VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 97370

最後變更 在這個檔案從97370是 97370,由 vboxsync 提交於 2 年 前

VMM/IEM: iemRegAddToRipAndClearRF -> iemRegUpdateRipAndFinishClearingRF and made callers use the return code. bugref:9898
  • 屬性 svn:eol-style 設為 native
  • 屬性 svn:keywords 設為 Author Date Id Revision
檔案大小: 348.0 KB
行 
1/* $Id: IEMAllCImpl.cpp 97370 2022-11-02 00:53:30Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.alldomusa.eu.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#include <VBox/vmm/iem.h>
35#include <VBox/vmm/cpum.h>
36#include <VBox/vmm/apic.h>
37#include <VBox/vmm/pdm.h>
38#include <VBox/vmm/pgm.h>
39#include <VBox/vmm/iom.h>
40#include <VBox/vmm/em.h>
41#include <VBox/vmm/hm.h>
42#include <VBox/vmm/nem.h>
43#include <VBox/vmm/gim.h>
44#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
45# include <VBox/vmm/em.h>
46# include <VBox/vmm/hm_svm.h>
47#endif
48#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
49# include <VBox/vmm/hmvmxinline.h>
50#endif
51#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
52# include <VBox/vmm/cpuidcall.h>
53#endif
54#include <VBox/vmm/tm.h>
55#include <VBox/vmm/dbgf.h>
56#include <VBox/vmm/dbgftrace.h>
57#include "IEMInternal.h"
58#include <VBox/vmm/vmcc.h>
59#include <VBox/log.h>
60#include <VBox/err.h>
61#include <VBox/param.h>
62#include <VBox/dis.h>
63#include <VBox/disopcode.h>
64#include <iprt/asm-math.h>
65#include <iprt/assert.h>
66#include <iprt/string.h>
67#include <iprt/x86.h>
68
69#include "IEMInline.h"
70
71
72/** @name Misc Helpers
73 * @{
74 */
75
76
77/**
78 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
79 *
80 * @returns Strict VBox status code.
81 *
82 * @param pVCpu The cross context virtual CPU structure of the calling thread.
83 * @param u16Port The port number.
84 * @param cbOperand The operand size.
85 */
86static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
87{
88 /* The TSS bits we're interested in are the same on 386 and AMD64. */
89 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
90 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
91 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
92 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
93
94 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
95
96 /*
97 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
98 */
99 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
100 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
101 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
102 {
103 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
104 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
105 return iemRaiseGeneralProtectionFault0(pVCpu);
106 }
107
108 /*
109 * Read the bitmap offset (may #PF).
110 */
111 uint16_t offBitmap;
112 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
113 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
114 if (rcStrict != VINF_SUCCESS)
115 {
116 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
117 return rcStrict;
118 }
119
120 /*
121 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
122 * describes the CPU actually reading two bytes regardless of whether the
123 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
124 */
125 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
126 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
127 * for instance sizeof(X86TSS32). */
128 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
129 {
130 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
131 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
132 return iemRaiseGeneralProtectionFault0(pVCpu);
133 }
134
135 /*
136 * Read the necessary bits.
137 */
138 /** @todo Test the assertion in the intel manual that the CPU reads two
139 * bytes. The question is how this works wrt to \#PF and \#GP on the
140 * 2nd byte when it's not required. */
141 uint16_t bmBytes = UINT16_MAX;
142 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
143 if (rcStrict != VINF_SUCCESS)
144 {
145 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
146 return rcStrict;
147 }
148
149 /*
150 * Perform the check.
151 */
152 uint16_t fPortMask = (1 << cbOperand) - 1;
153 bmBytes >>= (u16Port & 7);
154 if (bmBytes & fPortMask)
155 {
156 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
157 u16Port, cbOperand, bmBytes, fPortMask));
158 return iemRaiseGeneralProtectionFault0(pVCpu);
159 }
160
161 return VINF_SUCCESS;
162}
163
164
165/**
166 * Checks if we are allowed to access the given I/O port, raising the
167 * appropriate exceptions if we aren't (or if the I/O bitmap is not
168 * accessible).
169 *
170 * @returns Strict VBox status code.
171 *
172 * @param pVCpu The cross context virtual CPU structure of the calling thread.
173 * @param u16Port The port number.
174 * @param cbOperand The operand size.
175 */
176DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
177{
178 X86EFLAGS Efl;
179 Efl.u = IEMMISC_GET_EFL(pVCpu);
180 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
181 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
182 || Efl.Bits.u1VM) )
183 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
184 return VINF_SUCCESS;
185}
186
187
188#if 0
189/**
190 * Calculates the parity bit.
191 *
192 * @returns true if the bit is set, false if not.
193 * @param u8Result The least significant byte of the result.
194 */
195static bool iemHlpCalcParityFlag(uint8_t u8Result)
196{
197 /*
198 * Parity is set if the number of bits in the least significant byte of
199 * the result is even.
200 */
201 uint8_t cBits;
202 cBits = u8Result & 1; /* 0 */
203 u8Result >>= 1;
204 cBits += u8Result & 1;
205 u8Result >>= 1;
206 cBits += u8Result & 1;
207 u8Result >>= 1;
208 cBits += u8Result & 1;
209 u8Result >>= 1;
210 cBits += u8Result & 1; /* 4 */
211 u8Result >>= 1;
212 cBits += u8Result & 1;
213 u8Result >>= 1;
214 cBits += u8Result & 1;
215 u8Result >>= 1;
216 cBits += u8Result & 1;
217 return !(cBits & 1);
218}
219#endif /* not used */
220
221
222/**
223 * Updates the specified flags according to a 8-bit result.
224 *
225 * @param pVCpu The cross context virtual CPU structure of the calling thread.
226 * @param u8Result The result to set the flags according to.
227 * @param fToUpdate The flags to update.
228 * @param fUndefined The flags that are specified as undefined.
229 */
230static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
231{
232 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
233 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
234 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
235 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
236}
237
238
239/**
240 * Updates the specified flags according to a 16-bit result.
241 *
242 * @param pVCpu The cross context virtual CPU structure of the calling thread.
243 * @param u16Result The result to set the flags according to.
244 * @param fToUpdate The flags to update.
245 * @param fUndefined The flags that are specified as undefined.
246 */
247static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
248{
249 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
250 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
251 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
252 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
253}
254
255
256/**
257 * Helper used by iret.
258 *
259 * @param pVCpu The cross context virtual CPU structure of the calling thread.
260 * @param uCpl The new CPL.
261 * @param pSReg Pointer to the segment register.
262 */
263static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
264{
265 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
266 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
267
268 if ( uCpl > pSReg->Attr.n.u2Dpl
269 && pSReg->Attr.n.u1DescType /* code or data, not system */
270 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
271 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
272 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
273}
274
275
276/**
277 * Indicates that we have modified the FPU state.
278 *
279 * @param pVCpu The cross context virtual CPU structure of the calling thread.
280 */
281DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
282{
283 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
284}
285
286/** @} */
287
288/** @name C Implementations
289 * @{
290 */
291
292/**
293 * Implements a 16-bit popa.
294 */
295IEM_CIMPL_DEF_0(iemCImpl_popa_16)
296{
297 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
298 RTGCPTR GCPtrLast = GCPtrStart + 15;
299 VBOXSTRICTRC rcStrict;
300
301 /*
302 * The docs are a bit hard to comprehend here, but it looks like we wrap
303 * around in real mode as long as none of the individual "popa" crosses the
304 * end of the stack segment. In protected mode we check the whole access
305 * in one go. For efficiency, only do the word-by-word thing if we're in
306 * danger of wrapping around.
307 */
308 /** @todo do popa boundary / wrap-around checks. */
309 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
310 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
311 {
312 /* word-by-word */
313 RTUINT64U TmpRsp;
314 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
315 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
316 if (rcStrict == VINF_SUCCESS)
317 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
318 if (rcStrict == VINF_SUCCESS)
319 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
320 if (rcStrict == VINF_SUCCESS)
321 {
322 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
323 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
324 }
325 if (rcStrict == VINF_SUCCESS)
326 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
334 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
335 }
336 }
337 else
338 {
339 uint16_t const *pa16Mem = NULL;
340 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
341 if (rcStrict == VINF_SUCCESS)
342 {
343 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
344 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
345 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
346 /* skip sp */
347 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
348 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
349 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
350 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
351 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
352 if (rcStrict == VINF_SUCCESS)
353 {
354 iemRegAddToRsp(pVCpu, 16);
355 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
356 }
357 }
358 }
359 return rcStrict;
360}
361
362
363/**
364 * Implements a 32-bit popa.
365 */
366IEM_CIMPL_DEF_0(iemCImpl_popa_32)
367{
368 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
369 RTGCPTR GCPtrLast = GCPtrStart + 31;
370 VBOXSTRICTRC rcStrict;
371
372 /*
373 * The docs are a bit hard to comprehend here, but it looks like we wrap
374 * around in real mode as long as none of the individual "popa" crosses the
375 * end of the stack segment. In protected mode we check the whole access
376 * in one go. For efficiency, only do the word-by-word thing if we're in
377 * danger of wrapping around.
378 */
379 /** @todo do popa boundary / wrap-around checks. */
380 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
381 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
382 {
383 /* word-by-word */
384 RTUINT64U TmpRsp;
385 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
386 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
387 if (rcStrict == VINF_SUCCESS)
388 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
389 if (rcStrict == VINF_SUCCESS)
390 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
391 if (rcStrict == VINF_SUCCESS)
392 {
393 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
394 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
395 }
396 if (rcStrict == VINF_SUCCESS)
397 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
398 if (rcStrict == VINF_SUCCESS)
399 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
400 if (rcStrict == VINF_SUCCESS)
401 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
402 if (rcStrict == VINF_SUCCESS)
403 {
404#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
405 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
406 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
407 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
408 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
409 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
410 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
411 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
412#endif
413 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
414 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
415 }
416 }
417 else
418 {
419 uint32_t const *pa32Mem;
420 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
421 if (rcStrict == VINF_SUCCESS)
422 {
423 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
424 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
425 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
426 /* skip esp */
427 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
428 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
429 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
430 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
431 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
432 if (rcStrict == VINF_SUCCESS)
433 {
434 iemRegAddToRsp(pVCpu, 32);
435 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
436 }
437 }
438 }
439 return rcStrict;
440}
441
442
443/**
444 * Implements a 16-bit pusha.
445 */
446IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
447{
448 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
449 RTGCPTR GCPtrBottom = GCPtrTop - 15;
450 VBOXSTRICTRC rcStrict;
451
452 /*
453 * The docs are a bit hard to comprehend here, but it looks like we wrap
454 * around in real mode as long as none of the individual "pushd" crosses the
455 * end of the stack segment. In protected mode we check the whole access
456 * in one go. For efficiency, only do the word-by-word thing if we're in
457 * danger of wrapping around.
458 */
459 /** @todo do pusha boundary / wrap-around checks. */
460 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
461 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
462 {
463 /* word-by-word */
464 RTUINT64U TmpRsp;
465 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
466 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
467 if (rcStrict == VINF_SUCCESS)
468 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
469 if (rcStrict == VINF_SUCCESS)
470 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
471 if (rcStrict == VINF_SUCCESS)
472 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
473 if (rcStrict == VINF_SUCCESS)
474 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
475 if (rcStrict == VINF_SUCCESS)
476 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
477 if (rcStrict == VINF_SUCCESS)
478 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
479 if (rcStrict == VINF_SUCCESS)
480 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
481 if (rcStrict == VINF_SUCCESS)
482 {
483 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
484 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
485 }
486 }
487 else
488 {
489 GCPtrBottom--;
490 uint16_t *pa16Mem = NULL;
491 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
492 if (rcStrict == VINF_SUCCESS)
493 {
494 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
495 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
496 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
497 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
498 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
499 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
500 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
501 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
502 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
503 if (rcStrict == VINF_SUCCESS)
504 {
505 iemRegSubFromRsp(pVCpu, 16);
506 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
507 }
508 }
509 }
510 return rcStrict;
511}
512
513
514/**
515 * Implements a 32-bit pusha.
516 */
517IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
518{
519 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
520 RTGCPTR GCPtrBottom = GCPtrTop - 31;
521 VBOXSTRICTRC rcStrict;
522
523 /*
524 * The docs are a bit hard to comprehend here, but it looks like we wrap
525 * around in real mode as long as none of the individual "pusha" crosses the
526 * end of the stack segment. In protected mode we check the whole access
527 * in one go. For efficiency, only do the word-by-word thing if we're in
528 * danger of wrapping around.
529 */
530 /** @todo do pusha boundary / wrap-around checks. */
531 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
532 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
533 {
534 /* word-by-word */
535 RTUINT64U TmpRsp;
536 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
537 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
538 if (rcStrict == VINF_SUCCESS)
539 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
540 if (rcStrict == VINF_SUCCESS)
541 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
542 if (rcStrict == VINF_SUCCESS)
543 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
544 if (rcStrict == VINF_SUCCESS)
545 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
546 if (rcStrict == VINF_SUCCESS)
547 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
548 if (rcStrict == VINF_SUCCESS)
549 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
550 if (rcStrict == VINF_SUCCESS)
551 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
552 if (rcStrict == VINF_SUCCESS)
553 {
554 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
555 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
556 }
557 }
558 else
559 {
560 GCPtrBottom--;
561 uint32_t *pa32Mem;
562 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
563 if (rcStrict == VINF_SUCCESS)
564 {
565 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
566 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
567 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
568 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
569 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
570 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
571 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
572 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
573 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
574 if (rcStrict == VINF_SUCCESS)
575 {
576 iemRegSubFromRsp(pVCpu, 32);
577 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
578 }
579 }
580 }
581 return rcStrict;
582}
583
584
585/**
586 * Implements pushf.
587 *
588 *
589 * @param enmEffOpSize The effective operand size.
590 */
591IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
592{
593 VBOXSTRICTRC rcStrict;
594
595 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
596 {
597 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
598 IEM_SVM_UPDATE_NRIP(pVCpu);
599 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
600 }
601
602 /*
603 * If we're in V8086 mode some care is required (which is why we're in
604 * doing this in a C implementation).
605 */
606 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
607 if ( (fEfl & X86_EFL_VM)
608 && X86_EFL_GET_IOPL(fEfl) != 3 )
609 {
610 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
611 if ( enmEffOpSize != IEMMODE_16BIT
612 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
613 return iemRaiseGeneralProtectionFault0(pVCpu);
614 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
615 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
616 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
617 }
618 else
619 {
620
621 /*
622 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
623 */
624 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
625
626 switch (enmEffOpSize)
627 {
628 case IEMMODE_16BIT:
629 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
630 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
631 fEfl |= UINT16_C(0xf000);
632 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
633 break;
634 case IEMMODE_32BIT:
635 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
636 break;
637 case IEMMODE_64BIT:
638 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
639 break;
640 IEM_NOT_REACHED_DEFAULT_CASE_RET();
641 }
642 }
643
644 if (rcStrict == VINF_SUCCESS)
645 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
646 return rcStrict;
647}
648
649
650/**
651 * Implements popf.
652 *
653 * @param enmEffOpSize The effective operand size.
654 */
655IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
656{
657 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
658 VBOXSTRICTRC rcStrict;
659 uint32_t fEflNew;
660
661 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
662 {
663 Log2(("popf: Guest intercept -> #VMEXIT\n"));
664 IEM_SVM_UPDATE_NRIP(pVCpu);
665 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
666 }
667
668 /*
669 * V8086 is special as usual.
670 */
671 if (fEflOld & X86_EFL_VM)
672 {
673 /*
674 * Almost anything goes if IOPL is 3.
675 */
676 if (X86_EFL_GET_IOPL(fEflOld) == 3)
677 {
678 switch (enmEffOpSize)
679 {
680 case IEMMODE_16BIT:
681 {
682 uint16_t u16Value;
683 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
684 if (rcStrict != VINF_SUCCESS)
685 return rcStrict;
686 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
687 break;
688 }
689 case IEMMODE_32BIT:
690 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
691 if (rcStrict != VINF_SUCCESS)
692 return rcStrict;
693 break;
694 IEM_NOT_REACHED_DEFAULT_CASE_RET();
695 }
696
697 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
698 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
699 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
700 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
701 }
702 /*
703 * Interrupt flag virtualization with CR4.VME=1.
704 */
705 else if ( enmEffOpSize == IEMMODE_16BIT
706 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
707 {
708 uint16_t u16Value;
709 RTUINT64U TmpRsp;
710 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
711 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
712 if (rcStrict != VINF_SUCCESS)
713 return rcStrict;
714
715 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
716 * or before? */
717 if ( ( (u16Value & X86_EFL_IF)
718 && (fEflOld & X86_EFL_VIP))
719 || (u16Value & X86_EFL_TF) )
720 return iemRaiseGeneralProtectionFault0(pVCpu);
721
722 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
723 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
724 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
725 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
726
727 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
728 }
729 else
730 return iemRaiseGeneralProtectionFault0(pVCpu);
731
732 }
733 /*
734 * Not in V8086 mode.
735 */
736 else
737 {
738 /* Pop the flags. */
739 switch (enmEffOpSize)
740 {
741 case IEMMODE_16BIT:
742 {
743 uint16_t u16Value;
744 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
745 if (rcStrict != VINF_SUCCESS)
746 return rcStrict;
747 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
748
749 /*
750 * Ancient CPU adjustments:
751 * - 8086, 80186, V20/30:
752 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
753 * practical reasons (masking below). We add them when pushing flags.
754 * - 80286:
755 * The NT and IOPL flags cannot be popped from real mode and are
756 * therefore always zero (since a 286 can never exit from PM and
757 * their initial value is zero). This changed on a 386 and can
758 * therefore be used to detect 286 or 386 CPU in real mode.
759 */
760 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
761 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
762 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
763 break;
764 }
765 case IEMMODE_32BIT:
766 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
767 if (rcStrict != VINF_SUCCESS)
768 return rcStrict;
769 break;
770 case IEMMODE_64BIT:
771 {
772 uint64_t u64Value;
773 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
774 if (rcStrict != VINF_SUCCESS)
775 return rcStrict;
776 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
777 break;
778 }
779 IEM_NOT_REACHED_DEFAULT_CASE_RET();
780 }
781
782 /* Merge them with the current flags. */
783 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
784 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
785 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
786 || pVCpu->iem.s.uCpl == 0)
787 {
788 fEflNew &= fPopfBits;
789 fEflNew |= ~fPopfBits & fEflOld;
790 }
791 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
792 {
793 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
794 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
795 }
796 else
797 {
798 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
799 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
800 }
801 }
802
803 /*
804 * Commit the flags.
805 */
806 Assert(fEflNew & RT_BIT_32(1));
807 IEMMISC_SET_EFL(pVCpu, fEflNew);
808 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
809}
810
811
812/**
813 * Implements an indirect call.
814 *
815 * @param uNewPC The new program counter (RIP) value (loaded from the
816 * operand).
817 */
818IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
819{
820 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
821 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
822 return iemRaiseGeneralProtectionFault0(pVCpu);
823
824 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
825 if (rcStrict != VINF_SUCCESS)
826 return rcStrict;
827
828 pVCpu->cpum.GstCtx.rip = uNewPC;
829 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
830
831#ifndef IEM_WITH_CODE_TLB
832 /* Flush the prefetch buffer. */
833 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
834#endif
835 return VINF_SUCCESS;
836}
837
838
839/**
840 * Implements a 16-bit relative call.
841 *
842 * @param offDisp The displacment offset.
843 */
844IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
845{
846 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
847 uint16_t uNewPC = uOldPC + offDisp;
848 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
849 return iemRaiseGeneralProtectionFault0(pVCpu);
850
851 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
852 if (rcStrict != VINF_SUCCESS)
853 return rcStrict;
854
855 pVCpu->cpum.GstCtx.rip = uNewPC;
856 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
857
858#ifndef IEM_WITH_CODE_TLB
859 /* Flush the prefetch buffer. */
860 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
861#endif
862 return VINF_SUCCESS;
863}
864
865
866/**
867 * Implements a 32-bit indirect call.
868 *
869 * @param uNewPC The new program counter (RIP) value (loaded from the
870 * operand).
871 */
872IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
873{
874 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
875 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
876 return iemRaiseGeneralProtectionFault0(pVCpu);
877
878 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
879 if (rcStrict != VINF_SUCCESS)
880 return rcStrict;
881
882 pVCpu->cpum.GstCtx.rip = uNewPC;
883 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
884
885#ifndef IEM_WITH_CODE_TLB
886 /* Flush the prefetch buffer. */
887 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
888#endif
889 return VINF_SUCCESS;
890}
891
892
893/**
894 * Implements a 32-bit relative call.
895 *
896 * @param offDisp The displacment offset.
897 */
898IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
899{
900 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
901 uint32_t uNewPC = uOldPC + offDisp;
902 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
903 return iemRaiseGeneralProtectionFault0(pVCpu);
904
905 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
906 if (rcStrict != VINF_SUCCESS)
907 return rcStrict;
908
909 pVCpu->cpum.GstCtx.rip = uNewPC;
910 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
911
912#ifndef IEM_WITH_CODE_TLB
913 /* Flush the prefetch buffer. */
914 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
915#endif
916 return VINF_SUCCESS;
917}
918
919
920/**
921 * Implements a 64-bit indirect call.
922 *
923 * @param uNewPC The new program counter (RIP) value (loaded from the
924 * operand).
925 */
926IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
927{
928 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
929 if (!IEM_IS_CANONICAL(uNewPC))
930 return iemRaiseGeneralProtectionFault0(pVCpu);
931
932 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
933 if (rcStrict != VINF_SUCCESS)
934 return rcStrict;
935
936 pVCpu->cpum.GstCtx.rip = uNewPC;
937 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
938
939#ifndef IEM_WITH_CODE_TLB
940 /* Flush the prefetch buffer. */
941 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
942#endif
943 return VINF_SUCCESS;
944}
945
946
947/**
948 * Implements a 64-bit relative call.
949 *
950 * @param offDisp The displacment offset.
951 */
952IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
953{
954 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
955 uint64_t uNewPC = uOldPC + offDisp;
956 if (!IEM_IS_CANONICAL(uNewPC))
957 return iemRaiseNotCanonical(pVCpu);
958
959 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
960 if (rcStrict != VINF_SUCCESS)
961 return rcStrict;
962
963 pVCpu->cpum.GstCtx.rip = uNewPC;
964 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
965
966#ifndef IEM_WITH_CODE_TLB
967 /* Flush the prefetch buffer. */
968 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
969#endif
970
971 return VINF_SUCCESS;
972}
973
974
975/**
976 * Implements far jumps and calls thru task segments (TSS).
977 *
978 * @param uSel The selector.
979 * @param enmBranch The kind of branching we're performing.
980 * @param enmEffOpSize The effective operand size.
981 * @param pDesc The descriptor corresponding to @a uSel. The type is
982 * task gate.
983 */
984IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
985{
986#ifndef IEM_IMPLEMENTS_TASKSWITCH
987 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
988#else
989 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
990 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
991 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
992 RT_NOREF_PV(enmEffOpSize);
993 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
994
995 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
996 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
997 {
998 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
999 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1000 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1001 }
1002
1003 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1004 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1005 * checked here, need testcases. */
1006 if (!pDesc->Legacy.Gen.u1Present)
1007 {
1008 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1009 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1010 }
1011
1012 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1013 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1014 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1015#endif
1016}
1017
1018
1019/**
1020 * Implements far jumps and calls thru task gates.
1021 *
1022 * @param uSel The selector.
1023 * @param enmBranch The kind of branching we're performing.
1024 * @param enmEffOpSize The effective operand size.
1025 * @param pDesc The descriptor corresponding to @a uSel. The type is
1026 * task gate.
1027 */
1028IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1029{
1030#ifndef IEM_IMPLEMENTS_TASKSWITCH
1031 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1032#else
1033 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1034 RT_NOREF_PV(enmEffOpSize);
1035 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1036
1037 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1038 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1039 {
1040 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1041 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1042 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1043 }
1044
1045 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1046 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1047 * checked here, need testcases. */
1048 if (!pDesc->Legacy.Gen.u1Present)
1049 {
1050 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1051 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1052 }
1053
1054 /*
1055 * Fetch the new TSS descriptor from the GDT.
1056 */
1057 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1058 if (uSelTss & X86_SEL_LDT)
1059 {
1060 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1061 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1062 }
1063
1064 IEMSELDESC TssDesc;
1065 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1066 if (rcStrict != VINF_SUCCESS)
1067 return rcStrict;
1068
1069 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1070 {
1071 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1072 TssDesc.Legacy.Gate.u4Type));
1073 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1074 }
1075
1076 if (!TssDesc.Legacy.Gate.u1Present)
1077 {
1078 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1079 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1080 }
1081
1082 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1083 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1084 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1085#endif
1086}
1087
1088
1089/**
1090 * Implements far jumps and calls thru call gates.
1091 *
1092 * @param uSel The selector.
1093 * @param enmBranch The kind of branching we're performing.
1094 * @param enmEffOpSize The effective operand size.
1095 * @param pDesc The descriptor corresponding to @a uSel. The type is
1096 * call gate.
1097 */
1098IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1099{
1100#define IEM_IMPLEMENTS_CALLGATE
1101#ifndef IEM_IMPLEMENTS_CALLGATE
1102 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1103#else
1104 RT_NOREF_PV(enmEffOpSize);
1105 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1106
1107 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1108 * inter-privilege calls and are much more complex.
1109 *
1110 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1111 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1112 * must be 16-bit or 32-bit.
1113 */
1114 /** @todo effective operand size is probably irrelevant here, only the
1115 * call gate bitness matters??
1116 */
1117 VBOXSTRICTRC rcStrict;
1118 RTPTRUNION uPtrRet;
1119 uint64_t uNewRsp;
1120 uint64_t uNewRip;
1121 uint64_t u64Base;
1122 uint32_t cbLimit;
1123 RTSEL uNewCS;
1124 IEMSELDESC DescCS;
1125
1126 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1127 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1128 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1129 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1130
1131 /* Determine the new instruction pointer from the gate descriptor. */
1132 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1133 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1134 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1135
1136 /* Perform DPL checks on the gate descriptor. */
1137 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1138 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1139 {
1140 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1141 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1142 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1143 }
1144
1145 /** @todo does this catch NULL selectors, too? */
1146 if (!pDesc->Legacy.Gen.u1Present)
1147 {
1148 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1149 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1150 }
1151
1152 /*
1153 * Fetch the target CS descriptor from the GDT or LDT.
1154 */
1155 uNewCS = pDesc->Legacy.Gate.u16Sel;
1156 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1157 if (rcStrict != VINF_SUCCESS)
1158 return rcStrict;
1159
1160 /* Target CS must be a code selector. */
1161 if ( !DescCS.Legacy.Gen.u1DescType
1162 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1163 {
1164 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1165 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1167 }
1168
1169 /* Privilege checks on target CS. */
1170 if (enmBranch == IEMBRANCH_JUMP)
1171 {
1172 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1173 {
1174 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1175 {
1176 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1177 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1178 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1179 }
1180 }
1181 else
1182 {
1183 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1184 {
1185 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1186 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1187 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1188 }
1189 }
1190 }
1191 else
1192 {
1193 Assert(enmBranch == IEMBRANCH_CALL);
1194 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1195 {
1196 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1197 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1198 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1199 }
1200 }
1201
1202 /* Additional long mode checks. */
1203 if (IEM_IS_LONG_MODE(pVCpu))
1204 {
1205 if (!DescCS.Legacy.Gen.u1Long)
1206 {
1207 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1208 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1209 }
1210
1211 /* L vs D. */
1212 if ( DescCS.Legacy.Gen.u1Long
1213 && DescCS.Legacy.Gen.u1DefBig)
1214 {
1215 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1216 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1217 }
1218 }
1219
1220 if (!DescCS.Legacy.Gate.u1Present)
1221 {
1222 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1223 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1224 }
1225
1226 if (enmBranch == IEMBRANCH_JUMP)
1227 {
1228 /** @todo This is very similar to regular far jumps; merge! */
1229 /* Jumps are fairly simple... */
1230
1231 /* Chop the high bits off if 16-bit gate (Intel says so). */
1232 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1233 uNewRip = (uint16_t)uNewRip;
1234
1235 /* Limit check for non-long segments. */
1236 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1237 if (DescCS.Legacy.Gen.u1Long)
1238 u64Base = 0;
1239 else
1240 {
1241 if (uNewRip > cbLimit)
1242 {
1243 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1244 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1245 }
1246 u64Base = X86DESC_BASE(&DescCS.Legacy);
1247 }
1248
1249 /* Canonical address check. */
1250 if (!IEM_IS_CANONICAL(uNewRip))
1251 {
1252 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1253 return iemRaiseNotCanonical(pVCpu);
1254 }
1255
1256 /*
1257 * Ok, everything checked out fine. Now set the accessed bit before
1258 * committing the result into CS, CSHID and RIP.
1259 */
1260 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1261 {
1262 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1263 if (rcStrict != VINF_SUCCESS)
1264 return rcStrict;
1265 /** @todo check what VT-x and AMD-V does. */
1266 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1267 }
1268
1269 /* commit */
1270 pVCpu->cpum.GstCtx.rip = uNewRip;
1271 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1272 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1273 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1274 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1275 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1276 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1277 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1278 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1279 }
1280 else
1281 {
1282 Assert(enmBranch == IEMBRANCH_CALL);
1283 /* Calls are much more complicated. */
1284
1285 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1286 {
1287 uint16_t offNewStack; /* Offset of new stack in TSS. */
1288 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1289 uint8_t uNewCSDpl;
1290 uint8_t cbWords;
1291 RTSEL uNewSS;
1292 RTSEL uOldSS;
1293 uint64_t uOldRsp;
1294 IEMSELDESC DescSS;
1295 RTPTRUNION uPtrTSS;
1296 RTGCPTR GCPtrTSS;
1297 RTPTRUNION uPtrParmWds;
1298 RTGCPTR GCPtrParmWds;
1299
1300 /* More privilege. This is the fun part. */
1301 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1302
1303 /*
1304 * Determine new SS:rSP from the TSS.
1305 */
1306 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1307
1308 /* Figure out where the new stack pointer is stored in the TSS. */
1309 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1310 if (!IEM_IS_LONG_MODE(pVCpu))
1311 {
1312 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1313 {
1314 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1315 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1316 }
1317 else
1318 {
1319 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1320 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1321 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1322 }
1323 }
1324 else
1325 {
1326 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1327 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1328 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1329 }
1330
1331 /* Check against TSS limit. */
1332 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1333 {
1334 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1335 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1336 }
1337
1338 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1339 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
1340 if (rcStrict != VINF_SUCCESS)
1341 {
1342 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1343 return rcStrict;
1344 }
1345
1346 if (!IEM_IS_LONG_MODE(pVCpu))
1347 {
1348 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1349 {
1350 uNewRsp = uPtrTSS.pu32[0];
1351 uNewSS = uPtrTSS.pu16[2];
1352 }
1353 else
1354 {
1355 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1356 uNewRsp = uPtrTSS.pu16[0];
1357 uNewSS = uPtrTSS.pu16[1];
1358 }
1359 }
1360 else
1361 {
1362 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1363 /* SS will be a NULL selector, but that's valid. */
1364 uNewRsp = uPtrTSS.pu64[0];
1365 uNewSS = uNewCSDpl;
1366 }
1367
1368 /* Done with the TSS now. */
1369 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1370 if (rcStrict != VINF_SUCCESS)
1371 {
1372 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1373 return rcStrict;
1374 }
1375
1376 /* Only used outside of long mode. */
1377 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1378
1379 /* If EFER.LMA is 0, there's extra work to do. */
1380 if (!IEM_IS_LONG_MODE(pVCpu))
1381 {
1382 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1383 {
1384 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1385 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1386 }
1387
1388 /* Grab the new SS descriptor. */
1389 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1390 if (rcStrict != VINF_SUCCESS)
1391 return rcStrict;
1392
1393 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1394 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1395 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1396 {
1397 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1398 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1399 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1400 }
1401
1402 /* Ensure new SS is a writable data segment. */
1403 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1404 {
1405 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1406 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1407 }
1408
1409 if (!DescSS.Legacy.Gen.u1Present)
1410 {
1411 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1412 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1413 }
1414 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1415 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1416 else
1417 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1418 }
1419 else
1420 {
1421 /* Just grab the new (NULL) SS descriptor. */
1422 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1423 * like we do... */
1424 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1425 if (rcStrict != VINF_SUCCESS)
1426 return rcStrict;
1427
1428 cbNewStack = sizeof(uint64_t) * 4;
1429 }
1430
1431 /** @todo According to Intel, new stack is checked for enough space first,
1432 * then switched. According to AMD, the stack is switched first and
1433 * then pushes might fault!
1434 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1435 * incoming stack \#PF happens before actual stack switch. AMD is
1436 * either lying or implicitly assumes that new state is committed
1437 * only if and when an instruction doesn't fault.
1438 */
1439
1440 /** @todo According to AMD, CS is loaded first, then SS.
1441 * According to Intel, it's the other way around!?
1442 */
1443
1444 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1445
1446 /* Set the accessed bit before committing new SS. */
1447 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1448 {
1449 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1450 if (rcStrict != VINF_SUCCESS)
1451 return rcStrict;
1452 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1453 }
1454
1455 /* Remember the old SS:rSP and their linear address. */
1456 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1457 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1458
1459 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1460
1461 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1462 or #PF, the former is not implemented in this workaround. */
1463 /** @todo Proper fix callgate target stack exceptions. */
1464 /** @todo testcase: Cover callgates with partially or fully inaccessible
1465 * target stacks. */
1466 void *pvNewFrame;
1467 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1468 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1469 if (rcStrict != VINF_SUCCESS)
1470 {
1471 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1472 return rcStrict;
1473 }
1474 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1475 if (rcStrict != VINF_SUCCESS)
1476 {
1477 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1478 return rcStrict;
1479 }
1480
1481 /* Commit new SS:rSP. */
1482 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1483 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1484 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1485 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1486 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1487 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1488 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1489 pVCpu->iem.s.uCpl = uNewCSDpl; /** @todo is the parameter words accessed using the new CPL or the old CPL? */
1490 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1491 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1492
1493 /* At this point the stack access must not fail because new state was already committed. */
1494 /** @todo this can still fail due to SS.LIMIT not check. */
1495 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1496 IEM_IS_LONG_MODE(pVCpu) ? 7
1497 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1498 &uPtrRet.pv, &uNewRsp);
1499 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1500 VERR_INTERNAL_ERROR_5);
1501
1502 if (!IEM_IS_LONG_MODE(pVCpu))
1503 {
1504 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1505 {
1506 if (cbWords)
1507 {
1508 /* Map the relevant chunk of the old stack. */
1509 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1510 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1511 if (rcStrict != VINF_SUCCESS)
1512 {
1513 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1514 return rcStrict;
1515 }
1516
1517 /* Copy the parameter (d)words. */
1518 for (int i = 0; i < cbWords; ++i)
1519 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1520
1521 /* Unmap the old stack. */
1522 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1523 if (rcStrict != VINF_SUCCESS)
1524 {
1525 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1526 return rcStrict;
1527 }
1528 }
1529
1530 /* Push the old CS:rIP. */
1531 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1532 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1533
1534 /* Push the old SS:rSP. */
1535 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1536 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1537 }
1538 else
1539 {
1540 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1541
1542 if (cbWords)
1543 {
1544 /* Map the relevant chunk of the old stack. */
1545 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1546 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1547 if (rcStrict != VINF_SUCCESS)
1548 {
1549 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1550 return rcStrict;
1551 }
1552
1553 /* Copy the parameter words. */
1554 for (int i = 0; i < cbWords; ++i)
1555 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1556
1557 /* Unmap the old stack. */
1558 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1559 if (rcStrict != VINF_SUCCESS)
1560 {
1561 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1562 return rcStrict;
1563 }
1564 }
1565
1566 /* Push the old CS:rIP. */
1567 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1568 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1569
1570 /* Push the old SS:rSP. */
1571 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1572 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1573 }
1574 }
1575 else
1576 {
1577 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1578
1579 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1580 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1581 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1582 uPtrRet.pu64[2] = uOldRsp;
1583 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1584 }
1585
1586 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1587 if (rcStrict != VINF_SUCCESS)
1588 {
1589 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1590 return rcStrict;
1591 }
1592
1593 /* Chop the high bits off if 16-bit gate (Intel says so). */
1594 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1595 uNewRip = (uint16_t)uNewRip;
1596
1597 /* Limit / canonical check. */
1598 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1599 if (!IEM_IS_LONG_MODE(pVCpu))
1600 {
1601 if (uNewRip > cbLimit)
1602 {
1603 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1604 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1605 }
1606 u64Base = X86DESC_BASE(&DescCS.Legacy);
1607 }
1608 else
1609 {
1610 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1611 if (!IEM_IS_CANONICAL(uNewRip))
1612 {
1613 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1614 return iemRaiseNotCanonical(pVCpu);
1615 }
1616 u64Base = 0;
1617 }
1618
1619 /*
1620 * Now set the accessed bit before
1621 * writing the return address to the stack and committing the result into
1622 * CS, CSHID and RIP.
1623 */
1624 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1625 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1626 {
1627 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1628 if (rcStrict != VINF_SUCCESS)
1629 return rcStrict;
1630 /** @todo check what VT-x and AMD-V does. */
1631 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1632 }
1633
1634 /* Commit new CS:rIP. */
1635 pVCpu->cpum.GstCtx.rip = uNewRip;
1636 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1637 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1638 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1639 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1640 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1641 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1642 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1643 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1644 }
1645 else
1646 {
1647 /* Same privilege. */
1648 /** @todo This is very similar to regular far calls; merge! */
1649
1650 /* Check stack first - may #SS(0). */
1651 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1652 * 16-bit code cause a two or four byte CS to be pushed? */
1653 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1654 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1655 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1656 IEM_IS_LONG_MODE(pVCpu) ? 7
1657 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1658 &uPtrRet.pv, &uNewRsp);
1659 if (rcStrict != VINF_SUCCESS)
1660 return rcStrict;
1661
1662 /* Chop the high bits off if 16-bit gate (Intel says so). */
1663 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1664 uNewRip = (uint16_t)uNewRip;
1665
1666 /* Limit / canonical check. */
1667 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1668 if (!IEM_IS_LONG_MODE(pVCpu))
1669 {
1670 if (uNewRip > cbLimit)
1671 {
1672 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1673 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1674 }
1675 u64Base = X86DESC_BASE(&DescCS.Legacy);
1676 }
1677 else
1678 {
1679 if (!IEM_IS_CANONICAL(uNewRip))
1680 {
1681 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1682 return iemRaiseNotCanonical(pVCpu);
1683 }
1684 u64Base = 0;
1685 }
1686
1687 /*
1688 * Now set the accessed bit before
1689 * writing the return address to the stack and committing the result into
1690 * CS, CSHID and RIP.
1691 */
1692 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1693 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1694 {
1695 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1696 if (rcStrict != VINF_SUCCESS)
1697 return rcStrict;
1698 /** @todo check what VT-x and AMD-V does. */
1699 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1700 }
1701
1702 /* stack */
1703 if (!IEM_IS_LONG_MODE(pVCpu))
1704 {
1705 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1706 {
1707 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1708 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1709 }
1710 else
1711 {
1712 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1713 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1714 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1715 }
1716 }
1717 else
1718 {
1719 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1720 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1721 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1722 }
1723
1724 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1725 if (rcStrict != VINF_SUCCESS)
1726 return rcStrict;
1727
1728 /* commit */
1729 pVCpu->cpum.GstCtx.rip = uNewRip;
1730 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1731 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1732 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1733 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1734 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1735 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1736 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1737 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1738 }
1739 }
1740 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1741
1742 /* Flush the prefetch buffer. */
1743# ifdef IEM_WITH_CODE_TLB
1744 pVCpu->iem.s.pbInstrBuf = NULL;
1745# else
1746 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1747# endif
1748 return VINF_SUCCESS;
1749#endif
1750}
1751
1752
1753/**
1754 * Implements far jumps and calls thru system selectors.
1755 *
1756 * @param uSel The selector.
1757 * @param enmBranch The kind of branching we're performing.
1758 * @param enmEffOpSize The effective operand size.
1759 * @param pDesc The descriptor corresponding to @a uSel.
1760 */
1761IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1762{
1763 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1764 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1765 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1766
1767 if (IEM_IS_LONG_MODE(pVCpu))
1768 switch (pDesc->Legacy.Gen.u4Type)
1769 {
1770 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1771 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1772
1773 default:
1774 case AMD64_SEL_TYPE_SYS_LDT:
1775 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1776 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1777 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1778 case AMD64_SEL_TYPE_SYS_INT_GATE:
1779 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1780 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1781 }
1782
1783 switch (pDesc->Legacy.Gen.u4Type)
1784 {
1785 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1786 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1787 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1788
1789 case X86_SEL_TYPE_SYS_TASK_GATE:
1790 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1791
1792 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1793 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1794 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1795
1796 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1797 Log(("branch %04x -> busy 286 TSS\n", uSel));
1798 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1799
1800 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1801 Log(("branch %04x -> busy 386 TSS\n", uSel));
1802 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1803
1804 default:
1805 case X86_SEL_TYPE_SYS_LDT:
1806 case X86_SEL_TYPE_SYS_286_INT_GATE:
1807 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1808 case X86_SEL_TYPE_SYS_386_INT_GATE:
1809 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1810 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1811 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1812 }
1813}
1814
1815
1816/**
1817 * Implements far jumps.
1818 *
1819 * @param uSel The selector.
1820 * @param offSeg The segment offset.
1821 * @param enmEffOpSize The effective operand size.
1822 */
1823IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1824{
1825 NOREF(cbInstr);
1826 Assert(offSeg <= UINT32_MAX);
1827
1828 /*
1829 * Real mode and V8086 mode are easy. The only snag seems to be that
1830 * CS.limit doesn't change and the limit check is done against the current
1831 * limit.
1832 */
1833 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1834 * 1998) that up to and including the Intel 486, far control
1835 * transfers in real mode set default CS attributes (0x93) and also
1836 * set a 64K segment limit. Starting with the Pentium, the
1837 * attributes and limit are left alone but the access rights are
1838 * ignored. We only implement the Pentium+ behavior.
1839 * */
1840 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1841 {
1842 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1843 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1844 {
1845 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1846 return iemRaiseGeneralProtectionFault0(pVCpu);
1847 }
1848
1849 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1850 pVCpu->cpum.GstCtx.rip = offSeg;
1851 else
1852 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1853 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1854 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1855 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1856 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1857 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1858 return VINF_SUCCESS;
1859 }
1860
1861 /*
1862 * Protected mode. Need to parse the specified descriptor...
1863 */
1864 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1865 {
1866 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1867 return iemRaiseGeneralProtectionFault0(pVCpu);
1868 }
1869
1870 /* Fetch the descriptor. */
1871 IEMSELDESC Desc;
1872 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1873 if (rcStrict != VINF_SUCCESS)
1874 return rcStrict;
1875
1876 /* Is it there? */
1877 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1878 {
1879 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1880 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1881 }
1882
1883 /*
1884 * Deal with it according to its type. We do the standard code selectors
1885 * here and dispatch the system selectors to worker functions.
1886 */
1887 if (!Desc.Legacy.Gen.u1DescType)
1888 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1889
1890 /* Only code segments. */
1891 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1892 {
1893 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1894 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1895 }
1896
1897 /* L vs D. */
1898 if ( Desc.Legacy.Gen.u1Long
1899 && Desc.Legacy.Gen.u1DefBig
1900 && IEM_IS_LONG_MODE(pVCpu))
1901 {
1902 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1903 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1904 }
1905
1906 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1907 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1908 {
1909 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1910 {
1911 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1912 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1913 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1914 }
1915 }
1916 else
1917 {
1918 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1919 {
1920 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1921 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1922 }
1923 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1924 {
1925 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1926 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1927 }
1928 }
1929
1930 /* Chop the high bits if 16-bit (Intel says so). */
1931 if (enmEffOpSize == IEMMODE_16BIT)
1932 offSeg &= UINT16_MAX;
1933
1934 /* Limit check. (Should alternatively check for non-canonical addresses
1935 here, but that is ruled out by offSeg being 32-bit, right?) */
1936 uint64_t u64Base;
1937 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1938 if (Desc.Legacy.Gen.u1Long)
1939 u64Base = 0;
1940 else
1941 {
1942 if (offSeg > cbLimit)
1943 {
1944 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1945 /** @todo Intel says this is \#GP(0)! */
1946 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1947 }
1948 u64Base = X86DESC_BASE(&Desc.Legacy);
1949 }
1950
1951 /*
1952 * Ok, everything checked out fine. Now set the accessed bit before
1953 * committing the result into CS, CSHID and RIP.
1954 */
1955 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1956 {
1957 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1958 if (rcStrict != VINF_SUCCESS)
1959 return rcStrict;
1960 /** @todo check what VT-x and AMD-V does. */
1961 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1962 }
1963
1964 /* commit */
1965 pVCpu->cpum.GstCtx.rip = offSeg;
1966 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1967 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1968 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1969 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1970 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1971 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1972 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1973 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1974 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1975 /** @todo check if the hidden bits are loaded correctly for 64-bit
1976 * mode. */
1977
1978 /* Flush the prefetch buffer. */
1979#ifdef IEM_WITH_CODE_TLB
1980 pVCpu->iem.s.pbInstrBuf = NULL;
1981#else
1982 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1983#endif
1984
1985 return VINF_SUCCESS;
1986}
1987
1988
1989/**
1990 * Implements far calls.
1991 *
1992 * This very similar to iemCImpl_FarJmp.
1993 *
1994 * @param uSel The selector.
1995 * @param offSeg The segment offset.
1996 * @param enmEffOpSize The operand size (in case we need it).
1997 */
1998IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1999{
2000 VBOXSTRICTRC rcStrict;
2001 uint64_t uNewRsp;
2002 RTPTRUNION uPtrRet;
2003
2004 /*
2005 * Real mode and V8086 mode are easy. The only snag seems to be that
2006 * CS.limit doesn't change and the limit check is done against the current
2007 * limit.
2008 */
2009 /** @todo See comment for similar code in iemCImpl_FarJmp */
2010 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2011 {
2012 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
2013
2014 /* Check stack first - may #SS(0). */
2015 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2016 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2017 &uPtrRet.pv, &uNewRsp);
2018 if (rcStrict != VINF_SUCCESS)
2019 return rcStrict;
2020
2021 /* Check the target address range. */
2022 if (offSeg > UINT32_MAX)
2023 return iemRaiseGeneralProtectionFault0(pVCpu);
2024
2025 /* Everything is fine, push the return address. */
2026 if (enmEffOpSize == IEMMODE_16BIT)
2027 {
2028 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2029 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2030 }
2031 else
2032 {
2033 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2034 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2035 }
2036 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2037 if (rcStrict != VINF_SUCCESS)
2038 return rcStrict;
2039
2040 /* Branch. */
2041 pVCpu->cpum.GstCtx.rip = offSeg;
2042 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2043 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2044 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2045 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2046 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2047 return VINF_SUCCESS;
2048 }
2049
2050 /*
2051 * Protected mode. Need to parse the specified descriptor...
2052 */
2053 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2054 {
2055 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2056 return iemRaiseGeneralProtectionFault0(pVCpu);
2057 }
2058
2059 /* Fetch the descriptor. */
2060 IEMSELDESC Desc;
2061 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2062 if (rcStrict != VINF_SUCCESS)
2063 return rcStrict;
2064
2065 /*
2066 * Deal with it according to its type. We do the standard code selectors
2067 * here and dispatch the system selectors to worker functions.
2068 */
2069 if (!Desc.Legacy.Gen.u1DescType)
2070 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2071
2072 /* Only code segments. */
2073 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2074 {
2075 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2076 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2077 }
2078
2079 /* L vs D. */
2080 if ( Desc.Legacy.Gen.u1Long
2081 && Desc.Legacy.Gen.u1DefBig
2082 && IEM_IS_LONG_MODE(pVCpu))
2083 {
2084 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2085 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2086 }
2087
2088 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2089 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2090 {
2091 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2092 {
2093 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2094 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2095 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2096 }
2097 }
2098 else
2099 {
2100 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2101 {
2102 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2103 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2104 }
2105 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2106 {
2107 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2108 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2109 }
2110 }
2111
2112 /* Is it there? */
2113 if (!Desc.Legacy.Gen.u1Present)
2114 {
2115 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2116 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2117 }
2118
2119 /* Check stack first - may #SS(0). */
2120 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2121 * 16-bit code cause a two or four byte CS to be pushed? */
2122 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2123 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2124 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2125 &uPtrRet.pv, &uNewRsp);
2126 if (rcStrict != VINF_SUCCESS)
2127 return rcStrict;
2128
2129 /* Chop the high bits if 16-bit (Intel says so). */
2130 if (enmEffOpSize == IEMMODE_16BIT)
2131 offSeg &= UINT16_MAX;
2132
2133 /* Limit / canonical check. */
2134 uint64_t u64Base;
2135 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2136 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2137 {
2138 if (!IEM_IS_CANONICAL(offSeg))
2139 {
2140 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2141 return iemRaiseNotCanonical(pVCpu);
2142 }
2143 u64Base = 0;
2144 }
2145 else
2146 {
2147 if (offSeg > cbLimit)
2148 {
2149 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2150 /** @todo Intel says this is \#GP(0)! */
2151 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2152 }
2153 u64Base = X86DESC_BASE(&Desc.Legacy);
2154 }
2155
2156 /*
2157 * Now set the accessed bit before
2158 * writing the return address to the stack and committing the result into
2159 * CS, CSHID and RIP.
2160 */
2161 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2162 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2163 {
2164 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2165 if (rcStrict != VINF_SUCCESS)
2166 return rcStrict;
2167 /** @todo check what VT-x and AMD-V does. */
2168 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2169 }
2170
2171 /* stack */
2172 if (enmEffOpSize == IEMMODE_16BIT)
2173 {
2174 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2175 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2176 }
2177 else if (enmEffOpSize == IEMMODE_32BIT)
2178 {
2179 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2180 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2181 }
2182 else
2183 {
2184 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2185 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2186 }
2187 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2188 if (rcStrict != VINF_SUCCESS)
2189 return rcStrict;
2190
2191 /* commit */
2192 pVCpu->cpum.GstCtx.rip = offSeg;
2193 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2194 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2195 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2196 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2197 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2198 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2199 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2200 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2201 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2202 /** @todo check if the hidden bits are loaded correctly for 64-bit
2203 * mode. */
2204
2205 /* Flush the prefetch buffer. */
2206#ifdef IEM_WITH_CODE_TLB
2207 pVCpu->iem.s.pbInstrBuf = NULL;
2208#else
2209 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2210#endif
2211 return VINF_SUCCESS;
2212}
2213
2214
2215/**
2216 * Implements retf.
2217 *
2218 * @param enmEffOpSize The effective operand size.
2219 * @param cbPop The amount of arguments to pop from the stack
2220 * (bytes).
2221 */
2222IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2223{
2224 VBOXSTRICTRC rcStrict;
2225 RTCPTRUNION uPtrFrame;
2226 uint64_t uNewRsp;
2227 uint64_t uNewRip;
2228 uint16_t uNewCs;
2229 NOREF(cbInstr);
2230
2231 /*
2232 * Read the stack values first.
2233 */
2234 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2235 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2236 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2237 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2238 &uPtrFrame.pv, &uNewRsp);
2239 if (rcStrict != VINF_SUCCESS)
2240 return rcStrict;
2241 if (enmEffOpSize == IEMMODE_16BIT)
2242 {
2243 uNewRip = uPtrFrame.pu16[0];
2244 uNewCs = uPtrFrame.pu16[1];
2245 }
2246 else if (enmEffOpSize == IEMMODE_32BIT)
2247 {
2248 uNewRip = uPtrFrame.pu32[0];
2249 uNewCs = uPtrFrame.pu16[2];
2250 }
2251 else
2252 {
2253 uNewRip = uPtrFrame.pu64[0];
2254 uNewCs = uPtrFrame.pu16[4];
2255 }
2256 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2257 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2258 { /* extremely likely */ }
2259 else
2260 return rcStrict;
2261
2262 /*
2263 * Real mode and V8086 mode are easy.
2264 */
2265 /** @todo See comment for similar code in iemCImpl_FarJmp */
2266 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2267 {
2268 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2269 /** @todo check how this is supposed to work if sp=0xfffe. */
2270
2271 /* Check the limit of the new EIP. */
2272 /** @todo Intel pseudo code only does the limit check for 16-bit
2273 * operands, AMD does not make any distinction. What is right? */
2274 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2275 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2276
2277 /* commit the operation. */
2278 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2279 pVCpu->cpum.GstCtx.rip = uNewRip;
2280 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2281 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2282 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2283 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2284 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2285 if (cbPop)
2286 iemRegAddToRsp(pVCpu, cbPop);
2287 return VINF_SUCCESS;
2288 }
2289
2290 /*
2291 * Protected mode is complicated, of course.
2292 */
2293 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2294 {
2295 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2296 return iemRaiseGeneralProtectionFault0(pVCpu);
2297 }
2298
2299 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2300
2301 /* Fetch the descriptor. */
2302 IEMSELDESC DescCs;
2303 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2304 if (rcStrict != VINF_SUCCESS)
2305 return rcStrict;
2306
2307 /* Can only return to a code selector. */
2308 if ( !DescCs.Legacy.Gen.u1DescType
2309 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2310 {
2311 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2312 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2313 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2314 }
2315
2316 /* L vs D. */
2317 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2318 && DescCs.Legacy.Gen.u1DefBig
2319 && IEM_IS_LONG_MODE(pVCpu))
2320 {
2321 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2322 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2323 }
2324
2325 /* DPL/RPL/CPL checks. */
2326 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2327 {
2328 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2329 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2330 }
2331
2332 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2333 {
2334 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2335 {
2336 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2337 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2338 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2339 }
2340 }
2341 else
2342 {
2343 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2344 {
2345 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2346 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2347 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2348 }
2349 }
2350
2351 /* Is it there? */
2352 if (!DescCs.Legacy.Gen.u1Present)
2353 {
2354 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2355 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2356 }
2357
2358 /*
2359 * Return to outer privilege? (We'll typically have entered via a call gate.)
2360 */
2361 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2362 {
2363 /* Read the outer stack pointer stored *after* the parameters. */
2364 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, uNewRsp);
2365 if (rcStrict != VINF_SUCCESS)
2366 return rcStrict;
2367
2368 uint16_t uNewOuterSs;
2369 uint64_t uNewOuterRsp;
2370 if (enmEffOpSize == IEMMODE_16BIT)
2371 {
2372 uNewOuterRsp = uPtrFrame.pu16[0];
2373 uNewOuterSs = uPtrFrame.pu16[1];
2374 }
2375 else if (enmEffOpSize == IEMMODE_32BIT)
2376 {
2377 uNewOuterRsp = uPtrFrame.pu32[0];
2378 uNewOuterSs = uPtrFrame.pu16[2];
2379 }
2380 else
2381 {
2382 uNewOuterRsp = uPtrFrame.pu64[0];
2383 uNewOuterSs = uPtrFrame.pu16[4];
2384 }
2385 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2386 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2387 { /* extremely likely */ }
2388 else
2389 return rcStrict;
2390
2391 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2392 and read the selector. */
2393 IEMSELDESC DescSs;
2394 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2395 {
2396 if ( !DescCs.Legacy.Gen.u1Long
2397 || (uNewOuterSs & X86_SEL_RPL) == 3)
2398 {
2399 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2400 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2401 return iemRaiseGeneralProtectionFault0(pVCpu);
2402 }
2403 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2404 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2405 }
2406 else
2407 {
2408 /* Fetch the descriptor for the new stack segment. */
2409 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2410 if (rcStrict != VINF_SUCCESS)
2411 return rcStrict;
2412 }
2413
2414 /* Check that RPL of stack and code selectors match. */
2415 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2416 {
2417 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2418 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2419 }
2420
2421 /* Must be a writable data segment. */
2422 if ( !DescSs.Legacy.Gen.u1DescType
2423 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2424 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2425 {
2426 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2427 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2428 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2429 }
2430
2431 /* L vs D. (Not mentioned by intel.) */
2432 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2433 && DescSs.Legacy.Gen.u1DefBig
2434 && IEM_IS_LONG_MODE(pVCpu))
2435 {
2436 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2437 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2438 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2439 }
2440
2441 /* DPL/RPL/CPL checks. */
2442 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2443 {
2444 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2445 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2446 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2447 }
2448
2449 /* Is it there? */
2450 if (!DescSs.Legacy.Gen.u1Present)
2451 {
2452 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2453 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2454 }
2455
2456 /* Calc SS limit.*/
2457 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2458
2459 /* Is RIP canonical or within CS.limit? */
2460 uint64_t u64Base;
2461 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2462
2463 /** @todo Testcase: Is this correct? */
2464 if ( DescCs.Legacy.Gen.u1Long
2465 && IEM_IS_LONG_MODE(pVCpu) )
2466 {
2467 if (!IEM_IS_CANONICAL(uNewRip))
2468 {
2469 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2470 return iemRaiseNotCanonical(pVCpu);
2471 }
2472 u64Base = 0;
2473 }
2474 else
2475 {
2476 if (uNewRip > cbLimitCs)
2477 {
2478 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2479 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2480 /** @todo Intel says this is \#GP(0)! */
2481 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2482 }
2483 u64Base = X86DESC_BASE(&DescCs.Legacy);
2484 }
2485
2486 /*
2487 * Now set the accessed bit before
2488 * writing the return address to the stack and committing the result into
2489 * CS, CSHID and RIP.
2490 */
2491 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2492 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2493 {
2494 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2495 if (rcStrict != VINF_SUCCESS)
2496 return rcStrict;
2497 /** @todo check what VT-x and AMD-V does. */
2498 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2499 }
2500 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2501 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2502 {
2503 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2504 if (rcStrict != VINF_SUCCESS)
2505 return rcStrict;
2506 /** @todo check what VT-x and AMD-V does. */
2507 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2508 }
2509
2510 /* commit */
2511 if (enmEffOpSize == IEMMODE_16BIT)
2512 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2513 else
2514 pVCpu->cpum.GstCtx.rip = uNewRip;
2515 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2516 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2517 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2518 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2519 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2520 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2521 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2522 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2523 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2524 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2525 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2526 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2527 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2528 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2529 else
2530 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2531 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2532 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewOuterRsp;
2533 else
2534 pVCpu->cpum.GstCtx.rsp = uNewOuterRsp;
2535
2536 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2537 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2538 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2539 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2540 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2541
2542 /** @todo check if the hidden bits are loaded correctly for 64-bit
2543 * mode. */
2544
2545 if (cbPop)
2546 iemRegAddToRsp(pVCpu, cbPop);
2547 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2548
2549 /* Done! */
2550 }
2551 /*
2552 * Return to the same privilege level
2553 */
2554 else
2555 {
2556 /* Limit / canonical check. */
2557 uint64_t u64Base;
2558 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2559
2560 /** @todo Testcase: Is this correct? */
2561 if ( DescCs.Legacy.Gen.u1Long
2562 && IEM_IS_LONG_MODE(pVCpu) )
2563 {
2564 if (!IEM_IS_CANONICAL(uNewRip))
2565 {
2566 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2567 return iemRaiseNotCanonical(pVCpu);
2568 }
2569 u64Base = 0;
2570 }
2571 else
2572 {
2573 if (uNewRip > cbLimitCs)
2574 {
2575 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2576 /** @todo Intel says this is \#GP(0)! */
2577 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2578 }
2579 u64Base = X86DESC_BASE(&DescCs.Legacy);
2580 }
2581
2582 /*
2583 * Now set the accessed bit before
2584 * writing the return address to the stack and committing the result into
2585 * CS, CSHID and RIP.
2586 */
2587 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2588 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2589 {
2590 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2591 if (rcStrict != VINF_SUCCESS)
2592 return rcStrict;
2593 /** @todo check what VT-x and AMD-V does. */
2594 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2595 }
2596
2597 /* commit */
2598 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2599 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
2600 else
2601 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2602 if (enmEffOpSize == IEMMODE_16BIT)
2603 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2604 else
2605 pVCpu->cpum.GstCtx.rip = uNewRip;
2606 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2607 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2608 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2609 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2610 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2611 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2612 /** @todo check if the hidden bits are loaded correctly for 64-bit
2613 * mode. */
2614 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2615 if (cbPop)
2616 iemRegAddToRsp(pVCpu, cbPop);
2617 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2618 }
2619
2620 /* Flush the prefetch buffer. */
2621#ifdef IEM_WITH_CODE_TLB
2622 pVCpu->iem.s.pbInstrBuf = NULL;
2623#else
2624 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2625#endif
2626 return VINF_SUCCESS;
2627}
2628
2629
2630/**
2631 * Implements retn.
2632 *
2633 * We're doing this in C because of the \#GP that might be raised if the popped
2634 * program counter is out of bounds.
2635 *
2636 * @param enmEffOpSize The effective operand size.
2637 * @param cbPop The amount of arguments to pop from the stack
2638 * (bytes).
2639 */
2640IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2641{
2642 NOREF(cbInstr);
2643
2644 /* Fetch the RSP from the stack. */
2645 VBOXSTRICTRC rcStrict;
2646 RTUINT64U NewRip;
2647 RTUINT64U NewRsp;
2648 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2649
2650 switch (enmEffOpSize)
2651 {
2652 case IEMMODE_16BIT:
2653 NewRip.u = 0;
2654 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2655 break;
2656 case IEMMODE_32BIT:
2657 NewRip.u = 0;
2658 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2659 break;
2660 case IEMMODE_64BIT:
2661 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2662 break;
2663 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2664 }
2665 if (rcStrict != VINF_SUCCESS)
2666 return rcStrict;
2667
2668 /* Check the new RSP before loading it. */
2669 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2670 * of it. The canonical test is performed here and for call. */
2671 if (enmEffOpSize != IEMMODE_64BIT)
2672 {
2673 if (NewRip.DWords.dw0 > pVCpu->cpum.GstCtx.cs.u32Limit)
2674 {
2675 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2676 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2677 }
2678 }
2679 else
2680 {
2681 if (!IEM_IS_CANONICAL(NewRip.u))
2682 {
2683 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2684 return iemRaiseNotCanonical(pVCpu);
2685 }
2686 }
2687
2688 /* Apply cbPop */
2689 if (cbPop)
2690 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2691
2692 /* Commit it. */
2693 pVCpu->cpum.GstCtx.rip = NewRip.u;
2694 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2695 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2696
2697 /* Flush the prefetch buffer. */
2698#ifndef IEM_WITH_CODE_TLB
2699 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2700#endif
2701
2702 return VINF_SUCCESS;
2703}
2704
2705
2706/**
2707 * Implements enter.
2708 *
2709 * We're doing this in C because the instruction is insane, even for the
2710 * u8NestingLevel=0 case dealing with the stack is tedious.
2711 *
2712 * @param enmEffOpSize The effective operand size.
2713 * @param cbFrame Frame size.
2714 * @param cParameters Frame parameter count.
2715 */
2716IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2717{
2718 /* Push RBP, saving the old value in TmpRbp. */
2719 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2720 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2721 RTUINT64U NewRbp;
2722 VBOXSTRICTRC rcStrict;
2723 if (enmEffOpSize == IEMMODE_64BIT)
2724 {
2725 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2726 NewRbp = NewRsp;
2727 }
2728 else if (enmEffOpSize == IEMMODE_32BIT)
2729 {
2730 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2731 NewRbp = NewRsp;
2732 }
2733 else
2734 {
2735 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2736 NewRbp = TmpRbp;
2737 NewRbp.Words.w0 = NewRsp.Words.w0;
2738 }
2739 if (rcStrict != VINF_SUCCESS)
2740 return rcStrict;
2741
2742 /* Copy the parameters (aka nesting levels by Intel). */
2743 cParameters &= 0x1f;
2744 if (cParameters > 0)
2745 {
2746 switch (enmEffOpSize)
2747 {
2748 case IEMMODE_16BIT:
2749 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2750 TmpRbp.DWords.dw0 -= 2;
2751 else
2752 TmpRbp.Words.w0 -= 2;
2753 do
2754 {
2755 uint16_t u16Tmp;
2756 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2757 if (rcStrict != VINF_SUCCESS)
2758 break;
2759 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2760 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2761 break;
2762
2763 case IEMMODE_32BIT:
2764 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2765 TmpRbp.DWords.dw0 -= 4;
2766 else
2767 TmpRbp.Words.w0 -= 4;
2768 do
2769 {
2770 uint32_t u32Tmp;
2771 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2772 if (rcStrict != VINF_SUCCESS)
2773 break;
2774 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2775 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2776 break;
2777
2778 case IEMMODE_64BIT:
2779 TmpRbp.u -= 8;
2780 do
2781 {
2782 uint64_t u64Tmp;
2783 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2784 if (rcStrict != VINF_SUCCESS)
2785 break;
2786 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2787 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2788 break;
2789
2790 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2791 }
2792 if (rcStrict != VINF_SUCCESS)
2793 return VINF_SUCCESS;
2794
2795 /* Push the new RBP */
2796 if (enmEffOpSize == IEMMODE_64BIT)
2797 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2798 else if (enmEffOpSize == IEMMODE_32BIT)
2799 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2800 else
2801 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2802 if (rcStrict != VINF_SUCCESS)
2803 return rcStrict;
2804
2805 }
2806
2807 /* Recalc RSP. */
2808 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2809
2810 /** @todo Should probe write access at the new RSP according to AMD. */
2811 /** @todo Should handle accesses to the VMX APIC-access page. */
2812
2813 /* Commit it. */
2814 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2815 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2816 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2817}
2818
2819
2820
2821/**
2822 * Implements leave.
2823 *
2824 * We're doing this in C because messing with the stack registers is annoying
2825 * since they depends on SS attributes.
2826 *
2827 * @param enmEffOpSize The effective operand size.
2828 */
2829IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2830{
2831 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2832 RTUINT64U NewRsp;
2833 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2834 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2835 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2836 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2837 else
2838 {
2839 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2840 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2841 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2842 }
2843
2844 /* Pop RBP according to the operand size. */
2845 VBOXSTRICTRC rcStrict;
2846 RTUINT64U NewRbp;
2847 switch (enmEffOpSize)
2848 {
2849 case IEMMODE_16BIT:
2850 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2851 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2852 break;
2853 case IEMMODE_32BIT:
2854 NewRbp.u = 0;
2855 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2856 break;
2857 case IEMMODE_64BIT:
2858 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2859 break;
2860 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2861 }
2862 if (rcStrict != VINF_SUCCESS)
2863 return rcStrict;
2864
2865
2866 /* Commit it. */
2867 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2868 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2869 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2870}
2871
2872
2873/**
2874 * Implements int3 and int XX.
2875 *
2876 * @param u8Int The interrupt vector number.
2877 * @param enmInt The int instruction type.
2878 */
2879IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2880{
2881 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2882
2883 /*
2884 * We must check if this INT3 might belong to DBGF before raising a #BP.
2885 */
2886 if (u8Int == 3)
2887 {
2888 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2889 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2890 { /* likely: No vbox debugger breakpoints */ }
2891 else
2892 {
2893 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
2894 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2895 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2896 return iemSetPassUpStatus(pVCpu, rcStrict);
2897 }
2898 }
2899 return iemRaiseXcptOrInt(pVCpu,
2900 cbInstr,
2901 u8Int,
2902 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2903 0,
2904 0);
2905}
2906
2907
2908/**
2909 * Implements iret for real mode and V8086 mode.
2910 *
2911 * @param enmEffOpSize The effective operand size.
2912 */
2913IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2914{
2915 X86EFLAGS Efl;
2916 Efl.u = IEMMISC_GET_EFL(pVCpu);
2917 NOREF(cbInstr);
2918
2919 /*
2920 * iret throws an exception if VME isn't enabled.
2921 */
2922 if ( Efl.Bits.u1VM
2923 && Efl.Bits.u2IOPL != 3
2924 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2925 return iemRaiseGeneralProtectionFault0(pVCpu);
2926
2927 /*
2928 * Do the stack bits, but don't commit RSP before everything checks
2929 * out right.
2930 */
2931 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2932 VBOXSTRICTRC rcStrict;
2933 RTCPTRUNION uFrame;
2934 uint16_t uNewCs;
2935 uint32_t uNewEip;
2936 uint32_t uNewFlags;
2937 uint64_t uNewRsp;
2938 if (enmEffOpSize == IEMMODE_32BIT)
2939 {
2940 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
2941 if (rcStrict != VINF_SUCCESS)
2942 return rcStrict;
2943 uNewEip = uFrame.pu32[0];
2944 if (uNewEip > UINT16_MAX)
2945 return iemRaiseGeneralProtectionFault0(pVCpu);
2946
2947 uNewCs = (uint16_t)uFrame.pu32[1];
2948 uNewFlags = uFrame.pu32[2];
2949 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2950 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2951 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2952 | X86_EFL_ID;
2953 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2954 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2955 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2956 }
2957 else
2958 {
2959 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
2960 if (rcStrict != VINF_SUCCESS)
2961 return rcStrict;
2962 uNewEip = uFrame.pu16[0];
2963 uNewCs = uFrame.pu16[1];
2964 uNewFlags = uFrame.pu16[2];
2965 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2966 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2967 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2968 /** @todo The intel pseudo code does not indicate what happens to
2969 * reserved flags. We just ignore them. */
2970 /* Ancient CPU adjustments: See iemCImpl_popf. */
2971 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2972 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2973 }
2974 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2975 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2976 { /* extremely likely */ }
2977 else
2978 return rcStrict;
2979
2980 /** @todo Check how this is supposed to work if sp=0xfffe. */
2981 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2982 uNewCs, uNewEip, uNewFlags, uNewRsp));
2983
2984 /*
2985 * Check the limit of the new EIP.
2986 */
2987 /** @todo Only the AMD pseudo code check the limit here, what's
2988 * right? */
2989 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2990 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2991
2992 /*
2993 * V8086 checks and flag adjustments
2994 */
2995 if (Efl.Bits.u1VM)
2996 {
2997 if (Efl.Bits.u2IOPL == 3)
2998 {
2999 /* Preserve IOPL and clear RF. */
3000 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
3001 uNewFlags |= Efl.u & (X86_EFL_IOPL);
3002 }
3003 else if ( enmEffOpSize == IEMMODE_16BIT
3004 && ( !(uNewFlags & X86_EFL_IF)
3005 || !Efl.Bits.u1VIP )
3006 && !(uNewFlags & X86_EFL_TF) )
3007 {
3008 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
3009 uNewFlags &= ~X86_EFL_VIF;
3010 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
3011 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
3012 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
3013 }
3014 else
3015 return iemRaiseGeneralProtectionFault0(pVCpu);
3016 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
3017 }
3018
3019 /*
3020 * Commit the operation.
3021 */
3022#ifdef DBGFTRACE_ENABLED
3023 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3024 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3025#endif
3026 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3027 pVCpu->cpum.GstCtx.rip = uNewEip;
3028 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3029 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3030 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3031 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
3032 /** @todo do we load attribs and limit as well? */
3033 Assert(uNewFlags & X86_EFL_1);
3034 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3035
3036 /* Flush the prefetch buffer. */
3037#ifdef IEM_WITH_CODE_TLB
3038 pVCpu->iem.s.pbInstrBuf = NULL;
3039#else
3040 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3041#endif
3042
3043 return VINF_SUCCESS;
3044}
3045
3046
3047/**
3048 * Loads a segment register when entering V8086 mode.
3049 *
3050 * @param pSReg The segment register.
3051 * @param uSeg The segment to load.
3052 */
3053static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3054{
3055 pSReg->Sel = uSeg;
3056 pSReg->ValidSel = uSeg;
3057 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3058 pSReg->u64Base = (uint32_t)uSeg << 4;
3059 pSReg->u32Limit = 0xffff;
3060 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3061 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3062 * IRET'ing to V8086. */
3063}
3064
3065
3066/**
3067 * Implements iret for protected mode returning to V8086 mode.
3068 *
3069 * @param uNewEip The new EIP.
3070 * @param uNewCs The new CS.
3071 * @param uNewFlags The new EFLAGS.
3072 * @param uNewRsp The RSP after the initial IRET frame.
3073 *
3074 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3075 */
3076IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3077{
3078 RT_NOREF_PV(cbInstr);
3079 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3080
3081 /*
3082 * Pop the V8086 specific frame bits off the stack.
3083 */
3084 VBOXSTRICTRC rcStrict;
3085 RTCPTRUNION uFrame;
3086 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, uNewRsp);
3087 if (rcStrict != VINF_SUCCESS)
3088 return rcStrict;
3089 uint32_t uNewEsp = uFrame.pu32[0];
3090 uint16_t uNewSs = uFrame.pu32[1];
3091 uint16_t uNewEs = uFrame.pu32[2];
3092 uint16_t uNewDs = uFrame.pu32[3];
3093 uint16_t uNewFs = uFrame.pu32[4];
3094 uint16_t uNewGs = uFrame.pu32[5];
3095 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3096 if (rcStrict != VINF_SUCCESS)
3097 return rcStrict;
3098
3099 /*
3100 * Commit the operation.
3101 */
3102 uNewFlags &= X86_EFL_LIVE_MASK;
3103 uNewFlags |= X86_EFL_RA1_MASK;
3104#ifdef DBGFTRACE_ENABLED
3105 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3106 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3107#endif
3108 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3109
3110 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3111 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3112 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3113 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3114 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3115 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3116 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3117 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3118 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3119 pVCpu->iem.s.uCpl = 3;
3120
3121 /* Flush the prefetch buffer. */
3122#ifdef IEM_WITH_CODE_TLB
3123 pVCpu->iem.s.pbInstrBuf = NULL;
3124#else
3125 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3126#endif
3127
3128 return VINF_SUCCESS;
3129}
3130
3131
3132/**
3133 * Implements iret for protected mode returning via a nested task.
3134 *
3135 * @param enmEffOpSize The effective operand size.
3136 */
3137IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3138{
3139 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3140#ifndef IEM_IMPLEMENTS_TASKSWITCH
3141 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3142#else
3143 RT_NOREF_PV(enmEffOpSize);
3144
3145 /*
3146 * Read the segment selector in the link-field of the current TSS.
3147 */
3148 RTSEL uSelRet;
3149 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3150 if (rcStrict != VINF_SUCCESS)
3151 return rcStrict;
3152
3153 /*
3154 * Fetch the returning task's TSS descriptor from the GDT.
3155 */
3156 if (uSelRet & X86_SEL_LDT)
3157 {
3158 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3159 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3160 }
3161
3162 IEMSELDESC TssDesc;
3163 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3164 if (rcStrict != VINF_SUCCESS)
3165 return rcStrict;
3166
3167 if (TssDesc.Legacy.Gate.u1DescType)
3168 {
3169 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3170 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3171 }
3172
3173 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3174 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3175 {
3176 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3177 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3178 }
3179
3180 if (!TssDesc.Legacy.Gate.u1Present)
3181 {
3182 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3183 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3184 }
3185
3186 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3187 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3188 0 /* uCr2 */, uSelRet, &TssDesc);
3189#endif
3190}
3191
3192
3193/**
3194 * Implements iret for protected mode
3195 *
3196 * @param enmEffOpSize The effective operand size.
3197 */
3198IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3199{
3200 NOREF(cbInstr);
3201 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3202
3203 /*
3204 * Nested task return.
3205 */
3206 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3207 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3208
3209 /*
3210 * Normal return.
3211 *
3212 * Do the stack bits, but don't commit RSP before everything checks
3213 * out right.
3214 */
3215 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3216 VBOXSTRICTRC rcStrict;
3217 RTCPTRUNION uFrame;
3218 uint16_t uNewCs;
3219 uint32_t uNewEip;
3220 uint32_t uNewFlags;
3221 uint64_t uNewRsp;
3222 if (enmEffOpSize == IEMMODE_32BIT)
3223 {
3224 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
3225 if (rcStrict != VINF_SUCCESS)
3226 return rcStrict;
3227 uNewEip = uFrame.pu32[0];
3228 uNewCs = (uint16_t)uFrame.pu32[1];
3229 uNewFlags = uFrame.pu32[2];
3230 }
3231 else
3232 {
3233 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
3234 if (rcStrict != VINF_SUCCESS)
3235 return rcStrict;
3236 uNewEip = uFrame.pu16[0];
3237 uNewCs = uFrame.pu16[1];
3238 uNewFlags = uFrame.pu16[2];
3239 }
3240 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3241 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3242 { /* extremely likely */ }
3243 else
3244 return rcStrict;
3245 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3246
3247 /*
3248 * We're hopefully not returning to V8086 mode...
3249 */
3250 if ( (uNewFlags & X86_EFL_VM)
3251 && pVCpu->iem.s.uCpl == 0)
3252 {
3253 Assert(enmEffOpSize == IEMMODE_32BIT);
3254 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3255 }
3256
3257 /*
3258 * Protected mode.
3259 */
3260 /* Read the CS descriptor. */
3261 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3262 {
3263 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3264 return iemRaiseGeneralProtectionFault0(pVCpu);
3265 }
3266
3267 IEMSELDESC DescCS;
3268 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3269 if (rcStrict != VINF_SUCCESS)
3270 {
3271 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3272 return rcStrict;
3273 }
3274
3275 /* Must be a code descriptor. */
3276 if (!DescCS.Legacy.Gen.u1DescType)
3277 {
3278 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3279 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3280 }
3281 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3282 {
3283 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3284 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3285 }
3286
3287 /* Privilege checks. */
3288 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3289 {
3290 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3291 {
3292 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3293 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3294 }
3295 }
3296 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3297 {
3298 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3299 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3300 }
3301 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3302 {
3303 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3304 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3305 }
3306
3307 /* Present? */
3308 if (!DescCS.Legacy.Gen.u1Present)
3309 {
3310 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3311 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3312 }
3313
3314 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3315
3316 /*
3317 * Return to outer level?
3318 */
3319 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3320 {
3321 uint16_t uNewSS;
3322 uint32_t uNewESP;
3323 if (enmEffOpSize == IEMMODE_32BIT)
3324 {
3325 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, uNewRsp);
3326 if (rcStrict != VINF_SUCCESS)
3327 return rcStrict;
3328/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3329 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3330 * bit of the popped SS selector it turns out. */
3331 uNewESP = uFrame.pu32[0];
3332 uNewSS = (uint16_t)uFrame.pu32[1];
3333 }
3334 else
3335 {
3336 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, uNewRsp);
3337 if (rcStrict != VINF_SUCCESS)
3338 return rcStrict;
3339 uNewESP = uFrame.pu16[0];
3340 uNewSS = uFrame.pu16[1];
3341 }
3342 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3343 if (rcStrict != VINF_SUCCESS)
3344 return rcStrict;
3345 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3346
3347 /* Read the SS descriptor. */
3348 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3349 {
3350 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3351 return iemRaiseGeneralProtectionFault0(pVCpu);
3352 }
3353
3354 IEMSELDESC DescSS;
3355 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3356 if (rcStrict != VINF_SUCCESS)
3357 {
3358 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3359 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3360 return rcStrict;
3361 }
3362
3363 /* Privilege checks. */
3364 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3365 {
3366 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3367 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3368 }
3369 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3370 {
3371 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3372 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3373 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3374 }
3375
3376 /* Must be a writeable data segment descriptor. */
3377 if (!DescSS.Legacy.Gen.u1DescType)
3378 {
3379 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3380 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3381 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3382 }
3383 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3384 {
3385 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3386 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3387 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3388 }
3389
3390 /* Present? */
3391 if (!DescSS.Legacy.Gen.u1Present)
3392 {
3393 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3394 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3395 }
3396
3397 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3398
3399 /* Check EIP. */
3400 if (uNewEip > cbLimitCS)
3401 {
3402 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3403 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3404 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3405 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3406 }
3407
3408 /*
3409 * Commit the changes, marking CS and SS accessed first since
3410 * that may fail.
3411 */
3412 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3413 {
3414 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3415 if (rcStrict != VINF_SUCCESS)
3416 return rcStrict;
3417 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3418 }
3419 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3420 {
3421 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3422 if (rcStrict != VINF_SUCCESS)
3423 return rcStrict;
3424 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3425 }
3426
3427 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3428 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3429 if (enmEffOpSize != IEMMODE_16BIT)
3430 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3431 if (pVCpu->iem.s.uCpl == 0)
3432 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3433 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3434 fEFlagsMask |= X86_EFL_IF;
3435 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3436 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3437 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3438 fEFlagsNew &= ~fEFlagsMask;
3439 fEFlagsNew |= uNewFlags & fEFlagsMask;
3440#ifdef DBGFTRACE_ENABLED
3441 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3442 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3443 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3444#endif
3445
3446 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3447 pVCpu->cpum.GstCtx.rip = uNewEip;
3448 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3449 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3450 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3451 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3452 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3453 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3454 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3455
3456 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3457 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3458 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3459 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3460 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3461 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3462 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3463 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3464 else
3465 pVCpu->cpum.GstCtx.rsp = uNewESP;
3466
3467 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3468 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3469 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3470 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3471 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3472
3473 /* Done! */
3474
3475 }
3476 /*
3477 * Return to the same level.
3478 */
3479 else
3480 {
3481 /* Check EIP. */
3482 if (uNewEip > cbLimitCS)
3483 {
3484 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3485 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3486 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3487 }
3488
3489 /*
3490 * Commit the changes, marking CS first since it may fail.
3491 */
3492 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3493 {
3494 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3495 if (rcStrict != VINF_SUCCESS)
3496 return rcStrict;
3497 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3498 }
3499
3500 X86EFLAGS NewEfl;
3501 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3502 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3503 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3504 if (enmEffOpSize != IEMMODE_16BIT)
3505 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3506 if (pVCpu->iem.s.uCpl == 0)
3507 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3508 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3509 fEFlagsMask |= X86_EFL_IF;
3510 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3511 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3512 NewEfl.u &= ~fEFlagsMask;
3513 NewEfl.u |= fEFlagsMask & uNewFlags;
3514#ifdef DBGFTRACE_ENABLED
3515 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3516 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3517 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3518#endif
3519
3520 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3521 pVCpu->cpum.GstCtx.rip = uNewEip;
3522 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3523 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3524 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3525 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3526 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3527 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3528 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3529 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3530 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3531 else
3532 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3533 /* Done! */
3534 }
3535
3536 /* Flush the prefetch buffer. */
3537#ifdef IEM_WITH_CODE_TLB
3538 pVCpu->iem.s.pbInstrBuf = NULL;
3539#else
3540 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3541#endif
3542
3543 return VINF_SUCCESS;
3544}
3545
3546
3547/**
3548 * Implements iret for long mode
3549 *
3550 * @param enmEffOpSize The effective operand size.
3551 */
3552IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3553{
3554 NOREF(cbInstr);
3555
3556 /*
3557 * Nested task return is not supported in long mode.
3558 */
3559 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3560 {
3561 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3562 return iemRaiseGeneralProtectionFault0(pVCpu);
3563 }
3564
3565 /*
3566 * Normal return.
3567 *
3568 * Do the stack bits, but don't commit RSP before everything checks
3569 * out right.
3570 */
3571 VBOXSTRICTRC rcStrict;
3572 RTCPTRUNION uFrame;
3573 uint64_t uNewRip;
3574 uint16_t uNewCs;
3575 uint16_t uNewSs;
3576 uint32_t uNewFlags;
3577 uint64_t uNewRsp;
3578 if (enmEffOpSize == IEMMODE_64BIT)
3579 {
3580 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
3581 if (rcStrict != VINF_SUCCESS)
3582 return rcStrict;
3583 uNewRip = uFrame.pu64[0];
3584 uNewCs = (uint16_t)uFrame.pu64[1];
3585 uNewFlags = (uint32_t)uFrame.pu64[2];
3586 uNewRsp = uFrame.pu64[3];
3587 uNewSs = (uint16_t)uFrame.pu64[4];
3588 }
3589 else if (enmEffOpSize == IEMMODE_32BIT)
3590 {
3591 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
3592 if (rcStrict != VINF_SUCCESS)
3593 return rcStrict;
3594 uNewRip = uFrame.pu32[0];
3595 uNewCs = (uint16_t)uFrame.pu32[1];
3596 uNewFlags = uFrame.pu32[2];
3597 uNewRsp = uFrame.pu32[3];
3598 uNewSs = (uint16_t)uFrame.pu32[4];
3599 }
3600 else
3601 {
3602 Assert(enmEffOpSize == IEMMODE_16BIT);
3603 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
3604 if (rcStrict != VINF_SUCCESS)
3605 return rcStrict;
3606 uNewRip = uFrame.pu16[0];
3607 uNewCs = uFrame.pu16[1];
3608 uNewFlags = uFrame.pu16[2];
3609 uNewRsp = uFrame.pu16[3];
3610 uNewSs = uFrame.pu16[4];
3611 }
3612 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3613 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3614 { /* extremely like */ }
3615 else
3616 return rcStrict;
3617 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3618
3619 /*
3620 * Check stuff.
3621 */
3622 /* Read the CS descriptor. */
3623 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3624 {
3625 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3626 return iemRaiseGeneralProtectionFault0(pVCpu);
3627 }
3628
3629 IEMSELDESC DescCS;
3630 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3631 if (rcStrict != VINF_SUCCESS)
3632 {
3633 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3634 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3635 return rcStrict;
3636 }
3637
3638 /* Must be a code descriptor. */
3639 if ( !DescCS.Legacy.Gen.u1DescType
3640 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3641 {
3642 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3643 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3644 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3645 }
3646
3647 /* Privilege checks. */
3648 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3649 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3650 {
3651 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3652 {
3653 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3654 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3655 }
3656 }
3657 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3658 {
3659 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3660 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3661 }
3662 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3663 {
3664 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3665 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3666 }
3667
3668 /* Present? */
3669 if (!DescCS.Legacy.Gen.u1Present)
3670 {
3671 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3672 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3673 }
3674
3675 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3676
3677 /* Read the SS descriptor. */
3678 IEMSELDESC DescSS;
3679 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3680 {
3681 if ( !DescCS.Legacy.Gen.u1Long
3682 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3683 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3684 {
3685 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3686 return iemRaiseGeneralProtectionFault0(pVCpu);
3687 }
3688 /* Make sure SS is sensible, marked as accessed etc. */
3689 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3690 }
3691 else
3692 {
3693 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3694 if (rcStrict != VINF_SUCCESS)
3695 {
3696 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3697 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3698 return rcStrict;
3699 }
3700 }
3701
3702 /* Privilege checks. */
3703 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3704 {
3705 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3706 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3707 }
3708
3709 uint32_t cbLimitSs;
3710 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3711 cbLimitSs = UINT32_MAX;
3712 else
3713 {
3714 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3715 {
3716 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3717 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3718 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3719 }
3720
3721 /* Must be a writeable data segment descriptor. */
3722 if (!DescSS.Legacy.Gen.u1DescType)
3723 {
3724 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3725 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3726 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3727 }
3728 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3729 {
3730 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3731 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3732 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3733 }
3734
3735 /* Present? */
3736 if (!DescSS.Legacy.Gen.u1Present)
3737 {
3738 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3739 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3740 }
3741 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3742 }
3743
3744 /* Check EIP. */
3745 if (DescCS.Legacy.Gen.u1Long)
3746 {
3747 if (!IEM_IS_CANONICAL(uNewRip))
3748 {
3749 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3750 uNewCs, uNewRip, uNewSs, uNewRsp));
3751 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3752 }
3753 }
3754 else
3755 {
3756 if (uNewRip > cbLimitCS)
3757 {
3758 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3759 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3760 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3761 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3762 }
3763 }
3764
3765 /*
3766 * Commit the changes, marking CS and SS accessed first since
3767 * that may fail.
3768 */
3769 /** @todo where exactly are these actually marked accessed by a real CPU? */
3770 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3771 {
3772 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3773 if (rcStrict != VINF_SUCCESS)
3774 return rcStrict;
3775 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3776 }
3777 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3778 {
3779 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3780 if (rcStrict != VINF_SUCCESS)
3781 return rcStrict;
3782 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3783 }
3784
3785 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3786 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3787 if (enmEffOpSize != IEMMODE_16BIT)
3788 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3789 if (pVCpu->iem.s.uCpl == 0)
3790 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3791 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3792 fEFlagsMask |= X86_EFL_IF;
3793 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3794 fEFlagsNew &= ~fEFlagsMask;
3795 fEFlagsNew |= uNewFlags & fEFlagsMask;
3796#ifdef DBGFTRACE_ENABLED
3797 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3798 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3799#endif
3800
3801 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3802 pVCpu->cpum.GstCtx.rip = uNewRip;
3803 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3804 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3805 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3806 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3807 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3808 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3809 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3810 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3811 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3812 else
3813 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3814 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3815 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3816 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3817 {
3818 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3819 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3820 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3821 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3822 Log2(("iretq new SS: NULL\n"));
3823 }
3824 else
3825 {
3826 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3827 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3828 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3829 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3830 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3831 }
3832
3833 if (pVCpu->iem.s.uCpl != uNewCpl)
3834 {
3835 pVCpu->iem.s.uCpl = uNewCpl;
3836 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3837 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3838 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3839 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3840 }
3841
3842 /* Flush the prefetch buffer. */
3843#ifdef IEM_WITH_CODE_TLB
3844 pVCpu->iem.s.pbInstrBuf = NULL;
3845#else
3846 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3847#endif
3848
3849 return VINF_SUCCESS;
3850}
3851
3852
3853/**
3854 * Implements iret.
3855 *
3856 * @param enmEffOpSize The effective operand size.
3857 */
3858IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3859{
3860 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
3861
3862#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3863 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3864 {
3865 /*
3866 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3867 * of this IRET instruction. We need to provide this information as part of some
3868 * VM-exits.
3869 *
3870 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3871 */
3872 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3873 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3874 else
3875 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3876
3877 /*
3878 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3879 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3880 */
3881 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3882 fBlockingNmi = false;
3883
3884 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3885 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3886 }
3887#endif
3888
3889 /*
3890 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3891 * The NMI is still held pending (which I assume means blocking of further NMIs
3892 * is in effect).
3893 *
3894 * See AMD spec. 15.9 "Instruction Intercepts".
3895 * See AMD spec. 15.21.9 "NMI Support".
3896 */
3897 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3898 {
3899 Log(("iret: Guest intercept -> #VMEXIT\n"));
3900 IEM_SVM_UPDATE_NRIP(pVCpu);
3901 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3902 }
3903
3904 /*
3905 * Clear NMI blocking, if any, before causing any further exceptions.
3906 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3907 */
3908 if (fBlockingNmi)
3909 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
3910
3911 /*
3912 * Call a mode specific worker.
3913 */
3914 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3915 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3916 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3917 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3918 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3919 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3920}
3921
3922
3923static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3924{
3925 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3926
3927 pHid->Sel = uSel;
3928 pHid->ValidSel = uSel;
3929 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3930}
3931
3932
3933static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3934{
3935 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3936
3937 /* The base is in the first three bytes. */
3938 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3939 /* The attributes are in the fourth byte. */
3940 pHid->Attr.u = pbMem[3];
3941 /* The limit is in the last two bytes. */
3942 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3943}
3944
3945
3946/**
3947 * Implements 286 LOADALL (286 CPUs only).
3948 */
3949IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3950{
3951 NOREF(cbInstr);
3952
3953 /* Data is loaded from a buffer at 800h. No checks are done on the
3954 * validity of loaded state.
3955 *
3956 * LOADALL only loads the internal CPU state, it does not access any
3957 * GDT, LDT, or similar tables.
3958 */
3959
3960 if (pVCpu->iem.s.uCpl != 0)
3961 {
3962 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3963 return iemRaiseGeneralProtectionFault0(pVCpu);
3964 }
3965
3966 uint8_t const *pbMem = NULL;
3967 uint16_t const *pa16Mem;
3968 uint8_t const *pa8Mem;
3969 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3970 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
3971 if (rcStrict != VINF_SUCCESS)
3972 return rcStrict;
3973
3974 /* The MSW is at offset 0x06. */
3975 pa16Mem = (uint16_t const *)(pbMem + 0x06);
3976 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3977 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3978 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3979 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3980
3981 CPUMSetGuestCR0(pVCpu, uNewCr0);
3982 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3983
3984 /* Inform PGM if mode changed. */
3985 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3986 {
3987 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3988 AssertRCReturn(rc, rc);
3989 /* ignore informational status codes */
3990 }
3991 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
3992 false /* fForce */);
3993
3994 /* TR selector is at offset 0x16. */
3995 pa16Mem = (uint16_t const *)(pbMem + 0x16);
3996 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
3997 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
3998 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
3999
4000 /* Followed by FLAGS... */
4001 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
4002 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
4003
4004 /* LDT is at offset 0x1C. */
4005 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
4006 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
4007 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
4008 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4009
4010 /* Segment registers are at offset 0x1E. */
4011 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
4012 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
4013 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
4014 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
4015 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
4016
4017 /* GPRs are at offset 0x26. */
4018 pa16Mem = (uint16_t const *)(pbMem + 0x26);
4019 pVCpu->cpum.GstCtx.di = pa16Mem[0];
4020 pVCpu->cpum.GstCtx.si = pa16Mem[1];
4021 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
4022 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
4023 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
4024 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
4025 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
4026 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
4027
4028 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
4029 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
4030 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
4031 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4032 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4033
4034 /* GDTR contents are at offset 0x4E, 6 bytes. */
4035 RTGCPHYS GCPtrBase;
4036 uint16_t cbLimit;
4037 pa8Mem = pbMem + 0x4E;
4038 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4039 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4040 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4041 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4042
4043 /* IDTR contents are at offset 0x5A, 6 bytes. */
4044 pa8Mem = pbMem + 0x5A;
4045 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4046 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4047 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4048
4049 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4050 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4051 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4052 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4053 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4054 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4055
4056 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4057 if (rcStrict != VINF_SUCCESS)
4058 return rcStrict;
4059
4060 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4061 * descriptor caches" but there is no word as to what happens if those are
4062 * not identical (probably bad things).
4063 */
4064 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4065
4066 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4067
4068 /* Flush the prefetch buffer. */
4069#ifdef IEM_WITH_CODE_TLB
4070 pVCpu->iem.s.pbInstrBuf = NULL;
4071#else
4072 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4073#endif
4074 return rcStrict;
4075}
4076
4077
4078/**
4079 * Implements SYSCALL (AMD and Intel64).
4080 */
4081IEM_CIMPL_DEF_0(iemCImpl_syscall)
4082{
4083 /** @todo hack, LOADALL should be decoded as such on a 286. */
4084 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4085 return iemCImpl_loadall286(pVCpu, cbInstr);
4086
4087 /*
4088 * Check preconditions.
4089 *
4090 * Note that CPUs described in the documentation may load a few odd values
4091 * into CS and SS than we allow here. This has yet to be checked on real
4092 * hardware.
4093 */
4094 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4095 {
4096 Log(("syscall: Not enabled in EFER -> #UD\n"));
4097 return iemRaiseUndefinedOpcode(pVCpu);
4098 }
4099 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4100 {
4101 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4102 return iemRaiseGeneralProtectionFault0(pVCpu);
4103 }
4104 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4105 {
4106 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4107 return iemRaiseUndefinedOpcode(pVCpu);
4108 }
4109
4110 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4111
4112 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4113 /** @todo what about LDT selectors? Shouldn't matter, really. */
4114 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4115 uint16_t uNewSs = uNewCs + 8;
4116 if (uNewCs == 0 || uNewSs == 0)
4117 {
4118 /** @todo Neither Intel nor AMD document this check. */
4119 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4120 return iemRaiseGeneralProtectionFault0(pVCpu);
4121 }
4122
4123 /* Long mode and legacy mode differs. */
4124 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4125 {
4126 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4127
4128 /* This test isn't in the docs, but I'm not trusting the guys writing
4129 the MSRs to have validated the values as canonical like they should. */
4130 if (!IEM_IS_CANONICAL(uNewRip))
4131 {
4132 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4133 Log(("syscall: New RIP not canonical -> #UD\n"));
4134 return iemRaiseUndefinedOpcode(pVCpu);
4135 }
4136
4137 /*
4138 * Commit it.
4139 */
4140 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4141 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4142 pVCpu->cpum.GstCtx.rip = uNewRip;
4143
4144 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4145 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4146 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4147 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4148
4149 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4150 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4151 }
4152 else
4153 {
4154 /*
4155 * Commit it.
4156 */
4157 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4158 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4159 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4160 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4161
4162 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4163 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4164 }
4165 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4166 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4167 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4168 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4169 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4170
4171 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4172 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4173 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4174 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4175 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4176
4177 pVCpu->iem.s.uCpl = 0;
4178 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4179
4180 /* Flush the prefetch buffer. */
4181#ifdef IEM_WITH_CODE_TLB
4182 pVCpu->iem.s.pbInstrBuf = NULL;
4183#else
4184 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4185#endif
4186
4187 return VINF_SUCCESS;
4188}
4189
4190
4191/**
4192 * Implements SYSRET (AMD and Intel64).
4193 */
4194IEM_CIMPL_DEF_0(iemCImpl_sysret)
4195
4196{
4197 RT_NOREF_PV(cbInstr);
4198
4199 /*
4200 * Check preconditions.
4201 *
4202 * Note that CPUs described in the documentation may load a few odd values
4203 * into CS and SS than we allow here. This has yet to be checked on real
4204 * hardware.
4205 */
4206 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4207 {
4208 Log(("sysret: Not enabled in EFER -> #UD\n"));
4209 return iemRaiseUndefinedOpcode(pVCpu);
4210 }
4211 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4212 {
4213 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4214 return iemRaiseUndefinedOpcode(pVCpu);
4215 }
4216 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4217 {
4218 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4219 return iemRaiseGeneralProtectionFault0(pVCpu);
4220 }
4221 if (pVCpu->iem.s.uCpl != 0)
4222 {
4223 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4224 return iemRaiseGeneralProtectionFault0(pVCpu);
4225 }
4226
4227 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4228
4229 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4230 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4231 uint16_t uNewSs = uNewCs + 8;
4232 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4233 uNewCs += 16;
4234 if (uNewCs == 0 || uNewSs == 0)
4235 {
4236 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4237 return iemRaiseGeneralProtectionFault0(pVCpu);
4238 }
4239
4240 /*
4241 * Commit it.
4242 */
4243 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4244 {
4245 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4246 {
4247 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4248 /* Note! We disregard intel manual regarding the RCX canonical
4249 check, ask intel+xen why AMD doesn't do it. */
4250 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4251 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4252 | (3 << X86DESCATTR_DPL_SHIFT);
4253 }
4254 else
4255 {
4256 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4257 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4258 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4259 | (3 << X86DESCATTR_DPL_SHIFT);
4260 }
4261 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4262 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4263 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4264 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4265 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4266 }
4267 else
4268 {
4269 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4270 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4271 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4272 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4273 | (3 << X86DESCATTR_DPL_SHIFT);
4274 }
4275 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4276 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4277 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4278 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4279 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4280
4281 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4282 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4283 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4284 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4285 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4286 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4287 * on sysret. */
4288
4289 pVCpu->iem.s.uCpl = 3;
4290 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
4291
4292 /* Flush the prefetch buffer. */
4293#ifdef IEM_WITH_CODE_TLB
4294 pVCpu->iem.s.pbInstrBuf = NULL;
4295#else
4296 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4297#endif
4298
4299 return VINF_SUCCESS;
4300}
4301
4302
4303/**
4304 * Implements SYSENTER (Intel, 32-bit AMD).
4305 */
4306IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4307{
4308 RT_NOREF(cbInstr);
4309
4310 /*
4311 * Check preconditions.
4312 *
4313 * Note that CPUs described in the documentation may load a few odd values
4314 * into CS and SS than we allow here. This has yet to be checked on real
4315 * hardware.
4316 */
4317 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4318 {
4319 Log(("sysenter: not supported -=> #UD\n"));
4320 return iemRaiseUndefinedOpcode(pVCpu);
4321 }
4322 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4323 {
4324 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4325 return iemRaiseGeneralProtectionFault0(pVCpu);
4326 }
4327 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4328 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4329 {
4330 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4331 return iemRaiseUndefinedOpcode(pVCpu);
4332 }
4333 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4334 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4335 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4336 {
4337 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4338 return iemRaiseGeneralProtectionFault0(pVCpu);
4339 }
4340
4341 /* This test isn't in the docs, it's just a safeguard against missing
4342 canonical checks when writing the registers. */
4343 if (RT_LIKELY( !fIsLongMode
4344 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4345 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4346 { /* likely */ }
4347 else
4348 {
4349 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4350 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4351 return iemRaiseUndefinedOpcode(pVCpu);
4352 }
4353
4354/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4355
4356 /*
4357 * Update registers and commit.
4358 */
4359 if (fIsLongMode)
4360 {
4361 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4362 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4363 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4364 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4365 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4366 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4367 }
4368 else
4369 {
4370 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, (uint32_t)pVCpu->cpum.GstCtx.rip,
4371 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4372 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4373 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4374 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4375 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4376 }
4377 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4378 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4379 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4380 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4381 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4382
4383 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4384 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4385 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4386 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4387 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4388 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4389 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4390
4391 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4392 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4393 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4394
4395 pVCpu->iem.s.uCpl = 0;
4396
4397 /* Flush the prefetch buffer. */
4398#ifdef IEM_WITH_CODE_TLB
4399 pVCpu->iem.s.pbInstrBuf = NULL;
4400#else
4401 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4402#endif
4403
4404 return VINF_SUCCESS;
4405}
4406
4407
4408/**
4409 * Implements SYSEXIT (Intel, 32-bit AMD).
4410 *
4411 * @param enmEffOpSize The effective operand size.
4412 */
4413IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4414{
4415 RT_NOREF(cbInstr);
4416
4417 /*
4418 * Check preconditions.
4419 *
4420 * Note that CPUs described in the documentation may load a few odd values
4421 * into CS and SS than we allow here. This has yet to be checked on real
4422 * hardware.
4423 */
4424 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4425 {
4426 Log(("sysexit: not supported -=> #UD\n"));
4427 return iemRaiseUndefinedOpcode(pVCpu);
4428 }
4429 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4430 {
4431 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4432 return iemRaiseGeneralProtectionFault0(pVCpu);
4433 }
4434 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4435 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4436 {
4437 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4438 return iemRaiseUndefinedOpcode(pVCpu);
4439 }
4440 if (pVCpu->iem.s.uCpl != 0)
4441 {
4442 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", pVCpu->iem.s.uCpl));
4443 return iemRaiseGeneralProtectionFault0(pVCpu);
4444 }
4445 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4446 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4447 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4448 {
4449 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4450 return iemRaiseGeneralProtectionFault0(pVCpu);
4451 }
4452
4453 /*
4454 * Update registers and commit.
4455 */
4456 if (enmEffOpSize == IEMMODE_64BIT)
4457 {
4458 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4459 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4460 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4461 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4462 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4463 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4464 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4465 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4466 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4467 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4468 }
4469 else
4470 {
4471 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip,
4472 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4473 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4474 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4475 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4476 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4477 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4478 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4479 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4480 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4481 }
4482 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4483 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4484 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4485
4486 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4487 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4488 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4489 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4490 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4491 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4492
4493 pVCpu->iem.s.uCpl = 3;
4494
4495 /* Flush the prefetch buffer. */
4496#ifdef IEM_WITH_CODE_TLB
4497 pVCpu->iem.s.pbInstrBuf = NULL;
4498#else
4499 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4500#endif
4501
4502 return VINF_SUCCESS;
4503}
4504
4505
4506/**
4507 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4508 *
4509 * @param iSegReg The segment register number (valid).
4510 * @param uSel The new selector value.
4511 */
4512IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4513{
4514 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4515 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4516 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4517
4518 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4519
4520 /*
4521 * Real mode and V8086 mode are easy.
4522 */
4523 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4524 {
4525 *pSel = uSel;
4526 pHid->u64Base = (uint32_t)uSel << 4;
4527 pHid->ValidSel = uSel;
4528 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4529#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4530 /** @todo Does the CPU actually load limits and attributes in the
4531 * real/V8086 mode segment load case? It doesn't for CS in far
4532 * jumps... Affects unreal mode. */
4533 pHid->u32Limit = 0xffff;
4534 pHid->Attr.u = 0;
4535 pHid->Attr.n.u1Present = 1;
4536 pHid->Attr.n.u1DescType = 1;
4537 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4538 ? X86_SEL_TYPE_RW
4539 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4540#endif
4541 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4542 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4543 }
4544
4545 /*
4546 * Protected mode.
4547 *
4548 * Check if it's a null segment selector value first, that's OK for DS, ES,
4549 * FS and GS. If not null, then we have to load and parse the descriptor.
4550 */
4551 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4552 {
4553 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4554 if (iSegReg == X86_SREG_SS)
4555 {
4556 /* In 64-bit kernel mode, the stack can be 0 because of the way
4557 interrupts are dispatched. AMD seems to have a slighly more
4558 relaxed relationship to SS.RPL than intel does. */
4559 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4560 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4561 || pVCpu->iem.s.uCpl > 2
4562 || ( uSel != pVCpu->iem.s.uCpl
4563 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4564 {
4565 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4566 return iemRaiseGeneralProtectionFault0(pVCpu);
4567 }
4568 }
4569
4570 *pSel = uSel; /* Not RPL, remember :-) */
4571 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4572 if (iSegReg == X86_SREG_SS)
4573 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4574
4575 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4576 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4577
4578 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4579 }
4580
4581 /* Fetch the descriptor. */
4582 IEMSELDESC Desc;
4583 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4584 if (rcStrict != VINF_SUCCESS)
4585 return rcStrict;
4586
4587 /* Check GPs first. */
4588 if (!Desc.Legacy.Gen.u1DescType)
4589 {
4590 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4591 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4592 }
4593 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4594 {
4595 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4596 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4597 {
4598 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4599 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4600 }
4601 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4602 {
4603 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4604 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4605 }
4606 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4607 {
4608 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4609 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4610 }
4611 }
4612 else
4613 {
4614 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4615 {
4616 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4617 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4618 }
4619 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4620 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4621 {
4622#if 0 /* this is what intel says. */
4623 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4624 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4625 {
4626 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4627 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4628 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4629 }
4630#else /* this is what makes more sense. */
4631 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4632 {
4633 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4634 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4635 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4636 }
4637 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4638 {
4639 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4640 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4641 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4642 }
4643#endif
4644 }
4645 }
4646
4647 /* Is it there? */
4648 if (!Desc.Legacy.Gen.u1Present)
4649 {
4650 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4651 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4652 }
4653
4654 /* The base and limit. */
4655 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4656 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4657
4658 /*
4659 * Ok, everything checked out fine. Now set the accessed bit before
4660 * committing the result into the registers.
4661 */
4662 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4663 {
4664 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4665 if (rcStrict != VINF_SUCCESS)
4666 return rcStrict;
4667 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4668 }
4669
4670 /* commit */
4671 *pSel = uSel;
4672 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4673 pHid->u32Limit = cbLimit;
4674 pHid->u64Base = u64Base;
4675 pHid->ValidSel = uSel;
4676 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4677
4678 /** @todo check if the hidden bits are loaded correctly for 64-bit
4679 * mode. */
4680 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4681
4682 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4683 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4684}
4685
4686
4687/**
4688 * Implements 'mov SReg, r/m'.
4689 *
4690 * @param iSegReg The segment register number (valid).
4691 * @param uSel The new selector value.
4692 */
4693IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4694{
4695 if (iSegReg != X86_SREG_SS)
4696 return IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4697 /** @todo only set it the shadow flag if it was clear before? */
4698 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4699 if (rcStrict == VINF_SUCCESS)
4700 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4701 return rcStrict;
4702}
4703
4704
4705/**
4706 * Implements 'pop SReg'.
4707 *
4708 * @param iSegReg The segment register number (valid).
4709 * @param enmEffOpSize The efficient operand size (valid).
4710 */
4711IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4712{
4713 VBOXSTRICTRC rcStrict;
4714
4715 /*
4716 * Read the selector off the stack and join paths with mov ss, reg.
4717 */
4718 RTUINT64U TmpRsp;
4719 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4720 switch (enmEffOpSize)
4721 {
4722 case IEMMODE_16BIT:
4723 {
4724 uint16_t uSel;
4725 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4726 if (rcStrict == VINF_SUCCESS)
4727 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4728 break;
4729 }
4730
4731 case IEMMODE_32BIT:
4732 {
4733 uint32_t u32Value;
4734 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4735 if (rcStrict == VINF_SUCCESS)
4736 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4737 break;
4738 }
4739
4740 case IEMMODE_64BIT:
4741 {
4742 uint64_t u64Value;
4743 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4744 if (rcStrict == VINF_SUCCESS)
4745 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4746 break;
4747 }
4748 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4749 }
4750
4751 /*
4752 * Commit the stack on success and set interrupt shadow flag if appropriate
4753 * (the latter must be done after updating RIP).
4754 */
4755 if (rcStrict == VINF_SUCCESS)
4756 {
4757 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4758 if (iSegReg == X86_SREG_SS)
4759 {
4760 /** @todo only set it the shadow flag if it was clear before? */
4761 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4762 }
4763 }
4764 return rcStrict;
4765}
4766
4767
4768/**
4769 * Implements lgs, lfs, les, lds & lss.
4770 */
4771IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
4772{
4773 /*
4774 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4775 */
4776 /** @todo verify and test that mov, pop and lXs works the segment
4777 * register loading in the exact same way. */
4778 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4779 if (rcStrict == VINF_SUCCESS)
4780 {
4781 switch (enmEffOpSize)
4782 {
4783 case IEMMODE_16BIT:
4784 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4785 break;
4786 case IEMMODE_32BIT:
4787 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4788 break;
4789 case IEMMODE_64BIT:
4790 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4791 break;
4792 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4793 }
4794 }
4795
4796 return rcStrict;
4797}
4798
4799
4800/**
4801 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4802 *
4803 * @retval VINF_SUCCESS on success.
4804 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4805 * @retval iemMemFetchSysU64 return value.
4806 *
4807 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4808 * @param uSel The selector value.
4809 * @param fAllowSysDesc Whether system descriptors are OK or not.
4810 * @param pDesc Where to return the descriptor on success.
4811 */
4812static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4813{
4814 pDesc->Long.au64[0] = 0;
4815 pDesc->Long.au64[1] = 0;
4816
4817 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4818 return VINF_IEM_SELECTOR_NOT_OK;
4819
4820 /* Within the table limits? */
4821 RTGCPTR GCPtrBase;
4822 if (uSel & X86_SEL_LDT)
4823 {
4824 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4825 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4826 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4827 return VINF_IEM_SELECTOR_NOT_OK;
4828 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4829 }
4830 else
4831 {
4832 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4833 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4834 return VINF_IEM_SELECTOR_NOT_OK;
4835 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4836 }
4837
4838 /* Fetch the descriptor. */
4839 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4840 if (rcStrict != VINF_SUCCESS)
4841 return rcStrict;
4842 if (!pDesc->Legacy.Gen.u1DescType)
4843 {
4844 if (!fAllowSysDesc)
4845 return VINF_IEM_SELECTOR_NOT_OK;
4846 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4847 {
4848 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4849 if (rcStrict != VINF_SUCCESS)
4850 return rcStrict;
4851 }
4852
4853 }
4854
4855 return VINF_SUCCESS;
4856}
4857
4858
4859/**
4860 * Implements verr (fWrite = false) and verw (fWrite = true).
4861 */
4862IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4863{
4864 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4865
4866 /** @todo figure whether the accessed bit is set or not. */
4867
4868 bool fAccessible = true;
4869 IEMSELDESC Desc;
4870 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4871 if (rcStrict == VINF_SUCCESS)
4872 {
4873 /* Check the descriptor, order doesn't matter much here. */
4874 if ( !Desc.Legacy.Gen.u1DescType
4875 || !Desc.Legacy.Gen.u1Present)
4876 fAccessible = false;
4877 else
4878 {
4879 if ( fWrite
4880 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4881 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4882 fAccessible = false;
4883
4884 /** @todo testcase for the conforming behavior. */
4885 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4886 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4887 {
4888 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4889 fAccessible = false;
4890 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4891 fAccessible = false;
4892 }
4893 }
4894
4895 }
4896 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4897 fAccessible = false;
4898 else
4899 return rcStrict;
4900
4901 /* commit */
4902 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4903
4904 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4905}
4906
4907
4908/**
4909 * Implements LAR and LSL with 64-bit operand size.
4910 *
4911 * @returns VINF_SUCCESS.
4912 * @param pu64Dst Pointer to the destination register.
4913 * @param uSel The selector to load details for.
4914 * @param fIsLar true = LAR, false = LSL.
4915 */
4916IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4917{
4918 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4919
4920 /** @todo figure whether the accessed bit is set or not. */
4921
4922 bool fDescOk = true;
4923 IEMSELDESC Desc;
4924 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4925 if (rcStrict == VINF_SUCCESS)
4926 {
4927 /*
4928 * Check the descriptor type.
4929 */
4930 if (!Desc.Legacy.Gen.u1DescType)
4931 {
4932 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4933 {
4934 if (Desc.Long.Gen.u5Zeros)
4935 fDescOk = false;
4936 else
4937 switch (Desc.Long.Gen.u4Type)
4938 {
4939 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4940 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4941 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4942 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4943 break;
4944 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4945 fDescOk = fIsLar;
4946 break;
4947 default:
4948 fDescOk = false;
4949 break;
4950 }
4951 }
4952 else
4953 {
4954 switch (Desc.Long.Gen.u4Type)
4955 {
4956 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4957 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4958 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4959 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4960 case X86_SEL_TYPE_SYS_LDT:
4961 break;
4962 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4963 case X86_SEL_TYPE_SYS_TASK_GATE:
4964 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4965 fDescOk = fIsLar;
4966 break;
4967 default:
4968 fDescOk = false;
4969 break;
4970 }
4971 }
4972 }
4973 if (fDescOk)
4974 {
4975 /*
4976 * Check the RPL/DPL/CPL interaction..
4977 */
4978 /** @todo testcase for the conforming behavior. */
4979 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4980 || !Desc.Legacy.Gen.u1DescType)
4981 {
4982 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4983 fDescOk = false;
4984 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4985 fDescOk = false;
4986 }
4987 }
4988
4989 if (fDescOk)
4990 {
4991 /*
4992 * All fine, start committing the result.
4993 */
4994 if (fIsLar)
4995 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4996 else
4997 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4998 }
4999
5000 }
5001 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5002 fDescOk = false;
5003 else
5004 return rcStrict;
5005
5006 /* commit flags value and advance rip. */
5007 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5008 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5009}
5010
5011
5012/**
5013 * Implements LAR and LSL with 16-bit operand size.
5014 *
5015 * @returns VINF_SUCCESS.
5016 * @param pu16Dst Pointer to the destination register.
5017 * @param uSel The selector to load details for.
5018 * @param fIsLar true = LAR, false = LSL.
5019 */
5020IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5021{
5022 uint64_t u64TmpDst = *pu16Dst;
5023 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5024 *pu16Dst = u64TmpDst;
5025 return VINF_SUCCESS;
5026}
5027
5028
5029/**
5030 * Implements lgdt.
5031 *
5032 * @param iEffSeg The segment of the new gdtr contents
5033 * @param GCPtrEffSrc The address of the new gdtr contents.
5034 * @param enmEffOpSize The effective operand size.
5035 */
5036IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5037{
5038 if (pVCpu->iem.s.uCpl != 0)
5039 return iemRaiseGeneralProtectionFault0(pVCpu);
5040 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5041
5042 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5043 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5044 {
5045 Log(("lgdt: Guest intercept -> VM-exit\n"));
5046 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5047 }
5048
5049 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5050 {
5051 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5052 IEM_SVM_UPDATE_NRIP(pVCpu);
5053 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5054 }
5055
5056 /*
5057 * Fetch the limit and base address.
5058 */
5059 uint16_t cbLimit;
5060 RTGCPTR GCPtrBase;
5061 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5062 if (rcStrict == VINF_SUCCESS)
5063 {
5064 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5065 || X86_IS_CANONICAL(GCPtrBase))
5066 {
5067 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5068 if (rcStrict == VINF_SUCCESS)
5069 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5070 }
5071 else
5072 {
5073 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5074 return iemRaiseGeneralProtectionFault0(pVCpu);
5075 }
5076 }
5077 return rcStrict;
5078}
5079
5080
5081/**
5082 * Implements sgdt.
5083 *
5084 * @param iEffSeg The segment where to store the gdtr content.
5085 * @param GCPtrEffDst The address where to store the gdtr content.
5086 */
5087IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5088{
5089 /*
5090 * Join paths with sidt.
5091 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5092 * you really must know.
5093 */
5094 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5095 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5096 {
5097 Log(("sgdt: Guest intercept -> VM-exit\n"));
5098 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5099 }
5100
5101 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5102 {
5103 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5104 IEM_SVM_UPDATE_NRIP(pVCpu);
5105 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5106 }
5107
5108 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5109 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5110 if (rcStrict == VINF_SUCCESS)
5111 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5112 return rcStrict;
5113}
5114
5115
5116/**
5117 * Implements lidt.
5118 *
5119 * @param iEffSeg The segment of the new idtr contents
5120 * @param GCPtrEffSrc The address of the new idtr contents.
5121 * @param enmEffOpSize The effective operand size.
5122 */
5123IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5124{
5125 if (pVCpu->iem.s.uCpl != 0)
5126 return iemRaiseGeneralProtectionFault0(pVCpu);
5127 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5128
5129 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5130 {
5131 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5132 IEM_SVM_UPDATE_NRIP(pVCpu);
5133 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5134 }
5135
5136 /*
5137 * Fetch the limit and base address.
5138 */
5139 uint16_t cbLimit;
5140 RTGCPTR GCPtrBase;
5141 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5142 if (rcStrict == VINF_SUCCESS)
5143 {
5144 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
5145 || X86_IS_CANONICAL(GCPtrBase))
5146 {
5147 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5148 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5149 }
5150 else
5151 {
5152 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5153 return iemRaiseGeneralProtectionFault0(pVCpu);
5154 }
5155 }
5156 return rcStrict;
5157}
5158
5159
5160/**
5161 * Implements sidt.
5162 *
5163 * @param iEffSeg The segment where to store the idtr content.
5164 * @param GCPtrEffDst The address where to store the idtr content.
5165 */
5166IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5167{
5168 /*
5169 * Join paths with sgdt.
5170 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5171 * you really must know.
5172 */
5173 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5174 {
5175 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5176 IEM_SVM_UPDATE_NRIP(pVCpu);
5177 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5178 }
5179
5180 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5181 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5182 if (rcStrict == VINF_SUCCESS)
5183 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5184 return rcStrict;
5185}
5186
5187
5188/**
5189 * Implements lldt.
5190 *
5191 * @param uNewLdt The new LDT selector value.
5192 */
5193IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5194{
5195 /*
5196 * Check preconditions.
5197 */
5198 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5199 {
5200 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5201 return iemRaiseUndefinedOpcode(pVCpu);
5202 }
5203 if (pVCpu->iem.s.uCpl != 0)
5204 {
5205 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
5206 return iemRaiseGeneralProtectionFault0(pVCpu);
5207 }
5208 /* Nested-guest VMX intercept. */
5209 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5210 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5211 {
5212 Log(("lldt: Guest intercept -> VM-exit\n"));
5213 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5214 }
5215 if (uNewLdt & X86_SEL_LDT)
5216 {
5217 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5218 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5219 }
5220
5221 /*
5222 * Now, loading a NULL selector is easy.
5223 */
5224 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5225 {
5226 /* Nested-guest SVM intercept. */
5227 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5228 {
5229 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5230 IEM_SVM_UPDATE_NRIP(pVCpu);
5231 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5232 }
5233
5234 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5235 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5236 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5237 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5238 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5239 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5240 {
5241 /* AMD-V seems to leave the base and limit alone. */
5242 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5243 }
5244 else
5245 {
5246 /* VT-x (Intel 3960x) seems to be doing the following. */
5247 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5248 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5249 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5250 }
5251
5252 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5253 }
5254
5255 /*
5256 * Read the descriptor.
5257 */
5258 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5259 IEMSELDESC Desc;
5260 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5261 if (rcStrict != VINF_SUCCESS)
5262 return rcStrict;
5263
5264 /* Check GPs first. */
5265 if (Desc.Legacy.Gen.u1DescType)
5266 {
5267 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5268 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5269 }
5270 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5271 {
5272 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5273 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5274 }
5275 uint64_t u64Base;
5276 if (!IEM_IS_LONG_MODE(pVCpu))
5277 u64Base = X86DESC_BASE(&Desc.Legacy);
5278 else
5279 {
5280 if (Desc.Long.Gen.u5Zeros)
5281 {
5282 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5283 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5284 }
5285
5286 u64Base = X86DESC64_BASE(&Desc.Long);
5287 if (!IEM_IS_CANONICAL(u64Base))
5288 {
5289 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5290 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5291 }
5292 }
5293
5294 /* NP */
5295 if (!Desc.Legacy.Gen.u1Present)
5296 {
5297 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5298 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5299 }
5300
5301 /* Nested-guest SVM intercept. */
5302 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5303 {
5304 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5305 IEM_SVM_UPDATE_NRIP(pVCpu);
5306 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5307 }
5308
5309 /*
5310 * It checks out alright, update the registers.
5311 */
5312/** @todo check if the actual value is loaded or if the RPL is dropped */
5313 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5314 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5315 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5316 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5317 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5318 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5319
5320 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5321}
5322
5323
5324/**
5325 * Implements sldt GReg
5326 *
5327 * @param iGReg The general register to store the CRx value in.
5328 * @param enmEffOpSize The operand size.
5329 */
5330IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5331{
5332 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5333 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5334 {
5335 Log(("sldt: Guest intercept -> VM-exit\n"));
5336 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5337 }
5338
5339 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5340
5341 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5342 switch (enmEffOpSize)
5343 {
5344 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5345 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5346 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5347 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5348 }
5349 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5350}
5351
5352
5353/**
5354 * Implements sldt mem.
5355 *
5356 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5357 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5358 */
5359IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5360{
5361 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5362
5363 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5364 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5365 if (rcStrict == VINF_SUCCESS)
5366 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5367 return rcStrict;
5368}
5369
5370
5371/**
5372 * Implements ltr.
5373 *
5374 * @param uNewTr The new TSS selector value.
5375 */
5376IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5377{
5378 /*
5379 * Check preconditions.
5380 */
5381 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5382 {
5383 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5384 return iemRaiseUndefinedOpcode(pVCpu);
5385 }
5386 if (pVCpu->iem.s.uCpl != 0)
5387 {
5388 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5389 return iemRaiseGeneralProtectionFault0(pVCpu);
5390 }
5391 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5392 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5393 {
5394 Log(("ltr: Guest intercept -> VM-exit\n"));
5395 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5396 }
5397 if (uNewTr & X86_SEL_LDT)
5398 {
5399 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5400 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5401 }
5402 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5403 {
5404 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5405 return iemRaiseGeneralProtectionFault0(pVCpu);
5406 }
5407 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5408 {
5409 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5410 IEM_SVM_UPDATE_NRIP(pVCpu);
5411 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5412 }
5413
5414 /*
5415 * Read the descriptor.
5416 */
5417 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5418 IEMSELDESC Desc;
5419 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5420 if (rcStrict != VINF_SUCCESS)
5421 return rcStrict;
5422
5423 /* Check GPs first. */
5424 if (Desc.Legacy.Gen.u1DescType)
5425 {
5426 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5427 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5428 }
5429 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5430 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5431 || IEM_IS_LONG_MODE(pVCpu)) )
5432 {
5433 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5434 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5435 }
5436 uint64_t u64Base;
5437 if (!IEM_IS_LONG_MODE(pVCpu))
5438 u64Base = X86DESC_BASE(&Desc.Legacy);
5439 else
5440 {
5441 if (Desc.Long.Gen.u5Zeros)
5442 {
5443 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5444 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5445 }
5446
5447 u64Base = X86DESC64_BASE(&Desc.Long);
5448 if (!IEM_IS_CANONICAL(u64Base))
5449 {
5450 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5451 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5452 }
5453 }
5454
5455 /* NP */
5456 if (!Desc.Legacy.Gen.u1Present)
5457 {
5458 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5459 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5460 }
5461
5462 /*
5463 * Set it busy.
5464 * Note! Intel says this should lock down the whole descriptor, but we'll
5465 * restrict our selves to 32-bit for now due to lack of inline
5466 * assembly and such.
5467 */
5468 void *pvDesc;
5469 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
5470 IEM_ACCESS_DATA_RW, 0);
5471 if (rcStrict != VINF_SUCCESS)
5472 return rcStrict;
5473 switch ((uintptr_t)pvDesc & 3)
5474 {
5475 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5476 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5477 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5478 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5479 }
5480 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5481 if (rcStrict != VINF_SUCCESS)
5482 return rcStrict;
5483 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5484
5485 /*
5486 * It checks out alright, update the registers.
5487 */
5488/** @todo check if the actual value is loaded or if the RPL is dropped */
5489 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5490 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5491 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5492 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5493 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5494 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5495
5496 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5497}
5498
5499
5500/**
5501 * Implements str GReg
5502 *
5503 * @param iGReg The general register to store the CRx value in.
5504 * @param enmEffOpSize The operand size.
5505 */
5506IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5507{
5508 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5509 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5510 {
5511 Log(("str_reg: Guest intercept -> VM-exit\n"));
5512 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5513 }
5514
5515 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5516
5517 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5518 switch (enmEffOpSize)
5519 {
5520 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5521 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5522 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5523 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5524 }
5525 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5526}
5527
5528
5529/**
5530 * Implements str mem.
5531 *
5532 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5533 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5534 */
5535IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5536{
5537 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5538 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5539 {
5540 Log(("str_mem: Guest intercept -> VM-exit\n"));
5541 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5542 }
5543
5544 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5545
5546 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5547 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5548 if (rcStrict == VINF_SUCCESS)
5549 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5550 return rcStrict;
5551}
5552
5553
5554/**
5555 * Implements mov GReg,CRx.
5556 *
5557 * @param iGReg The general register to store the CRx value in.
5558 * @param iCrReg The CRx register to read (valid).
5559 */
5560IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5561{
5562 if (pVCpu->iem.s.uCpl != 0)
5563 return iemRaiseGeneralProtectionFault0(pVCpu);
5564 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5565
5566 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5567 {
5568 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5569 IEM_SVM_UPDATE_NRIP(pVCpu);
5570 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5571 }
5572
5573 /* Read it. */
5574 uint64_t crX;
5575 switch (iCrReg)
5576 {
5577 case 0:
5578 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5579 crX = pVCpu->cpum.GstCtx.cr0;
5580 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5581 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5582 break;
5583 case 2:
5584 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5585 crX = pVCpu->cpum.GstCtx.cr2;
5586 break;
5587 case 3:
5588 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5589 crX = pVCpu->cpum.GstCtx.cr3;
5590 break;
5591 case 4:
5592 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5593 crX = pVCpu->cpum.GstCtx.cr4;
5594 break;
5595 case 8:
5596 {
5597 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5598#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5599 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5600 {
5601 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5602 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5603 return rcStrict;
5604
5605 /*
5606 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5607 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5608 * are cleared.
5609 *
5610 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5611 */
5612 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5613 {
5614 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5615 crX = (uTpr >> 4) & 0xf;
5616 break;
5617 }
5618 }
5619#endif
5620#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5621 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5622 {
5623 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5624 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5625 {
5626 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5627 break;
5628 }
5629 }
5630#endif
5631 uint8_t uTpr;
5632 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5633 if (RT_SUCCESS(rc))
5634 crX = uTpr >> 4;
5635 else
5636 crX = 0;
5637 break;
5638 }
5639 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5640 }
5641
5642#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5643 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5644 {
5645 switch (iCrReg)
5646 {
5647 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5648 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5649 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5650
5651 case 3:
5652 {
5653 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5654 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5655 return rcStrict;
5656 break;
5657 }
5658 }
5659 }
5660#endif
5661
5662 /* Store it. */
5663 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5664 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5665 else
5666 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5667
5668 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5669}
5670
5671
5672/**
5673 * Implements smsw GReg.
5674 *
5675 * @param iGReg The general register to store the CRx value in.
5676 * @param enmEffOpSize The operand size.
5677 */
5678IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5679{
5680 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5681
5682#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5683 uint64_t u64MaskedCr0;
5684 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5685 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5686 else
5687 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5688 uint64_t const u64GuestCr0 = u64MaskedCr0;
5689#else
5690 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5691#endif
5692
5693 switch (enmEffOpSize)
5694 {
5695 case IEMMODE_16BIT:
5696 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5697 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5698 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5699 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5700 else
5701 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5702 break;
5703
5704 case IEMMODE_32BIT:
5705 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5706 break;
5707
5708 case IEMMODE_64BIT:
5709 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5710 break;
5711
5712 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5713 }
5714
5715 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5716}
5717
5718
5719/**
5720 * Implements smsw mem.
5721 *
5722 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5723 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5724 */
5725IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5726{
5727 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5728
5729#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5730 uint64_t u64MaskedCr0;
5731 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5732 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5733 else
5734 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5735 uint64_t const u64GuestCr0 = u64MaskedCr0;
5736#else
5737 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5738#endif
5739
5740 uint16_t u16Value;
5741 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5742 u16Value = (uint16_t)u64GuestCr0;
5743 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5744 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5745 else
5746 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5747
5748 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5749 if (rcStrict == VINF_SUCCESS)
5750 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5751 return rcStrict;
5752}
5753
5754
5755/**
5756 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5757 */
5758#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5759 do \
5760 { \
5761 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5762 if (RT_SUCCESS(rcX)) \
5763 { /* likely */ } \
5764 else \
5765 { \
5766 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5767 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5768 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5769 } \
5770 } while (0)
5771
5772
5773/**
5774 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5775 *
5776 * @param iCrReg The CRx register to write (valid).
5777 * @param uNewCrX The new value.
5778 * @param enmAccessCrX The instruction that caused the CrX load.
5779 * @param iGReg The general register in case of a 'mov CRx,GReg'
5780 * instruction.
5781 */
5782IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5783{
5784 VBOXSTRICTRC rcStrict;
5785 int rc;
5786#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5787 RT_NOREF2(iGReg, enmAccessCrX);
5788#endif
5789
5790 /*
5791 * Try store it.
5792 * Unfortunately, CPUM only does a tiny bit of the work.
5793 */
5794 switch (iCrReg)
5795 {
5796 case 0:
5797 {
5798 /*
5799 * Perform checks.
5800 */
5801 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5802
5803 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5804 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5805
5806 /* ET is hardcoded on 486 and later. */
5807 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5808 uNewCrX |= X86_CR0_ET;
5809 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5810 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5811 {
5812 uNewCrX &= fValid;
5813 uNewCrX |= X86_CR0_ET;
5814 }
5815 else
5816 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5817
5818 /* Check for reserved bits. */
5819 if (uNewCrX & ~(uint64_t)fValid)
5820 {
5821 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5822 return iemRaiseGeneralProtectionFault0(pVCpu);
5823 }
5824
5825 /* Check for invalid combinations. */
5826 if ( (uNewCrX & X86_CR0_PG)
5827 && !(uNewCrX & X86_CR0_PE) )
5828 {
5829 Log(("Trying to set CR0.PG without CR0.PE\n"));
5830 return iemRaiseGeneralProtectionFault0(pVCpu);
5831 }
5832
5833 if ( !(uNewCrX & X86_CR0_CD)
5834 && (uNewCrX & X86_CR0_NW) )
5835 {
5836 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5837 return iemRaiseGeneralProtectionFault0(pVCpu);
5838 }
5839
5840 if ( !(uNewCrX & X86_CR0_PG)
5841 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5842 {
5843 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5844 return iemRaiseGeneralProtectionFault0(pVCpu);
5845 }
5846
5847 /* Long mode consistency checks. */
5848 if ( (uNewCrX & X86_CR0_PG)
5849 && !(uOldCrX & X86_CR0_PG)
5850 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5851 {
5852 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5853 {
5854 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5855 return iemRaiseGeneralProtectionFault0(pVCpu);
5856 }
5857 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5858 {
5859 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5860 return iemRaiseGeneralProtectionFault0(pVCpu);
5861 }
5862 }
5863
5864 /* Check for bits that must remain set or cleared in VMX operation,
5865 see Intel spec. 23.8 "Restrictions on VMX operation". */
5866 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5867 {
5868#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5869 uint64_t const uCr0Fixed0 = IEM_VMX_IS_NON_ROOT_MODE(pVCpu) ? iemVmxGetCr0Fixed0(pVCpu) : VMX_V_CR0_FIXED0;
5870#else
5871 uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
5872#endif
5873 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5874 {
5875 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5876 return iemRaiseGeneralProtectionFault0(pVCpu);
5877 }
5878
5879 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5880 if (uNewCrX & ~uCr0Fixed1)
5881 {
5882 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5883 return iemRaiseGeneralProtectionFault0(pVCpu);
5884 }
5885 }
5886
5887 /*
5888 * SVM nested-guest CR0 write intercepts.
5889 */
5890 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5891 {
5892 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5893 IEM_SVM_UPDATE_NRIP(pVCpu);
5894 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5895 }
5896 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5897 {
5898 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5899 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5900 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5901 {
5902 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5903 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5904 IEM_SVM_UPDATE_NRIP(pVCpu);
5905 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5906 }
5907 }
5908
5909 /*
5910 * Change EFER.LMA if entering or leaving long mode.
5911 */
5912 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5913 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5914 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5915 {
5916 if (uNewCrX & X86_CR0_PG)
5917 NewEFER |= MSR_K6_EFER_LMA;
5918 else
5919 NewEFER &= ~MSR_K6_EFER_LMA;
5920
5921 CPUMSetGuestEFER(pVCpu, NewEFER);
5922 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5923 }
5924
5925 /*
5926 * Inform PGM.
5927 */
5928 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5929 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5930 {
5931 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
5932 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
5933 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5934 { /* likely */ }
5935 else
5936 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
5937 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5938 AssertRCReturn(rc, rc);
5939 /* ignore informational status codes */
5940 }
5941
5942 /*
5943 * Change CR0.
5944 */
5945 CPUMSetGuestCR0(pVCpu, uNewCrX);
5946 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
5947
5948 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
5949 false /* fForce */);
5950 break;
5951 }
5952
5953 /*
5954 * CR2 can be changed without any restrictions.
5955 */
5956 case 2:
5957 {
5958 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5959 {
5960 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5961 IEM_SVM_UPDATE_NRIP(pVCpu);
5962 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5963 }
5964 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
5965 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
5966 rcStrict = VINF_SUCCESS;
5967 break;
5968 }
5969
5970 /*
5971 * CR3 is relatively simple, although AMD and Intel have different
5972 * accounts of how setting reserved bits are handled. We take intel's
5973 * word for the lower bits and AMD's for the high bits (63:52). The
5974 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5975 * on this.
5976 */
5977 /** @todo Testcase: Setting reserved bits in CR3, especially before
5978 * enabling paging. */
5979 case 3:
5980 {
5981 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5982
5983 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
5984 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
5985 && (uNewCrX & RT_BIT_64(63)))
5986 {
5987 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5988 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5989 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5990 * Paging-Structure Caches". */
5991 uNewCrX &= ~RT_BIT_64(63);
5992 }
5993
5994 /* Check / mask the value. */
5995#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
5996 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
5997 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
5998 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
5999 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6000#else
6001 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6002#endif
6003 if (uNewCrX & fInvPhysMask)
6004 {
6005 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6006 * very vague in this area. As mentioned above, need testcase on real
6007 * hardware... Sigh. */
6008 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6009 return iemRaiseGeneralProtectionFault0(pVCpu);
6010 }
6011
6012 uint64_t fValid;
6013 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6014 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6015 {
6016 /** @todo Redundant? This value has already been validated above. */
6017 fValid = UINT64_C(0x000fffffffffffff);
6018 }
6019 else
6020 fValid = UINT64_C(0xffffffff);
6021 if (uNewCrX & ~fValid)
6022 {
6023 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6024 uNewCrX, uNewCrX & ~fValid));
6025 uNewCrX &= fValid;
6026 }
6027
6028 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6029 {
6030 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6031 IEM_SVM_UPDATE_NRIP(pVCpu);
6032 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6033 }
6034
6035 /* Inform PGM. */
6036 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6037 {
6038 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6039 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6040 { /* likely */ }
6041 else
6042 {
6043 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6044 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6045 }
6046 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6047 AssertRCReturn(rc, rc);
6048 /* ignore informational status codes */
6049 }
6050
6051 /* Make the change. */
6052 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6053 AssertRCSuccessReturn(rc, rc);
6054
6055 rcStrict = VINF_SUCCESS;
6056 break;
6057 }
6058
6059 /*
6060 * CR4 is a bit more tedious as there are bits which cannot be cleared
6061 * under some circumstances and such.
6062 */
6063 case 4:
6064 {
6065 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6066 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6067
6068 /* Reserved bits. */
6069 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6070 if (uNewCrX & ~(uint64_t)fValid)
6071 {
6072 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6073 return iemRaiseGeneralProtectionFault0(pVCpu);
6074 }
6075
6076 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6077 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6078
6079 /* PCIDE check. */
6080 if ( fPcide
6081 && ( !fLongMode
6082 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6083 {
6084 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6085 return iemRaiseGeneralProtectionFault0(pVCpu);
6086 }
6087
6088 /* PAE check. */
6089 if ( fLongMode
6090 && (uOldCrX & X86_CR4_PAE)
6091 && !(uNewCrX & X86_CR4_PAE))
6092 {
6093 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6094 return iemRaiseGeneralProtectionFault0(pVCpu);
6095 }
6096
6097 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6098 {
6099 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6100 IEM_SVM_UPDATE_NRIP(pVCpu);
6101 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6102 }
6103
6104 /* Check for bits that must remain set or cleared in VMX operation,
6105 see Intel spec. 23.8 "Restrictions on VMX operation". */
6106 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
6107 {
6108 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6109 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6110 {
6111 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6112 return iemRaiseGeneralProtectionFault0(pVCpu);
6113 }
6114
6115 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6116 if (uNewCrX & ~uCr4Fixed1)
6117 {
6118 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6119 return iemRaiseGeneralProtectionFault0(pVCpu);
6120 }
6121 }
6122
6123 /*
6124 * Notify PGM.
6125 */
6126 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6127 {
6128 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6129 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6130 { /* likely */ }
6131 else
6132 {
6133 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6134 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6135 }
6136 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6137 AssertRCReturn(rc, rc);
6138 /* ignore informational status codes */
6139 }
6140
6141 /*
6142 * Change it.
6143 */
6144 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6145 AssertRCSuccessReturn(rc, rc);
6146 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6147
6148 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6149 false /* fForce */);
6150 break;
6151 }
6152
6153 /*
6154 * CR8 maps to the APIC TPR.
6155 */
6156 case 8:
6157 {
6158 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6159 if (uNewCrX & ~(uint64_t)0xf)
6160 {
6161 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6162 return iemRaiseGeneralProtectionFault0(pVCpu);
6163 }
6164
6165#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6166 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6167 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6168 {
6169 /*
6170 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6171 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6172 * cleared. Following this the processor performs TPR virtualization.
6173 *
6174 * However, we should not perform TPR virtualization immediately here but
6175 * after this instruction has completed.
6176 *
6177 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6178 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6179 */
6180 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6181 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6182 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6183 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6184 rcStrict = VINF_SUCCESS;
6185 break;
6186 }
6187#endif
6188
6189#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6190 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6191 {
6192 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6193 {
6194 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6195 IEM_SVM_UPDATE_NRIP(pVCpu);
6196 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6197 }
6198
6199 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6200 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6201 {
6202 rcStrict = VINF_SUCCESS;
6203 break;
6204 }
6205 }
6206#endif
6207 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6208 APICSetTpr(pVCpu, u8Tpr);
6209 rcStrict = VINF_SUCCESS;
6210 break;
6211 }
6212
6213 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6214 }
6215
6216 /*
6217 * Advance the RIP on success.
6218 */
6219 if (RT_SUCCESS(rcStrict))
6220 {
6221 if (rcStrict != VINF_SUCCESS)
6222 iemSetPassUpStatus(pVCpu, rcStrict);
6223 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6224 }
6225
6226 return rcStrict;
6227}
6228
6229
6230/**
6231 * Implements mov CRx,GReg.
6232 *
6233 * @param iCrReg The CRx register to write (valid).
6234 * @param iGReg The general register to load the CRx value from.
6235 */
6236IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6237{
6238 if (pVCpu->iem.s.uCpl != 0)
6239 return iemRaiseGeneralProtectionFault0(pVCpu);
6240 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6241
6242 /*
6243 * Read the new value from the source register and call common worker.
6244 */
6245 uint64_t uNewCrX;
6246 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6247 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6248 else
6249 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6250
6251#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6252 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6253 {
6254 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6255 switch (iCrReg)
6256 {
6257 case 0:
6258 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6259 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6260 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6261 }
6262 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6263 return rcStrict;
6264 }
6265#endif
6266
6267 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6268}
6269
6270
6271/**
6272 * Implements 'LMSW r/m16'
6273 *
6274 * @param u16NewMsw The new value.
6275 * @param GCPtrEffDst The guest-linear address of the source operand in case
6276 * of a memory operand. For register operand, pass
6277 * NIL_RTGCPTR.
6278 */
6279IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6280{
6281 if (pVCpu->iem.s.uCpl != 0)
6282 return iemRaiseGeneralProtectionFault0(pVCpu);
6283 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6284 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6285
6286#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6287 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6288 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6289 {
6290 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6291 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6292 return rcStrict;
6293 }
6294#else
6295 RT_NOREF_PV(GCPtrEffDst);
6296#endif
6297
6298 /*
6299 * Compose the new CR0 value and call common worker.
6300 */
6301 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6302 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6303 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6304}
6305
6306
6307/**
6308 * Implements 'CLTS'.
6309 */
6310IEM_CIMPL_DEF_0(iemCImpl_clts)
6311{
6312 if (pVCpu->iem.s.uCpl != 0)
6313 return iemRaiseGeneralProtectionFault0(pVCpu);
6314
6315 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6316 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6317 uNewCr0 &= ~X86_CR0_TS;
6318
6319#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6320 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6321 {
6322 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6323 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6324 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6325 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6326 return rcStrict;
6327 }
6328#endif
6329
6330 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6331}
6332
6333
6334/**
6335 * Implements mov GReg,DRx.
6336 *
6337 * @param iGReg The general register to store the DRx value in.
6338 * @param iDrReg The DRx register to read (0-7).
6339 */
6340IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6341{
6342#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6343 /*
6344 * Check nested-guest VMX intercept.
6345 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6346 * over CPL and CR4.DE and even DR4/DR5 checks.
6347 *
6348 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6349 */
6350 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6351 {
6352 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6353 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6354 return rcStrict;
6355 }
6356#endif
6357
6358 /*
6359 * Check preconditions.
6360 */
6361 /* Raise GPs. */
6362 if (pVCpu->iem.s.uCpl != 0)
6363 return iemRaiseGeneralProtectionFault0(pVCpu);
6364 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6365 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR0);
6366
6367 if ( (iDrReg == 4 || iDrReg == 5)
6368 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE) )
6369 {
6370 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6371 return iemRaiseGeneralProtectionFault0(pVCpu);
6372 }
6373
6374 /* Raise #DB if general access detect is enabled. */
6375 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6376 {
6377 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6378 return iemRaiseDebugException(pVCpu);
6379 }
6380
6381 /*
6382 * Read the debug register and store it in the specified general register.
6383 */
6384 uint64_t drX;
6385 switch (iDrReg)
6386 {
6387 case 0:
6388 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6389 drX = pVCpu->cpum.GstCtx.dr[0];
6390 break;
6391 case 1:
6392 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6393 drX = pVCpu->cpum.GstCtx.dr[1];
6394 break;
6395 case 2:
6396 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6397 drX = pVCpu->cpum.GstCtx.dr[2];
6398 break;
6399 case 3:
6400 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6401 drX = pVCpu->cpum.GstCtx.dr[3];
6402 break;
6403 case 6:
6404 case 4:
6405 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6406 drX = pVCpu->cpum.GstCtx.dr[6];
6407 drX |= X86_DR6_RA1_MASK;
6408 drX &= ~X86_DR6_RAZ_MASK;
6409 break;
6410 case 7:
6411 case 5:
6412 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6413 drX = pVCpu->cpum.GstCtx.dr[7];
6414 drX |=X86_DR7_RA1_MASK;
6415 drX &= ~X86_DR7_RAZ_MASK;
6416 break;
6417 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6418 }
6419
6420 /** @todo SVM nested-guest intercept for DR8-DR15? */
6421 /*
6422 * Check for any SVM nested-guest intercepts for the DRx read.
6423 */
6424 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6425 {
6426 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6427 IEM_SVM_UPDATE_NRIP(pVCpu);
6428 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6429 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6430 }
6431
6432 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6433 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6434 else
6435 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6436
6437 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6438}
6439
6440
6441/**
6442 * Implements mov DRx,GReg.
6443 *
6444 * @param iDrReg The DRx register to write (valid).
6445 * @param iGReg The general register to load the DRx value from.
6446 */
6447IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6448{
6449#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6450 /*
6451 * Check nested-guest VMX intercept.
6452 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6453 * over CPL and CR4.DE and even DR4/DR5 checks.
6454 *
6455 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6456 */
6457 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6458 {
6459 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6460 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6461 return rcStrict;
6462 }
6463#endif
6464
6465 /*
6466 * Check preconditions.
6467 */
6468 if (pVCpu->iem.s.uCpl != 0)
6469 return iemRaiseGeneralProtectionFault0(pVCpu);
6470 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6471 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR4);
6472
6473 if (iDrReg == 4 || iDrReg == 5)
6474 {
6475 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6476 {
6477 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6478 return iemRaiseGeneralProtectionFault0(pVCpu);
6479 }
6480 iDrReg += 2;
6481 }
6482
6483 /* Raise #DB if general access detect is enabled. */
6484 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6485 * \#GP? */
6486 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6487 {
6488 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6489 return iemRaiseDebugException(pVCpu);
6490 }
6491
6492 /*
6493 * Read the new value from the source register.
6494 */
6495 uint64_t uNewDrX;
6496 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6497 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6498 else
6499 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6500
6501 /*
6502 * Adjust it.
6503 */
6504 switch (iDrReg)
6505 {
6506 case 0:
6507 case 1:
6508 case 2:
6509 case 3:
6510 /* nothing to adjust */
6511 break;
6512
6513 case 6:
6514 if (uNewDrX & X86_DR6_MBZ_MASK)
6515 {
6516 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6517 return iemRaiseGeneralProtectionFault0(pVCpu);
6518 }
6519 uNewDrX |= X86_DR6_RA1_MASK;
6520 uNewDrX &= ~X86_DR6_RAZ_MASK;
6521 break;
6522
6523 case 7:
6524 if (uNewDrX & X86_DR7_MBZ_MASK)
6525 {
6526 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6527 return iemRaiseGeneralProtectionFault0(pVCpu);
6528 }
6529 uNewDrX |= X86_DR7_RA1_MASK;
6530 uNewDrX &= ~X86_DR7_RAZ_MASK;
6531 break;
6532
6533 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6534 }
6535
6536 /** @todo SVM nested-guest intercept for DR8-DR15? */
6537 /*
6538 * Check for any SVM nested-guest intercepts for the DRx write.
6539 */
6540 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6541 {
6542 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6543 IEM_SVM_UPDATE_NRIP(pVCpu);
6544 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6545 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6546 }
6547
6548 /*
6549 * Do the actual setting.
6550 */
6551 if (iDrReg < 4)
6552 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6553 else if (iDrReg == 6)
6554 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6555
6556 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6557 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6558
6559 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6560}
6561
6562
6563/**
6564 * Implements mov GReg,TRx.
6565 *
6566 * @param iGReg The general register to store the
6567 * TRx value in.
6568 * @param iTrReg The TRx register to read (6/7).
6569 */
6570IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6571{
6572 /*
6573 * Check preconditions. NB: This instruction is 386/486 only.
6574 */
6575
6576 /* Raise GPs. */
6577 if (pVCpu->iem.s.uCpl != 0)
6578 return iemRaiseGeneralProtectionFault0(pVCpu);
6579 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6580
6581 if (iTrReg < 6 || iTrReg > 7)
6582 {
6583 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6584 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6585 return iemRaiseGeneralProtectionFault0(pVCpu);
6586 }
6587
6588 /*
6589 * Read the test register and store it in the specified general register.
6590 * This is currently a dummy implementation that only exists to satisfy
6591 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6592 * TR6/TR7 registers. Software which actually depends on the TR values
6593 * (different on 386/486) is exceedingly rare.
6594 */
6595 uint64_t trX;
6596 switch (iTrReg)
6597 {
6598 case 6:
6599 trX = 0; /* Currently a dummy. */
6600 break;
6601 case 7:
6602 trX = 0; /* Currently a dummy. */
6603 break;
6604 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6605 }
6606
6607 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)trX;
6608
6609 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6610}
6611
6612
6613/**
6614 * Implements mov TRx,GReg.
6615 *
6616 * @param iTrReg The TRx register to write (valid).
6617 * @param iGReg The general register to load the TRx
6618 * value from.
6619 */
6620IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6621{
6622 /*
6623 * Check preconditions. NB: This instruction is 386/486 only.
6624 */
6625
6626 /* Raise GPs. */
6627 if (pVCpu->iem.s.uCpl != 0)
6628 return iemRaiseGeneralProtectionFault0(pVCpu);
6629 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6630
6631 if (iTrReg < 6 || iTrReg > 7)
6632 {
6633 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6634 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6635 return iemRaiseGeneralProtectionFault0(pVCpu);
6636 }
6637
6638 /*
6639 * Read the new value from the source register.
6640 */
6641 uint64_t uNewTrX;
6642 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6643 uNewTrX = iemGRegFetchU64(pVCpu, iGReg);
6644 else
6645 uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6646
6647 /*
6648 * Here we would do the actual setting if this weren't a dummy implementation.
6649 * This is currently a dummy implementation that only exists to prevent
6650 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6651 */
6652 RT_NOREF(uNewTrX);
6653
6654 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6655}
6656
6657
6658/**
6659 * Implements 'INVLPG m'.
6660 *
6661 * @param GCPtrPage The effective address of the page to invalidate.
6662 * @remarks Updates the RIP.
6663 */
6664IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6665{
6666 /* ring-0 only. */
6667 if (pVCpu->iem.s.uCpl != 0)
6668 return iemRaiseGeneralProtectionFault0(pVCpu);
6669 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6670 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6671
6672#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6673 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6674 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6675 {
6676 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6677 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6678 }
6679#endif
6680
6681 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6682 {
6683 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6684 IEM_SVM_UPDATE_NRIP(pVCpu);
6685 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6686 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6687 }
6688
6689 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6690 if (rc == VINF_SUCCESS)
6691 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6692 if (rc == VINF_PGM_SYNC_CR3)
6693 {
6694 iemSetPassUpStatus(pVCpu, rc);
6695 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6696 }
6697
6698 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6699 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6700 return rc;
6701}
6702
6703
6704/**
6705 * Implements INVPCID.
6706 *
6707 * @param iEffSeg The segment of the invpcid descriptor.
6708 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6709 * @param uInvpcidType The invalidation type.
6710 * @remarks Updates the RIP.
6711 */
6712IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6713{
6714 /*
6715 * Check preconditions.
6716 */
6717 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6718 return iemRaiseUndefinedOpcode(pVCpu);
6719
6720 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6721 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6722 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6723 {
6724 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6725 return iemRaiseUndefinedOpcode(pVCpu);
6726 }
6727
6728 if (pVCpu->iem.s.uCpl != 0)
6729 {
6730 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6731 return iemRaiseGeneralProtectionFault0(pVCpu);
6732 }
6733
6734 if (IEM_IS_V86_MODE(pVCpu))
6735 {
6736 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6737 return iemRaiseGeneralProtectionFault0(pVCpu);
6738 }
6739
6740 /*
6741 * Check nested-guest intercept.
6742 *
6743 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6744 * both set. We have already checked the former earlier in this function.
6745 *
6746 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6747 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6748 */
6749 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6750 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6751 {
6752 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6753 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6754 }
6755
6756 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6757 {
6758 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6759 return iemRaiseGeneralProtectionFault0(pVCpu);
6760 }
6761 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6762
6763 /*
6764 * Fetch the invpcid descriptor from guest memory.
6765 */
6766 RTUINT128U uDesc;
6767 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6768 if (rcStrict == VINF_SUCCESS)
6769 {
6770 /*
6771 * Validate the descriptor.
6772 */
6773 if (uDesc.s.Lo > 0xfff)
6774 {
6775 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6776 return iemRaiseGeneralProtectionFault0(pVCpu);
6777 }
6778
6779 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6780 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6781 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6782 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6783 switch (uInvpcidType)
6784 {
6785 case X86_INVPCID_TYPE_INDV_ADDR:
6786 {
6787 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6788 {
6789 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6790 return iemRaiseGeneralProtectionFault0(pVCpu);
6791 }
6792 if ( !(uCr4 & X86_CR4_PCIDE)
6793 && uPcid != 0)
6794 {
6795 Log(("invpcid: invalid pcid %#x\n", uPcid));
6796 return iemRaiseGeneralProtectionFault0(pVCpu);
6797 }
6798
6799 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6800 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6801 break;
6802 }
6803
6804 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6805 {
6806 if ( !(uCr4 & X86_CR4_PCIDE)
6807 && uPcid != 0)
6808 {
6809 Log(("invpcid: invalid pcid %#x\n", uPcid));
6810 return iemRaiseGeneralProtectionFault0(pVCpu);
6811 }
6812 /* Invalidate all mappings associated with PCID except global translations. */
6813 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6814 break;
6815 }
6816
6817 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6818 {
6819 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6820 break;
6821 }
6822
6823 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6824 {
6825 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6826 break;
6827 }
6828 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6829 }
6830 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6831 }
6832 return rcStrict;
6833}
6834
6835
6836/**
6837 * Implements INVD.
6838 */
6839IEM_CIMPL_DEF_0(iemCImpl_invd)
6840{
6841 if (pVCpu->iem.s.uCpl != 0)
6842 {
6843 Log(("invd: CPL != 0 -> #GP(0)\n"));
6844 return iemRaiseGeneralProtectionFault0(pVCpu);
6845 }
6846
6847 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6848 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6849
6850 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6851
6852 /* We currently take no action here. */
6853 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6854}
6855
6856
6857/**
6858 * Implements WBINVD.
6859 */
6860IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6861{
6862 if (pVCpu->iem.s.uCpl != 0)
6863 {
6864 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6865 return iemRaiseGeneralProtectionFault0(pVCpu);
6866 }
6867
6868 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6869 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6870
6871 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6872
6873 /* We currently take no action here. */
6874 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6875}
6876
6877
6878/** Opcode 0x0f 0xaa. */
6879IEM_CIMPL_DEF_0(iemCImpl_rsm)
6880{
6881 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6882 NOREF(cbInstr);
6883 return iemRaiseUndefinedOpcode(pVCpu);
6884}
6885
6886
6887/**
6888 * Implements RDTSC.
6889 */
6890IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6891{
6892 /*
6893 * Check preconditions.
6894 */
6895 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6896 return iemRaiseUndefinedOpcode(pVCpu);
6897
6898 if (pVCpu->iem.s.uCpl != 0)
6899 {
6900 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6901 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6902 {
6903 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6904 return iemRaiseGeneralProtectionFault0(pVCpu);
6905 }
6906 }
6907
6908 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6909 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6910 {
6911 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6912 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6913 }
6914
6915 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6916 {
6917 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6918 IEM_SVM_UPDATE_NRIP(pVCpu);
6919 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6920 }
6921
6922 /*
6923 * Do the job.
6924 */
6925 uint64_t uTicks = TMCpuTickGet(pVCpu);
6926#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6927 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6928#endif
6929 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6930 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6931 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
6932 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6933}
6934
6935
6936/**
6937 * Implements RDTSC.
6938 */
6939IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
6940{
6941 /*
6942 * Check preconditions.
6943 */
6944 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6945 return iemRaiseUndefinedOpcode(pVCpu);
6946
6947 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6948 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
6949 {
6950 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
6951 return iemRaiseUndefinedOpcode(pVCpu);
6952 }
6953
6954 if (pVCpu->iem.s.uCpl != 0)
6955 {
6956 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6957 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6958 {
6959 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6960 return iemRaiseGeneralProtectionFault0(pVCpu);
6961 }
6962 }
6963
6964 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6965 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6966 {
6967 Log(("rdtscp: Guest intercept -> VM-exit\n"));
6968 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
6969 }
6970 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6971 {
6972 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6973 IEM_SVM_UPDATE_NRIP(pVCpu);
6974 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6975 }
6976
6977 /*
6978 * Do the job.
6979 * Query the MSR first in case of trips to ring-3.
6980 */
6981 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
6982 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
6983 if (rcStrict == VINF_SUCCESS)
6984 {
6985 /* Low dword of the TSC_AUX msr only. */
6986 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
6987
6988 uint64_t uTicks = TMCpuTickGet(pVCpu);
6989#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
6990 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6991#endif
6992 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6993 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6994 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
6995 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6996 }
6997 return rcStrict;
6998}
6999
7000
7001/**
7002 * Implements RDPMC.
7003 */
7004IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7005{
7006 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7007
7008 if ( pVCpu->iem.s.uCpl != 0
7009 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7010 return iemRaiseGeneralProtectionFault0(pVCpu);
7011
7012 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7013 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7014 {
7015 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7016 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7017 }
7018
7019 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7020 {
7021 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7022 IEM_SVM_UPDATE_NRIP(pVCpu);
7023 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7024 }
7025
7026 /** @todo Emulate performance counters, for now just return 0. */
7027 pVCpu->cpum.GstCtx.rax = 0;
7028 pVCpu->cpum.GstCtx.rdx = 0;
7029 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7030 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7031 * ecx but see @bugref{3472}! */
7032
7033 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7034}
7035
7036
7037/**
7038 * Implements RDMSR.
7039 */
7040IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7041{
7042 /*
7043 * Check preconditions.
7044 */
7045 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7046 return iemRaiseUndefinedOpcode(pVCpu);
7047 if (pVCpu->iem.s.uCpl != 0)
7048 return iemRaiseGeneralProtectionFault0(pVCpu);
7049
7050 /*
7051 * Check nested-guest intercepts.
7052 */
7053#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7054 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7055 {
7056 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7057 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7058 }
7059#endif
7060
7061#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7062 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7063 {
7064 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
7065 if (rcStrict == VINF_SVM_VMEXIT)
7066 return VINF_SUCCESS;
7067 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7068 {
7069 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7070 return rcStrict;
7071 }
7072 }
7073#endif
7074
7075 /*
7076 * Do the job.
7077 */
7078 RTUINT64U uValue;
7079 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7080 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7081
7082 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7083 if (rcStrict == VINF_SUCCESS)
7084 {
7085 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7086 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7087 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7088
7089 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7090 }
7091
7092#ifndef IN_RING3
7093 /* Deferred to ring-3. */
7094 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7095 {
7096 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7097 return rcStrict;
7098 }
7099#endif
7100
7101 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7102 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7103 {
7104 pVCpu->iem.s.cLogRelRdMsr++;
7105 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7106 }
7107 else
7108 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7109 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7110 return iemRaiseGeneralProtectionFault0(pVCpu);
7111}
7112
7113
7114/**
7115 * Implements WRMSR.
7116 */
7117IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7118{
7119 /*
7120 * Check preconditions.
7121 */
7122 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7123 return iemRaiseUndefinedOpcode(pVCpu);
7124 if (pVCpu->iem.s.uCpl != 0)
7125 return iemRaiseGeneralProtectionFault0(pVCpu);
7126
7127 RTUINT64U uValue;
7128 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7129 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7130
7131 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7132
7133 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7134 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7135
7136 /*
7137 * Check nested-guest intercepts.
7138 */
7139#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7140 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7141 {
7142 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7143 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7144 }
7145#endif
7146
7147#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7148 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7149 {
7150 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
7151 if (rcStrict == VINF_SVM_VMEXIT)
7152 return VINF_SUCCESS;
7153 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7154 {
7155 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7156 return rcStrict;
7157 }
7158 }
7159#endif
7160
7161 /*
7162 * Do the job.
7163 */
7164 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7165 if (rcStrict == VINF_SUCCESS)
7166 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7167
7168#ifndef IN_RING3
7169 /* Deferred to ring-3. */
7170 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7171 {
7172 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7173 return rcStrict;
7174 }
7175#endif
7176
7177 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7178 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7179 {
7180 pVCpu->iem.s.cLogRelWrMsr++;
7181 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7182 }
7183 else
7184 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7185 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7186 return iemRaiseGeneralProtectionFault0(pVCpu);
7187}
7188
7189
7190/**
7191 * Implements 'IN eAX, port'.
7192 *
7193 * @param u16Port The source port.
7194 * @param fImm Whether the port was specified through an immediate operand
7195 * or the implicit DX register.
7196 * @param cbReg The register size.
7197 */
7198IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7199{
7200 /*
7201 * CPL check
7202 */
7203 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7204 if (rcStrict != VINF_SUCCESS)
7205 return rcStrict;
7206
7207 /*
7208 * Check VMX nested-guest IO intercept.
7209 */
7210#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7211 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7212 {
7213 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
7214 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7215 return rcStrict;
7216 }
7217#else
7218 RT_NOREF(fImm);
7219#endif
7220
7221 /*
7222 * Check SVM nested-guest IO intercept.
7223 */
7224#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7225 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7226 {
7227 uint8_t cAddrSizeBits;
7228 switch (pVCpu->iem.s.enmEffAddrMode)
7229 {
7230 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7231 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7232 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7233 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7234 }
7235 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7236 false /* fRep */, false /* fStrIo */, cbInstr);
7237 if (rcStrict == VINF_SVM_VMEXIT)
7238 return VINF_SUCCESS;
7239 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7240 {
7241 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7242 VBOXSTRICTRC_VAL(rcStrict)));
7243 return rcStrict;
7244 }
7245 }
7246#endif
7247
7248 /*
7249 * Perform the I/O.
7250 */
7251 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7252 uint32_t u32Value = 0;
7253 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7254 if (IOM_SUCCESS(rcStrict))
7255 {
7256 switch (cbReg)
7257 {
7258 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7259 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7260 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7261 default: AssertFailedReturn(VERR_IEM_IPE_3);
7262 }
7263
7264 pVCpu->iem.s.cPotentialExits++;
7265 if (rcStrict != VINF_SUCCESS)
7266 iemSetPassUpStatus(pVCpu, rcStrict);
7267 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7268
7269 /*
7270 * Check for I/O breakpoints.
7271 */
7272 /** @todo this should set a internal flag and be raised by
7273 * iemRegAddToRipAndFinishingClearingRF! */
7274 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7275 if (RT_UNLIKELY( ( ( (uDr7 & X86_DR7_ENABLED_MASK)
7276 && X86_DR7_ANY_RW_IO(uDr7)
7277 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7278 || DBGFBpIsHwIoArmed(pVM))
7279 && rcStrict == VINF_SUCCESS))
7280 {
7281 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7282 rcStrict = DBGFBpCheckIo(pVM, pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7283 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7284 rcStrict = iemRaiseDebugException(pVCpu);
7285 }
7286 }
7287
7288 return rcStrict;
7289}
7290
7291
7292/**
7293 * Implements 'IN eAX, DX'.
7294 *
7295 * @param cbReg The register size.
7296 */
7297IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
7298{
7299 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7300}
7301
7302
7303/**
7304 * Implements 'OUT port, eAX'.
7305 *
7306 * @param u16Port The destination port.
7307 * @param fImm Whether the port was specified through an immediate operand
7308 * or the implicit DX register.
7309 * @param cbReg The register size.
7310 */
7311IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
7312{
7313 /*
7314 * CPL check
7315 */
7316 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7317 if (rcStrict != VINF_SUCCESS)
7318 return rcStrict;
7319
7320 /*
7321 * Check VMX nested-guest I/O intercept.
7322 */
7323#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7324 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7325 {
7326 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
7327 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7328 return rcStrict;
7329 }
7330#else
7331 RT_NOREF(fImm);
7332#endif
7333
7334 /*
7335 * Check SVM nested-guest I/O intercept.
7336 */
7337#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7338 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7339 {
7340 uint8_t cAddrSizeBits;
7341 switch (pVCpu->iem.s.enmEffAddrMode)
7342 {
7343 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7344 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7345 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7346 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7347 }
7348 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7349 false /* fRep */, false /* fStrIo */, cbInstr);
7350 if (rcStrict == VINF_SVM_VMEXIT)
7351 return VINF_SUCCESS;
7352 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7353 {
7354 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7355 VBOXSTRICTRC_VAL(rcStrict)));
7356 return rcStrict;
7357 }
7358 }
7359#endif
7360
7361 /*
7362 * Perform the I/O.
7363 */
7364 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7365 uint32_t u32Value;
7366 switch (cbReg)
7367 {
7368 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7369 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7370 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7371 default: AssertFailedReturn(VERR_IEM_IPE_4);
7372 }
7373 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7374 if (IOM_SUCCESS(rcStrict))
7375 {
7376 pVCpu->iem.s.cPotentialExits++;
7377 if (rcStrict != VINF_SUCCESS)
7378 iemSetPassUpStatus(pVCpu, rcStrict);
7379 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7380
7381 /*
7382 * Check for I/O breakpoints.
7383 */
7384 /** @todo this should set a internal flag and be raised by
7385 * iemRegAddToRipAndFinishingClearingRF! */
7386 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7387 if (RT_UNLIKELY( ( ( (uDr7 & X86_DR7_ENABLED_MASK)
7388 && X86_DR7_ANY_RW_IO(uDr7)
7389 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7390 || DBGFBpIsHwIoArmed(pVM))
7391 && rcStrict == VINF_SUCCESS))
7392 {
7393 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7394 rcStrict = DBGFBpCheckIo(pVM, pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7395 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7396 rcStrict = iemRaiseDebugException(pVCpu);
7397 }
7398 }
7399 return rcStrict;
7400}
7401
7402
7403/**
7404 * Implements 'OUT DX, eAX'.
7405 *
7406 * @param cbReg The register size.
7407 */
7408IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7409{
7410 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7411}
7412
7413
7414/**
7415 * Implements 'CLI'.
7416 */
7417IEM_CIMPL_DEF_0(iemCImpl_cli)
7418{
7419 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7420#ifdef LOG_ENABLED
7421 uint32_t const fEflOld = fEfl;
7422#endif
7423
7424 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7425 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7426 {
7427 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7428 if (!(fEfl & X86_EFL_VM))
7429 {
7430 if (pVCpu->iem.s.uCpl <= uIopl)
7431 fEfl &= ~X86_EFL_IF;
7432 else if ( pVCpu->iem.s.uCpl == 3
7433 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7434 fEfl &= ~X86_EFL_VIF;
7435 else
7436 return iemRaiseGeneralProtectionFault0(pVCpu);
7437 }
7438 /* V8086 */
7439 else if (uIopl == 3)
7440 fEfl &= ~X86_EFL_IF;
7441 else if ( uIopl < 3
7442 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7443 fEfl &= ~X86_EFL_VIF;
7444 else
7445 return iemRaiseGeneralProtectionFault0(pVCpu);
7446 }
7447 /* real mode */
7448 else
7449 fEfl &= ~X86_EFL_IF;
7450
7451 /* Commit. */
7452 IEMMISC_SET_EFL(pVCpu, fEfl);
7453 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7454 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7455 return rcStrict;
7456}
7457
7458
7459/**
7460 * Implements 'STI'.
7461 */
7462IEM_CIMPL_DEF_0(iemCImpl_sti)
7463{
7464 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7465 uint32_t const fEflOld = fEfl;
7466
7467 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7468 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7469 {
7470 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7471 if (!(fEfl & X86_EFL_VM))
7472 {
7473 if (pVCpu->iem.s.uCpl <= uIopl)
7474 fEfl |= X86_EFL_IF;
7475 else if ( pVCpu->iem.s.uCpl == 3
7476 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7477 && !(fEfl & X86_EFL_VIP) )
7478 fEfl |= X86_EFL_VIF;
7479 else
7480 return iemRaiseGeneralProtectionFault0(pVCpu);
7481 }
7482 /* V8086 */
7483 else if (uIopl == 3)
7484 fEfl |= X86_EFL_IF;
7485 else if ( uIopl < 3
7486 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7487 && !(fEfl & X86_EFL_VIP) )
7488 fEfl |= X86_EFL_VIF;
7489 else
7490 return iemRaiseGeneralProtectionFault0(pVCpu);
7491 }
7492 /* real mode */
7493 else
7494 fEfl |= X86_EFL_IF;
7495
7496 /*
7497 * Commit.
7498 *
7499 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7500 */
7501 IEMMISC_SET_EFL(pVCpu, fEfl);
7502 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7503 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7504 {
7505 /** @todo only set it the shadow flag if it was clear before? */
7506 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7507 }
7508 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7509 return rcStrict;
7510}
7511
7512
7513/**
7514 * Implements 'HLT'.
7515 */
7516IEM_CIMPL_DEF_0(iemCImpl_hlt)
7517{
7518 if (pVCpu->iem.s.uCpl != 0)
7519 return iemRaiseGeneralProtectionFault0(pVCpu);
7520
7521 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7522 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7523 {
7524 Log2(("hlt: Guest intercept -> VM-exit\n"));
7525 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7526 }
7527
7528 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7529 {
7530 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7531 IEM_SVM_UPDATE_NRIP(pVCpu);
7532 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7533 }
7534
7535 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7536 * be returning any status codes relating to non-guest events being raised, as
7537 * we'll mess up the guest HALT otherwise. */
7538 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7539 if (rcStrict == VINF_SUCCESS)
7540 rcStrict = VINF_EM_HALT;
7541 return rcStrict;
7542}
7543
7544
7545/**
7546 * Implements 'MONITOR'.
7547 */
7548IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7549{
7550 /*
7551 * Permission checks.
7552 */
7553 if (pVCpu->iem.s.uCpl != 0)
7554 {
7555 Log2(("monitor: CPL != 0\n"));
7556 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7557 }
7558 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7559 {
7560 Log2(("monitor: Not in CPUID\n"));
7561 return iemRaiseUndefinedOpcode(pVCpu);
7562 }
7563
7564 /*
7565 * Check VMX guest-intercept.
7566 * This should be considered a fault-like VM-exit.
7567 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7568 */
7569 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7570 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7571 {
7572 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7573 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7574 }
7575
7576 /*
7577 * Gather the operands and validate them.
7578 */
7579 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7580 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7581 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7582/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7583 * \#GP first. */
7584 if (uEcx != 0)
7585 {
7586 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7587 return iemRaiseGeneralProtectionFault0(pVCpu);
7588 }
7589
7590 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7591 if (rcStrict != VINF_SUCCESS)
7592 return rcStrict;
7593
7594 RTGCPHYS GCPhysMem;
7595 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7596 if (rcStrict != VINF_SUCCESS)
7597 return rcStrict;
7598
7599#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7600 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7601 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7602 {
7603 /*
7604 * MONITOR does not access the memory, just monitors the address. However,
7605 * if the address falls in the APIC-access page, the address monitored must
7606 * instead be the corresponding address in the virtual-APIC page.
7607 *
7608 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7609 */
7610 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7611 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7612 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7613 return rcStrict;
7614 }
7615#endif
7616
7617 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7618 {
7619 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7620 IEM_SVM_UPDATE_NRIP(pVCpu);
7621 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7622 }
7623
7624 /*
7625 * Call EM to prepare the monitor/wait.
7626 */
7627 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7628 Assert(rcStrict == VINF_SUCCESS);
7629 if (rcStrict == VINF_SUCCESS)
7630 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7631 return rcStrict;
7632}
7633
7634
7635/**
7636 * Implements 'MWAIT'.
7637 */
7638IEM_CIMPL_DEF_0(iemCImpl_mwait)
7639{
7640 /*
7641 * Permission checks.
7642 */
7643 if (pVCpu->iem.s.uCpl != 0)
7644 {
7645 Log2(("mwait: CPL != 0\n"));
7646 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7647 * EFLAGS.VM then.) */
7648 return iemRaiseUndefinedOpcode(pVCpu);
7649 }
7650 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7651 {
7652 Log2(("mwait: Not in CPUID\n"));
7653 return iemRaiseUndefinedOpcode(pVCpu);
7654 }
7655
7656 /* Check VMX nested-guest intercept. */
7657 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7658 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7659 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7660
7661 /*
7662 * Gather the operands and validate them.
7663 */
7664 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7665 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7666 if (uEcx != 0)
7667 {
7668 /* Only supported extension is break on IRQ when IF=0. */
7669 if (uEcx > 1)
7670 {
7671 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7672 return iemRaiseGeneralProtectionFault0(pVCpu);
7673 }
7674 uint32_t fMWaitFeatures = 0;
7675 uint32_t uIgnore = 0;
7676 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7677 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7678 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7679 {
7680 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7681 return iemRaiseGeneralProtectionFault0(pVCpu);
7682 }
7683
7684#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7685 /*
7686 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7687 * for delivery; and interrupts are disabled the processor does not enter its
7688 * mwait state but rather passes control to the next instruction.
7689 *
7690 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7691 */
7692 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7693 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7694 {
7695 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7696 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7697 /** @todo finish: check up this out after we move int window stuff out of the
7698 * run loop and into the instruction finishing logic here. */
7699 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7700 }
7701#endif
7702 }
7703
7704 /*
7705 * Check SVM nested-guest mwait intercepts.
7706 */
7707 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7708 && EMMonitorIsArmed(pVCpu))
7709 {
7710 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7711 IEM_SVM_UPDATE_NRIP(pVCpu);
7712 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7713 }
7714 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7715 {
7716 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7717 IEM_SVM_UPDATE_NRIP(pVCpu);
7718 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7719 }
7720
7721 /*
7722 * Call EM to prepare the monitor/wait.
7723 *
7724 * This will return VINF_EM_HALT. If there the trap flag is set, we may
7725 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
7726 * that will only return guest related events.
7727 */
7728 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7729
7730 /** @todo finish: This needs more thinking as we should suppress internal
7731 * debugger events here, or we'll bugger up the guest state even more than we
7732 * alread do around VINF_EM_HALT. */
7733 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7734 if (rcStrict2 != VINF_SUCCESS)
7735 {
7736 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
7737 rcStrict = rcStrict2;
7738 }
7739
7740 return rcStrict;
7741}
7742
7743
7744/**
7745 * Implements 'SWAPGS'.
7746 */
7747IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7748{
7749 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7750
7751 /*
7752 * Permission checks.
7753 */
7754 if (pVCpu->iem.s.uCpl != 0)
7755 {
7756 Log2(("swapgs: CPL != 0\n"));
7757 return iemRaiseUndefinedOpcode(pVCpu);
7758 }
7759
7760 /*
7761 * Do the job.
7762 */
7763 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7764 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7765 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7766 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7767
7768 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7769}
7770
7771
7772#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7773/**
7774 * Handles a CPUID call.
7775 */
7776static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
7777 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
7778{
7779 switch (iFunction)
7780 {
7781 case VBOX_CPUID_FN_ID:
7782 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
7783 *pEax = VBOX_CPUID_RESP_ID_EAX;
7784 *pEbx = VBOX_CPUID_RESP_ID_EBX;
7785 *pEcx = VBOX_CPUID_RESP_ID_ECX;
7786 *pEdx = VBOX_CPUID_RESP_ID_EDX;
7787 break;
7788
7789 case VBOX_CPUID_FN_LOG:
7790 {
7791 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
7792 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
7793
7794 /* Validate input. */
7795 uint32_t cchToLog = *pEdx;
7796 if (cchToLog <= _2M)
7797 {
7798 uint32_t const uLogPicker = *pEbx;
7799 if (uLogPicker <= 1)
7800 {
7801 /* Resolve the logger. */
7802 PRTLOGGER const pLogger = !uLogPicker
7803 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
7804 if (pLogger)
7805 {
7806 /* Copy over the data: */
7807 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
7808 while (cchToLog > 0)
7809 {
7810 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
7811 if (cbToMap > cchToLog)
7812 cbToMap = cchToLog;
7813 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
7814 * unnecessary calls & iterations per pages. */
7815 if (cbToMap > 512)
7816 cbToMap = 512;
7817 void *pvSrc = NULL;
7818 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, cbToMap, UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
7819 if (rcStrict == VINF_SUCCESS)
7820 {
7821 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
7822 rcStrict = iemMemCommitAndUnmap(pVCpu, pvSrc, IEM_ACCESS_DATA_R);
7823 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
7824 }
7825 else
7826 {
7827 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
7828 return rcStrict;
7829 }
7830
7831 /* Advance. */
7832 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
7833 *pEdx = cchToLog -= cbToMap;
7834 }
7835 *pEax = VINF_SUCCESS;
7836 }
7837 else
7838 *pEax = (uint32_t)VERR_NOT_FOUND;
7839 }
7840 else
7841 *pEax = (uint32_t)VERR_NOT_FOUND;
7842 }
7843 else
7844 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
7845 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
7846 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
7847 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
7848 break;
7849 }
7850
7851 default:
7852 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
7853 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
7854 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
7855 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
7856 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
7857 break;
7858 }
7859 return VINF_SUCCESS;
7860}
7861#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
7862
7863/**
7864 * Implements 'CPUID'.
7865 */
7866IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7867{
7868 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7869 {
7870 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7871 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7872 }
7873
7874 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7875 {
7876 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7877 IEM_SVM_UPDATE_NRIP(pVCpu);
7878 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7879 }
7880
7881
7882 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7883 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7884
7885#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7886 /*
7887 * CPUID host call backdoor.
7888 */
7889 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
7890 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
7891 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
7892 {
7893 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
7894 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
7895 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7896 if (rcStrict != VINF_SUCCESS)
7897 return rcStrict;
7898 }
7899 /*
7900 * Regular CPUID.
7901 */
7902 else
7903#endif
7904 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
7905 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7906
7907 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7908 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7909 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7910 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7911 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7912
7913 pVCpu->iem.s.cPotentialExits++;
7914 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7915}
7916
7917
7918/**
7919 * Implements 'AAD'.
7920 *
7921 * @param bImm The immediate operand.
7922 */
7923IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7924{
7925 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7926 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7927 pVCpu->cpum.GstCtx.ax = al;
7928 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7929 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7930 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7931
7932 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7933}
7934
7935
7936/**
7937 * Implements 'AAM'.
7938 *
7939 * @param bImm The immediate operand. Cannot be 0.
7940 */
7941IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
7942{
7943 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
7944
7945 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7946 uint8_t const al = (uint8_t)ax % bImm;
7947 uint8_t const ah = (uint8_t)ax / bImm;
7948 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
7949 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7950 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7951 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7952
7953 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7954}
7955
7956
7957/**
7958 * Implements 'DAA'.
7959 */
7960IEM_CIMPL_DEF_0(iemCImpl_daa)
7961{
7962 uint8_t const al = pVCpu->cpum.GstCtx.al;
7963 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7964
7965 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7966 || (al & 0xf) >= 10)
7967 {
7968 pVCpu->cpum.GstCtx.al = al + 6;
7969 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7970 }
7971 else
7972 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7973
7974 if (al >= 0x9a || fCarry)
7975 {
7976 pVCpu->cpum.GstCtx.al += 0x60;
7977 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7978 }
7979 else
7980 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7981
7982 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7983 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7984}
7985
7986
7987/**
7988 * Implements 'DAS'.
7989 */
7990IEM_CIMPL_DEF_0(iemCImpl_das)
7991{
7992 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
7993 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7994
7995 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7996 || (uInputAL & 0xf) >= 10)
7997 {
7998 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7999 if (uInputAL < 6)
8000 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8001 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8002 }
8003 else
8004 {
8005 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8006 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8007 }
8008
8009 if (uInputAL >= 0x9a || fCarry)
8010 {
8011 pVCpu->cpum.GstCtx.al -= 0x60;
8012 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8013 }
8014
8015 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8016 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8017}
8018
8019
8020/**
8021 * Implements 'AAA'.
8022 */
8023IEM_CIMPL_DEF_0(iemCImpl_aaa)
8024{
8025 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8026 {
8027 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8028 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8029 {
8030 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8031 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8032 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8033 }
8034 else
8035 {
8036 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8037 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8038 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8039 }
8040 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8041 }
8042 else
8043 {
8044 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8045 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8046 {
8047 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8048 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8049 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8050 }
8051 else
8052 {
8053 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8054 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8055 }
8056 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8057 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8058 }
8059
8060 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8061}
8062
8063
8064/**
8065 * Implements 'AAS'.
8066 */
8067IEM_CIMPL_DEF_0(iemCImpl_aas)
8068{
8069 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8070 {
8071 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8072 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8073 {
8074 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.uBoth);
8075 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8076 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8077 }
8078 else
8079 {
8080 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8081 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8082 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8083 }
8084 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8085 }
8086 else
8087 {
8088 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8089 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8090 {
8091 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8092 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8093 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8094 }
8095 else
8096 {
8097 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8098 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8099 }
8100 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8101 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8102 }
8103
8104 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8105}
8106
8107
8108/**
8109 * Implements the 16-bit version of 'BOUND'.
8110 *
8111 * @note We have separate 16-bit and 32-bit variants of this function due to
8112 * the decoder using unsigned parameters, whereas we want signed one to
8113 * do the job. This is significant for a recompiler.
8114 */
8115IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8116{
8117 /*
8118 * Check if the index is inside the bounds, otherwise raise #BR.
8119 */
8120 if ( idxArray >= idxLowerBound
8121 && idxArray <= idxUpperBound)
8122 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8123 return iemRaiseBoundRangeExceeded(pVCpu);
8124}
8125
8126
8127/**
8128 * Implements the 32-bit version of 'BOUND'.
8129 */
8130IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8131{
8132 /*
8133 * Check if the index is inside the bounds, otherwise raise #BR.
8134 */
8135 if ( idxArray >= idxLowerBound
8136 && idxArray <= idxUpperBound)
8137 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8138 return iemRaiseBoundRangeExceeded(pVCpu);
8139}
8140
8141
8142
8143/*
8144 * Instantiate the various string operation combinations.
8145 */
8146#define OP_SIZE 8
8147#define ADDR_SIZE 16
8148#include "IEMAllCImplStrInstr.cpp.h"
8149#define OP_SIZE 8
8150#define ADDR_SIZE 32
8151#include "IEMAllCImplStrInstr.cpp.h"
8152#define OP_SIZE 8
8153#define ADDR_SIZE 64
8154#include "IEMAllCImplStrInstr.cpp.h"
8155
8156#define OP_SIZE 16
8157#define ADDR_SIZE 16
8158#include "IEMAllCImplStrInstr.cpp.h"
8159#define OP_SIZE 16
8160#define ADDR_SIZE 32
8161#include "IEMAllCImplStrInstr.cpp.h"
8162#define OP_SIZE 16
8163#define ADDR_SIZE 64
8164#include "IEMAllCImplStrInstr.cpp.h"
8165
8166#define OP_SIZE 32
8167#define ADDR_SIZE 16
8168#include "IEMAllCImplStrInstr.cpp.h"
8169#define OP_SIZE 32
8170#define ADDR_SIZE 32
8171#include "IEMAllCImplStrInstr.cpp.h"
8172#define OP_SIZE 32
8173#define ADDR_SIZE 64
8174#include "IEMAllCImplStrInstr.cpp.h"
8175
8176#define OP_SIZE 64
8177#define ADDR_SIZE 32
8178#include "IEMAllCImplStrInstr.cpp.h"
8179#define OP_SIZE 64
8180#define ADDR_SIZE 64
8181#include "IEMAllCImplStrInstr.cpp.h"
8182
8183
8184/**
8185 * Implements 'XGETBV'.
8186 */
8187IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8188{
8189 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8190 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8191 {
8192 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8193 switch (uEcx)
8194 {
8195 case 0:
8196 break;
8197
8198 case 1: /** @todo Implement XCR1 support. */
8199 default:
8200 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8201 return iemRaiseGeneralProtectionFault0(pVCpu);
8202
8203 }
8204 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8205 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8206 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8207
8208 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8209 }
8210 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8211 return iemRaiseUndefinedOpcode(pVCpu);
8212}
8213
8214
8215/**
8216 * Implements 'XSETBV'.
8217 */
8218IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8219{
8220 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8221 {
8222 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8223 {
8224 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8225 IEM_SVM_UPDATE_NRIP(pVCpu);
8226 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8227 }
8228
8229 if (pVCpu->iem.s.uCpl == 0)
8230 {
8231 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8232
8233 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8234 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8235
8236 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8237 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8238 switch (uEcx)
8239 {
8240 case 0:
8241 {
8242 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8243 if (rc == VINF_SUCCESS)
8244 break;
8245 Assert(rc == VERR_CPUM_RAISE_GP_0);
8246 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8247 return iemRaiseGeneralProtectionFault0(pVCpu);
8248 }
8249
8250 case 1: /** @todo Implement XCR1 support. */
8251 default:
8252 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8253 return iemRaiseGeneralProtectionFault0(pVCpu);
8254
8255 }
8256
8257 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8258 }
8259
8260 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
8261 return iemRaiseGeneralProtectionFault0(pVCpu);
8262 }
8263 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8264 return iemRaiseUndefinedOpcode(pVCpu);
8265}
8266
8267#ifndef RT_ARCH_ARM64
8268# ifdef IN_RING3
8269
8270/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8271struct IEMCIMPLCX16ARGS
8272{
8273 PRTUINT128U pu128Dst;
8274 PRTUINT128U pu128RaxRdx;
8275 PRTUINT128U pu128RbxRcx;
8276 uint32_t *pEFlags;
8277# ifdef VBOX_STRICT
8278 uint32_t cCalls;
8279# endif
8280};
8281
8282/**
8283 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8284 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8285 */
8286static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8287{
8288 RT_NOREF(pVM, pVCpu);
8289 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8290# ifdef VBOX_STRICT
8291 Assert(pArgs->cCalls == 0);
8292 pArgs->cCalls++;
8293# endif
8294
8295 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8296 return VINF_SUCCESS;
8297}
8298
8299# endif /* IN_RING3 */
8300
8301/**
8302 * Implements 'CMPXCHG16B' fallback using rendezvous.
8303 */
8304IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8305 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
8306{
8307# ifdef IN_RING3
8308 struct IEMCIMPLCX16ARGS Args;
8309 Args.pu128Dst = pu128Dst;
8310 Args.pu128RaxRdx = pu128RaxRdx;
8311 Args.pu128RbxRcx = pu128RbxRcx;
8312 Args.pEFlags = pEFlags;
8313# ifdef VBOX_STRICT
8314 Args.cCalls = 0;
8315# endif
8316 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8317 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8318 Assert(Args.cCalls == 1);
8319 if (rcStrict == VINF_SUCCESS)
8320 {
8321 /* Duplicated tail code. */
8322 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
8323 if (rcStrict == VINF_SUCCESS)
8324 {
8325 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8326 if (!(*pEFlags & X86_EFL_ZF))
8327 {
8328 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8329 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8330 }
8331 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8332 }
8333 }
8334 return rcStrict;
8335# else
8336 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
8337 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8338# endif
8339}
8340
8341#endif /* RT_ARCH_ARM64 */
8342
8343/**
8344 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8345 *
8346 * This is implemented in C because it triggers a load like behaviour without
8347 * actually reading anything. Since that's not so common, it's implemented
8348 * here.
8349 *
8350 * @param iEffSeg The effective segment.
8351 * @param GCPtrEff The address of the image.
8352 */
8353IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8354{
8355 /*
8356 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8357 */
8358 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8359 if (rcStrict == VINF_SUCCESS)
8360 {
8361 RTGCPHYS GCPhysMem;
8362 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8363 if (rcStrict == VINF_SUCCESS)
8364 {
8365#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8366 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8367 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8368 {
8369 /*
8370 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8371 * that contains the address. However, if the address falls in the APIC-access
8372 * page, the address flushed must instead be the corresponding address in the
8373 * virtual-APIC page.
8374 *
8375 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8376 */
8377 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8378 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8379 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8380 return rcStrict;
8381 }
8382#endif
8383 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8384 }
8385 }
8386
8387 return rcStrict;
8388}
8389
8390
8391/**
8392 * Implements 'FINIT' and 'FNINIT'.
8393 *
8394 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8395 * not.
8396 */
8397IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8398{
8399 /*
8400 * Exceptions.
8401 */
8402 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8403 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8404 return iemRaiseDeviceNotAvailable(pVCpu);
8405
8406 iemFpuActualizeStateForChange(pVCpu);
8407 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8408
8409 /* FINIT: Raise #MF on pending exception(s): */
8410 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8411 return iemRaiseMathFault(pVCpu);
8412
8413 /*
8414 * Reset the state.
8415 */
8416 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8417
8418 /* Rotate the stack to account for changed TOS. */
8419 iemFpuRotateStackSetTop(&pXState->x87, 0);
8420
8421 pXState->x87.FCW = 0x37f;
8422 pXState->x87.FSW = 0;
8423 pXState->x87.FTW = 0x00; /* 0 - empty. */
8424 /** @todo Intel says the instruction and data pointers are not cleared on
8425 * 387, presume that 8087 and 287 doesn't do so either. */
8426 /** @todo test this stuff. */
8427 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8428 {
8429 pXState->x87.FPUDP = 0;
8430 pXState->x87.DS = 0; //??
8431 pXState->x87.Rsrvd2 = 0;
8432 pXState->x87.FPUIP = 0;
8433 pXState->x87.CS = 0; //??
8434 pXState->x87.Rsrvd1 = 0;
8435 }
8436 pXState->x87.FOP = 0;
8437
8438 iemHlpUsedFpu(pVCpu);
8439 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8440}
8441
8442
8443/**
8444 * Implements 'FXSAVE'.
8445 *
8446 * @param iEffSeg The effective segment.
8447 * @param GCPtrEff The address of the image.
8448 * @param enmEffOpSize The operand size (only REX.W really matters).
8449 */
8450IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8451{
8452 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8453
8454 /*
8455 * Raise exceptions.
8456 */
8457 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8458 return iemRaiseDeviceNotAvailable(pVCpu);
8459
8460 /*
8461 * Access the memory.
8462 */
8463 void *pvMem512;
8464 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8465 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8466 if (rcStrict != VINF_SUCCESS)
8467 return rcStrict;
8468 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8469 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8470
8471 /*
8472 * Store the registers.
8473 */
8474 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8475 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8476
8477 /* common for all formats */
8478 pDst->FCW = pSrc->FCW;
8479 pDst->FSW = pSrc->FSW;
8480 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8481 pDst->FOP = pSrc->FOP;
8482 pDst->MXCSR = pSrc->MXCSR;
8483 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8484 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8485 {
8486 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8487 * them for now... */
8488 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8489 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8490 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8491 pDst->aRegs[i].au32[3] = 0;
8492 }
8493
8494 /* FPU IP, CS, DP and DS. */
8495 pDst->FPUIP = pSrc->FPUIP;
8496 pDst->CS = pSrc->CS;
8497 pDst->FPUDP = pSrc->FPUDP;
8498 pDst->DS = pSrc->DS;
8499 if (enmEffOpSize == IEMMODE_64BIT)
8500 {
8501 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8502 pDst->Rsrvd1 = pSrc->Rsrvd1;
8503 pDst->Rsrvd2 = pSrc->Rsrvd2;
8504 }
8505 else
8506 {
8507 pDst->Rsrvd1 = 0;
8508 pDst->Rsrvd2 = 0;
8509 }
8510
8511 /* XMM registers. */
8512 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8513 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8514 || pVCpu->iem.s.uCpl != 0)
8515 {
8516 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8517 for (uint32_t i = 0; i < cXmmRegs; i++)
8518 pDst->aXMM[i] = pSrc->aXMM[i];
8519 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8520 * right? */
8521 }
8522
8523 /*
8524 * Commit the memory.
8525 */
8526 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8527 if (rcStrict != VINF_SUCCESS)
8528 return rcStrict;
8529
8530 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8531}
8532
8533
8534/**
8535 * Implements 'FXRSTOR'.
8536 *
8537 * @param iEffSeg The effective segment register for @a GCPtrEff.
8538 * @param GCPtrEff The address of the image.
8539 * @param enmEffOpSize The operand size (only REX.W really matters).
8540 */
8541IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8542{
8543 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8544
8545 /*
8546 * Raise exceptions.
8547 */
8548 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8549 return iemRaiseDeviceNotAvailable(pVCpu);
8550
8551 /*
8552 * Access the memory.
8553 */
8554 void *pvMem512;
8555 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8556 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8557 if (rcStrict != VINF_SUCCESS)
8558 return rcStrict;
8559 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8560 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8561
8562 /*
8563 * Check the state for stuff which will #GP(0).
8564 */
8565 uint32_t const fMXCSR = pSrc->MXCSR;
8566 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8567 if (fMXCSR & ~fMXCSR_MASK)
8568 {
8569 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8570 return iemRaiseGeneralProtectionFault0(pVCpu);
8571 }
8572
8573 /*
8574 * Load the registers.
8575 */
8576 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8577 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
8578
8579 /* common for all formats */
8580 pDst->FCW = pSrc->FCW;
8581 pDst->FSW = pSrc->FSW;
8582 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8583 pDst->FOP = pSrc->FOP;
8584 pDst->MXCSR = fMXCSR;
8585 /* (MXCSR_MASK is read-only) */
8586 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8587 {
8588 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8589 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8590 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8591 pDst->aRegs[i].au32[3] = 0;
8592 }
8593
8594 /* FPU IP, CS, DP and DS. */
8595 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8596 {
8597 pDst->FPUIP = pSrc->FPUIP;
8598 pDst->CS = pSrc->CS;
8599 pDst->Rsrvd1 = pSrc->Rsrvd1;
8600 pDst->FPUDP = pSrc->FPUDP;
8601 pDst->DS = pSrc->DS;
8602 pDst->Rsrvd2 = pSrc->Rsrvd2;
8603 }
8604 else
8605 {
8606 pDst->FPUIP = pSrc->FPUIP;
8607 pDst->CS = pSrc->CS;
8608 pDst->Rsrvd1 = 0;
8609 pDst->FPUDP = pSrc->FPUDP;
8610 pDst->DS = pSrc->DS;
8611 pDst->Rsrvd2 = 0;
8612 }
8613
8614 /* XMM registers. */
8615 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8616 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8617 || pVCpu->iem.s.uCpl != 0)
8618 {
8619 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8620 for (uint32_t i = 0; i < cXmmRegs; i++)
8621 pDst->aXMM[i] = pSrc->aXMM[i];
8622 }
8623
8624 if (pDst->FSW & X86_FSW_ES)
8625 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8626 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8627
8628 /*
8629 * Commit the memory.
8630 */
8631 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8632 if (rcStrict != VINF_SUCCESS)
8633 return rcStrict;
8634
8635 iemHlpUsedFpu(pVCpu);
8636 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8637}
8638
8639
8640/**
8641 * Implements 'XSAVE'.
8642 *
8643 * @param iEffSeg The effective segment.
8644 * @param GCPtrEff The address of the image.
8645 * @param enmEffOpSize The operand size (only REX.W really matters).
8646 */
8647IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8648{
8649 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8650
8651 /*
8652 * Raise exceptions.
8653 */
8654 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8655 return iemRaiseUndefinedOpcode(pVCpu);
8656 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8657 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8658 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8659 {
8660 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8661 return iemRaiseUndefinedOpcode(pVCpu);
8662 }
8663 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8664 return iemRaiseDeviceNotAvailable(pVCpu);
8665
8666 /*
8667 * Calc the requested mask.
8668 */
8669 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8670 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8671 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8672
8673/** @todo figure out the exact protocol for the memory access. Currently we
8674 * just need this crap to work halfways to make it possible to test
8675 * AVX instructions. */
8676/** @todo figure out the XINUSE and XMODIFIED */
8677
8678 /*
8679 * Access the x87 memory state.
8680 */
8681 /* The x87+SSE state. */
8682 void *pvMem512;
8683 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8684 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8685 if (rcStrict != VINF_SUCCESS)
8686 return rcStrict;
8687 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8688 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8689
8690 /* The header. */
8691 PX86XSAVEHDR pHdr;
8692 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
8693 if (rcStrict != VINF_SUCCESS)
8694 return rcStrict;
8695
8696 /*
8697 * Store the X87 state.
8698 */
8699 if (fReqComponents & XSAVE_C_X87)
8700 {
8701 /* common for all formats */
8702 pDst->FCW = pSrc->FCW;
8703 pDst->FSW = pSrc->FSW;
8704 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8705 pDst->FOP = pSrc->FOP;
8706 pDst->FPUIP = pSrc->FPUIP;
8707 pDst->CS = pSrc->CS;
8708 pDst->FPUDP = pSrc->FPUDP;
8709 pDst->DS = pSrc->DS;
8710 if (enmEffOpSize == IEMMODE_64BIT)
8711 {
8712 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8713 pDst->Rsrvd1 = pSrc->Rsrvd1;
8714 pDst->Rsrvd2 = pSrc->Rsrvd2;
8715 }
8716 else
8717 {
8718 pDst->Rsrvd1 = 0;
8719 pDst->Rsrvd2 = 0;
8720 }
8721 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8722 {
8723 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8724 * them for now... */
8725 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8726 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8727 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8728 pDst->aRegs[i].au32[3] = 0;
8729 }
8730
8731 }
8732
8733 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8734 {
8735 pDst->MXCSR = pSrc->MXCSR;
8736 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8737 }
8738
8739 if (fReqComponents & XSAVE_C_SSE)
8740 {
8741 /* XMM registers. */
8742 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8743 for (uint32_t i = 0; i < cXmmRegs; i++)
8744 pDst->aXMM[i] = pSrc->aXMM[i];
8745 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8746 * right? */
8747 }
8748
8749 /* Commit the x87 state bits. (probably wrong) */
8750 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8751 if (rcStrict != VINF_SUCCESS)
8752 return rcStrict;
8753
8754 /*
8755 * Store AVX state.
8756 */
8757 if (fReqComponents & XSAVE_C_YMM)
8758 {
8759 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8760 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8761 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8762 PX86XSAVEYMMHI pCompDst;
8763 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8764 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
8765 if (rcStrict != VINF_SUCCESS)
8766 return rcStrict;
8767
8768 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8769 for (uint32_t i = 0; i < cXmmRegs; i++)
8770 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8771
8772 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8773 if (rcStrict != VINF_SUCCESS)
8774 return rcStrict;
8775 }
8776
8777 /*
8778 * Update the header.
8779 */
8780 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8781 | (fReqComponents & fXInUse);
8782
8783 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8784 if (rcStrict != VINF_SUCCESS)
8785 return rcStrict;
8786
8787 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8788}
8789
8790
8791/**
8792 * Implements 'XRSTOR'.
8793 *
8794 * @param iEffSeg The effective segment.
8795 * @param GCPtrEff The address of the image.
8796 * @param enmEffOpSize The operand size (only REX.W really matters).
8797 */
8798IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8799{
8800 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8801
8802 /*
8803 * Raise exceptions.
8804 */
8805 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8806 return iemRaiseUndefinedOpcode(pVCpu);
8807 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8808 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8809 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8810 {
8811 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8812 return iemRaiseUndefinedOpcode(pVCpu);
8813 }
8814 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8815 return iemRaiseDeviceNotAvailable(pVCpu);
8816 if (GCPtrEff & 63)
8817 {
8818 /** @todo CPU/VM detection possible! \#AC might not be signal for
8819 * all/any misalignment sizes, intel says its an implementation detail. */
8820 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8821 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8822 && pVCpu->iem.s.uCpl == 3)
8823 return iemRaiseAlignmentCheckException(pVCpu);
8824 return iemRaiseGeneralProtectionFault0(pVCpu);
8825 }
8826
8827/** @todo figure out the exact protocol for the memory access. Currently we
8828 * just need this crap to work halfways to make it possible to test
8829 * AVX instructions. */
8830/** @todo figure out the XINUSE and XMODIFIED */
8831
8832 /*
8833 * Access the x87 memory state.
8834 */
8835 /* The x87+SSE state. */
8836 void *pvMem512;
8837 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8838 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8839 if (rcStrict != VINF_SUCCESS)
8840 return rcStrict;
8841 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8842 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8843
8844 /*
8845 * Calc the requested mask
8846 */
8847 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
8848 PCX86XSAVEHDR pHdrSrc;
8849 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
8850 IEM_ACCESS_DATA_R, 0 /* checked above */);
8851 if (rcStrict != VINF_SUCCESS)
8852 return rcStrict;
8853
8854 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8855 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8856 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8857 uint64_t const fRstorMask = pHdrSrc->bmXState;
8858 uint64_t const fCompMask = pHdrSrc->bmXComp;
8859
8860 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8861
8862 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8863
8864 /* We won't need this any longer. */
8865 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8866 if (rcStrict != VINF_SUCCESS)
8867 return rcStrict;
8868
8869 /*
8870 * Store the X87 state.
8871 */
8872 if (fReqComponents & XSAVE_C_X87)
8873 {
8874 if (fRstorMask & XSAVE_C_X87)
8875 {
8876 pDst->FCW = pSrc->FCW;
8877 pDst->FSW = pSrc->FSW;
8878 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8879 pDst->FOP = pSrc->FOP;
8880 pDst->FPUIP = pSrc->FPUIP;
8881 pDst->CS = pSrc->CS;
8882 pDst->FPUDP = pSrc->FPUDP;
8883 pDst->DS = pSrc->DS;
8884 if (enmEffOpSize == IEMMODE_64BIT)
8885 {
8886 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8887 pDst->Rsrvd1 = pSrc->Rsrvd1;
8888 pDst->Rsrvd2 = pSrc->Rsrvd2;
8889 }
8890 else
8891 {
8892 pDst->Rsrvd1 = 0;
8893 pDst->Rsrvd2 = 0;
8894 }
8895 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8896 {
8897 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8898 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8899 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8900 pDst->aRegs[i].au32[3] = 0;
8901 }
8902 if (pDst->FSW & X86_FSW_ES)
8903 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8904 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8905 }
8906 else
8907 {
8908 pDst->FCW = 0x37f;
8909 pDst->FSW = 0;
8910 pDst->FTW = 0x00; /* 0 - empty. */
8911 pDst->FPUDP = 0;
8912 pDst->DS = 0; //??
8913 pDst->Rsrvd2= 0;
8914 pDst->FPUIP = 0;
8915 pDst->CS = 0; //??
8916 pDst->Rsrvd1= 0;
8917 pDst->FOP = 0;
8918 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8919 {
8920 pDst->aRegs[i].au32[0] = 0;
8921 pDst->aRegs[i].au32[1] = 0;
8922 pDst->aRegs[i].au32[2] = 0;
8923 pDst->aRegs[i].au32[3] = 0;
8924 }
8925 }
8926 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
8927 }
8928
8929 /* MXCSR */
8930 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8931 {
8932 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
8933 pDst->MXCSR = pSrc->MXCSR;
8934 else
8935 pDst->MXCSR = 0x1f80;
8936 }
8937
8938 /* XMM registers. */
8939 if (fReqComponents & XSAVE_C_SSE)
8940 {
8941 if (fRstorMask & XSAVE_C_SSE)
8942 {
8943 for (uint32_t i = 0; i < cXmmRegs; i++)
8944 pDst->aXMM[i] = pSrc->aXMM[i];
8945 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8946 * right? */
8947 }
8948 else
8949 {
8950 for (uint32_t i = 0; i < cXmmRegs; i++)
8951 {
8952 pDst->aXMM[i].au64[0] = 0;
8953 pDst->aXMM[i].au64[1] = 0;
8954 }
8955 }
8956 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
8957 }
8958
8959 /* Unmap the x87 state bits (so we've don't run out of mapping). */
8960 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8961 if (rcStrict != VINF_SUCCESS)
8962 return rcStrict;
8963
8964 /*
8965 * Restore AVX state.
8966 */
8967 if (fReqComponents & XSAVE_C_YMM)
8968 {
8969 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8970 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
8971
8972 if (fRstorMask & XSAVE_C_YMM)
8973 {
8974 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8975 PCX86XSAVEYMMHI pCompSrc;
8976 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
8977 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8978 IEM_ACCESS_DATA_R, 0 /* checked above */);
8979 if (rcStrict != VINF_SUCCESS)
8980 return rcStrict;
8981
8982 for (uint32_t i = 0; i < cXmmRegs; i++)
8983 {
8984 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
8985 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
8986 }
8987
8988 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
8989 if (rcStrict != VINF_SUCCESS)
8990 return rcStrict;
8991 }
8992 else
8993 {
8994 for (uint32_t i = 0; i < cXmmRegs; i++)
8995 {
8996 pCompDst->aYmmHi[i].au64[0] = 0;
8997 pCompDst->aYmmHi[i].au64[1] = 0;
8998 }
8999 }
9000 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9001 }
9002
9003 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9004}
9005
9006
9007
9008
9009/**
9010 * Implements 'STMXCSR'.
9011 *
9012 * @param iEffSeg The effective segment register for @a GCPtrEff.
9013 * @param GCPtrEff The address of the image.
9014 */
9015IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9016{
9017 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9018
9019 /*
9020 * Raise exceptions.
9021 */
9022 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9023 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9024 {
9025 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9026 {
9027 /*
9028 * Do the job.
9029 */
9030 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9031 if (rcStrict == VINF_SUCCESS)
9032 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9033 return rcStrict;
9034 }
9035 return iemRaiseDeviceNotAvailable(pVCpu);
9036 }
9037 return iemRaiseUndefinedOpcode(pVCpu);
9038}
9039
9040
9041/**
9042 * Implements 'VSTMXCSR'.
9043 *
9044 * @param iEffSeg The effective segment register for @a GCPtrEff.
9045 * @param GCPtrEff The address of the image.
9046 */
9047IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9048{
9049 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9050
9051 /*
9052 * Raise exceptions.
9053 */
9054 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9055 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9056 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9057 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9058 {
9059 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9060 {
9061 /*
9062 * Do the job.
9063 */
9064 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9065 if (rcStrict == VINF_SUCCESS)
9066 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9067 return rcStrict;
9068 }
9069 return iemRaiseDeviceNotAvailable(pVCpu);
9070 }
9071 return iemRaiseUndefinedOpcode(pVCpu);
9072}
9073
9074
9075/**
9076 * Implements 'LDMXCSR'.
9077 *
9078 * @param iEffSeg The effective segment register for @a GCPtrEff.
9079 * @param GCPtrEff The address of the image.
9080 */
9081IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9082{
9083 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9084
9085 /*
9086 * Raise exceptions.
9087 */
9088 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9089 * happen after or before \#UD and \#EM? */
9090 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9091 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9092 {
9093 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9094 {
9095 /*
9096 * Do the job.
9097 */
9098 uint32_t fNewMxCsr;
9099 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9100 if (rcStrict == VINF_SUCCESS)
9101 {
9102 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9103 if (!(fNewMxCsr & ~fMxCsrMask))
9104 {
9105 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9106 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9107 }
9108 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9109 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9110 return iemRaiseGeneralProtectionFault0(pVCpu);
9111 }
9112 return rcStrict;
9113 }
9114 return iemRaiseDeviceNotAvailable(pVCpu);
9115 }
9116 return iemRaiseUndefinedOpcode(pVCpu);
9117}
9118
9119
9120/**
9121 * Commmon routine for fnstenv and fnsave.
9122 *
9123 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9124 * @param enmEffOpSize The effective operand size.
9125 * @param uPtr Where to store the state.
9126 */
9127static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9128{
9129 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9130 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9131 if (enmEffOpSize == IEMMODE_16BIT)
9132 {
9133 uPtr.pu16[0] = pSrcX87->FCW;
9134 uPtr.pu16[1] = pSrcX87->FSW;
9135 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9136 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9137 {
9138 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9139 * protected mode or long mode and we save it in real mode? And vice
9140 * versa? And with 32-bit operand size? I think CPU is storing the
9141 * effective address ((CS << 4) + IP) in the offset register and not
9142 * doing any address calculations here. */
9143 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9144 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9145 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9146 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9147 }
9148 else
9149 {
9150 uPtr.pu16[3] = pSrcX87->FPUIP;
9151 uPtr.pu16[4] = pSrcX87->CS;
9152 uPtr.pu16[5] = pSrcX87->FPUDP;
9153 uPtr.pu16[6] = pSrcX87->DS;
9154 }
9155 }
9156 else
9157 {
9158 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9159 uPtr.pu16[0*2] = pSrcX87->FCW;
9160 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9161 uPtr.pu16[1*2] = pSrcX87->FSW;
9162 uPtr.pu16[1*2+1] = 0xffff;
9163 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9164 uPtr.pu16[2*2+1] = 0xffff;
9165 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9166 {
9167 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9168 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9169 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9170 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9171 }
9172 else
9173 {
9174 uPtr.pu32[3] = pSrcX87->FPUIP;
9175 uPtr.pu16[4*2] = pSrcX87->CS;
9176 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9177 uPtr.pu32[5] = pSrcX87->FPUDP;
9178 uPtr.pu16[6*2] = pSrcX87->DS;
9179 uPtr.pu16[6*2+1] = 0xffff;
9180 }
9181 }
9182}
9183
9184
9185/**
9186 * Commmon routine for fldenv and frstor
9187 *
9188 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9189 * @param enmEffOpSize The effective operand size.
9190 * @param uPtr Where to store the state.
9191 */
9192static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9193{
9194 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9195 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9196 if (enmEffOpSize == IEMMODE_16BIT)
9197 {
9198 pDstX87->FCW = uPtr.pu16[0];
9199 pDstX87->FSW = uPtr.pu16[1];
9200 pDstX87->FTW = uPtr.pu16[2];
9201 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9202 {
9203 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9204 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9205 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9206 pDstX87->CS = 0;
9207 pDstX87->Rsrvd1= 0;
9208 pDstX87->DS = 0;
9209 pDstX87->Rsrvd2= 0;
9210 }
9211 else
9212 {
9213 pDstX87->FPUIP = uPtr.pu16[3];
9214 pDstX87->CS = uPtr.pu16[4];
9215 pDstX87->Rsrvd1= 0;
9216 pDstX87->FPUDP = uPtr.pu16[5];
9217 pDstX87->DS = uPtr.pu16[6];
9218 pDstX87->Rsrvd2= 0;
9219 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9220 }
9221 }
9222 else
9223 {
9224 pDstX87->FCW = uPtr.pu16[0*2];
9225 pDstX87->FSW = uPtr.pu16[1*2];
9226 pDstX87->FTW = uPtr.pu16[2*2];
9227 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9228 {
9229 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9230 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9231 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9232 pDstX87->CS = 0;
9233 pDstX87->Rsrvd1= 0;
9234 pDstX87->DS = 0;
9235 pDstX87->Rsrvd2= 0;
9236 }
9237 else
9238 {
9239 pDstX87->FPUIP = uPtr.pu32[3];
9240 pDstX87->CS = uPtr.pu16[4*2];
9241 pDstX87->Rsrvd1= 0;
9242 pDstX87->FOP = uPtr.pu16[4*2+1];
9243 pDstX87->FPUDP = uPtr.pu32[5];
9244 pDstX87->DS = uPtr.pu16[6*2];
9245 pDstX87->Rsrvd2= 0;
9246 }
9247 }
9248
9249 /* Make adjustments. */
9250 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9251#ifdef LOG_ENABLED
9252 uint16_t const fOldFsw = pDstX87->FSW;
9253#endif
9254 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
9255 iemFpuRecalcExceptionStatus(pDstX87);
9256#ifdef LOG_ENABLED
9257 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9258 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9259 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9260 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9261#endif
9262
9263 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9264 * exceptions are pending after loading the saved state? */
9265}
9266
9267
9268/**
9269 * Implements 'FNSTENV'.
9270 *
9271 * @param enmEffOpSize The operand size (only REX.W really matters).
9272 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9273 * @param GCPtrEffDst The address of the image.
9274 */
9275IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9276{
9277 RTPTRUNION uPtr;
9278 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9279 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9280 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9281 if (rcStrict != VINF_SUCCESS)
9282 return rcStrict;
9283
9284 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9285
9286 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9287 if (rcStrict != VINF_SUCCESS)
9288 return rcStrict;
9289
9290 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9291 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9292 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9293#ifdef LOG_ENABLED
9294 uint16_t fOldFsw = pFpuCtx->FSW;
9295#endif
9296 iemFpuRecalcExceptionStatus(pFpuCtx);
9297#ifdef LOG_ENABLED
9298 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9299 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9300 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9301#endif
9302
9303 iemHlpUsedFpu(pVCpu);
9304
9305 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9306 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9307}
9308
9309
9310/**
9311 * Implements 'FNSAVE'.
9312 *
9313 * @param enmEffOpSize The operand size.
9314 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9315 * @param GCPtrEffDst The address of the image.
9316 */
9317IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9318{
9319 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9320
9321 RTPTRUNION uPtr;
9322 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9323 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9324 if (rcStrict != VINF_SUCCESS)
9325 return rcStrict;
9326
9327 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9328 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9329 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9330 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9331 {
9332 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9333 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9334 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9335 }
9336
9337 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
9338 if (rcStrict != VINF_SUCCESS)
9339 return rcStrict;
9340
9341 /* Rotate the stack to account for changed TOS. */
9342 iemFpuRotateStackSetTop(pFpuCtx, 0);
9343
9344 /*
9345 * Re-initialize the FPU context.
9346 */
9347 pFpuCtx->FCW = 0x37f;
9348 pFpuCtx->FSW = 0;
9349 pFpuCtx->FTW = 0x00; /* 0 - empty */
9350 pFpuCtx->FPUDP = 0;
9351 pFpuCtx->DS = 0;
9352 pFpuCtx->Rsrvd2= 0;
9353 pFpuCtx->FPUIP = 0;
9354 pFpuCtx->CS = 0;
9355 pFpuCtx->Rsrvd1= 0;
9356 pFpuCtx->FOP = 0;
9357
9358 iemHlpUsedFpu(pVCpu);
9359 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9360}
9361
9362
9363
9364/**
9365 * Implements 'FLDENV'.
9366 *
9367 * @param enmEffOpSize The operand size (only REX.W really matters).
9368 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9369 * @param GCPtrEffSrc The address of the image.
9370 */
9371IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9372{
9373 RTCPTRUNION uPtr;
9374 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9375 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9376 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9377 if (rcStrict != VINF_SUCCESS)
9378 return rcStrict;
9379
9380 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9381
9382 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9383 if (rcStrict != VINF_SUCCESS)
9384 return rcStrict;
9385
9386 iemHlpUsedFpu(pVCpu);
9387 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9388}
9389
9390
9391/**
9392 * Implements 'FRSTOR'.
9393 *
9394 * @param enmEffOpSize The operand size.
9395 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9396 * @param GCPtrEffSrc The address of the image.
9397 */
9398IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9399{
9400 RTCPTRUNION uPtr;
9401 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9402 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9403 if (rcStrict != VINF_SUCCESS)
9404 return rcStrict;
9405
9406 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9407 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9408 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9409 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9410 {
9411 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9412 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9413 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9414 pFpuCtx->aRegs[i].au32[3] = 0;
9415 }
9416
9417 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
9418 if (rcStrict != VINF_SUCCESS)
9419 return rcStrict;
9420
9421 iemHlpUsedFpu(pVCpu);
9422 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9423}
9424
9425
9426/**
9427 * Implements 'FLDCW'.
9428 *
9429 * @param u16Fcw The new FCW.
9430 */
9431IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9432{
9433 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9434
9435 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9436 /** @todo Testcase: Try see what happens when trying to set undefined bits
9437 * (other than 6 and 7). Currently ignoring them. */
9438 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9439 * according to FSW. (This is what is currently implemented.) */
9440 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9441 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
9442#ifdef LOG_ENABLED
9443 uint16_t fOldFsw = pFpuCtx->FSW;
9444#endif
9445 iemFpuRecalcExceptionStatus(pFpuCtx);
9446#ifdef LOG_ENABLED
9447 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9448 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9449 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9450#endif
9451
9452 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9453 iemHlpUsedFpu(pVCpu);
9454 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9455}
9456
9457
9458
9459/**
9460 * Implements the underflow case of fxch.
9461 *
9462 * @param iStReg The other stack register.
9463 */
9464IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
9465{
9466 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9467
9468 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9469 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9470 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9471 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9472
9473 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9474 * registers are read as QNaN and then exchanged. This could be
9475 * wrong... */
9476 if (pFpuCtx->FCW & X86_FCW_IM)
9477 {
9478 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9479 {
9480 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9481 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9482 else
9483 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9484 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9485 }
9486 else
9487 {
9488 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9489 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9490 }
9491 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9492 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9493 }
9494 else
9495 {
9496 /* raise underflow exception, don't change anything. */
9497 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9498 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9499 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9500 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9501 }
9502
9503 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9504 iemHlpUsedFpu(pVCpu);
9505 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9506}
9507
9508
9509/**
9510 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9511 *
9512 * @param iStReg The other stack register.
9513 * @param pfnAImpl The assembly comparison implementation.
9514 * @param fPop Whether we should pop the stack when done or not.
9515 */
9516IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9517{
9518 Assert(iStReg < 8);
9519 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9520
9521 /*
9522 * Raise exceptions.
9523 */
9524 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9525 return iemRaiseDeviceNotAvailable(pVCpu);
9526
9527 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9528 uint16_t u16Fsw = pFpuCtx->FSW;
9529 if (u16Fsw & X86_FSW_ES)
9530 return iemRaiseMathFault(pVCpu);
9531
9532 /*
9533 * Check if any of the register accesses causes #SF + #IA.
9534 */
9535 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9536 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9537 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9538 {
9539 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9540
9541 pFpuCtx->FSW &= ~X86_FSW_C1;
9542 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9543 if ( !(u16Fsw & X86_FSW_IE)
9544 || (pFpuCtx->FCW & X86_FCW_IM) )
9545 {
9546 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9547 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9548 }
9549 }
9550 else if (pFpuCtx->FCW & X86_FCW_IM)
9551 {
9552 /* Masked underflow. */
9553 pFpuCtx->FSW &= ~X86_FSW_C1;
9554 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9555 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9556 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9557 }
9558 else
9559 {
9560 /* Raise underflow - don't touch EFLAGS or TOP. */
9561 pFpuCtx->FSW &= ~X86_FSW_C1;
9562 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9563 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
9564 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9565 fPop = false;
9566 }
9567
9568 /*
9569 * Pop if necessary.
9570 */
9571 if (fPop)
9572 {
9573 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9574 iemFpuStackIncTop(pVCpu);
9575 }
9576
9577 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9578 iemHlpUsedFpu(pVCpu);
9579 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9580}
9581
9582/** @} */
9583
注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette