VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 97297

最後變更 在這個檔案從97297是 97297,由 vboxsync 提交於 2 年 前

IEM: Fixed IRET with null SS (Linux 4.15 ftrace crash early in boot).
  • 屬性 svn:eol-style 設為 native
  • 屬性 svn:keywords 設為 Author Date Id Revision
檔案大小: 346.6 KB
行 
1/* $Id: IEMAllCImpl.cpp 97297 2022-10-25 13:53:10Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.alldomusa.eu.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#include <VBox/vmm/iem.h>
35#include <VBox/vmm/cpum.h>
36#include <VBox/vmm/apic.h>
37#include <VBox/vmm/pdm.h>
38#include <VBox/vmm/pgm.h>
39#include <VBox/vmm/iom.h>
40#include <VBox/vmm/em.h>
41#include <VBox/vmm/hm.h>
42#include <VBox/vmm/nem.h>
43#include <VBox/vmm/gim.h>
44#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
45# include <VBox/vmm/em.h>
46# include <VBox/vmm/hm_svm.h>
47#endif
48#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
49# include <VBox/vmm/hmvmxinline.h>
50#endif
51#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
52# include <VBox/vmm/cpuidcall.h>
53#endif
54#include <VBox/vmm/tm.h>
55#include <VBox/vmm/dbgf.h>
56#include <VBox/vmm/dbgftrace.h>
57#include "IEMInternal.h"
58#include <VBox/vmm/vmcc.h>
59#include <VBox/log.h>
60#include <VBox/err.h>
61#include <VBox/param.h>
62#include <VBox/dis.h>
63#include <VBox/disopcode.h>
64#include <iprt/asm-math.h>
65#include <iprt/assert.h>
66#include <iprt/string.h>
67#include <iprt/x86.h>
68
69#include "IEMInline.h"
70
71
72/** @name Misc Helpers
73 * @{
74 */
75
76
77/**
78 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
79 *
80 * @returns Strict VBox status code.
81 *
82 * @param pVCpu The cross context virtual CPU structure of the calling thread.
83 * @param u16Port The port number.
84 * @param cbOperand The operand size.
85 */
86static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
87{
88 /* The TSS bits we're interested in are the same on 386 and AMD64. */
89 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
90 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
91 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
92 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
93
94 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
95
96 /*
97 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
98 */
99 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
100 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
101 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
102 {
103 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
104 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
105 return iemRaiseGeneralProtectionFault0(pVCpu);
106 }
107
108 /*
109 * Read the bitmap offset (may #PF).
110 */
111 uint16_t offBitmap;
112 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
113 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
114 if (rcStrict != VINF_SUCCESS)
115 {
116 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
117 return rcStrict;
118 }
119
120 /*
121 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
122 * describes the CPU actually reading two bytes regardless of whether the
123 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
124 */
125 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
126 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
127 * for instance sizeof(X86TSS32). */
128 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
129 {
130 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
131 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
132 return iemRaiseGeneralProtectionFault0(pVCpu);
133 }
134
135 /*
136 * Read the necessary bits.
137 */
138 /** @todo Test the assertion in the intel manual that the CPU reads two
139 * bytes. The question is how this works wrt to \#PF and \#GP on the
140 * 2nd byte when it's not required. */
141 uint16_t bmBytes = UINT16_MAX;
142 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
143 if (rcStrict != VINF_SUCCESS)
144 {
145 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
146 return rcStrict;
147 }
148
149 /*
150 * Perform the check.
151 */
152 uint16_t fPortMask = (1 << cbOperand) - 1;
153 bmBytes >>= (u16Port & 7);
154 if (bmBytes & fPortMask)
155 {
156 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
157 u16Port, cbOperand, bmBytes, fPortMask));
158 return iemRaiseGeneralProtectionFault0(pVCpu);
159 }
160
161 return VINF_SUCCESS;
162}
163
164
165/**
166 * Checks if we are allowed to access the given I/O port, raising the
167 * appropriate exceptions if we aren't (or if the I/O bitmap is not
168 * accessible).
169 *
170 * @returns Strict VBox status code.
171 *
172 * @param pVCpu The cross context virtual CPU structure of the calling thread.
173 * @param u16Port The port number.
174 * @param cbOperand The operand size.
175 */
176DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
177{
178 X86EFLAGS Efl;
179 Efl.u = IEMMISC_GET_EFL(pVCpu);
180 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
181 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
182 || Efl.Bits.u1VM) )
183 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
184 return VINF_SUCCESS;
185}
186
187
188#if 0
189/**
190 * Calculates the parity bit.
191 *
192 * @returns true if the bit is set, false if not.
193 * @param u8Result The least significant byte of the result.
194 */
195static bool iemHlpCalcParityFlag(uint8_t u8Result)
196{
197 /*
198 * Parity is set if the number of bits in the least significant byte of
199 * the result is even.
200 */
201 uint8_t cBits;
202 cBits = u8Result & 1; /* 0 */
203 u8Result >>= 1;
204 cBits += u8Result & 1;
205 u8Result >>= 1;
206 cBits += u8Result & 1;
207 u8Result >>= 1;
208 cBits += u8Result & 1;
209 u8Result >>= 1;
210 cBits += u8Result & 1; /* 4 */
211 u8Result >>= 1;
212 cBits += u8Result & 1;
213 u8Result >>= 1;
214 cBits += u8Result & 1;
215 u8Result >>= 1;
216 cBits += u8Result & 1;
217 return !(cBits & 1);
218}
219#endif /* not used */
220
221
222/**
223 * Updates the specified flags according to a 8-bit result.
224 *
225 * @param pVCpu The cross context virtual CPU structure of the calling thread.
226 * @param u8Result The result to set the flags according to.
227 * @param fToUpdate The flags to update.
228 * @param fUndefined The flags that are specified as undefined.
229 */
230static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
231{
232 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
233 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
234 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
235 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
236}
237
238
239/**
240 * Updates the specified flags according to a 16-bit result.
241 *
242 * @param pVCpu The cross context virtual CPU structure of the calling thread.
243 * @param u16Result The result to set the flags according to.
244 * @param fToUpdate The flags to update.
245 * @param fUndefined The flags that are specified as undefined.
246 */
247static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
248{
249 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
250 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
251 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
252 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
253}
254
255
256/**
257 * Helper used by iret.
258 *
259 * @param pVCpu The cross context virtual CPU structure of the calling thread.
260 * @param uCpl The new CPL.
261 * @param pSReg Pointer to the segment register.
262 */
263static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
264{
265 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
266 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
267
268 if ( uCpl > pSReg->Attr.n.u2Dpl
269 && pSReg->Attr.n.u1DescType /* code or data, not system */
270 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
271 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
272 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
273}
274
275
276/**
277 * Indicates that we have modified the FPU state.
278 *
279 * @param pVCpu The cross context virtual CPU structure of the calling thread.
280 */
281DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
282{
283 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
284}
285
286/** @} */
287
288/** @name C Implementations
289 * @{
290 */
291
292/**
293 * Implements a 16-bit popa.
294 */
295IEM_CIMPL_DEF_0(iemCImpl_popa_16)
296{
297 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
298 RTGCPTR GCPtrLast = GCPtrStart + 15;
299 VBOXSTRICTRC rcStrict;
300
301 /*
302 * The docs are a bit hard to comprehend here, but it looks like we wrap
303 * around in real mode as long as none of the individual "popa" crosses the
304 * end of the stack segment. In protected mode we check the whole access
305 * in one go. For efficiency, only do the word-by-word thing if we're in
306 * danger of wrapping around.
307 */
308 /** @todo do popa boundary / wrap-around checks. */
309 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
310 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
311 {
312 /* word-by-word */
313 RTUINT64U TmpRsp;
314 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
315 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
316 if (rcStrict == VINF_SUCCESS)
317 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
318 if (rcStrict == VINF_SUCCESS)
319 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
320 if (rcStrict == VINF_SUCCESS)
321 {
322 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
323 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
324 }
325 if (rcStrict == VINF_SUCCESS)
326 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
334 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
335 }
336 }
337 else
338 {
339 uint16_t const *pa16Mem = NULL;
340 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
341 if (rcStrict == VINF_SUCCESS)
342 {
343 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
344 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
345 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
346 /* skip sp */
347 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
348 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
349 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
350 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
351 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
352 if (rcStrict == VINF_SUCCESS)
353 {
354 iemRegAddToRsp(pVCpu, 16);
355 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
356 }
357 }
358 }
359 return rcStrict;
360}
361
362
363/**
364 * Implements a 32-bit popa.
365 */
366IEM_CIMPL_DEF_0(iemCImpl_popa_32)
367{
368 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
369 RTGCPTR GCPtrLast = GCPtrStart + 31;
370 VBOXSTRICTRC rcStrict;
371
372 /*
373 * The docs are a bit hard to comprehend here, but it looks like we wrap
374 * around in real mode as long as none of the individual "popa" crosses the
375 * end of the stack segment. In protected mode we check the whole access
376 * in one go. For efficiency, only do the word-by-word thing if we're in
377 * danger of wrapping around.
378 */
379 /** @todo do popa boundary / wrap-around checks. */
380 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
381 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
382 {
383 /* word-by-word */
384 RTUINT64U TmpRsp;
385 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
386 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
387 if (rcStrict == VINF_SUCCESS)
388 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
389 if (rcStrict == VINF_SUCCESS)
390 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
391 if (rcStrict == VINF_SUCCESS)
392 {
393 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
394 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
395 }
396 if (rcStrict == VINF_SUCCESS)
397 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
398 if (rcStrict == VINF_SUCCESS)
399 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
400 if (rcStrict == VINF_SUCCESS)
401 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
402 if (rcStrict == VINF_SUCCESS)
403 {
404#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
405 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
406 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
407 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
408 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
409 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
410 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
411 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
412#endif
413 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
414 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
415 }
416 }
417 else
418 {
419 uint32_t const *pa32Mem;
420 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
421 if (rcStrict == VINF_SUCCESS)
422 {
423 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
424 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
425 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
426 /* skip esp */
427 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
428 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
429 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
430 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
431 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
432 if (rcStrict == VINF_SUCCESS)
433 {
434 iemRegAddToRsp(pVCpu, 32);
435 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
436 }
437 }
438 }
439 return rcStrict;
440}
441
442
443/**
444 * Implements a 16-bit pusha.
445 */
446IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
447{
448 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
449 RTGCPTR GCPtrBottom = GCPtrTop - 15;
450 VBOXSTRICTRC rcStrict;
451
452 /*
453 * The docs are a bit hard to comprehend here, but it looks like we wrap
454 * around in real mode as long as none of the individual "pushd" crosses the
455 * end of the stack segment. In protected mode we check the whole access
456 * in one go. For efficiency, only do the word-by-word thing if we're in
457 * danger of wrapping around.
458 */
459 /** @todo do pusha boundary / wrap-around checks. */
460 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
461 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
462 {
463 /* word-by-word */
464 RTUINT64U TmpRsp;
465 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
466 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
467 if (rcStrict == VINF_SUCCESS)
468 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
469 if (rcStrict == VINF_SUCCESS)
470 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
471 if (rcStrict == VINF_SUCCESS)
472 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
473 if (rcStrict == VINF_SUCCESS)
474 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
475 if (rcStrict == VINF_SUCCESS)
476 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
477 if (rcStrict == VINF_SUCCESS)
478 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
479 if (rcStrict == VINF_SUCCESS)
480 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
481 if (rcStrict == VINF_SUCCESS)
482 {
483 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
484 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
485 }
486 }
487 else
488 {
489 GCPtrBottom--;
490 uint16_t *pa16Mem = NULL;
491 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
492 if (rcStrict == VINF_SUCCESS)
493 {
494 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
495 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
496 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
497 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
498 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
499 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
500 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
501 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
502 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
503 if (rcStrict == VINF_SUCCESS)
504 {
505 iemRegSubFromRsp(pVCpu, 16);
506 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
507 }
508 }
509 }
510 return rcStrict;
511}
512
513
514/**
515 * Implements a 32-bit pusha.
516 */
517IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
518{
519 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
520 RTGCPTR GCPtrBottom = GCPtrTop - 31;
521 VBOXSTRICTRC rcStrict;
522
523 /*
524 * The docs are a bit hard to comprehend here, but it looks like we wrap
525 * around in real mode as long as none of the individual "pusha" crosses the
526 * end of the stack segment. In protected mode we check the whole access
527 * in one go. For efficiency, only do the word-by-word thing if we're in
528 * danger of wrapping around.
529 */
530 /** @todo do pusha boundary / wrap-around checks. */
531 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
532 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
533 {
534 /* word-by-word */
535 RTUINT64U TmpRsp;
536 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
537 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
538 if (rcStrict == VINF_SUCCESS)
539 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
540 if (rcStrict == VINF_SUCCESS)
541 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
542 if (rcStrict == VINF_SUCCESS)
543 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
544 if (rcStrict == VINF_SUCCESS)
545 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
546 if (rcStrict == VINF_SUCCESS)
547 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
548 if (rcStrict == VINF_SUCCESS)
549 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
550 if (rcStrict == VINF_SUCCESS)
551 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
552 if (rcStrict == VINF_SUCCESS)
553 {
554 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
555 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
556 }
557 }
558 else
559 {
560 GCPtrBottom--;
561 uint32_t *pa32Mem;
562 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
563 if (rcStrict == VINF_SUCCESS)
564 {
565 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
566 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
567 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
568 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
569 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
570 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
571 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
572 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
573 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
574 if (rcStrict == VINF_SUCCESS)
575 {
576 iemRegSubFromRsp(pVCpu, 32);
577 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
578 }
579 }
580 }
581 return rcStrict;
582}
583
584
585/**
586 * Implements pushf.
587 *
588 *
589 * @param enmEffOpSize The effective operand size.
590 */
591IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
592{
593 VBOXSTRICTRC rcStrict;
594
595 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
596 {
597 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
598 IEM_SVM_UPDATE_NRIP(pVCpu);
599 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
600 }
601
602 /*
603 * If we're in V8086 mode some care is required (which is why we're in
604 * doing this in a C implementation).
605 */
606 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
607 if ( (fEfl & X86_EFL_VM)
608 && X86_EFL_GET_IOPL(fEfl) != 3 )
609 {
610 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
611 if ( enmEffOpSize != IEMMODE_16BIT
612 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
613 return iemRaiseGeneralProtectionFault0(pVCpu);
614 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
615 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
616 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
617 }
618 else
619 {
620
621 /*
622 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
623 */
624 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
625
626 switch (enmEffOpSize)
627 {
628 case IEMMODE_16BIT:
629 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
630 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
631 fEfl |= UINT16_C(0xf000);
632 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
633 break;
634 case IEMMODE_32BIT:
635 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
636 break;
637 case IEMMODE_64BIT:
638 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
639 break;
640 IEM_NOT_REACHED_DEFAULT_CASE_RET();
641 }
642 }
643 if (rcStrict != VINF_SUCCESS)
644 return rcStrict;
645
646 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
647 return VINF_SUCCESS;
648}
649
650
651/**
652 * Implements popf.
653 *
654 * @param enmEffOpSize The effective operand size.
655 */
656IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
657{
658 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
659 VBOXSTRICTRC rcStrict;
660 uint32_t fEflNew;
661
662 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
663 {
664 Log2(("popf: Guest intercept -> #VMEXIT\n"));
665 IEM_SVM_UPDATE_NRIP(pVCpu);
666 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
667 }
668
669 /*
670 * V8086 is special as usual.
671 */
672 if (fEflOld & X86_EFL_VM)
673 {
674 /*
675 * Almost anything goes if IOPL is 3.
676 */
677 if (X86_EFL_GET_IOPL(fEflOld) == 3)
678 {
679 switch (enmEffOpSize)
680 {
681 case IEMMODE_16BIT:
682 {
683 uint16_t u16Value;
684 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
685 if (rcStrict != VINF_SUCCESS)
686 return rcStrict;
687 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
688 break;
689 }
690 case IEMMODE_32BIT:
691 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
692 if (rcStrict != VINF_SUCCESS)
693 return rcStrict;
694 break;
695 IEM_NOT_REACHED_DEFAULT_CASE_RET();
696 }
697
698 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
699 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
700 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
701 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
702 }
703 /*
704 * Interrupt flag virtualization with CR4.VME=1.
705 */
706 else if ( enmEffOpSize == IEMMODE_16BIT
707 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
708 {
709 uint16_t u16Value;
710 RTUINT64U TmpRsp;
711 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
712 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
713 if (rcStrict != VINF_SUCCESS)
714 return rcStrict;
715
716 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
717 * or before? */
718 if ( ( (u16Value & X86_EFL_IF)
719 && (fEflOld & X86_EFL_VIP))
720 || (u16Value & X86_EFL_TF) )
721 return iemRaiseGeneralProtectionFault0(pVCpu);
722
723 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
724 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
725 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
726 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
727
728 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
729 }
730 else
731 return iemRaiseGeneralProtectionFault0(pVCpu);
732
733 }
734 /*
735 * Not in V8086 mode.
736 */
737 else
738 {
739 /* Pop the flags. */
740 switch (enmEffOpSize)
741 {
742 case IEMMODE_16BIT:
743 {
744 uint16_t u16Value;
745 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
746 if (rcStrict != VINF_SUCCESS)
747 return rcStrict;
748 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
749
750 /*
751 * Ancient CPU adjustments:
752 * - 8086, 80186, V20/30:
753 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
754 * practical reasons (masking below). We add them when pushing flags.
755 * - 80286:
756 * The NT and IOPL flags cannot be popped from real mode and are
757 * therefore always zero (since a 286 can never exit from PM and
758 * their initial value is zero). This changed on a 386 and can
759 * therefore be used to detect 286 or 386 CPU in real mode.
760 */
761 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
762 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
763 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
764 break;
765 }
766 case IEMMODE_32BIT:
767 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
768 if (rcStrict != VINF_SUCCESS)
769 return rcStrict;
770 break;
771 case IEMMODE_64BIT:
772 {
773 uint64_t u64Value;
774 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
775 if (rcStrict != VINF_SUCCESS)
776 return rcStrict;
777 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
778 break;
779 }
780 IEM_NOT_REACHED_DEFAULT_CASE_RET();
781 }
782
783 /* Merge them with the current flags. */
784 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
785 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
786 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
787 || pVCpu->iem.s.uCpl == 0)
788 {
789 fEflNew &= fPopfBits;
790 fEflNew |= ~fPopfBits & fEflOld;
791 }
792 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
793 {
794 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
795 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
796 }
797 else
798 {
799 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
800 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
801 }
802 }
803
804 /*
805 * Commit the flags.
806 */
807 Assert(fEflNew & RT_BIT_32(1));
808 IEMMISC_SET_EFL(pVCpu, fEflNew);
809 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
810
811 return VINF_SUCCESS;
812}
813
814
815/**
816 * Implements an indirect call.
817 *
818 * @param uNewPC The new program counter (RIP) value (loaded from the
819 * operand).
820 */
821IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
822{
823 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
824 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
825 return iemRaiseGeneralProtectionFault0(pVCpu);
826
827 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
828 if (rcStrict != VINF_SUCCESS)
829 return rcStrict;
830
831 pVCpu->cpum.GstCtx.rip = uNewPC;
832 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
833
834#ifndef IEM_WITH_CODE_TLB
835 /* Flush the prefetch buffer. */
836 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
837#endif
838 return VINF_SUCCESS;
839}
840
841
842/**
843 * Implements a 16-bit relative call.
844 *
845 * @param offDisp The displacment offset.
846 */
847IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
848{
849 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
850 uint16_t uNewPC = uOldPC + offDisp;
851 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
852 return iemRaiseGeneralProtectionFault0(pVCpu);
853
854 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
855 if (rcStrict != VINF_SUCCESS)
856 return rcStrict;
857
858 pVCpu->cpum.GstCtx.rip = uNewPC;
859 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
860
861#ifndef IEM_WITH_CODE_TLB
862 /* Flush the prefetch buffer. */
863 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
864#endif
865 return VINF_SUCCESS;
866}
867
868
869/**
870 * Implements a 32-bit indirect call.
871 *
872 * @param uNewPC The new program counter (RIP) value (loaded from the
873 * operand).
874 */
875IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
876{
877 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
878 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
879 return iemRaiseGeneralProtectionFault0(pVCpu);
880
881 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
882 if (rcStrict != VINF_SUCCESS)
883 return rcStrict;
884
885 pVCpu->cpum.GstCtx.rip = uNewPC;
886 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
887
888#ifndef IEM_WITH_CODE_TLB
889 /* Flush the prefetch buffer. */
890 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
891#endif
892 return VINF_SUCCESS;
893}
894
895
896/**
897 * Implements a 32-bit relative call.
898 *
899 * @param offDisp The displacment offset.
900 */
901IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
902{
903 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
904 uint32_t uNewPC = uOldPC + offDisp;
905 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
906 return iemRaiseGeneralProtectionFault0(pVCpu);
907
908 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
909 if (rcStrict != VINF_SUCCESS)
910 return rcStrict;
911
912 pVCpu->cpum.GstCtx.rip = uNewPC;
913 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
914
915#ifndef IEM_WITH_CODE_TLB
916 /* Flush the prefetch buffer. */
917 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
918#endif
919 return VINF_SUCCESS;
920}
921
922
923/**
924 * Implements a 64-bit indirect call.
925 *
926 * @param uNewPC The new program counter (RIP) value (loaded from the
927 * operand).
928 */
929IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
930{
931 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
932 if (!IEM_IS_CANONICAL(uNewPC))
933 return iemRaiseGeneralProtectionFault0(pVCpu);
934
935 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
936 if (rcStrict != VINF_SUCCESS)
937 return rcStrict;
938
939 pVCpu->cpum.GstCtx.rip = uNewPC;
940 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
941
942#ifndef IEM_WITH_CODE_TLB
943 /* Flush the prefetch buffer. */
944 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
945#endif
946 return VINF_SUCCESS;
947}
948
949
950/**
951 * Implements a 64-bit relative call.
952 *
953 * @param offDisp The displacment offset.
954 */
955IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
956{
957 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
958 uint64_t uNewPC = uOldPC + offDisp;
959 if (!IEM_IS_CANONICAL(uNewPC))
960 return iemRaiseNotCanonical(pVCpu);
961
962 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
963 if (rcStrict != VINF_SUCCESS)
964 return rcStrict;
965
966 pVCpu->cpum.GstCtx.rip = uNewPC;
967 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
968
969#ifndef IEM_WITH_CODE_TLB
970 /* Flush the prefetch buffer. */
971 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
972#endif
973
974 return VINF_SUCCESS;
975}
976
977
978/**
979 * Implements far jumps and calls thru task segments (TSS).
980 *
981 * @param uSel The selector.
982 * @param enmBranch The kind of branching we're performing.
983 * @param enmEffOpSize The effective operand size.
984 * @param pDesc The descriptor corresponding to @a uSel. The type is
985 * task gate.
986 */
987IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
988{
989#ifndef IEM_IMPLEMENTS_TASKSWITCH
990 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
991#else
992 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
993 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
994 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
995 RT_NOREF_PV(enmEffOpSize);
996 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
997
998 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
999 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1000 {
1001 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1002 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1003 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1004 }
1005
1006 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1007 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1008 * checked here, need testcases. */
1009 if (!pDesc->Legacy.Gen.u1Present)
1010 {
1011 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1012 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1013 }
1014
1015 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1016 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1017 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1018#endif
1019}
1020
1021
1022/**
1023 * Implements far jumps and calls thru task gates.
1024 *
1025 * @param uSel The selector.
1026 * @param enmBranch The kind of branching we're performing.
1027 * @param enmEffOpSize The effective operand size.
1028 * @param pDesc The descriptor corresponding to @a uSel. The type is
1029 * task gate.
1030 */
1031IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1032{
1033#ifndef IEM_IMPLEMENTS_TASKSWITCH
1034 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1035#else
1036 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1037 RT_NOREF_PV(enmEffOpSize);
1038 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1039
1040 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1041 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1042 {
1043 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1044 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1045 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1046 }
1047
1048 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1049 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1050 * checked here, need testcases. */
1051 if (!pDesc->Legacy.Gen.u1Present)
1052 {
1053 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1054 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1055 }
1056
1057 /*
1058 * Fetch the new TSS descriptor from the GDT.
1059 */
1060 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1061 if (uSelTss & X86_SEL_LDT)
1062 {
1063 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1064 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1065 }
1066
1067 IEMSELDESC TssDesc;
1068 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1069 if (rcStrict != VINF_SUCCESS)
1070 return rcStrict;
1071
1072 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1073 {
1074 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1075 TssDesc.Legacy.Gate.u4Type));
1076 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1077 }
1078
1079 if (!TssDesc.Legacy.Gate.u1Present)
1080 {
1081 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1082 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1083 }
1084
1085 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1086 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1087 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1088#endif
1089}
1090
1091
1092/**
1093 * Implements far jumps and calls thru call gates.
1094 *
1095 * @param uSel The selector.
1096 * @param enmBranch The kind of branching we're performing.
1097 * @param enmEffOpSize The effective operand size.
1098 * @param pDesc The descriptor corresponding to @a uSel. The type is
1099 * call gate.
1100 */
1101IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1102{
1103#define IEM_IMPLEMENTS_CALLGATE
1104#ifndef IEM_IMPLEMENTS_CALLGATE
1105 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1106#else
1107 RT_NOREF_PV(enmEffOpSize);
1108 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1109
1110 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1111 * inter-privilege calls and are much more complex.
1112 *
1113 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1114 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1115 * must be 16-bit or 32-bit.
1116 */
1117 /** @todo effective operand size is probably irrelevant here, only the
1118 * call gate bitness matters??
1119 */
1120 VBOXSTRICTRC rcStrict;
1121 RTPTRUNION uPtrRet;
1122 uint64_t uNewRsp;
1123 uint64_t uNewRip;
1124 uint64_t u64Base;
1125 uint32_t cbLimit;
1126 RTSEL uNewCS;
1127 IEMSELDESC DescCS;
1128
1129 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1130 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1131 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1132 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1133
1134 /* Determine the new instruction pointer from the gate descriptor. */
1135 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1136 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1137 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1138
1139 /* Perform DPL checks on the gate descriptor. */
1140 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1141 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1142 {
1143 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1144 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1145 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1146 }
1147
1148 /** @todo does this catch NULL selectors, too? */
1149 if (!pDesc->Legacy.Gen.u1Present)
1150 {
1151 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1152 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1153 }
1154
1155 /*
1156 * Fetch the target CS descriptor from the GDT or LDT.
1157 */
1158 uNewCS = pDesc->Legacy.Gate.u16Sel;
1159 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1160 if (rcStrict != VINF_SUCCESS)
1161 return rcStrict;
1162
1163 /* Target CS must be a code selector. */
1164 if ( !DescCS.Legacy.Gen.u1DescType
1165 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1166 {
1167 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1168 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1169 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1170 }
1171
1172 /* Privilege checks on target CS. */
1173 if (enmBranch == IEMBRANCH_JUMP)
1174 {
1175 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1176 {
1177 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1178 {
1179 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1180 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1181 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1182 }
1183 }
1184 else
1185 {
1186 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1187 {
1188 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1189 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1190 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1191 }
1192 }
1193 }
1194 else
1195 {
1196 Assert(enmBranch == IEMBRANCH_CALL);
1197 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1198 {
1199 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1200 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1201 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1202 }
1203 }
1204
1205 /* Additional long mode checks. */
1206 if (IEM_IS_LONG_MODE(pVCpu))
1207 {
1208 if (!DescCS.Legacy.Gen.u1Long)
1209 {
1210 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1211 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1212 }
1213
1214 /* L vs D. */
1215 if ( DescCS.Legacy.Gen.u1Long
1216 && DescCS.Legacy.Gen.u1DefBig)
1217 {
1218 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1219 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1220 }
1221 }
1222
1223 if (!DescCS.Legacy.Gate.u1Present)
1224 {
1225 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1226 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1227 }
1228
1229 if (enmBranch == IEMBRANCH_JUMP)
1230 {
1231 /** @todo This is very similar to regular far jumps; merge! */
1232 /* Jumps are fairly simple... */
1233
1234 /* Chop the high bits off if 16-bit gate (Intel says so). */
1235 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1236 uNewRip = (uint16_t)uNewRip;
1237
1238 /* Limit check for non-long segments. */
1239 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1240 if (DescCS.Legacy.Gen.u1Long)
1241 u64Base = 0;
1242 else
1243 {
1244 if (uNewRip > cbLimit)
1245 {
1246 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1247 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1248 }
1249 u64Base = X86DESC_BASE(&DescCS.Legacy);
1250 }
1251
1252 /* Canonical address check. */
1253 if (!IEM_IS_CANONICAL(uNewRip))
1254 {
1255 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1256 return iemRaiseNotCanonical(pVCpu);
1257 }
1258
1259 /*
1260 * Ok, everything checked out fine. Now set the accessed bit before
1261 * committing the result into CS, CSHID and RIP.
1262 */
1263 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1264 {
1265 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1266 if (rcStrict != VINF_SUCCESS)
1267 return rcStrict;
1268 /** @todo check what VT-x and AMD-V does. */
1269 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1270 }
1271
1272 /* commit */
1273 pVCpu->cpum.GstCtx.rip = uNewRip;
1274 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1275 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1276 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1277 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1278 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1279 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1280 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1281 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1282 }
1283 else
1284 {
1285 Assert(enmBranch == IEMBRANCH_CALL);
1286 /* Calls are much more complicated. */
1287
1288 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1289 {
1290 uint16_t offNewStack; /* Offset of new stack in TSS. */
1291 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1292 uint8_t uNewCSDpl;
1293 uint8_t cbWords;
1294 RTSEL uNewSS;
1295 RTSEL uOldSS;
1296 uint64_t uOldRsp;
1297 IEMSELDESC DescSS;
1298 RTPTRUNION uPtrTSS;
1299 RTGCPTR GCPtrTSS;
1300 RTPTRUNION uPtrParmWds;
1301 RTGCPTR GCPtrParmWds;
1302
1303 /* More privilege. This is the fun part. */
1304 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1305
1306 /*
1307 * Determine new SS:rSP from the TSS.
1308 */
1309 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1310
1311 /* Figure out where the new stack pointer is stored in the TSS. */
1312 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1313 if (!IEM_IS_LONG_MODE(pVCpu))
1314 {
1315 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1316 {
1317 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1318 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1319 }
1320 else
1321 {
1322 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1323 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1324 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1325 }
1326 }
1327 else
1328 {
1329 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1330 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1331 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1332 }
1333
1334 /* Check against TSS limit. */
1335 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1336 {
1337 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1338 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1339 }
1340
1341 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1342 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
1343 if (rcStrict != VINF_SUCCESS)
1344 {
1345 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1346 return rcStrict;
1347 }
1348
1349 if (!IEM_IS_LONG_MODE(pVCpu))
1350 {
1351 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1352 {
1353 uNewRsp = uPtrTSS.pu32[0];
1354 uNewSS = uPtrTSS.pu16[2];
1355 }
1356 else
1357 {
1358 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1359 uNewRsp = uPtrTSS.pu16[0];
1360 uNewSS = uPtrTSS.pu16[1];
1361 }
1362 }
1363 else
1364 {
1365 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1366 /* SS will be a NULL selector, but that's valid. */
1367 uNewRsp = uPtrTSS.pu64[0];
1368 uNewSS = uNewCSDpl;
1369 }
1370
1371 /* Done with the TSS now. */
1372 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1373 if (rcStrict != VINF_SUCCESS)
1374 {
1375 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1376 return rcStrict;
1377 }
1378
1379 /* Only used outside of long mode. */
1380 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1381
1382 /* If EFER.LMA is 0, there's extra work to do. */
1383 if (!IEM_IS_LONG_MODE(pVCpu))
1384 {
1385 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1386 {
1387 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1388 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1389 }
1390
1391 /* Grab the new SS descriptor. */
1392 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1393 if (rcStrict != VINF_SUCCESS)
1394 return rcStrict;
1395
1396 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1397 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1398 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1399 {
1400 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1401 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1402 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1403 }
1404
1405 /* Ensure new SS is a writable data segment. */
1406 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1407 {
1408 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1409 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1410 }
1411
1412 if (!DescSS.Legacy.Gen.u1Present)
1413 {
1414 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1415 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1416 }
1417 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1418 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1419 else
1420 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1421 }
1422 else
1423 {
1424 /* Just grab the new (NULL) SS descriptor. */
1425 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1426 * like we do... */
1427 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1428 if (rcStrict != VINF_SUCCESS)
1429 return rcStrict;
1430
1431 cbNewStack = sizeof(uint64_t) * 4;
1432 }
1433
1434 /** @todo According to Intel, new stack is checked for enough space first,
1435 * then switched. According to AMD, the stack is switched first and
1436 * then pushes might fault!
1437 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1438 * incoming stack \#PF happens before actual stack switch. AMD is
1439 * either lying or implicitly assumes that new state is committed
1440 * only if and when an instruction doesn't fault.
1441 */
1442
1443 /** @todo According to AMD, CS is loaded first, then SS.
1444 * According to Intel, it's the other way around!?
1445 */
1446
1447 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1448
1449 /* Set the accessed bit before committing new SS. */
1450 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1451 {
1452 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1453 if (rcStrict != VINF_SUCCESS)
1454 return rcStrict;
1455 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1456 }
1457
1458 /* Remember the old SS:rSP and their linear address. */
1459 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1460 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1461
1462 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1463
1464 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1465 or #PF, the former is not implemented in this workaround. */
1466 /** @todo Proper fix callgate target stack exceptions. */
1467 /** @todo testcase: Cover callgates with partially or fully inaccessible
1468 * target stacks. */
1469 void *pvNewFrame;
1470 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1471 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1472 if (rcStrict != VINF_SUCCESS)
1473 {
1474 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1475 return rcStrict;
1476 }
1477 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1478 if (rcStrict != VINF_SUCCESS)
1479 {
1480 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1481 return rcStrict;
1482 }
1483
1484 /* Commit new SS:rSP. */
1485 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1486 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1487 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1488 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1489 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1490 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1491 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1492 pVCpu->iem.s.uCpl = uNewCSDpl; /** @todo is the parameter words accessed using the new CPL or the old CPL? */
1493 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1494 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1495
1496 /* At this point the stack access must not fail because new state was already committed. */
1497 /** @todo this can still fail due to SS.LIMIT not check. */
1498 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1499 IEM_IS_LONG_MODE(pVCpu) ? 7
1500 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1501 &uPtrRet.pv, &uNewRsp);
1502 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1503 VERR_INTERNAL_ERROR_5);
1504
1505 if (!IEM_IS_LONG_MODE(pVCpu))
1506 {
1507 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1508 {
1509 if (cbWords)
1510 {
1511 /* Map the relevant chunk of the old stack. */
1512 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1513 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1514 if (rcStrict != VINF_SUCCESS)
1515 {
1516 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1517 return rcStrict;
1518 }
1519
1520 /* Copy the parameter (d)words. */
1521 for (int i = 0; i < cbWords; ++i)
1522 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1523
1524 /* Unmap the old stack. */
1525 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1526 if (rcStrict != VINF_SUCCESS)
1527 {
1528 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1529 return rcStrict;
1530 }
1531 }
1532
1533 /* Push the old CS:rIP. */
1534 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1535 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1536
1537 /* Push the old SS:rSP. */
1538 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1539 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1540 }
1541 else
1542 {
1543 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1544
1545 if (cbWords)
1546 {
1547 /* Map the relevant chunk of the old stack. */
1548 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1549 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1550 if (rcStrict != VINF_SUCCESS)
1551 {
1552 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1553 return rcStrict;
1554 }
1555
1556 /* Copy the parameter words. */
1557 for (int i = 0; i < cbWords; ++i)
1558 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1559
1560 /* Unmap the old stack. */
1561 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1562 if (rcStrict != VINF_SUCCESS)
1563 {
1564 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1565 return rcStrict;
1566 }
1567 }
1568
1569 /* Push the old CS:rIP. */
1570 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1571 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1572
1573 /* Push the old SS:rSP. */
1574 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1575 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1576 }
1577 }
1578 else
1579 {
1580 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1581
1582 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1583 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1584 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1585 uPtrRet.pu64[2] = uOldRsp;
1586 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1587 }
1588
1589 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1590 if (rcStrict != VINF_SUCCESS)
1591 {
1592 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1593 return rcStrict;
1594 }
1595
1596 /* Chop the high bits off if 16-bit gate (Intel says so). */
1597 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1598 uNewRip = (uint16_t)uNewRip;
1599
1600 /* Limit / canonical check. */
1601 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1602 if (!IEM_IS_LONG_MODE(pVCpu))
1603 {
1604 if (uNewRip > cbLimit)
1605 {
1606 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1607 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1608 }
1609 u64Base = X86DESC_BASE(&DescCS.Legacy);
1610 }
1611 else
1612 {
1613 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1614 if (!IEM_IS_CANONICAL(uNewRip))
1615 {
1616 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1617 return iemRaiseNotCanonical(pVCpu);
1618 }
1619 u64Base = 0;
1620 }
1621
1622 /*
1623 * Now set the accessed bit before
1624 * writing the return address to the stack and committing the result into
1625 * CS, CSHID and RIP.
1626 */
1627 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1628 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1629 {
1630 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1631 if (rcStrict != VINF_SUCCESS)
1632 return rcStrict;
1633 /** @todo check what VT-x and AMD-V does. */
1634 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1635 }
1636
1637 /* Commit new CS:rIP. */
1638 pVCpu->cpum.GstCtx.rip = uNewRip;
1639 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1640 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1641 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1642 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1643 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1644 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1645 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1646 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1647 }
1648 else
1649 {
1650 /* Same privilege. */
1651 /** @todo This is very similar to regular far calls; merge! */
1652
1653 /* Check stack first - may #SS(0). */
1654 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1655 * 16-bit code cause a two or four byte CS to be pushed? */
1656 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1657 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1658 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1659 IEM_IS_LONG_MODE(pVCpu) ? 7
1660 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1661 &uPtrRet.pv, &uNewRsp);
1662 if (rcStrict != VINF_SUCCESS)
1663 return rcStrict;
1664
1665 /* Chop the high bits off if 16-bit gate (Intel says so). */
1666 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1667 uNewRip = (uint16_t)uNewRip;
1668
1669 /* Limit / canonical check. */
1670 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1671 if (!IEM_IS_LONG_MODE(pVCpu))
1672 {
1673 if (uNewRip > cbLimit)
1674 {
1675 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1676 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1677 }
1678 u64Base = X86DESC_BASE(&DescCS.Legacy);
1679 }
1680 else
1681 {
1682 if (!IEM_IS_CANONICAL(uNewRip))
1683 {
1684 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1685 return iemRaiseNotCanonical(pVCpu);
1686 }
1687 u64Base = 0;
1688 }
1689
1690 /*
1691 * Now set the accessed bit before
1692 * writing the return address to the stack and committing the result into
1693 * CS, CSHID and RIP.
1694 */
1695 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1696 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1697 {
1698 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1699 if (rcStrict != VINF_SUCCESS)
1700 return rcStrict;
1701 /** @todo check what VT-x and AMD-V does. */
1702 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1703 }
1704
1705 /* stack */
1706 if (!IEM_IS_LONG_MODE(pVCpu))
1707 {
1708 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1709 {
1710 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1711 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1712 }
1713 else
1714 {
1715 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1716 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1717 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1718 }
1719 }
1720 else
1721 {
1722 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1723 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1724 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1725 }
1726
1727 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1728 if (rcStrict != VINF_SUCCESS)
1729 return rcStrict;
1730
1731 /* commit */
1732 pVCpu->cpum.GstCtx.rip = uNewRip;
1733 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1734 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1735 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1736 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1737 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1738 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1739 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1740 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1741 }
1742 }
1743 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1744
1745 /* Flush the prefetch buffer. */
1746# ifdef IEM_WITH_CODE_TLB
1747 pVCpu->iem.s.pbInstrBuf = NULL;
1748# else
1749 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1750# endif
1751 return VINF_SUCCESS;
1752#endif
1753}
1754
1755
1756/**
1757 * Implements far jumps and calls thru system selectors.
1758 *
1759 * @param uSel The selector.
1760 * @param enmBranch The kind of branching we're performing.
1761 * @param enmEffOpSize The effective operand size.
1762 * @param pDesc The descriptor corresponding to @a uSel.
1763 */
1764IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1765{
1766 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1767 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1768 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1769
1770 if (IEM_IS_LONG_MODE(pVCpu))
1771 switch (pDesc->Legacy.Gen.u4Type)
1772 {
1773 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1774 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1775
1776 default:
1777 case AMD64_SEL_TYPE_SYS_LDT:
1778 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1779 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1780 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1781 case AMD64_SEL_TYPE_SYS_INT_GATE:
1782 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1783 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1784 }
1785
1786 switch (pDesc->Legacy.Gen.u4Type)
1787 {
1788 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1789 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1790 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1791
1792 case X86_SEL_TYPE_SYS_TASK_GATE:
1793 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1794
1795 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1796 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1797 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1798
1799 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1800 Log(("branch %04x -> busy 286 TSS\n", uSel));
1801 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1802
1803 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1804 Log(("branch %04x -> busy 386 TSS\n", uSel));
1805 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1806
1807 default:
1808 case X86_SEL_TYPE_SYS_LDT:
1809 case X86_SEL_TYPE_SYS_286_INT_GATE:
1810 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1811 case X86_SEL_TYPE_SYS_386_INT_GATE:
1812 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1813 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1814 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1815 }
1816}
1817
1818
1819/**
1820 * Implements far jumps.
1821 *
1822 * @param uSel The selector.
1823 * @param offSeg The segment offset.
1824 * @param enmEffOpSize The effective operand size.
1825 */
1826IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1827{
1828 NOREF(cbInstr);
1829 Assert(offSeg <= UINT32_MAX);
1830
1831 /*
1832 * Real mode and V8086 mode are easy. The only snag seems to be that
1833 * CS.limit doesn't change and the limit check is done against the current
1834 * limit.
1835 */
1836 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1837 * 1998) that up to and including the Intel 486, far control
1838 * transfers in real mode set default CS attributes (0x93) and also
1839 * set a 64K segment limit. Starting with the Pentium, the
1840 * attributes and limit are left alone but the access rights are
1841 * ignored. We only implement the Pentium+ behavior.
1842 * */
1843 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1844 {
1845 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1846 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1847 {
1848 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1849 return iemRaiseGeneralProtectionFault0(pVCpu);
1850 }
1851
1852 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1853 pVCpu->cpum.GstCtx.rip = offSeg;
1854 else
1855 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1856 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1857 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1858 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1859 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1860 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1861 return VINF_SUCCESS;
1862 }
1863
1864 /*
1865 * Protected mode. Need to parse the specified descriptor...
1866 */
1867 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1868 {
1869 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1870 return iemRaiseGeneralProtectionFault0(pVCpu);
1871 }
1872
1873 /* Fetch the descriptor. */
1874 IEMSELDESC Desc;
1875 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1876 if (rcStrict != VINF_SUCCESS)
1877 return rcStrict;
1878
1879 /* Is it there? */
1880 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1881 {
1882 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1883 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1884 }
1885
1886 /*
1887 * Deal with it according to its type. We do the standard code selectors
1888 * here and dispatch the system selectors to worker functions.
1889 */
1890 if (!Desc.Legacy.Gen.u1DescType)
1891 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1892
1893 /* Only code segments. */
1894 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1895 {
1896 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1897 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1898 }
1899
1900 /* L vs D. */
1901 if ( Desc.Legacy.Gen.u1Long
1902 && Desc.Legacy.Gen.u1DefBig
1903 && IEM_IS_LONG_MODE(pVCpu))
1904 {
1905 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1906 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1907 }
1908
1909 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1910 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1911 {
1912 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1913 {
1914 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1915 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1916 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1917 }
1918 }
1919 else
1920 {
1921 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1922 {
1923 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1924 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1925 }
1926 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1927 {
1928 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1929 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1930 }
1931 }
1932
1933 /* Chop the high bits if 16-bit (Intel says so). */
1934 if (enmEffOpSize == IEMMODE_16BIT)
1935 offSeg &= UINT16_MAX;
1936
1937 /* Limit check. (Should alternatively check for non-canonical addresses
1938 here, but that is ruled out by offSeg being 32-bit, right?) */
1939 uint64_t u64Base;
1940 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1941 if (Desc.Legacy.Gen.u1Long)
1942 u64Base = 0;
1943 else
1944 {
1945 if (offSeg > cbLimit)
1946 {
1947 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1948 /** @todo Intel says this is \#GP(0)! */
1949 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1950 }
1951 u64Base = X86DESC_BASE(&Desc.Legacy);
1952 }
1953
1954 /*
1955 * Ok, everything checked out fine. Now set the accessed bit before
1956 * committing the result into CS, CSHID and RIP.
1957 */
1958 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1959 {
1960 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1961 if (rcStrict != VINF_SUCCESS)
1962 return rcStrict;
1963 /** @todo check what VT-x and AMD-V does. */
1964 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1965 }
1966
1967 /* commit */
1968 pVCpu->cpum.GstCtx.rip = offSeg;
1969 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1970 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1971 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1972 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1973 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1974 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1975 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1976 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1977 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1978 /** @todo check if the hidden bits are loaded correctly for 64-bit
1979 * mode. */
1980
1981 /* Flush the prefetch buffer. */
1982#ifdef IEM_WITH_CODE_TLB
1983 pVCpu->iem.s.pbInstrBuf = NULL;
1984#else
1985 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1986#endif
1987
1988 return VINF_SUCCESS;
1989}
1990
1991
1992/**
1993 * Implements far calls.
1994 *
1995 * This very similar to iemCImpl_FarJmp.
1996 *
1997 * @param uSel The selector.
1998 * @param offSeg The segment offset.
1999 * @param enmEffOpSize The operand size (in case we need it).
2000 */
2001IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
2002{
2003 VBOXSTRICTRC rcStrict;
2004 uint64_t uNewRsp;
2005 RTPTRUNION uPtrRet;
2006
2007 /*
2008 * Real mode and V8086 mode are easy. The only snag seems to be that
2009 * CS.limit doesn't change and the limit check is done against the current
2010 * limit.
2011 */
2012 /** @todo See comment for similar code in iemCImpl_FarJmp */
2013 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2014 {
2015 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2016
2017 /* Check stack first - may #SS(0). */
2018 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2019 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2020 &uPtrRet.pv, &uNewRsp);
2021 if (rcStrict != VINF_SUCCESS)
2022 return rcStrict;
2023
2024 /* Check the target address range. */
2025 if (offSeg > UINT32_MAX)
2026 return iemRaiseGeneralProtectionFault0(pVCpu);
2027
2028 /* Everything is fine, push the return address. */
2029 if (enmEffOpSize == IEMMODE_16BIT)
2030 {
2031 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2032 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2033 }
2034 else
2035 {
2036 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2037 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2038 }
2039 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2040 if (rcStrict != VINF_SUCCESS)
2041 return rcStrict;
2042
2043 /* Branch. */
2044 pVCpu->cpum.GstCtx.rip = offSeg;
2045 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2046 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2047 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2048 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2049 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2050 return VINF_SUCCESS;
2051 }
2052
2053 /*
2054 * Protected mode. Need to parse the specified descriptor...
2055 */
2056 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2057 {
2058 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2059 return iemRaiseGeneralProtectionFault0(pVCpu);
2060 }
2061
2062 /* Fetch the descriptor. */
2063 IEMSELDESC Desc;
2064 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2065 if (rcStrict != VINF_SUCCESS)
2066 return rcStrict;
2067
2068 /*
2069 * Deal with it according to its type. We do the standard code selectors
2070 * here and dispatch the system selectors to worker functions.
2071 */
2072 if (!Desc.Legacy.Gen.u1DescType)
2073 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2074
2075 /* Only code segments. */
2076 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2077 {
2078 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2079 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2080 }
2081
2082 /* L vs D. */
2083 if ( Desc.Legacy.Gen.u1Long
2084 && Desc.Legacy.Gen.u1DefBig
2085 && IEM_IS_LONG_MODE(pVCpu))
2086 {
2087 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2088 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2089 }
2090
2091 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2092 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2093 {
2094 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2095 {
2096 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2097 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2098 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2099 }
2100 }
2101 else
2102 {
2103 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2104 {
2105 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2106 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2107 }
2108 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2109 {
2110 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2111 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2112 }
2113 }
2114
2115 /* Is it there? */
2116 if (!Desc.Legacy.Gen.u1Present)
2117 {
2118 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2119 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2120 }
2121
2122 /* Check stack first - may #SS(0). */
2123 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2124 * 16-bit code cause a two or four byte CS to be pushed? */
2125 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2126 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2127 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2128 &uPtrRet.pv, &uNewRsp);
2129 if (rcStrict != VINF_SUCCESS)
2130 return rcStrict;
2131
2132 /* Chop the high bits if 16-bit (Intel says so). */
2133 if (enmEffOpSize == IEMMODE_16BIT)
2134 offSeg &= UINT16_MAX;
2135
2136 /* Limit / canonical check. */
2137 uint64_t u64Base;
2138 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2139 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2140 {
2141 if (!IEM_IS_CANONICAL(offSeg))
2142 {
2143 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2144 return iemRaiseNotCanonical(pVCpu);
2145 }
2146 u64Base = 0;
2147 }
2148 else
2149 {
2150 if (offSeg > cbLimit)
2151 {
2152 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2153 /** @todo Intel says this is \#GP(0)! */
2154 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2155 }
2156 u64Base = X86DESC_BASE(&Desc.Legacy);
2157 }
2158
2159 /*
2160 * Now set the accessed bit before
2161 * writing the return address to the stack and committing the result into
2162 * CS, CSHID and RIP.
2163 */
2164 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2165 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2166 {
2167 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2168 if (rcStrict != VINF_SUCCESS)
2169 return rcStrict;
2170 /** @todo check what VT-x and AMD-V does. */
2171 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2172 }
2173
2174 /* stack */
2175 if (enmEffOpSize == IEMMODE_16BIT)
2176 {
2177 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2178 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2179 }
2180 else if (enmEffOpSize == IEMMODE_32BIT)
2181 {
2182 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2183 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2184 }
2185 else
2186 {
2187 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2188 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2189 }
2190 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2191 if (rcStrict != VINF_SUCCESS)
2192 return rcStrict;
2193
2194 /* commit */
2195 pVCpu->cpum.GstCtx.rip = offSeg;
2196 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2197 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2198 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2199 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2200 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2201 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2202 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2203 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2204 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2205 /** @todo check if the hidden bits are loaded correctly for 64-bit
2206 * mode. */
2207
2208 /* Flush the prefetch buffer. */
2209#ifdef IEM_WITH_CODE_TLB
2210 pVCpu->iem.s.pbInstrBuf = NULL;
2211#else
2212 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2213#endif
2214 return VINF_SUCCESS;
2215}
2216
2217
2218/**
2219 * Implements retf.
2220 *
2221 * @param enmEffOpSize The effective operand size.
2222 * @param cbPop The amount of arguments to pop from the stack
2223 * (bytes).
2224 */
2225IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2226{
2227 VBOXSTRICTRC rcStrict;
2228 RTCPTRUNION uPtrFrame;
2229 uint64_t uNewRsp;
2230 uint64_t uNewRip;
2231 uint16_t uNewCs;
2232 NOREF(cbInstr);
2233
2234 /*
2235 * Read the stack values first.
2236 */
2237 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2238 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2239 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2240 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2241 &uPtrFrame.pv, &uNewRsp);
2242 if (rcStrict != VINF_SUCCESS)
2243 return rcStrict;
2244 if (enmEffOpSize == IEMMODE_16BIT)
2245 {
2246 uNewRip = uPtrFrame.pu16[0];
2247 uNewCs = uPtrFrame.pu16[1];
2248 }
2249 else if (enmEffOpSize == IEMMODE_32BIT)
2250 {
2251 uNewRip = uPtrFrame.pu32[0];
2252 uNewCs = uPtrFrame.pu16[2];
2253 }
2254 else
2255 {
2256 uNewRip = uPtrFrame.pu64[0];
2257 uNewCs = uPtrFrame.pu16[4];
2258 }
2259 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2260 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2261 { /* extremely likely */ }
2262 else
2263 return rcStrict;
2264
2265 /*
2266 * Real mode and V8086 mode are easy.
2267 */
2268 /** @todo See comment for similar code in iemCImpl_FarJmp */
2269 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2270 {
2271 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2272 /** @todo check how this is supposed to work if sp=0xfffe. */
2273
2274 /* Check the limit of the new EIP. */
2275 /** @todo Intel pseudo code only does the limit check for 16-bit
2276 * operands, AMD does not make any distinction. What is right? */
2277 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2278 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2279
2280 /* commit the operation. */
2281 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2282 pVCpu->cpum.GstCtx.rip = uNewRip;
2283 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2284 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2285 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2286 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2287 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2288 if (cbPop)
2289 iemRegAddToRsp(pVCpu, cbPop);
2290 return VINF_SUCCESS;
2291 }
2292
2293 /*
2294 * Protected mode is complicated, of course.
2295 */
2296 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2297 {
2298 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2299 return iemRaiseGeneralProtectionFault0(pVCpu);
2300 }
2301
2302 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2303
2304 /* Fetch the descriptor. */
2305 IEMSELDESC DescCs;
2306 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2307 if (rcStrict != VINF_SUCCESS)
2308 return rcStrict;
2309
2310 /* Can only return to a code selector. */
2311 if ( !DescCs.Legacy.Gen.u1DescType
2312 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2313 {
2314 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2315 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2316 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2317 }
2318
2319 /* L vs D. */
2320 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2321 && DescCs.Legacy.Gen.u1DefBig
2322 && IEM_IS_LONG_MODE(pVCpu))
2323 {
2324 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2325 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2326 }
2327
2328 /* DPL/RPL/CPL checks. */
2329 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2330 {
2331 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2332 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2333 }
2334
2335 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2336 {
2337 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2338 {
2339 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2340 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2341 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2342 }
2343 }
2344 else
2345 {
2346 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2347 {
2348 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2349 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2350 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2351 }
2352 }
2353
2354 /* Is it there? */
2355 if (!DescCs.Legacy.Gen.u1Present)
2356 {
2357 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2358 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2359 }
2360
2361 /*
2362 * Return to outer privilege? (We'll typically have entered via a call gate.)
2363 */
2364 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2365 {
2366 /* Read the outer stack pointer stored *after* the parameters. */
2367 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, uNewRsp);
2368 if (rcStrict != VINF_SUCCESS)
2369 return rcStrict;
2370
2371 uint16_t uNewOuterSs;
2372 uint64_t uNewOuterRsp;
2373 if (enmEffOpSize == IEMMODE_16BIT)
2374 {
2375 uNewOuterRsp = uPtrFrame.pu16[0];
2376 uNewOuterSs = uPtrFrame.pu16[1];
2377 }
2378 else if (enmEffOpSize == IEMMODE_32BIT)
2379 {
2380 uNewOuterRsp = uPtrFrame.pu32[0];
2381 uNewOuterSs = uPtrFrame.pu16[2];
2382 }
2383 else
2384 {
2385 uNewOuterRsp = uPtrFrame.pu64[0];
2386 uNewOuterSs = uPtrFrame.pu16[4];
2387 }
2388 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2389 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2390 { /* extremely likely */ }
2391 else
2392 return rcStrict;
2393
2394 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2395 and read the selector. */
2396 IEMSELDESC DescSs;
2397 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2398 {
2399 if ( !DescCs.Legacy.Gen.u1Long
2400 || (uNewOuterSs & X86_SEL_RPL) == 3)
2401 {
2402 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2403 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2404 return iemRaiseGeneralProtectionFault0(pVCpu);
2405 }
2406 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2407 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2408 }
2409 else
2410 {
2411 /* Fetch the descriptor for the new stack segment. */
2412 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2413 if (rcStrict != VINF_SUCCESS)
2414 return rcStrict;
2415 }
2416
2417 /* Check that RPL of stack and code selectors match. */
2418 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2419 {
2420 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2421 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2422 }
2423
2424 /* Must be a writable data segment. */
2425 if ( !DescSs.Legacy.Gen.u1DescType
2426 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2427 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2428 {
2429 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2430 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2431 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2432 }
2433
2434 /* L vs D. (Not mentioned by intel.) */
2435 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2436 && DescSs.Legacy.Gen.u1DefBig
2437 && IEM_IS_LONG_MODE(pVCpu))
2438 {
2439 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2440 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2441 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2442 }
2443
2444 /* DPL/RPL/CPL checks. */
2445 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2446 {
2447 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2448 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2449 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2450 }
2451
2452 /* Is it there? */
2453 if (!DescSs.Legacy.Gen.u1Present)
2454 {
2455 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2456 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2457 }
2458
2459 /* Calc SS limit.*/
2460 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2461
2462 /* Is RIP canonical or within CS.limit? */
2463 uint64_t u64Base;
2464 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2465
2466 /** @todo Testcase: Is this correct? */
2467 if ( DescCs.Legacy.Gen.u1Long
2468 && IEM_IS_LONG_MODE(pVCpu) )
2469 {
2470 if (!IEM_IS_CANONICAL(uNewRip))
2471 {
2472 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2473 return iemRaiseNotCanonical(pVCpu);
2474 }
2475 u64Base = 0;
2476 }
2477 else
2478 {
2479 if (uNewRip > cbLimitCs)
2480 {
2481 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2482 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2483 /** @todo Intel says this is \#GP(0)! */
2484 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2485 }
2486 u64Base = X86DESC_BASE(&DescCs.Legacy);
2487 }
2488
2489 /*
2490 * Now set the accessed bit before
2491 * writing the return address to the stack and committing the result into
2492 * CS, CSHID and RIP.
2493 */
2494 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2495 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2496 {
2497 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2498 if (rcStrict != VINF_SUCCESS)
2499 return rcStrict;
2500 /** @todo check what VT-x and AMD-V does. */
2501 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2502 }
2503 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2504 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2505 {
2506 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2507 if (rcStrict != VINF_SUCCESS)
2508 return rcStrict;
2509 /** @todo check what VT-x and AMD-V does. */
2510 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2511 }
2512
2513 /* commit */
2514 if (enmEffOpSize == IEMMODE_16BIT)
2515 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2516 else
2517 pVCpu->cpum.GstCtx.rip = uNewRip;
2518 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2519 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2520 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2521 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2522 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2523 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2524 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2525 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2526 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2527 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2528 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2529 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2530 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2531 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2532 else
2533 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2534 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2535 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewOuterRsp;
2536 else
2537 pVCpu->cpum.GstCtx.rsp = uNewOuterRsp;
2538
2539 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2540 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2541 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2542 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2543 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2544
2545 /** @todo check if the hidden bits are loaded correctly for 64-bit
2546 * mode. */
2547
2548 if (cbPop)
2549 iemRegAddToRsp(pVCpu, cbPop);
2550 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2551
2552 /* Done! */
2553 }
2554 /*
2555 * Return to the same privilege level
2556 */
2557 else
2558 {
2559 /* Limit / canonical check. */
2560 uint64_t u64Base;
2561 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2562
2563 /** @todo Testcase: Is this correct? */
2564 if ( DescCs.Legacy.Gen.u1Long
2565 && IEM_IS_LONG_MODE(pVCpu) )
2566 {
2567 if (!IEM_IS_CANONICAL(uNewRip))
2568 {
2569 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2570 return iemRaiseNotCanonical(pVCpu);
2571 }
2572 u64Base = 0;
2573 }
2574 else
2575 {
2576 if (uNewRip > cbLimitCs)
2577 {
2578 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2579 /** @todo Intel says this is \#GP(0)! */
2580 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2581 }
2582 u64Base = X86DESC_BASE(&DescCs.Legacy);
2583 }
2584
2585 /*
2586 * Now set the accessed bit before
2587 * writing the return address to the stack and committing the result into
2588 * CS, CSHID and RIP.
2589 */
2590 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2591 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2592 {
2593 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2594 if (rcStrict != VINF_SUCCESS)
2595 return rcStrict;
2596 /** @todo check what VT-x and AMD-V does. */
2597 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2598 }
2599
2600 /* commit */
2601 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2602 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
2603 else
2604 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2605 if (enmEffOpSize == IEMMODE_16BIT)
2606 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2607 else
2608 pVCpu->cpum.GstCtx.rip = uNewRip;
2609 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2610 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2611 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2612 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2613 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2614 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2615 /** @todo check if the hidden bits are loaded correctly for 64-bit
2616 * mode. */
2617 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2618 if (cbPop)
2619 iemRegAddToRsp(pVCpu, cbPop);
2620 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2621 }
2622
2623 /* Flush the prefetch buffer. */
2624#ifdef IEM_WITH_CODE_TLB
2625 pVCpu->iem.s.pbInstrBuf = NULL;
2626#else
2627 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2628#endif
2629 return VINF_SUCCESS;
2630}
2631
2632
2633/**
2634 * Implements retn.
2635 *
2636 * We're doing this in C because of the \#GP that might be raised if the popped
2637 * program counter is out of bounds.
2638 *
2639 * @param enmEffOpSize The effective operand size.
2640 * @param cbPop The amount of arguments to pop from the stack
2641 * (bytes).
2642 */
2643IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2644{
2645 NOREF(cbInstr);
2646
2647 /* Fetch the RSP from the stack. */
2648 VBOXSTRICTRC rcStrict;
2649 RTUINT64U NewRip;
2650 RTUINT64U NewRsp;
2651 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2652
2653 switch (enmEffOpSize)
2654 {
2655 case IEMMODE_16BIT:
2656 NewRip.u = 0;
2657 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2658 break;
2659 case IEMMODE_32BIT:
2660 NewRip.u = 0;
2661 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2662 break;
2663 case IEMMODE_64BIT:
2664 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2665 break;
2666 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2667 }
2668 if (rcStrict != VINF_SUCCESS)
2669 return rcStrict;
2670
2671 /* Check the new RSP before loading it. */
2672 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2673 * of it. The canonical test is performed here and for call. */
2674 if (enmEffOpSize != IEMMODE_64BIT)
2675 {
2676 if (NewRip.DWords.dw0 > pVCpu->cpum.GstCtx.cs.u32Limit)
2677 {
2678 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2679 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2680 }
2681 }
2682 else
2683 {
2684 if (!IEM_IS_CANONICAL(NewRip.u))
2685 {
2686 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2687 return iemRaiseNotCanonical(pVCpu);
2688 }
2689 }
2690
2691 /* Apply cbPop */
2692 if (cbPop)
2693 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2694
2695 /* Commit it. */
2696 pVCpu->cpum.GstCtx.rip = NewRip.u;
2697 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2698 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2699
2700 /* Flush the prefetch buffer. */
2701#ifndef IEM_WITH_CODE_TLB
2702 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2703#endif
2704
2705 return VINF_SUCCESS;
2706}
2707
2708
2709/**
2710 * Implements enter.
2711 *
2712 * We're doing this in C because the instruction is insane, even for the
2713 * u8NestingLevel=0 case dealing with the stack is tedious.
2714 *
2715 * @param enmEffOpSize The effective operand size.
2716 * @param cbFrame Frame size.
2717 * @param cParameters Frame parameter count.
2718 */
2719IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2720{
2721 /* Push RBP, saving the old value in TmpRbp. */
2722 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2723 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2724 RTUINT64U NewRbp;
2725 VBOXSTRICTRC rcStrict;
2726 if (enmEffOpSize == IEMMODE_64BIT)
2727 {
2728 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2729 NewRbp = NewRsp;
2730 }
2731 else if (enmEffOpSize == IEMMODE_32BIT)
2732 {
2733 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2734 NewRbp = NewRsp;
2735 }
2736 else
2737 {
2738 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2739 NewRbp = TmpRbp;
2740 NewRbp.Words.w0 = NewRsp.Words.w0;
2741 }
2742 if (rcStrict != VINF_SUCCESS)
2743 return rcStrict;
2744
2745 /* Copy the parameters (aka nesting levels by Intel). */
2746 cParameters &= 0x1f;
2747 if (cParameters > 0)
2748 {
2749 switch (enmEffOpSize)
2750 {
2751 case IEMMODE_16BIT:
2752 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2753 TmpRbp.DWords.dw0 -= 2;
2754 else
2755 TmpRbp.Words.w0 -= 2;
2756 do
2757 {
2758 uint16_t u16Tmp;
2759 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2760 if (rcStrict != VINF_SUCCESS)
2761 break;
2762 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2763 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2764 break;
2765
2766 case IEMMODE_32BIT:
2767 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2768 TmpRbp.DWords.dw0 -= 4;
2769 else
2770 TmpRbp.Words.w0 -= 4;
2771 do
2772 {
2773 uint32_t u32Tmp;
2774 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2775 if (rcStrict != VINF_SUCCESS)
2776 break;
2777 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2778 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2779 break;
2780
2781 case IEMMODE_64BIT:
2782 TmpRbp.u -= 8;
2783 do
2784 {
2785 uint64_t u64Tmp;
2786 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2787 if (rcStrict != VINF_SUCCESS)
2788 break;
2789 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2790 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2791 break;
2792
2793 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2794 }
2795 if (rcStrict != VINF_SUCCESS)
2796 return VINF_SUCCESS;
2797
2798 /* Push the new RBP */
2799 if (enmEffOpSize == IEMMODE_64BIT)
2800 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2801 else if (enmEffOpSize == IEMMODE_32BIT)
2802 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2803 else
2804 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2805 if (rcStrict != VINF_SUCCESS)
2806 return rcStrict;
2807
2808 }
2809
2810 /* Recalc RSP. */
2811 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2812
2813 /** @todo Should probe write access at the new RSP according to AMD. */
2814 /** @todo Should handle accesses to the VMX APIC-access page. */
2815
2816 /* Commit it. */
2817 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2818 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2819 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2820
2821 return VINF_SUCCESS;
2822}
2823
2824
2825
2826/**
2827 * Implements leave.
2828 *
2829 * We're doing this in C because messing with the stack registers is annoying
2830 * since they depends on SS attributes.
2831 *
2832 * @param enmEffOpSize The effective operand size.
2833 */
2834IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2835{
2836 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2837 RTUINT64U NewRsp;
2838 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2839 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2840 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2841 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2842 else
2843 {
2844 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2845 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2846 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2847 }
2848
2849 /* Pop RBP according to the operand size. */
2850 VBOXSTRICTRC rcStrict;
2851 RTUINT64U NewRbp;
2852 switch (enmEffOpSize)
2853 {
2854 case IEMMODE_16BIT:
2855 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2856 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2857 break;
2858 case IEMMODE_32BIT:
2859 NewRbp.u = 0;
2860 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2861 break;
2862 case IEMMODE_64BIT:
2863 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2864 break;
2865 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2866 }
2867 if (rcStrict != VINF_SUCCESS)
2868 return rcStrict;
2869
2870
2871 /* Commit it. */
2872 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2873 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2874 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2875
2876 return VINF_SUCCESS;
2877}
2878
2879
2880/**
2881 * Implements int3 and int XX.
2882 *
2883 * @param u8Int The interrupt vector number.
2884 * @param enmInt The int instruction type.
2885 */
2886IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2887{
2888 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2889
2890 /*
2891 * We must check if this INT3 might belong to DBGF before raising a #BP.
2892 */
2893 if (u8Int == 3)
2894 {
2895 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2896 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2897 { /* likely: No vbox debugger breakpoints */ }
2898 else
2899 {
2900 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
2901 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2902 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2903 return iemSetPassUpStatus(pVCpu, rcStrict);
2904 }
2905 }
2906 return iemRaiseXcptOrInt(pVCpu,
2907 cbInstr,
2908 u8Int,
2909 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2910 0,
2911 0);
2912}
2913
2914
2915/**
2916 * Implements iret for real mode and V8086 mode.
2917 *
2918 * @param enmEffOpSize The effective operand size.
2919 */
2920IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2921{
2922 X86EFLAGS Efl;
2923 Efl.u = IEMMISC_GET_EFL(pVCpu);
2924 NOREF(cbInstr);
2925
2926 /*
2927 * iret throws an exception if VME isn't enabled.
2928 */
2929 if ( Efl.Bits.u1VM
2930 && Efl.Bits.u2IOPL != 3
2931 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2932 return iemRaiseGeneralProtectionFault0(pVCpu);
2933
2934 /*
2935 * Do the stack bits, but don't commit RSP before everything checks
2936 * out right.
2937 */
2938 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2939 VBOXSTRICTRC rcStrict;
2940 RTCPTRUNION uFrame;
2941 uint16_t uNewCs;
2942 uint32_t uNewEip;
2943 uint32_t uNewFlags;
2944 uint64_t uNewRsp;
2945 if (enmEffOpSize == IEMMODE_32BIT)
2946 {
2947 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
2948 if (rcStrict != VINF_SUCCESS)
2949 return rcStrict;
2950 uNewEip = uFrame.pu32[0];
2951 if (uNewEip > UINT16_MAX)
2952 return iemRaiseGeneralProtectionFault0(pVCpu);
2953
2954 uNewCs = (uint16_t)uFrame.pu32[1];
2955 uNewFlags = uFrame.pu32[2];
2956 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2957 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2958 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2959 | X86_EFL_ID;
2960 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2961 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2962 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2963 }
2964 else
2965 {
2966 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
2967 if (rcStrict != VINF_SUCCESS)
2968 return rcStrict;
2969 uNewEip = uFrame.pu16[0];
2970 uNewCs = uFrame.pu16[1];
2971 uNewFlags = uFrame.pu16[2];
2972 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2973 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2974 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2975 /** @todo The intel pseudo code does not indicate what happens to
2976 * reserved flags. We just ignore them. */
2977 /* Ancient CPU adjustments: See iemCImpl_popf. */
2978 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2979 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2980 }
2981 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2982 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2983 { /* extremely likely */ }
2984 else
2985 return rcStrict;
2986
2987 /** @todo Check how this is supposed to work if sp=0xfffe. */
2988 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2989 uNewCs, uNewEip, uNewFlags, uNewRsp));
2990
2991 /*
2992 * Check the limit of the new EIP.
2993 */
2994 /** @todo Only the AMD pseudo code check the limit here, what's
2995 * right? */
2996 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2997 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2998
2999 /*
3000 * V8086 checks and flag adjustments
3001 */
3002 if (Efl.Bits.u1VM)
3003 {
3004 if (Efl.Bits.u2IOPL == 3)
3005 {
3006 /* Preserve IOPL and clear RF. */
3007 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3008 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3009 }
3010 else if ( enmEffOpSize == IEMMODE_16BIT
3011 && ( !(uNewFlags & X86_EFL_IF)
3012 || !Efl.Bits.u1VIP )
3013 && !(uNewFlags & X86_EFL_TF) )
3014 {
3015 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3016 uNewFlags &= ~X86_EFL_VIF;
3017 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3018 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3019 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3020 }
3021 else
3022 return iemRaiseGeneralProtectionFault0(pVCpu);
3023 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3024 }
3025
3026 /*
3027 * Commit the operation.
3028 */
3029#ifdef DBGFTRACE_ENABLED
3030 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3031 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3032#endif
3033 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3034 pVCpu->cpum.GstCtx.rip = uNewEip;
3035 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3036 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3037 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3038 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3039 /** @todo do we load attribs and limit as well? */
3040 Assert(uNewFlags & X86_EFL_1);
3041 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3042
3043 /* Flush the prefetch buffer. */
3044#ifdef IEM_WITH_CODE_TLB
3045 pVCpu->iem.s.pbInstrBuf = NULL;
3046#else
3047 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3048#endif
3049
3050 return VINF_SUCCESS;
3051}
3052
3053
3054/**
3055 * Loads a segment register when entering V8086 mode.
3056 *
3057 * @param pSReg The segment register.
3058 * @param uSeg The segment to load.
3059 */
3060static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3061{
3062 pSReg->Sel = uSeg;
3063 pSReg->ValidSel = uSeg;
3064 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3065 pSReg->u64Base = (uint32_t)uSeg << 4;
3066 pSReg->u32Limit = 0xffff;
3067 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3068 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3069 * IRET'ing to V8086. */
3070}
3071
3072
3073/**
3074 * Implements iret for protected mode returning to V8086 mode.
3075 *
3076 * @param uNewEip The new EIP.
3077 * @param uNewCs The new CS.
3078 * @param uNewFlags The new EFLAGS.
3079 * @param uNewRsp The RSP after the initial IRET frame.
3080 *
3081 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3082 */
3083IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3084{
3085 RT_NOREF_PV(cbInstr);
3086 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3087
3088 /*
3089 * Pop the V8086 specific frame bits off the stack.
3090 */
3091 VBOXSTRICTRC rcStrict;
3092 RTCPTRUNION uFrame;
3093 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, uNewRsp);
3094 if (rcStrict != VINF_SUCCESS)
3095 return rcStrict;
3096 uint32_t uNewEsp = uFrame.pu32[0];
3097 uint16_t uNewSs = uFrame.pu32[1];
3098 uint16_t uNewEs = uFrame.pu32[2];
3099 uint16_t uNewDs = uFrame.pu32[3];
3100 uint16_t uNewFs = uFrame.pu32[4];
3101 uint16_t uNewGs = uFrame.pu32[5];
3102 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3103 if (rcStrict != VINF_SUCCESS)
3104 return rcStrict;
3105
3106 /*
3107 * Commit the operation.
3108 */
3109 uNewFlags &= X86_EFL_LIVE_MASK;
3110 uNewFlags |= X86_EFL_RA1_MASK;
3111#ifdef DBGFTRACE_ENABLED
3112 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3113 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3114#endif
3115 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3116
3117 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3118 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3119 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3120 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3121 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3122 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3123 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3124 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3125 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3126 pVCpu->iem.s.uCpl = 3;
3127
3128 /* Flush the prefetch buffer. */
3129#ifdef IEM_WITH_CODE_TLB
3130 pVCpu->iem.s.pbInstrBuf = NULL;
3131#else
3132 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3133#endif
3134
3135 return VINF_SUCCESS;
3136}
3137
3138
3139/**
3140 * Implements iret for protected mode returning via a nested task.
3141 *
3142 * @param enmEffOpSize The effective operand size.
3143 */
3144IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3145{
3146 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3147#ifndef IEM_IMPLEMENTS_TASKSWITCH
3148 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3149#else
3150 RT_NOREF_PV(enmEffOpSize);
3151
3152 /*
3153 * Read the segment selector in the link-field of the current TSS.
3154 */
3155 RTSEL uSelRet;
3156 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3157 if (rcStrict != VINF_SUCCESS)
3158 return rcStrict;
3159
3160 /*
3161 * Fetch the returning task's TSS descriptor from the GDT.
3162 */
3163 if (uSelRet & X86_SEL_LDT)
3164 {
3165 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3166 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3167 }
3168
3169 IEMSELDESC TssDesc;
3170 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3171 if (rcStrict != VINF_SUCCESS)
3172 return rcStrict;
3173
3174 if (TssDesc.Legacy.Gate.u1DescType)
3175 {
3176 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3177 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3178 }
3179
3180 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3181 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3182 {
3183 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3184 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3185 }
3186
3187 if (!TssDesc.Legacy.Gate.u1Present)
3188 {
3189 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3190 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3191 }
3192
3193 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3194 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3195 0 /* uCr2 */, uSelRet, &TssDesc);
3196#endif
3197}
3198
3199
3200/**
3201 * Implements iret for protected mode
3202 *
3203 * @param enmEffOpSize The effective operand size.
3204 */
3205IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3206{
3207 NOREF(cbInstr);
3208 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3209
3210 /*
3211 * Nested task return.
3212 */
3213 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3214 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3215
3216 /*
3217 * Normal return.
3218 *
3219 * Do the stack bits, but don't commit RSP before everything checks
3220 * out right.
3221 */
3222 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3223 VBOXSTRICTRC rcStrict;
3224 RTCPTRUNION uFrame;
3225 uint16_t uNewCs;
3226 uint32_t uNewEip;
3227 uint32_t uNewFlags;
3228 uint64_t uNewRsp;
3229 if (enmEffOpSize == IEMMODE_32BIT)
3230 {
3231 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
3232 if (rcStrict != VINF_SUCCESS)
3233 return rcStrict;
3234 uNewEip = uFrame.pu32[0];
3235 uNewCs = (uint16_t)uFrame.pu32[1];
3236 uNewFlags = uFrame.pu32[2];
3237 }
3238 else
3239 {
3240 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3241 if (rcStrict != VINF_SUCCESS)
3242 return rcStrict;
3243 uNewEip = uFrame.pu16[0];
3244 uNewCs = uFrame.pu16[1];
3245 uNewFlags = uFrame.pu16[2];
3246 }
3247 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3248 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3249 { /* extremely likely */ }
3250 else
3251 return rcStrict;
3252 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3253
3254 /*
3255 * We're hopefully not returning to V8086 mode...
3256 */
3257 if ( (uNewFlags & X86_EFL_VM)
3258 && pVCpu->iem.s.uCpl == 0)
3259 {
3260 Assert(enmEffOpSize == IEMMODE_32BIT);
3261 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3262 }
3263
3264 /*
3265 * Protected mode.
3266 */
3267 /* Read the CS descriptor. */
3268 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3269 {
3270 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3271 return iemRaiseGeneralProtectionFault0(pVCpu);
3272 }
3273
3274 IEMSELDESC DescCS;
3275 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3276 if (rcStrict != VINF_SUCCESS)
3277 {
3278 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3279 return rcStrict;
3280 }
3281
3282 /* Must be a code descriptor. */
3283 if (!DescCS.Legacy.Gen.u1DescType)
3284 {
3285 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3286 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3287 }
3288 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3289 {
3290 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3291 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3292 }
3293
3294 /* Privilege checks. */
3295 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3296 {
3297 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3298 {
3299 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3300 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3301 }
3302 }
3303 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3304 {
3305 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3306 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3307 }
3308 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3309 {
3310 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3311 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3312 }
3313
3314 /* Present? */
3315 if (!DescCS.Legacy.Gen.u1Present)
3316 {
3317 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3318 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3319 }
3320
3321 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3322
3323 /*
3324 * Return to outer level?
3325 */
3326 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3327 {
3328 uint16_t uNewSS;
3329 uint32_t uNewESP;
3330 if (enmEffOpSize == IEMMODE_32BIT)
3331 {
3332 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, uNewRsp);
3333 if (rcStrict != VINF_SUCCESS)
3334 return rcStrict;
3335/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3336 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3337 * bit of the popped SS selector it turns out. */
3338 uNewESP = uFrame.pu32[0];
3339 uNewSS = (uint16_t)uFrame.pu32[1];
3340 }
3341 else
3342 {
3343 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, uNewRsp);
3344 if (rcStrict != VINF_SUCCESS)
3345 return rcStrict;
3346 uNewESP = uFrame.pu16[0];
3347 uNewSS = uFrame.pu16[1];
3348 }
3349 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3350 if (rcStrict != VINF_SUCCESS)
3351 return rcStrict;
3352 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3353
3354 /* Read the SS descriptor. */
3355 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3356 {
3357 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3358 return iemRaiseGeneralProtectionFault0(pVCpu);
3359 }
3360
3361 IEMSELDESC DescSS;
3362 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3363 if (rcStrict != VINF_SUCCESS)
3364 {
3365 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3366 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3367 return rcStrict;
3368 }
3369
3370 /* Privilege checks. */
3371 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3372 {
3373 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3374 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3375 }
3376 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3377 {
3378 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3379 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3380 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3381 }
3382
3383 /* Must be a writeable data segment descriptor. */
3384 if (!DescSS.Legacy.Gen.u1DescType)
3385 {
3386 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3387 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3388 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3389 }
3390 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3391 {
3392 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3393 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3394 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3395 }
3396
3397 /* Present? */
3398 if (!DescSS.Legacy.Gen.u1Present)
3399 {
3400 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3401 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3402 }
3403
3404 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3405
3406 /* Check EIP. */
3407 if (uNewEip > cbLimitCS)
3408 {
3409 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3410 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3411 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3412 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3413 }
3414
3415 /*
3416 * Commit the changes, marking CS and SS accessed first since
3417 * that may fail.
3418 */
3419 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3420 {
3421 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3422 if (rcStrict != VINF_SUCCESS)
3423 return rcStrict;
3424 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3425 }
3426 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3427 {
3428 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3429 if (rcStrict != VINF_SUCCESS)
3430 return rcStrict;
3431 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3432 }
3433
3434 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3435 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3436 if (enmEffOpSize != IEMMODE_16BIT)
3437 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3438 if (pVCpu->iem.s.uCpl == 0)
3439 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3440 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3441 fEFlagsMask |= X86_EFL_IF;
3442 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3443 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3444 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3445 fEFlagsNew &= ~fEFlagsMask;
3446 fEFlagsNew |= uNewFlags & fEFlagsMask;
3447#ifdef DBGFTRACE_ENABLED
3448 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3449 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3450 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3451#endif
3452
3453 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3454 pVCpu->cpum.GstCtx.rip = uNewEip;
3455 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3456 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3457 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3458 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3459 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3460 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3461 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3462
3463 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3464 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3465 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3466 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3467 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3468 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3469 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3470 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3471 else
3472 pVCpu->cpum.GstCtx.rsp = uNewESP;
3473
3474 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3475 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3476 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3477 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3478 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3479
3480 /* Done! */
3481
3482 }
3483 /*
3484 * Return to the same level.
3485 */
3486 else
3487 {
3488 /* Check EIP. */
3489 if (uNewEip > cbLimitCS)
3490 {
3491 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3492 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3493 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3494 }
3495
3496 /*
3497 * Commit the changes, marking CS first since it may fail.
3498 */
3499 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3500 {
3501 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3502 if (rcStrict != VINF_SUCCESS)
3503 return rcStrict;
3504 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3505 }
3506
3507 X86EFLAGS NewEfl;
3508 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3509 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3510 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3511 if (enmEffOpSize != IEMMODE_16BIT)
3512 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3513 if (pVCpu->iem.s.uCpl == 0)
3514 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3515 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3516 fEFlagsMask |= X86_EFL_IF;
3517 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3518 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3519 NewEfl.u &= ~fEFlagsMask;
3520 NewEfl.u |= fEFlagsMask & uNewFlags;
3521#ifdef DBGFTRACE_ENABLED
3522 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3523 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3524 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3525#endif
3526
3527 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3528 pVCpu->cpum.GstCtx.rip = uNewEip;
3529 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3530 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3531 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3532 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3533 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3534 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3535 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3536 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3537 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3538 else
3539 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3540 /* Done! */
3541 }
3542
3543 /* Flush the prefetch buffer. */
3544#ifdef IEM_WITH_CODE_TLB
3545 pVCpu->iem.s.pbInstrBuf = NULL;
3546#else
3547 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3548#endif
3549
3550 return VINF_SUCCESS;
3551}
3552
3553
3554/**
3555 * Implements iret for long mode
3556 *
3557 * @param enmEffOpSize The effective operand size.
3558 */
3559IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3560{
3561 NOREF(cbInstr);
3562
3563 /*
3564 * Nested task return is not supported in long mode.
3565 */
3566 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3567 {
3568 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3569 return iemRaiseGeneralProtectionFault0(pVCpu);
3570 }
3571
3572 /*
3573 * Normal return.
3574 *
3575 * Do the stack bits, but don't commit RSP before everything checks
3576 * out right.
3577 */
3578 VBOXSTRICTRC rcStrict;
3579 RTCPTRUNION uFrame;
3580 uint64_t uNewRip;
3581 uint16_t uNewCs;
3582 uint16_t uNewSs;
3583 uint32_t uNewFlags;
3584 uint64_t uNewRsp;
3585 if (enmEffOpSize == IEMMODE_64BIT)
3586 {
3587 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
3588 if (rcStrict != VINF_SUCCESS)
3589 return rcStrict;
3590 uNewRip = uFrame.pu64[0];
3591 uNewCs = (uint16_t)uFrame.pu64[1];
3592 uNewFlags = (uint32_t)uFrame.pu64[2];
3593 uNewRsp = uFrame.pu64[3];
3594 uNewSs = (uint16_t)uFrame.pu64[4];
3595 }
3596 else if (enmEffOpSize == IEMMODE_32BIT)
3597 {
3598 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
3599 if (rcStrict != VINF_SUCCESS)
3600 return rcStrict;
3601 uNewRip = uFrame.pu32[0];
3602 uNewCs = (uint16_t)uFrame.pu32[1];
3603 uNewFlags = uFrame.pu32[2];
3604 uNewRsp = uFrame.pu32[3];
3605 uNewSs = (uint16_t)uFrame.pu32[4];
3606 }
3607 else
3608 {
3609 Assert(enmEffOpSize == IEMMODE_16BIT);
3610 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
3611 if (rcStrict != VINF_SUCCESS)
3612 return rcStrict;
3613 uNewRip = uFrame.pu16[0];
3614 uNewCs = uFrame.pu16[1];
3615 uNewFlags = uFrame.pu16[2];
3616 uNewRsp = uFrame.pu16[3];
3617 uNewSs = uFrame.pu16[4];
3618 }
3619 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3620 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3621 { /* extremely like */ }
3622 else
3623 return rcStrict;
3624 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3625
3626 /*
3627 * Check stuff.
3628 */
3629 /* Read the CS descriptor. */
3630 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3631 {
3632 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3633 return iemRaiseGeneralProtectionFault0(pVCpu);
3634 }
3635
3636 IEMSELDESC DescCS;
3637 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3638 if (rcStrict != VINF_SUCCESS)
3639 {
3640 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3641 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3642 return rcStrict;
3643 }
3644
3645 /* Must be a code descriptor. */
3646 if ( !DescCS.Legacy.Gen.u1DescType
3647 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3648 {
3649 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3650 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3651 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3652 }
3653
3654 /* Privilege checks. */
3655 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3656 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3657 {
3658 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3659 {
3660 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3661 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3662 }
3663 }
3664 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3665 {
3666 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3667 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3668 }
3669 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3670 {
3671 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3672 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3673 }
3674
3675 /* Present? */
3676 if (!DescCS.Legacy.Gen.u1Present)
3677 {
3678 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3679 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3680 }
3681
3682 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3683
3684 /* Read the SS descriptor. */
3685 IEMSELDESC DescSS;
3686 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3687 {
3688 if ( !DescCS.Legacy.Gen.u1Long
3689 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3690 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3691 {
3692 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3693 return iemRaiseGeneralProtectionFault0(pVCpu);
3694 }
3695 /* Make sure SS is sensible, marked as accessed etc. */
3696 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3697 }
3698 else
3699 {
3700 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3701 if (rcStrict != VINF_SUCCESS)
3702 {
3703 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3704 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3705 return rcStrict;
3706 }
3707 }
3708
3709 /* Privilege checks. */
3710 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3711 {
3712 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3713 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3714 }
3715
3716 uint32_t cbLimitSs;
3717 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3718 cbLimitSs = UINT32_MAX;
3719 else
3720 {
3721 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3722 {
3723 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3724 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3725 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3726 }
3727
3728 /* Must be a writeable data segment descriptor. */
3729 if (!DescSS.Legacy.Gen.u1DescType)
3730 {
3731 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3732 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3733 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3734 }
3735 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3736 {
3737 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3738 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3739 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3740 }
3741
3742 /* Present? */
3743 if (!DescSS.Legacy.Gen.u1Present)
3744 {
3745 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3746 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3747 }
3748 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3749 }
3750
3751 /* Check EIP. */
3752 if (DescCS.Legacy.Gen.u1Long)
3753 {
3754 if (!IEM_IS_CANONICAL(uNewRip))
3755 {
3756 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3757 uNewCs, uNewRip, uNewSs, uNewRsp));
3758 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3759 }
3760 }
3761 else
3762 {
3763 if (uNewRip > cbLimitCS)
3764 {
3765 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3766 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3767 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3768 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3769 }
3770 }
3771
3772 /*
3773 * Commit the changes, marking CS and SS accessed first since
3774 * that may fail.
3775 */
3776 /** @todo where exactly are these actually marked accessed by a real CPU? */
3777 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3778 {
3779 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3780 if (rcStrict != VINF_SUCCESS)
3781 return rcStrict;
3782 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3783 }
3784 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3785 {
3786 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3787 if (rcStrict != VINF_SUCCESS)
3788 return rcStrict;
3789 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3790 }
3791
3792 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3793 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3794 if (enmEffOpSize != IEMMODE_16BIT)
3795 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3796 if (pVCpu->iem.s.uCpl == 0)
3797 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3798 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3799 fEFlagsMask |= X86_EFL_IF;
3800 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3801 fEFlagsNew &= ~fEFlagsMask;
3802 fEFlagsNew |= uNewFlags & fEFlagsMask;
3803#ifdef DBGFTRACE_ENABLED
3804 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3805 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3806#endif
3807
3808 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3809 pVCpu->cpum.GstCtx.rip = uNewRip;
3810 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3811 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3812 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3813 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3814 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3815 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3816 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3817 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3818 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3819 else
3820 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3821 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3822 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3823 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3824 {
3825 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3826 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3827 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3828 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3829 Log2(("iretq new SS: NULL\n"));
3830 }
3831 else
3832 {
3833 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3834 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3835 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3836 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3837 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3838 }
3839
3840 if (pVCpu->iem.s.uCpl != uNewCpl)
3841 {
3842 pVCpu->iem.s.uCpl = uNewCpl;
3843 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3844 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3845 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3846 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3847 }
3848
3849 /* Flush the prefetch buffer. */
3850#ifdef IEM_WITH_CODE_TLB
3851 pVCpu->iem.s.pbInstrBuf = NULL;
3852#else
3853 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3854#endif
3855
3856 return VINF_SUCCESS;
3857}
3858
3859
3860/**
3861 * Implements iret.
3862 *
3863 * @param enmEffOpSize The effective operand size.
3864 */
3865IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3866{
3867 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
3868
3869#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3870 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3871 {
3872 /*
3873 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3874 * of this IRET instruction. We need to provide this information as part of some
3875 * VM-exits.
3876 *
3877 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3878 */
3879 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3880 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3881 else
3882 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3883
3884 /*
3885 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3886 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3887 */
3888 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3889 fBlockingNmi = false;
3890
3891 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3892 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3893 }
3894#endif
3895
3896 /*
3897 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3898 * The NMI is still held pending (which I assume means blocking of further NMIs
3899 * is in effect).
3900 *
3901 * See AMD spec. 15.9 "Instruction Intercepts".
3902 * See AMD spec. 15.21.9 "NMI Support".
3903 */
3904 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3905 {
3906 Log(("iret: Guest intercept -> #VMEXIT\n"));
3907 IEM_SVM_UPDATE_NRIP(pVCpu);
3908 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3909 }
3910
3911 /*
3912 * Clear NMI blocking, if any, before causing any further exceptions.
3913 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3914 */
3915 if (fBlockingNmi)
3916 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
3917
3918 /*
3919 * Call a mode specific worker.
3920 */
3921 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3922 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3923 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3924 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3925 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3926 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3927}
3928
3929
3930static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3931{
3932 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3933
3934 pHid->Sel = uSel;
3935 pHid->ValidSel = uSel;
3936 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3937}
3938
3939
3940static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3941{
3942 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3943
3944 /* The base is in the first three bytes. */
3945 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3946 /* The attributes are in the fourth byte. */
3947 pHid->Attr.u = pbMem[3];
3948 /* The limit is in the last two bytes. */
3949 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3950}
3951
3952
3953/**
3954 * Implements 286 LOADALL (286 CPUs only).
3955 */
3956IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3957{
3958 NOREF(cbInstr);
3959
3960 /* Data is loaded from a buffer at 800h. No checks are done on the
3961 * validity of loaded state.
3962 *
3963 * LOADALL only loads the internal CPU state, it does not access any
3964 * GDT, LDT, or similar tables.
3965 */
3966
3967 if (pVCpu->iem.s.uCpl != 0)
3968 {
3969 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3970 return iemRaiseGeneralProtectionFault0(pVCpu);
3971 }
3972
3973 uint8_t const *pbMem = NULL;
3974 uint16_t const *pa16Mem;
3975 uint8_t const *pa8Mem;
3976 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3977 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
3978 if (rcStrict != VINF_SUCCESS)
3979 return rcStrict;
3980
3981 /* The MSW is at offset 0x06. */
3982 pa16Mem = (uint16_t const *)(pbMem + 0x06);
3983 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3984 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3985 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3986 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3987
3988 CPUMSetGuestCR0(pVCpu, uNewCr0);
3989 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3990
3991 /* Inform PGM if mode changed. */
3992 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3993 {
3994 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3995 AssertRCReturn(rc, rc);
3996 /* ignore informational status codes */
3997 }
3998 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
3999 false /* fForce */);
4000
4001 /* TR selector is at offset 0x16. */
4002 pa16Mem = (uint16_t const *)(pbMem + 0x16);
4003 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
4004 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
4005 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
4006
4007 /* Followed by FLAGS... */
4008 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
4009 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
4010
4011 /* LDT is at offset 0x1C. */
4012 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
4013 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
4014 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
4015 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4016
4017 /* Segment registers are at offset 0x1E. */
4018 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
4019 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
4020 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
4021 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
4022 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
4023
4024 /* GPRs are at offset 0x26. */
4025 pa16Mem = (uint16_t const *)(pbMem + 0x26);
4026 pVCpu->cpum.GstCtx.di = pa16Mem[0];
4027 pVCpu->cpum.GstCtx.si = pa16Mem[1];
4028 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
4029 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
4030 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
4031 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
4032 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
4033 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
4034
4035 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4036 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4037 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4038 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4039 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4040
4041 /* GDTR contents are at offset 0x4E, 6 bytes. */
4042 RTGCPHYS GCPtrBase;
4043 uint16_t cbLimit;
4044 pa8Mem = pbMem + 0x4E;
4045 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4046 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4047 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4048 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4049
4050 /* IDTR contents are at offset 0x5A, 6 bytes. */
4051 pa8Mem = pbMem + 0x5A;
4052 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4053 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4054 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4055
4056 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4057 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4058 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4059 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4060 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4061 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4062
4063 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4064 if (rcStrict != VINF_SUCCESS)
4065 return rcStrict;
4066
4067 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4068 * descriptor caches" but there is no word as to what happens if those are
4069 * not identical (probably bad things).
4070 */
4071 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4072
4073 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4074
4075 /* Flush the prefetch buffer. */
4076#ifdef IEM_WITH_CODE_TLB
4077 pVCpu->iem.s.pbInstrBuf = NULL;
4078#else
4079 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4080#endif
4081 return rcStrict;
4082}
4083
4084
4085/**
4086 * Implements SYSCALL (AMD and Intel64).
4087 */
4088IEM_CIMPL_DEF_0(iemCImpl_syscall)
4089{
4090 /** @todo hack, LOADALL should be decoded as such on a 286. */
4091 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4092 return iemCImpl_loadall286(pVCpu, cbInstr);
4093
4094 /*
4095 * Check preconditions.
4096 *
4097 * Note that CPUs described in the documentation may load a few odd values
4098 * into CS and SS than we allow here. This has yet to be checked on real
4099 * hardware.
4100 */
4101 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4102 {
4103 Log(("syscall: Not enabled in EFER -> #UD\n"));
4104 return iemRaiseUndefinedOpcode(pVCpu);
4105 }
4106 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4107 {
4108 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4109 return iemRaiseGeneralProtectionFault0(pVCpu);
4110 }
4111 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4112 {
4113 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4114 return iemRaiseUndefinedOpcode(pVCpu);
4115 }
4116
4117 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4118
4119 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4120 /** @todo what about LDT selectors? Shouldn't matter, really. */
4121 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4122 uint16_t uNewSs = uNewCs + 8;
4123 if (uNewCs == 0 || uNewSs == 0)
4124 {
4125 /** @todo Neither Intel nor AMD document this check. */
4126 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4127 return iemRaiseGeneralProtectionFault0(pVCpu);
4128 }
4129
4130 /* Long mode and legacy mode differs. */
4131 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4132 {
4133 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4134
4135 /* This test isn't in the docs, but I'm not trusting the guys writing
4136 the MSRs to have validated the values as canonical like they should. */
4137 if (!IEM_IS_CANONICAL(uNewRip))
4138 {
4139 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4140 Log(("syscall: New RIP not canonical -> #UD\n"));
4141 return iemRaiseUndefinedOpcode(pVCpu);
4142 }
4143
4144 /*
4145 * Commit it.
4146 */
4147 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4148 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4149 pVCpu->cpum.GstCtx.rip = uNewRip;
4150
4151 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4152 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4153 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4154 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4155
4156 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4157 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4158 }
4159 else
4160 {
4161 /*
4162 * Commit it.
4163 */
4164 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4165 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4166 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4167 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4168
4169 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4170 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4171 }
4172 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4173 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4174 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4175 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4176 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4177
4178 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4179 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4180 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4181 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4182 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4183
4184 pVCpu->iem.s.uCpl = 0;
4185 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4186
4187 /* Flush the prefetch buffer. */
4188#ifdef IEM_WITH_CODE_TLB
4189 pVCpu->iem.s.pbInstrBuf = NULL;
4190#else
4191 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4192#endif
4193
4194 return VINF_SUCCESS;
4195}
4196
4197
4198/**
4199 * Implements SYSRET (AMD and Intel64).
4200 */
4201IEM_CIMPL_DEF_0(iemCImpl_sysret)
4202
4203{
4204 RT_NOREF_PV(cbInstr);
4205
4206 /*
4207 * Check preconditions.
4208 *
4209 * Note that CPUs described in the documentation may load a few odd values
4210 * into CS and SS than we allow here. This has yet to be checked on real
4211 * hardware.
4212 */
4213 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4214 {
4215 Log(("sysret: Not enabled in EFER -> #UD\n"));
4216 return iemRaiseUndefinedOpcode(pVCpu);
4217 }
4218 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4219 {
4220 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4221 return iemRaiseUndefinedOpcode(pVCpu);
4222 }
4223 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4224 {
4225 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4226 return iemRaiseGeneralProtectionFault0(pVCpu);
4227 }
4228 if (pVCpu->iem.s.uCpl != 0)
4229 {
4230 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4231 return iemRaiseGeneralProtectionFault0(pVCpu);
4232 }
4233
4234 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4235
4236 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4237 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4238 uint16_t uNewSs = uNewCs + 8;
4239 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4240 uNewCs += 16;
4241 if (uNewCs == 0 || uNewSs == 0)
4242 {
4243 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4244 return iemRaiseGeneralProtectionFault0(pVCpu);
4245 }
4246
4247 /*
4248 * Commit it.
4249 */
4250 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4251 {
4252 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4253 {
4254 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4255 /* Note! We disregard intel manual regarding the RCX canonical
4256 check, ask intel+xen why AMD doesn't do it. */
4257 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4258 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4259 | (3 << X86DESCATTR_DPL_SHIFT);
4260 }
4261 else
4262 {
4263 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4264 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4265 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4266 | (3 << X86DESCATTR_DPL_SHIFT);
4267 }
4268 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4269 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4270 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4271 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4272 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4273 }
4274 else
4275 {
4276 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4277 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4278 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4279 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4280 | (3 << X86DESCATTR_DPL_SHIFT);
4281 }
4282 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4283 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4284 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4285 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4286 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4287
4288 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4289 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4290 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4291 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4292 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4293 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4294 * on sysret. */
4295
4296 pVCpu->iem.s.uCpl = 3;
4297 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4298
4299 /* Flush the prefetch buffer. */
4300#ifdef IEM_WITH_CODE_TLB
4301 pVCpu->iem.s.pbInstrBuf = NULL;
4302#else
4303 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4304#endif
4305
4306 return VINF_SUCCESS;
4307}
4308
4309
4310/**
4311 * Implements SYSENTER (Intel, 32-bit AMD).
4312 */
4313IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4314{
4315 RT_NOREF(cbInstr);
4316
4317 /*
4318 * Check preconditions.
4319 *
4320 * Note that CPUs described in the documentation may load a few odd values
4321 * into CS and SS than we allow here. This has yet to be checked on real
4322 * hardware.
4323 */
4324 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4325 {
4326 Log(("sysenter: not supported -=> #UD\n"));
4327 return iemRaiseUndefinedOpcode(pVCpu);
4328 }
4329 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4330 {
4331 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4332 return iemRaiseGeneralProtectionFault0(pVCpu);
4333 }
4334 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4335 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4336 {
4337 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4338 return iemRaiseUndefinedOpcode(pVCpu);
4339 }
4340 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4341 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4342 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4343 {
4344 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4345 return iemRaiseGeneralProtectionFault0(pVCpu);
4346 }
4347
4348 /* This test isn't in the docs, it's just a safeguard against missing
4349 canonical checks when writing the registers. */
4350 if (RT_LIKELY( !fIsLongMode
4351 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4352 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4353 { /* likely */ }
4354 else
4355 {
4356 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4357 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4358 return iemRaiseUndefinedOpcode(pVCpu);
4359 }
4360
4361/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4362
4363 /*
4364 * Update registers and commit.
4365 */
4366 if (fIsLongMode)
4367 {
4368 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4369 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4370 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4371 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4372 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4373 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4374 }
4375 else
4376 {
4377 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, (uint32_t)pVCpu->cpum.GstCtx.rip,
4378 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4379 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4380 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4381 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4382 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4383 }
4384 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4385 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4386 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4387 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4388 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4389
4390 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4391 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4392 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4393 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4394 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4395 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4396 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4397
4398 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4399 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4400 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4401
4402 pVCpu->iem.s.uCpl = 0;
4403
4404 /* Flush the prefetch buffer. */
4405#ifdef IEM_WITH_CODE_TLB
4406 pVCpu->iem.s.pbInstrBuf = NULL;
4407#else
4408 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4409#endif
4410
4411 return VINF_SUCCESS;
4412}
4413
4414
4415/**
4416 * Implements SYSEXIT (Intel, 32-bit AMD).
4417 *
4418 * @param enmEffOpSize The effective operand size.
4419 */
4420IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4421{
4422 RT_NOREF(cbInstr);
4423
4424 /*
4425 * Check preconditions.
4426 *
4427 * Note that CPUs described in the documentation may load a few odd values
4428 * into CS and SS than we allow here. This has yet to be checked on real
4429 * hardware.
4430 */
4431 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4432 {
4433 Log(("sysexit: not supported -=> #UD\n"));
4434 return iemRaiseUndefinedOpcode(pVCpu);
4435 }
4436 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4437 {
4438 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4439 return iemRaiseGeneralProtectionFault0(pVCpu);
4440 }
4441 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4442 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4443 {
4444 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4445 return iemRaiseUndefinedOpcode(pVCpu);
4446 }
4447 if (pVCpu->iem.s.uCpl != 0)
4448 {
4449 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", pVCpu->iem.s.uCpl));
4450 return iemRaiseGeneralProtectionFault0(pVCpu);
4451 }
4452 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4453 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4454 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4455 {
4456 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4457 return iemRaiseGeneralProtectionFault0(pVCpu);
4458 }
4459
4460 /*
4461 * Update registers and commit.
4462 */
4463 if (enmEffOpSize == IEMMODE_64BIT)
4464 {
4465 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4466 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4467 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4468 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4469 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4470 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4471 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4472 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4473 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4474 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4475 }
4476 else
4477 {
4478 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4479 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4480 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4481 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4482 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4483 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4484 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4485 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4486 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4487 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4488 }
4489 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4490 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4491 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4492
4493 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4494 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4495 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4496 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4497 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4498 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4499
4500 pVCpu->iem.s.uCpl = 3;
4501
4502 /* Flush the prefetch buffer. */
4503#ifdef IEM_WITH_CODE_TLB
4504 pVCpu->iem.s.pbInstrBuf = NULL;
4505#else
4506 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4507#endif
4508
4509 return VINF_SUCCESS;
4510}
4511
4512
4513/**
4514 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4515 *
4516 * @param iSegReg The segment register number (valid).
4517 * @param uSel The new selector value.
4518 */
4519IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4520{
4521 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4522 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4523 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4524
4525 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4526
4527 /*
4528 * Real mode and V8086 mode are easy.
4529 */
4530 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4531 {
4532 *pSel = uSel;
4533 pHid->u64Base = (uint32_t)uSel << 4;
4534 pHid->ValidSel = uSel;
4535 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4536#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4537 /** @todo Does the CPU actually load limits and attributes in the
4538 * real/V8086 mode segment load case? It doesn't for CS in far
4539 * jumps... Affects unreal mode. */
4540 pHid->u32Limit = 0xffff;
4541 pHid->Attr.u = 0;
4542 pHid->Attr.n.u1Present = 1;
4543 pHid->Attr.n.u1DescType = 1;
4544 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4545 ? X86_SEL_TYPE_RW
4546 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4547#endif
4548 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4549 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4550 return VINF_SUCCESS;
4551 }
4552
4553 /*
4554 * Protected mode.
4555 *
4556 * Check if it's a null segment selector value first, that's OK for DS, ES,
4557 * FS and GS. If not null, then we have to load and parse the descriptor.
4558 */
4559 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4560 {
4561 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4562 if (iSegReg == X86_SREG_SS)
4563 {
4564 /* In 64-bit kernel mode, the stack can be 0 because of the way
4565 interrupts are dispatched. AMD seems to have a slighly more
4566 relaxed relationship to SS.RPL than intel does. */
4567 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4568 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4569 || pVCpu->iem.s.uCpl > 2
4570 || ( uSel != pVCpu->iem.s.uCpl
4571 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4572 {
4573 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4574 return iemRaiseGeneralProtectionFault0(pVCpu);
4575 }
4576 }
4577
4578 *pSel = uSel; /* Not RPL, remember :-) */
4579 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4580 if (iSegReg == X86_SREG_SS)
4581 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4582
4583 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4584 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4585
4586 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4587 return VINF_SUCCESS;
4588 }
4589
4590 /* Fetch the descriptor. */
4591 IEMSELDESC Desc;
4592 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4593 if (rcStrict != VINF_SUCCESS)
4594 return rcStrict;
4595
4596 /* Check GPs first. */
4597 if (!Desc.Legacy.Gen.u1DescType)
4598 {
4599 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4600 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4601 }
4602 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4603 {
4604 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4605 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4606 {
4607 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4608 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4609 }
4610 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4611 {
4612 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4613 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4614 }
4615 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4616 {
4617 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4618 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4619 }
4620 }
4621 else
4622 {
4623 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4624 {
4625 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4626 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4627 }
4628 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4629 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4630 {
4631#if 0 /* this is what intel says. */
4632 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4633 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4634 {
4635 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4636 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4637 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4638 }
4639#else /* this is what makes more sense. */
4640 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4641 {
4642 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4643 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4644 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4645 }
4646 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4647 {
4648 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4649 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4650 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4651 }
4652#endif
4653 }
4654 }
4655
4656 /* Is it there? */
4657 if (!Desc.Legacy.Gen.u1Present)
4658 {
4659 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4660 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4661 }
4662
4663 /* The base and limit. */
4664 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4665 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4666
4667 /*
4668 * Ok, everything checked out fine. Now set the accessed bit before
4669 * committing the result into the registers.
4670 */
4671 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4672 {
4673 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4674 if (rcStrict != VINF_SUCCESS)
4675 return rcStrict;
4676 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4677 }
4678
4679 /* commit */
4680 *pSel = uSel;
4681 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4682 pHid->u32Limit = cbLimit;
4683 pHid->u64Base = u64Base;
4684 pHid->ValidSel = uSel;
4685 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4686
4687 /** @todo check if the hidden bits are loaded correctly for 64-bit
4688 * mode. */
4689 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4690
4691 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4692 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4693 return VINF_SUCCESS;
4694}
4695
4696
4697/**
4698 * Implements 'mov SReg, r/m'.
4699 *
4700 * @param iSegReg The segment register number (valid).
4701 * @param uSel The new selector value.
4702 */
4703IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4704{
4705 if (iSegReg != X86_SREG_SS)
4706 return IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4707 /** @todo only set it the shadow flag if it was clear before? */
4708 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4709 if (rcStrict == VINF_SUCCESS)
4710 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4711 return rcStrict;
4712}
4713
4714
4715/**
4716 * Implements 'pop SReg'.
4717 *
4718 * @param iSegReg The segment register number (valid).
4719 * @param enmEffOpSize The efficient operand size (valid).
4720 */
4721IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4722{
4723 VBOXSTRICTRC rcStrict;
4724
4725 /*
4726 * Read the selector off the stack and join paths with mov ss, reg.
4727 */
4728 RTUINT64U TmpRsp;
4729 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4730 switch (enmEffOpSize)
4731 {
4732 case IEMMODE_16BIT:
4733 {
4734 uint16_t uSel;
4735 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4736 if (rcStrict == VINF_SUCCESS)
4737 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4738 break;
4739 }
4740
4741 case IEMMODE_32BIT:
4742 {
4743 uint32_t u32Value;
4744 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4745 if (rcStrict == VINF_SUCCESS)
4746 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4747 break;
4748 }
4749
4750 case IEMMODE_64BIT:
4751 {
4752 uint64_t u64Value;
4753 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4754 if (rcStrict == VINF_SUCCESS)
4755 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4756 break;
4757 }
4758 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4759 }
4760
4761 /*
4762 * Commit the stack on success and set interrupt shadow flag if appropriate
4763 * (the latter must be done after updating RIP).
4764 */
4765 if (rcStrict == VINF_SUCCESS)
4766 {
4767 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4768 if (iSegReg == X86_SREG_SS)
4769 {
4770 /** @todo only set it the shadow flag if it was clear before? */
4771 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4772 }
4773 }
4774 return rcStrict;
4775}
4776
4777
4778/**
4779 * Implements lgs, lfs, les, lds & lss.
4780 */
4781IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
4782{
4783 /*
4784 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4785 */
4786 /** @todo verify and test that mov, pop and lXs works the segment
4787 * register loading in the exact same way. */
4788 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4789 if (rcStrict == VINF_SUCCESS)
4790 {
4791 switch (enmEffOpSize)
4792 {
4793 case IEMMODE_16BIT:
4794 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4795 break;
4796 case IEMMODE_32BIT:
4797 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4798 break;
4799 case IEMMODE_64BIT:
4800 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4801 break;
4802 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4803 }
4804 }
4805
4806 return rcStrict;
4807}
4808
4809
4810/**
4811 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4812 *
4813 * @retval VINF_SUCCESS on success.
4814 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4815 * @retval iemMemFetchSysU64 return value.
4816 *
4817 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4818 * @param uSel The selector value.
4819 * @param fAllowSysDesc Whether system descriptors are OK or not.
4820 * @param pDesc Where to return the descriptor on success.
4821 */
4822static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4823{
4824 pDesc->Long.au64[0] = 0;
4825 pDesc->Long.au64[1] = 0;
4826
4827 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4828 return VINF_IEM_SELECTOR_NOT_OK;
4829
4830 /* Within the table limits? */
4831 RTGCPTR GCPtrBase;
4832 if (uSel & X86_SEL_LDT)
4833 {
4834 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4835 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4836 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4837 return VINF_IEM_SELECTOR_NOT_OK;
4838 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4839 }
4840 else
4841 {
4842 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4843 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4844 return VINF_IEM_SELECTOR_NOT_OK;
4845 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4846 }
4847
4848 /* Fetch the descriptor. */
4849 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4850 if (rcStrict != VINF_SUCCESS)
4851 return rcStrict;
4852 if (!pDesc->Legacy.Gen.u1DescType)
4853 {
4854 if (!fAllowSysDesc)
4855 return VINF_IEM_SELECTOR_NOT_OK;
4856 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4857 {
4858 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4859 if (rcStrict != VINF_SUCCESS)
4860 return rcStrict;
4861 }
4862
4863 }
4864
4865 return VINF_SUCCESS;
4866}
4867
4868
4869/**
4870 * Implements verr (fWrite = false) and verw (fWrite = true).
4871 */
4872IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4873{
4874 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4875
4876 /** @todo figure whether the accessed bit is set or not. */
4877
4878 bool fAccessible = true;
4879 IEMSELDESC Desc;
4880 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4881 if (rcStrict == VINF_SUCCESS)
4882 {
4883 /* Check the descriptor, order doesn't matter much here. */
4884 if ( !Desc.Legacy.Gen.u1DescType
4885 || !Desc.Legacy.Gen.u1Present)
4886 fAccessible = false;
4887 else
4888 {
4889 if ( fWrite
4890 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4891 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4892 fAccessible = false;
4893
4894 /** @todo testcase for the conforming behavior. */
4895 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4896 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4897 {
4898 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4899 fAccessible = false;
4900 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4901 fAccessible = false;
4902 }
4903 }
4904
4905 }
4906 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4907 fAccessible = false;
4908 else
4909 return rcStrict;
4910
4911 /* commit */
4912 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4913
4914 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4915 return VINF_SUCCESS;
4916}
4917
4918
4919/**
4920 * Implements LAR and LSL with 64-bit operand size.
4921 *
4922 * @returns VINF_SUCCESS.
4923 * @param pu64Dst Pointer to the destination register.
4924 * @param uSel The selector to load details for.
4925 * @param fIsLar true = LAR, false = LSL.
4926 */
4927IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4928{
4929 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4930
4931 /** @todo figure whether the accessed bit is set or not. */
4932
4933 bool fDescOk = true;
4934 IEMSELDESC Desc;
4935 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4936 if (rcStrict == VINF_SUCCESS)
4937 {
4938 /*
4939 * Check the descriptor type.
4940 */
4941 if (!Desc.Legacy.Gen.u1DescType)
4942 {
4943 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4944 {
4945 if (Desc.Long.Gen.u5Zeros)
4946 fDescOk = false;
4947 else
4948 switch (Desc.Long.Gen.u4Type)
4949 {
4950 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4951 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4952 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4953 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4954 break;
4955 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4956 fDescOk = fIsLar;
4957 break;
4958 default:
4959 fDescOk = false;
4960 break;
4961 }
4962 }
4963 else
4964 {
4965 switch (Desc.Long.Gen.u4Type)
4966 {
4967 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4968 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4969 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4970 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4971 case X86_SEL_TYPE_SYS_LDT:
4972 break;
4973 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4974 case X86_SEL_TYPE_SYS_TASK_GATE:
4975 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4976 fDescOk = fIsLar;
4977 break;
4978 default:
4979 fDescOk = false;
4980 break;
4981 }
4982 }
4983 }
4984 if (fDescOk)
4985 {
4986 /*
4987 * Check the RPL/DPL/CPL interaction..
4988 */
4989 /** @todo testcase for the conforming behavior. */
4990 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4991 || !Desc.Legacy.Gen.u1DescType)
4992 {
4993 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4994 fDescOk = false;
4995 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4996 fDescOk = false;
4997 }
4998 }
4999
5000 if (fDescOk)
5001 {
5002 /*
5003 * All fine, start committing the result.
5004 */
5005 if (fIsLar)
5006 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5007 else
5008 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5009 }
5010
5011 }
5012 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5013 fDescOk = false;
5014 else
5015 return rcStrict;
5016
5017 /* commit flags value and advance rip. */
5018 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5019 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5020
5021 return VINF_SUCCESS;
5022}
5023
5024
5025/**
5026 * Implements LAR and LSL with 16-bit operand size.
5027 *
5028 * @returns VINF_SUCCESS.
5029 * @param pu16Dst Pointer to the destination register.
5030 * @param uSel The selector to load details for.
5031 * @param fIsLar true = LAR, false = LSL.
5032 */
5033IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5034{
5035 uint64_t u64TmpDst = *pu16Dst;
5036 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5037 *pu16Dst = u64TmpDst;
5038 return VINF_SUCCESS;
5039}
5040
5041
5042/**
5043 * Implements lgdt.
5044 *
5045 * @param iEffSeg The segment of the new gdtr contents
5046 * @param GCPtrEffSrc The address of the new gdtr contents.
5047 * @param enmEffOpSize The effective operand size.
5048 */
5049IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5050{
5051 if (pVCpu->iem.s.uCpl != 0)
5052 return iemRaiseGeneralProtectionFault0(pVCpu);
5053 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5054
5055 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5056 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5057 {
5058 Log(("lgdt: Guest intercept -> VM-exit\n"));
5059 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5060 }
5061
5062 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5063 {
5064 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5065 IEM_SVM_UPDATE_NRIP(pVCpu);
5066 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5067 }
5068
5069 /*
5070 * Fetch the limit and base address.
5071 */
5072 uint16_t cbLimit;
5073 RTGCPTR GCPtrBase;
5074 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5075 if (rcStrict == VINF_SUCCESS)
5076 {
5077 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5078 || X86_IS_CANONICAL(GCPtrBase))
5079 {
5080 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5081 if (rcStrict == VINF_SUCCESS)
5082 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5083 }
5084 else
5085 {
5086 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5087 return iemRaiseGeneralProtectionFault0(pVCpu);
5088 }
5089 }
5090 return rcStrict;
5091}
5092
5093
5094/**
5095 * Implements sgdt.
5096 *
5097 * @param iEffSeg The segment where to store the gdtr content.
5098 * @param GCPtrEffDst The address where to store the gdtr content.
5099 */
5100IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5101{
5102 /*
5103 * Join paths with sidt.
5104 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5105 * you really must know.
5106 */
5107 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5108 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5109 {
5110 Log(("sgdt: Guest intercept -> VM-exit\n"));
5111 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5112 }
5113
5114 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5115 {
5116 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5117 IEM_SVM_UPDATE_NRIP(pVCpu);
5118 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5119 }
5120
5121 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5122 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5123 if (rcStrict == VINF_SUCCESS)
5124 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5125 return rcStrict;
5126}
5127
5128
5129/**
5130 * Implements lidt.
5131 *
5132 * @param iEffSeg The segment of the new idtr contents
5133 * @param GCPtrEffSrc The address of the new idtr contents.
5134 * @param enmEffOpSize The effective operand size.
5135 */
5136IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5137{
5138 if (pVCpu->iem.s.uCpl != 0)
5139 return iemRaiseGeneralProtectionFault0(pVCpu);
5140 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5141
5142 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5143 {
5144 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5145 IEM_SVM_UPDATE_NRIP(pVCpu);
5146 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5147 }
5148
5149 /*
5150 * Fetch the limit and base address.
5151 */
5152 uint16_t cbLimit;
5153 RTGCPTR GCPtrBase;
5154 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5155 if (rcStrict == VINF_SUCCESS)
5156 {
5157 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5158 || X86_IS_CANONICAL(GCPtrBase))
5159 {
5160 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5161 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5162 }
5163 else
5164 {
5165 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5166 return iemRaiseGeneralProtectionFault0(pVCpu);
5167 }
5168 }
5169 return rcStrict;
5170}
5171
5172
5173/**
5174 * Implements sidt.
5175 *
5176 * @param iEffSeg The segment where to store the idtr content.
5177 * @param GCPtrEffDst The address where to store the idtr content.
5178 */
5179IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5180{
5181 /*
5182 * Join paths with sgdt.
5183 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5184 * you really must know.
5185 */
5186 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5187 {
5188 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5189 IEM_SVM_UPDATE_NRIP(pVCpu);
5190 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5191 }
5192
5193 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5194 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5195 if (rcStrict == VINF_SUCCESS)
5196 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5197 return rcStrict;
5198}
5199
5200
5201/**
5202 * Implements lldt.
5203 *
5204 * @param uNewLdt The new LDT selector value.
5205 */
5206IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5207{
5208 /*
5209 * Check preconditions.
5210 */
5211 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5212 {
5213 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5214 return iemRaiseUndefinedOpcode(pVCpu);
5215 }
5216 if (pVCpu->iem.s.uCpl != 0)
5217 {
5218 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
5219 return iemRaiseGeneralProtectionFault0(pVCpu);
5220 }
5221 /* Nested-guest VMX intercept. */
5222 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5223 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5224 {
5225 Log(("lldt: Guest intercept -> VM-exit\n"));
5226 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5227 }
5228 if (uNewLdt & X86_SEL_LDT)
5229 {
5230 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5231 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5232 }
5233
5234 /*
5235 * Now, loading a NULL selector is easy.
5236 */
5237 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5238 {
5239 /* Nested-guest SVM intercept. */
5240 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5241 {
5242 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5243 IEM_SVM_UPDATE_NRIP(pVCpu);
5244 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5245 }
5246
5247 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5248 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5249 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5250 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5251 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5252 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5253 {
5254 /* AMD-V seems to leave the base and limit alone. */
5255 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5256 }
5257 else
5258 {
5259 /* VT-x (Intel 3960x) seems to be doing the following. */
5260 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5261 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5262 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5263 }
5264
5265 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5266 return VINF_SUCCESS;
5267 }
5268
5269 /*
5270 * Read the descriptor.
5271 */
5272 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5273 IEMSELDESC Desc;
5274 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5275 if (rcStrict != VINF_SUCCESS)
5276 return rcStrict;
5277
5278 /* Check GPs first. */
5279 if (Desc.Legacy.Gen.u1DescType)
5280 {
5281 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5282 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5283 }
5284 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5285 {
5286 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5287 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5288 }
5289 uint64_t u64Base;
5290 if (!IEM_IS_LONG_MODE(pVCpu))
5291 u64Base = X86DESC_BASE(&Desc.Legacy);
5292 else
5293 {
5294 if (Desc.Long.Gen.u5Zeros)
5295 {
5296 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5297 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5298 }
5299
5300 u64Base = X86DESC64_BASE(&Desc.Long);
5301 if (!IEM_IS_CANONICAL(u64Base))
5302 {
5303 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5304 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5305 }
5306 }
5307
5308 /* NP */
5309 if (!Desc.Legacy.Gen.u1Present)
5310 {
5311 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5312 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5313 }
5314
5315 /* Nested-guest SVM intercept. */
5316 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5317 {
5318 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5319 IEM_SVM_UPDATE_NRIP(pVCpu);
5320 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5321 }
5322
5323 /*
5324 * It checks out alright, update the registers.
5325 */
5326/** @todo check if the actual value is loaded or if the RPL is dropped */
5327 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5328 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5329 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5330 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5331 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5332 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5333
5334 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5335 return VINF_SUCCESS;
5336}
5337
5338
5339/**
5340 * Implements sldt GReg
5341 *
5342 * @param iGReg The general register to store the CRx value in.
5343 * @param enmEffOpSize The operand size.
5344 */
5345IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5346{
5347 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5348 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5349 {
5350 Log(("sldt: Guest intercept -> VM-exit\n"));
5351 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5352 }
5353
5354 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5355
5356 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5357 switch (enmEffOpSize)
5358 {
5359 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5360 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5361 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5362 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5363 }
5364 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5365 return VINF_SUCCESS;
5366}
5367
5368
5369/**
5370 * Implements sldt mem.
5371 *
5372 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5373 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5374 */
5375IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5376{
5377 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5378
5379 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5380 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5381 if (rcStrict == VINF_SUCCESS)
5382 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5383 return rcStrict;
5384}
5385
5386
5387/**
5388 * Implements ltr.
5389 *
5390 * @param uNewTr The new TSS selector value.
5391 */
5392IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5393{
5394 /*
5395 * Check preconditions.
5396 */
5397 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5398 {
5399 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5400 return iemRaiseUndefinedOpcode(pVCpu);
5401 }
5402 if (pVCpu->iem.s.uCpl != 0)
5403 {
5404 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5405 return iemRaiseGeneralProtectionFault0(pVCpu);
5406 }
5407 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5408 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5409 {
5410 Log(("ltr: Guest intercept -> VM-exit\n"));
5411 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5412 }
5413 if (uNewTr & X86_SEL_LDT)
5414 {
5415 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5416 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5417 }
5418 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5419 {
5420 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5421 return iemRaiseGeneralProtectionFault0(pVCpu);
5422 }
5423 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5424 {
5425 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5426 IEM_SVM_UPDATE_NRIP(pVCpu);
5427 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5428 }
5429
5430 /*
5431 * Read the descriptor.
5432 */
5433 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5434 IEMSELDESC Desc;
5435 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5436 if (rcStrict != VINF_SUCCESS)
5437 return rcStrict;
5438
5439 /* Check GPs first. */
5440 if (Desc.Legacy.Gen.u1DescType)
5441 {
5442 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5443 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5444 }
5445 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5446 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5447 || IEM_IS_LONG_MODE(pVCpu)) )
5448 {
5449 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5450 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5451 }
5452 uint64_t u64Base;
5453 if (!IEM_IS_LONG_MODE(pVCpu))
5454 u64Base = X86DESC_BASE(&Desc.Legacy);
5455 else
5456 {
5457 if (Desc.Long.Gen.u5Zeros)
5458 {
5459 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5460 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5461 }
5462
5463 u64Base = X86DESC64_BASE(&Desc.Long);
5464 if (!IEM_IS_CANONICAL(u64Base))
5465 {
5466 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5467 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5468 }
5469 }
5470
5471 /* NP */
5472 if (!Desc.Legacy.Gen.u1Present)
5473 {
5474 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5475 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5476 }
5477
5478 /*
5479 * Set it busy.
5480 * Note! Intel says this should lock down the whole descriptor, but we'll
5481 * restrict our selves to 32-bit for now due to lack of inline
5482 * assembly and such.
5483 */
5484 void *pvDesc;
5485 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
5486 IEM_ACCESS_DATA_RW, 0);
5487 if (rcStrict != VINF_SUCCESS)
5488 return rcStrict;
5489 switch ((uintptr_t)pvDesc & 3)
5490 {
5491 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5492 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5493 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5494 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5495 }
5496 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5497 if (rcStrict != VINF_SUCCESS)
5498 return rcStrict;
5499 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5500
5501 /*
5502 * It checks out alright, update the registers.
5503 */
5504/** @todo check if the actual value is loaded or if the RPL is dropped */
5505 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5506 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5507 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5508 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5509 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5510 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5511
5512 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5513 return VINF_SUCCESS;
5514}
5515
5516
5517/**
5518 * Implements str GReg
5519 *
5520 * @param iGReg The general register to store the CRx value in.
5521 * @param enmEffOpSize The operand size.
5522 */
5523IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5524{
5525 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5526 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5527 {
5528 Log(("str_reg: Guest intercept -> VM-exit\n"));
5529 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5530 }
5531
5532 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5533
5534 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5535 switch (enmEffOpSize)
5536 {
5537 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5538 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5539 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5540 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5541 }
5542 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5543 return VINF_SUCCESS;
5544}
5545
5546
5547/**
5548 * Implements str mem.
5549 *
5550 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5551 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5552 */
5553IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5554{
5555 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5556 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5557 {
5558 Log(("str_mem: Guest intercept -> VM-exit\n"));
5559 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5560 }
5561
5562 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5563
5564 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5565 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5566 if (rcStrict == VINF_SUCCESS)
5567 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5568 return rcStrict;
5569}
5570
5571
5572/**
5573 * Implements mov GReg,CRx.
5574 *
5575 * @param iGReg The general register to store the CRx value in.
5576 * @param iCrReg The CRx register to read (valid).
5577 */
5578IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5579{
5580 if (pVCpu->iem.s.uCpl != 0)
5581 return iemRaiseGeneralProtectionFault0(pVCpu);
5582 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5583
5584 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5585 {
5586 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5587 IEM_SVM_UPDATE_NRIP(pVCpu);
5588 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5589 }
5590
5591 /* Read it. */
5592 uint64_t crX;
5593 switch (iCrReg)
5594 {
5595 case 0:
5596 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5597 crX = pVCpu->cpum.GstCtx.cr0;
5598 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5599 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5600 break;
5601 case 2:
5602 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5603 crX = pVCpu->cpum.GstCtx.cr2;
5604 break;
5605 case 3:
5606 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5607 crX = pVCpu->cpum.GstCtx.cr3;
5608 break;
5609 case 4:
5610 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5611 crX = pVCpu->cpum.GstCtx.cr4;
5612 break;
5613 case 8:
5614 {
5615 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5616#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5617 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5618 {
5619 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5620 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5621 return rcStrict;
5622
5623 /*
5624 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5625 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5626 * are cleared.
5627 *
5628 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5629 */
5630 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5631 {
5632 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5633 crX = (uTpr >> 4) & 0xf;
5634 break;
5635 }
5636 }
5637#endif
5638#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5639 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5640 {
5641 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5642 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5643 {
5644 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5645 break;
5646 }
5647 }
5648#endif
5649 uint8_t uTpr;
5650 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5651 if (RT_SUCCESS(rc))
5652 crX = uTpr >> 4;
5653 else
5654 crX = 0;
5655 break;
5656 }
5657 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5658 }
5659
5660#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5661 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5662 {
5663 switch (iCrReg)
5664 {
5665 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5666 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5667 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5668
5669 case 3:
5670 {
5671 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5672 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5673 return rcStrict;
5674 break;
5675 }
5676 }
5677 }
5678#endif
5679
5680 /* Store it. */
5681 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5682 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5683 else
5684 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5685
5686 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5687 return VINF_SUCCESS;
5688}
5689
5690
5691/**
5692 * Implements smsw GReg.
5693 *
5694 * @param iGReg The general register to store the CRx value in.
5695 * @param enmEffOpSize The operand size.
5696 */
5697IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5698{
5699 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5700
5701#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5702 uint64_t u64MaskedCr0;
5703 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5704 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5705 else
5706 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5707 uint64_t const u64GuestCr0 = u64MaskedCr0;
5708#else
5709 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5710#endif
5711
5712 switch (enmEffOpSize)
5713 {
5714 case IEMMODE_16BIT:
5715 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5716 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5717 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5718 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5719 else
5720 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5721 break;
5722
5723 case IEMMODE_32BIT:
5724 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5725 break;
5726
5727 case IEMMODE_64BIT:
5728 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5729 break;
5730
5731 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5732 }
5733
5734 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5735 return VINF_SUCCESS;
5736}
5737
5738
5739/**
5740 * Implements smsw mem.
5741 *
5742 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5743 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5744 */
5745IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5746{
5747 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5748
5749#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5750 uint64_t u64MaskedCr0;
5751 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5752 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5753 else
5754 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5755 uint64_t const u64GuestCr0 = u64MaskedCr0;
5756#else
5757 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5758#endif
5759
5760 uint16_t u16Value;
5761 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5762 u16Value = (uint16_t)u64GuestCr0;
5763 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5764 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5765 else
5766 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5767
5768 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5769 if (rcStrict == VINF_SUCCESS)
5770 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5771 return rcStrict;
5772}
5773
5774
5775/**
5776 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5777 */
5778#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5779 do \
5780 { \
5781 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5782 if (RT_SUCCESS(rcX)) \
5783 { /* likely */ } \
5784 else \
5785 { \
5786 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5787 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5788 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5789 } \
5790 } while (0)
5791
5792
5793/**
5794 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5795 *
5796 * @param iCrReg The CRx register to write (valid).
5797 * @param uNewCrX The new value.
5798 * @param enmAccessCrX The instruction that caused the CrX load.
5799 * @param iGReg The general register in case of a 'mov CRx,GReg'
5800 * instruction.
5801 */
5802IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5803{
5804 VBOXSTRICTRC rcStrict;
5805 int rc;
5806#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5807 RT_NOREF2(iGReg, enmAccessCrX);
5808#endif
5809
5810 /*
5811 * Try store it.
5812 * Unfortunately, CPUM only does a tiny bit of the work.
5813 */
5814 switch (iCrReg)
5815 {
5816 case 0:
5817 {
5818 /*
5819 * Perform checks.
5820 */
5821 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5822
5823 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5824 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5825
5826 /* ET is hardcoded on 486 and later. */
5827 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5828 uNewCrX |= X86_CR0_ET;
5829 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5830 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5831 {
5832 uNewCrX &= fValid;
5833 uNewCrX |= X86_CR0_ET;
5834 }
5835 else
5836 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5837
5838 /* Check for reserved bits. */
5839 if (uNewCrX & ~(uint64_t)fValid)
5840 {
5841 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5842 return iemRaiseGeneralProtectionFault0(pVCpu);
5843 }
5844
5845 /* Check for invalid combinations. */
5846 if ( (uNewCrX & X86_CR0_PG)
5847 && !(uNewCrX & X86_CR0_PE) )
5848 {
5849 Log(("Trying to set CR0.PG without CR0.PE\n"));
5850 return iemRaiseGeneralProtectionFault0(pVCpu);
5851 }
5852
5853 if ( !(uNewCrX & X86_CR0_CD)
5854 && (uNewCrX & X86_CR0_NW) )
5855 {
5856 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5857 return iemRaiseGeneralProtectionFault0(pVCpu);
5858 }
5859
5860 if ( !(uNewCrX & X86_CR0_PG)
5861 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5862 {
5863 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5864 return iemRaiseGeneralProtectionFault0(pVCpu);
5865 }
5866
5867 /* Long mode consistency checks. */
5868 if ( (uNewCrX & X86_CR0_PG)
5869 && !(uOldCrX & X86_CR0_PG)
5870 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5871 {
5872 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5873 {
5874 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5875 return iemRaiseGeneralProtectionFault0(pVCpu);
5876 }
5877 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5878 {
5879 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5880 return iemRaiseGeneralProtectionFault0(pVCpu);
5881 }
5882 }
5883
5884 /* Check for bits that must remain set or cleared in VMX operation,
5885 see Intel spec. 23.8 "Restrictions on VMX operation". */
5886 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5887 {
5888#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5889 uint64_t const uCr0Fixed0 = IEM_VMX_IS_NON_ROOT_MODE(pVCpu) ? iemVmxGetCr0Fixed0(pVCpu) : VMX_V_CR0_FIXED0;
5890#else
5891 uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
5892#endif
5893 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5894 {
5895 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5896 return iemRaiseGeneralProtectionFault0(pVCpu);
5897 }
5898
5899 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5900 if (uNewCrX & ~uCr0Fixed1)
5901 {
5902 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5903 return iemRaiseGeneralProtectionFault0(pVCpu);
5904 }
5905 }
5906
5907 /*
5908 * SVM nested-guest CR0 write intercepts.
5909 */
5910 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5911 {
5912 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5913 IEM_SVM_UPDATE_NRIP(pVCpu);
5914 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5915 }
5916 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5917 {
5918 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5919 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5920 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5921 {
5922 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5923 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5924 IEM_SVM_UPDATE_NRIP(pVCpu);
5925 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5926 }
5927 }
5928
5929 /*
5930 * Change EFER.LMA if entering or leaving long mode.
5931 */
5932 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5933 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5934 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5935 {
5936 if (uNewCrX & X86_CR0_PG)
5937 NewEFER |= MSR_K6_EFER_LMA;
5938 else
5939 NewEFER &= ~MSR_K6_EFER_LMA;
5940
5941 CPUMSetGuestEFER(pVCpu, NewEFER);
5942 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5943 }
5944
5945 /*
5946 * Inform PGM.
5947 */
5948 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5949 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5950 {
5951 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
5952 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
5953 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5954 { /* likely */ }
5955 else
5956 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
5957 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5958 AssertRCReturn(rc, rc);
5959 /* ignore informational status codes */
5960 }
5961
5962 /*
5963 * Change CR0.
5964 */
5965 CPUMSetGuestCR0(pVCpu, uNewCrX);
5966 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
5967
5968 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
5969 false /* fForce */);
5970 break;
5971 }
5972
5973 /*
5974 * CR2 can be changed without any restrictions.
5975 */
5976 case 2:
5977 {
5978 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5979 {
5980 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5981 IEM_SVM_UPDATE_NRIP(pVCpu);
5982 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5983 }
5984 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
5985 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
5986 rcStrict = VINF_SUCCESS;
5987 break;
5988 }
5989
5990 /*
5991 * CR3 is relatively simple, although AMD and Intel have different
5992 * accounts of how setting reserved bits are handled. We take intel's
5993 * word for the lower bits and AMD's for the high bits (63:52). The
5994 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5995 * on this.
5996 */
5997 /** @todo Testcase: Setting reserved bits in CR3, especially before
5998 * enabling paging. */
5999 case 3:
6000 {
6001 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6002
6003 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6004 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6005 && (uNewCrX & RT_BIT_64(63)))
6006 {
6007 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6008 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6009 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6010 * Paging-Structure Caches". */
6011 uNewCrX &= ~RT_BIT_64(63);
6012 }
6013
6014 /* Check / mask the value. */
6015#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6016 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6017 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6018 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6019 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6020#else
6021 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6022#endif
6023 if (uNewCrX & fInvPhysMask)
6024 {
6025 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6026 * very vague in this area. As mentioned above, need testcase on real
6027 * hardware... Sigh. */
6028 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6029 return iemRaiseGeneralProtectionFault0(pVCpu);
6030 }
6031
6032 uint64_t fValid;
6033 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6034 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6035 {
6036 /** @todo Redundant? This value has already been validated above. */
6037 fValid = UINT64_C(0x000fffffffffffff);
6038 }
6039 else
6040 fValid = UINT64_C(0xffffffff);
6041 if (uNewCrX & ~fValid)
6042 {
6043 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6044 uNewCrX, uNewCrX & ~fValid));
6045 uNewCrX &= fValid;
6046 }
6047
6048 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6049 {
6050 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6051 IEM_SVM_UPDATE_NRIP(pVCpu);
6052 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6053 }
6054
6055 /* Inform PGM. */
6056 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6057 {
6058 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6059 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6060 { /* likely */ }
6061 else
6062 {
6063 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6064 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6065 }
6066 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6067 AssertRCReturn(rc, rc);
6068 /* ignore informational status codes */
6069 }
6070
6071 /* Make the change. */
6072 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6073 AssertRCSuccessReturn(rc, rc);
6074
6075 rcStrict = VINF_SUCCESS;
6076 break;
6077 }
6078
6079 /*
6080 * CR4 is a bit more tedious as there are bits which cannot be cleared
6081 * under some circumstances and such.
6082 */
6083 case 4:
6084 {
6085 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6086 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6087
6088 /* Reserved bits. */
6089 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6090 if (uNewCrX & ~(uint64_t)fValid)
6091 {
6092 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6093 return iemRaiseGeneralProtectionFault0(pVCpu);
6094 }
6095
6096 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6097 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6098
6099 /* PCIDE check. */
6100 if ( fPcide
6101 && ( !fLongMode
6102 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6103 {
6104 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6105 return iemRaiseGeneralProtectionFault0(pVCpu);
6106 }
6107
6108 /* PAE check. */
6109 if ( fLongMode
6110 && (uOldCrX & X86_CR4_PAE)
6111 && !(uNewCrX & X86_CR4_PAE))
6112 {
6113 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6114 return iemRaiseGeneralProtectionFault0(pVCpu);
6115 }
6116
6117 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6118 {
6119 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6120 IEM_SVM_UPDATE_NRIP(pVCpu);
6121 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6122 }
6123
6124 /* Check for bits that must remain set or cleared in VMX operation,
6125 see Intel spec. 23.8 "Restrictions on VMX operation". */
6126 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6127 {
6128 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6129 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6130 {
6131 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6132 return iemRaiseGeneralProtectionFault0(pVCpu);
6133 }
6134
6135 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6136 if (uNewCrX & ~uCr4Fixed1)
6137 {
6138 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6139 return iemRaiseGeneralProtectionFault0(pVCpu);
6140 }
6141 }
6142
6143 /*
6144 * Notify PGM.
6145 */
6146 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6147 {
6148 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6149 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6150 { /* likely */ }
6151 else
6152 {
6153 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6154 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6155 }
6156 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6157 AssertRCReturn(rc, rc);
6158 /* ignore informational status codes */
6159 }
6160
6161 /*
6162 * Change it.
6163 */
6164 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6165 AssertRCSuccessReturn(rc, rc);
6166 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6167
6168 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6169 false /* fForce */);
6170 break;
6171 }
6172
6173 /*
6174 * CR8 maps to the APIC TPR.
6175 */
6176 case 8:
6177 {
6178 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6179 if (uNewCrX & ~(uint64_t)0xf)
6180 {
6181 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6182 return iemRaiseGeneralProtectionFault0(pVCpu);
6183 }
6184
6185#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6186 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6187 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6188 {
6189 /*
6190 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6191 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6192 * cleared. Following this the processor performs TPR virtualization.
6193 *
6194 * However, we should not perform TPR virtualization immediately here but
6195 * after this instruction has completed.
6196 *
6197 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6198 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6199 */
6200 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6201 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6202 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6203 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6204 rcStrict = VINF_SUCCESS;
6205 break;
6206 }
6207#endif
6208
6209#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6210 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6211 {
6212 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6213 {
6214 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6215 IEM_SVM_UPDATE_NRIP(pVCpu);
6216 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6217 }
6218
6219 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6220 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6221 {
6222 rcStrict = VINF_SUCCESS;
6223 break;
6224 }
6225 }
6226#endif
6227 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6228 APICSetTpr(pVCpu, u8Tpr);
6229 rcStrict = VINF_SUCCESS;
6230 break;
6231 }
6232
6233 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6234 }
6235
6236 /*
6237 * Advance the RIP on success.
6238 */
6239 if (RT_SUCCESS(rcStrict))
6240 {
6241 if (rcStrict != VINF_SUCCESS)
6242 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6243 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6244 }
6245
6246 return rcStrict;
6247}
6248
6249
6250/**
6251 * Implements mov CRx,GReg.
6252 *
6253 * @param iCrReg The CRx register to write (valid).
6254 * @param iGReg The general register to load the CRx value from.
6255 */
6256IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6257{
6258 if (pVCpu->iem.s.uCpl != 0)
6259 return iemRaiseGeneralProtectionFault0(pVCpu);
6260 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6261
6262 /*
6263 * Read the new value from the source register and call common worker.
6264 */
6265 uint64_t uNewCrX;
6266 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6267 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6268 else
6269 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6270
6271#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6272 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6273 {
6274 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6275 switch (iCrReg)
6276 {
6277 case 0:
6278 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6279 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6280 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6281 }
6282 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6283 return rcStrict;
6284 }
6285#endif
6286
6287 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6288}
6289
6290
6291/**
6292 * Implements 'LMSW r/m16'
6293 *
6294 * @param u16NewMsw The new value.
6295 * @param GCPtrEffDst The guest-linear address of the source operand in case
6296 * of a memory operand. For register operand, pass
6297 * NIL_RTGCPTR.
6298 */
6299IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6300{
6301 if (pVCpu->iem.s.uCpl != 0)
6302 return iemRaiseGeneralProtectionFault0(pVCpu);
6303 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6304 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6305
6306#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6307 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6308 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6309 {
6310 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6311 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6312 return rcStrict;
6313 }
6314#else
6315 RT_NOREF_PV(GCPtrEffDst);
6316#endif
6317
6318 /*
6319 * Compose the new CR0 value and call common worker.
6320 */
6321 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6322 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6323 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6324}
6325
6326
6327/**
6328 * Implements 'CLTS'.
6329 */
6330IEM_CIMPL_DEF_0(iemCImpl_clts)
6331{
6332 if (pVCpu->iem.s.uCpl != 0)
6333 return iemRaiseGeneralProtectionFault0(pVCpu);
6334
6335 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6336 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6337 uNewCr0 &= ~X86_CR0_TS;
6338
6339#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6340 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6341 {
6342 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6343 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6344 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6345 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6346 return rcStrict;
6347 }
6348#endif
6349
6350 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6351}
6352
6353
6354/**
6355 * Implements mov GReg,DRx.
6356 *
6357 * @param iGReg The general register to store the DRx value in.
6358 * @param iDrReg The DRx register to read (0-7).
6359 */
6360IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6361{
6362#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6363 /*
6364 * Check nested-guest VMX intercept.
6365 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6366 * over CPL and CR4.DE and even DR4/DR5 checks.
6367 *
6368 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6369 */
6370 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6371 {
6372 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6373 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6374 return rcStrict;
6375 }
6376#endif
6377
6378 /*
6379 * Check preconditions.
6380 */
6381 /* Raise GPs. */
6382 if (pVCpu->iem.s.uCpl != 0)
6383 return iemRaiseGeneralProtectionFault0(pVCpu);
6384 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6385 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR0);
6386
6387 if ( (iDrReg == 4 || iDrReg == 5)
6388 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE) )
6389 {
6390 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6391 return iemRaiseGeneralProtectionFault0(pVCpu);
6392 }
6393
6394 /* Raise #DB if general access detect is enabled. */
6395 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6396 {
6397 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6398 return iemRaiseDebugException(pVCpu);
6399 }
6400
6401 /*
6402 * Read the debug register and store it in the specified general register.
6403 */
6404 uint64_t drX;
6405 switch (iDrReg)
6406 {
6407 case 0:
6408 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6409 drX = pVCpu->cpum.GstCtx.dr[0];
6410 break;
6411 case 1:
6412 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6413 drX = pVCpu->cpum.GstCtx.dr[1];
6414 break;
6415 case 2:
6416 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6417 drX = pVCpu->cpum.GstCtx.dr[2];
6418 break;
6419 case 3:
6420 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6421 drX = pVCpu->cpum.GstCtx.dr[3];
6422 break;
6423 case 6:
6424 case 4:
6425 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6426 drX = pVCpu->cpum.GstCtx.dr[6];
6427 drX |= X86_DR6_RA1_MASK;
6428 drX &= ~X86_DR6_RAZ_MASK;
6429 break;
6430 case 7:
6431 case 5:
6432 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6433 drX = pVCpu->cpum.GstCtx.dr[7];
6434 drX |=X86_DR7_RA1_MASK;
6435 drX &= ~X86_DR7_RAZ_MASK;
6436 break;
6437 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6438 }
6439
6440 /** @todo SVM nested-guest intercept for DR8-DR15? */
6441 /*
6442 * Check for any SVM nested-guest intercepts for the DRx read.
6443 */
6444 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6445 {
6446 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6447 IEM_SVM_UPDATE_NRIP(pVCpu);
6448 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6449 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6450 }
6451
6452 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6453 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6454 else
6455 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6456
6457 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6458 return VINF_SUCCESS;
6459}
6460
6461
6462/**
6463 * Implements mov DRx,GReg.
6464 *
6465 * @param iDrReg The DRx register to write (valid).
6466 * @param iGReg The general register to load the DRx value from.
6467 */
6468IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6469{
6470#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6471 /*
6472 * Check nested-guest VMX intercept.
6473 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6474 * over CPL and CR4.DE and even DR4/DR5 checks.
6475 *
6476 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6477 */
6478 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6479 {
6480 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6481 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6482 return rcStrict;
6483 }
6484#endif
6485
6486 /*
6487 * Check preconditions.
6488 */
6489 if (pVCpu->iem.s.uCpl != 0)
6490 return iemRaiseGeneralProtectionFault0(pVCpu);
6491 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6492 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR4);
6493
6494 if (iDrReg == 4 || iDrReg == 5)
6495 {
6496 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6497 {
6498 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6499 return iemRaiseGeneralProtectionFault0(pVCpu);
6500 }
6501 iDrReg += 2;
6502 }
6503
6504 /* Raise #DB if general access detect is enabled. */
6505 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6506 * \#GP? */
6507 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6508 {
6509 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6510 return iemRaiseDebugException(pVCpu);
6511 }
6512
6513 /*
6514 * Read the new value from the source register.
6515 */
6516 uint64_t uNewDrX;
6517 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6518 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6519 else
6520 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6521
6522 /*
6523 * Adjust it.
6524 */
6525 switch (iDrReg)
6526 {
6527 case 0:
6528 case 1:
6529 case 2:
6530 case 3:
6531 /* nothing to adjust */
6532 break;
6533
6534 case 6:
6535 if (uNewDrX & X86_DR6_MBZ_MASK)
6536 {
6537 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6538 return iemRaiseGeneralProtectionFault0(pVCpu);
6539 }
6540 uNewDrX |= X86_DR6_RA1_MASK;
6541 uNewDrX &= ~X86_DR6_RAZ_MASK;
6542 break;
6543
6544 case 7:
6545 if (uNewDrX & X86_DR7_MBZ_MASK)
6546 {
6547 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6548 return iemRaiseGeneralProtectionFault0(pVCpu);
6549 }
6550 uNewDrX |= X86_DR7_RA1_MASK;
6551 uNewDrX &= ~X86_DR7_RAZ_MASK;
6552 break;
6553
6554 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6555 }
6556
6557 /** @todo SVM nested-guest intercept for DR8-DR15? */
6558 /*
6559 * Check for any SVM nested-guest intercepts for the DRx write.
6560 */
6561 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6562 {
6563 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6564 IEM_SVM_UPDATE_NRIP(pVCpu);
6565 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6566 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6567 }
6568
6569 /*
6570 * Do the actual setting.
6571 */
6572 if (iDrReg < 4)
6573 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6574 else if (iDrReg == 6)
6575 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6576
6577 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6578 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6579
6580 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6581 return VINF_SUCCESS;
6582}
6583
6584
6585/**
6586 * Implements mov GReg,TRx.
6587 *
6588 * @param iGReg The general register to store the
6589 * TRx value in.
6590 * @param iTrReg The TRx register to read (6/7).
6591 */
6592IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6593{
6594 /*
6595 * Check preconditions. NB: This instruction is 386/486 only.
6596 */
6597
6598 /* Raise GPs. */
6599 if (pVCpu->iem.s.uCpl != 0)
6600 return iemRaiseGeneralProtectionFault0(pVCpu);
6601 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6602
6603 if (iTrReg < 6 || iTrReg > 7)
6604 {
6605 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6606 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6607 return iemRaiseGeneralProtectionFault0(pVCpu);
6608 }
6609
6610 /*
6611 * Read the test register and store it in the specified general register.
6612 * This is currently a dummy implementation that only exists to satisfy
6613 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6614 * TR6/TR7 registers. Software which actually depends on the TR values
6615 * (different on 386/486) is exceedingly rare.
6616 */
6617 uint64_t trX;
6618 switch (iTrReg)
6619 {
6620 case 6:
6621 trX = 0; /* Currently a dummy. */
6622 break;
6623 case 7:
6624 trX = 0; /* Currently a dummy. */
6625 break;
6626 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6627 }
6628
6629 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)trX;
6630
6631 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6632 return VINF_SUCCESS;
6633}
6634
6635
6636/**
6637 * Implements mov TRx,GReg.
6638 *
6639 * @param iTrReg The TRx register to write (valid).
6640 * @param iGReg The general register to load the TRx
6641 * value from.
6642 */
6643IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6644{
6645 /*
6646 * Check preconditions. NB: This instruction is 386/486 only.
6647 */
6648
6649 /* Raise GPs. */
6650 if (pVCpu->iem.s.uCpl != 0)
6651 return iemRaiseGeneralProtectionFault0(pVCpu);
6652 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6653
6654 if (iTrReg < 6 || iTrReg > 7)
6655 {
6656 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6657 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6658 return iemRaiseGeneralProtectionFault0(pVCpu);
6659 }
6660
6661 /*
6662 * Read the new value from the source register.
6663 */
6664 uint64_t uNewTrX;
6665 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6666 uNewTrX = iemGRegFetchU64(pVCpu, iGReg);
6667 else
6668 uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6669
6670 /*
6671 * Here we would do the actual setting if this weren't a dummy implementation.
6672 * This is currently a dummy implementation that only exists to prevent
6673 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6674 */
6675 RT_NOREF(uNewTrX);
6676
6677 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6678 return VINF_SUCCESS;
6679}
6680
6681
6682/**
6683 * Implements 'INVLPG m'.
6684 *
6685 * @param GCPtrPage The effective address of the page to invalidate.
6686 * @remarks Updates the RIP.
6687 */
6688IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6689{
6690 /* ring-0 only. */
6691 if (pVCpu->iem.s.uCpl != 0)
6692 return iemRaiseGeneralProtectionFault0(pVCpu);
6693 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6694 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6695
6696#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6697 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6698 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6699 {
6700 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6701 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6702 }
6703#endif
6704
6705 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6706 {
6707 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6708 IEM_SVM_UPDATE_NRIP(pVCpu);
6709 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6710 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6711 }
6712
6713 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6714 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6715
6716 if (rc == VINF_SUCCESS)
6717 return VINF_SUCCESS;
6718 if (rc == VINF_PGM_SYNC_CR3)
6719 return iemSetPassUpStatus(pVCpu, rc);
6720
6721 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6722 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6723 return rc;
6724}
6725
6726
6727/**
6728 * Implements INVPCID.
6729 *
6730 * @param iEffSeg The segment of the invpcid descriptor.
6731 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6732 * @param uInvpcidType The invalidation type.
6733 * @remarks Updates the RIP.
6734 */
6735IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6736{
6737 /*
6738 * Check preconditions.
6739 */
6740 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6741 return iemRaiseUndefinedOpcode(pVCpu);
6742
6743 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6744 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6745 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6746 {
6747 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6748 return iemRaiseUndefinedOpcode(pVCpu);
6749 }
6750
6751 if (pVCpu->iem.s.uCpl != 0)
6752 {
6753 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6754 return iemRaiseGeneralProtectionFault0(pVCpu);
6755 }
6756
6757 if (IEM_IS_V86_MODE(pVCpu))
6758 {
6759 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6760 return iemRaiseGeneralProtectionFault0(pVCpu);
6761 }
6762
6763 /*
6764 * Check nested-guest intercept.
6765 *
6766 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6767 * both set. We have already checked the former earlier in this function.
6768 *
6769 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6770 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6771 */
6772 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6773 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6774 {
6775 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6776 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6777 }
6778
6779 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6780 {
6781 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6782 return iemRaiseGeneralProtectionFault0(pVCpu);
6783 }
6784 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6785
6786 /*
6787 * Fetch the invpcid descriptor from guest memory.
6788 */
6789 RTUINT128U uDesc;
6790 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6791 if (rcStrict == VINF_SUCCESS)
6792 {
6793 /*
6794 * Validate the descriptor.
6795 */
6796 if (uDesc.s.Lo > 0xfff)
6797 {
6798 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6799 return iemRaiseGeneralProtectionFault0(pVCpu);
6800 }
6801
6802 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6803 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6804 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6805 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6806 switch (uInvpcidType)
6807 {
6808 case X86_INVPCID_TYPE_INDV_ADDR:
6809 {
6810 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6811 {
6812 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6813 return iemRaiseGeneralProtectionFault0(pVCpu);
6814 }
6815 if ( !(uCr4 & X86_CR4_PCIDE)
6816 && uPcid != 0)
6817 {
6818 Log(("invpcid: invalid pcid %#x\n", uPcid));
6819 return iemRaiseGeneralProtectionFault0(pVCpu);
6820 }
6821
6822 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6823 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6824 break;
6825 }
6826
6827 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6828 {
6829 if ( !(uCr4 & X86_CR4_PCIDE)
6830 && uPcid != 0)
6831 {
6832 Log(("invpcid: invalid pcid %#x\n", uPcid));
6833 return iemRaiseGeneralProtectionFault0(pVCpu);
6834 }
6835 /* Invalidate all mappings associated with PCID except global translations. */
6836 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6837 break;
6838 }
6839
6840 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6841 {
6842 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6843 break;
6844 }
6845
6846 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6847 {
6848 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6849 break;
6850 }
6851 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6852 }
6853 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6854 }
6855 return rcStrict;
6856}
6857
6858
6859/**
6860 * Implements INVD.
6861 */
6862IEM_CIMPL_DEF_0(iemCImpl_invd)
6863{
6864 if (pVCpu->iem.s.uCpl != 0)
6865 {
6866 Log(("invd: CPL != 0 -> #GP(0)\n"));
6867 return iemRaiseGeneralProtectionFault0(pVCpu);
6868 }
6869
6870 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6871 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6872
6873 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6874
6875 /* We currently take no action here. */
6876 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6877 return VINF_SUCCESS;
6878}
6879
6880
6881/**
6882 * Implements WBINVD.
6883 */
6884IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6885{
6886 if (pVCpu->iem.s.uCpl != 0)
6887 {
6888 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6889 return iemRaiseGeneralProtectionFault0(pVCpu);
6890 }
6891
6892 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6893 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6894
6895 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6896
6897 /* We currently take no action here. */
6898 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6899 return VINF_SUCCESS;
6900}
6901
6902
6903/** Opcode 0x0f 0xaa. */
6904IEM_CIMPL_DEF_0(iemCImpl_rsm)
6905{
6906 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6907 NOREF(cbInstr);
6908 return iemRaiseUndefinedOpcode(pVCpu);
6909}
6910
6911
6912/**
6913 * Implements RDTSC.
6914 */
6915IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6916{
6917 /*
6918 * Check preconditions.
6919 */
6920 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6921 return iemRaiseUndefinedOpcode(pVCpu);
6922
6923 if (pVCpu->iem.s.uCpl != 0)
6924 {
6925 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6926 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6927 {
6928 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6929 return iemRaiseGeneralProtectionFault0(pVCpu);
6930 }
6931 }
6932
6933 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6934 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6935 {
6936 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6937 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6938 }
6939
6940 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6941 {
6942 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6943 IEM_SVM_UPDATE_NRIP(pVCpu);
6944 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6945 }
6946
6947 /*
6948 * Do the job.
6949 */
6950 uint64_t uTicks = TMCpuTickGet(pVCpu);
6951#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6952 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6953#endif
6954 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6955 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6956 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
6957 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6958 return VINF_SUCCESS;
6959}
6960
6961
6962/**
6963 * Implements RDTSC.
6964 */
6965IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
6966{
6967 /*
6968 * Check preconditions.
6969 */
6970 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6971 return iemRaiseUndefinedOpcode(pVCpu);
6972
6973 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6974 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
6975 {
6976 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
6977 return iemRaiseUndefinedOpcode(pVCpu);
6978 }
6979
6980 if (pVCpu->iem.s.uCpl != 0)
6981 {
6982 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6983 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6984 {
6985 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6986 return iemRaiseGeneralProtectionFault0(pVCpu);
6987 }
6988 }
6989
6990 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6991 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6992 {
6993 Log(("rdtscp: Guest intercept -> VM-exit\n"));
6994 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
6995 }
6996 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6997 {
6998 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6999 IEM_SVM_UPDATE_NRIP(pVCpu);
7000 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7001 }
7002
7003 /*
7004 * Do the job.
7005 * Query the MSR first in case of trips to ring-3.
7006 */
7007 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7008 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7009 if (rcStrict == VINF_SUCCESS)
7010 {
7011 /* Low dword of the TSC_AUX msr only. */
7012 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7013
7014 uint64_t uTicks = TMCpuTickGet(pVCpu);
7015#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7016 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7017#endif
7018 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7019 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7020 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7021 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7022 }
7023 return rcStrict;
7024}
7025
7026
7027/**
7028 * Implements RDPMC.
7029 */
7030IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7031{
7032 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7033
7034 if ( pVCpu->iem.s.uCpl != 0
7035 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7036 return iemRaiseGeneralProtectionFault0(pVCpu);
7037
7038 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7039 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7040 {
7041 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7042 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7043 }
7044
7045 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7046 {
7047 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7048 IEM_SVM_UPDATE_NRIP(pVCpu);
7049 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7050 }
7051
7052 /** @todo Emulate performance counters, for now just return 0. */
7053 pVCpu->cpum.GstCtx.rax = 0;
7054 pVCpu->cpum.GstCtx.rdx = 0;
7055 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7056 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7057 * ecx but see @bugref{3472}! */
7058
7059 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7060 return VINF_SUCCESS;
7061}
7062
7063
7064/**
7065 * Implements RDMSR.
7066 */
7067IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7068{
7069 /*
7070 * Check preconditions.
7071 */
7072 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7073 return iemRaiseUndefinedOpcode(pVCpu);
7074 if (pVCpu->iem.s.uCpl != 0)
7075 return iemRaiseGeneralProtectionFault0(pVCpu);
7076
7077 /*
7078 * Check nested-guest intercepts.
7079 */
7080#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7081 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7082 {
7083 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7084 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7085 }
7086#endif
7087
7088#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7089 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7090 {
7091 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
7092 if (rcStrict == VINF_SVM_VMEXIT)
7093 return VINF_SUCCESS;
7094 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7095 {
7096 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7097 return rcStrict;
7098 }
7099 }
7100#endif
7101
7102 /*
7103 * Do the job.
7104 */
7105 RTUINT64U uValue;
7106 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7107 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7108
7109 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7110 if (rcStrict == VINF_SUCCESS)
7111 {
7112 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7113 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7114 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7115
7116 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7117 return VINF_SUCCESS;
7118 }
7119
7120#ifndef IN_RING3
7121 /* Deferred to ring-3. */
7122 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7123 {
7124 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7125 return rcStrict;
7126 }
7127#endif
7128
7129 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7130 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7131 {
7132 pVCpu->iem.s.cLogRelRdMsr++;
7133 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7134 }
7135 else
7136 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7137 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7138 return iemRaiseGeneralProtectionFault0(pVCpu);
7139}
7140
7141
7142/**
7143 * Implements WRMSR.
7144 */
7145IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7146{
7147 /*
7148 * Check preconditions.
7149 */
7150 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7151 return iemRaiseUndefinedOpcode(pVCpu);
7152 if (pVCpu->iem.s.uCpl != 0)
7153 return iemRaiseGeneralProtectionFault0(pVCpu);
7154
7155 RTUINT64U uValue;
7156 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7157 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7158
7159 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7160
7161 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7162 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7163
7164 /*
7165 * Check nested-guest intercepts.
7166 */
7167#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7168 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7169 {
7170 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7171 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7172 }
7173#endif
7174
7175#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7176 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7177 {
7178 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
7179 if (rcStrict == VINF_SVM_VMEXIT)
7180 return VINF_SUCCESS;
7181 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7182 {
7183 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7184 return rcStrict;
7185 }
7186 }
7187#endif
7188
7189 /*
7190 * Do the job.
7191 */
7192 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7193 if (rcStrict == VINF_SUCCESS)
7194 {
7195 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7196 return VINF_SUCCESS;
7197 }
7198
7199#ifndef IN_RING3
7200 /* Deferred to ring-3. */
7201 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7202 {
7203 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7204 return rcStrict;
7205 }
7206#endif
7207
7208 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7209 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7210 {
7211 pVCpu->iem.s.cLogRelWrMsr++;
7212 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7213 }
7214 else
7215 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7216 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7217 return iemRaiseGeneralProtectionFault0(pVCpu);
7218}
7219
7220
7221/**
7222 * Implements 'IN eAX, port'.
7223 *
7224 * @param u16Port The source port.
7225 * @param fImm Whether the port was specified through an immediate operand
7226 * or the implicit DX register.
7227 * @param cbReg The register size.
7228 */
7229IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7230{
7231 /*
7232 * CPL check
7233 */
7234 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7235 if (rcStrict != VINF_SUCCESS)
7236 return rcStrict;
7237
7238 /*
7239 * Check VMX nested-guest IO intercept.
7240 */
7241#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7242 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7243 {
7244 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
7245 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7246 return rcStrict;
7247 }
7248#else
7249 RT_NOREF(fImm);
7250#endif
7251
7252 /*
7253 * Check SVM nested-guest IO intercept.
7254 */
7255#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7256 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7257 {
7258 uint8_t cAddrSizeBits;
7259 switch (pVCpu->iem.s.enmEffAddrMode)
7260 {
7261 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7262 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7263 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7264 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7265 }
7266 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7267 false /* fRep */, false /* fStrIo */, cbInstr);
7268 if (rcStrict == VINF_SVM_VMEXIT)
7269 return VINF_SUCCESS;
7270 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7271 {
7272 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7273 VBOXSTRICTRC_VAL(rcStrict)));
7274 return rcStrict;
7275 }
7276 }
7277#endif
7278
7279 /*
7280 * Perform the I/O.
7281 */
7282 uint32_t u32Value = 0;
7283 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
7284 if (IOM_SUCCESS(rcStrict))
7285 {
7286 switch (cbReg)
7287 {
7288 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7289 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7290 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7291 default: AssertFailedReturn(VERR_IEM_IPE_3);
7292 }
7293 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7294 pVCpu->iem.s.cPotentialExits++;
7295 if (rcStrict != VINF_SUCCESS)
7296 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7297 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7298
7299 /*
7300 * Check for I/O breakpoints.
7301 */
7302 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7303 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7304 && X86_DR7_ANY_RW_IO(uDr7)
7305 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7306 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7307 {
7308 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7309 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7310 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7311 rcStrict = iemRaiseDebugException(pVCpu);
7312 }
7313 }
7314
7315 return rcStrict;
7316}
7317
7318
7319/**
7320 * Implements 'IN eAX, DX'.
7321 *
7322 * @param cbReg The register size.
7323 */
7324IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
7325{
7326 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7327}
7328
7329
7330/**
7331 * Implements 'OUT port, eAX'.
7332 *
7333 * @param u16Port The destination port.
7334 * @param fImm Whether the port was specified through an immediate operand
7335 * or the implicit DX register.
7336 * @param cbReg The register size.
7337 */
7338IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7339{
7340 /*
7341 * CPL check
7342 */
7343 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7344 if (rcStrict != VINF_SUCCESS)
7345 return rcStrict;
7346
7347 /*
7348 * Check VMX nested-guest I/O intercept.
7349 */
7350#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7351 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7352 {
7353 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
7354 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7355 return rcStrict;
7356 }
7357#else
7358 RT_NOREF(fImm);
7359#endif
7360
7361 /*
7362 * Check SVM nested-guest I/O intercept.
7363 */
7364#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7365 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7366 {
7367 uint8_t cAddrSizeBits;
7368 switch (pVCpu->iem.s.enmEffAddrMode)
7369 {
7370 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7371 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7372 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7373 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7374 }
7375 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7376 false /* fRep */, false /* fStrIo */, cbInstr);
7377 if (rcStrict == VINF_SVM_VMEXIT)
7378 return VINF_SUCCESS;
7379 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7380 {
7381 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7382 VBOXSTRICTRC_VAL(rcStrict)));
7383 return rcStrict;
7384 }
7385 }
7386#endif
7387
7388 /*
7389 * Perform the I/O.
7390 */
7391 uint32_t u32Value;
7392 switch (cbReg)
7393 {
7394 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7395 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7396 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7397 default: AssertFailedReturn(VERR_IEM_IPE_4);
7398 }
7399 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
7400 if (IOM_SUCCESS(rcStrict))
7401 {
7402 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7403 pVCpu->iem.s.cPotentialExits++;
7404 if (rcStrict != VINF_SUCCESS)
7405 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7406 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7407
7408 /*
7409 * Check for I/O breakpoints.
7410 */
7411 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7412 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7413 && X86_DR7_ANY_RW_IO(uDr7)
7414 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7415 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7416 {
7417 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7418 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7419 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7420 rcStrict = iemRaiseDebugException(pVCpu);
7421 }
7422 }
7423 return rcStrict;
7424}
7425
7426
7427/**
7428 * Implements 'OUT DX, eAX'.
7429 *
7430 * @param cbReg The register size.
7431 */
7432IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7433{
7434 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7435}
7436
7437
7438/**
7439 * Implements 'CLI'.
7440 */
7441IEM_CIMPL_DEF_0(iemCImpl_cli)
7442{
7443 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7444 uint32_t const fEflOld = fEfl;
7445
7446 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7447 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7448 {
7449 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7450 if (!(fEfl & X86_EFL_VM))
7451 {
7452 if (pVCpu->iem.s.uCpl <= uIopl)
7453 fEfl &= ~X86_EFL_IF;
7454 else if ( pVCpu->iem.s.uCpl == 3
7455 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7456 fEfl &= ~X86_EFL_VIF;
7457 else
7458 return iemRaiseGeneralProtectionFault0(pVCpu);
7459 }
7460 /* V8086 */
7461 else if (uIopl == 3)
7462 fEfl &= ~X86_EFL_IF;
7463 else if ( uIopl < 3
7464 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7465 fEfl &= ~X86_EFL_VIF;
7466 else
7467 return iemRaiseGeneralProtectionFault0(pVCpu);
7468 }
7469 /* real mode */
7470 else
7471 fEfl &= ~X86_EFL_IF;
7472
7473 /* Commit. */
7474 IEMMISC_SET_EFL(pVCpu, fEfl);
7475 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7476 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
7477 return VINF_SUCCESS;
7478}
7479
7480
7481/**
7482 * Implements 'STI'.
7483 */
7484IEM_CIMPL_DEF_0(iemCImpl_sti)
7485{
7486 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7487 uint32_t const fEflOld = fEfl;
7488
7489 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7490 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7491 {
7492 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7493 if (!(fEfl & X86_EFL_VM))
7494 {
7495 if (pVCpu->iem.s.uCpl <= uIopl)
7496 fEfl |= X86_EFL_IF;
7497 else if ( pVCpu->iem.s.uCpl == 3
7498 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7499 && !(fEfl & X86_EFL_VIP) )
7500 fEfl |= X86_EFL_VIF;
7501 else
7502 return iemRaiseGeneralProtectionFault0(pVCpu);
7503 }
7504 /* V8086 */
7505 else if (uIopl == 3)
7506 fEfl |= X86_EFL_IF;
7507 else if ( uIopl < 3
7508 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7509 && !(fEfl & X86_EFL_VIP) )
7510 fEfl |= X86_EFL_VIF;
7511 else
7512 return iemRaiseGeneralProtectionFault0(pVCpu);
7513 }
7514 /* real mode */
7515 else
7516 fEfl |= X86_EFL_IF;
7517
7518 /*
7519 * Commit.
7520 *
7521 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7522 */
7523 IEMMISC_SET_EFL(pVCpu, fEfl);
7524 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7525 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7526 {
7527 /** @todo only set it the shadow flag if it was clear before? */
7528 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7529 }
7530 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7531 return VINF_SUCCESS;
7532}
7533
7534
7535/**
7536 * Implements 'HLT'.
7537 */
7538IEM_CIMPL_DEF_0(iemCImpl_hlt)
7539{
7540 if (pVCpu->iem.s.uCpl != 0)
7541 return iemRaiseGeneralProtectionFault0(pVCpu);
7542
7543 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7544 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7545 {
7546 Log2(("hlt: Guest intercept -> VM-exit\n"));
7547 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7548 }
7549
7550 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7551 {
7552 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7553 IEM_SVM_UPDATE_NRIP(pVCpu);
7554 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7555 }
7556
7557 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7558 return VINF_EM_HALT;
7559}
7560
7561
7562/**
7563 * Implements 'MONITOR'.
7564 */
7565IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7566{
7567 /*
7568 * Permission checks.
7569 */
7570 if (pVCpu->iem.s.uCpl != 0)
7571 {
7572 Log2(("monitor: CPL != 0\n"));
7573 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7574 }
7575 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7576 {
7577 Log2(("monitor: Not in CPUID\n"));
7578 return iemRaiseUndefinedOpcode(pVCpu);
7579 }
7580
7581 /*
7582 * Check VMX guest-intercept.
7583 * This should be considered a fault-like VM-exit.
7584 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7585 */
7586 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7587 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7588 {
7589 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7590 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7591 }
7592
7593 /*
7594 * Gather the operands and validate them.
7595 */
7596 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7597 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7598 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7599/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7600 * \#GP first. */
7601 if (uEcx != 0)
7602 {
7603 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7604 return iemRaiseGeneralProtectionFault0(pVCpu);
7605 }
7606
7607 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7608 if (rcStrict != VINF_SUCCESS)
7609 return rcStrict;
7610
7611 RTGCPHYS GCPhysMem;
7612 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7613 if (rcStrict != VINF_SUCCESS)
7614 return rcStrict;
7615
7616#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7617 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7618 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7619 {
7620 /*
7621 * MONITOR does not access the memory, just monitors the address. However,
7622 * if the address falls in the APIC-access page, the address monitored must
7623 * instead be the corresponding address in the virtual-APIC page.
7624 *
7625 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7626 */
7627 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7628 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7629 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7630 return rcStrict;
7631 }
7632#endif
7633
7634 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7635 {
7636 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7637 IEM_SVM_UPDATE_NRIP(pVCpu);
7638 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7639 }
7640
7641 /*
7642 * Call EM to prepare the monitor/wait.
7643 */
7644 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7645 Assert(rcStrict == VINF_SUCCESS);
7646
7647 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7648 return rcStrict;
7649}
7650
7651
7652/**
7653 * Implements 'MWAIT'.
7654 */
7655IEM_CIMPL_DEF_0(iemCImpl_mwait)
7656{
7657 /*
7658 * Permission checks.
7659 */
7660 if (pVCpu->iem.s.uCpl != 0)
7661 {
7662 Log2(("mwait: CPL != 0\n"));
7663 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7664 * EFLAGS.VM then.) */
7665 return iemRaiseUndefinedOpcode(pVCpu);
7666 }
7667 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7668 {
7669 Log2(("mwait: Not in CPUID\n"));
7670 return iemRaiseUndefinedOpcode(pVCpu);
7671 }
7672
7673 /* Check VMX nested-guest intercept. */
7674 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7675 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7676 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7677
7678 /*
7679 * Gather the operands and validate them.
7680 */
7681 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7682 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7683 if (uEcx != 0)
7684 {
7685 /* Only supported extension is break on IRQ when IF=0. */
7686 if (uEcx > 1)
7687 {
7688 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7689 return iemRaiseGeneralProtectionFault0(pVCpu);
7690 }
7691 uint32_t fMWaitFeatures = 0;
7692 uint32_t uIgnore = 0;
7693 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7694 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7695 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7696 {
7697 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7698 return iemRaiseGeneralProtectionFault0(pVCpu);
7699 }
7700
7701#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7702 /*
7703 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7704 * for delivery; and interrupts are disabled the processor does not enter its
7705 * mwait state but rather passes control to the next instruction.
7706 *
7707 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7708 */
7709 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7710 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7711 {
7712 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7713 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7714 {
7715 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7716 return VINF_SUCCESS;
7717 }
7718 }
7719#endif
7720 }
7721
7722 /*
7723 * Check SVM nested-guest mwait intercepts.
7724 */
7725 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7726 && EMMonitorIsArmed(pVCpu))
7727 {
7728 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7729 IEM_SVM_UPDATE_NRIP(pVCpu);
7730 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7731 }
7732 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7733 {
7734 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7735 IEM_SVM_UPDATE_NRIP(pVCpu);
7736 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7737 }
7738
7739 /*
7740 * Call EM to prepare the monitor/wait.
7741 */
7742 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7743
7744 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7745 return rcStrict;
7746}
7747
7748
7749/**
7750 * Implements 'SWAPGS'.
7751 */
7752IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7753{
7754 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7755
7756 /*
7757 * Permission checks.
7758 */
7759 if (pVCpu->iem.s.uCpl != 0)
7760 {
7761 Log2(("swapgs: CPL != 0\n"));
7762 return iemRaiseUndefinedOpcode(pVCpu);
7763 }
7764
7765 /*
7766 * Do the job.
7767 */
7768 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7769 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7770 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7771 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7772
7773 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7774 return VINF_SUCCESS;
7775}
7776
7777
7778#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7779/**
7780 * Handles a CPUID call.
7781 */
7782static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
7783 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
7784{
7785 switch (iFunction)
7786 {
7787 case VBOX_CPUID_FN_ID:
7788 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
7789 *pEax = VBOX_CPUID_RESP_ID_EAX;
7790 *pEbx = VBOX_CPUID_RESP_ID_EBX;
7791 *pEcx = VBOX_CPUID_RESP_ID_ECX;
7792 *pEdx = VBOX_CPUID_RESP_ID_EDX;
7793 break;
7794
7795 case VBOX_CPUID_FN_LOG:
7796 {
7797 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
7798 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
7799
7800 /* Validate input. */
7801 uint32_t cchToLog = *pEdx;
7802 if (cchToLog <= _2M)
7803 {
7804 uint32_t const uLogPicker = *pEbx;
7805 if (uLogPicker <= 1)
7806 {
7807 /* Resolve the logger. */
7808 PRTLOGGER const pLogger = !uLogPicker
7809 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
7810 if (pLogger)
7811 {
7812 /* Copy over the data: */
7813 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
7814 while (cchToLog > 0)
7815 {
7816 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
7817 if (cbToMap > cchToLog)
7818 cbToMap = cchToLog;
7819 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
7820 * unnecessary calls & iterations per pages. */
7821 if (cbToMap > 512)
7822 cbToMap = 512;
7823 void *pvSrc = NULL;
7824 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, cbToMap, UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
7825 if (rcStrict == VINF_SUCCESS)
7826 {
7827 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
7828 rcStrict = iemMemCommitAndUnmap(pVCpu, pvSrc, IEM_ACCESS_DATA_R);
7829 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
7830 }
7831 else
7832 {
7833 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
7834 return rcStrict;
7835 }
7836
7837 /* Advance. */
7838 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
7839 *pEdx = cchToLog -= cbToMap;
7840 }
7841 *pEax = VINF_SUCCESS;
7842 }
7843 else
7844 *pEax = (uint32_t)VERR_NOT_FOUND;
7845 }
7846 else
7847 *pEax = (uint32_t)VERR_NOT_FOUND;
7848 }
7849 else
7850 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
7851 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
7852 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
7853 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
7854 break;
7855 }
7856
7857 default:
7858 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
7859 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
7860 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
7861 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
7862 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
7863 break;
7864 }
7865 return VINF_SUCCESS;
7866}
7867#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
7868
7869/**
7870 * Implements 'CPUID'.
7871 */
7872IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7873{
7874 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7875 {
7876 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7877 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7878 }
7879
7880 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7881 {
7882 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7883 IEM_SVM_UPDATE_NRIP(pVCpu);
7884 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7885 }
7886
7887
7888 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7889 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7890
7891#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7892 /*
7893 * CPUID host call backdoor.
7894 */
7895 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
7896 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
7897 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
7898 {
7899 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
7900 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
7901 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7902 if (rcStrict != VINF_SUCCESS)
7903 return rcStrict;
7904 }
7905 /*
7906 * Regular CPUID.
7907 */
7908 else
7909#endif
7910 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
7911 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7912
7913 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7914 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7915 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7916 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7917 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7918
7919 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7920 pVCpu->iem.s.cPotentialExits++;
7921 return VINF_SUCCESS;
7922}
7923
7924
7925/**
7926 * Implements 'AAD'.
7927 *
7928 * @param bImm The immediate operand.
7929 */
7930IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7931{
7932 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7933 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7934 pVCpu->cpum.GstCtx.ax = al;
7935 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7936 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7937 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7938
7939 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7940 return VINF_SUCCESS;
7941}
7942
7943
7944/**
7945 * Implements 'AAM'.
7946 *
7947 * @param bImm The immediate operand. Cannot be 0.
7948 */
7949IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
7950{
7951 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
7952
7953 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7954 uint8_t const al = (uint8_t)ax % bImm;
7955 uint8_t const ah = (uint8_t)ax / bImm;
7956 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
7957 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7958 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7959 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7960
7961 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7962 return VINF_SUCCESS;
7963}
7964
7965
7966/**
7967 * Implements 'DAA'.
7968 */
7969IEM_CIMPL_DEF_0(iemCImpl_daa)
7970{
7971 uint8_t const al = pVCpu->cpum.GstCtx.al;
7972 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7973
7974 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7975 || (al & 0xf) >= 10)
7976 {
7977 pVCpu->cpum.GstCtx.al = al + 6;
7978 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7979 }
7980 else
7981 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7982
7983 if (al >= 0x9a || fCarry)
7984 {
7985 pVCpu->cpum.GstCtx.al += 0x60;
7986 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7987 }
7988 else
7989 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7990
7991 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7992 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7993 return VINF_SUCCESS;
7994}
7995
7996
7997/**
7998 * Implements 'DAS'.
7999 */
8000IEM_CIMPL_DEF_0(iemCImpl_das)
8001{
8002 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8003 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8004
8005 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8006 || (uInputAL & 0xf) >= 10)
8007 {
8008 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8009 if (uInputAL < 6)
8010 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8011 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8012 }
8013 else
8014 {
8015 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8016 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8017 }
8018
8019 if (uInputAL >= 0x9a || fCarry)
8020 {
8021 pVCpu->cpum.GstCtx.al -= 0x60;
8022 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8023 }
8024
8025 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8026 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8027 return VINF_SUCCESS;
8028}
8029
8030
8031/**
8032 * Implements 'AAA'.
8033 */
8034IEM_CIMPL_DEF_0(iemCImpl_aaa)
8035{
8036 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8037 {
8038 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8039 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8040 {
8041 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8042 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8043 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8044 }
8045 else
8046 {
8047 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8048 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8049 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8050 }
8051 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8052 }
8053 else
8054 {
8055 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8056 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8057 {
8058 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8059 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8060 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8061 }
8062 else
8063 {
8064 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8065 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8066 }
8067 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8068 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8069 }
8070
8071 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8072 return VINF_SUCCESS;
8073}
8074
8075
8076/**
8077 * Implements 'AAS'.
8078 */
8079IEM_CIMPL_DEF_0(iemCImpl_aas)
8080{
8081 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8082 {
8083 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8084 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8085 {
8086 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8087 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8088 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8089 }
8090 else
8091 {
8092 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8093 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8094 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8095 }
8096 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8097 }
8098 else
8099 {
8100 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8101 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8102 {
8103 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8104 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8105 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8106 }
8107 else
8108 {
8109 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8110 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8111 }
8112 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8113 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8114 }
8115
8116 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8117 return VINF_SUCCESS;
8118}
8119
8120
8121/**
8122 * Implements the 16-bit version of 'BOUND'.
8123 *
8124 * @note We have separate 16-bit and 32-bit variants of this function due to
8125 * the decoder using unsigned parameters, whereas we want signed one to
8126 * do the job. This is significant for a recompiler.
8127 */
8128IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8129{
8130 /*
8131 * Check if the index is inside the bounds, otherwise raise #BR.
8132 */
8133 if ( idxArray >= idxLowerBound
8134 && idxArray <= idxUpperBound)
8135 {
8136 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8137 return VINF_SUCCESS;
8138 }
8139
8140 return iemRaiseBoundRangeExceeded(pVCpu);
8141}
8142
8143
8144/**
8145 * Implements the 32-bit version of 'BOUND'.
8146 */
8147IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8148{
8149 /*
8150 * Check if the index is inside the bounds, otherwise raise #BR.
8151 */
8152 if ( idxArray >= idxLowerBound
8153 && idxArray <= idxUpperBound)
8154 {
8155 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8156 return VINF_SUCCESS;
8157 }
8158
8159 return iemRaiseBoundRangeExceeded(pVCpu);
8160}
8161
8162
8163
8164/*
8165 * Instantiate the various string operation combinations.
8166 */
8167#define OP_SIZE 8
8168#define ADDR_SIZE 16
8169#include "IEMAllCImplStrInstr.cpp.h"
8170#define OP_SIZE 8
8171#define ADDR_SIZE 32
8172#include "IEMAllCImplStrInstr.cpp.h"
8173#define OP_SIZE 8
8174#define ADDR_SIZE 64
8175#include "IEMAllCImplStrInstr.cpp.h"
8176
8177#define OP_SIZE 16
8178#define ADDR_SIZE 16
8179#include "IEMAllCImplStrInstr.cpp.h"
8180#define OP_SIZE 16
8181#define ADDR_SIZE 32
8182#include "IEMAllCImplStrInstr.cpp.h"
8183#define OP_SIZE 16
8184#define ADDR_SIZE 64
8185#include "IEMAllCImplStrInstr.cpp.h"
8186
8187#define OP_SIZE 32
8188#define ADDR_SIZE 16
8189#include "IEMAllCImplStrInstr.cpp.h"
8190#define OP_SIZE 32
8191#define ADDR_SIZE 32
8192#include "IEMAllCImplStrInstr.cpp.h"
8193#define OP_SIZE 32
8194#define ADDR_SIZE 64
8195#include "IEMAllCImplStrInstr.cpp.h"
8196
8197#define OP_SIZE 64
8198#define ADDR_SIZE 32
8199#include "IEMAllCImplStrInstr.cpp.h"
8200#define OP_SIZE 64
8201#define ADDR_SIZE 64
8202#include "IEMAllCImplStrInstr.cpp.h"
8203
8204
8205/**
8206 * Implements 'XGETBV'.
8207 */
8208IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8209{
8210 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8211 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8212 {
8213 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8214 switch (uEcx)
8215 {
8216 case 0:
8217 break;
8218
8219 case 1: /** @todo Implement XCR1 support. */
8220 default:
8221 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8222 return iemRaiseGeneralProtectionFault0(pVCpu);
8223
8224 }
8225 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8226 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8227 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8228
8229 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8230 return VINF_SUCCESS;
8231 }
8232 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8233 return iemRaiseUndefinedOpcode(pVCpu);
8234}
8235
8236
8237/**
8238 * Implements 'XSETBV'.
8239 */
8240IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8241{
8242 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8243 {
8244 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8245 {
8246 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8247 IEM_SVM_UPDATE_NRIP(pVCpu);
8248 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8249 }
8250
8251 if (pVCpu->iem.s.uCpl == 0)
8252 {
8253 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8254
8255 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8256 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8257
8258 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8259 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8260 switch (uEcx)
8261 {
8262 case 0:
8263 {
8264 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8265 if (rc == VINF_SUCCESS)
8266 break;
8267 Assert(rc == VERR_CPUM_RAISE_GP_0);
8268 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8269 return iemRaiseGeneralProtectionFault0(pVCpu);
8270 }
8271
8272 case 1: /** @todo Implement XCR1 support. */
8273 default:
8274 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8275 return iemRaiseGeneralProtectionFault0(pVCpu);
8276
8277 }
8278
8279 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8280 return VINF_SUCCESS;
8281 }
8282
8283 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
8284 return iemRaiseGeneralProtectionFault0(pVCpu);
8285 }
8286 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8287 return iemRaiseUndefinedOpcode(pVCpu);
8288}
8289
8290#ifndef RT_ARCH_ARM64
8291# ifdef IN_RING3
8292
8293/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8294struct IEMCIMPLCX16ARGS
8295{
8296 PRTUINT128U pu128Dst;
8297 PRTUINT128U pu128RaxRdx;
8298 PRTUINT128U pu128RbxRcx;
8299 uint32_t *pEFlags;
8300# ifdef VBOX_STRICT
8301 uint32_t cCalls;
8302# endif
8303};
8304
8305/**
8306 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8307 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8308 */
8309static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8310{
8311 RT_NOREF(pVM, pVCpu);
8312 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8313# ifdef VBOX_STRICT
8314 Assert(pArgs->cCalls == 0);
8315 pArgs->cCalls++;
8316# endif
8317
8318 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8319 return VINF_SUCCESS;
8320}
8321
8322# endif /* IN_RING3 */
8323
8324/**
8325 * Implements 'CMPXCHG16B' fallback using rendezvous.
8326 */
8327IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8328 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8329{
8330# ifdef IN_RING3
8331 struct IEMCIMPLCX16ARGS Args;
8332 Args.pu128Dst = pu128Dst;
8333 Args.pu128RaxRdx = pu128RaxRdx;
8334 Args.pu128RbxRcx = pu128RbxRcx;
8335 Args.pEFlags = pEFlags;
8336# ifdef VBOX_STRICT
8337 Args.cCalls = 0;
8338# endif
8339 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8340 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8341 Assert(Args.cCalls == 1);
8342 if (rcStrict == VINF_SUCCESS)
8343 {
8344 /* Duplicated tail code. */
8345 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8346 if (rcStrict == VINF_SUCCESS)
8347 {
8348 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8349 if (!(*pEFlags & X86_EFL_ZF))
8350 {
8351 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8352 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8353 }
8354 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8355 }
8356 }
8357 return rcStrict;
8358# else
8359 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8360 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8361# endif
8362}
8363
8364#endif /* RT_ARCH_ARM64 */
8365
8366/**
8367 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8368 *
8369 * This is implemented in C because it triggers a load like behaviour without
8370 * actually reading anything. Since that's not so common, it's implemented
8371 * here.
8372 *
8373 * @param iEffSeg The effective segment.
8374 * @param GCPtrEff The address of the image.
8375 */
8376IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8377{
8378 /*
8379 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8380 */
8381 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8382 if (rcStrict == VINF_SUCCESS)
8383 {
8384 RTGCPHYS GCPhysMem;
8385 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8386 if (rcStrict == VINF_SUCCESS)
8387 {
8388#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8389 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8390 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8391 {
8392 /*
8393 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8394 * that contains the address. However, if the address falls in the APIC-access
8395 * page, the address flushed must instead be the corresponding address in the
8396 * virtual-APIC page.
8397 *
8398 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8399 */
8400 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8401 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8402 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8403 return rcStrict;
8404 }
8405#endif
8406 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8407 return VINF_SUCCESS;
8408 }
8409 }
8410
8411 return rcStrict;
8412}
8413
8414
8415/**
8416 * Implements 'FINIT' and 'FNINIT'.
8417 *
8418 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8419 * not.
8420 */
8421IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8422{
8423 /*
8424 * Exceptions.
8425 */
8426 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8427 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8428 return iemRaiseDeviceNotAvailable(pVCpu);
8429
8430 iemFpuActualizeStateForChange(pVCpu);
8431 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8432
8433 /* FINIT: Raise #MF on pending exception(s): */
8434 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8435 return iemRaiseMathFault(pVCpu);
8436
8437 /*
8438 * Reset the state.
8439 */
8440 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8441
8442 /* Rotate the stack to account for changed TOS. */
8443 iemFpuRotateStackSetTop(&pXState->x87, 0);
8444
8445 pXState->x87.FCW = 0x37f;
8446 pXState->x87.FSW = 0;
8447 pXState->x87.FTW = 0x00; /* 0 - empty. */
8448 /** @todo Intel says the instruction and data pointers are not cleared on
8449 * 387, presume that 8087 and 287 doesn't do so either. */
8450 /** @todo test this stuff. */
8451 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8452 {
8453 pXState->x87.FPUDP = 0;
8454 pXState->x87.DS = 0; //??
8455 pXState->x87.Rsrvd2 = 0;
8456 pXState->x87.FPUIP = 0;
8457 pXState->x87.CS = 0; //??
8458 pXState->x87.Rsrvd1 = 0;
8459 }
8460 pXState->x87.FOP = 0;
8461
8462 iemHlpUsedFpu(pVCpu);
8463 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8464 return VINF_SUCCESS;
8465}
8466
8467
8468/**
8469 * Implements 'FXSAVE'.
8470 *
8471 * @param iEffSeg The effective segment.
8472 * @param GCPtrEff The address of the image.
8473 * @param enmEffOpSize The operand size (only REX.W really matters).
8474 */
8475IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8476{
8477 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8478
8479 /*
8480 * Raise exceptions.
8481 */
8482 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8483 return iemRaiseDeviceNotAvailable(pVCpu);
8484
8485 /*
8486 * Access the memory.
8487 */
8488 void *pvMem512;
8489 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8490 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8491 if (rcStrict != VINF_SUCCESS)
8492 return rcStrict;
8493 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8494 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8495
8496 /*
8497 * Store the registers.
8498 */
8499 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8500 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8501
8502 /* common for all formats */
8503 pDst->FCW = pSrc->FCW;
8504 pDst->FSW = pSrc->FSW;
8505 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8506 pDst->FOP = pSrc->FOP;
8507 pDst->MXCSR = pSrc->MXCSR;
8508 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8509 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8510 {
8511 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8512 * them for now... */
8513 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8514 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8515 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8516 pDst->aRegs[i].au32[3] = 0;
8517 }
8518
8519 /* FPU IP, CS, DP and DS. */
8520 pDst->FPUIP = pSrc->FPUIP;
8521 pDst->CS = pSrc->CS;
8522 pDst->FPUDP = pSrc->FPUDP;
8523 pDst->DS = pSrc->DS;
8524 if (enmEffOpSize == IEMMODE_64BIT)
8525 {
8526 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8527 pDst->Rsrvd1 = pSrc->Rsrvd1;
8528 pDst->Rsrvd2 = pSrc->Rsrvd2;
8529 }
8530 else
8531 {
8532 pDst->Rsrvd1 = 0;
8533 pDst->Rsrvd2 = 0;
8534 }
8535
8536 /* XMM registers. */
8537 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8538 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8539 || pVCpu->iem.s.uCpl != 0)
8540 {
8541 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8542 for (uint32_t i = 0; i < cXmmRegs; i++)
8543 pDst->aXMM[i] = pSrc->aXMM[i];
8544 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8545 * right? */
8546 }
8547
8548 /*
8549 * Commit the memory.
8550 */
8551 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8552 if (rcStrict != VINF_SUCCESS)
8553 return rcStrict;
8554
8555 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8556 return VINF_SUCCESS;
8557}
8558
8559
8560/**
8561 * Implements 'FXRSTOR'.
8562 *
8563 * @param iEffSeg The effective segment register for @a GCPtrEff.
8564 * @param GCPtrEff The address of the image.
8565 * @param enmEffOpSize The operand size (only REX.W really matters).
8566 */
8567IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8568{
8569 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8570
8571 /*
8572 * Raise exceptions.
8573 */
8574 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8575 return iemRaiseDeviceNotAvailable(pVCpu);
8576
8577 /*
8578 * Access the memory.
8579 */
8580 void *pvMem512;
8581 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8582 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8583 if (rcStrict != VINF_SUCCESS)
8584 return rcStrict;
8585 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8586 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8587
8588 /*
8589 * Check the state for stuff which will #GP(0).
8590 */
8591 uint32_t const fMXCSR = pSrc->MXCSR;
8592 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8593 if (fMXCSR & ~fMXCSR_MASK)
8594 {
8595 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8596 return iemRaiseGeneralProtectionFault0(pVCpu);
8597 }
8598
8599 /*
8600 * Load the registers.
8601 */
8602 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8603 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
8604
8605 /* common for all formats */
8606 pDst->FCW = pSrc->FCW;
8607 pDst->FSW = pSrc->FSW;
8608 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8609 pDst->FOP = pSrc->FOP;
8610 pDst->MXCSR = fMXCSR;
8611 /* (MXCSR_MASK is read-only) */
8612 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8613 {
8614 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8615 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8616 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8617 pDst->aRegs[i].au32[3] = 0;
8618 }
8619
8620 /* FPU IP, CS, DP and DS. */
8621 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8622 {
8623 pDst->FPUIP = pSrc->FPUIP;
8624 pDst->CS = pSrc->CS;
8625 pDst->Rsrvd1 = pSrc->Rsrvd1;
8626 pDst->FPUDP = pSrc->FPUDP;
8627 pDst->DS = pSrc->DS;
8628 pDst->Rsrvd2 = pSrc->Rsrvd2;
8629 }
8630 else
8631 {
8632 pDst->FPUIP = pSrc->FPUIP;
8633 pDst->CS = pSrc->CS;
8634 pDst->Rsrvd1 = 0;
8635 pDst->FPUDP = pSrc->FPUDP;
8636 pDst->DS = pSrc->DS;
8637 pDst->Rsrvd2 = 0;
8638 }
8639
8640 /* XMM registers. */
8641 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8642 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8643 || pVCpu->iem.s.uCpl != 0)
8644 {
8645 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8646 for (uint32_t i = 0; i < cXmmRegs; i++)
8647 pDst->aXMM[i] = pSrc->aXMM[i];
8648 }
8649
8650 if (pDst->FSW & X86_FSW_ES)
8651 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8652 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8653
8654 /*
8655 * Commit the memory.
8656 */
8657 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8658 if (rcStrict != VINF_SUCCESS)
8659 return rcStrict;
8660
8661 iemHlpUsedFpu(pVCpu);
8662 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8663 return VINF_SUCCESS;
8664}
8665
8666
8667/**
8668 * Implements 'XSAVE'.
8669 *
8670 * @param iEffSeg The effective segment.
8671 * @param GCPtrEff The address of the image.
8672 * @param enmEffOpSize The operand size (only REX.W really matters).
8673 */
8674IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8675{
8676 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8677
8678 /*
8679 * Raise exceptions.
8680 */
8681 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8682 return iemRaiseUndefinedOpcode(pVCpu);
8683 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8684 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8685 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8686 {
8687 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8688 return iemRaiseUndefinedOpcode(pVCpu);
8689 }
8690 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8691 return iemRaiseDeviceNotAvailable(pVCpu);
8692
8693 /*
8694 * Calc the requested mask.
8695 */
8696 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8697 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8698 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8699
8700/** @todo figure out the exact protocol for the memory access. Currently we
8701 * just need this crap to work halfways to make it possible to test
8702 * AVX instructions. */
8703/** @todo figure out the XINUSE and XMODIFIED */
8704
8705 /*
8706 * Access the x87 memory state.
8707 */
8708 /* The x87+SSE state. */
8709 void *pvMem512;
8710 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8711 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8712 if (rcStrict != VINF_SUCCESS)
8713 return rcStrict;
8714 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8715 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8716
8717 /* The header. */
8718 PX86XSAVEHDR pHdr;
8719 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
8720 if (rcStrict != VINF_SUCCESS)
8721 return rcStrict;
8722
8723 /*
8724 * Store the X87 state.
8725 */
8726 if (fReqComponents & XSAVE_C_X87)
8727 {
8728 /* common for all formats */
8729 pDst->FCW = pSrc->FCW;
8730 pDst->FSW = pSrc->FSW;
8731 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8732 pDst->FOP = pSrc->FOP;
8733 pDst->FPUIP = pSrc->FPUIP;
8734 pDst->CS = pSrc->CS;
8735 pDst->FPUDP = pSrc->FPUDP;
8736 pDst->DS = pSrc->DS;
8737 if (enmEffOpSize == IEMMODE_64BIT)
8738 {
8739 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8740 pDst->Rsrvd1 = pSrc->Rsrvd1;
8741 pDst->Rsrvd2 = pSrc->Rsrvd2;
8742 }
8743 else
8744 {
8745 pDst->Rsrvd1 = 0;
8746 pDst->Rsrvd2 = 0;
8747 }
8748 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8749 {
8750 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8751 * them for now... */
8752 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8753 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8754 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8755 pDst->aRegs[i].au32[3] = 0;
8756 }
8757
8758 }
8759
8760 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8761 {
8762 pDst->MXCSR = pSrc->MXCSR;
8763 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8764 }
8765
8766 if (fReqComponents & XSAVE_C_SSE)
8767 {
8768 /* XMM registers. */
8769 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8770 for (uint32_t i = 0; i < cXmmRegs; i++)
8771 pDst->aXMM[i] = pSrc->aXMM[i];
8772 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8773 * right? */
8774 }
8775
8776 /* Commit the x87 state bits. (probably wrong) */
8777 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8778 if (rcStrict != VINF_SUCCESS)
8779 return rcStrict;
8780
8781 /*
8782 * Store AVX state.
8783 */
8784 if (fReqComponents & XSAVE_C_YMM)
8785 {
8786 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8787 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8788 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8789 PX86XSAVEYMMHI pCompDst;
8790 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8791 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
8792 if (rcStrict != VINF_SUCCESS)
8793 return rcStrict;
8794
8795 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8796 for (uint32_t i = 0; i < cXmmRegs; i++)
8797 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8798
8799 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8800 if (rcStrict != VINF_SUCCESS)
8801 return rcStrict;
8802 }
8803
8804 /*
8805 * Update the header.
8806 */
8807 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8808 | (fReqComponents & fXInUse);
8809
8810 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8811 if (rcStrict != VINF_SUCCESS)
8812 return rcStrict;
8813
8814 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8815 return VINF_SUCCESS;
8816}
8817
8818
8819/**
8820 * Implements 'XRSTOR'.
8821 *
8822 * @param iEffSeg The effective segment.
8823 * @param GCPtrEff The address of the image.
8824 * @param enmEffOpSize The operand size (only REX.W really matters).
8825 */
8826IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8827{
8828 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8829
8830 /*
8831 * Raise exceptions.
8832 */
8833 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8834 return iemRaiseUndefinedOpcode(pVCpu);
8835 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8836 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8837 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8838 {
8839 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8840 return iemRaiseUndefinedOpcode(pVCpu);
8841 }
8842 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8843 return iemRaiseDeviceNotAvailable(pVCpu);
8844 if (GCPtrEff & 63)
8845 {
8846 /** @todo CPU/VM detection possible! \#AC might not be signal for
8847 * all/any misalignment sizes, intel says its an implementation detail. */
8848 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8849 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8850 && pVCpu->iem.s.uCpl == 3)
8851 return iemRaiseAlignmentCheckException(pVCpu);
8852 return iemRaiseGeneralProtectionFault0(pVCpu);
8853 }
8854
8855/** @todo figure out the exact protocol for the memory access. Currently we
8856 * just need this crap to work halfways to make it possible to test
8857 * AVX instructions. */
8858/** @todo figure out the XINUSE and XMODIFIED */
8859
8860 /*
8861 * Access the x87 memory state.
8862 */
8863 /* The x87+SSE state. */
8864 void *pvMem512;
8865 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8866 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8867 if (rcStrict != VINF_SUCCESS)
8868 return rcStrict;
8869 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8870 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8871
8872 /*
8873 * Calc the requested mask
8874 */
8875 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
8876 PCX86XSAVEHDR pHdrSrc;
8877 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
8878 IEM_ACCESS_DATA_R, 0 /* checked above */);
8879 if (rcStrict != VINF_SUCCESS)
8880 return rcStrict;
8881
8882 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8883 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8884 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8885 uint64_t const fRstorMask = pHdrSrc->bmXState;
8886 uint64_t const fCompMask = pHdrSrc->bmXComp;
8887
8888 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8889
8890 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8891
8892 /* We won't need this any longer. */
8893 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8894 if (rcStrict != VINF_SUCCESS)
8895 return rcStrict;
8896
8897 /*
8898 * Store the X87 state.
8899 */
8900 if (fReqComponents & XSAVE_C_X87)
8901 {
8902 if (fRstorMask & XSAVE_C_X87)
8903 {
8904 pDst->FCW = pSrc->FCW;
8905 pDst->FSW = pSrc->FSW;
8906 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8907 pDst->FOP = pSrc->FOP;
8908 pDst->FPUIP = pSrc->FPUIP;
8909 pDst->CS = pSrc->CS;
8910 pDst->FPUDP = pSrc->FPUDP;
8911 pDst->DS = pSrc->DS;
8912 if (enmEffOpSize == IEMMODE_64BIT)
8913 {
8914 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8915 pDst->Rsrvd1 = pSrc->Rsrvd1;
8916 pDst->Rsrvd2 = pSrc->Rsrvd2;
8917 }
8918 else
8919 {
8920 pDst->Rsrvd1 = 0;
8921 pDst->Rsrvd2 = 0;
8922 }
8923 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8924 {
8925 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8926 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8927 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8928 pDst->aRegs[i].au32[3] = 0;
8929 }
8930 if (pDst->FSW & X86_FSW_ES)
8931 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8932 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8933 }
8934 else
8935 {
8936 pDst->FCW = 0x37f;
8937 pDst->FSW = 0;
8938 pDst->FTW = 0x00; /* 0 - empty. */
8939 pDst->FPUDP = 0;
8940 pDst->DS = 0; //??
8941 pDst->Rsrvd2= 0;
8942 pDst->FPUIP = 0;
8943 pDst->CS = 0; //??
8944 pDst->Rsrvd1= 0;
8945 pDst->FOP = 0;
8946 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8947 {
8948 pDst->aRegs[i].au32[0] = 0;
8949 pDst->aRegs[i].au32[1] = 0;
8950 pDst->aRegs[i].au32[2] = 0;
8951 pDst->aRegs[i].au32[3] = 0;
8952 }
8953 }
8954 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
8955 }
8956
8957 /* MXCSR */
8958 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8959 {
8960 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
8961 pDst->MXCSR = pSrc->MXCSR;
8962 else
8963 pDst->MXCSR = 0x1f80;
8964 }
8965
8966 /* XMM registers. */
8967 if (fReqComponents & XSAVE_C_SSE)
8968 {
8969 if (fRstorMask & XSAVE_C_SSE)
8970 {
8971 for (uint32_t i = 0; i < cXmmRegs; i++)
8972 pDst->aXMM[i] = pSrc->aXMM[i];
8973 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8974 * right? */
8975 }
8976 else
8977 {
8978 for (uint32_t i = 0; i < cXmmRegs; i++)
8979 {
8980 pDst->aXMM[i].au64[0] = 0;
8981 pDst->aXMM[i].au64[1] = 0;
8982 }
8983 }
8984 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
8985 }
8986
8987 /* Unmap the x87 state bits (so we've don't run out of mapping). */
8988 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8989 if (rcStrict != VINF_SUCCESS)
8990 return rcStrict;
8991
8992 /*
8993 * Restore AVX state.
8994 */
8995 if (fReqComponents & XSAVE_C_YMM)
8996 {
8997 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8998 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
8999
9000 if (fRstorMask & XSAVE_C_YMM)
9001 {
9002 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9003 PCX86XSAVEYMMHI pCompSrc;
9004 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
9005 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9006 IEM_ACCESS_DATA_R, 0 /* checked above */);
9007 if (rcStrict != VINF_SUCCESS)
9008 return rcStrict;
9009
9010 for (uint32_t i = 0; i < cXmmRegs; i++)
9011 {
9012 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9013 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9014 }
9015
9016 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
9017 if (rcStrict != VINF_SUCCESS)
9018 return rcStrict;
9019 }
9020 else
9021 {
9022 for (uint32_t i = 0; i < cXmmRegs; i++)
9023 {
9024 pCompDst->aYmmHi[i].au64[0] = 0;
9025 pCompDst->aYmmHi[i].au64[1] = 0;
9026 }
9027 }
9028 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9029 }
9030
9031 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9032 return VINF_SUCCESS;
9033}
9034
9035
9036
9037
9038/**
9039 * Implements 'STMXCSR'.
9040 *
9041 * @param iEffSeg The effective segment register for @a GCPtrEff.
9042 * @param GCPtrEff The address of the image.
9043 */
9044IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9045{
9046 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9047
9048 /*
9049 * Raise exceptions.
9050 */
9051 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9052 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9053 {
9054 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9055 {
9056 /*
9057 * Do the job.
9058 */
9059 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9060 if (rcStrict == VINF_SUCCESS)
9061 {
9062 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9063 return VINF_SUCCESS;
9064 }
9065 return rcStrict;
9066 }
9067 return iemRaiseDeviceNotAvailable(pVCpu);
9068 }
9069 return iemRaiseUndefinedOpcode(pVCpu);
9070}
9071
9072
9073/**
9074 * Implements 'VSTMXCSR'.
9075 *
9076 * @param iEffSeg The effective segment register for @a GCPtrEff.
9077 * @param GCPtrEff The address of the image.
9078 */
9079IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9080{
9081 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9082
9083 /*
9084 * Raise exceptions.
9085 */
9086 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9087 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9088 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9089 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9090 {
9091 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9092 {
9093 /*
9094 * Do the job.
9095 */
9096 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9097 if (rcStrict == VINF_SUCCESS)
9098 {
9099 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9100 return VINF_SUCCESS;
9101 }
9102 return rcStrict;
9103 }
9104 return iemRaiseDeviceNotAvailable(pVCpu);
9105 }
9106 return iemRaiseUndefinedOpcode(pVCpu);
9107}
9108
9109
9110/**
9111 * Implements 'LDMXCSR'.
9112 *
9113 * @param iEffSeg The effective segment register for @a GCPtrEff.
9114 * @param GCPtrEff The address of the image.
9115 */
9116IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9117{
9118 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9119
9120 /*
9121 * Raise exceptions.
9122 */
9123 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9124 * happen after or before \#UD and \#EM? */
9125 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9126 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9127 {
9128 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9129 {
9130 /*
9131 * Do the job.
9132 */
9133 uint32_t fNewMxCsr;
9134 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9135 if (rcStrict == VINF_SUCCESS)
9136 {
9137 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9138 if (!(fNewMxCsr & ~fMxCsrMask))
9139 {
9140 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9141 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9142 return VINF_SUCCESS;
9143 }
9144 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9145 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9146 return iemRaiseGeneralProtectionFault0(pVCpu);
9147 }
9148 return rcStrict;
9149 }
9150 return iemRaiseDeviceNotAvailable(pVCpu);
9151 }
9152 return iemRaiseUndefinedOpcode(pVCpu);
9153}
9154
9155
9156/**
9157 * Commmon routine for fnstenv and fnsave.
9158 *
9159 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9160 * @param enmEffOpSize The effective operand size.
9161 * @param uPtr Where to store the state.
9162 */
9163static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9164{
9165 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9166 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9167 if (enmEffOpSize == IEMMODE_16BIT)
9168 {
9169 uPtr.pu16[0] = pSrcX87->FCW;
9170 uPtr.pu16[1] = pSrcX87->FSW;
9171 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9172 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9173 {
9174 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9175 * protected mode or long mode and we save it in real mode? And vice
9176 * versa? And with 32-bit operand size? I think CPU is storing the
9177 * effective address ((CS << 4) + IP) in the offset register and not
9178 * doing any address calculations here. */
9179 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9180 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9181 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9182 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9183 }
9184 else
9185 {
9186 uPtr.pu16[3] = pSrcX87->FPUIP;
9187 uPtr.pu16[4] = pSrcX87->CS;
9188 uPtr.pu16[5] = pSrcX87->FPUDP;
9189 uPtr.pu16[6] = pSrcX87->DS;
9190 }
9191 }
9192 else
9193 {
9194 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9195 uPtr.pu16[0*2] = pSrcX87->FCW;
9196 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9197 uPtr.pu16[1*2] = pSrcX87->FSW;
9198 uPtr.pu16[1*2+1] = 0xffff;
9199 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9200 uPtr.pu16[2*2+1] = 0xffff;
9201 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9202 {
9203 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9204 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9205 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9206 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9207 }
9208 else
9209 {
9210 uPtr.pu32[3] = pSrcX87->FPUIP;
9211 uPtr.pu16[4*2] = pSrcX87->CS;
9212 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9213 uPtr.pu32[5] = pSrcX87->FPUDP;
9214 uPtr.pu16[6*2] = pSrcX87->DS;
9215 uPtr.pu16[6*2+1] = 0xffff;
9216 }
9217 }
9218}
9219
9220
9221/**
9222 * Commmon routine for fldenv and frstor
9223 *
9224 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9225 * @param enmEffOpSize The effective operand size.
9226 * @param uPtr Where to store the state.
9227 */
9228static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9229{
9230 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9231 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9232 if (enmEffOpSize == IEMMODE_16BIT)
9233 {
9234 pDstX87->FCW = uPtr.pu16[0];
9235 pDstX87->FSW = uPtr.pu16[1];
9236 pDstX87->FTW = uPtr.pu16[2];
9237 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9238 {
9239 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9240 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9241 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9242 pDstX87->CS = 0;
9243 pDstX87->Rsrvd1= 0;
9244 pDstX87->DS = 0;
9245 pDstX87->Rsrvd2= 0;
9246 }
9247 else
9248 {
9249 pDstX87->FPUIP = uPtr.pu16[3];
9250 pDstX87->CS = uPtr.pu16[4];
9251 pDstX87->Rsrvd1= 0;
9252 pDstX87->FPUDP = uPtr.pu16[5];
9253 pDstX87->DS = uPtr.pu16[6];
9254 pDstX87->Rsrvd2= 0;
9255 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9256 }
9257 }
9258 else
9259 {
9260 pDstX87->FCW = uPtr.pu16[0*2];
9261 pDstX87->FSW = uPtr.pu16[1*2];
9262 pDstX87->FTW = uPtr.pu16[2*2];
9263 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9264 {
9265 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9266 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9267 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9268 pDstX87->CS = 0;
9269 pDstX87->Rsrvd1= 0;
9270 pDstX87->DS = 0;
9271 pDstX87->Rsrvd2= 0;
9272 }
9273 else
9274 {
9275 pDstX87->FPUIP = uPtr.pu32[3];
9276 pDstX87->CS = uPtr.pu16[4*2];
9277 pDstX87->Rsrvd1= 0;
9278 pDstX87->FOP = uPtr.pu16[4*2+1];
9279 pDstX87->FPUDP = uPtr.pu32[5];
9280 pDstX87->DS = uPtr.pu16[6*2];
9281 pDstX87->Rsrvd2= 0;
9282 }
9283 }
9284
9285 /* Make adjustments. */
9286 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9287#ifdef LOG_ENABLED
9288 uint16_t const fOldFsw = pDstX87->FSW;
9289#endif
9290 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
9291 iemFpuRecalcExceptionStatus(pDstX87);
9292#ifdef LOG_ENABLED
9293 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9294 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9295 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9296 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9297#endif
9298
9299 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9300 * exceptions are pending after loading the saved state? */
9301}
9302
9303
9304/**
9305 * Implements 'FNSTENV'.
9306 *
9307 * @param enmEffOpSize The operand size (only REX.W really matters).
9308 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9309 * @param GCPtrEffDst The address of the image.
9310 */
9311IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9312{
9313 RTPTRUNION uPtr;
9314 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9315 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9316 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9317 if (rcStrict != VINF_SUCCESS)
9318 return rcStrict;
9319
9320 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9321
9322 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9323 if (rcStrict != VINF_SUCCESS)
9324 return rcStrict;
9325
9326 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9327 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9328 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9329#ifdef LOG_ENABLED
9330 uint16_t fOldFsw = pFpuCtx->FSW;
9331#endif
9332 iemFpuRecalcExceptionStatus(pFpuCtx);
9333#ifdef LOG_ENABLED
9334 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9335 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9336 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9337#endif
9338
9339 iemHlpUsedFpu(pVCpu);
9340
9341 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9342 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9343 return VINF_SUCCESS;
9344}
9345
9346
9347/**
9348 * Implements 'FNSAVE'.
9349 *
9350 * @param enmEffOpSize The operand size.
9351 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9352 * @param GCPtrEffDst The address of the image.
9353 */
9354IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9355{
9356 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9357
9358 RTPTRUNION uPtr;
9359 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9360 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9361 if (rcStrict != VINF_SUCCESS)
9362 return rcStrict;
9363
9364 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9365 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9366 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9367 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9368 {
9369 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9370 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9371 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9372 }
9373
9374 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9375 if (rcStrict != VINF_SUCCESS)
9376 return rcStrict;
9377
9378 /* Rotate the stack to account for changed TOS. */
9379 iemFpuRotateStackSetTop(pFpuCtx, 0);
9380
9381 /*
9382 * Re-initialize the FPU context.
9383 */
9384 pFpuCtx->FCW = 0x37f;
9385 pFpuCtx->FSW = 0;
9386 pFpuCtx->FTW = 0x00; /* 0 - empty */
9387 pFpuCtx->FPUDP = 0;
9388 pFpuCtx->DS = 0;
9389 pFpuCtx->Rsrvd2= 0;
9390 pFpuCtx->FPUIP = 0;
9391 pFpuCtx->CS = 0;
9392 pFpuCtx->Rsrvd1= 0;
9393 pFpuCtx->FOP = 0;
9394
9395 iemHlpUsedFpu(pVCpu);
9396 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9397 return VINF_SUCCESS;
9398}
9399
9400
9401
9402/**
9403 * Implements 'FLDENV'.
9404 *
9405 * @param enmEffOpSize The operand size (only REX.W really matters).
9406 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9407 * @param GCPtrEffSrc The address of the image.
9408 */
9409IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9410{
9411 RTCPTRUNION uPtr;
9412 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9413 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9414 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9415 if (rcStrict != VINF_SUCCESS)
9416 return rcStrict;
9417
9418 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9419
9420 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9421 if (rcStrict != VINF_SUCCESS)
9422 return rcStrict;
9423
9424 iemHlpUsedFpu(pVCpu);
9425 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9426 return VINF_SUCCESS;
9427}
9428
9429
9430/**
9431 * Implements 'FRSTOR'.
9432 *
9433 * @param enmEffOpSize The operand size.
9434 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9435 * @param GCPtrEffSrc The address of the image.
9436 */
9437IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9438{
9439 RTCPTRUNION uPtr;
9440 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9441 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9442 if (rcStrict != VINF_SUCCESS)
9443 return rcStrict;
9444
9445 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9446 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9447 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9448 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9449 {
9450 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9451 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9452 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9453 pFpuCtx->aRegs[i].au32[3] = 0;
9454 }
9455
9456 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9457 if (rcStrict != VINF_SUCCESS)
9458 return rcStrict;
9459
9460 iemHlpUsedFpu(pVCpu);
9461 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9462 return VINF_SUCCESS;
9463}
9464
9465
9466/**
9467 * Implements 'FLDCW'.
9468 *
9469 * @param u16Fcw The new FCW.
9470 */
9471IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9472{
9473 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9474
9475 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9476 /** @todo Testcase: Try see what happens when trying to set undefined bits
9477 * (other than 6 and 7). Currently ignoring them. */
9478 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9479 * according to FSW. (This is what is currently implemented.) */
9480 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9481 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
9482#ifdef LOG_ENABLED
9483 uint16_t fOldFsw = pFpuCtx->FSW;
9484#endif
9485 iemFpuRecalcExceptionStatus(pFpuCtx);
9486#ifdef LOG_ENABLED
9487 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9488 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9489 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9490#endif
9491
9492 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9493 iemHlpUsedFpu(pVCpu);
9494 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9495 return VINF_SUCCESS;
9496}
9497
9498
9499
9500/**
9501 * Implements the underflow case of fxch.
9502 *
9503 * @param iStReg The other stack register.
9504 */
9505IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
9506{
9507 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9508
9509 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9510 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9511 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9512 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9513
9514 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9515 * registers are read as QNaN and then exchanged. This could be
9516 * wrong... */
9517 if (pFpuCtx->FCW & X86_FCW_IM)
9518 {
9519 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9520 {
9521 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9522 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9523 else
9524 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9525 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9526 }
9527 else
9528 {
9529 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9530 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9531 }
9532 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9533 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9534 }
9535 else
9536 {
9537 /* raise underflow exception, don't change anything. */
9538 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9539 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9540 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9541 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9542 }
9543
9544 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9545 iemHlpUsedFpu(pVCpu);
9546 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9547 return VINF_SUCCESS;
9548}
9549
9550
9551/**
9552 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9553 *
9554 * @param iStReg The other stack register.
9555 * @param pfnAImpl The assembly comparison implementation.
9556 * @param fPop Whether we should pop the stack when done or not.
9557 */
9558IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9559{
9560 Assert(iStReg < 8);
9561 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9562
9563 /*
9564 * Raise exceptions.
9565 */
9566 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9567 return iemRaiseDeviceNotAvailable(pVCpu);
9568
9569 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9570 uint16_t u16Fsw = pFpuCtx->FSW;
9571 if (u16Fsw & X86_FSW_ES)
9572 return iemRaiseMathFault(pVCpu);
9573
9574 /*
9575 * Check if any of the register accesses causes #SF + #IA.
9576 */
9577 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9578 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9579 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9580 {
9581 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9582
9583 pFpuCtx->FSW &= ~X86_FSW_C1;
9584 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9585 if ( !(u16Fsw & X86_FSW_IE)
9586 || (pFpuCtx->FCW & X86_FCW_IM) )
9587 {
9588 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9589 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9590 }
9591 }
9592 else if (pFpuCtx->FCW & X86_FCW_IM)
9593 {
9594 /* Masked underflow. */
9595 pFpuCtx->FSW &= ~X86_FSW_C1;
9596 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9597 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9598 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9599 }
9600 else
9601 {
9602 /* Raise underflow - don't touch EFLAGS or TOP. */
9603 pFpuCtx->FSW &= ~X86_FSW_C1;
9604 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9605 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
9606 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9607 fPop = false;
9608 }
9609
9610 /*
9611 * Pop if necessary.
9612 */
9613 if (fPop)
9614 {
9615 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9616 iemFpuStackIncTop(pVCpu);
9617 }
9618
9619 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9620 iemHlpUsedFpu(pVCpu);
9621 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9622 return VINF_SUCCESS;
9623}
9624
9625/** @} */
9626
注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette