VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 62076

Last change on this file since 62076 was 62076, checked in by vboxsync, 9 years ago

IEM: Make use of the direct CPUMCTX access (VMCPU_INCL_CPUM_GST_CTX).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 236.8 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 62076 2016-07-06 16:37:04Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.215389.xyz. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/** @name Misc Helpers
19 * @{
20 */
21
22
23/**
24 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
25 *
26 * @returns Strict VBox status code.
27 *
28 * @param pVCpu The cross context virtual CPU structure of the calling thread.
29 * @param pCtx The register context.
30 * @param u16Port The port number.
31 * @param cbOperand The operand size.
32 */
33static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34{
35 /* The TSS bits we're interested in are the same on 386 and AMD64. */
36 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41 /*
42 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43 */
44 Assert(!pCtx->tr.Attr.n.u1DescType);
45 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47 {
48 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50 return iemRaiseGeneralProtectionFault0(pVCpu);
51 }
52
53 /*
54 * Read the bitmap offset (may #PF).
55 */
56 uint16_t offBitmap;
57 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
58 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59 if (rcStrict != VINF_SUCCESS)
60 {
61 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62 return rcStrict;
63 }
64
65 /*
66 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67 * describes the CPU actually reading two bytes regardless of whether the
68 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
69 */
70 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
72 * for instance sizeof(X86TSS32). */
73 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74 {
75 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76 offFirstBit, pCtx->tr.u32Limit));
77 return iemRaiseGeneralProtectionFault0(pVCpu);
78 }
79
80 /*
81 * Read the necessary bits.
82 */
83 /** @todo Test the assertion in the intel manual that the CPU reads two
84 * bytes. The question is how this works wrt to #PF and #GP on the
85 * 2nd byte when it's not required. */
86 uint16_t bmBytes = UINT16_MAX;
87 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88 if (rcStrict != VINF_SUCCESS)
89 {
90 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91 return rcStrict;
92 }
93
94 /*
95 * Perform the check.
96 */
97 uint16_t fPortMask = (1 << cbOperand) - 1;
98 bmBytes >>= (u16Port & 7);
99 if (bmBytes & fPortMask)
100 {
101 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102 u16Port, cbOperand, bmBytes, fPortMask));
103 return iemRaiseGeneralProtectionFault0(pVCpu);
104 }
105
106 return VINF_SUCCESS;
107}
108
109
110/**
111 * Checks if we are allowed to access the given I/O port, raising the
112 * appropriate exceptions if we aren't (or if the I/O bitmap is not
113 * accessible).
114 *
115 * @returns Strict VBox status code.
116 *
117 * @param pVCpu The cross context virtual CPU structure of the calling thread.
118 * @param pCtx The register context.
119 * @param u16Port The port number.
120 * @param cbOperand The operand size.
121 */
122DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123{
124 X86EFLAGS Efl;
125 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
126 if ( (pCtx->cr0 & X86_CR0_PE)
127 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
128 || Efl.Bits.u1VM) )
129 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
130 return VINF_SUCCESS;
131}
132
133
134#if 0
135/**
136 * Calculates the parity bit.
137 *
138 * @returns true if the bit is set, false if not.
139 * @param u8Result The least significant byte of the result.
140 */
141static bool iemHlpCalcParityFlag(uint8_t u8Result)
142{
143 /*
144 * Parity is set if the number of bits in the least significant byte of
145 * the result is even.
146 */
147 uint8_t cBits;
148 cBits = u8Result & 1; /* 0 */
149 u8Result >>= 1;
150 cBits += u8Result & 1;
151 u8Result >>= 1;
152 cBits += u8Result & 1;
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1; /* 4 */
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1;
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 return !(cBits & 1);
164}
165#endif /* not used */
166
167
168/**
169 * Updates the specified flags according to a 8-bit result.
170 *
171 * @param pVCpu The cross context virtual CPU structure of the calling thread.
172 * @param u8Result The result to set the flags according to.
173 * @param fToUpdate The flags to update.
174 * @param fUndefined The flags that are specified as undefined.
175 */
176static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177{
178 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
179
180 uint32_t fEFlags = pCtx->eflags.u;
181 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
183 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
184#ifdef IEM_VERIFICATION_MODE_FULL
185 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
186#endif
187}
188
189
190/**
191 * Helper used by iret.
192 *
193 * @param uCpl The new CPL.
194 * @param pSReg Pointer to the segment register.
195 */
196static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
197{
198#ifdef VBOX_WITH_RAW_MODE_NOT_R0
199 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
200 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
201#else
202 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
203#endif
204
205 if ( uCpl > pSReg->Attr.n.u2Dpl
206 && pSReg->Attr.n.u1DescType /* code or data, not system */
207 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
208 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
209 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
210}
211
212
213/**
214 * Indicates that we have modified the FPU state.
215 *
216 * @param pVCpu The cross context virtual CPU structure of the calling thread.
217 */
218DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
219{
220 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
221}
222
223/** @} */
224
225/** @name C Implementations
226 * @{
227 */
228
229/**
230 * Implements a 16-bit popa.
231 */
232IEM_CIMPL_DEF_0(iemCImpl_popa_16)
233{
234 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
235 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
236 RTGCPTR GCPtrLast = GCPtrStart + 15;
237 VBOXSTRICTRC rcStrict;
238
239 /*
240 * The docs are a bit hard to comprehend here, but it looks like we wrap
241 * around in real mode as long as none of the individual "popa" crosses the
242 * end of the stack segment. In protected mode we check the whole access
243 * in one go. For efficiency, only do the word-by-word thing if we're in
244 * danger of wrapping around.
245 */
246 /** @todo do popa boundary / wrap-around checks. */
247 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
248 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
249 {
250 /* word-by-word */
251 RTUINT64U TmpRsp;
252 TmpRsp.u = pCtx->rsp;
253 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
254 if (rcStrict == VINF_SUCCESS)
255 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
256 if (rcStrict == VINF_SUCCESS)
257 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
258 if (rcStrict == VINF_SUCCESS)
259 {
260 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
261 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
262 }
263 if (rcStrict == VINF_SUCCESS)
264 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
265 if (rcStrict == VINF_SUCCESS)
266 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
267 if (rcStrict == VINF_SUCCESS)
268 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
269 if (rcStrict == VINF_SUCCESS)
270 {
271 pCtx->rsp = TmpRsp.u;
272 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
273 }
274 }
275 else
276 {
277 uint16_t const *pa16Mem = NULL;
278 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
279 if (rcStrict == VINF_SUCCESS)
280 {
281 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
282 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
283 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
284 /* skip sp */
285 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
286 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
287 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
288 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
289 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
290 if (rcStrict == VINF_SUCCESS)
291 {
292 iemRegAddToRsp(pVCpu, pCtx, 16);
293 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
294 }
295 }
296 }
297 return rcStrict;
298}
299
300
301/**
302 * Implements a 32-bit popa.
303 */
304IEM_CIMPL_DEF_0(iemCImpl_popa_32)
305{
306 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
307 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
308 RTGCPTR GCPtrLast = GCPtrStart + 31;
309 VBOXSTRICTRC rcStrict;
310
311 /*
312 * The docs are a bit hard to comprehend here, but it looks like we wrap
313 * around in real mode as long as none of the individual "popa" crosses the
314 * end of the stack segment. In protected mode we check the whole access
315 * in one go. For efficiency, only do the word-by-word thing if we're in
316 * danger of wrapping around.
317 */
318 /** @todo do popa boundary / wrap-around checks. */
319 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
320 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
321 {
322 /* word-by-word */
323 RTUINT64U TmpRsp;
324 TmpRsp.u = pCtx->rsp;
325 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
326 if (rcStrict == VINF_SUCCESS)
327 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
328 if (rcStrict == VINF_SUCCESS)
329 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
330 if (rcStrict == VINF_SUCCESS)
331 {
332 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
333 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
334 }
335 if (rcStrict == VINF_SUCCESS)
336 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
337 if (rcStrict == VINF_SUCCESS)
338 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
339 if (rcStrict == VINF_SUCCESS)
340 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
341 if (rcStrict == VINF_SUCCESS)
342 {
343#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
344 pCtx->rdi &= UINT32_MAX;
345 pCtx->rsi &= UINT32_MAX;
346 pCtx->rbp &= UINT32_MAX;
347 pCtx->rbx &= UINT32_MAX;
348 pCtx->rdx &= UINT32_MAX;
349 pCtx->rcx &= UINT32_MAX;
350 pCtx->rax &= UINT32_MAX;
351#endif
352 pCtx->rsp = TmpRsp.u;
353 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
354 }
355 }
356 else
357 {
358 uint32_t const *pa32Mem;
359 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
360 if (rcStrict == VINF_SUCCESS)
361 {
362 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
363 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
364 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
365 /* skip esp */
366 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
367 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
368 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
369 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
370 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
371 if (rcStrict == VINF_SUCCESS)
372 {
373 iemRegAddToRsp(pVCpu, pCtx, 32);
374 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
375 }
376 }
377 }
378 return rcStrict;
379}
380
381
382/**
383 * Implements a 16-bit pusha.
384 */
385IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
386{
387 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
388 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
389 RTGCPTR GCPtrBottom = GCPtrTop - 15;
390 VBOXSTRICTRC rcStrict;
391
392 /*
393 * The docs are a bit hard to comprehend here, but it looks like we wrap
394 * around in real mode as long as none of the individual "pushd" crosses the
395 * end of the stack segment. In protected mode we check the whole access
396 * in one go. For efficiency, only do the word-by-word thing if we're in
397 * danger of wrapping around.
398 */
399 /** @todo do pusha boundary / wrap-around checks. */
400 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
401 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
402 {
403 /* word-by-word */
404 RTUINT64U TmpRsp;
405 TmpRsp.u = pCtx->rsp;
406 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
407 if (rcStrict == VINF_SUCCESS)
408 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
409 if (rcStrict == VINF_SUCCESS)
410 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
411 if (rcStrict == VINF_SUCCESS)
412 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
413 if (rcStrict == VINF_SUCCESS)
414 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
415 if (rcStrict == VINF_SUCCESS)
416 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
417 if (rcStrict == VINF_SUCCESS)
418 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
419 if (rcStrict == VINF_SUCCESS)
420 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
421 if (rcStrict == VINF_SUCCESS)
422 {
423 pCtx->rsp = TmpRsp.u;
424 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
425 }
426 }
427 else
428 {
429 GCPtrBottom--;
430 uint16_t *pa16Mem = NULL;
431 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
432 if (rcStrict == VINF_SUCCESS)
433 {
434 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
435 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
436 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
437 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
438 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
439 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
440 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
441 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
442 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
443 if (rcStrict == VINF_SUCCESS)
444 {
445 iemRegSubFromRsp(pVCpu, pCtx, 16);
446 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
447 }
448 }
449 }
450 return rcStrict;
451}
452
453
454/**
455 * Implements a 32-bit pusha.
456 */
457IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
458{
459 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
460 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
461 RTGCPTR GCPtrBottom = GCPtrTop - 31;
462 VBOXSTRICTRC rcStrict;
463
464 /*
465 * The docs are a bit hard to comprehend here, but it looks like we wrap
466 * around in real mode as long as none of the individual "pusha" crosses the
467 * end of the stack segment. In protected mode we check the whole access
468 * in one go. For efficiency, only do the word-by-word thing if we're in
469 * danger of wrapping around.
470 */
471 /** @todo do pusha boundary / wrap-around checks. */
472 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
473 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
474 {
475 /* word-by-word */
476 RTUINT64U TmpRsp;
477 TmpRsp.u = pCtx->rsp;
478 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
479 if (rcStrict == VINF_SUCCESS)
480 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
481 if (rcStrict == VINF_SUCCESS)
482 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
483 if (rcStrict == VINF_SUCCESS)
484 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
485 if (rcStrict == VINF_SUCCESS)
486 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
487 if (rcStrict == VINF_SUCCESS)
488 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
489 if (rcStrict == VINF_SUCCESS)
490 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
491 if (rcStrict == VINF_SUCCESS)
492 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
493 if (rcStrict == VINF_SUCCESS)
494 {
495 pCtx->rsp = TmpRsp.u;
496 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
497 }
498 }
499 else
500 {
501 GCPtrBottom--;
502 uint32_t *pa32Mem;
503 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
504 if (rcStrict == VINF_SUCCESS)
505 {
506 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
507 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
508 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
509 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
510 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
511 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
512 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
513 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
514 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
515 if (rcStrict == VINF_SUCCESS)
516 {
517 iemRegSubFromRsp(pVCpu, pCtx, 32);
518 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
519 }
520 }
521 }
522 return rcStrict;
523}
524
525
526/**
527 * Implements pushf.
528 *
529 *
530 * @param enmEffOpSize The effective operand size.
531 */
532IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
533{
534 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
535
536 /*
537 * If we're in V8086 mode some care is required (which is why we're in
538 * doing this in a C implementation).
539 */
540 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
541 if ( (fEfl & X86_EFL_VM)
542 && X86_EFL_GET_IOPL(fEfl) != 3 )
543 {
544 Assert(pCtx->cr0 & X86_CR0_PE);
545 if ( enmEffOpSize != IEMMODE_16BIT
546 || !(pCtx->cr4 & X86_CR4_VME))
547 return iemRaiseGeneralProtectionFault0(pVCpu);
548 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
549 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
550 return iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
551 }
552
553 /*
554 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
555 */
556 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
557
558 VBOXSTRICTRC rcStrict;
559 switch (enmEffOpSize)
560 {
561 case IEMMODE_16BIT:
562 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
563 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
564 fEfl |= UINT16_C(0xf000);
565 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
566 break;
567 case IEMMODE_32BIT:
568 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
569 break;
570 case IEMMODE_64BIT:
571 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
572 break;
573 IEM_NOT_REACHED_DEFAULT_CASE_RET();
574 }
575 if (rcStrict != VINF_SUCCESS)
576 return rcStrict;
577
578 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
579 return VINF_SUCCESS;
580}
581
582
583/**
584 * Implements popf.
585 *
586 * @param enmEffOpSize The effective operand size.
587 */
588IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
589{
590 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
591 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
592 VBOXSTRICTRC rcStrict;
593 uint32_t fEflNew;
594
595 /*
596 * V8086 is special as usual.
597 */
598 if (fEflOld & X86_EFL_VM)
599 {
600 /*
601 * Almost anything goes if IOPL is 3.
602 */
603 if (X86_EFL_GET_IOPL(fEflOld) == 3)
604 {
605 switch (enmEffOpSize)
606 {
607 case IEMMODE_16BIT:
608 {
609 uint16_t u16Value;
610 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
611 if (rcStrict != VINF_SUCCESS)
612 return rcStrict;
613 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
614 break;
615 }
616 case IEMMODE_32BIT:
617 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
618 if (rcStrict != VINF_SUCCESS)
619 return rcStrict;
620 break;
621 IEM_NOT_REACHED_DEFAULT_CASE_RET();
622 }
623
624 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
625 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
626 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
627 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
628 }
629 /*
630 * Interrupt flag virtualization with CR4.VME=1.
631 */
632 else if ( enmEffOpSize == IEMMODE_16BIT
633 && (pCtx->cr4 & X86_CR4_VME) )
634 {
635 uint16_t u16Value;
636 RTUINT64U TmpRsp;
637 TmpRsp.u = pCtx->rsp;
638 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
639 if (rcStrict != VINF_SUCCESS)
640 return rcStrict;
641
642 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
643 * or before? */
644 if ( ( (u16Value & X86_EFL_IF)
645 && (fEflOld & X86_EFL_VIP))
646 || (u16Value & X86_EFL_TF) )
647 return iemRaiseGeneralProtectionFault0(pVCpu);
648
649 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
650 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
651 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
652 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
653
654 pCtx->rsp = TmpRsp.u;
655 }
656 else
657 return iemRaiseGeneralProtectionFault0(pVCpu);
658
659 }
660 /*
661 * Not in V8086 mode.
662 */
663 else
664 {
665 /* Pop the flags. */
666 switch (enmEffOpSize)
667 {
668 case IEMMODE_16BIT:
669 {
670 uint16_t u16Value;
671 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
672 if (rcStrict != VINF_SUCCESS)
673 return rcStrict;
674 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
675
676 /*
677 * Ancient CPU adjustments:
678 * - 8086, 80186, V20/30:
679 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
680 * practical reasons (masking below). We add them when pushing flags.
681 * - 80286:
682 * The NT and IOPL flags cannot be popped from real mode and are
683 * therefore always zero (since a 286 can never exit from PM and
684 * their initial value is zero). This changed on a 386 and can
685 * therefore be used to detect 286 or 386 CPU in real mode.
686 */
687 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
688 && !(pCtx->cr0 & X86_CR0_PE) )
689 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
690 break;
691 }
692 case IEMMODE_32BIT:
693 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
694 if (rcStrict != VINF_SUCCESS)
695 return rcStrict;
696 break;
697 case IEMMODE_64BIT:
698 {
699 uint64_t u64Value;
700 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
701 if (rcStrict != VINF_SUCCESS)
702 return rcStrict;
703 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
704 break;
705 }
706 IEM_NOT_REACHED_DEFAULT_CASE_RET();
707 }
708
709 /* Merge them with the current flags. */
710 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
711 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
712 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
713 || pVCpu->iem.s.uCpl == 0)
714 {
715 fEflNew &= fPopfBits;
716 fEflNew |= ~fPopfBits & fEflOld;
717 }
718 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
719 {
720 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
721 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
722 }
723 else
724 {
725 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
726 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
727 }
728 }
729
730 /*
731 * Commit the flags.
732 */
733 Assert(fEflNew & RT_BIT_32(1));
734 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
735 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
736
737 return VINF_SUCCESS;
738}
739
740
741/**
742 * Implements an indirect call.
743 *
744 * @param uNewPC The new program counter (RIP) value (loaded from the
745 * operand).
746 * @param enmEffOpSize The effective operand size.
747 */
748IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
749{
750 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
751 uint16_t uOldPC = pCtx->ip + cbInstr;
752 if (uNewPC > pCtx->cs.u32Limit)
753 return iemRaiseGeneralProtectionFault0(pVCpu);
754
755 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
756 if (rcStrict != VINF_SUCCESS)
757 return rcStrict;
758
759 pCtx->rip = uNewPC;
760 pCtx->eflags.Bits.u1RF = 0;
761
762 /* Flush the prefetch buffer. */
763 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
764 return VINF_SUCCESS;
765}
766
767
768/**
769 * Implements a 16-bit relative call.
770 *
771 * @param offDisp The displacment offset.
772 */
773IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
774{
775 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
776 uint16_t uOldPC = pCtx->ip + cbInstr;
777 uint16_t uNewPC = uOldPC + offDisp;
778 if (uNewPC > pCtx->cs.u32Limit)
779 return iemRaiseGeneralProtectionFault0(pVCpu);
780
781 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
782 if (rcStrict != VINF_SUCCESS)
783 return rcStrict;
784
785 pCtx->rip = uNewPC;
786 pCtx->eflags.Bits.u1RF = 0;
787
788 /* Flush the prefetch buffer. */
789 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
790 return VINF_SUCCESS;
791}
792
793
794/**
795 * Implements a 32-bit indirect call.
796 *
797 * @param uNewPC The new program counter (RIP) value (loaded from the
798 * operand).
799 * @param enmEffOpSize The effective operand size.
800 */
801IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
802{
803 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
804 uint32_t uOldPC = pCtx->eip + cbInstr;
805 if (uNewPC > pCtx->cs.u32Limit)
806 return iemRaiseGeneralProtectionFault0(pVCpu);
807
808 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
809 if (rcStrict != VINF_SUCCESS)
810 return rcStrict;
811
812#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
813 /*
814 * CASM hook for recording interesting indirect calls.
815 */
816 if ( !pCtx->eflags.Bits.u1IF
817 && (pCtx->cr0 & X86_CR0_PG)
818 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
819 && pVCpu->iem.s.uCpl == 0)
820 {
821 EMSTATE enmState = EMGetState(pVCpu);
822 if ( enmState == EMSTATE_IEM_THEN_REM
823 || enmState == EMSTATE_IEM
824 || enmState == EMSTATE_REM)
825 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
826 }
827#endif
828
829 pCtx->rip = uNewPC;
830 pCtx->eflags.Bits.u1RF = 0;
831
832 /* Flush the prefetch buffer. */
833 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
834 return VINF_SUCCESS;
835}
836
837
838/**
839 * Implements a 32-bit relative call.
840 *
841 * @param offDisp The displacment offset.
842 */
843IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
844{
845 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
846 uint32_t uOldPC = pCtx->eip + cbInstr;
847 uint32_t uNewPC = uOldPC + offDisp;
848 if (uNewPC > pCtx->cs.u32Limit)
849 return iemRaiseGeneralProtectionFault0(pVCpu);
850
851 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
852 if (rcStrict != VINF_SUCCESS)
853 return rcStrict;
854
855 pCtx->rip = uNewPC;
856 pCtx->eflags.Bits.u1RF = 0;
857
858 /* Flush the prefetch buffer. */
859 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
860 return VINF_SUCCESS;
861}
862
863
864/**
865 * Implements a 64-bit indirect call.
866 *
867 * @param uNewPC The new program counter (RIP) value (loaded from the
868 * operand).
869 * @param enmEffOpSize The effective operand size.
870 */
871IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
872{
873 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
874 uint64_t uOldPC = pCtx->rip + cbInstr;
875 if (!IEM_IS_CANONICAL(uNewPC))
876 return iemRaiseGeneralProtectionFault0(pVCpu);
877
878 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
879 if (rcStrict != VINF_SUCCESS)
880 return rcStrict;
881
882 pCtx->rip = uNewPC;
883 pCtx->eflags.Bits.u1RF = 0;
884
885 /* Flush the prefetch buffer. */
886 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
887 return VINF_SUCCESS;
888}
889
890
891/**
892 * Implements a 64-bit relative call.
893 *
894 * @param offDisp The displacment offset.
895 */
896IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
897{
898 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
899 uint64_t uOldPC = pCtx->rip + cbInstr;
900 uint64_t uNewPC = uOldPC + offDisp;
901 if (!IEM_IS_CANONICAL(uNewPC))
902 return iemRaiseNotCanonical(pVCpu);
903
904 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
905 if (rcStrict != VINF_SUCCESS)
906 return rcStrict;
907
908 pCtx->rip = uNewPC;
909 pCtx->eflags.Bits.u1RF = 0;
910
911 /* Flush the prefetch buffer. */
912 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
913
914 return VINF_SUCCESS;
915}
916
917
918/**
919 * Implements far jumps and calls thru task segments (TSS).
920 *
921 * @param uSel The selector.
922 * @param enmBranch The kind of branching we're performing.
923 * @param enmEffOpSize The effective operand size.
924 * @param pDesc The descriptor corresponding to @a uSel. The type is
925 * task gate.
926 */
927IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
928{
929#ifndef IEM_IMPLEMENTS_TASKSWITCH
930 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
931#else
932 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
933 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
934 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
935
936 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
937 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
938 {
939 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
940 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
941 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
942 }
943
944 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
945 * far calls (see iemCImpl_callf). Most likely in both cases it should be
946 * checked here, need testcases. */
947 if (!pDesc->Legacy.Gen.u1Present)
948 {
949 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
950 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
951 }
952
953 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
954 uint32_t uNextEip = pCtx->eip + cbInstr;
955 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
956 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
957#endif
958}
959
960
961/**
962 * Implements far jumps and calls thru task gates.
963 *
964 * @param uSel The selector.
965 * @param enmBranch The kind of branching we're performing.
966 * @param enmEffOpSize The effective operand size.
967 * @param pDesc The descriptor corresponding to @a uSel. The type is
968 * task gate.
969 */
970IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
971{
972#ifndef IEM_IMPLEMENTS_TASKSWITCH
973 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
974#else
975 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
976
977 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
978 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
979 {
980 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
981 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
982 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
983 }
984
985 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
986 * far calls (see iemCImpl_callf). Most likely in both cases it should be
987 * checked here, need testcases. */
988 if (!pDesc->Legacy.Gen.u1Present)
989 {
990 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
991 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
992 }
993
994 /*
995 * Fetch the new TSS descriptor from the GDT.
996 */
997 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
998 if (uSelTss & X86_SEL_LDT)
999 {
1000 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1001 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1002 }
1003
1004 IEMSELDESC TssDesc;
1005 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1006 if (rcStrict != VINF_SUCCESS)
1007 return rcStrict;
1008
1009 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1010 {
1011 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1012 TssDesc.Legacy.Gate.u4Type));
1013 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1014 }
1015
1016 if (!TssDesc.Legacy.Gate.u1Present)
1017 {
1018 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1019 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1020 }
1021
1022 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1023 uint32_t uNextEip = pCtx->eip + cbInstr;
1024 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1025 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1026#endif
1027}
1028
1029
1030/**
1031 * Implements far jumps and calls thru call gates.
1032 *
1033 * @param uSel The selector.
1034 * @param enmBranch The kind of branching we're performing.
1035 * @param enmEffOpSize The effective operand size.
1036 * @param pDesc The descriptor corresponding to @a uSel. The type is
1037 * call gate.
1038 */
1039IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1040{
1041#define IEM_IMPLEMENTS_CALLGATE
1042#ifndef IEM_IMPLEMENTS_CALLGATE
1043 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1044#else
1045 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1046 * inter-privilege calls and are much more complex.
1047 *
1048 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1049 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1050 * must be 16-bit or 32-bit.
1051 */
1052 /** @todo: effective operand size is probably irrelevant here, only the
1053 * call gate bitness matters??
1054 */
1055 VBOXSTRICTRC rcStrict;
1056 RTPTRUNION uPtrRet;
1057 uint64_t uNewRsp;
1058 uint64_t uNewRip;
1059 uint64_t u64Base;
1060 uint32_t cbLimit;
1061 RTSEL uNewCS;
1062 IEMSELDESC DescCS;
1063
1064 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1065 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1066 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1067 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1068
1069 /* Determine the new instruction pointer from the gate descriptor. */
1070 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1071 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1072 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1073
1074 /* Perform DPL checks on the gate descriptor. */
1075 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1076 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1077 {
1078 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1079 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1080 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1081 }
1082
1083 /** @todo does this catch NULL selectors, too? */
1084 if (!pDesc->Legacy.Gen.u1Present)
1085 {
1086 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1087 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1088 }
1089
1090 /*
1091 * Fetch the target CS descriptor from the GDT or LDT.
1092 */
1093 uNewCS = pDesc->Legacy.Gate.u16Sel;
1094 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1095 if (rcStrict != VINF_SUCCESS)
1096 return rcStrict;
1097
1098 /* Target CS must be a code selector. */
1099 if ( !DescCS.Legacy.Gen.u1DescType
1100 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1101 {
1102 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1103 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1104 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1105 }
1106
1107 /* Privilege checks on target CS. */
1108 if (enmBranch == IEMBRANCH_JUMP)
1109 {
1110 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1111 {
1112 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1113 {
1114 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1115 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1116 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1117 }
1118 }
1119 else
1120 {
1121 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1122 {
1123 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1124 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1125 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1126 }
1127 }
1128 }
1129 else
1130 {
1131 Assert(enmBranch == IEMBRANCH_CALL);
1132 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1133 {
1134 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1135 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1137 }
1138 }
1139
1140 /* Additional long mode checks. */
1141 if (IEM_IS_LONG_MODE(pVCpu))
1142 {
1143 if (!DescCS.Legacy.Gen.u1Long)
1144 {
1145 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1146 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1147 }
1148
1149 /* L vs D. */
1150 if ( DescCS.Legacy.Gen.u1Long
1151 && DescCS.Legacy.Gen.u1DefBig)
1152 {
1153 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1154 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1155 }
1156 }
1157
1158 if (!DescCS.Legacy.Gate.u1Present)
1159 {
1160 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1161 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1162 }
1163
1164 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1165
1166 if (enmBranch == IEMBRANCH_JUMP)
1167 {
1168 /** @todo: This is very similar to regular far jumps; merge! */
1169 /* Jumps are fairly simple... */
1170
1171 /* Chop the high bits off if 16-bit gate (Intel says so). */
1172 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1173 uNewRip = (uint16_t)uNewRip;
1174
1175 /* Limit check for non-long segments. */
1176 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1177 if (DescCS.Legacy.Gen.u1Long)
1178 u64Base = 0;
1179 else
1180 {
1181 if (uNewRip > cbLimit)
1182 {
1183 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1184 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1185 }
1186 u64Base = X86DESC_BASE(&DescCS.Legacy);
1187 }
1188
1189 /* Canonical address check. */
1190 if (!IEM_IS_CANONICAL(uNewRip))
1191 {
1192 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1193 return iemRaiseNotCanonical(pVCpu);
1194 }
1195
1196 /*
1197 * Ok, everything checked out fine. Now set the accessed bit before
1198 * committing the result into CS, CSHID and RIP.
1199 */
1200 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1201 {
1202 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1203 if (rcStrict != VINF_SUCCESS)
1204 return rcStrict;
1205 /** @todo check what VT-x and AMD-V does. */
1206 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1207 }
1208
1209 /* commit */
1210 pCtx->rip = uNewRip;
1211 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1212 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1213 pCtx->cs.ValidSel = pCtx->cs.Sel;
1214 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1215 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1216 pCtx->cs.u32Limit = cbLimit;
1217 pCtx->cs.u64Base = u64Base;
1218 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1219 }
1220 else
1221 {
1222 Assert(enmBranch == IEMBRANCH_CALL);
1223 /* Calls are much more complicated. */
1224
1225 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1226 {
1227 uint16_t offNewStack; /* Offset of new stack in TSS. */
1228 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1229 uint8_t uNewCSDpl;
1230 uint8_t cbWords;
1231 RTSEL uNewSS;
1232 RTSEL uOldSS;
1233 uint64_t uOldRsp;
1234 IEMSELDESC DescSS;
1235 RTPTRUNION uPtrTSS;
1236 RTGCPTR GCPtrTSS;
1237 RTPTRUNION uPtrParmWds;
1238 RTGCPTR GCPtrParmWds;
1239
1240 /* More privilege. This is the fun part. */
1241 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1242
1243 /*
1244 * Determine new SS:rSP from the TSS.
1245 */
1246 Assert(!pCtx->tr.Attr.n.u1DescType);
1247
1248 /* Figure out where the new stack pointer is stored in the TSS. */
1249 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1250 if (!IEM_IS_LONG_MODE(pVCpu))
1251 {
1252 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1253 {
1254 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1255 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1256 }
1257 else
1258 {
1259 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1260 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1261 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1262 }
1263 }
1264 else
1265 {
1266 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1267 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1268 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1269 }
1270
1271 /* Check against TSS limit. */
1272 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1273 {
1274 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1275 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1276 }
1277
1278 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1279 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1280 if (rcStrict != VINF_SUCCESS)
1281 {
1282 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1283 return rcStrict;
1284 }
1285
1286 if (!IEM_IS_LONG_MODE(pVCpu))
1287 {
1288 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1289 {
1290 uNewRsp = uPtrTSS.pu32[0];
1291 uNewSS = uPtrTSS.pu16[2];
1292 }
1293 else
1294 {
1295 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1296 uNewRsp = uPtrTSS.pu16[0];
1297 uNewSS = uPtrTSS.pu16[1];
1298 }
1299 }
1300 else
1301 {
1302 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1303 /* SS will be a NULL selector, but that's valid. */
1304 uNewRsp = uPtrTSS.pu64[0];
1305 uNewSS = uNewCSDpl;
1306 }
1307
1308 /* Done with the TSS now. */
1309 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1310 if (rcStrict != VINF_SUCCESS)
1311 {
1312 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1313 return rcStrict;
1314 }
1315
1316 /* Only used outside of long mode. */
1317 cbWords = pDesc->Legacy.Gate.u4ParmCount;
1318
1319 /* If EFER.LMA is 0, there's extra work to do. */
1320 if (!IEM_IS_LONG_MODE(pVCpu))
1321 {
1322 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1323 {
1324 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1325 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1326 }
1327
1328 /* Grab the new SS descriptor. */
1329 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1330 if (rcStrict != VINF_SUCCESS)
1331 return rcStrict;
1332
1333 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1334 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1335 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1336 {
1337 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1338 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1339 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1340 }
1341
1342 /* Ensure new SS is a writable data segment. */
1343 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1344 {
1345 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1346 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1347 }
1348
1349 if (!DescSS.Legacy.Gen.u1Present)
1350 {
1351 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1352 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1353 }
1354 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1355 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1356 else
1357 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1358 }
1359 else
1360 {
1361 /* Just grab the new (NULL) SS descriptor. */
1362 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1363 if (rcStrict != VINF_SUCCESS)
1364 return rcStrict;
1365
1366 cbNewStack = sizeof(uint64_t) * 4;
1367 }
1368
1369 /** @todo: According to Intel, new stack is checked for enough space first,
1370 * then switched. According to AMD, the stack is switched first and
1371 * then pushes might fault!
1372 */
1373
1374 /** @todo: According to AMD, CS is loaded first, then SS.
1375 * According to Intel, it's the other way around!?
1376 */
1377
1378 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1379
1380 /* Set the accessed bit before committing new SS. */
1381 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1382 {
1383 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1384 if (rcStrict != VINF_SUCCESS)
1385 return rcStrict;
1386 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1387 }
1388
1389 /* Remember the old SS:rSP and their linear address. */
1390 uOldSS = pCtx->ss.Sel;
1391 uOldRsp = pCtx->rsp;
1392
1393 GCPtrParmWds = pCtx->ss.u64Base + pCtx->rsp;
1394
1395 /* Commit new SS:rSP. */
1396 pCtx->ss.Sel = uNewSS;
1397 pCtx->ss.ValidSel = uNewSS;
1398 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1399 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1400 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1401 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1402 pCtx->rsp = uNewRsp;
1403 pVCpu->iem.s.uCpl = uNewCSDpl;
1404 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1405 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1406
1407 /* Check new stack - may #SS(NewSS). */
1408 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1409 &uPtrRet.pv, &uNewRsp);
1410 if (rcStrict != VINF_SUCCESS)
1411 {
1412 Log(("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1413 return rcStrict;
1414 }
1415
1416 if (!IEM_IS_LONG_MODE(pVCpu))
1417 {
1418 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1419 {
1420 /* Push the old CS:rIP. */
1421 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1422 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1423
1424 /* Map the relevant chunk of the old stack. */
1425 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1426 if (rcStrict != VINF_SUCCESS)
1427 {
1428 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1429 return rcStrict;
1430 }
1431
1432 /* Copy the parameter (d)words. */
1433 for (int i = 0; i < cbWords; ++i)
1434 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1435
1436 /* Unmap the old stack. */
1437 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1438 if (rcStrict != VINF_SUCCESS)
1439 {
1440 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1441 return rcStrict;
1442 }
1443
1444 /* Push the old SS:rSP. */
1445 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1446 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1447 }
1448 else
1449 {
1450 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1451
1452 /* Push the old CS:rIP. */
1453 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1454 uPtrRet.pu16[1] = pCtx->cs.Sel;
1455
1456 /* Map the relevant chunk of the old stack. */
1457 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1458 if (rcStrict != VINF_SUCCESS)
1459 {
1460 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1461 return rcStrict;
1462 }
1463
1464 /* Copy the parameter words. */
1465 for (int i = 0; i < cbWords; ++i)
1466 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1467
1468 /* Unmap the old stack. */
1469 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1470 if (rcStrict != VINF_SUCCESS)
1471 {
1472 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1473 return rcStrict;
1474 }
1475
1476 /* Push the old SS:rSP. */
1477 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1478 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1479 }
1480 }
1481 else
1482 {
1483 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1484
1485 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1486 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1487 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1488 uPtrRet.pu64[2] = uOldRsp;
1489 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1490 }
1491
1492 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1493 if (rcStrict != VINF_SUCCESS)
1494 {
1495 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1496 return rcStrict;
1497 }
1498
1499 /* Chop the high bits off if 16-bit gate (Intel says so). */
1500 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1501 uNewRip = (uint16_t)uNewRip;
1502
1503 /* Limit / canonical check. */
1504 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1505 if (!IEM_IS_LONG_MODE(pVCpu))
1506 {
1507 if (uNewRip > cbLimit)
1508 {
1509 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1510 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1511 }
1512 u64Base = X86DESC_BASE(&DescCS.Legacy);
1513 }
1514 else
1515 {
1516 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1517 if (!IEM_IS_CANONICAL(uNewRip))
1518 {
1519 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1520 return iemRaiseNotCanonical(pVCpu);
1521 }
1522 u64Base = 0;
1523 }
1524
1525 /*
1526 * Now set the accessed bit before
1527 * writing the return address to the stack and committing the result into
1528 * CS, CSHID and RIP.
1529 */
1530 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1531 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1532 {
1533 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1534 if (rcStrict != VINF_SUCCESS)
1535 return rcStrict;
1536 /** @todo check what VT-x and AMD-V does. */
1537 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1538 }
1539
1540 /* Commit new CS:rIP. */
1541 pCtx->rip = uNewRip;
1542 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1543 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1544 pCtx->cs.ValidSel = pCtx->cs.Sel;
1545 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1546 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1547 pCtx->cs.u32Limit = cbLimit;
1548 pCtx->cs.u64Base = u64Base;
1549 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1550 }
1551 else
1552 {
1553 /* Same privilege. */
1554 /** @todo: This is very similar to regular far calls; merge! */
1555
1556 /* Check stack first - may #SS(0). */
1557 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1558 * 16-bit code cause a two or four byte CS to be pushed? */
1559 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1560 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1561 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1562 &uPtrRet.pv, &uNewRsp);
1563 if (rcStrict != VINF_SUCCESS)
1564 return rcStrict;
1565
1566 /* Chop the high bits off if 16-bit gate (Intel says so). */
1567 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1568 uNewRip = (uint16_t)uNewRip;
1569
1570 /* Limit / canonical check. */
1571 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1572 if (!IEM_IS_LONG_MODE(pVCpu))
1573 {
1574 if (uNewRip > cbLimit)
1575 {
1576 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1577 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1578 }
1579 u64Base = X86DESC_BASE(&DescCS.Legacy);
1580 }
1581 else
1582 {
1583 if (!IEM_IS_CANONICAL(uNewRip))
1584 {
1585 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1586 return iemRaiseNotCanonical(pVCpu);
1587 }
1588 u64Base = 0;
1589 }
1590
1591 /*
1592 * Now set the accessed bit before
1593 * writing the return address to the stack and committing the result into
1594 * CS, CSHID and RIP.
1595 */
1596 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1597 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1598 {
1599 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1600 if (rcStrict != VINF_SUCCESS)
1601 return rcStrict;
1602 /** @todo check what VT-x and AMD-V does. */
1603 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1604 }
1605
1606 /* stack */
1607 if (!IEM_IS_LONG_MODE(pVCpu))
1608 {
1609 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1610 {
1611 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1612 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1613 }
1614 else
1615 {
1616 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1617 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1618 uPtrRet.pu16[1] = pCtx->cs.Sel;
1619 }
1620 }
1621 else
1622 {
1623 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1624 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1625 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1626 }
1627
1628 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1629 if (rcStrict != VINF_SUCCESS)
1630 return rcStrict;
1631
1632 /* commit */
1633 pCtx->rip = uNewRip;
1634 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1635 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1636 pCtx->cs.ValidSel = pCtx->cs.Sel;
1637 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1638 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1639 pCtx->cs.u32Limit = cbLimit;
1640 pCtx->cs.u64Base = u64Base;
1641 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1642 }
1643 }
1644 pCtx->eflags.Bits.u1RF = 0;
1645
1646 /* Flush the prefetch buffer. */
1647 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1648 return VINF_SUCCESS;
1649#endif
1650}
1651
1652
1653/**
1654 * Implements far jumps and calls thru system selectors.
1655 *
1656 * @param uSel The selector.
1657 * @param enmBranch The kind of branching we're performing.
1658 * @param enmEffOpSize The effective operand size.
1659 * @param pDesc The descriptor corresponding to @a uSel.
1660 */
1661IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1662{
1663 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1664 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1665
1666 if (IEM_IS_LONG_MODE(pVCpu))
1667 switch (pDesc->Legacy.Gen.u4Type)
1668 {
1669 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1670 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1671
1672 default:
1673 case AMD64_SEL_TYPE_SYS_LDT:
1674 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1675 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1676 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1677 case AMD64_SEL_TYPE_SYS_INT_GATE:
1678 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1679 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1680 }
1681
1682 switch (pDesc->Legacy.Gen.u4Type)
1683 {
1684 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1685 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1686 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1687
1688 case X86_SEL_TYPE_SYS_TASK_GATE:
1689 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1690
1691 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1692 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1693 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1694
1695 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1696 Log(("branch %04x -> busy 286 TSS\n", uSel));
1697 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1698
1699 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1700 Log(("branch %04x -> busy 386 TSS\n", uSel));
1701 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1702
1703 default:
1704 case X86_SEL_TYPE_SYS_LDT:
1705 case X86_SEL_TYPE_SYS_286_INT_GATE:
1706 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1707 case X86_SEL_TYPE_SYS_386_INT_GATE:
1708 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1709 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1710 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1711 }
1712}
1713
1714
1715/**
1716 * Implements far jumps.
1717 *
1718 * @param uSel The selector.
1719 * @param offSeg The segment offset.
1720 * @param enmEffOpSize The effective operand size.
1721 */
1722IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1723{
1724 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1725 NOREF(cbInstr);
1726 Assert(offSeg <= UINT32_MAX);
1727
1728 /*
1729 * Real mode and V8086 mode are easy. The only snag seems to be that
1730 * CS.limit doesn't change and the limit check is done against the current
1731 * limit.
1732 */
1733 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1734 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1735 {
1736 if (offSeg > pCtx->cs.u32Limit)
1737 {
1738 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1739 return iemRaiseGeneralProtectionFault0(pVCpu);
1740 }
1741
1742 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1743 pCtx->rip = offSeg;
1744 else
1745 pCtx->rip = offSeg & UINT16_MAX;
1746 pCtx->cs.Sel = uSel;
1747 pCtx->cs.ValidSel = uSel;
1748 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1749 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1750 pCtx->eflags.Bits.u1RF = 0;
1751 return VINF_SUCCESS;
1752 }
1753
1754 /*
1755 * Protected mode. Need to parse the specified descriptor...
1756 */
1757 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1758 {
1759 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1760 return iemRaiseGeneralProtectionFault0(pVCpu);
1761 }
1762
1763 /* Fetch the descriptor. */
1764 IEMSELDESC Desc;
1765 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1766 if (rcStrict != VINF_SUCCESS)
1767 return rcStrict;
1768
1769 /* Is it there? */
1770 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1771 {
1772 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1773 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1774 }
1775
1776 /*
1777 * Deal with it according to its type. We do the standard code selectors
1778 * here and dispatch the system selectors to worker functions.
1779 */
1780 if (!Desc.Legacy.Gen.u1DescType)
1781 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1782
1783 /* Only code segments. */
1784 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1785 {
1786 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1787 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1788 }
1789
1790 /* L vs D. */
1791 if ( Desc.Legacy.Gen.u1Long
1792 && Desc.Legacy.Gen.u1DefBig
1793 && IEM_IS_LONG_MODE(pVCpu))
1794 {
1795 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1796 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1797 }
1798
1799 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1800 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1801 {
1802 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1803 {
1804 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1805 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1806 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1807 }
1808 }
1809 else
1810 {
1811 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1812 {
1813 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1814 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1815 }
1816 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1817 {
1818 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1819 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1820 }
1821 }
1822
1823 /* Chop the high bits if 16-bit (Intel says so). */
1824 if (enmEffOpSize == IEMMODE_16BIT)
1825 offSeg &= UINT16_MAX;
1826
1827 /* Limit check. (Should alternatively check for non-canonical addresses
1828 here, but that is ruled out by offSeg being 32-bit, right?) */
1829 uint64_t u64Base;
1830 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1831 if (Desc.Legacy.Gen.u1Long)
1832 u64Base = 0;
1833 else
1834 {
1835 if (offSeg > cbLimit)
1836 {
1837 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1838 /** @todo: Intel says this is #GP(0)! */
1839 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1840 }
1841 u64Base = X86DESC_BASE(&Desc.Legacy);
1842 }
1843
1844 /*
1845 * Ok, everything checked out fine. Now set the accessed bit before
1846 * committing the result into CS, CSHID and RIP.
1847 */
1848 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1849 {
1850 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1851 if (rcStrict != VINF_SUCCESS)
1852 return rcStrict;
1853 /** @todo check what VT-x and AMD-V does. */
1854 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1855 }
1856
1857 /* commit */
1858 pCtx->rip = offSeg;
1859 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1860 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1861 pCtx->cs.ValidSel = pCtx->cs.Sel;
1862 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1863 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1864 pCtx->cs.u32Limit = cbLimit;
1865 pCtx->cs.u64Base = u64Base;
1866 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1867 pCtx->eflags.Bits.u1RF = 0;
1868 /** @todo check if the hidden bits are loaded correctly for 64-bit
1869 * mode. */
1870
1871 /* Flush the prefetch buffer. */
1872 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1873
1874 return VINF_SUCCESS;
1875}
1876
1877
1878/**
1879 * Implements far calls.
1880 *
1881 * This very similar to iemCImpl_FarJmp.
1882 *
1883 * @param uSel The selector.
1884 * @param offSeg The segment offset.
1885 * @param enmEffOpSize The operand size (in case we need it).
1886 */
1887IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1888{
1889 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1890 VBOXSTRICTRC rcStrict;
1891 uint64_t uNewRsp;
1892 RTPTRUNION uPtrRet;
1893
1894 /*
1895 * Real mode and V8086 mode are easy. The only snag seems to be that
1896 * CS.limit doesn't change and the limit check is done against the current
1897 * limit.
1898 */
1899 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1900 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1901 {
1902 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1903
1904 /* Check stack first - may #SS(0). */
1905 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1906 &uPtrRet.pv, &uNewRsp);
1907 if (rcStrict != VINF_SUCCESS)
1908 return rcStrict;
1909
1910 /* Check the target address range. */
1911 if (offSeg > UINT32_MAX)
1912 return iemRaiseGeneralProtectionFault0(pVCpu);
1913
1914 /* Everything is fine, push the return address. */
1915 if (enmEffOpSize == IEMMODE_16BIT)
1916 {
1917 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1918 uPtrRet.pu16[1] = pCtx->cs.Sel;
1919 }
1920 else
1921 {
1922 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1923 uPtrRet.pu16[3] = pCtx->cs.Sel;
1924 }
1925 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1926 if (rcStrict != VINF_SUCCESS)
1927 return rcStrict;
1928
1929 /* Branch. */
1930 pCtx->rip = offSeg;
1931 pCtx->cs.Sel = uSel;
1932 pCtx->cs.ValidSel = uSel;
1933 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1934 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1935 pCtx->eflags.Bits.u1RF = 0;
1936 return VINF_SUCCESS;
1937 }
1938
1939 /*
1940 * Protected mode. Need to parse the specified descriptor...
1941 */
1942 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1943 {
1944 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1945 return iemRaiseGeneralProtectionFault0(pVCpu);
1946 }
1947
1948 /* Fetch the descriptor. */
1949 IEMSELDESC Desc;
1950 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1951 if (rcStrict != VINF_SUCCESS)
1952 return rcStrict;
1953
1954 /*
1955 * Deal with it according to its type. We do the standard code selectors
1956 * here and dispatch the system selectors to worker functions.
1957 */
1958 if (!Desc.Legacy.Gen.u1DescType)
1959 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1960
1961 /* Only code segments. */
1962 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1963 {
1964 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1965 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1966 }
1967
1968 /* L vs D. */
1969 if ( Desc.Legacy.Gen.u1Long
1970 && Desc.Legacy.Gen.u1DefBig
1971 && IEM_IS_LONG_MODE(pVCpu))
1972 {
1973 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1974 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1975 }
1976
1977 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1978 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1979 {
1980 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1981 {
1982 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1983 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1984 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1985 }
1986 }
1987 else
1988 {
1989 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1990 {
1991 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1992 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1993 }
1994 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1995 {
1996 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1997 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1998 }
1999 }
2000
2001 /* Is it there? */
2002 if (!Desc.Legacy.Gen.u1Present)
2003 {
2004 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2005 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2006 }
2007
2008 /* Check stack first - may #SS(0). */
2009 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2010 * 16-bit code cause a two or four byte CS to be pushed? */
2011 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2012 enmEffOpSize == IEMMODE_64BIT ? 8+8
2013 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2014 &uPtrRet.pv, &uNewRsp);
2015 if (rcStrict != VINF_SUCCESS)
2016 return rcStrict;
2017
2018 /* Chop the high bits if 16-bit (Intel says so). */
2019 if (enmEffOpSize == IEMMODE_16BIT)
2020 offSeg &= UINT16_MAX;
2021
2022 /* Limit / canonical check. */
2023 uint64_t u64Base;
2024 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2025 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2026 {
2027 if (!IEM_IS_CANONICAL(offSeg))
2028 {
2029 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2030 return iemRaiseNotCanonical(pVCpu);
2031 }
2032 u64Base = 0;
2033 }
2034 else
2035 {
2036 if (offSeg > cbLimit)
2037 {
2038 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2039 /** @todo: Intel says this is #GP(0)! */
2040 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2041 }
2042 u64Base = X86DESC_BASE(&Desc.Legacy);
2043 }
2044
2045 /*
2046 * Now set the accessed bit before
2047 * writing the return address to the stack and committing the result into
2048 * CS, CSHID and RIP.
2049 */
2050 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2051 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2052 {
2053 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2054 if (rcStrict != VINF_SUCCESS)
2055 return rcStrict;
2056 /** @todo check what VT-x and AMD-V does. */
2057 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2058 }
2059
2060 /* stack */
2061 if (enmEffOpSize == IEMMODE_16BIT)
2062 {
2063 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2064 uPtrRet.pu16[1] = pCtx->cs.Sel;
2065 }
2066 else if (enmEffOpSize == IEMMODE_32BIT)
2067 {
2068 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2069 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2070 }
2071 else
2072 {
2073 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2074 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2075 }
2076 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2077 if (rcStrict != VINF_SUCCESS)
2078 return rcStrict;
2079
2080 /* commit */
2081 pCtx->rip = offSeg;
2082 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2083 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2084 pCtx->cs.ValidSel = pCtx->cs.Sel;
2085 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2086 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2087 pCtx->cs.u32Limit = cbLimit;
2088 pCtx->cs.u64Base = u64Base;
2089 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2090 pCtx->eflags.Bits.u1RF = 0;
2091 /** @todo check if the hidden bits are loaded correctly for 64-bit
2092 * mode. */
2093
2094 /* Flush the prefetch buffer. */
2095 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2096
2097 return VINF_SUCCESS;
2098}
2099
2100
2101/**
2102 * Implements retf.
2103 *
2104 * @param enmEffOpSize The effective operand size.
2105 * @param cbPop The amount of arguments to pop from the stack
2106 * (bytes).
2107 */
2108IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2109{
2110 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2111 VBOXSTRICTRC rcStrict;
2112 RTCPTRUNION uPtrFrame;
2113 uint64_t uNewRsp;
2114 uint64_t uNewRip;
2115 uint16_t uNewCs;
2116 NOREF(cbInstr);
2117
2118 /*
2119 * Read the stack values first.
2120 */
2121 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2122 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2123 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2124 if (rcStrict != VINF_SUCCESS)
2125 return rcStrict;
2126 if (enmEffOpSize == IEMMODE_16BIT)
2127 {
2128 uNewRip = uPtrFrame.pu16[0];
2129 uNewCs = uPtrFrame.pu16[1];
2130 }
2131 else if (enmEffOpSize == IEMMODE_32BIT)
2132 {
2133 uNewRip = uPtrFrame.pu32[0];
2134 uNewCs = uPtrFrame.pu16[2];
2135 }
2136 else
2137 {
2138 uNewRip = uPtrFrame.pu64[0];
2139 uNewCs = uPtrFrame.pu16[4];
2140 }
2141
2142 /*
2143 * Real mode and V8086 mode are easy.
2144 */
2145 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2146 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
2147 {
2148 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2149 /** @todo check how this is supposed to work if sp=0xfffe. */
2150
2151 /* Check the limit of the new EIP. */
2152 /** @todo Intel pseudo code only does the limit check for 16-bit
2153 * operands, AMD does not make any distinction. What is right? */
2154 if (uNewRip > pCtx->cs.u32Limit)
2155 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2156
2157 /* commit the operation. */
2158 rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2159 if (rcStrict != VINF_SUCCESS)
2160 return rcStrict;
2161 pCtx->rip = uNewRip;
2162 pCtx->cs.Sel = uNewCs;
2163 pCtx->cs.ValidSel = uNewCs;
2164 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2165 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2166 pCtx->eflags.Bits.u1RF = 0;
2167 /** @todo do we load attribs and limit as well? */
2168 if (cbPop)
2169 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2170 return VINF_SUCCESS;
2171 }
2172
2173 /*
2174 * Protected mode is complicated, of course.
2175 */
2176 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2177 {
2178 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2179 return iemRaiseGeneralProtectionFault0(pVCpu);
2180 }
2181
2182 /* Fetch the descriptor. */
2183 IEMSELDESC DescCs;
2184 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2185 if (rcStrict != VINF_SUCCESS)
2186 return rcStrict;
2187
2188 /* Can only return to a code selector. */
2189 if ( !DescCs.Legacy.Gen.u1DescType
2190 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2191 {
2192 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2193 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2194 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2195 }
2196
2197 /* L vs D. */
2198 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2199 && DescCs.Legacy.Gen.u1DefBig
2200 && IEM_IS_LONG_MODE(pVCpu))
2201 {
2202 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2203 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2204 }
2205
2206 /* DPL/RPL/CPL checks. */
2207 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2208 {
2209 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2210 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2211 }
2212
2213 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2214 {
2215 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2216 {
2217 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2218 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2219 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2220 }
2221 }
2222 else
2223 {
2224 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2225 {
2226 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2227 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2228 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2229 }
2230 }
2231
2232 /* Is it there? */
2233 if (!DescCs.Legacy.Gen.u1Present)
2234 {
2235 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2236 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2237 }
2238
2239 /*
2240 * Return to outer privilege? (We'll typically have entered via a call gate.)
2241 */
2242 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2243 {
2244 /* Read the outer stack pointer stored *after* the parameters. */
2245 RTCPTRUNION uPtrStack;
2246 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
2247 if (rcStrict != VINF_SUCCESS)
2248 return rcStrict;
2249
2250 uPtrStack.pu8 += cbPop; /* Skip the parameters. */
2251
2252 uint16_t uNewOuterSs;
2253 uint64_t uNewOuterRsp;
2254 if (enmEffOpSize == IEMMODE_16BIT)
2255 {
2256 uNewOuterRsp = uPtrStack.pu16[0];
2257 uNewOuterSs = uPtrStack.pu16[1];
2258 }
2259 else if (enmEffOpSize == IEMMODE_32BIT)
2260 {
2261 uNewOuterRsp = uPtrStack.pu32[0];
2262 uNewOuterSs = uPtrStack.pu16[2];
2263 }
2264 else
2265 {
2266 uNewOuterRsp = uPtrStack.pu64[0];
2267 uNewOuterSs = uPtrStack.pu16[4];
2268 }
2269
2270 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2271 and read the selector. */
2272 IEMSELDESC DescSs;
2273 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2274 {
2275 if ( !DescCs.Legacy.Gen.u1Long
2276 || (uNewOuterSs & X86_SEL_RPL) == 3)
2277 {
2278 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2279 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2280 return iemRaiseGeneralProtectionFault0(pVCpu);
2281 }
2282 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2283 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2284 }
2285 else
2286 {
2287 /* Fetch the descriptor for the new stack segment. */
2288 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2289 if (rcStrict != VINF_SUCCESS)
2290 return rcStrict;
2291 }
2292
2293 /* Check that RPL of stack and code selectors match. */
2294 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2295 {
2296 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2297 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2298 }
2299
2300 /* Must be a writable data segment. */
2301 if ( !DescSs.Legacy.Gen.u1DescType
2302 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2303 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2304 {
2305 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2306 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2307 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2308 }
2309
2310 /* L vs D. (Not mentioned by intel.) */
2311 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2312 && DescSs.Legacy.Gen.u1DefBig
2313 && IEM_IS_LONG_MODE(pVCpu))
2314 {
2315 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2316 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2317 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2318 }
2319
2320 /* DPL/RPL/CPL checks. */
2321 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2322 {
2323 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2324 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2325 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2326 }
2327
2328 /* Is it there? */
2329 if (!DescSs.Legacy.Gen.u1Present)
2330 {
2331 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2332 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2333 }
2334
2335 /* Calc SS limit.*/
2336 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2337
2338 /* Is RIP canonical or within CS.limit? */
2339 uint64_t u64Base;
2340 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2341
2342 /** @todo Testcase: Is this correct? */
2343 if ( DescCs.Legacy.Gen.u1Long
2344 && IEM_IS_LONG_MODE(pVCpu) )
2345 {
2346 if (!IEM_IS_CANONICAL(uNewRip))
2347 {
2348 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2349 return iemRaiseNotCanonical(pVCpu);
2350 }
2351 u64Base = 0;
2352 }
2353 else
2354 {
2355 if (uNewRip > cbLimitCs)
2356 {
2357 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2358 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2359 /** @todo: Intel says this is #GP(0)! */
2360 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2361 }
2362 u64Base = X86DESC_BASE(&DescCs.Legacy);
2363 }
2364
2365 /*
2366 * Now set the accessed bit before
2367 * writing the return address to the stack and committing the result into
2368 * CS, CSHID and RIP.
2369 */
2370 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2371 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2372 {
2373 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2374 if (rcStrict != VINF_SUCCESS)
2375 return rcStrict;
2376 /** @todo check what VT-x and AMD-V does. */
2377 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2378 }
2379 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2380 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2381 {
2382 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2383 if (rcStrict != VINF_SUCCESS)
2384 return rcStrict;
2385 /** @todo check what VT-x and AMD-V does. */
2386 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2387 }
2388
2389 /* commit */
2390 rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2391 if (rcStrict != VINF_SUCCESS)
2392 return rcStrict;
2393 if (enmEffOpSize == IEMMODE_16BIT)
2394 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2395 else
2396 pCtx->rip = uNewRip;
2397 pCtx->cs.Sel = uNewCs;
2398 pCtx->cs.ValidSel = uNewCs;
2399 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2400 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2401 pCtx->cs.u32Limit = cbLimitCs;
2402 pCtx->cs.u64Base = u64Base;
2403 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2404 pCtx->rsp = uNewOuterRsp;
2405 pCtx->ss.Sel = uNewOuterSs;
2406 pCtx->ss.ValidSel = uNewOuterSs;
2407 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2408 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2409 pCtx->ss.u32Limit = cbLimitSs;
2410 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2411 pCtx->ss.u64Base = 0;
2412 else
2413 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2414
2415 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2416 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2417 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2418 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2419 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2420
2421 /** @todo check if the hidden bits are loaded correctly for 64-bit
2422 * mode. */
2423
2424 if (cbPop)
2425 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2426 pCtx->eflags.Bits.u1RF = 0;
2427
2428 /* Done! */
2429 }
2430 /*
2431 * Return to the same privilege level
2432 */
2433 else
2434 {
2435 /* Limit / canonical check. */
2436 uint64_t u64Base;
2437 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2438
2439 /** @todo Testcase: Is this correct? */
2440 if ( DescCs.Legacy.Gen.u1Long
2441 && IEM_IS_LONG_MODE(pVCpu) )
2442 {
2443 if (!IEM_IS_CANONICAL(uNewRip))
2444 {
2445 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2446 return iemRaiseNotCanonical(pVCpu);
2447 }
2448 u64Base = 0;
2449 }
2450 else
2451 {
2452 if (uNewRip > cbLimitCs)
2453 {
2454 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2455 /** @todo: Intel says this is #GP(0)! */
2456 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2457 }
2458 u64Base = X86DESC_BASE(&DescCs.Legacy);
2459 }
2460
2461 /*
2462 * Now set the accessed bit before
2463 * writing the return address to the stack and committing the result into
2464 * CS, CSHID and RIP.
2465 */
2466 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2467 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2468 {
2469 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2470 if (rcStrict != VINF_SUCCESS)
2471 return rcStrict;
2472 /** @todo check what VT-x and AMD-V does. */
2473 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2474 }
2475
2476 /* commit */
2477 rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2478 if (rcStrict != VINF_SUCCESS)
2479 return rcStrict;
2480 if (enmEffOpSize == IEMMODE_16BIT)
2481 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2482 else
2483 pCtx->rip = uNewRip;
2484 pCtx->cs.Sel = uNewCs;
2485 pCtx->cs.ValidSel = uNewCs;
2486 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2487 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2488 pCtx->cs.u32Limit = cbLimitCs;
2489 pCtx->cs.u64Base = u64Base;
2490 /** @todo check if the hidden bits are loaded correctly for 64-bit
2491 * mode. */
2492 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2493 if (cbPop)
2494 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2495 pCtx->eflags.Bits.u1RF = 0;
2496 }
2497
2498 /* Flush the prefetch buffer. */
2499 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2500 return VINF_SUCCESS;
2501}
2502
2503
2504/**
2505 * Implements retn.
2506 *
2507 * We're doing this in C because of the \#GP that might be raised if the popped
2508 * program counter is out of bounds.
2509 *
2510 * @param enmEffOpSize The effective operand size.
2511 * @param cbPop The amount of arguments to pop from the stack
2512 * (bytes).
2513 */
2514IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2515{
2516 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2517 NOREF(cbInstr);
2518
2519 /* Fetch the RSP from the stack. */
2520 VBOXSTRICTRC rcStrict;
2521 RTUINT64U NewRip;
2522 RTUINT64U NewRsp;
2523 NewRsp.u = pCtx->rsp;
2524 switch (enmEffOpSize)
2525 {
2526 case IEMMODE_16BIT:
2527 NewRip.u = 0;
2528 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2529 break;
2530 case IEMMODE_32BIT:
2531 NewRip.u = 0;
2532 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2533 break;
2534 case IEMMODE_64BIT:
2535 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2536 break;
2537 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2538 }
2539 if (rcStrict != VINF_SUCCESS)
2540 return rcStrict;
2541
2542 /* Check the new RSP before loading it. */
2543 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2544 * of it. The canonical test is performed here and for call. */
2545 if (enmEffOpSize != IEMMODE_64BIT)
2546 {
2547 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2548 {
2549 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2550 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2551 }
2552 }
2553 else
2554 {
2555 if (!IEM_IS_CANONICAL(NewRip.u))
2556 {
2557 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2558 return iemRaiseNotCanonical(pVCpu);
2559 }
2560 }
2561
2562 /* Apply cbPop */
2563 if (cbPop)
2564 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2565
2566 /* Commit it. */
2567 pCtx->rip = NewRip.u;
2568 pCtx->rsp = NewRsp.u;
2569 pCtx->eflags.Bits.u1RF = 0;
2570
2571 /* Flush the prefetch buffer. */
2572 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2573
2574 return VINF_SUCCESS;
2575}
2576
2577
2578/**
2579 * Implements enter.
2580 *
2581 * We're doing this in C because the instruction is insane, even for the
2582 * u8NestingLevel=0 case dealing with the stack is tedious.
2583 *
2584 * @param enmEffOpSize The effective operand size.
2585 */
2586IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2587{
2588 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2589
2590 /* Push RBP, saving the old value in TmpRbp. */
2591 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2592 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2593 RTUINT64U NewRbp;
2594 VBOXSTRICTRC rcStrict;
2595 if (enmEffOpSize == IEMMODE_64BIT)
2596 {
2597 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2598 NewRbp = NewRsp;
2599 }
2600 else if (enmEffOpSize == IEMMODE_32BIT)
2601 {
2602 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2603 NewRbp = NewRsp;
2604 }
2605 else
2606 {
2607 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2608 NewRbp = TmpRbp;
2609 NewRbp.Words.w0 = NewRsp.Words.w0;
2610 }
2611 if (rcStrict != VINF_SUCCESS)
2612 return rcStrict;
2613
2614 /* Copy the parameters (aka nesting levels by Intel). */
2615 cParameters &= 0x1f;
2616 if (cParameters > 0)
2617 {
2618 switch (enmEffOpSize)
2619 {
2620 case IEMMODE_16BIT:
2621 if (pCtx->ss.Attr.n.u1DefBig)
2622 TmpRbp.DWords.dw0 -= 2;
2623 else
2624 TmpRbp.Words.w0 -= 2;
2625 do
2626 {
2627 uint16_t u16Tmp;
2628 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2629 if (rcStrict != VINF_SUCCESS)
2630 break;
2631 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2632 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2633 break;
2634
2635 case IEMMODE_32BIT:
2636 if (pCtx->ss.Attr.n.u1DefBig)
2637 TmpRbp.DWords.dw0 -= 4;
2638 else
2639 TmpRbp.Words.w0 -= 4;
2640 do
2641 {
2642 uint32_t u32Tmp;
2643 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2644 if (rcStrict != VINF_SUCCESS)
2645 break;
2646 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2647 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2648 break;
2649
2650 case IEMMODE_64BIT:
2651 TmpRbp.u -= 8;
2652 do
2653 {
2654 uint64_t u64Tmp;
2655 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2656 if (rcStrict != VINF_SUCCESS)
2657 break;
2658 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2659 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2660 break;
2661
2662 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2663 }
2664 if (rcStrict != VINF_SUCCESS)
2665 return VINF_SUCCESS;
2666
2667 /* Push the new RBP */
2668 if (enmEffOpSize == IEMMODE_64BIT)
2669 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2670 else if (enmEffOpSize == IEMMODE_32BIT)
2671 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2672 else
2673 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2674 if (rcStrict != VINF_SUCCESS)
2675 return rcStrict;
2676
2677 }
2678
2679 /* Recalc RSP. */
2680 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2681
2682 /** @todo Should probe write access at the new RSP according to AMD. */
2683
2684 /* Commit it. */
2685 pCtx->rbp = NewRbp.u;
2686 pCtx->rsp = NewRsp.u;
2687 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2688
2689 return VINF_SUCCESS;
2690}
2691
2692
2693
2694/**
2695 * Implements leave.
2696 *
2697 * We're doing this in C because messing with the stack registers is annoying
2698 * since they depends on SS attributes.
2699 *
2700 * @param enmEffOpSize The effective operand size.
2701 */
2702IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2703{
2704 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2705
2706 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2707 RTUINT64U NewRsp;
2708 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2709 NewRsp.u = pCtx->rbp;
2710 else if (pCtx->ss.Attr.n.u1DefBig)
2711 NewRsp.u = pCtx->ebp;
2712 else
2713 {
2714 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2715 NewRsp.u = pCtx->rsp;
2716 NewRsp.Words.w0 = pCtx->bp;
2717 }
2718
2719 /* Pop RBP according to the operand size. */
2720 VBOXSTRICTRC rcStrict;
2721 RTUINT64U NewRbp;
2722 switch (enmEffOpSize)
2723 {
2724 case IEMMODE_16BIT:
2725 NewRbp.u = pCtx->rbp;
2726 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2727 break;
2728 case IEMMODE_32BIT:
2729 NewRbp.u = 0;
2730 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2731 break;
2732 case IEMMODE_64BIT:
2733 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2734 break;
2735 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2736 }
2737 if (rcStrict != VINF_SUCCESS)
2738 return rcStrict;
2739
2740
2741 /* Commit it. */
2742 pCtx->rbp = NewRbp.u;
2743 pCtx->rsp = NewRsp.u;
2744 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2745
2746 return VINF_SUCCESS;
2747}
2748
2749
2750/**
2751 * Implements int3 and int XX.
2752 *
2753 * @param u8Int The interrupt vector number.
2754 * @param fIsBpInstr Is it the breakpoint instruction.
2755 */
2756IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2757{
2758 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2759 return iemRaiseXcptOrInt(pVCpu,
2760 cbInstr,
2761 u8Int,
2762 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2763 0,
2764 0);
2765}
2766
2767
2768/**
2769 * Implements iret for real mode and V8086 mode.
2770 *
2771 * @param enmEffOpSize The effective operand size.
2772 */
2773IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2774{
2775 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2776 X86EFLAGS Efl;
2777 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2778 NOREF(cbInstr);
2779
2780 /*
2781 * iret throws an exception if VME isn't enabled.
2782 */
2783 if ( Efl.Bits.u1VM
2784 && Efl.Bits.u2IOPL != 3
2785 && !(pCtx->cr4 & X86_CR4_VME))
2786 return iemRaiseGeneralProtectionFault0(pVCpu);
2787
2788 /*
2789 * Do the stack bits, but don't commit RSP before everything checks
2790 * out right.
2791 */
2792 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2793 VBOXSTRICTRC rcStrict;
2794 RTCPTRUNION uFrame;
2795 uint16_t uNewCs;
2796 uint32_t uNewEip;
2797 uint32_t uNewFlags;
2798 uint64_t uNewRsp;
2799 if (enmEffOpSize == IEMMODE_32BIT)
2800 {
2801 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2802 if (rcStrict != VINF_SUCCESS)
2803 return rcStrict;
2804 uNewEip = uFrame.pu32[0];
2805 if (uNewEip > UINT16_MAX)
2806 return iemRaiseGeneralProtectionFault0(pVCpu);
2807
2808 uNewCs = (uint16_t)uFrame.pu32[1];
2809 uNewFlags = uFrame.pu32[2];
2810 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2811 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2812 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2813 | X86_EFL_ID;
2814 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2815 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2816 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2817 }
2818 else
2819 {
2820 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2821 if (rcStrict != VINF_SUCCESS)
2822 return rcStrict;
2823 uNewEip = uFrame.pu16[0];
2824 uNewCs = uFrame.pu16[1];
2825 uNewFlags = uFrame.pu16[2];
2826 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2827 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2828 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2829 /** @todo The intel pseudo code does not indicate what happens to
2830 * reserved flags. We just ignore them. */
2831 /* Ancient CPU adjustments: See iemCImpl_popf. */
2832 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2833 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2834 }
2835 /** @todo Check how this is supposed to work if sp=0xfffe. */
2836 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2837 uNewCs, uNewEip, uNewFlags, uNewRsp));
2838
2839 /*
2840 * Check the limit of the new EIP.
2841 */
2842 /** @todo Only the AMD pseudo code check the limit here, what's
2843 * right? */
2844 if (uNewEip > pCtx->cs.u32Limit)
2845 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2846
2847 /*
2848 * V8086 checks and flag adjustments
2849 */
2850 if (Efl.Bits.u1VM)
2851 {
2852 if (Efl.Bits.u2IOPL == 3)
2853 {
2854 /* Preserve IOPL and clear RF. */
2855 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2856 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2857 }
2858 else if ( enmEffOpSize == IEMMODE_16BIT
2859 && ( !(uNewFlags & X86_EFL_IF)
2860 || !Efl.Bits.u1VIP )
2861 && !(uNewFlags & X86_EFL_TF) )
2862 {
2863 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2864 uNewFlags &= ~X86_EFL_VIF;
2865 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2866 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2867 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2868 }
2869 else
2870 return iemRaiseGeneralProtectionFault0(pVCpu);
2871 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2872 }
2873
2874 /*
2875 * Commit the operation.
2876 */
2877 rcStrict = iemMemStackPopCommitSpecial(pVCpu, uFrame.pv, uNewRsp);
2878 if (rcStrict != VINF_SUCCESS)
2879 return rcStrict;
2880#ifdef DBGFTRACE_ENABLED
2881 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2882 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2883#endif
2884
2885 pCtx->rip = uNewEip;
2886 pCtx->cs.Sel = uNewCs;
2887 pCtx->cs.ValidSel = uNewCs;
2888 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2889 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2890 /** @todo do we load attribs and limit as well? */
2891 Assert(uNewFlags & X86_EFL_1);
2892 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2893
2894 /* Flush the prefetch buffer. */
2895 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2896
2897 return VINF_SUCCESS;
2898}
2899
2900
2901/**
2902 * Loads a segment register when entering V8086 mode.
2903 *
2904 * @param pSReg The segment register.
2905 * @param uSeg The segment to load.
2906 */
2907static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2908{
2909 pSReg->Sel = uSeg;
2910 pSReg->ValidSel = uSeg;
2911 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2912 pSReg->u64Base = (uint32_t)uSeg << 4;
2913 pSReg->u32Limit = 0xffff;
2914 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2915 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2916 * IRET'ing to V8086. */
2917}
2918
2919
2920/**
2921 * Implements iret for protected mode returning to V8086 mode.
2922 *
2923 * @param pCtx Pointer to the CPU context.
2924 * @param uNewEip The new EIP.
2925 * @param uNewCs The new CS.
2926 * @param uNewFlags The new EFLAGS.
2927 * @param uNewRsp The RSP after the initial IRET frame.
2928 *
2929 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2930 */
2931IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2932 uint32_t, uNewFlags, uint64_t, uNewRsp)
2933{
2934 /*
2935 * Pop the V8086 specific frame bits off the stack.
2936 */
2937 VBOXSTRICTRC rcStrict;
2938 RTCPTRUNION uFrame;
2939 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
2940 if (rcStrict != VINF_SUCCESS)
2941 return rcStrict;
2942 uint32_t uNewEsp = uFrame.pu32[0];
2943 uint16_t uNewSs = uFrame.pu32[1];
2944 uint16_t uNewEs = uFrame.pu32[2];
2945 uint16_t uNewDs = uFrame.pu32[3];
2946 uint16_t uNewFs = uFrame.pu32[4];
2947 uint16_t uNewGs = uFrame.pu32[5];
2948 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2949 if (rcStrict != VINF_SUCCESS)
2950 return rcStrict;
2951
2952 /*
2953 * Commit the operation.
2954 */
2955 uNewFlags &= X86_EFL_LIVE_MASK;
2956 uNewFlags |= X86_EFL_RA1_MASK;
2957#ifdef DBGFTRACE_ENABLED
2958 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2959 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2960#endif
2961
2962 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2963 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2964 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2965 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2966 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2967 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2968 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2969 pCtx->rip = (uint16_t)uNewEip;
2970 pCtx->rsp = uNewEsp; /** @todo check this out! */
2971 pVCpu->iem.s.uCpl = 3;
2972
2973 /* Flush the prefetch buffer. */
2974 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2975
2976 return VINF_SUCCESS;
2977}
2978
2979
2980/**
2981 * Implements iret for protected mode returning via a nested task.
2982 *
2983 * @param enmEffOpSize The effective operand size.
2984 */
2985IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2986{
2987 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
2988#ifndef IEM_IMPLEMENTS_TASKSWITCH
2989 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2990#else
2991 /*
2992 * Read the segment selector in the link-field of the current TSS.
2993 */
2994 RTSEL uSelRet;
2995 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2996 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
2997 if (rcStrict != VINF_SUCCESS)
2998 return rcStrict;
2999
3000 /*
3001 * Fetch the returning task's TSS descriptor from the GDT.
3002 */
3003 if (uSelRet & X86_SEL_LDT)
3004 {
3005 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3006 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3007 }
3008
3009 IEMSELDESC TssDesc;
3010 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3011 if (rcStrict != VINF_SUCCESS)
3012 return rcStrict;
3013
3014 if (TssDesc.Legacy.Gate.u1DescType)
3015 {
3016 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3017 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3018 }
3019
3020 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3021 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3022 {
3023 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3024 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3025 }
3026
3027 if (!TssDesc.Legacy.Gate.u1Present)
3028 {
3029 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3030 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3031 }
3032
3033 uint32_t uNextEip = pCtx->eip + cbInstr;
3034 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3035 0 /* uCr2 */, uSelRet, &TssDesc);
3036#endif
3037}
3038
3039
3040/**
3041 * Implements iret for protected mode
3042 *
3043 * @param enmEffOpSize The effective operand size.
3044 */
3045IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3046{
3047 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3048 NOREF(cbInstr);
3049 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3050
3051 /*
3052 * Nested task return.
3053 */
3054 if (pCtx->eflags.Bits.u1NT)
3055 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3056
3057 /*
3058 * Normal return.
3059 *
3060 * Do the stack bits, but don't commit RSP before everything checks
3061 * out right.
3062 */
3063 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3064 VBOXSTRICTRC rcStrict;
3065 RTCPTRUNION uFrame;
3066 uint16_t uNewCs;
3067 uint32_t uNewEip;
3068 uint32_t uNewFlags;
3069 uint64_t uNewRsp;
3070 if (enmEffOpSize == IEMMODE_32BIT)
3071 {
3072 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3073 if (rcStrict != VINF_SUCCESS)
3074 return rcStrict;
3075 uNewEip = uFrame.pu32[0];
3076 uNewCs = (uint16_t)uFrame.pu32[1];
3077 uNewFlags = uFrame.pu32[2];
3078 }
3079 else
3080 {
3081 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3082 if (rcStrict != VINF_SUCCESS)
3083 return rcStrict;
3084 uNewEip = uFrame.pu16[0];
3085 uNewCs = uFrame.pu16[1];
3086 uNewFlags = uFrame.pu16[2];
3087 }
3088 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3089 if (rcStrict != VINF_SUCCESS)
3090 return rcStrict;
3091 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3092
3093 /*
3094 * We're hopefully not returning to V8086 mode...
3095 */
3096 if ( (uNewFlags & X86_EFL_VM)
3097 && pVCpu->iem.s.uCpl == 0)
3098 {
3099 Assert(enmEffOpSize == IEMMODE_32BIT);
3100 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3101 }
3102
3103 /*
3104 * Protected mode.
3105 */
3106 /* Read the CS descriptor. */
3107 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3108 {
3109 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3110 return iemRaiseGeneralProtectionFault0(pVCpu);
3111 }
3112
3113 IEMSELDESC DescCS;
3114 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3115 if (rcStrict != VINF_SUCCESS)
3116 {
3117 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3118 return rcStrict;
3119 }
3120
3121 /* Must be a code descriptor. */
3122 if (!DescCS.Legacy.Gen.u1DescType)
3123 {
3124 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3125 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3126 }
3127 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3128 {
3129 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3130 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3131 }
3132
3133#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3134 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3135 PVM pVM = pVCpu->CTX_SUFF(pVM);
3136 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3137 {
3138 if ((uNewCs & X86_SEL_RPL) == 1)
3139 {
3140 if ( pVCpu->iem.s.uCpl == 0
3141 && ( !EMIsRawRing1Enabled(pVM)
3142 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3143 {
3144 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3145 uNewCs &= X86_SEL_MASK_OFF_RPL;
3146 }
3147# ifdef LOG_ENABLED
3148 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3149 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3150# endif
3151 }
3152 else if ( (uNewCs & X86_SEL_RPL) == 2
3153 && EMIsRawRing1Enabled(pVM)
3154 && pVCpu->iem.s.uCpl <= 1)
3155 {
3156 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3157 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3158 }
3159 }
3160#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3161
3162
3163 /* Privilege checks. */
3164 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3165 {
3166 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3167 {
3168 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3169 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3170 }
3171 }
3172 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3173 {
3174 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3175 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3176 }
3177 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3178 {
3179 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3180 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3181 }
3182
3183 /* Present? */
3184 if (!DescCS.Legacy.Gen.u1Present)
3185 {
3186 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3187 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3188 }
3189
3190 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3191
3192 /*
3193 * Return to outer level?
3194 */
3195 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3196 {
3197 uint16_t uNewSS;
3198 uint32_t uNewESP;
3199 if (enmEffOpSize == IEMMODE_32BIT)
3200 {
3201 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3202 if (rcStrict != VINF_SUCCESS)
3203 return rcStrict;
3204/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3205 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3206 * bit of the popped SS selector it turns out. */
3207 uNewESP = uFrame.pu32[0];
3208 uNewSS = (uint16_t)uFrame.pu32[1];
3209 }
3210 else
3211 {
3212 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3213 if (rcStrict != VINF_SUCCESS)
3214 return rcStrict;
3215 uNewESP = uFrame.pu16[0];
3216 uNewSS = uFrame.pu16[1];
3217 }
3218 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3219 if (rcStrict != VINF_SUCCESS)
3220 return rcStrict;
3221 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3222
3223 /* Read the SS descriptor. */
3224 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3225 {
3226 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3227 return iemRaiseGeneralProtectionFault0(pVCpu);
3228 }
3229
3230 IEMSELDESC DescSS;
3231 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3232 if (rcStrict != VINF_SUCCESS)
3233 {
3234 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3235 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3236 return rcStrict;
3237 }
3238
3239 /* Privilege checks. */
3240 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3241 {
3242 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3243 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3244 }
3245 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3246 {
3247 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3248 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3249 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3250 }
3251
3252 /* Must be a writeable data segment descriptor. */
3253 if (!DescSS.Legacy.Gen.u1DescType)
3254 {
3255 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3256 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3257 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3258 }
3259 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3260 {
3261 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3262 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3263 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3264 }
3265
3266 /* Present? */
3267 if (!DescSS.Legacy.Gen.u1Present)
3268 {
3269 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3270 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3271 }
3272
3273 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3274
3275 /* Check EIP. */
3276 if (uNewEip > cbLimitCS)
3277 {
3278 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3279 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3280 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3281 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3282 }
3283
3284 /*
3285 * Commit the changes, marking CS and SS accessed first since
3286 * that may fail.
3287 */
3288 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3289 {
3290 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3291 if (rcStrict != VINF_SUCCESS)
3292 return rcStrict;
3293 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3294 }
3295 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3296 {
3297 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3298 if (rcStrict != VINF_SUCCESS)
3299 return rcStrict;
3300 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3301 }
3302
3303 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3304 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3305 if (enmEffOpSize != IEMMODE_16BIT)
3306 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3307 if (pVCpu->iem.s.uCpl == 0)
3308 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3309 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3310 fEFlagsMask |= X86_EFL_IF;
3311 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3312 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3313 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3314 fEFlagsNew &= ~fEFlagsMask;
3315 fEFlagsNew |= uNewFlags & fEFlagsMask;
3316#ifdef DBGFTRACE_ENABLED
3317 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3318 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3319 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3320#endif
3321
3322 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3323 pCtx->rip = uNewEip;
3324 pCtx->cs.Sel = uNewCs;
3325 pCtx->cs.ValidSel = uNewCs;
3326 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3327 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3328 pCtx->cs.u32Limit = cbLimitCS;
3329 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3330 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3331 if (!pCtx->ss.Attr.n.u1DefBig)
3332 pCtx->sp = (uint16_t)uNewESP;
3333 else
3334 pCtx->rsp = uNewESP;
3335 pCtx->ss.Sel = uNewSS;
3336 pCtx->ss.ValidSel = uNewSS;
3337 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3338 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3339 pCtx->ss.u32Limit = cbLimitSs;
3340 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3341
3342 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3343 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3344 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3345 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3346 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3347
3348 /* Done! */
3349
3350 }
3351 /*
3352 * Return to the same level.
3353 */
3354 else
3355 {
3356 /* Check EIP. */
3357 if (uNewEip > cbLimitCS)
3358 {
3359 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3360 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3361 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3362 }
3363
3364 /*
3365 * Commit the changes, marking CS first since it may fail.
3366 */
3367 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3368 {
3369 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3370 if (rcStrict != VINF_SUCCESS)
3371 return rcStrict;
3372 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3373 }
3374
3375 X86EFLAGS NewEfl;
3376 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3377 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3378 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3379 if (enmEffOpSize != IEMMODE_16BIT)
3380 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3381 if (pVCpu->iem.s.uCpl == 0)
3382 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3383 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3384 fEFlagsMask |= X86_EFL_IF;
3385 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3386 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3387 NewEfl.u &= ~fEFlagsMask;
3388 NewEfl.u |= fEFlagsMask & uNewFlags;
3389#ifdef DBGFTRACE_ENABLED
3390 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3391 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3392 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3393#endif
3394
3395 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3396 pCtx->rip = uNewEip;
3397 pCtx->cs.Sel = uNewCs;
3398 pCtx->cs.ValidSel = uNewCs;
3399 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3400 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3401 pCtx->cs.u32Limit = cbLimitCS;
3402 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3403 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3404 pCtx->rsp = uNewRsp;
3405 /* Done! */
3406 }
3407
3408 /* Flush the prefetch buffer. */
3409 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3410
3411 return VINF_SUCCESS;
3412}
3413
3414
3415/**
3416 * Implements iret for long mode
3417 *
3418 * @param enmEffOpSize The effective operand size.
3419 */
3420IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3421{
3422 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3423 NOREF(cbInstr);
3424
3425 /*
3426 * Nested task return is not supported in long mode.
3427 */
3428 if (pCtx->eflags.Bits.u1NT)
3429 {
3430 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3431 return iemRaiseGeneralProtectionFault0(pVCpu);
3432 }
3433
3434 /*
3435 * Normal return.
3436 *
3437 * Do the stack bits, but don't commit RSP before everything checks
3438 * out right.
3439 */
3440 VBOXSTRICTRC rcStrict;
3441 RTCPTRUNION uFrame;
3442 uint64_t uNewRip;
3443 uint16_t uNewCs;
3444 uint16_t uNewSs;
3445 uint32_t uNewFlags;
3446 uint64_t uNewRsp;
3447 if (enmEffOpSize == IEMMODE_64BIT)
3448 {
3449 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3450 if (rcStrict != VINF_SUCCESS)
3451 return rcStrict;
3452 uNewRip = uFrame.pu64[0];
3453 uNewCs = (uint16_t)uFrame.pu64[1];
3454 uNewFlags = (uint32_t)uFrame.pu64[2];
3455 uNewRsp = uFrame.pu64[3];
3456 uNewSs = (uint16_t)uFrame.pu64[4];
3457 }
3458 else if (enmEffOpSize == IEMMODE_32BIT)
3459 {
3460 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3461 if (rcStrict != VINF_SUCCESS)
3462 return rcStrict;
3463 uNewRip = uFrame.pu32[0];
3464 uNewCs = (uint16_t)uFrame.pu32[1];
3465 uNewFlags = uFrame.pu32[2];
3466 uNewRsp = uFrame.pu32[3];
3467 uNewSs = (uint16_t)uFrame.pu32[4];
3468 }
3469 else
3470 {
3471 Assert(enmEffOpSize == IEMMODE_16BIT);
3472 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3473 if (rcStrict != VINF_SUCCESS)
3474 return rcStrict;
3475 uNewRip = uFrame.pu16[0];
3476 uNewCs = uFrame.pu16[1];
3477 uNewFlags = uFrame.pu16[2];
3478 uNewRsp = uFrame.pu16[3];
3479 uNewSs = uFrame.pu16[4];
3480 }
3481 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3482 if (rcStrict != VINF_SUCCESS)
3483 return rcStrict;
3484 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3485
3486 /*
3487 * Check stuff.
3488 */
3489 /* Read the CS descriptor. */
3490 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3491 {
3492 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3493 return iemRaiseGeneralProtectionFault0(pVCpu);
3494 }
3495
3496 IEMSELDESC DescCS;
3497 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3498 if (rcStrict != VINF_SUCCESS)
3499 {
3500 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3501 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3502 return rcStrict;
3503 }
3504
3505 /* Must be a code descriptor. */
3506 if ( !DescCS.Legacy.Gen.u1DescType
3507 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3508 {
3509 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3510 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3511 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3512 }
3513
3514 /* Privilege checks. */
3515 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3516 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3517 {
3518 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3519 {
3520 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3521 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3522 }
3523 }
3524 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3525 {
3526 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3527 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3528 }
3529 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3530 {
3531 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3532 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3533 }
3534
3535 /* Present? */
3536 if (!DescCS.Legacy.Gen.u1Present)
3537 {
3538 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3539 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3540 }
3541
3542 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3543
3544 /* Read the SS descriptor. */
3545 IEMSELDESC DescSS;
3546 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3547 {
3548 if ( !DescCS.Legacy.Gen.u1Long
3549 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3550 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3551 {
3552 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3553 return iemRaiseGeneralProtectionFault0(pVCpu);
3554 }
3555 DescSS.Legacy.u = 0;
3556 }
3557 else
3558 {
3559 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3560 if (rcStrict != VINF_SUCCESS)
3561 {
3562 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3563 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3564 return rcStrict;
3565 }
3566 }
3567
3568 /* Privilege checks. */
3569 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3570 {
3571 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3572 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3573 }
3574
3575 uint32_t cbLimitSs;
3576 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3577 cbLimitSs = UINT32_MAX;
3578 else
3579 {
3580 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3581 {
3582 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3583 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3584 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3585 }
3586
3587 /* Must be a writeable data segment descriptor. */
3588 if (!DescSS.Legacy.Gen.u1DescType)
3589 {
3590 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3591 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3592 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3593 }
3594 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3595 {
3596 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3597 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3598 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3599 }
3600
3601 /* Present? */
3602 if (!DescSS.Legacy.Gen.u1Present)
3603 {
3604 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3605 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3606 }
3607 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3608 }
3609
3610 /* Check EIP. */
3611 if (DescCS.Legacy.Gen.u1Long)
3612 {
3613 if (!IEM_IS_CANONICAL(uNewRip))
3614 {
3615 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3616 uNewCs, uNewRip, uNewSs, uNewRsp));
3617 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3618 }
3619 }
3620 else
3621 {
3622 if (uNewRip > cbLimitCS)
3623 {
3624 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3625 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3626 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3627 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3628 }
3629 }
3630
3631 /*
3632 * Commit the changes, marking CS and SS accessed first since
3633 * that may fail.
3634 */
3635 /** @todo where exactly are these actually marked accessed by a real CPU? */
3636 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3637 {
3638 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3639 if (rcStrict != VINF_SUCCESS)
3640 return rcStrict;
3641 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3642 }
3643 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3644 {
3645 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3646 if (rcStrict != VINF_SUCCESS)
3647 return rcStrict;
3648 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3649 }
3650
3651 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3652 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3653 if (enmEffOpSize != IEMMODE_16BIT)
3654 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3655 if (pVCpu->iem.s.uCpl == 0)
3656 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3657 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3658 fEFlagsMask |= X86_EFL_IF;
3659 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3660 fEFlagsNew &= ~fEFlagsMask;
3661 fEFlagsNew |= uNewFlags & fEFlagsMask;
3662#ifdef DBGFTRACE_ENABLED
3663 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3664 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3665#endif
3666
3667 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3668 pCtx->rip = uNewRip;
3669 pCtx->cs.Sel = uNewCs;
3670 pCtx->cs.ValidSel = uNewCs;
3671 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3672 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3673 pCtx->cs.u32Limit = cbLimitCS;
3674 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3675 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3676 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3677 pCtx->rsp = uNewRsp;
3678 else
3679 pCtx->sp = (uint16_t)uNewRsp;
3680 pCtx->ss.Sel = uNewSs;
3681 pCtx->ss.ValidSel = uNewSs;
3682 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3683 {
3684 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3685 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3686 pCtx->ss.u32Limit = UINT32_MAX;
3687 pCtx->ss.u64Base = 0;
3688 Log2(("iretq new SS: NULL\n"));
3689 }
3690 else
3691 {
3692 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3693 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3694 pCtx->ss.u32Limit = cbLimitSs;
3695 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3696 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3697 }
3698
3699 if (pVCpu->iem.s.uCpl != uNewCpl)
3700 {
3701 pVCpu->iem.s.uCpl = uNewCpl;
3702 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3703 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3704 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3705 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3706 }
3707
3708 /* Flush the prefetch buffer. */
3709 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3710
3711 return VINF_SUCCESS;
3712}
3713
3714
3715/**
3716 * Implements iret.
3717 *
3718 * @param enmEffOpSize The effective operand size.
3719 */
3720IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3721{
3722 /*
3723 * First, clear NMI blocking, if any, before causing any exceptions.
3724 */
3725 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3726
3727 /*
3728 * Call a mode specific worker.
3729 */
3730 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3731 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3732 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3733 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3734 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3735}
3736
3737
3738/**
3739 * Implements SYSCALL (AMD and Intel64).
3740 *
3741 * @param enmEffOpSize The effective operand size.
3742 */
3743IEM_CIMPL_DEF_0(iemCImpl_syscall)
3744{
3745 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3746
3747 /*
3748 * Check preconditions.
3749 *
3750 * Note that CPUs described in the documentation may load a few odd values
3751 * into CS and SS than we allow here. This has yet to be checked on real
3752 * hardware.
3753 */
3754 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3755 {
3756 Log(("syscall: Not enabled in EFER -> #UD\n"));
3757 return iemRaiseUndefinedOpcode(pVCpu);
3758 }
3759 if (!(pCtx->cr0 & X86_CR0_PE))
3760 {
3761 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3762 return iemRaiseGeneralProtectionFault0(pVCpu);
3763 }
3764 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3765 {
3766 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3767 return iemRaiseUndefinedOpcode(pVCpu);
3768 }
3769
3770 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3771 /** @todo what about LDT selectors? Shouldn't matter, really. */
3772 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3773 uint16_t uNewSs = uNewCs + 8;
3774 if (uNewCs == 0 || uNewSs == 0)
3775 {
3776 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3777 return iemRaiseGeneralProtectionFault0(pVCpu);
3778 }
3779
3780 /* Long mode and legacy mode differs. */
3781 if (CPUMIsGuestInLongModeEx(pCtx))
3782 {
3783 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3784
3785 /* This test isn't in the docs, but I'm not trusting the guys writing
3786 the MSRs to have validated the values as canonical like they should. */
3787 if (!IEM_IS_CANONICAL(uNewRip))
3788 {
3789 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3790 return iemRaiseUndefinedOpcode(pVCpu);
3791 }
3792
3793 /*
3794 * Commit it.
3795 */
3796 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3797 pCtx->rcx = pCtx->rip + cbInstr;
3798 pCtx->rip = uNewRip;
3799
3800 pCtx->rflags.u &= ~X86_EFL_RF;
3801 pCtx->r11 = pCtx->rflags.u;
3802 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3803 pCtx->rflags.u |= X86_EFL_1;
3804
3805 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3806 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3807 }
3808 else
3809 {
3810 /*
3811 * Commit it.
3812 */
3813 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3814 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3815 pCtx->rcx = pCtx->eip + cbInstr;
3816 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3817 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3818
3819 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3820 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3821 }
3822 pCtx->cs.Sel = uNewCs;
3823 pCtx->cs.ValidSel = uNewCs;
3824 pCtx->cs.u64Base = 0;
3825 pCtx->cs.u32Limit = UINT32_MAX;
3826 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3827
3828 pCtx->ss.Sel = uNewSs;
3829 pCtx->ss.ValidSel = uNewSs;
3830 pCtx->ss.u64Base = 0;
3831 pCtx->ss.u32Limit = UINT32_MAX;
3832 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3833
3834 /* Flush the prefetch buffer. */
3835 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3836
3837 return VINF_SUCCESS;
3838}
3839
3840
3841/**
3842 * Implements SYSRET (AMD and Intel64).
3843 */
3844IEM_CIMPL_DEF_0(iemCImpl_sysret)
3845
3846{
3847 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3848
3849 /*
3850 * Check preconditions.
3851 *
3852 * Note that CPUs described in the documentation may load a few odd values
3853 * into CS and SS than we allow here. This has yet to be checked on real
3854 * hardware.
3855 */
3856 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3857 {
3858 Log(("sysret: Not enabled in EFER -> #UD\n"));
3859 return iemRaiseUndefinedOpcode(pVCpu);
3860 }
3861 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3862 {
3863 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3864 return iemRaiseUndefinedOpcode(pVCpu);
3865 }
3866 if (!(pCtx->cr0 & X86_CR0_PE))
3867 {
3868 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3869 return iemRaiseGeneralProtectionFault0(pVCpu);
3870 }
3871 if (pVCpu->iem.s.uCpl != 0)
3872 {
3873 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3874 return iemRaiseGeneralProtectionFault0(pVCpu);
3875 }
3876
3877 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3878 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3879 uint16_t uNewSs = uNewCs + 8;
3880 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3881 uNewCs += 16;
3882 if (uNewCs == 0 || uNewSs == 0)
3883 {
3884 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3885 return iemRaiseGeneralProtectionFault0(pVCpu);
3886 }
3887
3888 /*
3889 * Commit it.
3890 */
3891 if (CPUMIsGuestInLongModeEx(pCtx))
3892 {
3893 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3894 {
3895 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3896 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3897 /* Note! We disregard intel manual regarding the RCX cananonical
3898 check, ask intel+xen why AMD doesn't do it. */
3899 pCtx->rip = pCtx->rcx;
3900 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3901 | (3 << X86DESCATTR_DPL_SHIFT);
3902 }
3903 else
3904 {
3905 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3906 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3907 pCtx->rip = pCtx->ecx;
3908 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3909 | (3 << X86DESCATTR_DPL_SHIFT);
3910 }
3911 /** @todo testcase: See what kind of flags we can make SYSRET restore and
3912 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
3913 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
3914 pCtx->rflags.u |= X86_EFL_1;
3915 }
3916 else
3917 {
3918 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3919 pCtx->rip = pCtx->rcx;
3920 pCtx->rflags.u |= X86_EFL_IF;
3921 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3922 | (3 << X86DESCATTR_DPL_SHIFT);
3923 }
3924 pCtx->cs.Sel = uNewCs | 3;
3925 pCtx->cs.ValidSel = uNewCs | 3;
3926 pCtx->cs.u64Base = 0;
3927 pCtx->cs.u32Limit = UINT32_MAX;
3928 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3929
3930 pCtx->ss.Sel = uNewSs | 3;
3931 pCtx->ss.ValidSel = uNewSs | 3;
3932 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3933 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3934 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
3935 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3936 * on sysret. */
3937
3938 /* Flush the prefetch buffer. */
3939 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3940
3941 return VINF_SUCCESS;
3942}
3943
3944
3945/**
3946 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3947 *
3948 * @param iSegReg The segment register number (valid).
3949 * @param uSel The new selector value.
3950 */
3951IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3952{
3953 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
3954 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
3955 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3956
3957 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3958
3959 /*
3960 * Real mode and V8086 mode are easy.
3961 */
3962 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
3963 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
3964 {
3965 *pSel = uSel;
3966 pHid->u64Base = (uint32_t)uSel << 4;
3967 pHid->ValidSel = uSel;
3968 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3969#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3970 /** @todo Does the CPU actually load limits and attributes in the
3971 * real/V8086 mode segment load case? It doesn't for CS in far
3972 * jumps... Affects unreal mode. */
3973 pHid->u32Limit = 0xffff;
3974 pHid->Attr.u = 0;
3975 pHid->Attr.n.u1Present = 1;
3976 pHid->Attr.n.u1DescType = 1;
3977 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3978 ? X86_SEL_TYPE_RW
3979 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
3980#endif
3981 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
3982 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
3983 return VINF_SUCCESS;
3984 }
3985
3986 /*
3987 * Protected mode.
3988 *
3989 * Check if it's a null segment selector value first, that's OK for DS, ES,
3990 * FS and GS. If not null, then we have to load and parse the descriptor.
3991 */
3992 if (!(uSel & X86_SEL_MASK_OFF_RPL))
3993 {
3994 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3995 if (iSegReg == X86_SREG_SS)
3996 {
3997 /* In 64-bit kernel mode, the stack can be 0 because of the way
3998 interrupts are dispatched. AMD seems to have a slighly more
3999 relaxed relationship to SS.RPL than intel does. */
4000 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4001 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4002 || pVCpu->iem.s.uCpl > 2
4003 || ( uSel != pVCpu->iem.s.uCpl
4004 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4005 {
4006 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4007 return iemRaiseGeneralProtectionFault0(pVCpu);
4008 }
4009 }
4010
4011 *pSel = uSel; /* Not RPL, remember :-) */
4012 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4013 if (iSegReg == X86_SREG_SS)
4014 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4015
4016 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4017 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4018
4019 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4020 return VINF_SUCCESS;
4021 }
4022
4023 /* Fetch the descriptor. */
4024 IEMSELDESC Desc;
4025 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4026 if (rcStrict != VINF_SUCCESS)
4027 return rcStrict;
4028
4029 /* Check GPs first. */
4030 if (!Desc.Legacy.Gen.u1DescType)
4031 {
4032 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4033 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4034 }
4035 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4036 {
4037 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4038 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4039 {
4040 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4041 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4042 }
4043 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4044 {
4045 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4046 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4047 }
4048 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4049 {
4050 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4051 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4052 }
4053 }
4054 else
4055 {
4056 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4057 {
4058 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4059 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4060 }
4061 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4062 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4063 {
4064#if 0 /* this is what intel says. */
4065 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4066 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4067 {
4068 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4069 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4070 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4071 }
4072#else /* this is what makes more sense. */
4073 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4074 {
4075 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4076 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4077 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4078 }
4079 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4080 {
4081 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4082 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4083 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4084 }
4085#endif
4086 }
4087 }
4088
4089 /* Is it there? */
4090 if (!Desc.Legacy.Gen.u1Present)
4091 {
4092 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4093 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4094 }
4095
4096 /* The base and limit. */
4097 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4098 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4099
4100 /*
4101 * Ok, everything checked out fine. Now set the accessed bit before
4102 * committing the result into the registers.
4103 */
4104 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4105 {
4106 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4107 if (rcStrict != VINF_SUCCESS)
4108 return rcStrict;
4109 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4110 }
4111
4112 /* commit */
4113 *pSel = uSel;
4114 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4115 pHid->u32Limit = cbLimit;
4116 pHid->u64Base = u64Base;
4117 pHid->ValidSel = uSel;
4118 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4119
4120 /** @todo check if the hidden bits are loaded correctly for 64-bit
4121 * mode. */
4122 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4123
4124 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4125 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4126 return VINF_SUCCESS;
4127}
4128
4129
4130/**
4131 * Implements 'mov SReg, r/m'.
4132 *
4133 * @param iSegReg The segment register number (valid).
4134 * @param uSel The new selector value.
4135 */
4136IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4137{
4138 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4139 if (rcStrict == VINF_SUCCESS)
4140 {
4141 if (iSegReg == X86_SREG_SS)
4142 {
4143 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4144 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4145 }
4146 }
4147 return rcStrict;
4148}
4149
4150
4151/**
4152 * Implements 'pop SReg'.
4153 *
4154 * @param iSegReg The segment register number (valid).
4155 * @param enmEffOpSize The efficient operand size (valid).
4156 */
4157IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4158{
4159 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4160 VBOXSTRICTRC rcStrict;
4161
4162 /*
4163 * Read the selector off the stack and join paths with mov ss, reg.
4164 */
4165 RTUINT64U TmpRsp;
4166 TmpRsp.u = pCtx->rsp;
4167 switch (enmEffOpSize)
4168 {
4169 case IEMMODE_16BIT:
4170 {
4171 uint16_t uSel;
4172 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4173 if (rcStrict == VINF_SUCCESS)
4174 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4175 break;
4176 }
4177
4178 case IEMMODE_32BIT:
4179 {
4180 uint32_t u32Value;
4181 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4182 if (rcStrict == VINF_SUCCESS)
4183 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4184 break;
4185 }
4186
4187 case IEMMODE_64BIT:
4188 {
4189 uint64_t u64Value;
4190 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4191 if (rcStrict == VINF_SUCCESS)
4192 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4193 break;
4194 }
4195 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4196 }
4197
4198 /*
4199 * Commit the stack on success.
4200 */
4201 if (rcStrict == VINF_SUCCESS)
4202 {
4203 pCtx->rsp = TmpRsp.u;
4204 if (iSegReg == X86_SREG_SS)
4205 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4206 }
4207 return rcStrict;
4208}
4209
4210
4211/**
4212 * Implements lgs, lfs, les, lds & lss.
4213 */
4214IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4215 uint16_t, uSel,
4216 uint64_t, offSeg,
4217 uint8_t, iSegReg,
4218 uint8_t, iGReg,
4219 IEMMODE, enmEffOpSize)
4220{
4221 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4222 VBOXSTRICTRC rcStrict;
4223
4224 /*
4225 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4226 */
4227 /** @todo verify and test that mov, pop and lXs works the segment
4228 * register loading in the exact same way. */
4229 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4230 if (rcStrict == VINF_SUCCESS)
4231 {
4232 switch (enmEffOpSize)
4233 {
4234 case IEMMODE_16BIT:
4235 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4236 break;
4237 case IEMMODE_32BIT:
4238 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4239 break;
4240 case IEMMODE_64BIT:
4241 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4242 break;
4243 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4244 }
4245 }
4246
4247 return rcStrict;
4248}
4249
4250
4251/**
4252 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4253 *
4254 * @retval VINF_SUCCESS on success.
4255 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4256 * @retval iemMemFetchSysU64 return value.
4257 *
4258 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4259 * @param uSel The selector value.
4260 * @param fAllowSysDesc Whether system descriptors are OK or not.
4261 * @param pDesc Where to return the descriptor on success.
4262 */
4263static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4264{
4265 pDesc->Long.au64[0] = 0;
4266 pDesc->Long.au64[1] = 0;
4267
4268 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4269 return VINF_IEM_SELECTOR_NOT_OK;
4270
4271 /* Within the table limits? */
4272 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4273 RTGCPTR GCPtrBase;
4274 if (uSel & X86_SEL_LDT)
4275 {
4276 if ( !pCtx->ldtr.Attr.n.u1Present
4277 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4278 return VINF_IEM_SELECTOR_NOT_OK;
4279 GCPtrBase = pCtx->ldtr.u64Base;
4280 }
4281 else
4282 {
4283 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4284 return VINF_IEM_SELECTOR_NOT_OK;
4285 GCPtrBase = pCtx->gdtr.pGdt;
4286 }
4287
4288 /* Fetch the descriptor. */
4289 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4290 if (rcStrict != VINF_SUCCESS)
4291 return rcStrict;
4292 if (!pDesc->Legacy.Gen.u1DescType)
4293 {
4294 if (!fAllowSysDesc)
4295 return VINF_IEM_SELECTOR_NOT_OK;
4296 if (CPUMIsGuestInLongModeEx(pCtx))
4297 {
4298 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4299 if (rcStrict != VINF_SUCCESS)
4300 return rcStrict;
4301 }
4302
4303 }
4304
4305 return VINF_SUCCESS;
4306}
4307
4308
4309/**
4310 * Implements verr (fWrite = false) and verw (fWrite = true).
4311 */
4312IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4313{
4314 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4315
4316 /** @todo figure whether the accessed bit is set or not. */
4317
4318 bool fAccessible = true;
4319 IEMSELDESC Desc;
4320 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4321 if (rcStrict == VINF_SUCCESS)
4322 {
4323 /* Check the descriptor, order doesn't matter much here. */
4324 if ( !Desc.Legacy.Gen.u1DescType
4325 || !Desc.Legacy.Gen.u1Present)
4326 fAccessible = false;
4327 else
4328 {
4329 if ( fWrite
4330 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4331 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4332 fAccessible = false;
4333
4334 /** @todo testcase for the conforming behavior. */
4335 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4336 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4337 {
4338 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4339 fAccessible = false;
4340 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4341 fAccessible = false;
4342 }
4343 }
4344
4345 }
4346 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4347 fAccessible = false;
4348 else
4349 return rcStrict;
4350
4351 /* commit */
4352 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4353
4354 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4355 return VINF_SUCCESS;
4356}
4357
4358
4359/**
4360 * Implements LAR and LSL with 64-bit operand size.
4361 *
4362 * @returns VINF_SUCCESS.
4363 * @param pu16Dst Pointer to the destination register.
4364 * @param uSel The selector to load details for.
4365 * @param pEFlags Pointer to the eflags register.
4366 * @param fIsLar true = LAR, false = LSL.
4367 */
4368IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
4369{
4370 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4371
4372 /** @todo figure whether the accessed bit is set or not. */
4373
4374 bool fDescOk = true;
4375 IEMSELDESC Desc;
4376 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4377 if (rcStrict == VINF_SUCCESS)
4378 {
4379 /*
4380 * Check the descriptor type.
4381 */
4382 if (!Desc.Legacy.Gen.u1DescType)
4383 {
4384 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4385 {
4386 if (Desc.Long.Gen.u5Zeros)
4387 fDescOk = false;
4388 else
4389 switch (Desc.Long.Gen.u4Type)
4390 {
4391 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4392 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4393 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4394 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4395 break;
4396 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4397 fDescOk = fIsLar;
4398 break;
4399 default:
4400 fDescOk = false;
4401 break;
4402 }
4403 }
4404 else
4405 {
4406 switch (Desc.Long.Gen.u4Type)
4407 {
4408 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4409 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4410 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4411 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4412 case X86_SEL_TYPE_SYS_LDT:
4413 break;
4414 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4415 case X86_SEL_TYPE_SYS_TASK_GATE:
4416 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4417 fDescOk = fIsLar;
4418 break;
4419 default:
4420 fDescOk = false;
4421 break;
4422 }
4423 }
4424 }
4425 if (fDescOk)
4426 {
4427 /*
4428 * Check the RPL/DPL/CPL interaction..
4429 */
4430 /** @todo testcase for the conforming behavior. */
4431 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4432 || !Desc.Legacy.Gen.u1DescType)
4433 {
4434 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4435 fDescOk = false;
4436 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4437 fDescOk = false;
4438 }
4439 }
4440
4441 if (fDescOk)
4442 {
4443 /*
4444 * All fine, start committing the result.
4445 */
4446 if (fIsLar)
4447 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4448 else
4449 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4450 }
4451
4452 }
4453 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4454 fDescOk = false;
4455 else
4456 return rcStrict;
4457
4458 /* commit flags value and advance rip. */
4459 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4460 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4461
4462 return VINF_SUCCESS;
4463}
4464
4465
4466/**
4467 * Implements LAR and LSL with 16-bit operand size.
4468 *
4469 * @returns VINF_SUCCESS.
4470 * @param pu16Dst Pointer to the destination register.
4471 * @param u16Sel The selector to load details for.
4472 * @param pEFlags Pointer to the eflags register.
4473 * @param fIsLar true = LAR, false = LSL.
4474 */
4475IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
4476{
4477 uint64_t u64TmpDst = *pu16Dst;
4478 IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
4479 *pu16Dst = (uint16_t)u64TmpDst;
4480 return VINF_SUCCESS;
4481}
4482
4483
4484/**
4485 * Implements lgdt.
4486 *
4487 * @param iEffSeg The segment of the new gdtr contents
4488 * @param GCPtrEffSrc The address of the new gdtr contents.
4489 * @param enmEffOpSize The effective operand size.
4490 */
4491IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4492{
4493 if (pVCpu->iem.s.uCpl != 0)
4494 return iemRaiseGeneralProtectionFault0(pVCpu);
4495 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4496
4497 /*
4498 * Fetch the limit and base address.
4499 */
4500 uint16_t cbLimit;
4501 RTGCPTR GCPtrBase;
4502 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4503 if (rcStrict == VINF_SUCCESS)
4504 {
4505 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4506 || X86_IS_CANONICAL(GCPtrBase))
4507 {
4508 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4509 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4510 else
4511 {
4512 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4513 pCtx->gdtr.cbGdt = cbLimit;
4514 pCtx->gdtr.pGdt = GCPtrBase;
4515 }
4516 if (rcStrict == VINF_SUCCESS)
4517 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4518 }
4519 else
4520 {
4521 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4522 return iemRaiseGeneralProtectionFault0(pVCpu);
4523 }
4524 }
4525 return rcStrict;
4526}
4527
4528
4529/**
4530 * Implements sgdt.
4531 *
4532 * @param iEffSeg The segment where to store the gdtr content.
4533 * @param GCPtrEffDst The address where to store the gdtr content.
4534 */
4535IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4536{
4537 /*
4538 * Join paths with sidt.
4539 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4540 * you really must know.
4541 */
4542 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4543 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4544 if (rcStrict == VINF_SUCCESS)
4545 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4546 return rcStrict;
4547}
4548
4549
4550/**
4551 * Implements lidt.
4552 *
4553 * @param iEffSeg The segment of the new idtr contents
4554 * @param GCPtrEffSrc The address of the new idtr contents.
4555 * @param enmEffOpSize The effective operand size.
4556 */
4557IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4558{
4559 if (pVCpu->iem.s.uCpl != 0)
4560 return iemRaiseGeneralProtectionFault0(pVCpu);
4561 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4562
4563 /*
4564 * Fetch the limit and base address.
4565 */
4566 uint16_t cbLimit;
4567 RTGCPTR GCPtrBase;
4568 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4569 if (rcStrict == VINF_SUCCESS)
4570 {
4571 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4572 || X86_IS_CANONICAL(GCPtrBase))
4573 {
4574 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4575 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4576 else
4577 {
4578 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4579 pCtx->idtr.cbIdt = cbLimit;
4580 pCtx->idtr.pIdt = GCPtrBase;
4581 }
4582 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4583 }
4584 else
4585 {
4586 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4587 return iemRaiseGeneralProtectionFault0(pVCpu);
4588 }
4589 }
4590 return rcStrict;
4591}
4592
4593
4594/**
4595 * Implements sidt.
4596 *
4597 * @param iEffSeg The segment where to store the idtr content.
4598 * @param GCPtrEffDst The address where to store the idtr content.
4599 */
4600IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4601{
4602 /*
4603 * Join paths with sgdt.
4604 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4605 * you really must know.
4606 */
4607 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4608 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4609 if (rcStrict == VINF_SUCCESS)
4610 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4611 return rcStrict;
4612}
4613
4614
4615/**
4616 * Implements lldt.
4617 *
4618 * @param uNewLdt The new LDT selector value.
4619 */
4620IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4621{
4622 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4623
4624 /*
4625 * Check preconditions.
4626 */
4627 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4628 {
4629 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4630 return iemRaiseUndefinedOpcode(pVCpu);
4631 }
4632 if (pVCpu->iem.s.uCpl != 0)
4633 {
4634 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4635 return iemRaiseGeneralProtectionFault0(pVCpu);
4636 }
4637 if (uNewLdt & X86_SEL_LDT)
4638 {
4639 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4640 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4641 }
4642
4643 /*
4644 * Now, loading a NULL selector is easy.
4645 */
4646 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4647 {
4648 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4649 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4650 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4651 else
4652 pCtx->ldtr.Sel = uNewLdt;
4653 pCtx->ldtr.ValidSel = uNewLdt;
4654 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4655 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4656 {
4657 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4658 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4659 }
4660 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4661 {
4662 /* AMD-V seems to leave the base and limit alone. */
4663 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4664 }
4665 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4666 {
4667 /* VT-x (Intel 3960x) seems to be doing the following. */
4668 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4669 pCtx->ldtr.u64Base = 0;
4670 pCtx->ldtr.u32Limit = UINT32_MAX;
4671 }
4672
4673 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4674 return VINF_SUCCESS;
4675 }
4676
4677 /*
4678 * Read the descriptor.
4679 */
4680 IEMSELDESC Desc;
4681 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4682 if (rcStrict != VINF_SUCCESS)
4683 return rcStrict;
4684
4685 /* Check GPs first. */
4686 if (Desc.Legacy.Gen.u1DescType)
4687 {
4688 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4689 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4690 }
4691 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4692 {
4693 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4694 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4695 }
4696 uint64_t u64Base;
4697 if (!IEM_IS_LONG_MODE(pVCpu))
4698 u64Base = X86DESC_BASE(&Desc.Legacy);
4699 else
4700 {
4701 if (Desc.Long.Gen.u5Zeros)
4702 {
4703 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4704 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4705 }
4706
4707 u64Base = X86DESC64_BASE(&Desc.Long);
4708 if (!IEM_IS_CANONICAL(u64Base))
4709 {
4710 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4711 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4712 }
4713 }
4714
4715 /* NP */
4716 if (!Desc.Legacy.Gen.u1Present)
4717 {
4718 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4719 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4720 }
4721
4722 /*
4723 * It checks out alright, update the registers.
4724 */
4725/** @todo check if the actual value is loaded or if the RPL is dropped */
4726 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4727 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4728 else
4729 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4730 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4731 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4732 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4733 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4734 pCtx->ldtr.u64Base = u64Base;
4735
4736 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4737 return VINF_SUCCESS;
4738}
4739
4740
4741/**
4742 * Implements lldt.
4743 *
4744 * @param uNewLdt The new LDT selector value.
4745 */
4746IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4747{
4748 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4749
4750 /*
4751 * Check preconditions.
4752 */
4753 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4754 {
4755 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4756 return iemRaiseUndefinedOpcode(pVCpu);
4757 }
4758 if (pVCpu->iem.s.uCpl != 0)
4759 {
4760 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4761 return iemRaiseGeneralProtectionFault0(pVCpu);
4762 }
4763 if (uNewTr & X86_SEL_LDT)
4764 {
4765 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4766 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4767 }
4768 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4769 {
4770 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4771 return iemRaiseGeneralProtectionFault0(pVCpu);
4772 }
4773
4774 /*
4775 * Read the descriptor.
4776 */
4777 IEMSELDESC Desc;
4778 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4779 if (rcStrict != VINF_SUCCESS)
4780 return rcStrict;
4781
4782 /* Check GPs first. */
4783 if (Desc.Legacy.Gen.u1DescType)
4784 {
4785 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4786 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4787 }
4788 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4789 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4790 || IEM_IS_LONG_MODE(pVCpu)) )
4791 {
4792 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4793 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4794 }
4795 uint64_t u64Base;
4796 if (!IEM_IS_LONG_MODE(pVCpu))
4797 u64Base = X86DESC_BASE(&Desc.Legacy);
4798 else
4799 {
4800 if (Desc.Long.Gen.u5Zeros)
4801 {
4802 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4803 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4804 }
4805
4806 u64Base = X86DESC64_BASE(&Desc.Long);
4807 if (!IEM_IS_CANONICAL(u64Base))
4808 {
4809 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4810 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4811 }
4812 }
4813
4814 /* NP */
4815 if (!Desc.Legacy.Gen.u1Present)
4816 {
4817 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4818 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
4819 }
4820
4821 /*
4822 * Set it busy.
4823 * Note! Intel says this should lock down the whole descriptor, but we'll
4824 * restrict our selves to 32-bit for now due to lack of inline
4825 * assembly and such.
4826 */
4827 void *pvDesc;
4828 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4829 if (rcStrict != VINF_SUCCESS)
4830 return rcStrict;
4831 switch ((uintptr_t)pvDesc & 3)
4832 {
4833 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4834 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4835 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4836 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4837 }
4838 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
4839 if (rcStrict != VINF_SUCCESS)
4840 return rcStrict;
4841 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4842
4843 /*
4844 * It checks out alright, update the registers.
4845 */
4846/** @todo check if the actual value is loaded or if the RPL is dropped */
4847 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4848 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4849 else
4850 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4851 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4852 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4853 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4854 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4855 pCtx->tr.u64Base = u64Base;
4856
4857 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4858 return VINF_SUCCESS;
4859}
4860
4861
4862/**
4863 * Implements mov GReg,CRx.
4864 *
4865 * @param iGReg The general register to store the CRx value in.
4866 * @param iCrReg The CRx register to read (valid).
4867 */
4868IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4869{
4870 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4871 if (pVCpu->iem.s.uCpl != 0)
4872 return iemRaiseGeneralProtectionFault0(pVCpu);
4873 Assert(!pCtx->eflags.Bits.u1VM);
4874
4875 /* read it */
4876 uint64_t crX;
4877 switch (iCrReg)
4878 {
4879 case 0:
4880 crX = pCtx->cr0;
4881 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
4882 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4883 break;
4884 case 2: crX = pCtx->cr2; break;
4885 case 3: crX = pCtx->cr3; break;
4886 case 4: crX = pCtx->cr4; break;
4887 case 8:
4888 {
4889 uint8_t uTpr;
4890 int rc = PDMApicGetTPR(pVCpu, &uTpr, NULL, NULL);
4891 if (RT_SUCCESS(rc))
4892 crX = uTpr >> 4;
4893 else
4894 crX = 0;
4895 break;
4896 }
4897 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4898 }
4899
4900 /* store it */
4901 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
4902 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
4903 else
4904 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
4905
4906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4907 return VINF_SUCCESS;
4908}
4909
4910
4911/**
4912 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4913 *
4914 * @param iCrReg The CRx register to write (valid).
4915 * @param uNewCrX The new value.
4916 */
4917IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4918{
4919 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4920 VBOXSTRICTRC rcStrict;
4921 int rc;
4922
4923 /*
4924 * Try store it.
4925 * Unfortunately, CPUM only does a tiny bit of the work.
4926 */
4927 switch (iCrReg)
4928 {
4929 case 0:
4930 {
4931 /*
4932 * Perform checks.
4933 */
4934 uint64_t const uOldCrX = pCtx->cr0;
4935 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
4936 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
4937 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
4938
4939 /* ET is hardcoded on 486 and later. */
4940 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
4941 uNewCrX |= X86_CR0_ET;
4942 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
4943 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
4944 {
4945 uNewCrX &= fValid;
4946 uNewCrX |= X86_CR0_ET;
4947 }
4948 else
4949 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
4950
4951 /* Check for reserved bits. */
4952 if (uNewCrX & ~(uint64_t)fValid)
4953 {
4954 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4955 return iemRaiseGeneralProtectionFault0(pVCpu);
4956 }
4957
4958 /* Check for invalid combinations. */
4959 if ( (uNewCrX & X86_CR0_PG)
4960 && !(uNewCrX & X86_CR0_PE) )
4961 {
4962 Log(("Trying to set CR0.PG without CR0.PE\n"));
4963 return iemRaiseGeneralProtectionFault0(pVCpu);
4964 }
4965
4966 if ( !(uNewCrX & X86_CR0_CD)
4967 && (uNewCrX & X86_CR0_NW) )
4968 {
4969 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4970 return iemRaiseGeneralProtectionFault0(pVCpu);
4971 }
4972
4973 /* Long mode consistency checks. */
4974 if ( (uNewCrX & X86_CR0_PG)
4975 && !(uOldCrX & X86_CR0_PG)
4976 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
4977 {
4978 if (!(pCtx->cr4 & X86_CR4_PAE))
4979 {
4980 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4981 return iemRaiseGeneralProtectionFault0(pVCpu);
4982 }
4983 if (pCtx->cs.Attr.n.u1Long)
4984 {
4985 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4986 return iemRaiseGeneralProtectionFault0(pVCpu);
4987 }
4988 }
4989
4990 /** @todo check reserved PDPTR bits as AMD states. */
4991
4992 /*
4993 * Change CR0.
4994 */
4995 if (!IEM_VERIFICATION_ENABLED(pVCpu))
4996 CPUMSetGuestCR0(pVCpu, uNewCrX);
4997 else
4998 pCtx->cr0 = uNewCrX;
4999 Assert(pCtx->cr0 == uNewCrX);
5000
5001 /*
5002 * Change EFER.LMA if entering or leaving long mode.
5003 */
5004 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5005 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5006 {
5007 uint64_t NewEFER = pCtx->msrEFER;
5008 if (uNewCrX & X86_CR0_PG)
5009 NewEFER |= MSR_K6_EFER_LMA;
5010 else
5011 NewEFER &= ~MSR_K6_EFER_LMA;
5012
5013 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5014 CPUMSetGuestEFER(pVCpu, NewEFER);
5015 else
5016 pCtx->msrEFER = NewEFER;
5017 Assert(pCtx->msrEFER == NewEFER);
5018 }
5019
5020 /*
5021 * Inform PGM.
5022 */
5023 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5024 {
5025 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5026 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5027 {
5028 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5029 AssertRCReturn(rc, rc);
5030 /* ignore informational status codes */
5031 }
5032 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5033 }
5034 else
5035 rcStrict = VINF_SUCCESS;
5036
5037#ifdef IN_RC
5038 /* Return to ring-3 for rescheduling if WP or AM changes. */
5039 if ( rcStrict == VINF_SUCCESS
5040 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5041 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5042 rcStrict = VINF_EM_RESCHEDULE;
5043#endif
5044 break;
5045 }
5046
5047 /*
5048 * CR2 can be changed without any restrictions.
5049 */
5050 case 2:
5051 pCtx->cr2 = uNewCrX;
5052 rcStrict = VINF_SUCCESS;
5053 break;
5054
5055 /*
5056 * CR3 is relatively simple, although AMD and Intel have different
5057 * accounts of how setting reserved bits are handled. We take intel's
5058 * word for the lower bits and AMD's for the high bits (63:52). The
5059 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5060 * on this.
5061 */
5062 /** @todo Testcase: Setting reserved bits in CR3, especially before
5063 * enabling paging. */
5064 case 3:
5065 {
5066 /* check / mask the value. */
5067 if (uNewCrX & UINT64_C(0xfff0000000000000))
5068 {
5069 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5070 return iemRaiseGeneralProtectionFault0(pVCpu);
5071 }
5072
5073 uint64_t fValid;
5074 if ( (pCtx->cr4 & X86_CR4_PAE)
5075 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5076 fValid = UINT64_C(0x000fffffffffffff);
5077 else
5078 fValid = UINT64_C(0xffffffff);
5079 if (uNewCrX & ~fValid)
5080 {
5081 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5082 uNewCrX, uNewCrX & ~fValid));
5083 uNewCrX &= fValid;
5084 }
5085
5086 /** @todo If we're in PAE mode we should check the PDPTRs for
5087 * invalid bits. */
5088
5089 /* Make the change. */
5090 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5091 {
5092 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5093 AssertRCSuccessReturn(rc, rc);
5094 }
5095 else
5096 pCtx->cr3 = uNewCrX;
5097
5098 /* Inform PGM. */
5099 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5100 {
5101 if (pCtx->cr0 & X86_CR0_PG)
5102 {
5103 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5104 AssertRCReturn(rc, rc);
5105 /* ignore informational status codes */
5106 }
5107 }
5108 rcStrict = VINF_SUCCESS;
5109 break;
5110 }
5111
5112 /*
5113 * CR4 is a bit more tedious as there are bits which cannot be cleared
5114 * under some circumstances and such.
5115 */
5116 case 4:
5117 {
5118 uint64_t const uOldCrX = pCtx->cr4;
5119
5120 /** @todo Shouldn't this look at the guest CPUID bits to determine
5121 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5122 * should #GP(0). */
5123 /* reserved bits */
5124 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5125 | X86_CR4_TSD | X86_CR4_DE
5126 | X86_CR4_PSE | X86_CR4_PAE
5127 | X86_CR4_MCE | X86_CR4_PGE
5128 | X86_CR4_PCE | X86_CR4_OSFXSR
5129 | X86_CR4_OSXMMEEXCPT;
5130 //if (xxx)
5131 // fValid |= X86_CR4_VMXE;
5132 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5133 fValid |= X86_CR4_OSXSAVE;
5134 if (uNewCrX & ~(uint64_t)fValid)
5135 {
5136 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5137 return iemRaiseGeneralProtectionFault0(pVCpu);
5138 }
5139
5140 /* long mode checks. */
5141 if ( (uOldCrX & X86_CR4_PAE)
5142 && !(uNewCrX & X86_CR4_PAE)
5143 && CPUMIsGuestInLongModeEx(pCtx) )
5144 {
5145 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5146 return iemRaiseGeneralProtectionFault0(pVCpu);
5147 }
5148
5149
5150 /*
5151 * Change it.
5152 */
5153 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5154 {
5155 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5156 AssertRCSuccessReturn(rc, rc);
5157 }
5158 else
5159 pCtx->cr4 = uNewCrX;
5160 Assert(pCtx->cr4 == uNewCrX);
5161
5162 /*
5163 * Notify SELM and PGM.
5164 */
5165 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5166 {
5167 /* SELM - VME may change things wrt to the TSS shadowing. */
5168 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5169 {
5170 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5171 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5172#ifdef VBOX_WITH_RAW_MODE
5173 if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
5174 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5175#endif
5176 }
5177
5178 /* PGM - flushing and mode. */
5179 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
5180 {
5181 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5182 AssertRCReturn(rc, rc);
5183 /* ignore informational status codes */
5184 }
5185 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5186 }
5187 else
5188 rcStrict = VINF_SUCCESS;
5189 break;
5190 }
5191
5192 /*
5193 * CR8 maps to the APIC TPR.
5194 */
5195 case 8:
5196 if (uNewCrX & ~(uint64_t)0xf)
5197 {
5198 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5199 return iemRaiseGeneralProtectionFault0(pVCpu);
5200 }
5201
5202 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5203 PDMApicSetTPR(pVCpu, (uint8_t)uNewCrX << 4);
5204 rcStrict = VINF_SUCCESS;
5205 break;
5206
5207 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5208 }
5209
5210 /*
5211 * Advance the RIP on success.
5212 */
5213 if (RT_SUCCESS(rcStrict))
5214 {
5215 if (rcStrict != VINF_SUCCESS)
5216 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5217 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5218 }
5219
5220 return rcStrict;
5221}
5222
5223
5224/**
5225 * Implements mov CRx,GReg.
5226 *
5227 * @param iCrReg The CRx register to write (valid).
5228 * @param iGReg The general register to load the DRx value from.
5229 */
5230IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5231{
5232 if (pVCpu->iem.s.uCpl != 0)
5233 return iemRaiseGeneralProtectionFault0(pVCpu);
5234 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5235
5236 /*
5237 * Read the new value from the source register and call common worker.
5238 */
5239 uint64_t uNewCrX;
5240 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5241 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5242 else
5243 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5244 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5245}
5246
5247
5248/**
5249 * Implements 'LMSW r/m16'
5250 *
5251 * @param u16NewMsw The new value.
5252 */
5253IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5254{
5255 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5256
5257 if (pVCpu->iem.s.uCpl != 0)
5258 return iemRaiseGeneralProtectionFault0(pVCpu);
5259 Assert(!pCtx->eflags.Bits.u1VM);
5260
5261 /*
5262 * Compose the new CR0 value and call common worker.
5263 */
5264 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5265 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5266 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5267}
5268
5269
5270/**
5271 * Implements 'CLTS'.
5272 */
5273IEM_CIMPL_DEF_0(iemCImpl_clts)
5274{
5275 if (pVCpu->iem.s.uCpl != 0)
5276 return iemRaiseGeneralProtectionFault0(pVCpu);
5277
5278 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5279 uint64_t uNewCr0 = pCtx->cr0;
5280 uNewCr0 &= ~X86_CR0_TS;
5281 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5282}
5283
5284
5285/**
5286 * Implements mov GReg,DRx.
5287 *
5288 * @param iGReg The general register to store the DRx value in.
5289 * @param iDrReg The DRx register to read (0-7).
5290 */
5291IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5292{
5293 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5294
5295 /*
5296 * Check preconditions.
5297 */
5298
5299 /* Raise GPs. */
5300 if (pVCpu->iem.s.uCpl != 0)
5301 return iemRaiseGeneralProtectionFault0(pVCpu);
5302 Assert(!pCtx->eflags.Bits.u1VM);
5303
5304 if ( (iDrReg == 4 || iDrReg == 5)
5305 && (pCtx->cr4 & X86_CR4_DE) )
5306 {
5307 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5308 return iemRaiseGeneralProtectionFault0(pVCpu);
5309 }
5310
5311 /* Raise #DB if general access detect is enabled. */
5312 if (pCtx->dr[7] & X86_DR7_GD)
5313 {
5314 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5315 return iemRaiseDebugException(pVCpu);
5316 }
5317
5318 /*
5319 * Read the debug register and store it in the specified general register.
5320 */
5321 uint64_t drX;
5322 switch (iDrReg)
5323 {
5324 case 0: drX = pCtx->dr[0]; break;
5325 case 1: drX = pCtx->dr[1]; break;
5326 case 2: drX = pCtx->dr[2]; break;
5327 case 3: drX = pCtx->dr[3]; break;
5328 case 6:
5329 case 4:
5330 drX = pCtx->dr[6];
5331 drX |= X86_DR6_RA1_MASK;
5332 drX &= ~X86_DR6_RAZ_MASK;
5333 break;
5334 case 7:
5335 case 5:
5336 drX = pCtx->dr[7];
5337 drX |=X86_DR7_RA1_MASK;
5338 drX &= ~X86_DR7_RAZ_MASK;
5339 break;
5340 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5341 }
5342
5343 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5344 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5345 else
5346 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5347
5348 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5349 return VINF_SUCCESS;
5350}
5351
5352
5353/**
5354 * Implements mov DRx,GReg.
5355 *
5356 * @param iDrReg The DRx register to write (valid).
5357 * @param iGReg The general register to load the DRx value from.
5358 */
5359IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5360{
5361 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5362
5363 /*
5364 * Check preconditions.
5365 */
5366 if (pVCpu->iem.s.uCpl != 0)
5367 return iemRaiseGeneralProtectionFault0(pVCpu);
5368 Assert(!pCtx->eflags.Bits.u1VM);
5369
5370 if (iDrReg == 4 || iDrReg == 5)
5371 {
5372 if (pCtx->cr4 & X86_CR4_DE)
5373 {
5374 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5375 return iemRaiseGeneralProtectionFault0(pVCpu);
5376 }
5377 iDrReg += 2;
5378 }
5379
5380 /* Raise #DB if general access detect is enabled. */
5381 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5382 * \#GP? */
5383 if (pCtx->dr[7] & X86_DR7_GD)
5384 {
5385 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5386 return iemRaiseDebugException(pVCpu);
5387 }
5388
5389 /*
5390 * Read the new value from the source register.
5391 */
5392 uint64_t uNewDrX;
5393 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5394 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5395 else
5396 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5397
5398 /*
5399 * Adjust it.
5400 */
5401 switch (iDrReg)
5402 {
5403 case 0:
5404 case 1:
5405 case 2:
5406 case 3:
5407 /* nothing to adjust */
5408 break;
5409
5410 case 6:
5411 if (uNewDrX & X86_DR6_MBZ_MASK)
5412 {
5413 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5414 return iemRaiseGeneralProtectionFault0(pVCpu);
5415 }
5416 uNewDrX |= X86_DR6_RA1_MASK;
5417 uNewDrX &= ~X86_DR6_RAZ_MASK;
5418 break;
5419
5420 case 7:
5421 if (uNewDrX & X86_DR7_MBZ_MASK)
5422 {
5423 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5424 return iemRaiseGeneralProtectionFault0(pVCpu);
5425 }
5426 uNewDrX |= X86_DR7_RA1_MASK;
5427 uNewDrX &= ~X86_DR7_RAZ_MASK;
5428 break;
5429
5430 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5431 }
5432
5433 /*
5434 * Do the actual setting.
5435 */
5436 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5437 {
5438 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5439 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5440 }
5441 else
5442 pCtx->dr[iDrReg] = uNewDrX;
5443
5444 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5445 return VINF_SUCCESS;
5446}
5447
5448
5449/**
5450 * Implements 'INVLPG m'.
5451 *
5452 * @param GCPtrPage The effective address of the page to invalidate.
5453 * @remarks Updates the RIP.
5454 */
5455IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5456{
5457 /* ring-0 only. */
5458 if (pVCpu->iem.s.uCpl != 0)
5459 return iemRaiseGeneralProtectionFault0(pVCpu);
5460 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5461
5462 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5463 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5464
5465 if (rc == VINF_SUCCESS)
5466 return VINF_SUCCESS;
5467 if (rc == VINF_PGM_SYNC_CR3)
5468 return iemSetPassUpStatus(pVCpu, rc);
5469
5470 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5471 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5472 return rc;
5473}
5474
5475
5476/**
5477 * Implements RDTSC.
5478 */
5479IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5480{
5481 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5482
5483 /*
5484 * Check preconditions.
5485 */
5486 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5487 return iemRaiseUndefinedOpcode(pVCpu);
5488
5489 if ( (pCtx->cr4 & X86_CR4_TSD)
5490 && pVCpu->iem.s.uCpl != 0)
5491 {
5492 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5493 return iemRaiseGeneralProtectionFault0(pVCpu);
5494 }
5495
5496 /*
5497 * Do the job.
5498 */
5499 uint64_t uTicks = TMCpuTickGet(pVCpu);
5500 pCtx->rax = (uint32_t)uTicks;
5501 pCtx->rdx = uTicks >> 32;
5502#ifdef IEM_VERIFICATION_MODE_FULL
5503 pVCpu->iem.s.fIgnoreRaxRdx = true;
5504#endif
5505
5506 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5507 return VINF_SUCCESS;
5508}
5509
5510
5511/**
5512 * Implements RDMSR.
5513 */
5514IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5515{
5516 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5517
5518 /*
5519 * Check preconditions.
5520 */
5521 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5522 return iemRaiseUndefinedOpcode(pVCpu);
5523 if (pVCpu->iem.s.uCpl != 0)
5524 return iemRaiseGeneralProtectionFault0(pVCpu);
5525
5526 /*
5527 * Do the job.
5528 */
5529 RTUINT64U uValue;
5530 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
5531 if (rcStrict == VINF_SUCCESS)
5532 {
5533 pCtx->rax = uValue.s.Lo;
5534 pCtx->rdx = uValue.s.Hi;
5535
5536 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5537 return VINF_SUCCESS;
5538 }
5539
5540#ifndef IN_RING3
5541 /* Deferred to ring-3. */
5542 if (rcStrict == VINF_CPUM_R3_MSR_READ)
5543 {
5544 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5545 return rcStrict;
5546 }
5547#else /* IN_RING3 */
5548 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5549 static uint32_t s_cTimes = 0;
5550 if (s_cTimes++ < 10)
5551 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5552 else
5553#endif
5554 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5555 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5556 return iemRaiseGeneralProtectionFault0(pVCpu);
5557}
5558
5559
5560/**
5561 * Implements WRMSR.
5562 */
5563IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5564{
5565 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5566
5567 /*
5568 * Check preconditions.
5569 */
5570 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5571 return iemRaiseUndefinedOpcode(pVCpu);
5572 if (pVCpu->iem.s.uCpl != 0)
5573 return iemRaiseGeneralProtectionFault0(pVCpu);
5574
5575 /*
5576 * Do the job.
5577 */
5578 RTUINT64U uValue;
5579 uValue.s.Lo = pCtx->eax;
5580 uValue.s.Hi = pCtx->edx;
5581
5582 VBOXSTRICTRC rcStrict;
5583 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5584 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5585 else
5586 {
5587#ifdef IN_RING3
5588 CPUMCTX CtxTmp = *pCtx;
5589 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5590 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
5591 *pCtx = *pCtx2;
5592 *pCtx2 = CtxTmp;
5593#else
5594 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5595#endif
5596 }
5597 if (rcStrict == VINF_SUCCESS)
5598 {
5599 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5600 return VINF_SUCCESS;
5601 }
5602
5603#ifndef IN_RING3
5604 /* Deferred to ring-3. */
5605 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5606 {
5607 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5608 return rcStrict;
5609 }
5610#else /* IN_RING3 */
5611 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5612 static uint32_t s_cTimes = 0;
5613 if (s_cTimes++ < 10)
5614 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5615 else
5616#endif
5617 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5618 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5619 return iemRaiseGeneralProtectionFault0(pVCpu);
5620}
5621
5622
5623/**
5624 * Implements 'IN eAX, port'.
5625 *
5626 * @param u16Port The source port.
5627 * @param cbReg The register size.
5628 */
5629IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5630{
5631 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5632
5633 /*
5634 * CPL check
5635 */
5636 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5637 if (rcStrict != VINF_SUCCESS)
5638 return rcStrict;
5639
5640 /*
5641 * Perform the I/O.
5642 */
5643 uint32_t u32Value;
5644 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5645 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
5646 else
5647 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
5648 if (IOM_SUCCESS(rcStrict))
5649 {
5650 switch (cbReg)
5651 {
5652 case 1: pCtx->al = (uint8_t)u32Value; break;
5653 case 2: pCtx->ax = (uint16_t)u32Value; break;
5654 case 4: pCtx->rax = u32Value; break;
5655 default: AssertFailedReturn(VERR_IEM_IPE_3);
5656 }
5657 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5658 pVCpu->iem.s.cPotentialExits++;
5659 if (rcStrict != VINF_SUCCESS)
5660 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5661 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5662
5663 /*
5664 * Check for I/O breakpoints.
5665 */
5666 uint32_t const uDr7 = pCtx->dr[7];
5667 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5668 && X86_DR7_ANY_RW_IO(uDr7)
5669 && (pCtx->cr4 & X86_CR4_DE))
5670 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5671 {
5672 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5673 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5674 rcStrict = iemRaiseDebugException(pVCpu);
5675 }
5676 }
5677
5678 return rcStrict;
5679}
5680
5681
5682/**
5683 * Implements 'IN eAX, DX'.
5684 *
5685 * @param cbReg The register size.
5686 */
5687IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5688{
5689 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
5690}
5691
5692
5693/**
5694 * Implements 'OUT port, eAX'.
5695 *
5696 * @param u16Port The destination port.
5697 * @param cbReg The register size.
5698 */
5699IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5700{
5701 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5702
5703 /*
5704 * CPL check
5705 */
5706 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5707 if (rcStrict != VINF_SUCCESS)
5708 return rcStrict;
5709
5710 /*
5711 * Perform the I/O.
5712 */
5713 uint32_t u32Value;
5714 switch (cbReg)
5715 {
5716 case 1: u32Value = pCtx->al; break;
5717 case 2: u32Value = pCtx->ax; break;
5718 case 4: u32Value = pCtx->eax; break;
5719 default: AssertFailedReturn(VERR_IEM_IPE_4);
5720 }
5721 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5722 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
5723 else
5724 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
5725 if (IOM_SUCCESS(rcStrict))
5726 {
5727 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5728 pVCpu->iem.s.cPotentialExits++;
5729 if (rcStrict != VINF_SUCCESS)
5730 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5731 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5732
5733 /*
5734 * Check for I/O breakpoints.
5735 */
5736 uint32_t const uDr7 = pCtx->dr[7];
5737 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5738 && X86_DR7_ANY_RW_IO(uDr7)
5739 && (pCtx->cr4 & X86_CR4_DE))
5740 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5741 {
5742 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5743 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5744 rcStrict = iemRaiseDebugException(pVCpu);
5745 }
5746 }
5747 return rcStrict;
5748}
5749
5750
5751/**
5752 * Implements 'OUT DX, eAX'.
5753 *
5754 * @param cbReg The register size.
5755 */
5756IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5757{
5758 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
5759}
5760
5761
5762/**
5763 * Implements 'CLI'.
5764 */
5765IEM_CIMPL_DEF_0(iemCImpl_cli)
5766{
5767 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5768 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5769 uint32_t const fEflOld = fEfl;
5770 if (pCtx->cr0 & X86_CR0_PE)
5771 {
5772 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5773 if (!(fEfl & X86_EFL_VM))
5774 {
5775 if (pVCpu->iem.s.uCpl <= uIopl)
5776 fEfl &= ~X86_EFL_IF;
5777 else if ( pVCpu->iem.s.uCpl == 3
5778 && (pCtx->cr4 & X86_CR4_PVI) )
5779 fEfl &= ~X86_EFL_VIF;
5780 else
5781 return iemRaiseGeneralProtectionFault0(pVCpu);
5782 }
5783 /* V8086 */
5784 else if (uIopl == 3)
5785 fEfl &= ~X86_EFL_IF;
5786 else if ( uIopl < 3
5787 && (pCtx->cr4 & X86_CR4_VME) )
5788 fEfl &= ~X86_EFL_VIF;
5789 else
5790 return iemRaiseGeneralProtectionFault0(pVCpu);
5791 }
5792 /* real mode */
5793 else
5794 fEfl &= ~X86_EFL_IF;
5795
5796 /* Commit. */
5797 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5798 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5799 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5800 return VINF_SUCCESS;
5801}
5802
5803
5804/**
5805 * Implements 'STI'.
5806 */
5807IEM_CIMPL_DEF_0(iemCImpl_sti)
5808{
5809 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5810 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5811 uint32_t const fEflOld = fEfl;
5812
5813 if (pCtx->cr0 & X86_CR0_PE)
5814 {
5815 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5816 if (!(fEfl & X86_EFL_VM))
5817 {
5818 if (pVCpu->iem.s.uCpl <= uIopl)
5819 fEfl |= X86_EFL_IF;
5820 else if ( pVCpu->iem.s.uCpl == 3
5821 && (pCtx->cr4 & X86_CR4_PVI)
5822 && !(fEfl & X86_EFL_VIP) )
5823 fEfl |= X86_EFL_VIF;
5824 else
5825 return iemRaiseGeneralProtectionFault0(pVCpu);
5826 }
5827 /* V8086 */
5828 else if (uIopl == 3)
5829 fEfl |= X86_EFL_IF;
5830 else if ( uIopl < 3
5831 && (pCtx->cr4 & X86_CR4_VME)
5832 && !(fEfl & X86_EFL_VIP) )
5833 fEfl |= X86_EFL_VIF;
5834 else
5835 return iemRaiseGeneralProtectionFault0(pVCpu);
5836 }
5837 /* real mode */
5838 else
5839 fEfl |= X86_EFL_IF;
5840
5841 /* Commit. */
5842 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5843 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5844 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
5845 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
5846 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5847 return VINF_SUCCESS;
5848}
5849
5850
5851/**
5852 * Implements 'HLT'.
5853 */
5854IEM_CIMPL_DEF_0(iemCImpl_hlt)
5855{
5856 if (pVCpu->iem.s.uCpl != 0)
5857 return iemRaiseGeneralProtectionFault0(pVCpu);
5858 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5859 return VINF_EM_HALT;
5860}
5861
5862
5863/**
5864 * Implements 'MONITOR'.
5865 */
5866IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5867{
5868 /*
5869 * Permission checks.
5870 */
5871 if (pVCpu->iem.s.uCpl != 0)
5872 {
5873 Log2(("monitor: CPL != 0\n"));
5874 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5875 }
5876 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5877 {
5878 Log2(("monitor: Not in CPUID\n"));
5879 return iemRaiseUndefinedOpcode(pVCpu);
5880 }
5881
5882 /*
5883 * Gather the operands and validate them.
5884 */
5885 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5886 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5887 uint32_t uEcx = pCtx->ecx;
5888 uint32_t uEdx = pCtx->edx;
5889/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5890 * \#GP first. */
5891 if (uEcx != 0)
5892 {
5893 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
5894 return iemRaiseGeneralProtectionFault0(pVCpu);
5895 }
5896
5897 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
5898 if (rcStrict != VINF_SUCCESS)
5899 return rcStrict;
5900
5901 RTGCPHYS GCPhysMem;
5902 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
5903 if (rcStrict != VINF_SUCCESS)
5904 return rcStrict;
5905
5906 /*
5907 * Call EM to prepare the monitor/wait.
5908 */
5909 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
5910 Assert(rcStrict == VINF_SUCCESS);
5911
5912 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5913 return rcStrict;
5914}
5915
5916
5917/**
5918 * Implements 'MWAIT'.
5919 */
5920IEM_CIMPL_DEF_0(iemCImpl_mwait)
5921{
5922 /*
5923 * Permission checks.
5924 */
5925 if (pVCpu->iem.s.uCpl != 0)
5926 {
5927 Log2(("mwait: CPL != 0\n"));
5928 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
5929 * EFLAGS.VM then.) */
5930 return iemRaiseUndefinedOpcode(pVCpu);
5931 }
5932 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5933 {
5934 Log2(("mwait: Not in CPUID\n"));
5935 return iemRaiseUndefinedOpcode(pVCpu);
5936 }
5937
5938 /*
5939 * Gather the operands and validate them.
5940 */
5941 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5942 uint32_t uEax = pCtx->eax;
5943 uint32_t uEcx = pCtx->ecx;
5944 if (uEcx != 0)
5945 {
5946 /* Only supported extension is break on IRQ when IF=0. */
5947 if (uEcx > 1)
5948 {
5949 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5950 return iemRaiseGeneralProtectionFault0(pVCpu);
5951 }
5952 uint32_t fMWaitFeatures = 0;
5953 uint32_t uIgnore = 0;
5954 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5955 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5956 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5957 {
5958 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5959 return iemRaiseGeneralProtectionFault0(pVCpu);
5960 }
5961 }
5962
5963 /*
5964 * Call EM to prepare the monitor/wait.
5965 */
5966 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
5967
5968 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5969 return rcStrict;
5970}
5971
5972
5973/**
5974 * Implements 'SWAPGS'.
5975 */
5976IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5977{
5978 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5979
5980 /*
5981 * Permission checks.
5982 */
5983 if (pVCpu->iem.s.uCpl != 0)
5984 {
5985 Log2(("swapgs: CPL != 0\n"));
5986 return iemRaiseUndefinedOpcode(pVCpu);
5987 }
5988
5989 /*
5990 * Do the job.
5991 */
5992 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5993 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5994 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5995 pCtx->gs.u64Base = uOtherGsBase;
5996
5997 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5998 return VINF_SUCCESS;
5999}
6000
6001
6002/**
6003 * Implements 'CPUID'.
6004 */
6005IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6006{
6007 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6008
6009 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6010 pCtx->rax &= UINT32_C(0xffffffff);
6011 pCtx->rbx &= UINT32_C(0xffffffff);
6012 pCtx->rcx &= UINT32_C(0xffffffff);
6013 pCtx->rdx &= UINT32_C(0xffffffff);
6014
6015 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6016 return VINF_SUCCESS;
6017}
6018
6019
6020/**
6021 * Implements 'AAD'.
6022 *
6023 * @param bImm The immediate operand.
6024 */
6025IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6026{
6027 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6028
6029 uint16_t const ax = pCtx->ax;
6030 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6031 pCtx->ax = al;
6032 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6033 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6034 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6035
6036 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6037 return VINF_SUCCESS;
6038}
6039
6040
6041/**
6042 * Implements 'AAM'.
6043 *
6044 * @param bImm The immediate operand. Cannot be 0.
6045 */
6046IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6047{
6048 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6049 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6050
6051 uint16_t const ax = pCtx->ax;
6052 uint8_t const al = (uint8_t)ax % bImm;
6053 uint8_t const ah = (uint8_t)ax / bImm;
6054 pCtx->ax = (ah << 8) + al;
6055 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6056 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6057 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6058
6059 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6060 return VINF_SUCCESS;
6061}
6062
6063
6064/**
6065 * Implements 'DAA'.
6066 */
6067IEM_CIMPL_DEF_0(iemCImpl_daa)
6068{
6069 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6070
6071 uint8_t const al = pCtx->al;
6072 bool const fCarry = pCtx->eflags.Bits.u1CF;
6073
6074 if ( pCtx->eflags.Bits.u1AF
6075 || (al & 0xf) >= 10)
6076 {
6077 pCtx->al = al + 6;
6078 pCtx->eflags.Bits.u1AF = 1;
6079 }
6080 else
6081 pCtx->eflags.Bits.u1AF = 0;
6082
6083 if (al >= 0x9a || fCarry)
6084 {
6085 pCtx->al += 0x60;
6086 pCtx->eflags.Bits.u1CF = 1;
6087 }
6088 else
6089 pCtx->eflags.Bits.u1CF = 0;
6090
6091 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6092 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6093 return VINF_SUCCESS;
6094}
6095
6096
6097/**
6098 * Implements 'DAS'.
6099 */
6100IEM_CIMPL_DEF_0(iemCImpl_das)
6101{
6102 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6103
6104 uint8_t const uInputAL = pCtx->al;
6105 bool const fCarry = pCtx->eflags.Bits.u1CF;
6106
6107 if ( pCtx->eflags.Bits.u1AF
6108 || (uInputAL & 0xf) >= 10)
6109 {
6110 pCtx->eflags.Bits.u1AF = 1;
6111 if (uInputAL < 6)
6112 pCtx->eflags.Bits.u1CF = 1;
6113 pCtx->al = uInputAL - 6;
6114 }
6115 else
6116 {
6117 pCtx->eflags.Bits.u1AF = 0;
6118 pCtx->eflags.Bits.u1CF = 0;
6119 }
6120
6121 if (uInputAL >= 0x9a || fCarry)
6122 {
6123 pCtx->al -= 0x60;
6124 pCtx->eflags.Bits.u1CF = 1;
6125 }
6126
6127 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6128 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6129 return VINF_SUCCESS;
6130}
6131
6132
6133
6134
6135/*
6136 * Instantiate the various string operation combinations.
6137 */
6138#define OP_SIZE 8
6139#define ADDR_SIZE 16
6140#include "IEMAllCImplStrInstr.cpp.h"
6141#define OP_SIZE 8
6142#define ADDR_SIZE 32
6143#include "IEMAllCImplStrInstr.cpp.h"
6144#define OP_SIZE 8
6145#define ADDR_SIZE 64
6146#include "IEMAllCImplStrInstr.cpp.h"
6147
6148#define OP_SIZE 16
6149#define ADDR_SIZE 16
6150#include "IEMAllCImplStrInstr.cpp.h"
6151#define OP_SIZE 16
6152#define ADDR_SIZE 32
6153#include "IEMAllCImplStrInstr.cpp.h"
6154#define OP_SIZE 16
6155#define ADDR_SIZE 64
6156#include "IEMAllCImplStrInstr.cpp.h"
6157
6158#define OP_SIZE 32
6159#define ADDR_SIZE 16
6160#include "IEMAllCImplStrInstr.cpp.h"
6161#define OP_SIZE 32
6162#define ADDR_SIZE 32
6163#include "IEMAllCImplStrInstr.cpp.h"
6164#define OP_SIZE 32
6165#define ADDR_SIZE 64
6166#include "IEMAllCImplStrInstr.cpp.h"
6167
6168#define OP_SIZE 64
6169#define ADDR_SIZE 32
6170#include "IEMAllCImplStrInstr.cpp.h"
6171#define OP_SIZE 64
6172#define ADDR_SIZE 64
6173#include "IEMAllCImplStrInstr.cpp.h"
6174
6175
6176/**
6177 * Implements 'XGETBV'.
6178 */
6179IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6180{
6181 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6182 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6183 {
6184 uint32_t uEcx = pCtx->ecx;
6185 switch (uEcx)
6186 {
6187 case 0:
6188 break;
6189
6190 case 1: /** @todo Implement XCR1 support. */
6191 default:
6192 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6193 return iemRaiseGeneralProtectionFault0(pVCpu);
6194
6195 }
6196 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6197 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6198
6199 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6200 return VINF_SUCCESS;
6201 }
6202 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6203 return iemRaiseUndefinedOpcode(pVCpu);
6204}
6205
6206
6207/**
6208 * Implements 'XSETBV'.
6209 */
6210IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6211{
6212 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6213 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6214 {
6215 if (pVCpu->iem.s.uCpl == 0)
6216 {
6217 uint32_t uEcx = pCtx->ecx;
6218 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6219 switch (uEcx)
6220 {
6221 case 0:
6222 {
6223 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
6224 if (rc == VINF_SUCCESS)
6225 break;
6226 Assert(rc == VERR_CPUM_RAISE_GP_0);
6227 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6228 return iemRaiseGeneralProtectionFault0(pVCpu);
6229 }
6230
6231 case 1: /** @todo Implement XCR1 support. */
6232 default:
6233 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6234 return iemRaiseGeneralProtectionFault0(pVCpu);
6235
6236 }
6237
6238 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6239 return VINF_SUCCESS;
6240 }
6241
6242 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
6243 return iemRaiseGeneralProtectionFault0(pVCpu);
6244 }
6245 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6246 return iemRaiseUndefinedOpcode(pVCpu);
6247}
6248
6249
6250
6251/**
6252 * Implements 'FINIT' and 'FNINIT'.
6253 *
6254 * @param fCheckXcpts Whether to check for umasked pending exceptions or
6255 * not.
6256 */
6257IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6258{
6259 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6260
6261 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6262 return iemRaiseDeviceNotAvailable(pVCpu);
6263
6264 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6265 if (fCheckXcpts && TODO )
6266 return iemRaiseMathFault(pVCpu);
6267 */
6268
6269 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6270 pXState->x87.FCW = 0x37f;
6271 pXState->x87.FSW = 0;
6272 pXState->x87.FTW = 0x00; /* 0 - empty. */
6273 pXState->x87.FPUDP = 0;
6274 pXState->x87.DS = 0; //??
6275 pXState->x87.Rsrvd2= 0;
6276 pXState->x87.FPUIP = 0;
6277 pXState->x87.CS = 0; //??
6278 pXState->x87.Rsrvd1= 0;
6279 pXState->x87.FOP = 0;
6280
6281 iemHlpUsedFpu(pVCpu);
6282 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6283 return VINF_SUCCESS;
6284}
6285
6286
6287/**
6288 * Implements 'FXSAVE'.
6289 *
6290 * @param iEffSeg The effective segment.
6291 * @param GCPtrEff The address of the image.
6292 * @param enmEffOpSize The operand size (only REX.W really matters).
6293 */
6294IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6295{
6296 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6297
6298 /*
6299 * Raise exceptions.
6300 */
6301 if (pCtx->cr0 & X86_CR0_EM)
6302 return iemRaiseUndefinedOpcode(pVCpu);
6303 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6304 return iemRaiseDeviceNotAvailable(pVCpu);
6305 if (GCPtrEff & 15)
6306 {
6307 /** @todo CPU/VM detection possible! \#AC might not be signal for
6308 * all/any misalignment sizes, intel says its an implementation detail. */
6309 if ( (pCtx->cr0 & X86_CR0_AM)
6310 && pCtx->eflags.Bits.u1AC
6311 && pVCpu->iem.s.uCpl == 3)
6312 return iemRaiseAlignmentCheckException(pVCpu);
6313 return iemRaiseGeneralProtectionFault0(pVCpu);
6314 }
6315
6316 /*
6317 * Access the memory.
6318 */
6319 void *pvMem512;
6320 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6321 if (rcStrict != VINF_SUCCESS)
6322 return rcStrict;
6323 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6324 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6325
6326 /*
6327 * Store the registers.
6328 */
6329 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6330 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6331
6332 /* common for all formats */
6333 pDst->FCW = pSrc->FCW;
6334 pDst->FSW = pSrc->FSW;
6335 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6336 pDst->FOP = pSrc->FOP;
6337 pDst->MXCSR = pSrc->MXCSR;
6338 pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6339 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6340 {
6341 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6342 * them for now... */
6343 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6344 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6345 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6346 pDst->aRegs[i].au32[3] = 0;
6347 }
6348
6349 /* FPU IP, CS, DP and DS. */
6350 pDst->FPUIP = pSrc->FPUIP;
6351 pDst->CS = pSrc->CS;
6352 pDst->FPUDP = pSrc->FPUDP;
6353 pDst->DS = pSrc->DS;
6354 if (enmEffOpSize == IEMMODE_64BIT)
6355 {
6356 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6357 pDst->Rsrvd1 = pSrc->Rsrvd1;
6358 pDst->Rsrvd2 = pSrc->Rsrvd2;
6359 pDst->au32RsrvdForSoftware[0] = 0;
6360 }
6361 else
6362 {
6363 pDst->Rsrvd1 = 0;
6364 pDst->Rsrvd2 = 0;
6365 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6366 }
6367
6368 /* XMM registers. */
6369 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6370 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6371 || pVCpu->iem.s.uCpl != 0)
6372 {
6373 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6374 for (uint32_t i = 0; i < cXmmRegs; i++)
6375 pDst->aXMM[i] = pSrc->aXMM[i];
6376 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6377 * right? */
6378 }
6379
6380 /*
6381 * Commit the memory.
6382 */
6383 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6384 if (rcStrict != VINF_SUCCESS)
6385 return rcStrict;
6386
6387 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6388 return VINF_SUCCESS;
6389}
6390
6391
6392/**
6393 * Implements 'FXRSTOR'.
6394 *
6395 * @param GCPtrEff The address of the image.
6396 * @param enmEffOpSize The operand size (only REX.W really matters).
6397 */
6398IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6399{
6400 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6401
6402 /*
6403 * Raise exceptions.
6404 */
6405 if (pCtx->cr0 & X86_CR0_EM)
6406 return iemRaiseUndefinedOpcode(pVCpu);
6407 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6408 return iemRaiseDeviceNotAvailable(pVCpu);
6409 if (GCPtrEff & 15)
6410 {
6411 /** @todo CPU/VM detection possible! \#AC might not be signal for
6412 * all/any misalignment sizes, intel says its an implementation detail. */
6413 if ( (pCtx->cr0 & X86_CR0_AM)
6414 && pCtx->eflags.Bits.u1AC
6415 && pVCpu->iem.s.uCpl == 3)
6416 return iemRaiseAlignmentCheckException(pVCpu);
6417 return iemRaiseGeneralProtectionFault0(pVCpu);
6418 }
6419
6420 /*
6421 * Access the memory.
6422 */
6423 void *pvMem512;
6424 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6425 if (rcStrict != VINF_SUCCESS)
6426 return rcStrict;
6427 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6428 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6429
6430 /*
6431 * Check the state for stuff which will #GP(0).
6432 */
6433 uint32_t const fMXCSR = pSrc->MXCSR;
6434 uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6435 if (fMXCSR & ~fMXCSR_MASK)
6436 {
6437 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6438 return iemRaiseGeneralProtectionFault0(pVCpu);
6439 }
6440
6441 /*
6442 * Load the registers.
6443 */
6444 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6445 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6446
6447 /* common for all formats */
6448 pDst->FCW = pSrc->FCW;
6449 pDst->FSW = pSrc->FSW;
6450 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6451 pDst->FOP = pSrc->FOP;
6452 pDst->MXCSR = fMXCSR;
6453 /* (MXCSR_MASK is read-only) */
6454 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6455 {
6456 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6457 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6458 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6459 pDst->aRegs[i].au32[3] = 0;
6460 }
6461
6462 /* FPU IP, CS, DP and DS. */
6463 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6464 {
6465 pDst->FPUIP = pSrc->FPUIP;
6466 pDst->CS = pSrc->CS;
6467 pDst->Rsrvd1 = pSrc->Rsrvd1;
6468 pDst->FPUDP = pSrc->FPUDP;
6469 pDst->DS = pSrc->DS;
6470 pDst->Rsrvd2 = pSrc->Rsrvd2;
6471 }
6472 else
6473 {
6474 pDst->FPUIP = pSrc->FPUIP;
6475 pDst->CS = pSrc->CS;
6476 pDst->Rsrvd1 = 0;
6477 pDst->FPUDP = pSrc->FPUDP;
6478 pDst->DS = pSrc->DS;
6479 pDst->Rsrvd2 = 0;
6480 }
6481
6482 /* XMM registers. */
6483 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6484 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6485 || pVCpu->iem.s.uCpl != 0)
6486 {
6487 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6488 for (uint32_t i = 0; i < cXmmRegs; i++)
6489 pDst->aXMM[i] = pSrc->aXMM[i];
6490 }
6491
6492 /*
6493 * Commit the memory.
6494 */
6495 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
6496 if (rcStrict != VINF_SUCCESS)
6497 return rcStrict;
6498
6499 iemHlpUsedFpu(pVCpu);
6500 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6501 return VINF_SUCCESS;
6502}
6503
6504
6505/**
6506 * Commmon routine for fnstenv and fnsave.
6507 *
6508 * @param uPtr Where to store the state.
6509 * @param pCtx The CPU context.
6510 */
6511static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6512{
6513 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6514 if (enmEffOpSize == IEMMODE_16BIT)
6515 {
6516 uPtr.pu16[0] = pSrcX87->FCW;
6517 uPtr.pu16[1] = pSrcX87->FSW;
6518 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6519 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6520 {
6521 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
6522 * protected mode or long mode and we save it in real mode? And vice
6523 * versa? And with 32-bit operand size? I think CPU is storing the
6524 * effective address ((CS << 4) + IP) in the offset register and not
6525 * doing any address calculations here. */
6526 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6527 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
6528 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6529 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6530 }
6531 else
6532 {
6533 uPtr.pu16[3] = pSrcX87->FPUIP;
6534 uPtr.pu16[4] = pSrcX87->CS;
6535 uPtr.pu16[5] = pSrcX87->FPUDP;
6536 uPtr.pu16[6] = pSrcX87->DS;
6537 }
6538 }
6539 else
6540 {
6541 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6542 uPtr.pu16[0*2] = pSrcX87->FCW;
6543 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
6544 uPtr.pu16[1*2] = pSrcX87->FSW;
6545 uPtr.pu16[1*2+1] = 0xffff;
6546 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6547 uPtr.pu16[2*2+1] = 0xffff;
6548 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6549 {
6550 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6551 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
6552 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6553 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6554 }
6555 else
6556 {
6557 uPtr.pu32[3] = pSrcX87->FPUIP;
6558 uPtr.pu16[4*2] = pSrcX87->CS;
6559 uPtr.pu16[4*2+1] = pSrcX87->FOP;
6560 uPtr.pu32[5] = pSrcX87->FPUDP;
6561 uPtr.pu16[6*2] = pSrcX87->DS;
6562 uPtr.pu16[6*2+1] = 0xffff;
6563 }
6564 }
6565}
6566
6567
6568/**
6569 * Commmon routine for fldenv and frstor
6570 *
6571 * @param uPtr Where to store the state.
6572 * @param pCtx The CPU context.
6573 */
6574static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6575{
6576 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6577 if (enmEffOpSize == IEMMODE_16BIT)
6578 {
6579 pDstX87->FCW = uPtr.pu16[0];
6580 pDstX87->FSW = uPtr.pu16[1];
6581 pDstX87->FTW = uPtr.pu16[2];
6582 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6583 {
6584 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6585 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6586 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6587 pDstX87->CS = 0;
6588 pDstX87->Rsrvd1= 0;
6589 pDstX87->DS = 0;
6590 pDstX87->Rsrvd2= 0;
6591 }
6592 else
6593 {
6594 pDstX87->FPUIP = uPtr.pu16[3];
6595 pDstX87->CS = uPtr.pu16[4];
6596 pDstX87->Rsrvd1= 0;
6597 pDstX87->FPUDP = uPtr.pu16[5];
6598 pDstX87->DS = uPtr.pu16[6];
6599 pDstX87->Rsrvd2= 0;
6600 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6601 }
6602 }
6603 else
6604 {
6605 pDstX87->FCW = uPtr.pu16[0*2];
6606 pDstX87->FSW = uPtr.pu16[1*2];
6607 pDstX87->FTW = uPtr.pu16[2*2];
6608 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6609 {
6610 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6611 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6612 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6613 pDstX87->CS = 0;
6614 pDstX87->Rsrvd1= 0;
6615 pDstX87->DS = 0;
6616 pDstX87->Rsrvd2= 0;
6617 }
6618 else
6619 {
6620 pDstX87->FPUIP = uPtr.pu32[3];
6621 pDstX87->CS = uPtr.pu16[4*2];
6622 pDstX87->Rsrvd1= 0;
6623 pDstX87->FOP = uPtr.pu16[4*2+1];
6624 pDstX87->FPUDP = uPtr.pu32[5];
6625 pDstX87->DS = uPtr.pu16[6*2];
6626 pDstX87->Rsrvd2= 0;
6627 }
6628 }
6629
6630 /* Make adjustments. */
6631 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6632 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6633 iemFpuRecalcExceptionStatus(pDstX87);
6634 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
6635 * exceptions are pending after loading the saved state? */
6636}
6637
6638
6639/**
6640 * Implements 'FNSTENV'.
6641 *
6642 * @param enmEffOpSize The operand size (only REX.W really matters).
6643 * @param iEffSeg The effective segment register for @a GCPtrEff.
6644 * @param GCPtrEffDst The address of the image.
6645 */
6646IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6647{
6648 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6649 RTPTRUNION uPtr;
6650 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6651 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6652 if (rcStrict != VINF_SUCCESS)
6653 return rcStrict;
6654
6655 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6656
6657 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6658 if (rcStrict != VINF_SUCCESS)
6659 return rcStrict;
6660
6661 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6662 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6663 return VINF_SUCCESS;
6664}
6665
6666
6667/**
6668 * Implements 'FNSAVE'.
6669 *
6670 * @param GCPtrEffDst The address of the image.
6671 * @param enmEffOpSize The operand size.
6672 */
6673IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6674{
6675 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6676 RTPTRUNION uPtr;
6677 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6678 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6679 if (rcStrict != VINF_SUCCESS)
6680 return rcStrict;
6681
6682 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6683 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6684 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6685 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6686 {
6687 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6688 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6689 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6690 }
6691
6692 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6693 if (rcStrict != VINF_SUCCESS)
6694 return rcStrict;
6695
6696 /*
6697 * Re-initialize the FPU context.
6698 */
6699 pFpuCtx->FCW = 0x37f;
6700 pFpuCtx->FSW = 0;
6701 pFpuCtx->FTW = 0x00; /* 0 - empty */
6702 pFpuCtx->FPUDP = 0;
6703 pFpuCtx->DS = 0;
6704 pFpuCtx->Rsrvd2= 0;
6705 pFpuCtx->FPUIP = 0;
6706 pFpuCtx->CS = 0;
6707 pFpuCtx->Rsrvd1= 0;
6708 pFpuCtx->FOP = 0;
6709
6710 iemHlpUsedFpu(pVCpu);
6711 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6712 return VINF_SUCCESS;
6713}
6714
6715
6716
6717/**
6718 * Implements 'FLDENV'.
6719 *
6720 * @param enmEffOpSize The operand size (only REX.W really matters).
6721 * @param iEffSeg The effective segment register for @a GCPtrEff.
6722 * @param GCPtrEffSrc The address of the image.
6723 */
6724IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6725{
6726 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6727 RTCPTRUNION uPtr;
6728 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6729 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6730 if (rcStrict != VINF_SUCCESS)
6731 return rcStrict;
6732
6733 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6734
6735 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6736 if (rcStrict != VINF_SUCCESS)
6737 return rcStrict;
6738
6739 iemHlpUsedFpu(pVCpu);
6740 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6741 return VINF_SUCCESS;
6742}
6743
6744
6745/**
6746 * Implements 'FRSTOR'.
6747 *
6748 * @param GCPtrEffSrc The address of the image.
6749 * @param enmEffOpSize The operand size.
6750 */
6751IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6752{
6753 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6754 RTCPTRUNION uPtr;
6755 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6756 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6757 if (rcStrict != VINF_SUCCESS)
6758 return rcStrict;
6759
6760 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6761 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6762 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6763 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6764 {
6765 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6766 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6767 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6768 pFpuCtx->aRegs[i].au32[3] = 0;
6769 }
6770
6771 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6772 if (rcStrict != VINF_SUCCESS)
6773 return rcStrict;
6774
6775 iemHlpUsedFpu(pVCpu);
6776 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6777 return VINF_SUCCESS;
6778}
6779
6780
6781/**
6782 * Implements 'FLDCW'.
6783 *
6784 * @param u16Fcw The new FCW.
6785 */
6786IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6787{
6788 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6789
6790 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6791 /** @todo Testcase: Try see what happens when trying to set undefined bits
6792 * (other than 6 and 7). Currently ignoring them. */
6793 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
6794 * according to FSW. (This is was is currently implemented.) */
6795 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6796 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6797 iemFpuRecalcExceptionStatus(pFpuCtx);
6798
6799 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6800 iemHlpUsedFpu(pVCpu);
6801 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6802 return VINF_SUCCESS;
6803}
6804
6805
6806
6807/**
6808 * Implements the underflow case of fxch.
6809 *
6810 * @param iStReg The other stack register.
6811 */
6812IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6813{
6814 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6815
6816 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6817 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6818 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6819 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
6820
6821 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
6822 * registers are read as QNaN and then exchanged. This could be
6823 * wrong... */
6824 if (pFpuCtx->FCW & X86_FCW_IM)
6825 {
6826 if (RT_BIT(iReg1) & pFpuCtx->FTW)
6827 {
6828 if (RT_BIT(iReg2) & pFpuCtx->FTW)
6829 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6830 else
6831 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6832 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6833 }
6834 else
6835 {
6836 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6837 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6838 }
6839 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6840 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
6841 }
6842 else
6843 {
6844 /* raise underflow exception, don't change anything. */
6845 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
6846 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6847 }
6848
6849 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6850 iemHlpUsedFpu(pVCpu);
6851 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6852 return VINF_SUCCESS;
6853}
6854
6855
6856/**
6857 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6858 *
6859 * @param cToAdd 1 or 7.
6860 */
6861IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6862{
6863 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6864 Assert(iStReg < 8);
6865
6866 /*
6867 * Raise exceptions.
6868 */
6869 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6870 return iemRaiseDeviceNotAvailable(pVCpu);
6871
6872 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6873 uint16_t u16Fsw = pFpuCtx->FSW;
6874 if (u16Fsw & X86_FSW_ES)
6875 return iemRaiseMathFault(pVCpu);
6876
6877 /*
6878 * Check if any of the register accesses causes #SF + #IA.
6879 */
6880 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
6881 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6882 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
6883 {
6884 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
6885 NOREF(u32Eflags);
6886
6887 pFpuCtx->FSW &= ~X86_FSW_C1;
6888 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
6889 if ( !(u16Fsw & X86_FSW_IE)
6890 || (pFpuCtx->FCW & X86_FCW_IM) )
6891 {
6892 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6893 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6894 }
6895 }
6896 else if (pFpuCtx->FCW & X86_FCW_IM)
6897 {
6898 /* Masked underflow. */
6899 pFpuCtx->FSW &= ~X86_FSW_C1;
6900 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
6901 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6902 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
6903 }
6904 else
6905 {
6906 /* Raise underflow - don't touch EFLAGS or TOP. */
6907 pFpuCtx->FSW &= ~X86_FSW_C1;
6908 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6909 fPop = false;
6910 }
6911
6912 /*
6913 * Pop if necessary.
6914 */
6915 if (fPop)
6916 {
6917 pFpuCtx->FTW &= ~RT_BIT(iReg1);
6918 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
6919 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
6920 }
6921
6922 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6923 iemHlpUsedFpu(pVCpu);
6924 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6925 return VINF_SUCCESS;
6926}
6927
6928/** @} */
6929
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette