else
2336 return rcStrict;
2337
2338 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2339 and read the selector. */
2340 IEMSELDESC DescSs;
2341 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2342 {
2343 if ( !DescCs.Legacy.Gen.u1Long
2344 || (uNewOuterSs & X86_SEL_RPL) == 3)
2345 {
2346 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2347 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2348 return iemRaiseGeneralProtectionFault0(pVCpu);
2349 }
2350 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2351 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2352 }
2353 else
2354 {
2355 /* Fetch the descriptor for the new stack segment. */
2356 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2357 if (rcStrict != VINF_SUCCESS)
2358 return rcStrict;
2359 }
2360
2361 /* Check that RPL of stack and code selectors match. */
2362 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2363 {
2364 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2365 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2366 }
2367
2368 /* Must be a writable data segment. */
2369 if ( !DescSs.Legacy.Gen.u1DescType
2370 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2371 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2372 {
2373 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2374 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2375 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2376 }
2377
2378 /* L vs D. (Not mentioned by intel.) */
2379 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2380 && DescSs.Legacy.Gen.u1DefBig
2381 && IEM_IS_LONG_MODE(pVCpu))
2382 {
2383 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2384 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2385 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2386 }
2387
2388 /* DPL/RPL/CPL checks. */
2389 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2390 {
2391 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2392 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2393 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2394 }
2395
2396 /* Is it there? */
2397 if (!DescSs.Legacy.Gen.u1Present)
2398 {
2399 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2400 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2401 }
2402
2403 /* Calc SS limit.*/
2404 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2405
2406 /* Is RIP canonical or within CS.limit? */
2407 uint64_t u64Base;
2408 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2409
2410 /** @todo Testcase: Is this correct? */
2411 if ( DescCs.Legacy.Gen.u1Long
2412 && IEM_IS_LONG_MODE(pVCpu) )
2413 {
2414 if (!IEM_IS_CANONICAL(uNewRip))
2415 {
2416 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2417 return iemRaiseNotCanonical(pVCpu);
2418 }
2419 u64Base = 0;
2420 }
2421 else
2422 {
2423 if (uNewRip > cbLimitCs)
2424 {
2425 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2426 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2427 /** @todo Intel says this is \#GP(0)! */
2428 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2429 }
2430 u64Base = X86DESC_BASE(&DescCs.Legacy);
2431 }
2432
2433 /*
2434 * Now set the accessed bit before
2435 * writing the return address to the stack and committing the result into
2436 * CS, CSHID and RIP.
2437 */
2438 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2439 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2440 {
2441 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2442 if (rcStrict != VINF_SUCCESS)
2443 return rcStrict;
2444 /** @todo check what VT-x and AMD-V does. */
2445 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2446 }
2447 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2448 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2449 {
2450 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2451 if (rcStrict != VINF_SUCCESS)
2452 return rcStrict;
2453 /** @todo check what VT-x and AMD-V does. */
2454 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2455 }
2456
2457 /* commit */
2458 if (enmEffOpSize == IEMMODE_16BIT)
2459 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2460 else
2461 pVCpu->cpum.GstCtx.rip = uNewRip;
2462 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2463 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2464 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2465 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2466 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2467 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2468 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2469 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2470 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2471 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2472 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2473 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2474 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2475 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2476 else
2477 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2478 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2479 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewOuterRsp;
2480 else
2481 pVCpu->cpum.GstCtx.rsp = uNewOuterRsp;
2482
2483 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2484 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2485 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2486 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2487 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2488
2489 /** @todo check if the hidden bits are loaded correctly for 64-bit
2490 * mode. */
2491
2492 if (cbPop)
2493 iemRegAddToRsp(pVCpu, cbPop);
2494 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2495
2496 /* Done! */
2497 }
2498 /*
2499 * Return to the same privilege level
2500 */
2501 else
2502 {
2503 /* Limit / canonical check. */
2504 uint64_t u64Base;
2505 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2506
2507 /** @todo Testcase: Is this correct? */
2508 if ( DescCs.Legacy.Gen.u1Long
2509 && IEM_IS_LONG_MODE(pVCpu) )
2510 {
2511 if (!IEM_IS_CANONICAL(uNewRip))
2512 {
2513 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2514 return iemRaiseNotCanonical(pVCpu);
2515 }
2516 u64Base = 0;
2517 }
2518 else
2519 {
2520 if (uNewRip > cbLimitCs)
2521 {
2522 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2523 /** @todo Intel says this is \#GP(0)! */
2524 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2525 }
2526 u64Base = X86DESC_BASE(&DescCs.Legacy);
2527 }
2528
2529 /*
2530 * Now set the accessed bit before
2531 * writing the return address to the stack and committing the result into
2532 * CS, CSHID and RIP.
2533 */
2534 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2535 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2536 {
2537 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2538 if (rcStrict != VINF_SUCCESS)
2539 return rcStrict;
2540 /** @todo check what VT-x and AMD-V does. */
2541 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2542 }
2543
2544 /* commit */
2545 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2546 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
2547 else
2548 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2549 if (enmEffOpSize == IEMMODE_16BIT)
2550 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2551 else
2552 pVCpu->cpum.GstCtx.rip = uNewRip;
2553 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2554 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2555 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2556 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2557 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2558 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2559 /** @todo check if the hidden bits are loaded correctly for 64-bit
2560 * mode. */
2561 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2562 if (cbPop)
2563 iemRegAddToRsp(pVCpu, cbPop);
2564 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2565 }
2566
2567 /* Flush the prefetch buffer. */
2568#ifdef IEM_WITH_CODE_TLB
2569 pVCpu->iem.s.pbInstrBuf = NULL;
2570#else
2571 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2572#endif
2573 return VINF_SUCCESS;
2574}
2575
2576
2577/**
2578 * Implements retn.
2579 *
2580 * We're doing this in C because of the \#GP that might be raised if the popped
2581 * program counter is out of bounds.
2582 *
2583 * @param enmEffOpSize The effective operand size.
2584 * @param cbPop The amount of arguments to pop from the stack
2585 * (bytes).
2586 */
2587IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2588{
2589 NOREF(cbInstr);
2590
2591 /* Fetch the RSP from the stack. */
2592 VBOXSTRICTRC rcStrict;
2593 RTUINT64U NewRip;
2594 RTUINT64U NewRsp;
2595 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2596
2597 switch (enmEffOpSize)
2598 {
2599 case IEMMODE_16BIT:
2600 NewRip.u = 0;
2601 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2602 break;
2603 case IEMMODE_32BIT:
2604 NewRip.u = 0;
2605 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2606 break;
2607 case IEMMODE_64BIT:
2608 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2609 break;
2610 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2611 }
2612 if (rcStrict != VINF_SUCCESS)
2613 return rcStrict;
2614
2615 /* Check the new RSP before loading it. */
2616 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2617 * of it. The canonical test is performed here and for call. */
2618 if (enmEffOpSize != IEMMODE_64BIT)
2619 {
2620 if (NewRip.DWords.dw0 > pVCpu->cpum.GstCtx.cs.u32Limit)
2621 {
2622 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2623 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2624 }
2625 }
2626 else
2627 {
2628 if (!IEM_IS_CANONICAL(NewRip.u))
2629 {
2630 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2631 return iemRaiseNotCanonical(pVCpu);
2632 }
2633 }
2634
2635 /* Apply cbPop */
2636 if (cbPop)
2637 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2638
2639 /* Commit it. */
2640 pVCpu->cpum.GstCtx.rip = NewRip.u;
2641 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2642 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2643
2644 /* Flush the prefetch buffer. */
2645#ifndef IEM_WITH_CODE_TLB
2646 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2647#endif
2648
2649 return VINF_SUCCESS;
2650}
2651
2652
2653/**
2654 * Implements enter.
2655 *
2656 * We're doing this in C because the instruction is insane, even for the
2657 * u8NestingLevel=0 case dealing with the stack is tedious.
2658 *
2659 * @param enmEffOpSize The effective operand size.
2660 * @param cbFrame Frame size.
2661 * @param cParameters Frame parameter count.
2662 */
2663IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2664{
2665 /* Push RBP, saving the old value in TmpRbp. */
2666 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2667 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2668 RTUINT64U NewRbp;
2669 VBOXSTRICTRC rcStrict;
2670 if (enmEffOpSize == IEMMODE_64BIT)
2671 {
2672 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2673 NewRbp = NewRsp;
2674 }
2675 else if (enmEffOpSize == IEMMODE_32BIT)
2676 {
2677 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2678 NewRbp = NewRsp;
2679 }
2680 else
2681 {
2682 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2683 NewRbp = TmpRbp;
2684 NewRbp.Words.w0 = NewRsp.Words.w0;
2685 }
2686 if (rcStrict != VINF_SUCCESS)
2687 return rcStrict;
2688
2689 /* Copy the parameters (aka nesting levels by Intel). */
2690 cParameters &= 0x1f;
2691 if (cParameters > 0)
2692 {
2693 switch (enmEffOpSize)
2694 {
2695 case IEMMODE_16BIT:
2696 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2697 TmpRbp.DWords.dw0 -= 2;
2698 else
2699 TmpRbp.Words.w0 -= 2;
2700 do
2701 {
2702 uint16_t u16Tmp;
2703 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2704 if (rcStrict != VINF_SUCCESS)
2705 break;
2706 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2707 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2708 break;
2709
2710 case IEMMODE_32BIT:
2711 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2712 TmpRbp.DWords.dw0 -= 4;
2713 else
2714 TmpRbp.Words.w0 -= 4;
2715 do
2716 {
2717 uint32_t u32Tmp;
2718 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2719 if (rcStrict != VINF_SUCCESS)
2720 break;
2721 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2722 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2723 break;
2724
2725 case IEMMODE_64BIT:
2726 TmpRbp.u -= 8;
2727 do
2728 {
2729 uint64_t u64Tmp;
2730 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2731 if (rcStrict != VINF_SUCCESS)
2732 break;
2733 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2734 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2735 break;
2736
2737 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2738 }
2739 if (rcStrict != VINF_SUCCESS)
2740 return VINF_SUCCESS;
2741
2742 /* Push the new RBP */
2743 if (enmEffOpSize == IEMMODE_64BIT)
2744 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2745 else if (enmEffOpSize == IEMMODE_32BIT)
2746 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2747 else
2748 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2749 if (rcStrict != VINF_SUCCESS)
2750 return rcStrict;
2751
2752 }
2753
2754 /* Recalc RSP. */
2755 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2756
2757 /** @todo Should probe write access at the new RSP according to AMD. */
2758 /** @todo Should handle accesses to the VMX APIC-access page. */
2759
2760 /* Commit it. */
2761 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2762 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2763 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2764
2765 return VINF_SUCCESS;
2766}
2767
2768
2769
2770/**
2771 * Implements leave.
2772 *
2773 * We're doing this in C because messing with the stack registers is annoying
2774 * since they depends on SS attributes.
2775 *
2776 * @param enmEffOpSize The effective operand size.
2777 */
2778IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2779{
2780 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2781 RTUINT64U NewRsp;
2782 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2783 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2784 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2785 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2786 else
2787 {
2788 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2789 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2790 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2791 }
2792
2793 /* Pop RBP according to the operand size. */
2794 VBOXSTRICTRC rcStrict;
2795 RTUINT64U NewRbp;
2796 switch (enmEffOpSize)
2797 {
2798 case IEMMODE_16BIT:
2799 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2800 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2801 break;
2802 case IEMMODE_32BIT:
2803 NewRbp.u = 0;
2804 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2805 break;
2806 case IEMMODE_64BIT:
2807 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2808 break;
2809 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2810 }
2811 if (rcStrict != VINF_SUCCESS)
2812 return rcStrict;
2813
2814
2815 /* Commit it. */
2816 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2817 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2818 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2819
2820 return VINF_SUCCESS;
2821}
2822
2823
2824/**
2825 * Implements int3 and int XX.
2826 *
2827 * @param u8Int The interrupt vector number.
2828 * @param enmInt The int instruction type.
2829 */
2830IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2831{
2832 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2833
2834 /*
2835 * We must check if this INT3 might belong to DBGF before raising a #BP.
2836 */
2837 if (u8Int == 3)
2838 {
2839 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2840 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2841 { /* likely: No vbox debugger breakpoints */ }
2842 else
2843 {
2844 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(&pVCpu->cpum.GstCtx));
2845 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2846 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2847 return iemSetPassUpStatus(pVCpu, rcStrict);
2848 }
2849 }
2850 return iemRaiseXcptOrInt(pVCpu,
2851 cbInstr,
2852 u8Int,
2853 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2854 0,
2855 0);
2856}
2857
2858
2859/**
2860 * Implements iret for real mode and V8086 mode.
2861 *
2862 * @param enmEffOpSize The effective operand size.
2863 */
2864IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2865{
2866 X86EFLAGS Efl;
2867 Efl.u = IEMMISC_GET_EFL(pVCpu);
2868 NOREF(cbInstr);
2869
2870 /*
2871 * iret throws an exception if VME isn't enabled.
2872 */
2873 if ( Efl.Bits.u1VM
2874 && Efl.Bits.u2IOPL != 3
2875 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2876 return iemRaiseGeneralProtectionFault0(pVCpu);
2877
2878 /*
2879 * Do the stack bits, but don't commit RSP before everything checks
2880 * out right.
2881 */
2882 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2883 VBOXSTRICTRC rcStrict;
2884 RTCPTRUNION uFrame;
2885 uint16_t uNewCs;
2886 uint32_t uNewEip;
2887 uint32_t uNewFlags;
2888 uint64_t uNewRsp;
2889 if (enmEffOpSize == IEMMODE_32BIT)
2890 {
2891 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2892 if (rcStrict != VINF_SUCCESS)
2893 return rcStrict;
2894 uNewEip = uFrame.pu32[0];
2895 if (uNewEip > UINT16_MAX)
2896 return iemRaiseGeneralProtectionFault0(pVCpu);
2897
2898 uNewCs = (uint16_t)uFrame.pu32[1];
2899 uNewFlags = uFrame.pu32[2];
2900 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2901 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2902 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2903 | X86_EFL_ID;
2904 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2905 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2906 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2907 }
2908 else
2909 {
2910 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2911 if (rcStrict != VINF_SUCCESS)
2912 return rcStrict;
2913 uNewEip = uFrame.pu16[0];
2914 uNewCs = uFrame.pu16[1];
2915 uNewFlags = uFrame.pu16[2];
2916 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2917 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2918 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2919 /** @todo The intel pseudo code does not indicate what happens to
2920 * reserved flags. We just ignore them. */
2921 /* Ancient CPU adjustments: See iemCImpl_popf. */
2922 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2923 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2924 }
2925 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2926 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2927 { /* extremely likely */ }
2928 else
2929 return rcStrict;
2930
2931 /** @todo Check how this is supposed to work if sp=0xfffe. */
2932 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2933 uNewCs, uNewEip, uNewFlags, uNewRsp));
2934
2935 /*
2936 * Check the limit of the new EIP.
2937 */
2938 /** @todo Only the AMD pseudo code check the limit here, what's
2939 * right? */
2940 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2941 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2942
2943 /*
2944 * V8086 checks and flag adjustments
2945 */
2946 if (Efl.Bits.u1VM)
2947 {
2948 if (Efl.Bits.u2IOPL == 3)
2949 {
2950 /* Preserve IOPL and clear RF. */
2951 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2952 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2953 }
2954 else if ( enmEffOpSize == IEMMODE_16BIT
2955 && ( !(uNewFlags & X86_EFL_IF)
2956 || !Efl.Bits.u1VIP )
2957 && !(uNewFlags & X86_EFL_TF) )
2958 {
2959 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2960 uNewFlags &= ~X86_EFL_VIF;
2961 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2962 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2963 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2964 }
2965 else
2966 return iemRaiseGeneralProtectionFault0(pVCpu);
2967 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2968 }
2969
2970 /*
2971 * Commit the operation.
2972 */
2973#ifdef DBGFTRACE_ENABLED
2974 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2975 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2976#endif
2977 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2978 pVCpu->cpum.GstCtx.rip = uNewEip;
2979 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2980 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2981 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2982 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2983 /** @todo do we load attribs and limit as well? */
2984 Assert(uNewFlags & X86_EFL_1);
2985 IEMMISC_SET_EFL(pVCpu, uNewFlags);
2986
2987 /* Flush the prefetch buffer. */
2988#ifdef IEM_WITH_CODE_TLB
2989 pVCpu->iem.s.pbInstrBuf = NULL;
2990#else
2991 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2992#endif
2993
2994 return VINF_SUCCESS;
2995}
2996
2997
2998/**
2999 * Loads a segment register when entering V8086 mode.
3000 *
3001 * @param pSReg The segment register.
3002 * @param uSeg The segment to load.
3003 */
3004static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3005{
3006 pSReg->Sel = uSeg;
3007 pSReg->ValidSel = uSeg;
3008 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3009 pSReg->u64Base = (uint32_t)uSeg << 4;
3010 pSReg->u32Limit = 0xffff;
3011 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3012 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3013 * IRET'ing to V8086. */
3014}
3015
3016
3017/**
3018 * Implements iret for protected mode returning to V8086 mode.
3019 *
3020 * @param uNewEip The new EIP.
3021 * @param uNewCs The new CS.
3022 * @param uNewFlags The new EFLAGS.
3023 * @param uNewRsp The RSP after the initial IRET frame.
3024 *
3025 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3026 */
3027IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3028{
3029 RT_NOREF_PV(cbInstr);
3030 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3031
3032 /*
3033 * Pop the V8086 specific frame bits off the stack.
3034 */
3035 VBOXSTRICTRC rcStrict;
3036 RTCPTRUNION uFrame;
3037 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3038 if (rcStrict != VINF_SUCCESS)
3039 return rcStrict;
3040 uint32_t uNewEsp = uFrame.pu32[0];
3041 uint16_t uNewSs = uFrame.pu32[1];
3042 uint16_t uNewEs = uFrame.pu32[2];
3043 uint16_t uNewDs = uFrame.pu32[3];
3044 uint16_t uNewFs = uFrame.pu32[4];
3045 uint16_t uNewGs = uFrame.pu32[5];
3046 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3047 if (rcStrict != VINF_SUCCESS)
3048 return rcStrict;
3049
3050 /*
3051 * Commit the operation.
3052 */
3053 uNewFlags &= X86_EFL_LIVE_MASK;
3054 uNewFlags |= X86_EFL_RA1_MASK;
3055#ifdef DBGFTRACE_ENABLED
3056 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3057 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3058#endif
3059 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3060
3061 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3062 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3063 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3064 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3065 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3066 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3067 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3068 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3069 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3070 pVCpu->iem.s.uCpl = 3;
3071
3072 /* Flush the prefetch buffer. */
3073#ifdef IEM_WITH_CODE_TLB
3074 pVCpu->iem.s.pbInstrBuf = NULL;
3075#else
3076 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3077#endif
3078
3079 return VINF_SUCCESS;
3080}
3081
3082
3083/**
3084 * Implements iret for protected mode returning via a nested task.
3085 *
3086 * @param enmEffOpSize The effective operand size.
3087 */
3088IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3089{
3090 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3091#ifndef IEM_IMPLEMENTS_TASKSWITCH
3092 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3093#else
3094 RT_NOREF_PV(enmEffOpSize);
3095
3096 /*
3097 * Read the segment selector in the link-field of the current TSS.
3098 */
3099 RTSEL uSelRet;
3100 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3101 if (rcStrict != VINF_SUCCESS)
3102 return rcStrict;
3103
3104 /*
3105 * Fetch the returning task's TSS descriptor from the GDT.
3106 */
3107 if (uSelRet & X86_SEL_LDT)
3108 {
3109 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3110 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3111 }
3112
3113 IEMSELDESC TssDesc;
3114 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3115 if (rcStrict != VINF_SUCCESS)
3116 return rcStrict;
3117
3118 if (TssDesc.Legacy.Gate.u1DescType)
3119 {
3120 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3121 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3122 }
3123
3124 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3125 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3126 {
3127 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3128 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3129 }
3130
3131 if (!TssDesc.Legacy.Gate.u1Present)
3132 {
3133 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3134 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3135 }
3136
3137 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3138 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3139 0 /* uCr2 */, uSelRet, &TssDesc);
3140#endif
3141}
3142
3143
3144/**
3145 * Implements iret for protected mode
3146 *
3147 * @param enmEffOpSize The effective operand size.
3148 */
3149IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3150{
3151 NOREF(cbInstr);
3152 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3153
3154 /*
3155 * Nested task return.
3156 */
3157 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3158 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3159
3160 /*
3161 * Normal return.
3162 *
3163 * Do the stack bits, but don't commit RSP before everything checks
3164 * out right.
3165 */
3166 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3167 VBOXSTRICTRC rcStrict;
3168 RTCPTRUNION uFrame;
3169 uint16_t uNewCs;
3170 uint32_t uNewEip;
3171 uint32_t uNewFlags;
3172 uint64_t uNewRsp;
3173 if (enmEffOpSize == IEMMODE_32BIT)
3174 {
3175 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3176 if (rcStrict != VINF_SUCCESS)
3177 return rcStrict;
3178 uNewEip = uFrame.pu32[0];
3179 uNewCs = (uint16_t)uFrame.pu32[1];
3180 uNewFlags = uFrame.pu32[2];
3181 }
3182 else
3183 {
3184 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3185 if (rcStrict != VINF_SUCCESS)
3186 return rcStrict;
3187 uNewEip = uFrame.pu16[0];
3188 uNewCs = uFrame.pu16[1];
3189 uNewFlags = uFrame.pu16[2];
3190 }
3191 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3192 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3193 { /* extremely likely */ }
3194 else
3195 return rcStrict;
3196 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3197
3198 /*
3199 * We're hopefully not returning to V8086 mode...
3200 */
3201 if ( (uNewFlags & X86_EFL_VM)
3202 && pVCpu->iem.s.uCpl == 0)
3203 {
3204 Assert(enmEffOpSize == IEMMODE_32BIT);
3205 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3206 }
3207
3208 /*
3209 * Protected mode.
3210 */
3211 /* Read the CS descriptor. */
3212 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3213 {
3214 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3215 return iemRaiseGeneralProtectionFault0(pVCpu);
3216 }
3217
3218 IEMSELDESC DescCS;
3219 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3220 if (rcStrict != VINF_SUCCESS)
3221 {
3222 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3223 return rcStrict;
3224 }
3225
3226 /* Must be a code descriptor. */
3227 if (!DescCS.Legacy.Gen.u1DescType)
3228 {
3229 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3230 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3231 }
3232 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3233 {
3234 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3235 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3236 }
3237
3238 /* Privilege checks. */
3239 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3240 {
3241 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3242 {
3243 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3244 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3245 }
3246 }
3247 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3248 {
3249 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3250 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3251 }
3252 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3253 {
3254 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3255 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3256 }
3257
3258 /* Present? */
3259 if (!DescCS.Legacy.Gen.u1Present)
3260 {
3261 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3262 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3263 }
3264
3265 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3266
3267 /*
3268 * Return to outer level?
3269 */
3270 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3271 {
3272 uint16_t uNewSS;
3273 uint32_t uNewESP;
3274 if (enmEffOpSize == IEMMODE_32BIT)
3275 {
3276 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3277 if (rcStrict != VINF_SUCCESS)
3278 return rcStrict;
3279/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3280 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3281 * bit of the popped SS selector it turns out. */
3282 uNewESP = uFrame.pu32[0];
3283 uNewSS = (uint16_t)uFrame.pu32[1];
3284 }
3285 else
3286 {
3287 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3288 if (rcStrict != VINF_SUCCESS)
3289 return rcStrict;
3290 uNewESP = uFrame.pu16[0];
3291 uNewSS = uFrame.pu16[1];
3292 }
3293 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3294 if (rcStrict != VINF_SUCCESS)
3295 return rcStrict;
3296 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3297
3298 /* Read the SS descriptor. */
3299 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3300 {
3301 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3302 return iemRaiseGeneralProtectionFault0(pVCpu);
3303 }
3304
3305 IEMSELDESC DescSS;
3306 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3307 if (rcStrict != VINF_SUCCESS)
3308 {
3309 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3310 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3311 return rcStrict;
3312 }
3313
3314 /* Privilege checks. */
3315 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3316 {
3317 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3318 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3319 }
3320 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3321 {
3322 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3323 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3324 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3325 }
3326
3327 /* Must be a writeable data segment descriptor. */
3328 if (!DescSS.Legacy.Gen.u1DescType)
3329 {
3330 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3331 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3332 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3333 }
3334 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3335 {
3336 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3337 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3338 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3339 }
3340
3341 /* Present? */
3342 if (!DescSS.Legacy.Gen.u1Present)
3343 {
3344 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3345 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3346 }
3347
3348 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3349
3350 /* Check EIP. */
3351 if (uNewEip > cbLimitCS)
3352 {
3353 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3354 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3355 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3356 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3357 }
3358
3359 /*
3360 * Commit the changes, marking CS and SS accessed first since
3361 * that may fail.
3362 */
3363 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3364 {
3365 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3366 if (rcStrict != VINF_SUCCESS)
3367 return rcStrict;
3368 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3369 }
3370 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3371 {
3372 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3373 if (rcStrict != VINF_SUCCESS)
3374 return rcStrict;
3375 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3376 }
3377
3378 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3379 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3380 if (enmEffOpSize != IEMMODE_16BIT)
3381 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3382 if (pVCpu->iem.s.uCpl == 0)
3383 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3384 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3385 fEFlagsMask |= X86_EFL_IF;
3386 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3387 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3388 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3389 fEFlagsNew &= ~fEFlagsMask;
3390 fEFlagsNew |= uNewFlags & fEFlagsMask;
3391#ifdef DBGFTRACE_ENABLED
3392 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3393 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3394 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3395#endif
3396
3397 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3398 pVCpu->cpum.GstCtx.rip = uNewEip;
3399 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3400 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3401 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3402 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3403 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3404 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3405 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3406
3407 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3408 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3409 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3410 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3411 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3412 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3413 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3414 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3415 else
3416 pVCpu->cpum.GstCtx.rsp = uNewESP;
3417
3418 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3419 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3420 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3421 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3422 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3423
3424 /* Done! */
3425
3426 }
3427 /*
3428 * Return to the same level.
3429 */
3430 else
3431 {
3432 /* Check EIP. */
3433 if (uNewEip > cbLimitCS)
3434 {
3435 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3436 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3437 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3438 }
3439
3440 /*
3441 * Commit the changes, marking CS first since it may fail.
3442 */
3443 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3444 {
3445 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3446 if (rcStrict != VINF_SUCCESS)
3447 return rcStrict;
3448 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3449 }
3450
3451 X86EFLAGS NewEfl;
3452 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3453 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3454 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3455 if (enmEffOpSize != IEMMODE_16BIT)
3456 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3457 if (pVCpu->iem.s.uCpl == 0)
3458 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3459 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3460 fEFlagsMask |= X86_EFL_IF;
3461 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3462 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3463 NewEfl.u &= ~fEFlagsMask;
3464 NewEfl.u |= fEFlagsMask & uNewFlags;
3465#ifdef DBGFTRACE_ENABLED
3466 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3467 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3468 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3469#endif
3470
3471 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3472 pVCpu->cpum.GstCtx.rip = uNewEip;
3473 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3474 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3475 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3476 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3477 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3478 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3479 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3480 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3481 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3482 else
3483 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3484 /* Done! */
3485 }
3486
3487 /* Flush the prefetch buffer. */
3488#ifdef IEM_WITH_CODE_TLB
3489 pVCpu->iem.s.pbInstrBuf = NULL;
3490#else
3491 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3492#endif
3493
3494 return VINF_SUCCESS;
3495}
3496
3497
3498/**
3499 * Implements iret for long mode
3500 *
3501 * @param enmEffOpSize The effective operand size.
3502 */
3503IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3504{
3505 NOREF(cbInstr);
3506
3507 /*
3508 * Nested task return is not supported in long mode.
3509 */
3510 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3511 {
3512 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3513 return iemRaiseGeneralProtectionFault0(pVCpu);
3514 }
3515
3516 /*
3517 * Normal return.
3518 *
3519 * Do the stack bits, but don't commit RSP before everything checks
3520 * out right.
3521 */
3522 VBOXSTRICTRC rcStrict;
3523 RTCPTRUNION uFrame;
3524 uint64_t uNewRip;
3525 uint16_t uNewCs;
3526 uint16_t uNewSs;
3527 uint32_t uNewFlags;
3528 uint64_t uNewRsp;
3529 if (enmEffOpSize == IEMMODE_64BIT)
3530 {
3531 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3532 if (rcStrict != VINF_SUCCESS)
3533 return rcStrict;
3534 uNewRip = uFrame.pu64[0];
3535 uNewCs = (uint16_t)uFrame.pu64[1];
3536 uNewFlags = (uint32_t)uFrame.pu64[2];
3537 uNewRsp = uFrame.pu64[3];
3538 uNewSs = (uint16_t)uFrame.pu64[4];
3539 }
3540 else if (enmEffOpSize == IEMMODE_32BIT)
3541 {
3542 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3543 if (rcStrict != VINF_SUCCESS)
3544 return rcStrict;
3545 uNewRip = uFrame.pu32[0];
3546 uNewCs = (uint16_t)uFrame.pu32[1];
3547 uNewFlags = uFrame.pu32[2];
3548 uNewRsp = uFrame.pu32[3];
3549 uNewSs = (uint16_t)uFrame.pu32[4];
3550 }
3551 else
3552 {
3553 Assert(enmEffOpSize == IEMMODE_16BIT);
3554 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3555 if (rcStrict != VINF_SUCCESS)
3556 return rcStrict;
3557 uNewRip = uFrame.pu16[0];
3558 uNewCs = uFrame.pu16[1];
3559 uNewFlags = uFrame.pu16[2];
3560 uNewRsp = uFrame.pu16[3];
3561 uNewSs = uFrame.pu16[4];
3562 }
3563 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3564 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3565 { /* extremely like */ }
3566 else
3567 return rcStrict;
3568 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3569
3570 /*
3571 * Check stuff.
3572 */
3573 /* Read the CS descriptor. */
3574 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3575 {
3576 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3577 return iemRaiseGeneralProtectionFault0(pVCpu);
3578 }
3579
3580 IEMSELDESC DescCS;
3581 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3582 if (rcStrict != VINF_SUCCESS)
3583 {
3584 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3585 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3586 return rcStrict;
3587 }
3588
3589 /* Must be a code descriptor. */
3590 if ( !DescCS.Legacy.Gen.u1DescType
3591 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3592 {
3593 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3594 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3595 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3596 }
3597
3598 /* Privilege checks. */
3599 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3600 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3601 {
3602 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3603 {
3604 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3605 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3606 }
3607 }
3608 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3609 {
3610 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3611 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3612 }
3613 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3614 {
3615 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3616 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3617 }
3618
3619 /* Present? */
3620 if (!DescCS.Legacy.Gen.u1Present)
3621 {
3622 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3623 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3624 }
3625
3626 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3627
3628 /* Read the SS descriptor. */
3629 IEMSELDESC DescSS;
3630 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3631 {
3632 if ( !DescCS.Legacy.Gen.u1Long
3633 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3634 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3635 {
3636 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3637 return iemRaiseGeneralProtectionFault0(pVCpu);
3638 }
3639 DescSS.Legacy.u = 0;
3640 }
3641 else
3642 {
3643 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3644 if (rcStrict != VINF_SUCCESS)
3645 {
3646 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3647 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3648 return rcStrict;
3649 }
3650 }
3651
3652 /* Privilege checks. */
3653 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3654 {
3655 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3656 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3657 }
3658
3659 uint32_t cbLimitSs;
3660 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3661 cbLimitSs = UINT32_MAX;
3662 else
3663 {
3664 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3665 {
3666 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3667 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3668 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3669 }
3670
3671 /* Must be a writeable data segment descriptor. */
3672 if (!DescSS.Legacy.Gen.u1DescType)
3673 {
3674 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3675 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3676 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3677 }
3678 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3679 {
3680 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3681 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3682 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3683 }
3684
3685 /* Present? */
3686 if (!DescSS.Legacy.Gen.u1Present)
3687 {
3688 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3689 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3690 }
3691 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3692 }
3693
3694 /* Check EIP. */
3695 if (DescCS.Legacy.Gen.u1Long)
3696 {
3697 if (!IEM_IS_CANONICAL(uNewRip))
3698 {
3699 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3700 uNewCs, uNewRip, uNewSs, uNewRsp));
3701 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3702 }
3703 }
3704 else
3705 {
3706 if (uNewRip > cbLimitCS)
3707 {
3708 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3709 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3710 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3711 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3712 }
3713 }
3714
3715 /*
3716 * Commit the changes, marking CS and SS accessed first since
3717 * that may fail.
3718 */
3719 /** @todo where exactly are these actually marked accessed by a real CPU? */
3720 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3721 {
3722 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3723 if (rcStrict != VINF_SUCCESS)
3724 return rcStrict;
3725 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3726 }
3727 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3728 {
3729 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3730 if (rcStrict != VINF_SUCCESS)
3731 return rcStrict;
3732 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3733 }
3734
3735 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3736 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3737 if (enmEffOpSize != IEMMODE_16BIT)
3738 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3739 if (pVCpu->iem.s.uCpl == 0)
3740 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3741 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3742 fEFlagsMask |= X86_EFL_IF;
3743 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3744 fEFlagsNew &= ~fEFlagsMask;
3745 fEFlagsNew |= uNewFlags & fEFlagsMask;
3746#ifdef DBGFTRACE_ENABLED
3747 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3748 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3749#endif
3750
3751 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3752 pVCpu->cpum.GstCtx.rip = uNewRip;
3753 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3754 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3755 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3756 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3757 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3758 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3759 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3760 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3761 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3762 else
3763 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3764 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3765 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3766 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3767 {
3768 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3769 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3770 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3771 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3772 Log2(("iretq new SS: NULL\n"));
3773 }
3774 else
3775 {
3776 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3777 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3778 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3779 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3780 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3781 }
3782
3783 if (pVCpu->iem.s.uCpl != uNewCpl)
3784 {
3785 pVCpu->iem.s.uCpl = uNewCpl;
3786 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3787 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3788 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3789 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3790 }
3791
3792 /* Flush the prefetch buffer. */
3793#ifdef IEM_WITH_CODE_TLB
3794 pVCpu->iem.s.pbInstrBuf = NULL;
3795#else
3796 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3797#endif
3798
3799 return VINF_SUCCESS;
3800}
3801
3802
3803/**
3804 * Implements iret.
3805 *
3806 * @param enmEffOpSize The effective operand size.
3807 */
3808IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3809{
3810 bool fBlockingNmi = VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
3811
3812#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3813 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3814 {
3815 /*
3816 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3817 * of this IRET instruction. We need to provide this information as part of some
3818 * VM-exits.
3819 *
3820 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3821 */
3822 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3823 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3824 else
3825 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3826
3827 /*
3828 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3829 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3830 */
3831 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3832 fBlockingNmi = false;
3833
3834 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3835 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3836 }
3837#endif
3838
3839 /*
3840 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3841 * The NMI is still held pending (which I assume means blocking of further NMIs
3842 * is in effect).
3843 *
3844 * See AMD spec. 15.9 "Instruction Intercepts".
3845 * See AMD spec. 15.21.9 "NMI Support".
3846 */
3847 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3848 {
3849 Log(("iret: Guest intercept -> #VMEXIT\n"));
3850 IEM_SVM_UPDATE_NRIP(pVCpu);
3851 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3852 }
3853
3854 /*
3855 * Clear NMI blocking, if any, before causing any further exceptions.
3856 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3857 */
3858 if (fBlockingNmi)
3859 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3860
3861 /*
3862 * Call a mode specific worker.
3863 */
3864 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3865 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3866 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3867 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3868 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3869 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3870}
3871
3872
3873static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3874{
3875 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3876
3877 pHid->Sel = uSel;
3878 pHid->ValidSel = uSel;
3879 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3880}
3881
3882
3883static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3884{
3885 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3886
3887 /* The base is in the first three bytes. */
3888 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3889 /* The attributes are in the fourth byte. */
3890 pHid->Attr.u = pbMem[3];
3891 /* The limit is in the last two bytes. */
3892 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3893}
3894
3895
3896/**
3897 * Implements 286 LOADALL (286 CPUs only).
3898 */
3899IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3900{
3901 NOREF(cbInstr);
3902
3903 /* Data is loaded from a buffer at 800h. No checks are done on the
3904 * validity of loaded state.
3905 *
3906 * LOADALL only loads the internal CPU state, it does not access any
3907 * GDT, LDT, or similar tables.
3908 */
3909
3910 if (pVCpu->iem.s.uCpl != 0)
3911 {
3912 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3913 return iemRaiseGeneralProtectionFault0(pVCpu);
3914 }
3915
3916 uint8_t const *pbMem = NULL;
3917 uint16_t const *pa16Mem;
3918 uint8_t const *pa8Mem;
3919 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3920 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R);
3921 if (rcStrict != VINF_SUCCESS)
3922 return rcStrict;
3923
3924 /* The MSW is at offset 0x06. */
3925 pa16Mem = (uint16_t const *)(pbMem + 0x06);
3926 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3927 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3928 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3929 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3930
3931 CPUMSetGuestCR0(pVCpu, uNewCr0);
3932 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3933
3934 /* Inform PGM if mode changed. */
3935 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3936 {
3937 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3938 AssertRCReturn(rc, rc);
3939 /* ignore informational status codes */
3940 }
3941 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
3942 false /* fForce */);
3943
3944 /* TR selector is at offset 0x16. */
3945 pa16Mem = (uint16_t const *)(pbMem + 0x16);
3946 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
3947 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
3948 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
3949
3950 /* Followed by FLAGS... */
3951 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
3952 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
3953
3954 /* LDT is at offset 0x1C. */
3955 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
3956 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
3957 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
3958 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3959
3960 /* Segment registers are at offset 0x1E. */
3961 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
3962 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
3963 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
3964 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
3965 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
3966
3967 /* GPRs are at offset 0x26. */
3968 pa16Mem = (uint16_t const *)(pbMem + 0x26);
3969 pVCpu->cpum.GstCtx.di = pa16Mem[0];
3970 pVCpu->cpum.GstCtx.si = pa16Mem[1];
3971 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
3972 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
3973 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
3974 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
3975 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
3976 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
3977
3978 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
3979 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
3980 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
3981 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
3982 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
3983
3984 /* GDTR contents are at offset 0x4E, 6 bytes. */
3985 RTGCPHYS GCPtrBase;
3986 uint16_t cbLimit;
3987 pa8Mem = pbMem + 0x4E;
3988 /* NB: Fourth byte "should be zero"; we are ignoring it. */
3989 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
3990 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
3991 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
3992
3993 /* IDTR contents are at offset 0x5A, 6 bytes. */
3994 pa8Mem = pbMem + 0x5A;
3995 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
3996 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
3997 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
3998
3999 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4000 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4001 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4002 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4003 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4004 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4005
4006 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4007 if (rcStrict != VINF_SUCCESS)
4008 return rcStrict;
4009
4010 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4011 * descriptor caches" but there is no word as to what happens if those are
4012 * not identical (probably bad things).
4013 */
4014 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4015
4016 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4017
4018 /* Flush the prefetch buffer. */
4019#ifdef IEM_WITH_CODE_TLB
4020 pVCpu->iem.s.pbInstrBuf = NULL;
4021#else
4022 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4023#endif
4024 return rcStrict;
4025}
4026
4027
4028/**
4029 * Implements SYSCALL (AMD and Intel64).
4030 */
4031IEM_CIMPL_DEF_0(iemCImpl_syscall)
4032{
4033 /** @todo hack, LOADALL should be decoded as such on a 286. */
4034 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4035 return iemCImpl_loadall286(pVCpu, cbInstr);
4036
4037 /*
4038 * Check preconditions.
4039 *
4040 * Note that CPUs described in the documentation may load a few odd values
4041 * into CS and SS than we allow here. This has yet to be checked on real
4042 * hardware.
4043 */
4044 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4045 {
4046 Log(("syscall: Not enabled in EFER -> #UD\n"));
4047 return iemRaiseUndefinedOpcode(pVCpu);
4048 }
4049 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4050 {
4051 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4052 return iemRaiseGeneralProtectionFault0(pVCpu);
4053 }
4054 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4055 {
4056 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4057 return iemRaiseUndefinedOpcode(pVCpu);
4058 }
4059
4060 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4061
4062 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4063 /** @todo what about LDT selectors? Shouldn't matter, really. */
4064 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4065 uint16_t uNewSs = uNewCs + 8;
4066 if (uNewCs == 0 || uNewSs == 0)
4067 {
4068 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4069 return iemRaiseGeneralProtectionFault0(pVCpu);
4070 }
4071
4072 /* Long mode and legacy mode differs. */
4073 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4074 {
4075 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4076
4077 /* This test isn't in the docs, but I'm not trusting the guys writing
4078 the MSRs to have validated the values as canonical like they should. */
4079 if (!IEM_IS_CANONICAL(uNewRip))
4080 {
4081 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4082 return iemRaiseUndefinedOpcode(pVCpu);
4083 }
4084
4085 /*
4086 * Commit it.
4087 */
4088 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4089 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4090 pVCpu->cpum.GstCtx.rip = uNewRip;
4091
4092 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4093 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4094 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4095 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4096
4097 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4098 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4099 }
4100 else
4101 {
4102 /*
4103 * Commit it.
4104 */
4105 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
4106 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4107 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4108 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4109 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4110
4111 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4112 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4113 }
4114 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4115 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4116 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4117 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4118 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4119
4120 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4121 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4122 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4123 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4124 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4125
4126 /* Flush the prefetch buffer. */
4127#ifdef IEM_WITH_CODE_TLB
4128 pVCpu->iem.s.pbInstrBuf = NULL;
4129#else
4130 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4131#endif
4132
4133 return VINF_SUCCESS;
4134}
4135
4136
4137/**
4138 * Implements SYSRET (AMD and Intel64).
4139 */
4140IEM_CIMPL_DEF_0(iemCImpl_sysret)
4141
4142{
4143 RT_NOREF_PV(cbInstr);
4144
4145 /*
4146 * Check preconditions.
4147 *
4148 * Note that CPUs described in the documentation may load a few odd values
4149 * into CS and SS than we allow here. This has yet to be checked on real
4150 * hardware.
4151 */
4152 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4153 {
4154 Log(("sysret: Not enabled in EFER -> #UD\n"));
4155 return iemRaiseUndefinedOpcode(pVCpu);
4156 }
4157 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4158 {
4159 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4160 return iemRaiseUndefinedOpcode(pVCpu);
4161 }
4162 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4163 {
4164 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4165 return iemRaiseGeneralProtectionFault0(pVCpu);
4166 }
4167 if (pVCpu->iem.s.uCpl != 0)
4168 {
4169 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4170 return iemRaiseGeneralProtectionFault0(pVCpu);
4171 }
4172
4173 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4174
4175 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4176 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4177 uint16_t uNewSs = uNewCs + 8;
4178 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4179 uNewCs += 16;
4180 if (uNewCs == 0 || uNewSs == 0)
4181 {
4182 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4183 return iemRaiseGeneralProtectionFault0(pVCpu);
4184 }
4185
4186 /*
4187 * Commit it.
4188 */
4189 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4190 {
4191 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4192 {
4193 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4194 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4195 /* Note! We disregard intel manual regarding the RCX cananonical
4196 check, ask intel+xen why AMD doesn't do it. */
4197 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4198 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4199 | (3 << X86DESCATTR_DPL_SHIFT);
4200 }
4201 else
4202 {
4203 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4204 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4205 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4206 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4207 | (3 << X86DESCATTR_DPL_SHIFT);
4208 }
4209 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4210 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4211 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4212 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4213 }
4214 else
4215 {
4216 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4217 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4218 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4219 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4220 | (3 << X86DESCATTR_DPL_SHIFT);
4221 }
4222 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4223 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4224 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4225 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4226 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4227
4228 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4229 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4230 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4231 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4232 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4233 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4234 * on sysret. */
4235
4236 /* Flush the prefetch buffer. */
4237#ifdef IEM_WITH_CODE_TLB
4238 pVCpu->iem.s.pbInstrBuf = NULL;
4239#else
4240 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4241#endif
4242
4243 return VINF_SUCCESS;
4244}
4245
4246
4247/**
4248 * Implements SYSENTER (Intel, 32-bit AMD).
4249 */
4250IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4251{
4252 RT_NOREF(cbInstr);
4253
4254 /*
4255 * Check preconditions.
4256 *
4257 * Note that CPUs described in the documentation may load a few odd values
4258 * into CS and SS than we allow here. This has yet to be checked on real
4259 * hardware.
4260 */
4261 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4262 {
4263 Log(("sysenter: not supported -=> #UD\n"));
4264 return iemRaiseUndefinedOpcode(pVCpu);
4265 }
4266 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4267 {
4268 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4269 return iemRaiseGeneralProtectionFault0(pVCpu);
4270 }
4271 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4272 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && !fIsLongMode)
4273 {
4274 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4275 return iemRaiseUndefinedOpcode(pVCpu);
4276 }
4277 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4278 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4279 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4280 {
4281 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4282 return iemRaiseGeneralProtectionFault0(pVCpu);
4283 }
4284
4285 /* This test isn't in the docs, it's just a safeguard against missing
4286 canonical checks when writing the registers. */
4287 if (RT_LIKELY( !fIsLongMode
4288 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4289 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4290 { /* likely */ }
4291 else
4292 {
4293 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4294 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4295 return iemRaiseUndefinedOpcode(pVCpu);
4296 }
4297
4298/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4299
4300 /*
4301 * Update registers and commit.
4302 */
4303 if (fIsLongMode)
4304 {
4305 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4306 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4307 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4308 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4309 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4310 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4311 }
4312 else
4313 {
4314 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, (uint32_t)pVCpu->cpum.GstCtx.rip,
4315 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4316 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4317 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4318 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4319 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4320 }
4321 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4322 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4323 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4324 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4325 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4326
4327 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4328 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4329 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4330 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4331 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4332 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4333 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4334
4335 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4336 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4337 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4338
4339 pVCpu->iem.s.uCpl = 0;
4340
4341 /* Flush the prefetch buffer. */
4342#ifdef IEM_WITH_CODE_TLB
4343 pVCpu->iem.s.pbInstrBuf = NULL;
4344#else
4345 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4346#endif
4347
4348 return VINF_SUCCESS;
4349}
4350
4351
4352/**
4353 * Implements SYSEXIT (Intel, 32-bit AMD).
4354 *
4355 * @param enmEffOpSize The effective operand size.
4356 */
4357IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4358{
4359 RT_NOREF(cbInstr);
4360
4361 /*
4362 * Check preconditions.
4363 *
4364 * Note that CPUs described in the documentation may load a few odd values
4365 * into CS and SS than we allow here. This has yet to be checked on real
4366 * hardware.
4367 */
4368 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4369 {
4370 Log(("sysexit: not supported -=> #UD\n"));
4371 return iemRaiseUndefinedOpcode(pVCpu);
4372 }
4373 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4374 {
4375 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4376 return iemRaiseGeneralProtectionFault0(pVCpu);
4377 }
4378 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4379 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && !fIsLongMode)
4380 {
4381 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4382 return iemRaiseUndefinedOpcode(pVCpu);
4383 }
4384 if (pVCpu->iem.s.uCpl != 0)
4385 {
4386 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", pVCpu->iem.s.uCpl));
4387 return iemRaiseGeneralProtectionFault0(pVCpu);
4388 }
4389 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4390 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4391 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4392 {
4393 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4394 return iemRaiseGeneralProtectionFault0(pVCpu);
4395 }
4396
4397 /*
4398 * Update registers and commit.
4399 */
4400 if (enmEffOpSize == IEMMODE_64BIT)
4401 {
4402 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4403 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4404 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4405 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4406 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4407 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4408 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4409 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4410 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4411 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4412 }
4413 else
4414 {
4415 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4416 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4417 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4418 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4419 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4420 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4421 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4422 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4423 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4424 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4425 }
4426 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4427 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4428 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4429
4430 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4431 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4432 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4433 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4434 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4435 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4436
4437 pVCpu->iem.s.uCpl = 3;
4438
4439 /* Flush the prefetch buffer. */
4440#ifdef IEM_WITH_CODE_TLB
4441 pVCpu->iem.s.pbInstrBuf = NULL;
4442#else
4443 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4444#endif
4445
4446 return VINF_SUCCESS;
4447}
4448
4449
4450/**
4451 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4452 *
4453 * @param iSegReg The segment register number (valid).
4454 * @param uSel The new selector value.
4455 */
4456IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4457{
4458 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4459 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4460 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4461
4462 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4463
4464 /*
4465 * Real mode and V8086 mode are easy.
4466 */
4467 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4468 {
4469 *pSel = uSel;
4470 pHid->u64Base = (uint32_t)uSel << 4;
4471 pHid->ValidSel = uSel;
4472 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4473#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4474 /** @todo Does the CPU actually load limits and attributes in the
4475 * real/V8086 mode segment load case? It doesn't for CS in far
4476 * jumps... Affects unreal mode. */
4477 pHid->u32Limit = 0xffff;
4478 pHid->Attr.u = 0;
4479 pHid->Attr.n.u1Present = 1;
4480 pHid->Attr.n.u1DescType = 1;
4481 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4482 ? X86_SEL_TYPE_RW
4483 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4484#endif
4485 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4486 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4487 return VINF_SUCCESS;
4488 }
4489
4490 /*
4491 * Protected mode.
4492 *
4493 * Check if it's a null segment selector value first, that's OK for DS, ES,
4494 * FS and GS. If not null, then we have to load and parse the descriptor.
4495 */
4496 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4497 {
4498 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4499 if (iSegReg == X86_SREG_SS)
4500 {
4501 /* In 64-bit kernel mode, the stack can be 0 because of the way
4502 interrupts are dispatched. AMD seems to have a slighly more
4503 relaxed relationship to SS.RPL than intel does. */
4504 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4505 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4506 || pVCpu->iem.s.uCpl > 2
4507 || ( uSel != pVCpu->iem.s.uCpl
4508 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4509 {
4510 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4511 return iemRaiseGeneralProtectionFault0(pVCpu);
4512 }
4513 }
4514
4515 *pSel = uSel; /* Not RPL, remember :-) */
4516 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4517 if (iSegReg == X86_SREG_SS)
4518 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4519
4520 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4521 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4522
4523 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4524 return VINF_SUCCESS;
4525 }
4526
4527 /* Fetch the descriptor. */
4528 IEMSELDESC Desc;
4529 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4530 if (rcStrict != VINF_SUCCESS)
4531 return rcStrict;
4532
4533 /* Check GPs first. */
4534 if (!Desc.Legacy.Gen.u1DescType)
4535 {
4536 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4537 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4538 }
4539 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4540 {
4541 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4542 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4543 {
4544 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4545 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4546 }
4547 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4548 {
4549 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4550 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4551 }
4552 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4553 {
4554 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4555 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4556 }
4557 }
4558 else
4559 {
4560 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4561 {
4562 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4563 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4564 }
4565 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4566 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4567 {
4568#if 0 /* this is what intel says. */
4569 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4570 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4571 {
4572 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4573 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4574 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4575 }
4576#else /* this is what makes more sense. */
4577 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4578 {
4579 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4580 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4581 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4582 }
4583 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4584 {
4585 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4586 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4587 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4588 }
4589#endif
4590 }
4591 }
4592
4593 /* Is it there? */
4594 if (!Desc.Legacy.Gen.u1Present)
4595 {
4596 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4597 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4598 }
4599
4600 /* The base and limit. */
4601 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4602 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4603
4604 /*
4605 * Ok, everything checked out fine. Now set the accessed bit before
4606 * committing the result into the registers.
4607 */
4608 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4609 {
4610 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4611 if (rcStrict != VINF_SUCCESS)
4612 return rcStrict;
4613 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4614 }
4615
4616 /* commit */
4617 *pSel = uSel;
4618 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4619 pHid->u32Limit = cbLimit;
4620 pHid->u64Base = u64Base;
4621 pHid->ValidSel = uSel;
4622 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4623
4624 /** @todo check if the hidden bits are loaded correctly for 64-bit
4625 * mode. */
4626 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4627
4628 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4629 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4630 return VINF_SUCCESS;
4631}
4632
4633
4634/**
4635 * Implements 'mov SReg, r/m'.
4636 *
4637 * @param iSegReg The segment register number (valid).
4638 * @param uSel The new selector value.
4639 */
4640IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4641{
4642 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4643 if (rcStrict == VINF_SUCCESS)
4644 {
4645 if (iSegReg == X86_SREG_SS)
4646 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4647 }
4648 return rcStrict;
4649}
4650
4651
4652/**
4653 * Implements 'pop SReg'.
4654 *
4655 * @param iSegReg The segment register number (valid).
4656 * @param enmEffOpSize The efficient operand size (valid).
4657 */
4658IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4659{
4660 VBOXSTRICTRC rcStrict;
4661
4662 /*
4663 * Read the selector off the stack and join paths with mov ss, reg.
4664 */
4665 RTUINT64U TmpRsp;
4666 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4667 switch (enmEffOpSize)
4668 {
4669 case IEMMODE_16BIT:
4670 {
4671 uint16_t uSel;
4672 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4673 if (rcStrict == VINF_SUCCESS)
4674 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4675 break;
4676 }
4677
4678 case IEMMODE_32BIT:
4679 {
4680 uint32_t u32Value;
4681 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4682 if (rcStrict == VINF_SUCCESS)
4683 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4684 break;
4685 }
4686
4687 case IEMMODE_64BIT:
4688 {
4689 uint64_t u64Value;
4690 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4691 if (rcStrict == VINF_SUCCESS)
4692 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4693 break;
4694 }
4695 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4696 }
4697
4698 /*
4699 * Commit the stack on success.
4700 */
4701 if (rcStrict == VINF_SUCCESS)
4702 {
4703 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4704 if (iSegReg == X86_SREG_SS)
4705 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4706 }
4707 return rcStrict;
4708}
4709
4710
4711/**
4712 * Implements lgs, lfs, les, lds & lss.
4713 */
4714IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4715 uint16_t, uSel,
4716 uint64_t, offSeg,
4717 uint8_t, iSegReg,
4718 uint8_t, iGReg,
4719 IEMMODE, enmEffOpSize)
4720{
4721 /*
4722 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4723 */
4724 /** @todo verify and test that mov, pop and lXs works the segment
4725 * register loading in the exact same way. */
4726 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4727 if (rcStrict == VINF_SUCCESS)
4728 {
4729 switch (enmEffOpSize)
4730 {
4731 case IEMMODE_16BIT:
4732 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4733 break;
4734 case IEMMODE_32BIT:
4735 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4736 break;
4737 case IEMMODE_64BIT:
4738 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4739 break;
4740 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4741 }
4742 }
4743
4744 return rcStrict;
4745}
4746
4747
4748/**
4749 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4750 *
4751 * @retval VINF_SUCCESS on success.
4752 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4753 * @retval iemMemFetchSysU64 return value.
4754 *
4755 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4756 * @param uSel The selector value.
4757 * @param fAllowSysDesc Whether system descriptors are OK or not.
4758 * @param pDesc Where to return the descriptor on success.
4759 */
4760static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4761{
4762 pDesc->Long.au64[0] = 0;
4763 pDesc->Long.au64[1] = 0;
4764
4765 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4766 return VINF_IEM_SELECTOR_NOT_OK;
4767
4768 /* Within the table limits? */
4769 RTGCPTR GCPtrBase;
4770 if (uSel & X86_SEL_LDT)
4771 {
4772 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4773 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4774 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4775 return VINF_IEM_SELECTOR_NOT_OK;
4776 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4777 }
4778 else
4779 {
4780 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4781 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4782 return VINF_IEM_SELECTOR_NOT_OK;
4783 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4784 }
4785
4786 /* Fetch the descriptor. */
4787 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4788 if (rcStrict != VINF_SUCCESS)
4789 return rcStrict;
4790 if (!pDesc->Legacy.Gen.u1DescType)
4791 {
4792 if (!fAllowSysDesc)
4793 return VINF_IEM_SELECTOR_NOT_OK;
4794 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4795 {
4796 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4797 if (rcStrict != VINF_SUCCESS)
4798 return rcStrict;
4799 }
4800
4801 }
4802
4803 return VINF_SUCCESS;
4804}
4805
4806
4807/**
4808 * Implements verr (fWrite = false) and verw (fWrite = true).
4809 */
4810IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4811{
4812 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4813
4814 /** @todo figure whether the accessed bit is set or not. */
4815
4816 bool fAccessible = true;
4817 IEMSELDESC Desc;
4818 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4819 if (rcStrict == VINF_SUCCESS)
4820 {
4821 /* Check the descriptor, order doesn't matter much here. */
4822 if ( !Desc.Legacy.Gen.u1DescType
4823 || !Desc.Legacy.Gen.u1Present)
4824 fAccessible = false;
4825 else
4826 {
4827 if ( fWrite
4828 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4829 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4830 fAccessible = false;
4831
4832 /** @todo testcase for the conforming behavior. */
4833 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4834 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4835 {
4836 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4837 fAccessible = false;
4838 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4839 fAccessible = false;
4840 }
4841 }
4842
4843 }
4844 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4845 fAccessible = false;
4846 else
4847 return rcStrict;
4848
4849 /* commit */
4850 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4851
4852 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4853 return VINF_SUCCESS;
4854}
4855
4856
4857/**
4858 * Implements LAR and LSL with 64-bit operand size.
4859 *
4860 * @returns VINF_SUCCESS.
4861 * @param pu64Dst Pointer to the destination register.
4862 * @param uSel The selector to load details for.
4863 * @param fIsLar true = LAR, false = LSL.
4864 */
4865IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4866{
4867 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4868
4869 /** @todo figure whether the accessed bit is set or not. */
4870
4871 bool fDescOk = true;
4872 IEMSELDESC Desc;
4873 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4874 if (rcStrict == VINF_SUCCESS)
4875 {
4876 /*
4877 * Check the descriptor type.
4878 */
4879 if (!Desc.Legacy.Gen.u1DescType)
4880 {
4881 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4882 {
4883 if (Desc.Long.Gen.u5Zeros)
4884 fDescOk = false;
4885 else
4886 switch (Desc.Long.Gen.u4Type)
4887 {
4888 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4889 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4890 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4891 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4892 break;
4893 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4894 fDescOk = fIsLar;
4895 break;
4896 default:
4897 fDescOk = false;
4898 break;
4899 }
4900 }
4901 else
4902 {
4903 switch (Desc.Long.Gen.u4Type)
4904 {
4905 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4906 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4907 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4908 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4909 case X86_SEL_TYPE_SYS_LDT:
4910 break;
4911 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4912 case X86_SEL_TYPE_SYS_TASK_GATE:
4913 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4914 fDescOk = fIsLar;
4915 break;
4916 default:
4917 fDescOk = false;
4918 break;
4919 }
4920 }
4921 }
4922 if (fDescOk)
4923 {
4924 /*
4925 * Check the RPL/DPL/CPL interaction..
4926 */
4927 /** @todo testcase for the conforming behavior. */
4928 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4929 || !Desc.Legacy.Gen.u1DescType)
4930 {
4931 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4932 fDescOk = false;
4933 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4934 fDescOk = false;
4935 }
4936 }
4937
4938 if (fDescOk)
4939 {
4940 /*
4941 * All fine, start committing the result.
4942 */
4943 if (fIsLar)
4944 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4945 else
4946 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4947 }
4948
4949 }
4950 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4951 fDescOk = false;
4952 else
4953 return rcStrict;
4954
4955 /* commit flags value and advance rip. */
4956 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
4957 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4958
4959 return VINF_SUCCESS;
4960}
4961
4962
4963/**
4964 * Implements LAR and LSL with 16-bit operand size.
4965 *
4966 * @returns VINF_SUCCESS.
4967 * @param pu16Dst Pointer to the destination register.
4968 * @param uSel The selector to load details for.
4969 * @param fIsLar true = LAR, false = LSL.
4970 */
4971IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4972{
4973 uint64_t u64TmpDst = *pu16Dst;
4974 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4975 *pu16Dst = u64TmpDst;
4976 return VINF_SUCCESS;
4977}
4978
4979
4980/**
4981 * Implements lgdt.
4982 *
4983 * @param iEffSeg The segment of the new gdtr contents
4984 * @param GCPtrEffSrc The address of the new gdtr contents.
4985 * @param enmEffOpSize The effective operand size.
4986 */
4987IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4988{
4989 if (pVCpu->iem.s.uCpl != 0)
4990 return iemRaiseGeneralProtectionFault0(pVCpu);
4991 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
4992
4993 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
4994 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
4995 {
4996 Log(("lgdt: Guest intercept -> VM-exit\n"));
4997 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
4998 }
4999
5000 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5001 {
5002 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5003 IEM_SVM_UPDATE_NRIP(pVCpu);
5004 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5005 }
5006
5007 /*
5008 * Fetch the limit and base address.
5009 */
5010 uint16_t cbLimit;
5011 RTGCPTR GCPtrBase;
5012 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5013 if (rcStrict == VINF_SUCCESS)
5014 {
5015 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5016 || X86_IS_CANONICAL(GCPtrBase))
5017 {
5018 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5019 if (rcStrict == VINF_SUCCESS)
5020 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5021 }
5022 else
5023 {
5024 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5025 return iemRaiseGeneralProtectionFault0(pVCpu);
5026 }
5027 }
5028 return rcStrict;
5029}
5030
5031
5032/**
5033 * Implements sgdt.
5034 *
5035 * @param iEffSeg The segment where to store the gdtr content.
5036 * @param GCPtrEffDst The address where to store the gdtr content.
5037 */
5038IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5039{
5040 /*
5041 * Join paths with sidt.
5042 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5043 * you really must know.
5044 */
5045 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5046 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5047 {
5048 Log(("sgdt: Guest intercept -> VM-exit\n"));
5049 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5050 }
5051
5052 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5053 {
5054 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5055 IEM_SVM_UPDATE_NRIP(pVCpu);
5056 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5057 }
5058
5059 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5060 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5061 if (rcStrict == VINF_SUCCESS)
5062 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5063 return rcStrict;
5064}
5065
5066
5067/**
5068 * Implements lidt.
5069 *
5070 * @param iEffSeg The segment of the new idtr contents
5071 * @param GCPtrEffSrc The address of the new idtr contents.
5072 * @param enmEffOpSize The effective operand size.
5073 */
5074IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5075{
5076 if (pVCpu->iem.s.uCpl != 0)
5077 return iemRaiseGeneralProtectionFault0(pVCpu);
5078 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5079
5080 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5081 {
5082 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5083 IEM_SVM_UPDATE_NRIP(pVCpu);
5084 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5085 }
5086
5087 /*
5088 * Fetch the limit and base address.
5089 */
5090 uint16_t cbLimit;
5091 RTGCPTR GCPtrBase;
5092 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5093 if (rcStrict == VINF_SUCCESS)
5094 {
5095 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5096 || X86_IS_CANONICAL(GCPtrBase))
5097 {
5098 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5099 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5100 }
5101 else
5102 {
5103 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5104 return iemRaiseGeneralProtectionFault0(pVCpu);
5105 }
5106 }
5107 return rcStrict;
5108}
5109
5110
5111/**
5112 * Implements sidt.
5113 *
5114 * @param iEffSeg The segment where to store the idtr content.
5115 * @param GCPtrEffDst The address where to store the idtr content.
5116 */
5117IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5118{
5119 /*
5120 * Join paths with sgdt.
5121 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5122 * you really must know.
5123 */
5124 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5125 {
5126 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5127 IEM_SVM_UPDATE_NRIP(pVCpu);
5128 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5129 }
5130
5131 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5132 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5133 if (rcStrict == VINF_SUCCESS)
5134 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5135 return rcStrict;
5136}
5137
5138
5139/**
5140 * Implements lldt.
5141 *
5142 * @param uNewLdt The new LDT selector value.
5143 */
5144IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5145{
5146 /*
5147 * Check preconditions.
5148 */
5149 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5150 {
5151 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5152 return iemRaiseUndefinedOpcode(pVCpu);
5153 }
5154 if (pVCpu->iem.s.uCpl != 0)
5155 {
5156 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
5157 return iemRaiseGeneralProtectionFault0(pVCpu);
5158 }
5159 /* Nested-guest VMX intercept. */
5160 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5161 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5162 {
5163 Log(("lldt: Guest intercept -> VM-exit\n"));
5164 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5165 }
5166 if (uNewLdt & X86_SEL_LDT)
5167 {
5168 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5169 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5170 }
5171
5172 /*
5173 * Now, loading a NULL selector is easy.
5174 */
5175 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5176 {
5177 /* Nested-guest SVM intercept. */
5178 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5179 {
5180 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5181 IEM_SVM_UPDATE_NRIP(pVCpu);
5182 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5183 }
5184
5185 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5186 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5187 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5188 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5189 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5190 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5191 {
5192 /* AMD-V seems to leave the base and limit alone. */
5193 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5194 }
5195 else
5196 {
5197 /* VT-x (Intel 3960x) seems to be doing the following. */
5198 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5199 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5200 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5201 }
5202
5203 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5204 return VINF_SUCCESS;
5205 }
5206
5207 /*
5208 * Read the descriptor.
5209 */
5210 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5211 IEMSELDESC Desc;
5212 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5213 if (rcStrict != VINF_SUCCESS)
5214 return rcStrict;
5215
5216 /* Check GPs first. */
5217 if (Desc.Legacy.Gen.u1DescType)
5218 {
5219 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5220 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5221 }
5222 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5223 {
5224 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5225 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5226 }
5227 uint64_t u64Base;
5228 if (!IEM_IS_LONG_MODE(pVCpu))
5229 u64Base = X86DESC_BASE(&Desc.Legacy);
5230 else
5231 {
5232 if (Desc.Long.Gen.u5Zeros)
5233 {
5234 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5235 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5236 }
5237
5238 u64Base = X86DESC64_BASE(&Desc.Long);
5239 if (!IEM_IS_CANONICAL(u64Base))
5240 {
5241 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5242 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5243 }
5244 }
5245
5246 /* NP */
5247 if (!Desc.Legacy.Gen.u1Present)
5248 {
5249 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5250 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5251 }
5252
5253 /* Nested-guest SVM intercept. */
5254 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5255 {
5256 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5257 IEM_SVM_UPDATE_NRIP(pVCpu);
5258 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5259 }
5260
5261 /*
5262 * It checks out alright, update the registers.
5263 */
5264/** @todo check if the actual value is loaded or if the RPL is dropped */
5265 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5266 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5267 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5268 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5269 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5270 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5271
5272 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5273 return VINF_SUCCESS;
5274}
5275
5276
5277/**
5278 * Implements sldt GReg
5279 *
5280 * @param iGReg The general register to store the CRx value in.
5281 * @param enmEffOpSize The operand size.
5282 */
5283IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5284{
5285 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5286 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5287 {
5288 Log(("sldt: Guest intercept -> VM-exit\n"));
5289 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5290 }
5291
5292 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5293
5294 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5295 switch (enmEffOpSize)
5296 {
5297 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5298 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5299 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5300 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5301 }
5302 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5303 return VINF_SUCCESS;
5304}
5305
5306
5307/**
5308 * Implements sldt mem.
5309 *
5310 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5311 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5312 */
5313IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5314{
5315 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5316
5317 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5318 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5319 if (rcStrict == VINF_SUCCESS)
5320 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5321 return rcStrict;
5322}
5323
5324
5325/**
5326 * Implements ltr.
5327 *
5328 * @param uNewTr The new TSS selector value.
5329 */
5330IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5331{
5332 /*
5333 * Check preconditions.
5334 */
5335 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5336 {
5337 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5338 return iemRaiseUndefinedOpcode(pVCpu);
5339 }
5340 if (pVCpu->iem.s.uCpl != 0)
5341 {
5342 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5343 return iemRaiseGeneralProtectionFault0(pVCpu);
5344 }
5345 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5346 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5347 {
5348 Log(("ltr: Guest intercept -> VM-exit\n"));
5349 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5350 }
5351 if (uNewTr & X86_SEL_LDT)
5352 {
5353 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5354 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5355 }
5356 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5357 {
5358 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5359 return iemRaiseGeneralProtectionFault0(pVCpu);
5360 }
5361 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5362 {
5363 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5364 IEM_SVM_UPDATE_NRIP(pVCpu);
5365 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5366 }
5367
5368 /*
5369 * Read the descriptor.
5370 */
5371 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5372 IEMSELDESC Desc;
5373 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5374 if (rcStrict != VINF_SUCCESS)
5375 return rcStrict;
5376
5377 /* Check GPs first. */
5378 if (Desc.Legacy.Gen.u1DescType)
5379 {
5380 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5381 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5382 }
5383 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5384 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5385 || IEM_IS_LONG_MODE(pVCpu)) )
5386 {
5387 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5388 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5389 }
5390 uint64_t u64Base;
5391 if (!IEM_IS_LONG_MODE(pVCpu))
5392 u64Base = X86DESC_BASE(&Desc.Legacy);
5393 else
5394 {
5395 if (Desc.Long.Gen.u5Zeros)
5396 {
5397 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5398 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5399 }
5400
5401 u64Base = X86DESC64_BASE(&Desc.Long);
5402 if (!IEM_IS_CANONICAL(u64Base))
5403 {
5404 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5405 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5406 }
5407 }
5408
5409 /* NP */
5410 if (!Desc.Legacy.Gen.u1Present)
5411 {
5412 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5413 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5414 }
5415
5416 /*
5417 * Set it busy.
5418 * Note! Intel says this should lock down the whole descriptor, but we'll
5419 * restrict our selves to 32-bit for now due to lack of inline
5420 * assembly and such.
5421 */
5422 void *pvDesc;
5423 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
5424 if (rcStrict != VINF_SUCCESS)
5425 return rcStrict;
5426 switch ((uintptr_t)pvDesc & 3)
5427 {
5428 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5429 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5430 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5431 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5432 }
5433 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5434 if (rcStrict != VINF_SUCCESS)
5435 return rcStrict;
5436 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5437
5438 /*
5439 * It checks out alright, update the registers.
5440 */
5441/** @todo check if the actual value is loaded or if the RPL is dropped */
5442 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5443 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5444 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5445 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5446 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5447 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5448
5449 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5450 return VINF_SUCCESS;
5451}
5452
5453
5454/**
5455 * Implements str GReg
5456 *
5457 * @param iGReg The general register to store the CRx value in.
5458 * @param enmEffOpSize The operand size.
5459 */
5460IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5461{
5462 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5463 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5464 {
5465 Log(("str_reg: Guest intercept -> VM-exit\n"));
5466 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5467 }
5468
5469 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5470
5471 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5472 switch (enmEffOpSize)
5473 {
5474 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5475 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5476 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5477 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5478 }
5479 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5480 return VINF_SUCCESS;
5481}
5482
5483
5484/**
5485 * Implements str mem.
5486 *
5487 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5488 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5489 */
5490IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5491{
5492 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5493 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5494 {
5495 Log(("str_mem: Guest intercept -> VM-exit\n"));
5496 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5497 }
5498
5499 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5500
5501 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5502 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5503 if (rcStrict == VINF_SUCCESS)
5504 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5505 return rcStrict;
5506}
5507
5508
5509/**
5510 * Implements mov GReg,CRx.
5511 *
5512 * @param iGReg The general register to store the CRx value in.
5513 * @param iCrReg The CRx register to read (valid).
5514 */
5515IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5516{
5517 if (pVCpu->iem.s.uCpl != 0)
5518 return iemRaiseGeneralProtectionFault0(pVCpu);
5519 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5520
5521 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5522 {
5523 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5524 IEM_SVM_UPDATE_NRIP(pVCpu);
5525 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5526 }
5527
5528 /* Read it. */
5529 uint64_t crX;
5530 switch (iCrReg)
5531 {
5532 case 0:
5533 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5534 crX = pVCpu->cpum.GstCtx.cr0;
5535 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5536 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5537 break;
5538 case 2:
5539 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5540 crX = pVCpu->cpum.GstCtx.cr2;
5541 break;
5542 case 3:
5543 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5544 crX = pVCpu->cpum.GstCtx.cr3;
5545 break;
5546 case 4:
5547 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5548 crX = pVCpu->cpum.GstCtx.cr4;
5549 break;
5550 case 8:
5551 {
5552 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5553#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5554 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5555 {
5556 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5557 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5558 return rcStrict;
5559
5560 /*
5561 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5562 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5563 * are cleared.
5564 *
5565 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5566 */
5567 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5568 {
5569 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5570 crX = (uTpr >> 4) & 0xf;
5571 break;
5572 }
5573 }
5574#endif
5575#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5576 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5577 {
5578 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5579 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5580 {
5581 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5582 break;
5583 }
5584 }
5585#endif
5586 uint8_t uTpr;
5587 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5588 if (RT_SUCCESS(rc))
5589 crX = uTpr >> 4;
5590 else
5591 crX = 0;
5592 break;
5593 }
5594 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5595 }
5596
5597#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5598 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5599 {
5600 switch (iCrReg)
5601 {
5602 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5603 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5604 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5605
5606 case 3:
5607 {
5608 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5609 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5610 return rcStrict;
5611 break;
5612 }
5613 }
5614 }
5615#endif
5616
5617 /* Store it. */
5618 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5619 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5620 else
5621 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5622
5623 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5624 return VINF_SUCCESS;
5625}
5626
5627
5628/**
5629 * Implements smsw GReg.
5630 *
5631 * @param iGReg The general register to store the CRx value in.
5632 * @param enmEffOpSize The operand size.
5633 */
5634IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5635{
5636 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5637
5638#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5639 uint64_t u64MaskedCr0;
5640 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5641 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5642 else
5643 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5644 uint64_t const u64GuestCr0 = u64MaskedCr0;
5645#else
5646 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5647#endif
5648
5649 switch (enmEffOpSize)
5650 {
5651 case IEMMODE_16BIT:
5652 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5653 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5654 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5655 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5656 else
5657 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5658 break;
5659
5660 case IEMMODE_32BIT:
5661 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5662 break;
5663
5664 case IEMMODE_64BIT:
5665 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5666 break;
5667
5668 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5669 }
5670
5671 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5672 return VINF_SUCCESS;
5673}
5674
5675
5676/**
5677 * Implements smsw mem.
5678 *
5679 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5680 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5681 */
5682IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5683{
5684 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5685
5686#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5687 uint64_t u64MaskedCr0;
5688 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5689 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5690 else
5691 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5692 uint64_t const u64GuestCr0 = u64MaskedCr0;
5693#else
5694 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5695#endif
5696
5697 uint16_t u16Value;
5698 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5699 u16Value = (uint16_t)u64GuestCr0;
5700 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5701 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5702 else
5703 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5704
5705 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5706 if (rcStrict == VINF_SUCCESS)
5707 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5708 return rcStrict;
5709}
5710
5711
5712/**
5713 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5714 */
5715#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5716 do \
5717 { \
5718 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5719 if (RT_SUCCESS(rcX)) \
5720 { /* likely */ } \
5721 else \
5722 { \
5723 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5724 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5725 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5726 } \
5727 } while (0)
5728
5729
5730/**
5731 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5732 *
5733 * @param iCrReg The CRx register to write (valid).
5734 * @param uNewCrX The new value.
5735 * @param enmAccessCrX The instruction that caused the CrX load.
5736 * @param iGReg The general register in case of a 'mov CRx,GReg'
5737 * instruction.
5738 */
5739IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5740{
5741 VBOXSTRICTRC rcStrict;
5742 int rc;
5743#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5744 RT_NOREF2(iGReg, enmAccessCrX);
5745#endif
5746
5747 /*
5748 * Try store it.
5749 * Unfortunately, CPUM only does a tiny bit of the work.
5750 */
5751 switch (iCrReg)
5752 {
5753 case 0:
5754 {
5755 /*
5756 * Perform checks.
5757 */
5758 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5759
5760 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5761 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5762
5763 /* ET is hardcoded on 486 and later. */
5764 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5765 uNewCrX |= X86_CR0_ET;
5766 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5767 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5768 {
5769 uNewCrX &= fValid;
5770 uNewCrX |= X86_CR0_ET;
5771 }
5772 else
5773 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5774
5775 /* Check for reserved bits. */
5776 if (uNewCrX & ~(uint64_t)fValid)
5777 {
5778 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5779 return iemRaiseGeneralProtectionFault0(pVCpu);
5780 }
5781
5782 /* Check for invalid combinations. */
5783 if ( (uNewCrX & X86_CR0_PG)
5784 && !(uNewCrX & X86_CR0_PE) )
5785 {
5786 Log(("Trying to set CR0.PG without CR0.PE\n"));
5787 return iemRaiseGeneralProtectionFault0(pVCpu);
5788 }
5789
5790 if ( !(uNewCrX & X86_CR0_CD)
5791 && (uNewCrX & X86_CR0_NW) )
5792 {
5793 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5794 return iemRaiseGeneralProtectionFault0(pVCpu);
5795 }
5796
5797 if ( !(uNewCrX & X86_CR0_PG)
5798 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5799 {
5800 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5801 return iemRaiseGeneralProtectionFault0(pVCpu);
5802 }
5803
5804 /* Long mode consistency checks. */
5805 if ( (uNewCrX & X86_CR0_PG)
5806 && !(uOldCrX & X86_CR0_PG)
5807 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5808 {
5809 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5810 {
5811 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5812 return iemRaiseGeneralProtectionFault0(pVCpu);
5813 }
5814 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5815 {
5816 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5817 return iemRaiseGeneralProtectionFault0(pVCpu);
5818 }
5819 }
5820
5821 /* Check for bits that must remain set or cleared in VMX operation,
5822 see Intel spec. 23.8 "Restrictions on VMX operation". */
5823 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5824 {
5825#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5826 uint64_t const uCr0Fixed0 = IEM_VMX_IS_NON_ROOT_MODE(pVCpu) ? iemVmxGetCr0Fixed0(pVCpu) : VMX_V_CR0_FIXED0;
5827#else
5828 uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
5829#endif
5830 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5831 {
5832 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5833 return iemRaiseGeneralProtectionFault0(pVCpu);
5834 }
5835
5836 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5837 if (uNewCrX & ~uCr0Fixed1)
5838 {
5839 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5840 return iemRaiseGeneralProtectionFault0(pVCpu);
5841 }
5842 }
5843
5844 /*
5845 * SVM nested-guest CR0 write intercepts.
5846 */
5847 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5848 {
5849 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5850 IEM_SVM_UPDATE_NRIP(pVCpu);
5851 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5852 }
5853 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5854 {
5855 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5856 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5857 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5858 {
5859 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5860 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5861 IEM_SVM_UPDATE_NRIP(pVCpu);
5862 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5863 }
5864 }
5865
5866 /*
5867 * Change EFER.LMA if entering or leaving long mode.
5868 */
5869 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5870 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5871 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5872 {
5873 if (uNewCrX & X86_CR0_PG)
5874 NewEFER |= MSR_K6_EFER_LMA;
5875 else
5876 NewEFER &= ~MSR_K6_EFER_LMA;
5877
5878 CPUMSetGuestEFER(pVCpu, NewEFER);
5879 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5880 }
5881
5882 /*
5883 * Inform PGM.
5884 */
5885 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5886 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5887 {
5888 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
5889 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
5890 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5891 { /* likely */ }
5892 else
5893 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
5894 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5895 AssertRCReturn(rc, rc);
5896 /* ignore informational status codes */
5897 }
5898
5899 /*
5900 * Change CR0.
5901 */
5902 CPUMSetGuestCR0(pVCpu, uNewCrX);
5903 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
5904
5905 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
5906 false /* fForce */);
5907 break;
5908 }
5909
5910 /*
5911 * CR2 can be changed without any restrictions.
5912 */
5913 case 2:
5914 {
5915 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5916 {
5917 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5918 IEM_SVM_UPDATE_NRIP(pVCpu);
5919 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5920 }
5921 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
5922 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
5923 rcStrict = VINF_SUCCESS;
5924 break;
5925 }
5926
5927 /*
5928 * CR3 is relatively simple, although AMD and Intel have different
5929 * accounts of how setting reserved bits are handled. We take intel's
5930 * word for the lower bits and AMD's for the high bits (63:52). The
5931 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5932 * on this.
5933 */
5934 /** @todo Testcase: Setting reserved bits in CR3, especially before
5935 * enabling paging. */
5936 case 3:
5937 {
5938 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5939
5940 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
5941 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
5942 && (uNewCrX & RT_BIT_64(63)))
5943 {
5944 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5945 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5946 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5947 * Paging-Structure Caches". */
5948 uNewCrX &= ~RT_BIT_64(63);
5949 }
5950
5951 /* Check / mask the value. */
5952#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
5953 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
5954 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
5955 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
5956 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
5957#else
5958 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
5959#endif
5960 if (uNewCrX & fInvPhysMask)
5961 {
5962 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
5963 * very vague in this area. As mentioned above, need testcase on real
5964 * hardware... Sigh. */
5965 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5966 return iemRaiseGeneralProtectionFault0(pVCpu);
5967 }
5968
5969 uint64_t fValid;
5970 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
5971 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
5972 {
5973 /** @todo Redundant? This value has already been validated above. */
5974 fValid = UINT64_C(0x000fffffffffffff);
5975 }
5976 else
5977 fValid = UINT64_C(0xffffffff);
5978 if (uNewCrX & ~fValid)
5979 {
5980 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5981 uNewCrX, uNewCrX & ~fValid));
5982 uNewCrX &= fValid;
5983 }
5984
5985 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
5986 {
5987 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5988 IEM_SVM_UPDATE_NRIP(pVCpu);
5989 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
5990 }
5991
5992 /* Inform PGM. */
5993 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
5994 {
5995 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
5996 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5997 { /* likely */ }
5998 else
5999 {
6000 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6001 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6002 }
6003 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6004 AssertRCReturn(rc, rc);
6005 /* ignore informational status codes */
6006 }
6007
6008 /* Make the change. */
6009 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6010 AssertRCSuccessReturn(rc, rc);
6011
6012 rcStrict = VINF_SUCCESS;
6013 break;
6014 }
6015
6016 /*
6017 * CR4 is a bit more tedious as there are bits which cannot be cleared
6018 * under some circumstances and such.
6019 */
6020 case 4:
6021 {
6022 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6023 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6024
6025 /* Reserved bits. */
6026 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6027 if (uNewCrX & ~(uint64_t)fValid)
6028 {
6029 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6030 return iemRaiseGeneralProtectionFault0(pVCpu);
6031 }
6032
6033 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6034 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6035
6036 /* PCIDE check. */
6037 if ( fPcide
6038 && ( !fLongMode
6039 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6040 {
6041 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6042 return iemRaiseGeneralProtectionFault0(pVCpu);
6043 }
6044
6045 /* PAE check. */
6046 if ( fLongMode
6047 && (uOldCrX & X86_CR4_PAE)
6048 && !(uNewCrX & X86_CR4_PAE))
6049 {
6050 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6051 return iemRaiseGeneralProtectionFault0(pVCpu);
6052 }
6053
6054 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6055 {
6056 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6057 IEM_SVM_UPDATE_NRIP(pVCpu);
6058 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6059 }
6060
6061 /* Check for bits that must remain set or cleared in VMX operation,
6062 see Intel spec. 23.8 "Restrictions on VMX operation". */
6063 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6064 {
6065 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6066 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6067 {
6068 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6069 return iemRaiseGeneralProtectionFault0(pVCpu);
6070 }
6071
6072 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6073 if (uNewCrX & ~uCr4Fixed1)
6074 {
6075 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6076 return iemRaiseGeneralProtectionFault0(pVCpu);
6077 }
6078 }
6079
6080 /*
6081 * Notify PGM.
6082 */
6083 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6084 {
6085 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6086 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6087 { /* likely */ }
6088 else
6089 {
6090 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6091 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6092 }
6093 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6094 AssertRCReturn(rc, rc);
6095 /* ignore informational status codes */
6096 }
6097
6098 /*
6099 * Change it.
6100 */
6101 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6102 AssertRCSuccessReturn(rc, rc);
6103 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6104
6105 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6106 false /* fForce */);
6107 break;
6108 }
6109
6110 /*
6111 * CR8 maps to the APIC TPR.
6112 */
6113 case 8:
6114 {
6115 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6116 if (uNewCrX & ~(uint64_t)0xf)
6117 {
6118 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6119 return iemRaiseGeneralProtectionFault0(pVCpu);
6120 }
6121
6122#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6123 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6124 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6125 {
6126 /*
6127 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6128 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6129 * cleared. Following this the processor performs TPR virtualization.
6130 *
6131 * However, we should not perform TPR virtualization immediately here but
6132 * after this instruction has completed.
6133 *
6134 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6135 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6136 */
6137 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6138 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6139 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6140 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6141 rcStrict = VINF_SUCCESS;
6142 break;
6143 }
6144#endif
6145
6146#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6147 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6148 {
6149 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6150 {
6151 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6152 IEM_SVM_UPDATE_NRIP(pVCpu);
6153 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6154 }
6155
6156 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6157 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6158 {
6159 rcStrict = VINF_SUCCESS;
6160 break;
6161 }
6162 }
6163#endif
6164 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6165 APICSetTpr(pVCpu, u8Tpr);
6166 rcStrict = VINF_SUCCESS;
6167 break;
6168 }
6169
6170 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6171 }
6172
6173 /*
6174 * Advance the RIP on success.
6175 */
6176 if (RT_SUCCESS(rcStrict))
6177 {
6178 if (rcStrict != VINF_SUCCESS)
6179 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6180 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6181 }
6182
6183 return rcStrict;
6184}
6185
6186
6187/**
6188 * Implements mov CRx,GReg.
6189 *
6190 * @param iCrReg The CRx register to write (valid).
6191 * @param iGReg The general register to load the CRx value from.
6192 */
6193IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6194{
6195 if (pVCpu->iem.s.uCpl != 0)
6196 return iemRaiseGeneralProtectionFault0(pVCpu);
6197 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6198
6199 /*
6200 * Read the new value from the source register and call common worker.
6201 */
6202 uint64_t uNewCrX;
6203 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6204 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6205 else
6206 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6207
6208#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6209 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6210 {
6211 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6212 switch (iCrReg)
6213 {
6214 case 0:
6215 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6216 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6217 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6218 }
6219 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6220 return rcStrict;
6221 }
6222#endif
6223
6224 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6225}
6226
6227
6228/**
6229 * Implements 'LMSW r/m16'
6230 *
6231 * @param u16NewMsw The new value.
6232 * @param GCPtrEffDst The guest-linear address of the source operand in case
6233 * of a memory operand. For register operand, pass
6234 * NIL_RTGCPTR.
6235 */
6236IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6237{
6238 if (pVCpu->iem.s.uCpl != 0)
6239 return iemRaiseGeneralProtectionFault0(pVCpu);
6240 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6241 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6242
6243#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6244 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6245 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6246 {
6247 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6248 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6249 return rcStrict;
6250 }
6251#else
6252 RT_NOREF_PV(GCPtrEffDst);
6253#endif
6254
6255 /*
6256 * Compose the new CR0 value and call common worker.
6257 */
6258 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6259 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6260 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6261}
6262
6263
6264/**
6265 * Implements 'CLTS'.
6266 */
6267IEM_CIMPL_DEF_0(iemCImpl_clts)
6268{
6269 if (pVCpu->iem.s.uCpl != 0)
6270 return iemRaiseGeneralProtectionFault0(pVCpu);
6271
6272 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6273 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6274 uNewCr0 &= ~X86_CR0_TS;
6275
6276#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6277 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6278 {
6279 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6280 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6281 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6282 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6283 return rcStrict;
6284 }
6285#endif
6286
6287 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6288}
6289
6290
6291/**
6292 * Implements mov GReg,DRx.
6293 *
6294 * @param iGReg The general register to store the DRx value in.
6295 * @param iDrReg The DRx register to read (0-7).
6296 */
6297IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6298{
6299#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6300 /*
6301 * Check nested-guest VMX intercept.
6302 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6303 * over CPL and CR4.DE and even DR4/DR5 checks.
6304 *
6305 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6306 */
6307 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6308 {
6309 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6310 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6311 return rcStrict;
6312 }
6313#endif
6314
6315 /*
6316 * Check preconditions.
6317 */
6318 /* Raise GPs. */
6319 if (pVCpu->iem.s.uCpl != 0)
6320 return iemRaiseGeneralProtectionFault0(pVCpu);
6321 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6322 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR0);
6323
6324 if ( (iDrReg == 4 || iDrReg == 5)
6325 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE) )
6326 {
6327 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6328 return iemRaiseGeneralProtectionFault0(pVCpu);
6329 }
6330
6331 /* Raise #DB if general access detect is enabled. */
6332 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6333 {
6334 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6335 return iemRaiseDebugException(pVCpu);
6336 }
6337
6338 /*
6339 * Read the debug register and store it in the specified general register.
6340 */
6341 uint64_t drX;
6342 switch (iDrReg)
6343 {
6344 case 0:
6345 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6346 drX = pVCpu->cpum.GstCtx.dr[0];
6347 break;
6348 case 1:
6349 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6350 drX = pVCpu->cpum.GstCtx.dr[1];
6351 break;
6352 case 2:
6353 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6354 drX = pVCpu->cpum.GstCtx.dr[2];
6355 break;
6356 case 3:
6357 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6358 drX = pVCpu->cpum.GstCtx.dr[3];
6359 break;
6360 case 6:
6361 case 4:
6362 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6363 drX = pVCpu->cpum.GstCtx.dr[6];
6364 drX |= X86_DR6_RA1_MASK;
6365 drX &= ~X86_DR6_RAZ_MASK;
6366 break;
6367 case 7:
6368 case 5:
6369 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6370 drX = pVCpu->cpum.GstCtx.dr[7];
6371 drX |=X86_DR7_RA1_MASK;
6372 drX &= ~X86_DR7_RAZ_MASK;
6373 break;
6374 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6375 }
6376
6377 /** @todo SVM nested-guest intercept for DR8-DR15? */
6378 /*
6379 * Check for any SVM nested-guest intercepts for the DRx read.
6380 */
6381 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6382 {
6383 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6384 IEM_SVM_UPDATE_NRIP(pVCpu);
6385 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6386 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6387 }
6388
6389 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6390 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6391 else
6392 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6393
6394 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6395 return VINF_SUCCESS;
6396}
6397
6398
6399/**
6400 * Implements mov DRx,GReg.
6401 *
6402 * @param iDrReg The DRx register to write (valid).
6403 * @param iGReg The general register to load the DRx value from.
6404 */
6405IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6406{
6407#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6408 /*
6409 * Check nested-guest VMX intercept.
6410 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6411 * over CPL and CR4.DE and even DR4/DR5 checks.
6412 *
6413 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6414 */
6415 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6416 {
6417 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6418 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6419 return rcStrict;
6420 }
6421#endif
6422
6423 /*
6424 * Check preconditions.
6425 */
6426 if (pVCpu->iem.s.uCpl != 0)
6427 return iemRaiseGeneralProtectionFault0(pVCpu);
6428 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6429 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR4);
6430
6431 if (iDrReg == 4 || iDrReg == 5)
6432 {
6433 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6434 {
6435 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6436 return iemRaiseGeneralProtectionFault0(pVCpu);
6437 }
6438 iDrReg += 2;
6439 }
6440
6441 /* Raise #DB if general access detect is enabled. */
6442 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6443 * \#GP? */
6444 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6445 {
6446 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6447 return iemRaiseDebugException(pVCpu);
6448 }
6449
6450 /*
6451 * Read the new value from the source register.
6452 */
6453 uint64_t uNewDrX;
6454 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6455 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6456 else
6457 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6458
6459 /*
6460 * Adjust it.
6461 */
6462 switch (iDrReg)
6463 {
6464 case 0:
6465 case 1:
6466 case 2:
6467 case 3:
6468 /* nothing to adjust */
6469 break;
6470
6471 case 6:
6472 if (uNewDrX & X86_DR6_MBZ_MASK)
6473 {
6474 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6475 return iemRaiseGeneralProtectionFault0(pVCpu);
6476 }
6477 uNewDrX |= X86_DR6_RA1_MASK;
6478 uNewDrX &= ~X86_DR6_RAZ_MASK;
6479 break;
6480
6481 case 7:
6482 if (uNewDrX & X86_DR7_MBZ_MASK)
6483 {
6484 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6485 return iemRaiseGeneralProtectionFault0(pVCpu);
6486 }
6487 uNewDrX |= X86_DR7_RA1_MASK;
6488 uNewDrX &= ~X86_DR7_RAZ_MASK;
6489 break;
6490
6491 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6492 }
6493
6494 /** @todo SVM nested-guest intercept for DR8-DR15? */
6495 /*
6496 * Check for any SVM nested-guest intercepts for the DRx write.
6497 */
6498 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6499 {
6500 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6501 IEM_SVM_UPDATE_NRIP(pVCpu);
6502 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6503 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6504 }
6505
6506 /*
6507 * Do the actual setting.
6508 */
6509 if (iDrReg < 4)
6510 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6511 else if (iDrReg == 6)
6512 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6513
6514 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6515 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6516
6517 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6518 return VINF_SUCCESS;
6519}
6520
6521
6522/**
6523 * Implements mov GReg,TRx.
6524 *
6525 * @param iGReg The general register to store the
6526 * TRx value in.
6527 * @param iTrReg The TRx register to read (6/7).
6528 */
6529IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6530{
6531 /*
6532 * Check preconditions. NB: This instruction is 386/486 only.
6533 */
6534
6535 /* Raise GPs. */
6536 if (pVCpu->iem.s.uCpl != 0)
6537 return iemRaiseGeneralProtectionFault0(pVCpu);
6538 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6539
6540 if (iTrReg < 6 || iTrReg > 7)
6541 {
6542 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6543 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6544 return iemRaiseGeneralProtectionFault0(pVCpu);
6545 }
6546
6547 /*
6548 * Read the test register and store it in the specified general register.
6549 * This is currently a dummy implementation that only exists to satisfy
6550 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6551 * TR6/TR7 registers. Software which actually depends on the TR values
6552 * (different on 386/486) is exceedingly rare.
6553 */
6554 uint64_t trX;
6555 switch (iTrReg)
6556 {
6557 case 6:
6558 trX = 0; /* Currently a dummy. */
6559 break;
6560 case 7:
6561 trX = 0; /* Currently a dummy. */
6562 break;
6563 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6564 }
6565
6566 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)trX;
6567
6568 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6569 return VINF_SUCCESS;
6570}
6571
6572
6573/**
6574 * Implements mov TRx,GReg.
6575 *
6576 * @param iTrReg The TRx register to write (valid).
6577 * @param iGReg The general register to load the TRx
6578 * value from.
6579 */
6580IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6581{
6582 /*
6583 * Check preconditions. NB: This instruction is 386/486 only.
6584 */
6585
6586 /* Raise GPs. */
6587 if (pVCpu->iem.s.uCpl != 0)
6588 return iemRaiseGeneralProtectionFault0(pVCpu);
6589 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6590
6591 if (iTrReg < 6 || iTrReg > 7)
6592 {
6593 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6594 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6595 return iemRaiseGeneralProtectionFault0(pVCpu);
6596 }
6597
6598 /*
6599 * Read the new value from the source register.
6600 */
6601 uint64_t uNewTrX;
6602 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6603 uNewTrX = iemGRegFetchU64(pVCpu, iGReg);
6604 else
6605 uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6606
6607 /*
6608 * Here we would do the actual setting if this weren't a dummy implementation.
6609 * This is currently a dummy implementation that only exists to prevent
6610 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6611 */
6612 RT_NOREF(uNewTrX);
6613
6614 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6615 return VINF_SUCCESS;
6616}
6617
6618
6619/**
6620 * Implements 'INVLPG m'.
6621 *
6622 * @param GCPtrPage The effective address of the page to invalidate.
6623 * @remarks Updates the RIP.
6624 */
6625IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6626{
6627 /* ring-0 only. */
6628 if (pVCpu->iem.s.uCpl != 0)
6629 return iemRaiseGeneralProtectionFault0(pVCpu);
6630 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6631 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6632
6633#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6634 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6635 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6636 {
6637 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6638 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6639 }
6640#endif
6641
6642 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6643 {
6644 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6645 IEM_SVM_UPDATE_NRIP(pVCpu);
6646 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6647 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6648 }
6649
6650 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6651 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6652
6653 if (rc == VINF_SUCCESS)
6654 return VINF_SUCCESS;
6655 if (rc == VINF_PGM_SYNC_CR3)
6656 return iemSetPassUpStatus(pVCpu, rc);
6657
6658 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6659 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6660 return rc;
6661}
6662
6663
6664/**
6665 * Implements INVPCID.
6666 *
6667 * @param iEffSeg The segment of the invpcid descriptor.
6668 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6669 * @param uInvpcidType The invalidation type.
6670 * @remarks Updates the RIP.
6671 */
6672IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6673{
6674 /*
6675 * Check preconditions.
6676 */
6677 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6678 return iemRaiseUndefinedOpcode(pVCpu);
6679
6680 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6681 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6682 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6683 {
6684 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6685 return iemRaiseUndefinedOpcode(pVCpu);
6686 }
6687
6688 if (pVCpu->iem.s.uCpl != 0)
6689 {
6690 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6691 return iemRaiseGeneralProtectionFault0(pVCpu);
6692 }
6693
6694 if (IEM_IS_V86_MODE(pVCpu))
6695 {
6696 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6697 return iemRaiseGeneralProtectionFault0(pVCpu);
6698 }
6699
6700 /*
6701 * Check nested-guest intercept.
6702 *
6703 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6704 * both set. We have already checked the former earlier in this function.
6705 *
6706 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6707 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6708 */
6709 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6710 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6711 {
6712 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6713 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6714 }
6715
6716 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6717 {
6718 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6719 return iemRaiseGeneralProtectionFault0(pVCpu);
6720 }
6721 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6722
6723 /*
6724 * Fetch the invpcid descriptor from guest memory.
6725 */
6726 RTUINT128U uDesc;
6727 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6728 if (rcStrict == VINF_SUCCESS)
6729 {
6730 /*
6731 * Validate the descriptor.
6732 */
6733 if (uDesc.s.Lo > 0xfff)
6734 {
6735 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6736 return iemRaiseGeneralProtectionFault0(pVCpu);
6737 }
6738
6739 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6740 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6741 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6742 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6743 switch (uInvpcidType)
6744 {
6745 case X86_INVPCID_TYPE_INDV_ADDR:
6746 {
6747 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6748 {
6749 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6750 return iemRaiseGeneralProtectionFault0(pVCpu);
6751 }
6752 if ( !(uCr4 & X86_CR4_PCIDE)
6753 && uPcid != 0)
6754 {
6755 Log(("invpcid: invalid pcid %#x\n", uPcid));
6756 return iemRaiseGeneralProtectionFault0(pVCpu);
6757 }
6758
6759 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6760 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6761 break;
6762 }
6763
6764 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6765 {
6766 if ( !(uCr4 & X86_CR4_PCIDE)
6767 && uPcid != 0)
6768 {
6769 Log(("invpcid: invalid pcid %#x\n", uPcid));
6770 return iemRaiseGeneralProtectionFault0(pVCpu);
6771 }
6772 /* Invalidate all mappings associated with PCID except global translations. */
6773 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6774 break;
6775 }
6776
6777 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6778 {
6779 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6780 break;
6781 }
6782
6783 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6784 {
6785 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6786 break;
6787 }
6788 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6789 }
6790 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6791 }
6792 return rcStrict;
6793}
6794
6795
6796/**
6797 * Implements INVD.
6798 */
6799IEM_CIMPL_DEF_0(iemCImpl_invd)
6800{
6801 if (pVCpu->iem.s.uCpl != 0)
6802 {
6803 Log(("invd: CPL != 0 -> #GP(0)\n"));
6804 return iemRaiseGeneralProtectionFault0(pVCpu);
6805 }
6806
6807 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6808 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6809
6810 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6811
6812 /* We currently take no action here. */
6813 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6814 return VINF_SUCCESS;
6815}
6816
6817
6818/**
6819 * Implements WBINVD.
6820 */
6821IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6822{
6823 if (pVCpu->iem.s.uCpl != 0)
6824 {
6825 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6826 return iemRaiseGeneralProtectionFault0(pVCpu);
6827 }
6828
6829 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6830 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6831
6832 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6833
6834 /* We currently take no action here. */
6835 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6836 return VINF_SUCCESS;
6837}
6838
6839
6840/** Opcode 0x0f 0xaa. */
6841IEM_CIMPL_DEF_0(iemCImpl_rsm)
6842{
6843 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6844 NOREF(cbInstr);
6845 return iemRaiseUndefinedOpcode(pVCpu);
6846}
6847
6848
6849/**
6850 * Implements RDTSC.
6851 */
6852IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6853{
6854 /*
6855 * Check preconditions.
6856 */
6857 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6858 return iemRaiseUndefinedOpcode(pVCpu);
6859
6860 if (pVCpu->iem.s.uCpl != 0)
6861 {
6862 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6863 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6864 {
6865 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6866 return iemRaiseGeneralProtectionFault0(pVCpu);
6867 }
6868 }
6869
6870 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6871 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6872 {
6873 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6874 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6875 }
6876
6877 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6878 {
6879 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6880 IEM_SVM_UPDATE_NRIP(pVCpu);
6881 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6882 }
6883
6884 /*
6885 * Do the job.
6886 */
6887 uint64_t uTicks = TMCpuTickGet(pVCpu);
6888#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6889 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6890#endif
6891 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6892 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6893 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
6894 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6895 return VINF_SUCCESS;
6896}
6897
6898
6899/**
6900 * Implements RDTSC.
6901 */
6902IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
6903{
6904 /*
6905 * Check preconditions.
6906 */
6907 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6908 return iemRaiseUndefinedOpcode(pVCpu);
6909
6910 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6911 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
6912 {
6913 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
6914 return iemRaiseUndefinedOpcode(pVCpu);
6915 }
6916
6917 if (pVCpu->iem.s.uCpl != 0)
6918 {
6919 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6920 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6921 {
6922 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6923 return iemRaiseGeneralProtectionFault0(pVCpu);
6924 }
6925 }
6926
6927 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6928 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6929 {
6930 Log(("rdtscp: Guest intercept -> VM-exit\n"));
6931 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
6932 }
6933 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6934 {
6935 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6936 IEM_SVM_UPDATE_NRIP(pVCpu);
6937 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6938 }
6939
6940 /*
6941 * Do the job.
6942 * Query the MSR first in case of trips to ring-3.
6943 */
6944 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
6945 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
6946 if (rcStrict == VINF_SUCCESS)
6947 {
6948 /* Low dword of the TSC_AUX msr only. */
6949 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
6950
6951 uint64_t uTicks = TMCpuTickGet(pVCpu);
6952#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6953 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6954#endif
6955 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6956 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6957 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
6958 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6959 }
6960 return rcStrict;
6961}
6962
6963
6964/**
6965 * Implements RDPMC.
6966 */
6967IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
6968{
6969 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6970
6971 if ( pVCpu->iem.s.uCpl != 0
6972 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
6973 return iemRaiseGeneralProtectionFault0(pVCpu);
6974
6975 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6976 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
6977 {
6978 Log(("rdpmc: Guest intercept -> VM-exit\n"));
6979 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
6980 }
6981
6982 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
6983 {
6984 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
6985 IEM_SVM_UPDATE_NRIP(pVCpu);
6986 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6987 }
6988
6989 /** @todo Emulate performance counters, for now just return 0. */
6990 pVCpu->cpum.GstCtx.rax = 0;
6991 pVCpu->cpum.GstCtx.rdx = 0;
6992 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
6993 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
6994 * ecx but see @bugref{3472}! */
6995
6996 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6997 return VINF_SUCCESS;
6998}
6999
7000
7001/**
7002 * Implements RDMSR.
7003 */
7004IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7005{
7006 /*
7007 * Check preconditions.
7008 */
7009 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7010 return iemRaiseUndefinedOpcode(pVCpu);
7011 if (pVCpu->iem.s.uCpl != 0)
7012 return iemRaiseGeneralProtectionFault0(pVCpu);
7013
7014 /*
7015 * Check nested-guest intercepts.
7016 */
7017#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7018 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7019 {
7020 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7021 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7022 }
7023#endif
7024
7025#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7026 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7027 {
7028 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
7029 if (rcStrict == VINF_SVM_VMEXIT)
7030 return VINF_SUCCESS;
7031 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7032 {
7033 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7034 return rcStrict;
7035 }
7036 }
7037#endif
7038
7039 /*
7040 * Do the job.
7041 */
7042 RTUINT64U uValue;
7043 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7044 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7045
7046 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7047 if (rcStrict == VINF_SUCCESS)
7048 {
7049 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7050 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7051 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7052
7053 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7054 return VINF_SUCCESS;
7055 }
7056
7057#ifndef IN_RING3
7058 /* Deferred to ring-3. */
7059 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7060 {
7061 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7062 return rcStrict;
7063 }
7064#endif
7065
7066 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7067 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7068 {
7069 pVCpu->iem.s.cLogRelRdMsr++;
7070 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7071 }
7072 else
7073 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7074 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7075 return iemRaiseGeneralProtectionFault0(pVCpu);
7076}
7077
7078
7079/**
7080 * Implements WRMSR.
7081 */
7082IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7083{
7084 /*
7085 * Check preconditions.
7086 */
7087 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7088 return iemRaiseUndefinedOpcode(pVCpu);
7089 if (pVCpu->iem.s.uCpl != 0)
7090 return iemRaiseGeneralProtectionFault0(pVCpu);
7091
7092 RTUINT64U uValue;
7093 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7094 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7095
7096 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7097
7098 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7099 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7100
7101 /*
7102 * Check nested-guest intercepts.
7103 */
7104#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7105 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7106 {
7107 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7108 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7109 }
7110#endif
7111
7112#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7113 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7114 {
7115 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
7116 if (rcStrict == VINF_SVM_VMEXIT)
7117 return VINF_SUCCESS;
7118 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7119 {
7120 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7121 return rcStrict;
7122 }
7123 }
7124#endif
7125
7126 /*
7127 * Do the job.
7128 */
7129 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7130 if (rcStrict == VINF_SUCCESS)
7131 {
7132 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7133 return VINF_SUCCESS;
7134 }
7135
7136#ifndef IN_RING3
7137 /* Deferred to ring-3. */
7138 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7139 {
7140 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7141 return rcStrict;
7142 }
7143#endif
7144
7145 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7146 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7147 {
7148 pVCpu->iem.s.cLogRelWrMsr++;
7149 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7150 }
7151 else
7152 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7153 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7154 return iemRaiseGeneralProtectionFault0(pVCpu);
7155}
7156
7157
7158/**
7159 * Implements 'IN eAX, port'.
7160 *
7161 * @param u16Port The source port.
7162 * @param fImm Whether the port was specified through an immediate operand
7163 * or the implicit DX register.
7164 * @param cbReg The register size.
7165 */
7166IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7167{
7168 /*
7169 * CPL check
7170 */
7171 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7172 if (rcStrict != VINF_SUCCESS)
7173 return rcStrict;
7174
7175 /*
7176 * Check VMX nested-guest IO intercept.
7177 */
7178#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7179 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7180 {
7181 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
7182 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7183 return rcStrict;
7184 }
7185#else
7186 RT_NOREF(fImm);
7187#endif
7188
7189 /*
7190 * Check SVM nested-guest IO intercept.
7191 */
7192#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7193 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7194 {
7195 uint8_t cAddrSizeBits;
7196 switch (pVCpu->iem.s.enmEffAddrMode)
7197 {
7198 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7199 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7200 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7201 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7202 }
7203 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7204 false /* fRep */, false /* fStrIo */, cbInstr);
7205 if (rcStrict == VINF_SVM_VMEXIT)
7206 return VINF_SUCCESS;
7207 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7208 {
7209 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7210 VBOXSTRICTRC_VAL(rcStrict)));
7211 return rcStrict;
7212 }
7213 }
7214#endif
7215
7216 /*
7217 * Perform the I/O.
7218 */
7219 uint32_t u32Value = 0;
7220 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
7221 if (IOM_SUCCESS(rcStrict))
7222 {
7223 switch (cbReg)
7224 {
7225 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7226 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7227 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7228 default: AssertFailedReturn(VERR_IEM_IPE_3);
7229 }
7230 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7231 pVCpu->iem.s.cPotentialExits++;
7232 if (rcStrict != VINF_SUCCESS)
7233 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7234 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7235
7236 /*
7237 * Check for I/O breakpoints.
7238 */
7239 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7240 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7241 && X86_DR7_ANY_RW_IO(uDr7)
7242 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7243 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7244 {
7245 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7246 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7247 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7248 rcStrict = iemRaiseDebugException(pVCpu);
7249 }
7250 }
7251
7252 return rcStrict;
7253}
7254
7255
7256/**
7257 * Implements 'IN eAX, DX'.
7258 *
7259 * @param cbReg The register size.
7260 */
7261IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
7262{
7263 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7264}
7265
7266
7267/**
7268 * Implements 'OUT port, eAX'.
7269 *
7270 * @param u16Port The destination port.
7271 * @param fImm Whether the port was specified through an immediate operand
7272 * or the implicit DX register.
7273 * @param cbReg The register size.
7274 */
7275IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7276{
7277 /*
7278 * CPL check
7279 */
7280 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7281 if (rcStrict != VINF_SUCCESS)
7282 return rcStrict;
7283
7284 /*
7285 * Check VMX nested-guest I/O intercept.
7286 */
7287#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7288 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7289 {
7290 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
7291 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7292 return rcStrict;
7293 }
7294#else
7295 RT_NOREF(fImm);
7296#endif
7297
7298 /*
7299 * Check SVM nested-guest I/O intercept.
7300 */
7301#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7302 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7303 {
7304 uint8_t cAddrSizeBits;
7305 switch (pVCpu->iem.s.enmEffAddrMode)
7306 {
7307 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7308 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7309 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7310 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7311 }
7312 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7313 false /* fRep */, false /* fStrIo */, cbInstr);
7314 if (rcStrict == VINF_SVM_VMEXIT)
7315 return VINF_SUCCESS;
7316 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7317 {
7318 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7319 VBOXSTRICTRC_VAL(rcStrict)));
7320 return rcStrict;
7321 }
7322 }
7323#endif
7324
7325 /*
7326 * Perform the I/O.
7327 */
7328 uint32_t u32Value;
7329 switch (cbReg)
7330 {
7331 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7332 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7333 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7334 default: AssertFailedReturn(VERR_IEM_IPE_4);
7335 }
7336 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
7337 if (IOM_SUCCESS(rcStrict))
7338 {
7339 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7340 pVCpu->iem.s.cPotentialExits++;
7341 if (rcStrict != VINF_SUCCESS)
7342 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7343 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7344
7345 /*
7346 * Check for I/O breakpoints.
7347 */
7348 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7349 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7350 && X86_DR7_ANY_RW_IO(uDr7)
7351 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7352 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7353 {
7354 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7355 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7356 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7357 rcStrict = iemRaiseDebugException(pVCpu);
7358 }
7359 }
7360 return rcStrict;
7361}
7362
7363
7364/**
7365 * Implements 'OUT DX, eAX'.
7366 *
7367 * @param cbReg The register size.
7368 */
7369IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7370{
7371 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7372}
7373
7374
7375/**
7376 * Implements 'CLI'.
7377 */
7378IEM_CIMPL_DEF_0(iemCImpl_cli)
7379{
7380 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7381 uint32_t const fEflOld = fEfl;
7382
7383 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7384 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7385 {
7386 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7387 if (!(fEfl & X86_EFL_VM))
7388 {
7389 if (pVCpu->iem.s.uCpl <= uIopl)
7390 fEfl &= ~X86_EFL_IF;
7391 else if ( pVCpu->iem.s.uCpl == 3
7392 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7393 fEfl &= ~X86_EFL_VIF;
7394 else
7395 return iemRaiseGeneralProtectionFault0(pVCpu);
7396 }
7397 /* V8086 */
7398 else if (uIopl == 3)
7399 fEfl &= ~X86_EFL_IF;
7400 else if ( uIopl < 3
7401 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7402 fEfl &= ~X86_EFL_VIF;
7403 else
7404 return iemRaiseGeneralProtectionFault0(pVCpu);
7405 }
7406 /* real mode */
7407 else
7408 fEfl &= ~X86_EFL_IF;
7409
7410 /* Commit. */
7411 IEMMISC_SET_EFL(pVCpu, fEfl);
7412 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7413 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
7414 return VINF_SUCCESS;
7415}
7416
7417
7418/**
7419 * Implements 'STI'.
7420 */
7421IEM_CIMPL_DEF_0(iemCImpl_sti)
7422{
7423 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7424 uint32_t const fEflOld = fEfl;
7425
7426 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7427 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7428 {
7429 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7430 if (!(fEfl & X86_EFL_VM))
7431 {
7432 if (pVCpu->iem.s.uCpl <= uIopl)
7433 fEfl |= X86_EFL_IF;
7434 else if ( pVCpu->iem.s.uCpl == 3
7435 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7436 && !(fEfl & X86_EFL_VIP) )
7437 fEfl |= X86_EFL_VIF;
7438 else
7439 return iemRaiseGeneralProtectionFault0(pVCpu);
7440 }
7441 /* V8086 */
7442 else if (uIopl == 3)
7443 fEfl |= X86_EFL_IF;
7444 else if ( uIopl < 3
7445 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7446 && !(fEfl & X86_EFL_VIP) )
7447 fEfl |= X86_EFL_VIF;
7448 else
7449 return iemRaiseGeneralProtectionFault0(pVCpu);
7450 }
7451 /* real mode */
7452 else
7453 fEfl |= X86_EFL_IF;
7454
7455 /* Commit. */
7456 IEMMISC_SET_EFL(pVCpu, fEfl);
7457 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7458 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7459 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
7460 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7461 return VINF_SUCCESS;
7462}
7463
7464
7465/**
7466 * Implements 'HLT'.
7467 */
7468IEM_CIMPL_DEF_0(iemCImpl_hlt)
7469{
7470 if (pVCpu->iem.s.uCpl != 0)
7471 return iemRaiseGeneralProtectionFault0(pVCpu);
7472
7473 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7474 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7475 {
7476 Log2(("hlt: Guest intercept -> VM-exit\n"));
7477 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7478 }
7479
7480 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7481 {
7482 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7483 IEM_SVM_UPDATE_NRIP(pVCpu);
7484 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7485 }
7486
7487 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7488 return VINF_EM_HALT;
7489}
7490
7491
7492/**
7493 * Implements 'MONITOR'.
7494 */
7495IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7496{
7497 /*
7498 * Permission checks.
7499 */
7500 if (pVCpu->iem.s.uCpl != 0)
7501 {
7502 Log2(("monitor: CPL != 0\n"));
7503 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7504 }
7505 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7506 {
7507 Log2(("monitor: Not in CPUID\n"));
7508 return iemRaiseUndefinedOpcode(pVCpu);
7509 }
7510
7511 /*
7512 * Check VMX guest-intercept.
7513 * This should be considered a fault-like VM-exit.
7514 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7515 */
7516 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7517 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7518 {
7519 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7520 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7521 }
7522
7523 /*
7524 * Gather the operands and validate them.
7525 */
7526 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7527 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7528 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7529/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7530 * \#GP first. */
7531 if (uEcx != 0)
7532 {
7533 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7534 return iemRaiseGeneralProtectionFault0(pVCpu);
7535 }
7536
7537 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7538 if (rcStrict != VINF_SUCCESS)
7539 return rcStrict;
7540
7541 RTGCPHYS GCPhysMem;
7542 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7543 if (rcStrict != VINF_SUCCESS)
7544 return rcStrict;
7545
7546#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7547 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7548 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7549 {
7550 /*
7551 * MONITOR does not access the memory, just monitors the address. However,
7552 * if the address falls in the APIC-access page, the address monitored must
7553 * instead be the corresponding address in the virtual-APIC page.
7554 *
7555 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7556 */
7557 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7558 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7559 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7560 return rcStrict;
7561 }
7562#endif
7563
7564 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7565 {
7566 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7567 IEM_SVM_UPDATE_NRIP(pVCpu);
7568 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7569 }
7570
7571 /*
7572 * Call EM to prepare the monitor/wait.
7573 */
7574 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7575 Assert(rcStrict == VINF_SUCCESS);
7576
7577 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7578 return rcStrict;
7579}
7580
7581
7582/**
7583 * Implements 'MWAIT'.
7584 */
7585IEM_CIMPL_DEF_0(iemCImpl_mwait)
7586{
7587 /*
7588 * Permission checks.
7589 */
7590 if (pVCpu->iem.s.uCpl != 0)
7591 {
7592 Log2(("mwait: CPL != 0\n"));
7593 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7594 * EFLAGS.VM then.) */
7595 return iemRaiseUndefinedOpcode(pVCpu);
7596 }
7597 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7598 {
7599 Log2(("mwait: Not in CPUID\n"));
7600 return iemRaiseUndefinedOpcode(pVCpu);
7601 }
7602
7603 /* Check VMX nested-guest intercept. */
7604 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7605 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7606 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7607
7608 /*
7609 * Gather the operands and validate them.
7610 */
7611 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7612 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7613 if (uEcx != 0)
7614 {
7615 /* Only supported extension is break on IRQ when IF=0. */
7616 if (uEcx > 1)
7617 {
7618 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7619 return iemRaiseGeneralProtectionFault0(pVCpu);
7620 }
7621 uint32_t fMWaitFeatures = 0;
7622 uint32_t uIgnore = 0;
7623 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7624 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7625 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7626 {
7627 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7628 return iemRaiseGeneralProtectionFault0(pVCpu);
7629 }
7630
7631#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7632 /*
7633 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7634 * for delivery; and interrupts are disabled the processor does not enter its
7635 * mwait state but rather passes control to the next instruction.
7636 *
7637 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7638 */
7639 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7640 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7641 {
7642 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7643 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7644 {
7645 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7646 return VINF_SUCCESS;
7647 }
7648 }
7649#endif
7650 }
7651
7652 /*
7653 * Check SVM nested-guest mwait intercepts.
7654 */
7655 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7656 && EMMonitorIsArmed(pVCpu))
7657 {
7658 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7659 IEM_SVM_UPDATE_NRIP(pVCpu);
7660 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7661 }
7662 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7663 {
7664 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7665 IEM_SVM_UPDATE_NRIP(pVCpu);
7666 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7667 }
7668
7669 /*
7670 * Call EM to prepare the monitor/wait.
7671 */
7672 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7673
7674 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7675 return rcStrict;
7676}
7677
7678
7679/**
7680 * Implements 'SWAPGS'.
7681 */
7682IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7683{
7684 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7685
7686 /*
7687 * Permission checks.
7688 */
7689 if (pVCpu->iem.s.uCpl != 0)
7690 {
7691 Log2(("swapgs: CPL != 0\n"));
7692 return iemRaiseUndefinedOpcode(pVCpu);
7693 }
7694
7695 /*
7696 * Do the job.
7697 */
7698 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7699 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7700 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7701 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7702
7703 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7704 return VINF_SUCCESS;
7705}
7706
7707
7708/**
7709 * Implements 'CPUID'.
7710 */
7711IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7712{
7713 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7714 {
7715 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7716 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7717 }
7718
7719 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7720 {
7721 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7722 IEM_SVM_UPDATE_NRIP(pVCpu);
7723 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7724 }
7725
7726 CPUMGetGuestCpuId(pVCpu, pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ecx,
7727 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7728 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7729 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7730 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7731 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7732 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7733
7734 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7735 pVCpu->iem.s.cPotentialExits++;
7736 return VINF_SUCCESS;
7737}
7738
7739
7740/**
7741 * Implements 'AAD'.
7742 *
7743 * @param bImm The immediate operand.
7744 */
7745IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7746{
7747 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7748 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7749 pVCpu->cpum.GstCtx.ax = al;
7750 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7751 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7752 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7753
7754 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7755 return VINF_SUCCESS;
7756}
7757
7758
7759/**
7760 * Implements 'AAM'.
7761 *
7762 * @param bImm The immediate operand. Cannot be 0.
7763 */
7764IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
7765{
7766 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
7767
7768 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7769 uint8_t const al = (uint8_t)ax % bImm;
7770 uint8_t const ah = (uint8_t)ax / bImm;
7771 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
7772 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7773 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7774 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7775
7776 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7777 return VINF_SUCCESS;
7778}
7779
7780
7781/**
7782 * Implements 'DAA'.
7783 */
7784IEM_CIMPL_DEF_0(iemCImpl_daa)
7785{
7786 uint8_t const al = pVCpu->cpum.GstCtx.al;
7787 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7788
7789 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7790 || (al & 0xf) >= 10)
7791 {
7792 pVCpu->cpum.GstCtx.al = al + 6;
7793 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7794 }
7795 else
7796 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7797
7798 if (al >= 0x9a || fCarry)
7799 {
7800 pVCpu->cpum.GstCtx.al += 0x60;
7801 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7802 }
7803 else
7804 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7805
7806 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7807 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7808 return VINF_SUCCESS;
7809}
7810
7811
7812/**
7813 * Implements 'DAS'.
7814 */
7815IEM_CIMPL_DEF_0(iemCImpl_das)
7816{
7817 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
7818 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7819
7820 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7821 || (uInputAL & 0xf) >= 10)
7822 {
7823 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7824 if (uInputAL < 6)
7825 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7826 pVCpu->cpum.GstCtx.al = uInputAL - 6;
7827 }
7828 else
7829 {
7830 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7831 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7832 }
7833
7834 if (uInputAL >= 0x9a || fCarry)
7835 {
7836 pVCpu->cpum.GstCtx.al -= 0x60;
7837 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7838 }
7839
7840 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7841 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7842 return VINF_SUCCESS;
7843}
7844
7845
7846/**
7847 * Implements 'AAA'.
7848 */
7849IEM_CIMPL_DEF_0(iemCImpl_aaa)
7850{
7851 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7852 {
7853 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7854 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7855 {
7856 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7857 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7858 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7859 }
7860 else
7861 {
7862 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7863 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7864 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7865 }
7866 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7867 }
7868 else
7869 {
7870 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7871 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7872 {
7873 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
7874 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7875 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7876 }
7877 else
7878 {
7879 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7880 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7881 }
7882 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7883 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7884 }
7885
7886 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7887 return VINF_SUCCESS;
7888}
7889
7890
7891/**
7892 * Implements 'AAS'.
7893 */
7894IEM_CIMPL_DEF_0(iemCImpl_aas)
7895{
7896 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7897 {
7898 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7899 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7900 {
7901 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7902 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7903 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7904 }
7905 else
7906 {
7907 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7908 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7909 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7910 }
7911 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7912 }
7913 else
7914 {
7915 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7916 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7917 {
7918 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
7919 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7920 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7921 }
7922 else
7923 {
7924 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7925 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7926 }
7927 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7928 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7929 }
7930
7931 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7932 return VINF_SUCCESS;
7933}
7934
7935
7936/**
7937 * Implements the 16-bit version of 'BOUND'.
7938 *
7939 * @note We have separate 16-bit and 32-bit variants of this function due to
7940 * the decoder using unsigned parameters, whereas we want signed one to
7941 * do the job. This is significant for a recompiler.
7942 */
7943IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
7944{
7945 /*
7946 * Check if the index is inside the bounds, otherwise raise #BR.
7947 */
7948 if ( idxArray >= idxLowerBound
7949 && idxArray <= idxUpperBound)
7950 {
7951 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7952 return VINF_SUCCESS;
7953 }
7954
7955 return iemRaiseBoundRangeExceeded(pVCpu);
7956}
7957
7958
7959/**
7960 * Implements the 32-bit version of 'BOUND'.
7961 */
7962IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
7963{
7964 /*
7965 * Check if the index is inside the bounds, otherwise raise #BR.
7966 */
7967 if ( idxArray >= idxLowerBound
7968 && idxArray <= idxUpperBound)
7969 {
7970 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7971 return VINF_SUCCESS;
7972 }
7973
7974 return iemRaiseBoundRangeExceeded(pVCpu);
7975}
7976
7977
7978
7979/*
7980 * Instantiate the various string operation combinations.
7981 */
7982#define OP_SIZE 8
7983#define ADDR_SIZE 16
7984#include "IEMAllCImplStrInstr.cpp.h"
7985#define OP_SIZE 8
7986#define ADDR_SIZE 32
7987#include "IEMAllCImplStrInstr.cpp.h"
7988#define OP_SIZE 8
7989#define ADDR_SIZE 64
7990#include "IEMAllCImplStrInstr.cpp.h"
7991
7992#define OP_SIZE 16
7993#define ADDR_SIZE 16
7994#include "IEMAllCImplStrInstr.cpp.h"
7995#define OP_SIZE 16
7996#define ADDR_SIZE 32
7997#include "IEMAllCImplStrInstr.cpp.h"
7998#define OP_SIZE 16
7999#define ADDR_SIZE 64
8000#include "IEMAllCImplStrInstr.cpp.h"
8001
8002#define OP_SIZE 32
8003#define ADDR_SIZE 16
8004#include "IEMAllCImplStrInstr.cpp.h"
8005#define OP_SIZE 32
8006#define ADDR_SIZE 32
8007#include "IEMAllCImplStrInstr.cpp.h"
8008#define OP_SIZE 32
8009#define ADDR_SIZE 64
8010#include "IEMAllCImplStrInstr.cpp.h"
8011
8012#define OP_SIZE 64
8013#define ADDR_SIZE 32
8014#include "IEMAllCImplStrInstr.cpp.h"
8015#define OP_SIZE 64
8016#define ADDR_SIZE 64
8017#include "IEMAllCImplStrInstr.cpp.h"
8018
8019
8020/**
8021 * Implements 'XGETBV'.
8022 */
8023IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8024{
8025 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8026 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8027 {
8028 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8029 switch (uEcx)
8030 {
8031 case 0:
8032 break;
8033
8034 case 1: /** @todo Implement XCR1 support. */
8035 default:
8036 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8037 return iemRaiseGeneralProtectionFault0(pVCpu);
8038
8039 }
8040 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8041 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8042 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8043
8044 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8045 return VINF_SUCCESS;
8046 }
8047 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8048 return iemRaiseUndefinedOpcode(pVCpu);
8049}
8050
8051
8052/**
8053 * Implements 'XSETBV'.
8054 */
8055IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8056{
8057 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8058 {
8059 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8060 {
8061 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8062 IEM_SVM_UPDATE_NRIP(pVCpu);
8063 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8064 }
8065
8066 if (pVCpu->iem.s.uCpl == 0)
8067 {
8068 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8069
8070 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8071 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8072
8073 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8074 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8075 switch (uEcx)
8076 {
8077 case 0:
8078 {
8079 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8080 if (rc == VINF_SUCCESS)
8081 break;
8082 Assert(rc == VERR_CPUM_RAISE_GP_0);
8083 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8084 return iemRaiseGeneralProtectionFault0(pVCpu);
8085 }
8086
8087 case 1: /** @todo Implement XCR1 support. */
8088 default:
8089 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8090 return iemRaiseGeneralProtectionFault0(pVCpu);
8091
8092 }
8093
8094 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8095 return VINF_SUCCESS;
8096 }
8097
8098 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
8099 return iemRaiseGeneralProtectionFault0(pVCpu);
8100 }
8101 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8102 return iemRaiseUndefinedOpcode(pVCpu);
8103}
8104
8105#ifndef RT_ARCH_ARM64
8106# ifdef IN_RING3
8107
8108/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8109struct IEMCIMPLCX16ARGS
8110{
8111 PRTUINT128U pu128Dst;
8112 PRTUINT128U pu128RaxRdx;
8113 PRTUINT128U pu128RbxRcx;
8114 uint32_t *pEFlags;
8115# ifdef VBOX_STRICT
8116 uint32_t cCalls;
8117# endif
8118};
8119
8120/**
8121 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8122 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8123 */
8124static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8125{
8126 RT_NOREF(pVM, pVCpu);
8127 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8128# ifdef VBOX_STRICT
8129 Assert(pArgs->cCalls == 0);
8130 pArgs->cCalls++;
8131# endif
8132
8133 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8134 return VINF_SUCCESS;
8135}
8136
8137# endif /* IN_RING3 */
8138
8139/**
8140 * Implements 'CMPXCHG16B' fallback using rendezvous.
8141 */
8142IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8143 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8144{
8145# ifdef IN_RING3
8146 struct IEMCIMPLCX16ARGS Args;
8147 Args.pu128Dst = pu128Dst;
8148 Args.pu128RaxRdx = pu128RaxRdx;
8149 Args.pu128RbxRcx = pu128RbxRcx;
8150 Args.pEFlags = pEFlags;
8151# ifdef VBOX_STRICT
8152 Args.cCalls = 0;
8153# endif
8154 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8155 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8156 Assert(Args.cCalls == 1);
8157 if (rcStrict == VINF_SUCCESS)
8158 {
8159 /* Duplicated tail code. */
8160 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8161 if (rcStrict == VINF_SUCCESS)
8162 {
8163 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8164 if (!(*pEFlags & X86_EFL_ZF))
8165 {
8166 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8167 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8168 }
8169 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8170 }
8171 }
8172 return rcStrict;
8173# else
8174 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8175 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8176# endif
8177}
8178
8179#endif /* RT_ARCH_ARM64 */
8180
8181/**
8182 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8183 *
8184 * This is implemented in C because it triggers a load like behaviour without
8185 * actually reading anything. Since that's not so common, it's implemented
8186 * here.
8187 *
8188 * @param iEffSeg The effective segment.
8189 * @param GCPtrEff The address of the image.
8190 */
8191IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8192{
8193 /*
8194 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8195 */
8196 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8197 if (rcStrict == VINF_SUCCESS)
8198 {
8199 RTGCPHYS GCPhysMem;
8200 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8201 if (rcStrict == VINF_SUCCESS)
8202 {
8203#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8204 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8205 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8206 {
8207 /*
8208 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8209 * that contains the address. However, if the address falls in the APIC-access
8210 * page, the address flushed must instead be the corresponding address in the
8211 * virtual-APIC page.
8212 *
8213 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8214 */
8215 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8216 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8217 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8218 return rcStrict;
8219 }
8220#endif
8221 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8222 return VINF_SUCCESS;
8223 }
8224 }
8225
8226 return rcStrict;
8227}
8228
8229
8230/**
8231 * Implements 'FINIT' and 'FNINIT'.
8232 *
8233 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8234 * not.
8235 */
8236IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8237{
8238 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8239 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8240 return iemRaiseDeviceNotAvailable(pVCpu);
8241
8242 iemFpuActualizeStateForChange(pVCpu);
8243 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8244
8245 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
8246 if (fCheckXcpts && TODO )
8247 return iemRaiseMathFault(pVCpu);
8248 */
8249
8250 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8251 pXState->x87.FCW = 0x37f;
8252 pXState->x87.FSW = 0;
8253 pXState->x87.FTW = 0x00; /* 0 - empty. */
8254 pXState->x87.FPUDP = 0;
8255 pXState->x87.DS = 0; //??
8256 pXState->x87.Rsrvd2= 0;
8257 pXState->x87.FPUIP = 0;
8258 pXState->x87.CS = 0; //??
8259 pXState->x87.Rsrvd1= 0;
8260 pXState->x87.FOP = 0;
8261
8262 iemHlpUsedFpu(pVCpu);
8263 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8264 return VINF_SUCCESS;
8265}
8266
8267
8268/**
8269 * Implements 'FXSAVE'.
8270 *
8271 * @param iEffSeg The effective segment.
8272 * @param GCPtrEff The address of the image.
8273 * @param enmEffOpSize The operand size (only REX.W really matters).
8274 */
8275IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8276{
8277 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8278
8279 /*
8280 * Raise exceptions.
8281 */
8282 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8283 return iemRaiseUndefinedOpcode(pVCpu);
8284 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8285 return iemRaiseDeviceNotAvailable(pVCpu);
8286 if (GCPtrEff & 15)
8287 {
8288 /** @todo CPU/VM detection possible! \#AC might not be signal for
8289 * all/any misalignment sizes, intel says its an implementation detail. */
8290 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8291 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8292 && pVCpu->iem.s.uCpl == 3)
8293 return iemRaiseAlignmentCheckException(pVCpu);
8294 return iemRaiseGeneralProtectionFault0(pVCpu);
8295 }
8296
8297 /*
8298 * Access the memory.
8299 */
8300 void *pvMem512;
8301 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8302 if (rcStrict != VINF_SUCCESS)
8303 return rcStrict;
8304 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8305 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8306
8307 /*
8308 * Store the registers.
8309 */
8310 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8311 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8312
8313 /* common for all formats */
8314 pDst->FCW = pSrc->FCW;
8315 pDst->FSW = pSrc->FSW;
8316 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8317 pDst->FOP = pSrc->FOP;
8318 pDst->MXCSR = pSrc->MXCSR;
8319 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8320 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8321 {
8322 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8323 * them for now... */
8324 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8325 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8326 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8327 pDst->aRegs[i].au32[3] = 0;
8328 }
8329
8330 /* FPU IP, CS, DP and DS. */
8331 pDst->FPUIP = pSrc->FPUIP;
8332 pDst->CS = pSrc->CS;
8333 pDst->FPUDP = pSrc->FPUDP;
8334 pDst->DS = pSrc->DS;
8335 if (enmEffOpSize == IEMMODE_64BIT)
8336 {
8337 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8338 pDst->Rsrvd1 = pSrc->Rsrvd1;
8339 pDst->Rsrvd2 = pSrc->Rsrvd2;
8340 pDst->au32RsrvdForSoftware[0] = 0;
8341 }
8342 else
8343 {
8344 pDst->Rsrvd1 = 0;
8345 pDst->Rsrvd2 = 0;
8346 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
8347 }
8348
8349 /* XMM registers. */
8350 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8351 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8352 || pVCpu->iem.s.uCpl != 0)
8353 {
8354 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8355 for (uint32_t i = 0; i < cXmmRegs; i++)
8356 pDst->aXMM[i] = pSrc->aXMM[i];
8357 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8358 * right? */
8359 }
8360
8361 /*
8362 * Commit the memory.
8363 */
8364 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8365 if (rcStrict != VINF_SUCCESS)
8366 return rcStrict;
8367
8368 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8369 return VINF_SUCCESS;
8370}
8371
8372
8373/**
8374 * Implements 'FXRSTOR'.
8375 *
8376 * @param iEffSeg The effective segment register for @a GCPtrEff.
8377 * @param GCPtrEff The address of the image.
8378 * @param enmEffOpSize The operand size (only REX.W really matters).
8379 */
8380IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8381{
8382 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8383
8384 /*
8385 * Raise exceptions.
8386 */
8387 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8388 return iemRaiseUndefinedOpcode(pVCpu);
8389 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8390 return iemRaiseDeviceNotAvailable(pVCpu);
8391 if (GCPtrEff & 15)
8392 {
8393 /** @todo CPU/VM detection possible! \#AC might not be signal for
8394 * all/any misalignment sizes, intel says its an implementation detail. */
8395 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8396 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8397 && pVCpu->iem.s.uCpl == 3)
8398 return iemRaiseAlignmentCheckException(pVCpu);
8399 return iemRaiseGeneralProtectionFault0(pVCpu);
8400 }
8401
8402 /*
8403 * Access the memory.
8404 */
8405 void *pvMem512;
8406 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
8407 if (rcStrict != VINF_SUCCESS)
8408 return rcStrict;
8409 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8410 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8411
8412 /*
8413 * Check the state for stuff which will #GP(0).
8414 */
8415 uint32_t const fMXCSR = pSrc->MXCSR;
8416 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8417 if (fMXCSR & ~fMXCSR_MASK)
8418 {
8419 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8420 return iemRaiseGeneralProtectionFault0(pVCpu);
8421 }
8422
8423 /*
8424 * Load the registers.
8425 */
8426 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8427 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
8428
8429 /* common for all formats */
8430 pDst->FCW = pSrc->FCW;
8431 pDst->FSW = pSrc->FSW;
8432 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8433 pDst->FOP = pSrc->FOP;
8434 pDst->MXCSR = fMXCSR;
8435 /* (MXCSR_MASK is read-only) */
8436 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8437 {
8438 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8439 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8440 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8441 pDst->aRegs[i].au32[3] = 0;
8442 }
8443
8444 /* FPU IP, CS, DP and DS. */
8445 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8446 {
8447 pDst->FPUIP = pSrc->FPUIP;
8448 pDst->CS = pSrc->CS;
8449 pDst->Rsrvd1 = pSrc->Rsrvd1;
8450 pDst->FPUDP = pSrc->FPUDP;
8451 pDst->DS = pSrc->DS;
8452 pDst->Rsrvd2 = pSrc->Rsrvd2;
8453 }
8454 else
8455 {
8456 pDst->FPUIP = pSrc->FPUIP;
8457 pDst->CS = pSrc->CS;
8458 pDst->Rsrvd1 = 0;
8459 pDst->FPUDP = pSrc->FPUDP;
8460 pDst->DS = pSrc->DS;
8461 pDst->Rsrvd2 = 0;
8462 }
8463
8464 /* XMM registers. */
8465 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8466 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8467 || pVCpu->iem.s.uCpl != 0)
8468 {
8469 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8470 for (uint32_t i = 0; i < cXmmRegs; i++)
8471 pDst->aXMM[i] = pSrc->aXMM[i];
8472 }
8473
8474 /*
8475 * Commit the memory.
8476 */
8477 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8478 if (rcStrict != VINF_SUCCESS)
8479 return rcStrict;
8480
8481 iemHlpUsedFpu(pVCpu);
8482 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8483 return VINF_SUCCESS;
8484}
8485
8486
8487/**
8488 * Implements 'XSAVE'.
8489 *
8490 * @param iEffSeg The effective segment.
8491 * @param GCPtrEff The address of the image.
8492 * @param enmEffOpSize The operand size (only REX.W really matters).
8493 */
8494IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8495{
8496 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8497
8498 /*
8499 * Raise exceptions.
8500 */
8501 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8502 return iemRaiseUndefinedOpcode(pVCpu);
8503 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8504 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8505 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8506 {
8507 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8508 return iemRaiseUndefinedOpcode(pVCpu);
8509 }
8510 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8511 return iemRaiseDeviceNotAvailable(pVCpu);
8512 if (GCPtrEff & 63)
8513 {
8514 /** @todo CPU/VM detection possible! \#AC might not be signal for
8515 * all/any misalignment sizes, intel says its an implementation detail. */
8516 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8517 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8518 && pVCpu->iem.s.uCpl == 3)
8519 return iemRaiseAlignmentCheckException(pVCpu);
8520 return iemRaiseGeneralProtectionFault0(pVCpu);
8521 }
8522
8523 /*
8524 * Calc the requested mask.
8525 */
8526 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8527 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8528 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8529
8530/** @todo figure out the exact protocol for the memory access. Currently we
8531 * just need this crap to work halfways to make it possible to test
8532 * AVX instructions. */
8533/** @todo figure out the XINUSE and XMODIFIED */
8534
8535 /*
8536 * Access the x87 memory state.
8537 */
8538 /* The x87+SSE state. */
8539 void *pvMem512;
8540 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8541 if (rcStrict != VINF_SUCCESS)
8542 return rcStrict;
8543 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8544 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8545
8546 /* The header. */
8547 PX86XSAVEHDR pHdr;
8548 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW);
8549 if (rcStrict != VINF_SUCCESS)
8550 return rcStrict;
8551
8552 /*
8553 * Store the X87 state.
8554 */
8555 if (fReqComponents & XSAVE_C_X87)
8556 {
8557 /* common for all formats */
8558 pDst->FCW = pSrc->FCW;
8559 pDst->FSW = pSrc->FSW;
8560 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8561 pDst->FOP = pSrc->FOP;
8562 pDst->FPUIP = pSrc->FPUIP;
8563 pDst->CS = pSrc->CS;
8564 pDst->FPUDP = pSrc->FPUDP;
8565 pDst->DS = pSrc->DS;
8566 if (enmEffOpSize == IEMMODE_64BIT)
8567 {
8568 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8569 pDst->Rsrvd1 = pSrc->Rsrvd1;
8570 pDst->Rsrvd2 = pSrc->Rsrvd2;
8571 pDst->au32RsrvdForSoftware[0] = 0;
8572 }
8573 else
8574 {
8575 pDst->Rsrvd1 = 0;
8576 pDst->Rsrvd2 = 0;
8577 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
8578 }
8579 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8580 {
8581 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8582 * them for now... */
8583 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8584 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8585 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8586 pDst->aRegs[i].au32[3] = 0;
8587 }
8588
8589 }
8590
8591 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8592 {
8593 pDst->MXCSR = pSrc->MXCSR;
8594 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8595 }
8596
8597 if (fReqComponents & XSAVE_C_SSE)
8598 {
8599 /* XMM registers. */
8600 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8601 for (uint32_t i = 0; i < cXmmRegs; i++)
8602 pDst->aXMM[i] = pSrc->aXMM[i];
8603 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8604 * right? */
8605 }
8606
8607 /* Commit the x87 state bits. (probably wrong) */
8608 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8609 if (rcStrict != VINF_SUCCESS)
8610 return rcStrict;
8611
8612 /*
8613 * Store AVX state.
8614 */
8615 if (fReqComponents & XSAVE_C_YMM)
8616 {
8617 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8618 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8619 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8620 PX86XSAVEYMMHI pCompDst;
8621 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8622 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8623 if (rcStrict != VINF_SUCCESS)
8624 return rcStrict;
8625
8626 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8627 for (uint32_t i = 0; i < cXmmRegs; i++)
8628 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8629
8630 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8631 if (rcStrict != VINF_SUCCESS)
8632 return rcStrict;
8633 }
8634
8635 /*
8636 * Update the header.
8637 */
8638 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8639 | (fReqComponents & fXInUse);
8640
8641 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8642 if (rcStrict != VINF_SUCCESS)
8643 return rcStrict;
8644
8645 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8646 return VINF_SUCCESS;
8647}
8648
8649
8650/**
8651 * Implements 'XRSTOR'.
8652 *
8653 * @param iEffSeg The effective segment.
8654 * @param GCPtrEff The address of the image.
8655 * @param enmEffOpSize The operand size (only REX.W really matters).
8656 */
8657IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8658{
8659 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8660
8661 /*
8662 * Raise exceptions.
8663 */
8664 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8665 return iemRaiseUndefinedOpcode(pVCpu);
8666 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8667 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8668 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8669 {
8670 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8671 return iemRaiseUndefinedOpcode(pVCpu);
8672 }
8673 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8674 return iemRaiseDeviceNotAvailable(pVCpu);
8675 if (GCPtrEff & 63)
8676 {
8677 /** @todo CPU/VM detection possible! \#AC might not be signal for
8678 * all/any misalignment sizes, intel says its an implementation detail. */
8679 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8680 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8681 && pVCpu->iem.s.uCpl == 3)
8682 return iemRaiseAlignmentCheckException(pVCpu);
8683 return iemRaiseGeneralProtectionFault0(pVCpu);
8684 }
8685
8686/** @todo figure out the exact protocol for the memory access. Currently we
8687 * just need this crap to work halfways to make it possible to test
8688 * AVX instructions. */
8689/** @todo figure out the XINUSE and XMODIFIED */
8690
8691 /*
8692 * Access the x87 memory state.
8693 */
8694 /* The x87+SSE state. */
8695 void *pvMem512;
8696 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
8697 if (rcStrict != VINF_SUCCESS)
8698 return rcStrict;
8699 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8700 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8701
8702 /*
8703 * Calc the requested mask
8704 */
8705 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
8706 PCX86XSAVEHDR pHdrSrc;
8707 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_R);
8708 if (rcStrict != VINF_SUCCESS)
8709 return rcStrict;
8710
8711 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8712 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8713 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8714 uint64_t const fRstorMask = pHdrSrc->bmXState;
8715 uint64_t const fCompMask = pHdrSrc->bmXComp;
8716
8717 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8718
8719 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8720
8721 /* We won't need this any longer. */
8722 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8723 if (rcStrict != VINF_SUCCESS)
8724 return rcStrict;
8725
8726 /*
8727 * Store the X87 state.
8728 */
8729 if (fReqComponents & XSAVE_C_X87)
8730 {
8731 if (fRstorMask & XSAVE_C_X87)
8732 {
8733 pDst->FCW = pSrc->FCW;
8734 pDst->FSW = pSrc->FSW;
8735 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8736 pDst->FOP = pSrc->FOP;
8737 pDst->FPUIP = pSrc->FPUIP;
8738 pDst->CS = pSrc->CS;
8739 pDst->FPUDP = pSrc->FPUDP;
8740 pDst->DS = pSrc->DS;
8741 if (enmEffOpSize == IEMMODE_64BIT)
8742 {
8743 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8744 pDst->Rsrvd1 = pSrc->Rsrvd1;
8745 pDst->Rsrvd2 = pSrc->Rsrvd2;
8746 }
8747 else
8748 {
8749 pDst->Rsrvd1 = 0;
8750 pDst->Rsrvd2 = 0;
8751 }
8752 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8753 {
8754 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8755 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8756 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8757 pDst->aRegs[i].au32[3] = 0;
8758 }
8759 }
8760 else
8761 {
8762 pDst->FCW = 0x37f;
8763 pDst->FSW = 0;
8764 pDst->FTW = 0x00; /* 0 - empty. */
8765 pDst->FPUDP = 0;
8766 pDst->DS = 0; //??
8767 pDst->Rsrvd2= 0;
8768 pDst->FPUIP = 0;
8769 pDst->CS = 0; //??
8770 pDst->Rsrvd1= 0;
8771 pDst->FOP = 0;
8772 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8773 {
8774 pDst->aRegs[i].au32[0] = 0;
8775 pDst->aRegs[i].au32[1] = 0;
8776 pDst->aRegs[i].au32[2] = 0;
8777 pDst->aRegs[i].au32[3] = 0;
8778 }
8779 }
8780 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
8781 }
8782
8783 /* MXCSR */
8784 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8785 {
8786 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
8787 pDst->MXCSR = pSrc->MXCSR;
8788 else
8789 pDst->MXCSR = 0x1f80;
8790 }
8791
8792 /* XMM registers. */
8793 if (fReqComponents & XSAVE_C_SSE)
8794 {
8795 if (fRstorMask & XSAVE_C_SSE)
8796 {
8797 for (uint32_t i = 0; i < cXmmRegs; i++)
8798 pDst->aXMM[i] = pSrc->aXMM[i];
8799 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8800 * right? */
8801 }
8802 else
8803 {
8804 for (uint32_t i = 0; i < cXmmRegs; i++)
8805 {
8806 pDst->aXMM[i].au64[0] = 0;
8807 pDst->aXMM[i].au64[1] = 0;
8808 }
8809 }
8810 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
8811 }
8812
8813 /* Unmap the x87 state bits (so we've don't run out of mapping). */
8814 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8815 if (rcStrict != VINF_SUCCESS)
8816 return rcStrict;
8817
8818 /*
8819 * Restore AVX state.
8820 */
8821 if (fReqComponents & XSAVE_C_YMM)
8822 {
8823 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8824 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
8825
8826 if (fRstorMask & XSAVE_C_YMM)
8827 {
8828 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8829 PCX86XSAVEYMMHI pCompSrc;
8830 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
8831 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT], IEM_ACCESS_DATA_R);
8832 if (rcStrict != VINF_SUCCESS)
8833 return rcStrict;
8834
8835 for (uint32_t i = 0; i < cXmmRegs; i++)
8836 {
8837 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
8838 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
8839 }
8840
8841 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
8842 if (rcStrict != VINF_SUCCESS)
8843 return rcStrict;
8844 }
8845 else
8846 {
8847 for (uint32_t i = 0; i < cXmmRegs; i++)
8848 {
8849 pCompDst->aYmmHi[i].au64[0] = 0;
8850 pCompDst->aYmmHi[i].au64[1] = 0;
8851 }
8852 }
8853 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
8854 }
8855
8856 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8857 return VINF_SUCCESS;
8858}
8859
8860
8861
8862
8863/**
8864 * Implements 'STMXCSR'.
8865 *
8866 * @param iEffSeg The effective segment register for @a GCPtrEff.
8867 * @param GCPtrEff The address of the image.
8868 */
8869IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8870{
8871 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8872
8873 /*
8874 * Raise exceptions.
8875 */
8876 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8877 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8878 {
8879 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8880 {
8881 /*
8882 * Do the job.
8883 */
8884 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
8885 if (rcStrict == VINF_SUCCESS)
8886 {
8887 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8888 return VINF_SUCCESS;
8889 }
8890 return rcStrict;
8891 }
8892 return iemRaiseDeviceNotAvailable(pVCpu);
8893 }
8894 return iemRaiseUndefinedOpcode(pVCpu);
8895}
8896
8897
8898/**
8899 * Implements 'VSTMXCSR'.
8900 *
8901 * @param iEffSeg The effective segment register for @a GCPtrEff.
8902 * @param GCPtrEff The address of the image.
8903 */
8904IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8905{
8906 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
8907
8908 /*
8909 * Raise exceptions.
8910 */
8911 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
8912 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
8913 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
8914 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8915 {
8916 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8917 {
8918 /*
8919 * Do the job.
8920 */
8921 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
8922 if (rcStrict == VINF_SUCCESS)
8923 {
8924 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8925 return VINF_SUCCESS;
8926 }
8927 return rcStrict;
8928 }
8929 return iemRaiseDeviceNotAvailable(pVCpu);
8930 }
8931 return iemRaiseUndefinedOpcode(pVCpu);
8932}
8933
8934
8935/**
8936 * Implements 'LDMXCSR'.
8937 *
8938 * @param iEffSeg The effective segment register for @a GCPtrEff.
8939 * @param GCPtrEff The address of the image.
8940 */
8941IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8942{
8943 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8944
8945 /*
8946 * Raise exceptions.
8947 */
8948 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
8949 * happen after or before \#UD and \#EM? */
8950 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8951 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8952 {
8953 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8954 {
8955 /*
8956 * Do the job.
8957 */
8958 uint32_t fNewMxCsr;
8959 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
8960 if (rcStrict == VINF_SUCCESS)
8961 {
8962 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8963 if (!(fNewMxCsr & ~fMxCsrMask))
8964 {
8965 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
8966 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8967 return VINF_SUCCESS;
8968 }
8969 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
8970 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
8971 return iemRaiseGeneralProtectionFault0(pVCpu);
8972 }
8973 return rcStrict;
8974 }
8975 return iemRaiseDeviceNotAvailable(pVCpu);
8976 }
8977 return iemRaiseUndefinedOpcode(pVCpu);
8978}
8979
8980
8981/**
8982 * Commmon routine for fnstenv and fnsave.
8983 *
8984 * @param pVCpu The cross context virtual CPU structure of the calling thread.
8985 * @param enmEffOpSize The effective operand size.
8986 * @param uPtr Where to store the state.
8987 */
8988static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
8989{
8990 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8991 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
8992 if (enmEffOpSize == IEMMODE_16BIT)
8993 {
8994 uPtr.pu16[0] = pSrcX87->FCW;
8995 uPtr.pu16[1] = pSrcX87->FSW;
8996 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
8997 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8998 {
8999 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9000 * protected mode or long mode and we save it in real mode? And vice
9001 * versa? And with 32-bit operand size? I think CPU is storing the
9002 * effective address ((CS << 4) + IP) in the offset register and not
9003 * doing any address calculations here. */
9004 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9005 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9006 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9007 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9008 }
9009 else
9010 {
9011 uPtr.pu16[3] = pSrcX87->FPUIP;
9012 uPtr.pu16[4] = pSrcX87->CS;
9013 uPtr.pu16[5] = pSrcX87->FPUDP;
9014 uPtr.pu16[6] = pSrcX87->DS;
9015 }
9016 }
9017 else
9018 {
9019 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9020 uPtr.pu16[0*2] = pSrcX87->FCW;
9021 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9022 uPtr.pu16[1*2] = pSrcX87->FSW;
9023 uPtr.pu16[1*2+1] = 0xffff;
9024 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9025 uPtr.pu16[2*2+1] = 0xffff;
9026 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9027 {
9028 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9029 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9030 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9031 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9032 }
9033 else
9034 {
9035 uPtr.pu32[3] = pSrcX87->FPUIP;
9036 uPtr.pu16[4*2] = pSrcX87->CS;
9037 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9038 uPtr.pu32[5] = pSrcX87->FPUDP;
9039 uPtr.pu16[6*2] = pSrcX87->DS;
9040 uPtr.pu16[6*2+1] = 0xffff;
9041 }
9042 }
9043}
9044
9045
9046/**
9047 * Commmon routine for fldenv and frstor
9048 *
9049 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9050 * @param enmEffOpSize The effective operand size.
9051 * @param uPtr Where to store the state.
9052 */
9053static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9054{
9055 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9056 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9057 if (enmEffOpSize == IEMMODE_16BIT)
9058 {
9059 pDstX87->FCW = uPtr.pu16[0];
9060 pDstX87->FSW = uPtr.pu16[1];
9061 pDstX87->FTW = uPtr.pu16[2];
9062 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9063 {
9064 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9065 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9066 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9067 pDstX87->CS = 0;
9068 pDstX87->Rsrvd1= 0;
9069 pDstX87->DS = 0;
9070 pDstX87->Rsrvd2= 0;
9071 }
9072 else
9073 {
9074 pDstX87->FPUIP = uPtr.pu16[3];
9075 pDstX87->CS = uPtr.pu16[4];
9076 pDstX87->Rsrvd1= 0;
9077 pDstX87->FPUDP = uPtr.pu16[5];
9078 pDstX87->DS = uPtr.pu16[6];
9079 pDstX87->Rsrvd2= 0;
9080 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9081 }
9082 }
9083 else
9084 {
9085 pDstX87->FCW = uPtr.pu16[0*2];
9086 pDstX87->FSW = uPtr.pu16[1*2];
9087 pDstX87->FTW = uPtr.pu16[2*2];
9088 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9089 {
9090 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9091 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9092 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9093 pDstX87->CS = 0;
9094 pDstX87->Rsrvd1= 0;
9095 pDstX87->DS = 0;
9096 pDstX87->Rsrvd2= 0;
9097 }
9098 else
9099 {
9100 pDstX87->FPUIP = uPtr.pu32[3];
9101 pDstX87->CS = uPtr.pu16[4*2];
9102 pDstX87->Rsrvd1= 0;
9103 pDstX87->FOP = uPtr.pu16[4*2+1];
9104 pDstX87->FPUDP = uPtr.pu32[5];
9105 pDstX87->DS = uPtr.pu16[6*2];
9106 pDstX87->Rsrvd2= 0;
9107 }
9108 }
9109
9110 /* Make adjustments. */
9111 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9112 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
9113 iemFpuRecalcExceptionStatus(pDstX87);
9114 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9115 * exceptions are pending after loading the saved state? */
9116}
9117
9118
9119/**
9120 * Implements 'FNSTENV'.
9121 *
9122 * @param enmEffOpSize The operand size (only REX.W really matters).
9123 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9124 * @param GCPtrEffDst The address of the image.
9125 */
9126IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9127{
9128 RTPTRUNION uPtr;
9129 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9130 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9131 if (rcStrict != VINF_SUCCESS)
9132 return rcStrict;
9133
9134 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9135
9136 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9137 if (rcStrict != VINF_SUCCESS)
9138 return rcStrict;
9139
9140 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9141 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9142 return VINF_SUCCESS;
9143}
9144
9145
9146/**
9147 * Implements 'FNSAVE'.
9148 *
9149 * @param enmEffOpSize The operand size.
9150 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9151 * @param GCPtrEffDst The address of the image.
9152 */
9153IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9154{
9155 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9156
9157 RTPTRUNION uPtr;
9158 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9159 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9160 if (rcStrict != VINF_SUCCESS)
9161 return rcStrict;
9162
9163 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9164 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9165 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9166 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9167 {
9168 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9169 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9170 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9171 }
9172
9173 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9174 if (rcStrict != VINF_SUCCESS)
9175 return rcStrict;
9176
9177 /*
9178 * Re-initialize the FPU context.
9179 */
9180 pFpuCtx->FCW = 0x37f;
9181 pFpuCtx->FSW = 0;
9182 pFpuCtx->FTW = 0x00; /* 0 - empty */
9183 pFpuCtx->FPUDP = 0;
9184 pFpuCtx->DS = 0;
9185 pFpuCtx->Rsrvd2= 0;
9186 pFpuCtx->FPUIP = 0;
9187 pFpuCtx->CS = 0;
9188 pFpuCtx->Rsrvd1= 0;
9189 pFpuCtx->FOP = 0;
9190
9191 iemHlpUsedFpu(pVCpu);
9192 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9193 return VINF_SUCCESS;
9194}
9195
9196
9197
9198/**
9199 * Implements 'FLDENV'.
9200 *
9201 * @param enmEffOpSize The operand size (only REX.W really matters).
9202 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9203 * @param GCPtrEffSrc The address of the image.
9204 */
9205IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9206{
9207 RTCPTRUNION uPtr;
9208 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9209 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
9210 if (rcStrict != VINF_SUCCESS)
9211 return rcStrict;
9212
9213 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9214
9215 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9216 if (rcStrict != VINF_SUCCESS)
9217 return rcStrict;
9218
9219 iemHlpUsedFpu(pVCpu);
9220 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9221 return VINF_SUCCESS;
9222}
9223
9224
9225/**
9226 * Implements 'FRSTOR'.
9227 *
9228 * @param enmEffOpSize The operand size.
9229 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9230 * @param GCPtrEffSrc The address of the image.
9231 */
9232IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9233{
9234 RTCPTRUNION uPtr;
9235 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9236 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
9237 if (rcStrict != VINF_SUCCESS)
9238 return rcStrict;
9239
9240 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9241 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9242 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9243 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9244 {
9245 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9246 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9247 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9248 pFpuCtx->aRegs[i].au32[3] = 0;
9249 }
9250
9251 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9252 if (rcStrict != VINF_SUCCESS)
9253 return rcStrict;
9254
9255 iemHlpUsedFpu(pVCpu);
9256 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9257 return VINF_SUCCESS;
9258}
9259
9260
9261/**
9262 * Implements 'FLDCW'.
9263 *
9264 * @param u16Fcw The new FCW.
9265 */
9266IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9267{
9268 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9269
9270 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9271 /** @todo Testcase: Try see what happens when trying to set undefined bits
9272 * (other than 6 and 7). Currently ignoring them. */
9273 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9274 * according to FSW. (This is was is currently implemented.) */
9275 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9276 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
9277 iemFpuRecalcExceptionStatus(pFpuCtx);
9278
9279 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9280 iemHlpUsedFpu(pVCpu);
9281 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9282 return VINF_SUCCESS;
9283}
9284
9285
9286
9287/**
9288 * Implements the underflow case of fxch.
9289 *
9290 * @param iStReg The other stack register.
9291 */
9292IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
9293{
9294 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9295
9296 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9297 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9298 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9299 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9300
9301 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9302 * registers are read as QNaN and then exchanged. This could be
9303 * wrong... */
9304 if (pFpuCtx->FCW & X86_FCW_IM)
9305 {
9306 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9307 {
9308 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9309 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9310 else
9311 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9312 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9313 }
9314 else
9315 {
9316 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9317 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9318 }
9319 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9320 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9321 }
9322 else
9323 {
9324 /* raise underflow exception, don't change anything. */
9325 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9326 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9327 }
9328
9329 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9330 iemHlpUsedFpu(pVCpu);
9331 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9332 return VINF_SUCCESS;
9333}
9334
9335
9336/**
9337 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9338 *
9339 * @param iStReg The other stack register.
9340 * @param pfnAImpl The assembly comparison implementation.
9341 * @param fPop Whether we should pop the stack when done or not.
9342 */
9343IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9344{
9345 Assert(iStReg < 8);
9346 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9347
9348 /*
9349 * Raise exceptions.
9350 */
9351 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9352 return iemRaiseDeviceNotAvailable(pVCpu);
9353
9354 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9355 uint16_t u16Fsw = pFpuCtx->FSW;
9356 if (u16Fsw & X86_FSW_ES)
9357 return iemRaiseMathFault(pVCpu);
9358
9359 /*
9360 * Check if any of the register accesses causes #SF + #IA.
9361 */
9362 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9363 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9364 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9365 {
9366 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9367 NOREF(u32Eflags);
9368
9369 pFpuCtx->FSW &= ~X86_FSW_C1;
9370 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9371 if ( !(u16Fsw & X86_FSW_IE)
9372 || (pFpuCtx->FCW & X86_FCW_IM) )
9373 {
9374 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9375 pVCpu->cpum.GstCtx.eflags.u |= pVCpu->cpum.GstCtx.eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9376 }
9377 }
9378 else if (pFpuCtx->FCW & X86_FCW_IM)
9379 {
9380 /* Masked underflow. */
9381 pFpuCtx->FSW &= ~X86_FSW_C1;
9382 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9383 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9384 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9385 }
9386 else
9387 {
9388 /* Raise underflow - don't touch EFLAGS or TOP. */
9389 pFpuCtx->FSW &= ~X86_FSW_C1;
9390 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9391 fPop = false;
9392 }
9393
9394 /*
9395 * Pop if necessary.
9396 */
9397 if (fPop)
9398 {
9399 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9400 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
9401 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
9402 }
9403
9404 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9405 iemHlpUsedFpu(pVCpu);
9406 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9407 return VINF_SUCCESS;
9408}
9409
9410/** @} */
9411
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette