VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp@ 105098

Last change on this file since 105098 was 105098, checked in by vboxsync, 11 months ago

VMM/IEM: iret logging. bugref:10715
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 390.9 KB
Line 
1/* $Id: IEMAllCImpl.cpp 105098 2024-07-02 12:46:06Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.215389.xyz.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#define IEM_WITH_OPAQUE_DECODER_STATE
35#include <VBox/vmm/iem.h>
36#include <VBox/vmm/cpum.h>
37#include <VBox/vmm/apic.h>
38#include <VBox/vmm/pdm.h>
39#include <VBox/vmm/pgm.h>
40#include <VBox/vmm/iom.h>
41#include <VBox/vmm/em.h>
42#include <VBox/vmm/hm.h>
43#include <VBox/vmm/nem.h>
44#include <VBox/vmm/gim.h>
45#include <VBox/vmm/gcm.h>
46#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
47# include <VBox/vmm/em.h>
48# include <VBox/vmm/hm_svm.h>
49#endif
50#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
51# include <VBox/vmm/hmvmxinline.h>
52#endif
53#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
54# include <VBox/vmm/cpuidcall.h>
55#endif
56#include <VBox/vmm/tm.h>
57#include <VBox/vmm/dbgf.h>
58#include <VBox/vmm/dbgftrace.h>
59#include "IEMInternal.h"
60#include <VBox/vmm/vmcc.h>
61#include <VBox/log.h>
62#include <VBox/err.h>
63#include <VBox/param.h>
64#include <VBox/dis.h>
65#include <iprt/asm-math.h>
66#include <iprt/assert.h>
67#include <iprt/string.h>
68#include <iprt/x86.h>
69
70#include "IEMInline.h"
71
72
73/*********************************************************************************************************************************
74* Defined Constants And Macros *
75*********************************************************************************************************************************/
76/**
77 * Flushes the prefetch buffer, light version.
78 * @todo The \#if conditions here must match the ones in iemOpcodeFlushLight().
79 */
80#ifndef IEM_WITH_CODE_TLB
81# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) iemOpcodeFlushLight(a_pVCpu, a_cbInstr)
82#else
83# define IEM_FLUSH_PREFETCH_LIGHT(a_pVCpu, a_cbInstr) do { } while (0)
84#endif
85
86/**
87 * Flushes the prefetch buffer, heavy version.
88 * @todo The \#if conditions here must match the ones in iemOpcodeFlushHeavy().
89 */
90#if !defined(IEM_WITH_CODE_TLB) || 1
91# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) iemOpcodeFlushHeavy(a_pVCpu, a_cbInstr)
92#else
93# define IEM_FLUSH_PREFETCH_HEAVY(a_pVCpu, a_cbInstr) do { } while (0)
94#endif
95
96
97
98/** @name Misc Helpers
99 * @{
100 */
101
102
103/**
104 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
105 *
106 * @returns Strict VBox status code.
107 *
108 * @param pVCpu The cross context virtual CPU structure of the calling thread.
109 * @param u16Port The port number.
110 * @param cbOperand The operand size.
111 */
112static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
113{
114 /* The TSS bits we're interested in are the same on 386 and AMD64. */
115 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
116 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
117 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
118 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
119
120 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
121
122 /*
123 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
124 */
125 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
126 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
127 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
128 {
129 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
130 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
131 return iemRaiseGeneralProtectionFault0(pVCpu);
132 }
133
134 /*
135 * Read the bitmap offset (may #PF).
136 */
137 uint16_t offBitmap;
138 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
139 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
140 if (rcStrict != VINF_SUCCESS)
141 {
142 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
143 return rcStrict;
144 }
145
146 /*
147 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
148 * describes the CPU actually reading two bytes regardless of whether the
149 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
150 */
151 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
152 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
153 * for instance sizeof(X86TSS32). */
154 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
155 {
156 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
157 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
158 return iemRaiseGeneralProtectionFault0(pVCpu);
159 }
160
161 /*
162 * Read the necessary bits.
163 */
164 /** @todo Test the assertion in the intel manual that the CPU reads two
165 * bytes. The question is how this works wrt to \#PF and \#GP on the
166 * 2nd byte when it's not required. */
167 uint16_t bmBytes = UINT16_MAX;
168 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
169 if (rcStrict != VINF_SUCCESS)
170 {
171 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
172 return rcStrict;
173 }
174
175 /*
176 * Perform the check.
177 */
178 uint16_t fPortMask = (1 << cbOperand) - 1;
179 bmBytes >>= (u16Port & 7);
180 if (bmBytes & fPortMask)
181 {
182 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
183 u16Port, cbOperand, bmBytes, fPortMask));
184 return iemRaiseGeneralProtectionFault0(pVCpu);
185 }
186
187 return VINF_SUCCESS;
188}
189
190
191/**
192 * Checks if we are allowed to access the given I/O port, raising the
193 * appropriate exceptions if we aren't (or if the I/O bitmap is not
194 * accessible).
195 *
196 * @returns Strict VBox status code.
197 *
198 * @param pVCpu The cross context virtual CPU structure of the calling thread.
199 * @param u16Port The port number.
200 * @param cbOperand The operand size.
201 */
202DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbOperand)
203{
204 X86EFLAGS Efl;
205 Efl.u = IEMMISC_GET_EFL(pVCpu);
206 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
207 && ( IEM_GET_CPL(pVCpu) > Efl.Bits.u2IOPL
208 || Efl.Bits.u1VM) )
209 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
210 return VINF_SUCCESS;
211}
212
213
214#if 0
215/**
216 * Calculates the parity bit.
217 *
218 * @returns true if the bit is set, false if not.
219 * @param u8Result The least significant byte of the result.
220 */
221static bool iemHlpCalcParityFlag(uint8_t u8Result)
222{
223 /*
224 * Parity is set if the number of bits in the least significant byte of
225 * the result is even.
226 */
227 uint8_t cBits;
228 cBits = u8Result & 1; /* 0 */
229 u8Result >>= 1;
230 cBits += u8Result & 1;
231 u8Result >>= 1;
232 cBits += u8Result & 1;
233 u8Result >>= 1;
234 cBits += u8Result & 1;
235 u8Result >>= 1;
236 cBits += u8Result & 1; /* 4 */
237 u8Result >>= 1;
238 cBits += u8Result & 1;
239 u8Result >>= 1;
240 cBits += u8Result & 1;
241 u8Result >>= 1;
242 cBits += u8Result & 1;
243 return !(cBits & 1);
244}
245#endif /* not used */
246
247
248/**
249 * Updates the specified flags according to a 8-bit result.
250 *
251 * @param pVCpu The cross context virtual CPU structure of the calling thread.
252 * @param u8Result The result to set the flags according to.
253 * @param fToUpdate The flags to update.
254 * @param fUndefined The flags that are specified as undefined.
255 */
256static void iemHlpUpdateArithEFlagsU8(PVMCPUCC pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
257{
258 uint32_t fEFlags = iemAImpl_test_u8(pVCpu->cpum.GstCtx.eflags.u, &u8Result, u8Result);
259 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
260 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
261}
262
263
264/**
265 * Updates the specified flags according to a 16-bit result.
266 *
267 * @param pVCpu The cross context virtual CPU structure of the calling thread.
268 * @param u16Result The result to set the flags according to.
269 * @param fToUpdate The flags to update.
270 * @param fUndefined The flags that are specified as undefined.
271 */
272static void iemHlpUpdateArithEFlagsU16(PVMCPUCC pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
273{
274 uint32_t fEFlags = iemAImpl_test_u16(pVCpu->cpum.GstCtx.eflags.u, &u16Result, u16Result);
275 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
276 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
277}
278
279
280/**
281 * Helper used by iret.
282 *
283 * @param pVCpu The cross context virtual CPU structure of the calling thread.
284 * @param uCpl The new CPL.
285 * @param pSReg Pointer to the segment register.
286 */
287static void iemHlpAdjustSelectorForNewCpl(PVMCPUCC pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
288{
289 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
290 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
291
292 if ( uCpl > pSReg->Attr.n.u2Dpl
293 && pSReg->Attr.n.u1DescType /* code or data, not system */
294 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
295 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
296 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
297}
298
299
300/**
301 * Indicates that we have modified the FPU state.
302 *
303 * @param pVCpu The cross context virtual CPU structure of the calling thread.
304 */
305DECLINLINE(void) iemHlpUsedFpu(PVMCPUCC pVCpu)
306{
307 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
308}
309
310/** @} */
311
312/** @name C Implementations
313 * @{
314 */
315
316
317/**
318 * Implements a pop [mem16].
319 */
320IEM_CIMPL_DEF_2(iemCImpl_pop_mem16, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
321{
322 uint16_t u16Value;
323 RTUINT64U TmpRsp;
324 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
325 VBOXSTRICTRC rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
326 if (rcStrict == VINF_SUCCESS)
327 {
328 rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
329 if (rcStrict == VINF_SUCCESS)
330 {
331 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
332 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
333 }
334 }
335 return rcStrict;
336
337}
338
339
340/**
341 * Implements a pop [mem32].
342 */
343IEM_CIMPL_DEF_2(iemCImpl_pop_mem32, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
344{
345 uint32_t u32Value;
346 RTUINT64U TmpRsp;
347 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
348 VBOXSTRICTRC rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
349 if (rcStrict == VINF_SUCCESS)
350 {
351 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEffDst, u32Value);
352 if (rcStrict == VINF_SUCCESS)
353 {
354 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
355 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
356 }
357 }
358 return rcStrict;
359
360}
361
362
363/**
364 * Implements a pop [mem64].
365 */
366IEM_CIMPL_DEF_2(iemCImpl_pop_mem64, uint16_t, iEffSeg, RTGCPTR, GCPtrEffDst)
367{
368 uint64_t u64Value;
369 RTUINT64U TmpRsp;
370 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
371 VBOXSTRICTRC rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
372 if (rcStrict == VINF_SUCCESS)
373 {
374 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrEffDst, u64Value);
375 if (rcStrict == VINF_SUCCESS)
376 {
377 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
378 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
379 }
380 }
381 return rcStrict;
382
383}
384
385
386/**
387 * Implements a 16-bit popa.
388 */
389IEM_CIMPL_DEF_0(iemCImpl_popa_16)
390{
391 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
392 RTGCPTR GCPtrLast = GCPtrStart + 15;
393 VBOXSTRICTRC rcStrict;
394
395 /*
396 * The docs are a bit hard to comprehend here, but it looks like we wrap
397 * around in real mode as long as none of the individual "popa" crosses the
398 * end of the stack segment. In protected mode we check the whole access
399 * in one go. For efficiency, only do the word-by-word thing if we're in
400 * danger of wrapping around.
401 */
402 /** @todo do popa boundary / wrap-around checks. */
403 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
404 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
405 {
406 /* word-by-word */
407 RTUINT64U TmpRsp;
408 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
409 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
410 if (rcStrict == VINF_SUCCESS)
411 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 {
416 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
417 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
418 }
419 if (rcStrict == VINF_SUCCESS)
420 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
421 if (rcStrict == VINF_SUCCESS)
422 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
423 if (rcStrict == VINF_SUCCESS)
424 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
425 if (rcStrict == VINF_SUCCESS)
426 {
427 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
428 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
429 }
430 }
431 else
432 {
433 uint8_t bUnmapInfo;
434 uint16_t const *pau16Mem = NULL;
435 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrStart,
436 IEM_ACCESS_STACK_R, sizeof(*pau16Mem) - 1);
437 if (rcStrict == VINF_SUCCESS)
438 {
439 pVCpu->cpum.GstCtx.di = pau16Mem[7 - X86_GREG_xDI];
440 pVCpu->cpum.GstCtx.si = pau16Mem[7 - X86_GREG_xSI];
441 pVCpu->cpum.GstCtx.bp = pau16Mem[7 - X86_GREG_xBP];
442 /* skip sp */
443 pVCpu->cpum.GstCtx.bx = pau16Mem[7 - X86_GREG_xBX];
444 pVCpu->cpum.GstCtx.dx = pau16Mem[7 - X86_GREG_xDX];
445 pVCpu->cpum.GstCtx.cx = pau16Mem[7 - X86_GREG_xCX];
446 pVCpu->cpum.GstCtx.ax = pau16Mem[7 - X86_GREG_xAX];
447 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
448 if (rcStrict == VINF_SUCCESS)
449 {
450 iemRegAddToRsp(pVCpu, 16);
451 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
452 }
453 }
454 }
455 return rcStrict;
456}
457
458
459/**
460 * Implements a 32-bit popa.
461 */
462IEM_CIMPL_DEF_0(iemCImpl_popa_32)
463{
464 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
465 RTGCPTR GCPtrLast = GCPtrStart + 31;
466 VBOXSTRICTRC rcStrict;
467
468 /*
469 * The docs are a bit hard to comprehend here, but it looks like we wrap
470 * around in real mode as long as none of the individual "popa" crosses the
471 * end of the stack segment. In protected mode we check the whole access
472 * in one go. For efficiency, only do the word-by-word thing if we're in
473 * danger of wrapping around.
474 */
475 /** @todo do popa boundary / wrap-around checks. */
476 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
477 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
478 {
479 /* word-by-word */
480 RTUINT64U TmpRsp;
481 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
482 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
483 if (rcStrict == VINF_SUCCESS)
484 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
485 if (rcStrict == VINF_SUCCESS)
486 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
487 if (rcStrict == VINF_SUCCESS)
488 {
489 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
490 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
491 }
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
496 if (rcStrict == VINF_SUCCESS)
497 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
498 if (rcStrict == VINF_SUCCESS)
499 {
500#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
501 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
502 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
503 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
504 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
505 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
506 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
507 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
508#endif
509 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
510 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
511 }
512 }
513 else
514 {
515 uint8_t bUnmapInfo;
516 uint32_t const *pau32Mem;
517 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrStart,
518 IEM_ACCESS_STACK_R, sizeof(*pau32Mem) - 1);
519 if (rcStrict == VINF_SUCCESS)
520 {
521 pVCpu->cpum.GstCtx.rdi = pau32Mem[7 - X86_GREG_xDI];
522 pVCpu->cpum.GstCtx.rsi = pau32Mem[7 - X86_GREG_xSI];
523 pVCpu->cpum.GstCtx.rbp = pau32Mem[7 - X86_GREG_xBP];
524 /* skip esp */
525 pVCpu->cpum.GstCtx.rbx = pau32Mem[7 - X86_GREG_xBX];
526 pVCpu->cpum.GstCtx.rdx = pau32Mem[7 - X86_GREG_xDX];
527 pVCpu->cpum.GstCtx.rcx = pau32Mem[7 - X86_GREG_xCX];
528 pVCpu->cpum.GstCtx.rax = pau32Mem[7 - X86_GREG_xAX];
529 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
530 if (rcStrict == VINF_SUCCESS)
531 {
532 iemRegAddToRsp(pVCpu, 32);
533 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
534 }
535 }
536 }
537 return rcStrict;
538}
539
540
541/**
542 * Implements a 16-bit pusha.
543 */
544IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
545{
546 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
547 RTGCPTR GCPtrBottom = GCPtrTop - 15;
548 VBOXSTRICTRC rcStrict;
549
550 /*
551 * The docs are a bit hard to comprehend here, but it looks like we wrap
552 * around in real mode as long as none of the individual "pushd" crosses the
553 * end of the stack segment. In protected mode we check the whole access
554 * in one go. For efficiency, only do the word-by-word thing if we're in
555 * danger of wrapping around.
556 */
557 /** @todo do pusha boundary / wrap-around checks. */
558 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
559 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
560 {
561 /* word-by-word */
562 RTUINT64U TmpRsp;
563 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
564 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
565 if (rcStrict == VINF_SUCCESS)
566 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
567 if (rcStrict == VINF_SUCCESS)
568 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
569 if (rcStrict == VINF_SUCCESS)
570 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
571 if (rcStrict == VINF_SUCCESS)
572 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
573 if (rcStrict == VINF_SUCCESS)
574 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
575 if (rcStrict == VINF_SUCCESS)
576 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
577 if (rcStrict == VINF_SUCCESS)
578 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
579 if (rcStrict == VINF_SUCCESS)
580 {
581 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
582 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
583 }
584 }
585 else
586 {
587 GCPtrBottom--;
588 uint8_t bUnmapInfo;
589 uint16_t *pau16Mem = NULL;
590 rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrBottom,
591 IEM_ACCESS_STACK_W, sizeof(*pau16Mem) - 1);
592 if (rcStrict == VINF_SUCCESS)
593 {
594 pau16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
595 pau16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
596 pau16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
597 pau16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
598 pau16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
599 pau16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
600 pau16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
601 pau16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
602 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
603 if (rcStrict == VINF_SUCCESS)
604 {
605 iemRegSubFromRsp(pVCpu, 16);
606 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
607 }
608 }
609 }
610 return rcStrict;
611}
612
613
614/**
615 * Implements a 32-bit pusha.
616 */
617IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
618{
619 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
620 RTGCPTR GCPtrBottom = GCPtrTop - 31;
621 VBOXSTRICTRC rcStrict;
622
623 /*
624 * The docs are a bit hard to comprehend here, but it looks like we wrap
625 * around in real mode as long as none of the individual "pusha" crosses the
626 * end of the stack segment. In protected mode we check the whole access
627 * in one go. For efficiency, only do the word-by-word thing if we're in
628 * danger of wrapping around.
629 */
630 /** @todo do pusha boundary / wrap-around checks. */
631 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
632 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
633 {
634 /* word-by-word */
635 RTUINT64U TmpRsp;
636 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
637 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
638 if (rcStrict == VINF_SUCCESS)
639 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
640 if (rcStrict == VINF_SUCCESS)
641 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
642 if (rcStrict == VINF_SUCCESS)
643 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
644 if (rcStrict == VINF_SUCCESS)
645 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
646 if (rcStrict == VINF_SUCCESS)
647 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
648 if (rcStrict == VINF_SUCCESS)
649 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
650 if (rcStrict == VINF_SUCCESS)
651 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
652 if (rcStrict == VINF_SUCCESS)
653 {
654 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
655 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
656 }
657 }
658 else
659 {
660 GCPtrBottom--;
661 uint8_t bUnmapInfo;
662 uint32_t *pau32Mem;
663 rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrBottom,
664 IEM_ACCESS_STACK_W, sizeof(*pau32Mem) - 1);
665 if (rcStrict == VINF_SUCCESS)
666 {
667 pau32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
668 pau32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
669 pau32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
670 pau32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
671 pau32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
672 pau32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
673 pau32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
674 pau32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
675 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
676 if (rcStrict == VINF_SUCCESS)
677 {
678 iemRegSubFromRsp(pVCpu, 32);
679 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
680 }
681 }
682 }
683 return rcStrict;
684}
685
686
687/**
688 * Implements pushf.
689 *
690 *
691 * @param enmEffOpSize The effective operand size.
692 */
693IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
694{
695 VBOXSTRICTRC rcStrict;
696
697 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
698 { /* probable */ }
699 else
700 {
701 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
702 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
703 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
704 }
705
706 /*
707 * If we're in V8086 mode some care is required (which is why we're in
708 * doing this in a C implementation).
709 */
710 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
711 if ( (fEfl & X86_EFL_VM)
712 && X86_EFL_GET_IOPL(fEfl) != 3 )
713 {
714 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
715 if ( enmEffOpSize != IEMMODE_16BIT
716 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
717 return iemRaiseGeneralProtectionFault0(pVCpu);
718 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
719 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
720 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
721 }
722 else
723 {
724
725 /*
726 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
727 */
728 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
729
730 switch (enmEffOpSize)
731 {
732 case IEMMODE_16BIT:
733 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
734 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
735 fEfl |= UINT16_C(0xf000);
736 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
737 break;
738 case IEMMODE_32BIT:
739 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
740 break;
741 case IEMMODE_64BIT:
742 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
743 break;
744 IEM_NOT_REACHED_DEFAULT_CASE_RET();
745 }
746 }
747
748 if (rcStrict == VINF_SUCCESS)
749 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
750 return rcStrict;
751}
752
753
754/**
755 * Implements popf.
756 *
757 * @param enmEffOpSize The effective operand size.
758 */
759IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
760{
761 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
762 VBOXSTRICTRC rcStrict;
763 uint32_t fEflNew;
764
765 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
766 { /* probable */ }
767 else
768 {
769 Log2(("popf: Guest intercept -> #VMEXIT\n"));
770 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
771 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
772 }
773
774 /*
775 * V8086 is special as usual.
776 */
777 if (fEflOld & X86_EFL_VM)
778 {
779 /*
780 * Almost anything goes if IOPL is 3.
781 */
782 if (X86_EFL_GET_IOPL(fEflOld) == 3)
783 {
784 switch (enmEffOpSize)
785 {
786 case IEMMODE_16BIT:
787 {
788 uint16_t u16Value;
789 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
790 if (rcStrict != VINF_SUCCESS)
791 return rcStrict;
792 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
793 break;
794 }
795 case IEMMODE_32BIT:
796 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
797 if (rcStrict != VINF_SUCCESS)
798 return rcStrict;
799 break;
800 IEM_NOT_REACHED_DEFAULT_CASE_RET();
801 }
802
803 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
804 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
805 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
806 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
807 }
808 /*
809 * Interrupt flag virtualization with CR4.VME=1.
810 */
811 else if ( enmEffOpSize == IEMMODE_16BIT
812 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
813 {
814 uint16_t u16Value;
815 RTUINT64U TmpRsp;
816 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
817 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
818 if (rcStrict != VINF_SUCCESS)
819 return rcStrict;
820
821 /** @todo Is the popf VME \#GP(0) delivered after updating RSP+RIP
822 * or before? */
823 if ( ( (u16Value & X86_EFL_IF)
824 && (fEflOld & X86_EFL_VIP))
825 || (u16Value & X86_EFL_TF) )
826 return iemRaiseGeneralProtectionFault0(pVCpu);
827
828 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
829 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
830 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
831 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
832
833 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
834 }
835 else
836 return iemRaiseGeneralProtectionFault0(pVCpu);
837
838 }
839 /*
840 * Not in V8086 mode.
841 */
842 else
843 {
844 /* Pop the flags. */
845 switch (enmEffOpSize)
846 {
847 case IEMMODE_16BIT:
848 {
849 uint16_t u16Value;
850 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
851 if (rcStrict != VINF_SUCCESS)
852 return rcStrict;
853 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
854
855 /*
856 * Ancient CPU adjustments:
857 * - 8086, 80186, V20/30:
858 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
859 * practical reasons (masking below). We add them when pushing flags.
860 * - 80286:
861 * The NT and IOPL flags cannot be popped from real mode and are
862 * therefore always zero (since a 286 can never exit from PM and
863 * their initial value is zero). This changed on a 386 and can
864 * therefore be used to detect 286 or 386 CPU in real mode.
865 */
866 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
867 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
868 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
869 break;
870 }
871 case IEMMODE_32BIT:
872 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
873 if (rcStrict != VINF_SUCCESS)
874 return rcStrict;
875 break;
876 case IEMMODE_64BIT:
877 {
878 uint64_t u64Value;
879 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
880 if (rcStrict != VINF_SUCCESS)
881 return rcStrict;
882 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
883 break;
884 }
885 IEM_NOT_REACHED_DEFAULT_CASE_RET();
886 }
887
888 /* Merge them with the current flags. */
889 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
890 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
891 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
892 || IEM_GET_CPL(pVCpu) == 0)
893 {
894 fEflNew &= fPopfBits;
895 fEflNew |= ~fPopfBits & fEflOld;
896 }
897 else if (IEM_GET_CPL(pVCpu) <= X86_EFL_GET_IOPL(fEflOld))
898 {
899 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
900 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
901 }
902 else
903 {
904 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
905 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
906 }
907 }
908
909 /*
910 * Commit the flags.
911 */
912 Assert(fEflNew & RT_BIT_32(1));
913 IEMMISC_SET_EFL(pVCpu, fEflNew);
914 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_X86_AC) | iemCalcExecAcFlag(pVCpu);
915 return iemRegAddToRipAndFinishingClearingRfEx(pVCpu, cbInstr, fEflOld);
916}
917
918
919/**
920 * Implements far jumps and calls thru task segments (TSS).
921 *
922 * @returns VBox strict status code.
923 * @param pVCpu The cross context virtual CPU structure of the
924 * calling thread.
925 * @param cbInstr The current instruction length.
926 * @param uSel The selector.
927 * @param enmBranch The kind of branching we're performing.
928 * @param enmEffOpSize The effective operand size.
929 * @param pDesc The descriptor corresponding to @a uSel. The type is
930 * task gate.
931 */
932static VBOXSTRICTRC iemCImpl_BranchTaskSegment(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
933 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
934{
935#ifndef IEM_IMPLEMENTS_TASKSWITCH
936 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
937#else
938 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
939 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
940 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
941 RT_NOREF_PV(enmEffOpSize);
942 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
943
944 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
945 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
946 {
947 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
948 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
949 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
950 }
951
952 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
953 * far calls (see iemCImpl_callf). Most likely in both cases it should be
954 * checked here, need testcases. */
955 if (!pDesc->Legacy.Gen.u1Present)
956 {
957 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
958 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
959 }
960
961 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
962 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
963 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
964#endif
965}
966
967
968/**
969 * Implements far jumps and calls thru task gates.
970 *
971 * @returns VBox strict status code.
972 * @param pVCpu The cross context virtual CPU structure of the
973 * calling thread.
974 * @param cbInstr The current instruction length.
975 * @param uSel The selector.
976 * @param enmBranch The kind of branching we're performing.
977 * @param enmEffOpSize The effective operand size.
978 * @param pDesc The descriptor corresponding to @a uSel. The type is
979 * task gate.
980 */
981static VBOXSTRICTRC iemCImpl_BranchTaskGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
982 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
983{
984#ifndef IEM_IMPLEMENTS_TASKSWITCH
985 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
986#else
987 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
988 RT_NOREF_PV(enmEffOpSize);
989 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
990
991 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
992 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
993 {
994 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
995 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
996 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
997 }
998
999 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1000 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1001 * checked here, need testcases. */
1002 if (!pDesc->Legacy.Gen.u1Present)
1003 {
1004 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1005 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1006 }
1007
1008 /*
1009 * Fetch the new TSS descriptor from the GDT.
1010 */
1011 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1012 if (uSelTss & X86_SEL_LDT)
1013 {
1014 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1015 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1016 }
1017
1018 IEMSELDESC TssDesc;
1019 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1020 if (rcStrict != VINF_SUCCESS)
1021 return rcStrict;
1022
1023 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1024 {
1025 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1026 TssDesc.Legacy.Gate.u4Type));
1027 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1028 }
1029
1030 if (!TssDesc.Legacy.Gate.u1Present)
1031 {
1032 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1033 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1034 }
1035
1036 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1037 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1038 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1039#endif
1040}
1041
1042
1043/**
1044 * Implements far jumps and calls thru call gates.
1045 *
1046 * @returns VBox strict status code.
1047 * @param pVCpu The cross context virtual CPU structure of the
1048 * calling thread.
1049 * @param cbInstr The current instruction length.
1050 * @param uSel The selector.
1051 * @param enmBranch The kind of branching we're performing.
1052 * @param enmEffOpSize The effective operand size.
1053 * @param pDesc The descriptor corresponding to @a uSel. The type is
1054 * call gate.
1055 */
1056static VBOXSTRICTRC iemCImpl_BranchCallGate(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1057 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1058{
1059#define IEM_IMPLEMENTS_CALLGATE
1060#ifndef IEM_IMPLEMENTS_CALLGATE
1061 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1062#else
1063 RT_NOREF_PV(enmEffOpSize);
1064 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1065
1066 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1067 * inter-privilege calls and are much more complex.
1068 *
1069 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1070 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1071 * must be 16-bit or 32-bit.
1072 */
1073 /** @todo effective operand size is probably irrelevant here, only the
1074 * call gate bitness matters??
1075 */
1076 VBOXSTRICTRC rcStrict;
1077 RTPTRUNION uPtrRet;
1078 uint64_t uNewRsp;
1079 uint64_t uNewRip;
1080 uint64_t u64Base;
1081 uint32_t cbLimit;
1082 RTSEL uNewCS;
1083 IEMSELDESC DescCS;
1084
1085 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1086 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1087 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1088 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1089
1090 /* Determine the new instruction pointer from the gate descriptor. */
1091 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1092 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1093 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1094
1095 /* Perform DPL checks on the gate descriptor. */
1096 if ( pDesc->Legacy.Gate.u2Dpl < IEM_GET_CPL(pVCpu)
1097 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1098 {
1099 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1100 IEM_GET_CPL(pVCpu), (uSel & X86_SEL_RPL)));
1101 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1102 }
1103
1104 /** @todo does this catch NULL selectors, too? */
1105 if (!pDesc->Legacy.Gen.u1Present)
1106 {
1107 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1108 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1109 }
1110
1111 /*
1112 * Fetch the target CS descriptor from the GDT or LDT.
1113 */
1114 uNewCS = pDesc->Legacy.Gate.u16Sel;
1115 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1116 if (rcStrict != VINF_SUCCESS)
1117 return rcStrict;
1118
1119 /* Target CS must be a code selector. */
1120 if ( !DescCS.Legacy.Gen.u1DescType
1121 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1122 {
1123 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1124 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1125 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1126 }
1127
1128 /* Privilege checks on target CS. */
1129 if (enmBranch == IEMBRANCH_JUMP)
1130 {
1131 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1132 {
1133 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1134 {
1135 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1136 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1137 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1138 }
1139 }
1140 else
1141 {
1142 if (DescCS.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
1143 {
1144 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1145 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1146 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1147 }
1148 }
1149 }
1150 else
1151 {
1152 Assert(enmBranch == IEMBRANCH_CALL);
1153 if (DescCS.Legacy.Gen.u2Dpl > IEM_GET_CPL(pVCpu))
1154 {
1155 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1156 uNewCS, DescCS.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1157 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1158 }
1159 }
1160
1161 /* Additional long mode checks. */
1162 if (IEM_IS_LONG_MODE(pVCpu))
1163 {
1164 if (!DescCS.Legacy.Gen.u1Long)
1165 {
1166 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1167 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1168 }
1169
1170 /* L vs D. */
1171 if ( DescCS.Legacy.Gen.u1Long
1172 && DescCS.Legacy.Gen.u1DefBig)
1173 {
1174 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1175 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1176 }
1177 }
1178
1179 if (!DescCS.Legacy.Gate.u1Present)
1180 {
1181 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1182 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1183 }
1184
1185 if (enmBranch == IEMBRANCH_JUMP)
1186 {
1187 /** @todo This is very similar to regular far jumps; merge! */
1188 /* Jumps are fairly simple... */
1189
1190 /* Chop the high bits off if 16-bit gate (Intel says so). */
1191 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1192 uNewRip = (uint16_t)uNewRip;
1193
1194 /* Limit check for non-long segments. */
1195 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1196 if (DescCS.Legacy.Gen.u1Long)
1197 u64Base = 0;
1198 else
1199 {
1200 if (uNewRip > cbLimit)
1201 {
1202 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1203 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1204 }
1205 u64Base = X86DESC_BASE(&DescCS.Legacy);
1206 }
1207
1208 /* Canonical address check. */
1209 if (!IEM_IS_CANONICAL(uNewRip))
1210 {
1211 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1212 return iemRaiseNotCanonical(pVCpu);
1213 }
1214
1215 /*
1216 * Ok, everything checked out fine. Now set the accessed bit before
1217 * committing the result into CS, CSHID and RIP.
1218 */
1219 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1220 {
1221 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1222 if (rcStrict != VINF_SUCCESS)
1223 return rcStrict;
1224 /** @todo check what VT-x and AMD-V does. */
1225 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1226 }
1227
1228 /* commit */
1229 pVCpu->cpum.GstCtx.rip = uNewRip;
1230 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1231 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
1232 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1233 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1234 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1235 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1236 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1237 }
1238 else
1239 {
1240 Assert(enmBranch == IEMBRANCH_CALL);
1241 /* Calls are much more complicated. */
1242
1243 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < IEM_GET_CPL(pVCpu)))
1244 {
1245 /* More privilege. This is the fun part. */
1246 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1247
1248 /*
1249 * Determine new SS:rSP from the TSS.
1250 */
1251 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1252
1253 /* Figure out where the new stack pointer is stored in the TSS. */
1254 uint8_t const uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1255 uint16_t offNewStack; /* Offset of new stack in TSS. */
1256 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1257 if (!IEM_IS_LONG_MODE(pVCpu))
1258 {
1259 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1260 {
1261 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1262 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1263 }
1264 else
1265 {
1266 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1267 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1268 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1269 }
1270 }
1271 else
1272 {
1273 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1274 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1275 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1276 }
1277
1278 /* Check against TSS limit. */
1279 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1280 {
1281 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1282 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1283 }
1284
1285 uint8_t bUnmapInfo;
1286 RTPTRUNION uPtrTss;
1287 RTGCPTR GCPtrTss = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1288 rcStrict = iemMemMap(pVCpu, &uPtrTss.pv, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrTss, IEM_ACCESS_SYS_R, 0);
1289 if (rcStrict != VINF_SUCCESS)
1290 {
1291 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1292 return rcStrict;
1293 }
1294
1295 RTSEL uNewSS;
1296 if (!IEM_IS_LONG_MODE(pVCpu))
1297 {
1298 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1299 {
1300 uNewRsp = uPtrTss.pu32[0];
1301 uNewSS = uPtrTss.pu16[2];
1302 }
1303 else
1304 {
1305 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1306 uNewRsp = uPtrTss.pu16[0];
1307 uNewSS = uPtrTss.pu16[1];
1308 }
1309 }
1310 else
1311 {
1312 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1313 /* SS will be a NULL selector, but that's valid. */
1314 uNewRsp = uPtrTss.pu64[0];
1315 uNewSS = uNewCSDpl;
1316 }
1317
1318 /* Done with the TSS now. */
1319 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1320 if (rcStrict != VINF_SUCCESS)
1321 {
1322 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1323 return rcStrict;
1324 }
1325
1326 /* Only used outside of long mode. */
1327 uint8_t const cbWords = pDesc->Legacy.Gate.u5ParmCount;
1328
1329 /* If EFER.LMA is 0, there's extra work to do. */
1330 IEMSELDESC DescSS;
1331 if (!IEM_IS_LONG_MODE(pVCpu))
1332 {
1333 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1334 {
1335 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1336 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1337 }
1338
1339 /* Grab the new SS descriptor. */
1340 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1341 if (rcStrict != VINF_SUCCESS)
1342 return rcStrict;
1343
1344 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1345 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1346 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1347 {
1348 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1349 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1350 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1351 }
1352
1353 /* Ensure new SS is a writable data segment. */
1354 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1355 {
1356 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1357 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1358 }
1359
1360 if (!DescSS.Legacy.Gen.u1Present)
1361 {
1362 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1363 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1364 }
1365 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1366 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1367 else
1368 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1369 }
1370 else
1371 {
1372 /* Just grab the new (NULL) SS descriptor. */
1373 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1374 * like we do... */
1375 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1376 if (rcStrict != VINF_SUCCESS)
1377 return rcStrict;
1378
1379 cbNewStack = sizeof(uint64_t) * 4;
1380 }
1381
1382 /** @todo According to Intel, new stack is checked for enough space first,
1383 * then switched. According to AMD, the stack is switched first and
1384 * then pushes might fault!
1385 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1386 * incoming stack \#PF happens before actual stack switch. AMD is
1387 * either lying or implicitly assumes that new state is committed
1388 * only if and when an instruction doesn't fault.
1389 */
1390
1391 /** @todo According to AMD, CS is loaded first, then SS.
1392 * According to Intel, it's the other way around!?
1393 */
1394
1395 /** @todo Intel and AMD disagree on when exactly the CPL changes! */
1396
1397 /* Set the accessed bit before committing new SS. */
1398 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1399 {
1400 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1401 if (rcStrict != VINF_SUCCESS)
1402 return rcStrict;
1403 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1404 }
1405
1406 /* Remember the old SS:rSP and their linear address. */
1407 RTSEL const uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1408 uint64_t const uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1409
1410 RTGCPTR const GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1411
1412 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1413 or #PF, the former is not implemented in this workaround. */
1414 /** @todo Proper fix callgate target stack exceptions. */
1415 /** @todo testcase: Cover callgates with partially or fully inaccessible
1416 * target stacks. */
1417 void *pvNewFrame;
1418 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1419 rcStrict = iemMemMap(pVCpu, &pvNewFrame, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
1420 if (rcStrict != VINF_SUCCESS)
1421 {
1422 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1423 return rcStrict;
1424 }
1425 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1426 if (rcStrict != VINF_SUCCESS)
1427 {
1428 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1429 return rcStrict;
1430 }
1431
1432 /* Commit new SS:rSP. */
1433 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1434 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1435 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1436 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1437 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1438 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1439 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1440 IEM_SET_CPL(pVCpu, uNewCSDpl); /** @todo Are the parameter words accessed using the new CPL or the old CPL? */
1441 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1442 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1443
1444 /* At this point the stack access must not fail because new state was already committed. */
1445 /** @todo this can still fail due to SS.LIMIT not check. */
1446 uint8_t bUnmapInfoRet;
1447 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1448 IEM_IS_LONG_MODE(pVCpu) ? 7
1449 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
1450 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1451 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1452 VERR_INTERNAL_ERROR_5);
1453
1454 if (!IEM_IS_LONG_MODE(pVCpu))
1455 {
1456 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1457 {
1458 if (cbWords)
1459 {
1460 /* Map the relevant chunk of the old stack. */
1461 RTPTRUNION uPtrParmWds;
1462 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 4, UINT8_MAX, GCPtrParmWds,
1463 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1464 if (rcStrict != VINF_SUCCESS)
1465 {
1466 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1467 return rcStrict;
1468 }
1469
1470 /* Copy the parameter (d)words. */
1471 for (int i = 0; i < cbWords; ++i)
1472 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1473
1474 /* Unmap the old stack. */
1475 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1476 if (rcStrict != VINF_SUCCESS)
1477 {
1478 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1479 return rcStrict;
1480 }
1481 }
1482
1483 /* Push the old CS:rIP. */
1484 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1485 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1486
1487 /* Push the old SS:rSP. */
1488 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1489 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1490 }
1491 else
1492 {
1493 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1494
1495 if (cbWords)
1496 {
1497 /* Map the relevant chunk of the old stack. */
1498 RTPTRUNION uPtrParmWds;
1499 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 2, UINT8_MAX, GCPtrParmWds,
1500 IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
1501 if (rcStrict != VINF_SUCCESS)
1502 {
1503 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1504 return rcStrict;
1505 }
1506
1507 /* Copy the parameter words. */
1508 for (int i = 0; i < cbWords; ++i)
1509 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1510
1511 /* Unmap the old stack. */
1512 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1513 if (rcStrict != VINF_SUCCESS)
1514 {
1515 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1516 return rcStrict;
1517 }
1518 }
1519
1520 /* Push the old CS:rIP. */
1521 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1522 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1523
1524 /* Push the old SS:rSP. */
1525 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1526 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1527 }
1528 }
1529 else
1530 {
1531 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1532
1533 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1534 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1535 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1536 uPtrRet.pu64[2] = uOldRsp;
1537 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1538 }
1539
1540 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1541 if (rcStrict != VINF_SUCCESS)
1542 {
1543 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1544 return rcStrict;
1545 }
1546
1547 /* Chop the high bits off if 16-bit gate (Intel says so). */
1548 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1549 uNewRip = (uint16_t)uNewRip;
1550
1551 /* Limit / canonical check. */
1552 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1553 if (!IEM_IS_LONG_MODE(pVCpu))
1554 {
1555 if (uNewRip > cbLimit)
1556 {
1557 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1558 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1559 }
1560 u64Base = X86DESC_BASE(&DescCS.Legacy);
1561 }
1562 else
1563 {
1564 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1565 if (!IEM_IS_CANONICAL(uNewRip))
1566 {
1567 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1568 return iemRaiseNotCanonical(pVCpu);
1569 }
1570 u64Base = 0;
1571 }
1572
1573 /*
1574 * Now set the accessed bit before
1575 * writing the return address to the stack and committing the result into
1576 * CS, CSHID and RIP.
1577 */
1578 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1579 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1580 {
1581 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1582 if (rcStrict != VINF_SUCCESS)
1583 return rcStrict;
1584 /** @todo check what VT-x and AMD-V does. */
1585 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1586 }
1587
1588 /* Commit new CS:rIP. */
1589 pVCpu->cpum.GstCtx.rip = uNewRip;
1590 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1591 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1592 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1593 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1594 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1595 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1596 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1597 }
1598 else
1599 {
1600 /* Same privilege. */
1601 /** @todo This is very similar to regular far calls; merge! */
1602
1603 /* Check stack first - may #SS(0). */
1604 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1605 * 16-bit code cause a two or four byte CS to be pushed? */
1606 uint8_t bUnmapInfoRet;
1607 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1608 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1609 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1610 IEM_IS_LONG_MODE(pVCpu) ? 7
1611 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
1612 &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
1613 if (rcStrict != VINF_SUCCESS)
1614 return rcStrict;
1615
1616 /* Chop the high bits off if 16-bit gate (Intel says so). */
1617 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1618 uNewRip = (uint16_t)uNewRip;
1619
1620 /* Limit / canonical check. */
1621 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1622 if (!IEM_IS_LONG_MODE(pVCpu))
1623 {
1624 if (uNewRip > cbLimit)
1625 {
1626 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1627 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1628 }
1629 u64Base = X86DESC_BASE(&DescCS.Legacy);
1630 }
1631 else
1632 {
1633 if (!IEM_IS_CANONICAL(uNewRip))
1634 {
1635 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1636 return iemRaiseNotCanonical(pVCpu);
1637 }
1638 u64Base = 0;
1639 }
1640
1641 /*
1642 * Now set the accessed bit before
1643 * writing the return address to the stack and committing the result into
1644 * CS, CSHID and RIP.
1645 */
1646 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1647 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1648 {
1649 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1650 if (rcStrict != VINF_SUCCESS)
1651 return rcStrict;
1652 /** @todo check what VT-x and AMD-V does. */
1653 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1654 }
1655
1656 /* stack */
1657 if (!IEM_IS_LONG_MODE(pVCpu))
1658 {
1659 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1660 {
1661 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1662 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1663 }
1664 else
1665 {
1666 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1667 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1668 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1669 }
1670 }
1671 else
1672 {
1673 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1674 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1675 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1676 }
1677
1678 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
1679 if (rcStrict != VINF_SUCCESS)
1680 return rcStrict;
1681
1682 /* commit */
1683 pVCpu->cpum.GstCtx.rip = uNewRip;
1684 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1685 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
1686 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1687 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1688 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1689 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1690 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1691 }
1692 }
1693 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1694
1695 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
1696
1697/** @todo single stepping */
1698
1699 /* Flush the prefetch buffer. */
1700 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1701 return VINF_SUCCESS;
1702#endif /* IEM_IMPLEMENTS_CALLGATE */
1703}
1704
1705
1706/**
1707 * Implements far jumps and calls thru system selectors.
1708 *
1709 * @returns VBox strict status code.
1710 * @param pVCpu The cross context virtual CPU structure of the
1711 * calling thread.
1712 * @param cbInstr The current instruction length.
1713 * @param uSel The selector.
1714 * @param enmBranch The kind of branching we're performing.
1715 * @param enmEffOpSize The effective operand size.
1716 * @param pDesc The descriptor corresponding to @a uSel.
1717 */
1718static VBOXSTRICTRC iemCImpl_BranchSysSel(PVMCPUCC pVCpu, uint8_t cbInstr, uint16_t uSel, IEMBRANCH enmBranch,
1719 IEMMODE enmEffOpSize, PIEMSELDESC pDesc)
1720{
1721 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1722 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1723 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1724
1725 if (IEM_IS_LONG_MODE(pVCpu))
1726 switch (pDesc->Legacy.Gen.u4Type)
1727 {
1728 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1729 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1730
1731 default:
1732 case AMD64_SEL_TYPE_SYS_LDT:
1733 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1734 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1735 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1736 case AMD64_SEL_TYPE_SYS_INT_GATE:
1737 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1738 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1739 }
1740
1741 switch (pDesc->Legacy.Gen.u4Type)
1742 {
1743 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1744 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1745 return iemCImpl_BranchCallGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1746
1747 case X86_SEL_TYPE_SYS_TASK_GATE:
1748 return iemCImpl_BranchTaskGate(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1749
1750 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1751 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1752 return iemCImpl_BranchTaskSegment(pVCpu, cbInstr, uSel, enmBranch, enmEffOpSize, pDesc);
1753
1754 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1755 Log(("branch %04x -> busy 286 TSS\n", uSel));
1756 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1757
1758 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1759 Log(("branch %04x -> busy 386 TSS\n", uSel));
1760 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1761
1762 default:
1763 case X86_SEL_TYPE_SYS_LDT:
1764 case X86_SEL_TYPE_SYS_286_INT_GATE:
1765 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1766 case X86_SEL_TYPE_SYS_386_INT_GATE:
1767 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1768 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1769 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1770 }
1771}
1772
1773
1774/**
1775 * Implements far jumps.
1776 *
1777 * @param uSel The selector.
1778 * @param offSeg The segment offset.
1779 * @param enmEffOpSize The effective operand size.
1780 */
1781IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1782{
1783 NOREF(cbInstr);
1784 Assert(offSeg <= UINT32_MAX || (!IEM_IS_GUEST_CPU_AMD(pVCpu) && IEM_IS_64BIT_CODE(pVCpu)));
1785
1786 /*
1787 * Real mode and V8086 mode are easy. The only snag seems to be that
1788 * CS.limit doesn't change and the limit check is done against the current
1789 * limit.
1790 */
1791 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1792 * 1998) that up to and including the Intel 486, far control
1793 * transfers in real mode set default CS attributes (0x93) and also
1794 * set a 64K segment limit. Starting with the Pentium, the
1795 * attributes and limit are left alone but the access rights are
1796 * ignored. We only implement the Pentium+ behavior.
1797 * */
1798 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1799 {
1800 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1801 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1802 {
1803 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1804 return iemRaiseGeneralProtectionFault0(pVCpu);
1805 }
1806
1807 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1808 pVCpu->cpum.GstCtx.rip = offSeg;
1809 else
1810 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1811 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1812 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1813 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1814 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1815
1816 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
1817 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
1818 { /* likely */ }
1819 else if (uSel != 0)
1820 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
1821 else
1822 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
1823 | iemCalc32BitFlatIndicator(pVCpu);
1824
1825 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1826 }
1827
1828 /*
1829 * Protected mode. Need to parse the specified descriptor...
1830 */
1831 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1832 {
1833 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1834 return iemRaiseGeneralProtectionFault0(pVCpu);
1835 }
1836
1837 /* Fetch the descriptor. */
1838 IEMSELDESC Desc;
1839 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1840 if (rcStrict != VINF_SUCCESS)
1841 return rcStrict;
1842
1843 /* Is it there? */
1844 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1845 {
1846 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1847 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1848 }
1849
1850 /*
1851 * Deal with it according to its type. We do the standard code selectors
1852 * here and dispatch the system selectors to worker functions.
1853 */
1854 if (!Desc.Legacy.Gen.u1DescType)
1855 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1856
1857 /* Only code segments. */
1858 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1859 {
1860 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1861 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1862 }
1863
1864 /* L vs D. */
1865 if ( Desc.Legacy.Gen.u1Long
1866 && Desc.Legacy.Gen.u1DefBig
1867 && IEM_IS_LONG_MODE(pVCpu))
1868 {
1869 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1870 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1871 }
1872
1873 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1874 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1875 {
1876 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
1877 {
1878 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1879 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1880 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1881 }
1882 }
1883 else
1884 {
1885 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
1886 {
1887 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
1888 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1889 }
1890 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
1891 {
1892 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895 }
1896
1897 /* Chop the high bits if 16-bit (Intel says so). */
1898 if (enmEffOpSize == IEMMODE_16BIT)
1899 offSeg &= UINT16_MAX;
1900
1901 /* Limit check and get the base. */
1902 uint64_t u64Base;
1903 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1904 if ( !Desc.Legacy.Gen.u1Long
1905 || !IEM_IS_LONG_MODE(pVCpu))
1906 {
1907 if (RT_LIKELY(offSeg <= cbLimit))
1908 u64Base = X86DESC_BASE(&Desc.Legacy);
1909 else
1910 {
1911 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1912 /** @todo Intel says this is \#GP(0)! */
1913 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1914 }
1915 }
1916 else
1917 u64Base = 0;
1918
1919 /*
1920 * Ok, everything checked out fine. Now set the accessed bit before
1921 * committing the result into CS, CSHID and RIP.
1922 */
1923 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1924 {
1925 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1926 if (rcStrict != VINF_SUCCESS)
1927 return rcStrict;
1928 /** @todo check what VT-x and AMD-V does. */
1929 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1930 }
1931
1932 /* commit */
1933 pVCpu->cpum.GstCtx.rip = offSeg;
1934 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1935 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu); /** @todo is this right for conforming segs? or in general? */
1936 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1937 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1938 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1939 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1940 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1941
1942 /** @todo check if the hidden bits are loaded correctly for 64-bit
1943 * mode. */
1944
1945 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
1946
1947 /* Flush the prefetch buffer. */
1948 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
1949
1950 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
1951}
1952
1953
1954/**
1955 * Implements far calls.
1956 *
1957 * This very similar to iemCImpl_FarJmp.
1958 *
1959 * @param uSel The selector.
1960 * @param offSeg The segment offset.
1961 * @param enmEffOpSize The operand size (in case we need it).
1962 */
1963IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1964{
1965 VBOXSTRICTRC rcStrict;
1966 uint64_t uNewRsp;
1967 RTPTRUNION uPtrRet;
1968 uint8_t bUnmapInfo;
1969
1970 /*
1971 * Real mode and V8086 mode are easy. The only snag seems to be that
1972 * CS.limit doesn't change and the limit check is done against the current
1973 * limit.
1974 */
1975 /** @todo See comment for similar code in iemCImpl_FarJmp */
1976 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1977 {
1978 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1979
1980 /* Check stack first - may #SS(0). */
1981 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1982 enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
1983 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
1984 if (rcStrict != VINF_SUCCESS)
1985 return rcStrict;
1986
1987 /* Check the target address range. */
1988/** @todo this must be wrong! Write unreal mode tests! */
1989 if (offSeg > UINT32_MAX)
1990 return iemRaiseGeneralProtectionFault0(pVCpu);
1991
1992 /* Everything is fine, push the return address. */
1993 if (enmEffOpSize == IEMMODE_16BIT)
1994 {
1995 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1996 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1997 }
1998 else
1999 {
2000 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2001 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2002 }
2003 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2004 if (rcStrict != VINF_SUCCESS)
2005 return rcStrict;
2006
2007 /* Branch. */
2008 pVCpu->cpum.GstCtx.rip = offSeg;
2009 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2010 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2011 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2012 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2013
2014 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2015 }
2016
2017 /*
2018 * Protected mode. Need to parse the specified descriptor...
2019 */
2020 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2021 {
2022 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2023 return iemRaiseGeneralProtectionFault0(pVCpu);
2024 }
2025
2026 /* Fetch the descriptor. */
2027 IEMSELDESC Desc;
2028 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2029 if (rcStrict != VINF_SUCCESS)
2030 return rcStrict;
2031
2032 /*
2033 * Deal with it according to its type. We do the standard code selectors
2034 * here and dispatch the system selectors to worker functions.
2035 */
2036 if (!Desc.Legacy.Gen.u1DescType)
2037 return iemCImpl_BranchSysSel(pVCpu, cbInstr, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2038
2039 /* Only code segments. */
2040 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2041 {
2042 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2043 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2044 }
2045
2046 /* L vs D. */
2047 if ( Desc.Legacy.Gen.u1Long
2048 && Desc.Legacy.Gen.u1DefBig
2049 && IEM_IS_LONG_MODE(pVCpu))
2050 {
2051 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2052 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2053 }
2054
2055 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2056 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2057 {
2058 if (IEM_GET_CPL(pVCpu) < Desc.Legacy.Gen.u2Dpl)
2059 {
2060 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2061 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2062 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2063 }
2064 }
2065 else
2066 {
2067 if (IEM_GET_CPL(pVCpu) != Desc.Legacy.Gen.u2Dpl)
2068 {
2069 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
2070 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2071 }
2072 if ((uSel & X86_SEL_RPL) > IEM_GET_CPL(pVCpu))
2073 {
2074 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu)));
2075 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2076 }
2077 }
2078
2079 /* Is it there? */
2080 if (!Desc.Legacy.Gen.u1Present)
2081 {
2082 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2083 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2084 }
2085
2086 /* Check stack first - may #SS(0). */
2087 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2088 * 16-bit code cause a two or four byte CS to be pushed? */
2089 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2090 enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2091 enmEffOpSize == IEMMODE_64BIT ? 7 : enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
2092 &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
2093 if (rcStrict != VINF_SUCCESS)
2094 return rcStrict;
2095
2096 /* Chop the high bits if 16-bit (Intel says so). */
2097 if (enmEffOpSize == IEMMODE_16BIT)
2098 offSeg &= UINT16_MAX;
2099
2100 /* Limit / canonical check. */
2101 uint64_t u64Base;
2102 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2103 if ( !Desc.Legacy.Gen.u1Long
2104 || !IEM_IS_LONG_MODE(pVCpu))
2105 {
2106 if (RT_LIKELY(offSeg <= cbLimit))
2107 u64Base = X86DESC_BASE(&Desc.Legacy);
2108 else
2109 {
2110 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2111 /** @todo Intel says this is \#GP(0)! */
2112 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2113 }
2114 }
2115 else if (IEM_IS_CANONICAL(offSeg))
2116 u64Base = 0;
2117 else
2118 {
2119 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2120 return iemRaiseNotCanonical(pVCpu);
2121 }
2122
2123 /*
2124 * Now set the accessed bit before
2125 * writing the return address to the stack and committing the result into
2126 * CS, CSHID and RIP.
2127 */
2128 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2129 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2130 {
2131 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2132 if (rcStrict != VINF_SUCCESS)
2133 return rcStrict;
2134 /** @todo check what VT-x and AMD-V does. */
2135 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2136 }
2137
2138 /* stack */
2139 if (enmEffOpSize == IEMMODE_16BIT)
2140 {
2141 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2142 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2143 }
2144 else if (enmEffOpSize == IEMMODE_32BIT)
2145 {
2146 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2147 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2148 }
2149 else
2150 {
2151 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2152 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2153 }
2154 rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
2155 if (rcStrict != VINF_SUCCESS)
2156 return rcStrict;
2157
2158 /* commit */
2159 pVCpu->cpum.GstCtx.rip = offSeg;
2160 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2161 pVCpu->cpum.GstCtx.cs.Sel |= IEM_GET_CPL(pVCpu);
2162 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2163 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2164 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2165 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2166 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2167
2168 /** @todo check if the hidden bits are loaded correctly for 64-bit
2169 * mode. */
2170
2171 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
2172
2173 /* Flush the prefetch buffer. */
2174 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
2175
2176 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2177}
2178
2179
2180/**
2181 * Implements retf.
2182 *
2183 * @param enmEffOpSize The effective operand size.
2184 * @param cbPop The amount of arguments to pop from the stack
2185 * (bytes).
2186 */
2187IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2188{
2189 NOREF(cbInstr);
2190
2191 /*
2192 * Read the stack values first.
2193 */
2194 RTUINT64U NewRsp;
2195 uint8_t bUnmapInfo;
2196 RTCPTRUNION uPtrFrame;
2197 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2198 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2199 VBOXSTRICTRC rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
2200 enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
2201 &uPtrFrame.pv, &bUnmapInfo, &NewRsp.u);
2202 if (rcStrict != VINF_SUCCESS)
2203 return rcStrict;
2204
2205 uint64_t uNewRip;
2206 uint16_t uNewCs;
2207 if (enmEffOpSize == IEMMODE_16BIT)
2208 {
2209 uNewRip = uPtrFrame.pu16[0];
2210 uNewCs = uPtrFrame.pu16[1];
2211 }
2212 else if (enmEffOpSize == IEMMODE_32BIT)
2213 {
2214 uNewRip = uPtrFrame.pu32[0];
2215 uNewCs = uPtrFrame.pu16[2];
2216 }
2217 else
2218 {
2219 uNewRip = uPtrFrame.pu64[0];
2220 uNewCs = uPtrFrame.pu16[4];
2221 }
2222
2223 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2224 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2225 { /* extremely likely */ }
2226 else
2227 return rcStrict;
2228
2229 /*
2230 * Real mode and V8086 mode are easy.
2231 */
2232 /** @todo See comment for similar code in iemCImpl_FarJmp */
2233 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2234 {
2235 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2236 /** @todo check how this is supposed to work if sp=0xfffe. */
2237
2238 /* Check the limit of the new EIP. */
2239 /** @todo Intel pseudo code only does the limit check for 16-bit
2240 * operands, AMD does not make any distinction. What is right? */
2241 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2242 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2243
2244 /* commit the operation. */
2245 if (cbPop)
2246 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2247 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2248 pVCpu->cpum.GstCtx.rip = uNewRip;
2249 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2250 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2251 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2252 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2253 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2254 }
2255
2256 /*
2257 * Protected mode is complicated, of course.
2258 */
2259 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2260 {
2261 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2262 return iemRaiseGeneralProtectionFault0(pVCpu);
2263 }
2264
2265 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2266
2267 /* Fetch the descriptor. */
2268 IEMSELDESC DescCs;
2269 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2270 if (rcStrict != VINF_SUCCESS)
2271 return rcStrict;
2272
2273 /* Can only return to a code selector. */
2274 if ( !DescCs.Legacy.Gen.u1DescType
2275 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2276 {
2277 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2278 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2279 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2280 }
2281
2282 /* L vs D. */
2283 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2284 && DescCs.Legacy.Gen.u1DefBig
2285 && IEM_IS_LONG_MODE(pVCpu))
2286 {
2287 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2288 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2289 }
2290
2291 /* DPL/RPL/CPL checks. */
2292 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
2293 {
2294 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
2295 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2296 }
2297
2298 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2299 {
2300 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2301 {
2302 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2303 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2304 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2305 }
2306 }
2307 else
2308 {
2309 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2310 {
2311 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2312 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2313 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2314 }
2315 }
2316
2317 /* Is it there? */
2318 if (!DescCs.Legacy.Gen.u1Present)
2319 {
2320 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2321 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2322 }
2323
2324 /*
2325 * Return to outer privilege? (We'll typically have entered via a call gate.)
2326 */
2327 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
2328 {
2329 /* Read the outer stack pointer stored *after* the parameters. */
2330 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, &bUnmapInfo, NewRsp.u);
2331 if (rcStrict != VINF_SUCCESS)
2332 return rcStrict;
2333
2334 uint16_t uNewOuterSs;
2335 RTUINT64U NewOuterRsp;
2336 if (enmEffOpSize == IEMMODE_16BIT)
2337 {
2338 NewOuterRsp.u = uPtrFrame.pu16[0];
2339 uNewOuterSs = uPtrFrame.pu16[1];
2340 }
2341 else if (enmEffOpSize == IEMMODE_32BIT)
2342 {
2343 NewOuterRsp.u = uPtrFrame.pu32[0];
2344 uNewOuterSs = uPtrFrame.pu16[2];
2345 }
2346 else
2347 {
2348 NewOuterRsp.u = uPtrFrame.pu64[0];
2349 uNewOuterSs = uPtrFrame.pu16[4];
2350 }
2351 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2352 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2353 { /* extremely likely */ }
2354 else
2355 return rcStrict;
2356
2357 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2358 and read the selector. */
2359 IEMSELDESC DescSs;
2360 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2361 {
2362 if ( !DescCs.Legacy.Gen.u1Long
2363 || (uNewOuterSs & X86_SEL_RPL) == 3)
2364 {
2365 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2366 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2367 return iemRaiseGeneralProtectionFault0(pVCpu);
2368 }
2369 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2370 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2371 }
2372 else
2373 {
2374 /* Fetch the descriptor for the new stack segment. */
2375 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2376 if (rcStrict != VINF_SUCCESS)
2377 return rcStrict;
2378 }
2379
2380 /* Check that RPL of stack and code selectors match. */
2381 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2382 {
2383 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2384 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2385 }
2386
2387 /* Must be a writable data segment. */
2388 if ( !DescSs.Legacy.Gen.u1DescType
2389 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2390 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2391 {
2392 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2393 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2394 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2395 }
2396
2397 /* L vs D. (Not mentioned by intel.) */
2398 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2399 && DescSs.Legacy.Gen.u1DefBig
2400 && IEM_IS_LONG_MODE(pVCpu))
2401 {
2402 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2403 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2404 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2405 }
2406
2407 /* DPL/RPL/CPL checks. */
2408 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2409 {
2410 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2411 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2412 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2413 }
2414
2415 /* Is it there? */
2416 if (!DescSs.Legacy.Gen.u1Present)
2417 {
2418 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2419 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2420 }
2421
2422 /* Calc SS limit.*/
2423 uint64_t u64BaseSs;
2424 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2425
2426 /* Is RIP canonical or within CS.limit? */
2427 uint64_t u64BaseCs;
2428 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2429
2430 /** @todo Testcase: Is this correct? */
2431 if ( DescCs.Legacy.Gen.u1Long
2432 && IEM_IS_LONG_MODE(pVCpu) )
2433 {
2434 if (!IEM_IS_CANONICAL(uNewRip))
2435 {
2436 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u));
2437 return iemRaiseNotCanonical(pVCpu);
2438 }
2439 u64BaseCs = 0;
2440 u64BaseSs = 0;
2441 }
2442 else
2443 {
2444 if (uNewRip > cbLimitCs)
2445 {
2446 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2447 uNewCs, uNewRip, uNewOuterSs, NewOuterRsp.u, cbLimitCs));
2448 /** @todo Intel says this is \#GP(0)! */
2449 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2450 }
2451 u64BaseCs = X86DESC_BASE(&DescCs.Legacy);
2452 u64BaseSs = X86DESC_BASE(&DescSs.Legacy);
2453 }
2454
2455 /*
2456 * Now set the accessed bit before
2457 * writing the return address to the stack and committing the result into
2458 * CS, CSHID and RIP.
2459 */
2460 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2461 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2462 {
2463 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2464 if (rcStrict != VINF_SUCCESS)
2465 return rcStrict;
2466 /** @todo check what VT-x and AMD-V does. */
2467 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2468 }
2469 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2470 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2471 {
2472 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2473 if (rcStrict != VINF_SUCCESS)
2474 return rcStrict;
2475 /** @todo check what VT-x and AMD-V does. */
2476 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2477 }
2478
2479 /* commit */
2480 if (enmEffOpSize == IEMMODE_16BIT)
2481 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2482 else
2483 pVCpu->cpum.GstCtx.rip = uNewRip;
2484 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2485 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2486 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2487 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2488 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2489 pVCpu->cpum.GstCtx.cs.u64Base = u64BaseCs;
2490 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2491 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2492 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2493 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2494 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2495 pVCpu->cpum.GstCtx.ss.u64Base = u64BaseSs;
2496
2497 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2498 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2499 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2500 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2501
2502 iemRecalcExecModeAndCplAndAcFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2503
2504 if (cbPop)
2505 iemRegAddToRspEx(pVCpu, &NewOuterRsp, cbPop);
2506 if (IEM_IS_64BIT_CODE(pVCpu))
2507 pVCpu->cpum.GstCtx.rsp = NewOuterRsp.u;
2508 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2509 pVCpu->cpum.GstCtx.rsp = (uint32_t)NewOuterRsp.u;
2510 else
2511 pVCpu->cpum.GstCtx.sp = (uint16_t)NewOuterRsp.u;
2512
2513 iemRecalcExecModeAndCplAndAcFlags(pVCpu); /* Affects iemRegAddToRspEx and the setting of RSP/SP below. */
2514
2515 /** @todo check if the hidden bits are loaded correctly for 64-bit
2516 * mode. */
2517 }
2518 /*
2519 * Return to the same privilege level
2520 */
2521 else
2522 {
2523 /* Limit / canonical check. */
2524 uint64_t u64Base;
2525 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2526
2527 /** @todo Testcase: Is this correct? */
2528 bool f64BitCs = false;
2529 if ( DescCs.Legacy.Gen.u1Long
2530 && IEM_IS_LONG_MODE(pVCpu) )
2531 {
2532 if (!IEM_IS_CANONICAL(uNewRip))
2533 {
2534 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2535 return iemRaiseNotCanonical(pVCpu);
2536 }
2537 u64Base = 0;
2538 f64BitCs = true;
2539 f64BitCs = true;
2540 }
2541 else
2542 {
2543 if (uNewRip > cbLimitCs)
2544 {
2545 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2546 /** @todo Intel says this is \#GP(0)! */
2547 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2548 }
2549 u64Base = X86DESC_BASE(&DescCs.Legacy);
2550 }
2551
2552 /*
2553 * Now set the accessed bit before
2554 * writing the return address to the stack and committing the result into
2555 * CS, CSHID and RIP.
2556 */
2557 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2558 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2559 {
2560 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2561 if (rcStrict != VINF_SUCCESS)
2562 return rcStrict;
2563 /** @todo check what VT-x and AMD-V does. */
2564 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2565 }
2566
2567 /* commit */
2568 if (cbPop)
2569/** @todo This cannot be right. We're using the old CS mode here, and iemRegAddToRspEx checks fExec. */
2570 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2571 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig || f64BitCs)
2572 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2573 else
2574 pVCpu->cpum.GstCtx.sp = (uint16_t)NewRsp.u;
2575 if (enmEffOpSize == IEMMODE_16BIT)
2576 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2577 else
2578 pVCpu->cpum.GstCtx.rip = uNewRip;
2579 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2580 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2581 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2582 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2583 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2584 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2585 /** @todo check if the hidden bits are loaded correctly for 64-bit
2586 * mode. */
2587
2588 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
2589 }
2590
2591 /* Flush the prefetch buffer. */
2592 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo use light flush for same privilege? */
2593
2594 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
2595}
2596
2597
2598/**
2599 * Implements enter.
2600 *
2601 * We're doing this in C because the instruction is insane, even for the
2602 * u8NestingLevel=0 case dealing with the stack is tedious.
2603 *
2604 * @param enmEffOpSize The effective operand size.
2605 * @param cbFrame Frame size.
2606 * @param cParameters Frame parameter count.
2607 */
2608IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2609{
2610 /* Push RBP, saving the old value in TmpRbp. */
2611 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2612 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2613 RTUINT64U NewRbp;
2614 VBOXSTRICTRC rcStrict;
2615 if (enmEffOpSize == IEMMODE_64BIT)
2616 {
2617 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2618 NewRbp = NewRsp;
2619 }
2620 else if (enmEffOpSize == IEMMODE_32BIT)
2621 {
2622 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2623 NewRbp = NewRsp;
2624 }
2625 else
2626 {
2627 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2628 NewRbp = TmpRbp;
2629 NewRbp.Words.w0 = NewRsp.Words.w0;
2630 }
2631 if (rcStrict != VINF_SUCCESS)
2632 return rcStrict;
2633
2634 /* Copy the parameters (aka nesting levels by Intel). */
2635 cParameters &= 0x1f;
2636 if (cParameters > 0)
2637 {
2638 switch (enmEffOpSize)
2639 {
2640 case IEMMODE_16BIT:
2641 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2642 TmpRbp.DWords.dw0 -= 2;
2643 else
2644 TmpRbp.Words.w0 -= 2;
2645 do
2646 {
2647 uint16_t u16Tmp;
2648 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2649 if (rcStrict != VINF_SUCCESS)
2650 break;
2651 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2652 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2653 break;
2654
2655 case IEMMODE_32BIT:
2656 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2657 TmpRbp.DWords.dw0 -= 4;
2658 else
2659 TmpRbp.Words.w0 -= 4;
2660 do
2661 {
2662 uint32_t u32Tmp;
2663 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2664 if (rcStrict != VINF_SUCCESS)
2665 break;
2666 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2667 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2668 break;
2669
2670 case IEMMODE_64BIT:
2671 TmpRbp.u -= 8;
2672 do
2673 {
2674 uint64_t u64Tmp;
2675 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2676 if (rcStrict != VINF_SUCCESS)
2677 break;
2678 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2679 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2680 break;
2681
2682 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2683 }
2684 if (rcStrict != VINF_SUCCESS)
2685 return VINF_SUCCESS;
2686
2687 /* Push the new RBP */
2688 if (enmEffOpSize == IEMMODE_64BIT)
2689 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2690 else if (enmEffOpSize == IEMMODE_32BIT)
2691 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2692 else
2693 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2694 if (rcStrict != VINF_SUCCESS)
2695 return rcStrict;
2696
2697 }
2698
2699 /* Recalc RSP. */
2700 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2701
2702 /** @todo Should probe write access at the new RSP according to AMD. */
2703 /** @todo Should handle accesses to the VMX APIC-access page. */
2704
2705 /* Commit it. */
2706 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2707 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2708 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2709}
2710
2711
2712
2713/**
2714 * Implements leave.
2715 *
2716 * We're doing this in C because messing with the stack registers is annoying
2717 * since they depends on SS attributes.
2718 *
2719 * @param enmEffOpSize The effective operand size.
2720 */
2721IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2722{
2723 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2724 RTUINT64U NewRsp;
2725 if (IEM_IS_64BIT_CODE(pVCpu))
2726 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2727 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2728 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2729 else
2730 {
2731 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2732 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2733 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2734 }
2735
2736 /* Pop RBP according to the operand size. */
2737 VBOXSTRICTRC rcStrict;
2738 RTUINT64U NewRbp;
2739 switch (enmEffOpSize)
2740 {
2741 case IEMMODE_16BIT:
2742 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2743 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2744 break;
2745 case IEMMODE_32BIT:
2746 NewRbp.u = 0;
2747 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2748 break;
2749 case IEMMODE_64BIT:
2750 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2751 break;
2752 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2753 }
2754 if (rcStrict != VINF_SUCCESS)
2755 return rcStrict;
2756
2757
2758 /* Commit it. */
2759 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2760 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2761 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
2762}
2763
2764
2765/**
2766 * Implements int3 and int XX.
2767 *
2768 * @param u8Int The interrupt vector number.
2769 * @param enmInt The int instruction type.
2770 */
2771IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2772{
2773 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2774
2775 /*
2776 * We must check if this INT3 might belong to DBGF before raising a #BP.
2777 */
2778 if (u8Int == 3)
2779 {
2780 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
2781 if (pVM->dbgf.ro.cEnabledInt3Breakpoints == 0)
2782 { /* likely: No vbox debugger breakpoints */ }
2783 else
2784 {
2785 VBOXSTRICTRC rcStrict = DBGFTrap03Handler(pVM, pVCpu, &pVCpu->cpum.GstCtx);
2786 Log(("iemCImpl_int: DBGFTrap03Handler -> %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2787 if (rcStrict != VINF_EM_RAW_GUEST_TRAP)
2788 return iemSetPassUpStatus(pVCpu, rcStrict);
2789 }
2790 }
2791/** @todo single stepping */
2792 return iemRaiseXcptOrInt(pVCpu,
2793 cbInstr,
2794 u8Int,
2795 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2796 0,
2797 0);
2798}
2799
2800
2801/**
2802 * Implements iret for real mode and V8086 mode.
2803 *
2804 * @param enmEffOpSize The effective operand size.
2805 */
2806IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2807{
2808 X86EFLAGS Efl;
2809 Efl.u = IEMMISC_GET_EFL(pVCpu);
2810 NOREF(cbInstr);
2811
2812 /*
2813 * iret throws an exception if VME isn't enabled.
2814 */
2815 if ( Efl.Bits.u1VM
2816 && Efl.Bits.u2IOPL != 3
2817 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2818 return iemRaiseGeneralProtectionFault0(pVCpu);
2819
2820 /*
2821 * Do the stack bits, but don't commit RSP before everything checks
2822 * out right.
2823 */
2824 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2825 VBOXSTRICTRC rcStrict;
2826 uint8_t bUnmapInfo;
2827 RTCPTRUNION uFrame;
2828 uint16_t uNewCs;
2829 uint32_t uNewEip;
2830 uint32_t uNewFlags;
2831 uint64_t uNewRsp;
2832 if (enmEffOpSize == IEMMODE_32BIT)
2833 {
2834 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
2835 if (rcStrict != VINF_SUCCESS)
2836 return rcStrict;
2837 uNewEip = uFrame.pu32[0];
2838 if (uNewEip > UINT16_MAX)
2839 return iemRaiseGeneralProtectionFault0(pVCpu);
2840
2841 uNewCs = (uint16_t)uFrame.pu32[1];
2842 uNewFlags = uFrame.pu32[2];
2843 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2844 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2845 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2846 | X86_EFL_ID;
2847 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2848 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2849 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2850 }
2851 else
2852 {
2853 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
2854 if (rcStrict != VINF_SUCCESS)
2855 return rcStrict;
2856 uNewEip = uFrame.pu16[0];
2857 uNewCs = uFrame.pu16[1];
2858 uNewFlags = uFrame.pu16[2];
2859 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2860 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2861 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2862 /** @todo The intel pseudo code does not indicate what happens to
2863 * reserved flags. We just ignore them. */
2864 /* Ancient CPU adjustments: See iemCImpl_popf. */
2865 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2866 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2867 }
2868 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
2869 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2870 { /* extremely likely */ }
2871 else
2872 return rcStrict;
2873
2874 /** @todo Check how this is supposed to work if sp=0xfffe. */
2875 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2876 uNewCs, uNewEip, uNewFlags, uNewRsp));
2877
2878 /*
2879 * Check the limit of the new EIP.
2880 */
2881 /** @todo Only the AMD pseudo code check the limit here, what's
2882 * right? */
2883 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2884 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2885
2886 /*
2887 * V8086 checks and flag adjustments
2888 */
2889 if (Efl.Bits.u1VM)
2890 {
2891 if (Efl.Bits.u2IOPL == 3)
2892 {
2893 /* Preserve IOPL and clear RF. */
2894 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2895 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2896 }
2897 else if ( enmEffOpSize == IEMMODE_16BIT
2898 && ( !(uNewFlags & X86_EFL_IF)
2899 || !Efl.Bits.u1VIP )
2900 && !(uNewFlags & X86_EFL_TF) )
2901 {
2902 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2903 uNewFlags &= ~X86_EFL_VIF;
2904 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2905 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2906 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2907 }
2908 else
2909 return iemRaiseGeneralProtectionFault0(pVCpu);
2910 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2911 }
2912
2913 /*
2914 * Commit the operation.
2915 */
2916#ifdef DBGFTRACE_ENABLED
2917 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2918 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2919#endif
2920 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2921 pVCpu->cpum.GstCtx.rip = uNewEip;
2922 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2923 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2924 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2925 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2926 /** @todo do we load attribs and limit as well? */
2927 Assert(uNewFlags & X86_EFL_1);
2928 IEMMISC_SET_EFL(pVCpu, uNewFlags);
2929 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_X86_AC) | iemCalcExecAcFlag(pVCpu);
2930
2931 /* Flush the prefetch buffer. */
2932 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo can do light flush in real mode at least */
2933
2934/** @todo single stepping */
2935 return VINF_SUCCESS;
2936}
2937
2938
2939/**
2940 * Loads a segment register when entering V8086 mode.
2941 *
2942 * @param pSReg The segment register.
2943 * @param uSeg The segment to load.
2944 */
2945static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2946{
2947 pSReg->Sel = uSeg;
2948 pSReg->ValidSel = uSeg;
2949 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2950 pSReg->u64Base = (uint32_t)uSeg << 4;
2951 pSReg->u32Limit = 0xffff;
2952 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2953 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2954 * IRET'ing to V8086. */
2955}
2956
2957
2958/**
2959 * Implements iret for protected mode returning to V8086 mode.
2960 *
2961 * @param uNewEip The new EIP.
2962 * @param uNewCs The new CS.
2963 * @param uNewFlags The new EFLAGS.
2964 * @param uNewRsp The RSP after the initial IRET frame.
2965 *
2966 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2967 */
2968IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
2969{
2970 RT_NOREF_PV(cbInstr);
2971 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
2972
2973 /*
2974 * Pop the V8086 specific frame bits off the stack.
2975 */
2976 uint8_t bUnmapInfo;
2977 RTCPTRUNION uFrame;
2978 VBOXSTRICTRC rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
2979 if (rcStrict != VINF_SUCCESS)
2980 return rcStrict;
2981 uint32_t uNewEsp = uFrame.pu32[0];
2982 uint16_t uNewSs = uFrame.pu32[1];
2983 uint16_t uNewEs = uFrame.pu32[2];
2984 uint16_t uNewDs = uFrame.pu32[3];
2985 uint16_t uNewFs = uFrame.pu32[4];
2986 uint16_t uNewGs = uFrame.pu32[5];
2987 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
2988 if (rcStrict != VINF_SUCCESS)
2989 return rcStrict;
2990
2991 /*
2992 * Commit the operation.
2993 */
2994 uNewFlags &= X86_EFL_LIVE_MASK;
2995 uNewFlags |= X86_EFL_RA1_MASK;
2996#ifdef DBGFTRACE_ENABLED
2997 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2998 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2999#endif
3000 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3001
3002 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3003 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3004 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3005 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3006 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3007 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3008 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3009 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3010 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3011 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
3012 | (3 << IEM_F_X86_CPL_SHIFT)
3013 | IEM_F_MODE_X86_16BIT_PROT_V86
3014 | iemCalcExecAcFlag(pVCpu);
3015
3016 /* Flush the prefetch buffer. */
3017 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3018
3019/** @todo single stepping */
3020 return VINF_SUCCESS;
3021}
3022
3023
3024/**
3025 * Implements iret for protected mode returning via a nested task.
3026 *
3027 * @param enmEffOpSize The effective operand size.
3028 */
3029IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3030{
3031 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3032#ifndef IEM_IMPLEMENTS_TASKSWITCH
3033 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3034#else
3035 RT_NOREF_PV(enmEffOpSize);
3036
3037 /*
3038 * Read the segment selector in the link-field of the current TSS.
3039 */
3040 RTSEL uSelRet;
3041 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3042 if (rcStrict != VINF_SUCCESS)
3043 return rcStrict;
3044
3045 /*
3046 * Fetch the returning task's TSS descriptor from the GDT.
3047 */
3048 if (uSelRet & X86_SEL_LDT)
3049 {
3050 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3051 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3052 }
3053
3054 IEMSELDESC TssDesc;
3055 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3056 if (rcStrict != VINF_SUCCESS)
3057 return rcStrict;
3058
3059 if (TssDesc.Legacy.Gate.u1DescType)
3060 {
3061 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3062 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3063 }
3064
3065 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3066 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3067 {
3068 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3069 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3070 }
3071
3072 if (!TssDesc.Legacy.Gate.u1Present)
3073 {
3074 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3075 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3076 }
3077
3078 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3079 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3080 0 /* uCr2 */, uSelRet, &TssDesc);
3081#endif
3082}
3083
3084
3085/**
3086 * Implements iret for protected mode
3087 *
3088 * @param enmEffOpSize The effective operand size.
3089 */
3090IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3091{
3092 NOREF(cbInstr);
3093 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3094
3095 /*
3096 * Nested task return.
3097 */
3098 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3099 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3100
3101 /*
3102 * Normal return.
3103 *
3104 * Do the stack bits, but don't commit RSP before everything checks
3105 * out right.
3106 */
3107 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3108 uint8_t bUnmapInfo;
3109 VBOXSTRICTRC rcStrict;
3110 RTCPTRUNION uFrame;
3111 uint16_t uNewCs;
3112 uint32_t uNewEip;
3113 uint32_t uNewFlags;
3114 uint64_t uNewRsp;
3115 if (enmEffOpSize == IEMMODE_32BIT)
3116 {
3117 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3118 if (rcStrict != VINF_SUCCESS)
3119 return rcStrict;
3120 uNewEip = uFrame.pu32[0];
3121 uNewCs = (uint16_t)uFrame.pu32[1];
3122 uNewFlags = uFrame.pu32[2];
3123 }
3124 else
3125 {
3126 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3127 if (rcStrict != VINF_SUCCESS)
3128 return rcStrict;
3129 uNewEip = uFrame.pu16[0];
3130 uNewCs = uFrame.pu16[1];
3131 uNewFlags = uFrame.pu16[2];
3132 }
3133 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3134 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3135 { /* extremely likely */ }
3136 else
3137 return rcStrict;
3138 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, IEM_GET_CPL(pVCpu)));
3139
3140 /*
3141 * We're hopefully not returning to V8086 mode...
3142 */
3143 if ( (uNewFlags & X86_EFL_VM)
3144 && IEM_GET_CPL(pVCpu) == 0)
3145 {
3146 Assert(enmEffOpSize == IEMMODE_32BIT);
3147 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3148 }
3149
3150 /*
3151 * Protected mode.
3152 */
3153 /* Read the CS descriptor. */
3154 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3155 {
3156 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3157 return iemRaiseGeneralProtectionFault0(pVCpu);
3158 }
3159
3160 IEMSELDESC DescCS;
3161 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3162 if (rcStrict != VINF_SUCCESS)
3163 {
3164 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3165 return rcStrict;
3166 }
3167
3168 /* Must be a code descriptor. */
3169 if (!DescCS.Legacy.Gen.u1DescType)
3170 {
3171 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3172 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3173 }
3174 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3175 {
3176 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3177 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3178 }
3179
3180 /* Privilege checks. */
3181 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3182 {
3183 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3184 {
3185 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3186 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3187 }
3188 }
3189 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3190 {
3191 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3192 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3193 }
3194 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3195 {
3196 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, IEM_GET_CPL(pVCpu)));
3197 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3198 }
3199
3200 /* Present? */
3201 if (!DescCS.Legacy.Gen.u1Present)
3202 {
3203 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3204 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3205 }
3206
3207 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3208
3209 /*
3210 * Return to outer level?
3211 */
3212 if ((uNewCs & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
3213 {
3214 uint16_t uNewSS;
3215 uint32_t uNewESP;
3216 if (enmEffOpSize == IEMMODE_32BIT)
3217 {
3218 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3219 if (rcStrict != VINF_SUCCESS)
3220 return rcStrict;
3221/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3222 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3223 * bit of the popped SS selector it turns out. */
3224 uNewESP = uFrame.pu32[0];
3225 uNewSS = (uint16_t)uFrame.pu32[1];
3226 }
3227 else
3228 {
3229 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
3230 if (rcStrict != VINF_SUCCESS)
3231 return rcStrict;
3232 uNewESP = uFrame.pu16[0];
3233 uNewSS = uFrame.pu16[1];
3234 }
3235 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
3236 if (rcStrict != VINF_SUCCESS)
3237 return rcStrict;
3238 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3239
3240 /* Read the SS descriptor. */
3241 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3242 {
3243 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3244 return iemRaiseGeneralProtectionFault0(pVCpu);
3245 }
3246
3247 IEMSELDESC DescSS;
3248 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3249 if (rcStrict != VINF_SUCCESS)
3250 {
3251 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3252 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3253 return rcStrict;
3254 }
3255
3256 /* Privilege checks. */
3257 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3258 {
3259 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3260 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3261 }
3262 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3263 {
3264 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3265 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3266 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3267 }
3268
3269 /* Must be a writeable data segment descriptor. */
3270 if (!DescSS.Legacy.Gen.u1DescType)
3271 {
3272 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3273 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3274 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3275 }
3276 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3277 {
3278 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3279 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3280 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3281 }
3282
3283 /* Present? */
3284 if (!DescSS.Legacy.Gen.u1Present)
3285 {
3286 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3287 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3288 }
3289
3290 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3291
3292 /* Check EIP. */
3293 if (uNewEip > cbLimitCS)
3294 {
3295 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3296 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3297 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3298 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3299 }
3300
3301 /*
3302 * Commit the changes, marking CS and SS accessed first since
3303 * that may fail.
3304 */
3305 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3306 {
3307 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3308 if (rcStrict != VINF_SUCCESS)
3309 return rcStrict;
3310 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3311 }
3312 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3313 {
3314 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3315 if (rcStrict != VINF_SUCCESS)
3316 return rcStrict;
3317 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3318 }
3319
3320 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3321 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3322 if (enmEffOpSize != IEMMODE_16BIT)
3323 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3324 if (IEM_GET_CPL(pVCpu) == 0)
3325 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3326 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3327 fEFlagsMask |= X86_EFL_IF;
3328 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3329 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3330 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3331 fEFlagsNew &= ~fEFlagsMask;
3332 fEFlagsNew |= uNewFlags & fEFlagsMask;
3333#ifdef DBGFTRACE_ENABLED
3334 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3335 IEM_GET_CPL(pVCpu), uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3336 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3337#endif
3338
3339 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3340 pVCpu->cpum.GstCtx.rip = uNewEip;
3341 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3342 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3343 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3344 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3345 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3346 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3347
3348 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3349 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3350 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3351 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3352 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3353 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3354 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3355 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3356 else
3357 pVCpu->cpum.GstCtx.rsp = uNewESP;
3358
3359 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3360 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3361 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3362 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3363
3364 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
3365
3366 /* Done! */
3367
3368 }
3369 /*
3370 * Return to the same level.
3371 */
3372 else
3373 {
3374 /* Check EIP. */
3375 if (uNewEip > cbLimitCS)
3376 {
3377 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3378 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3379 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3380 }
3381
3382 /*
3383 * Commit the changes, marking CS first since it may fail.
3384 */
3385 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3386 {
3387 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3388 if (rcStrict != VINF_SUCCESS)
3389 return rcStrict;
3390 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3391 }
3392
3393 X86EFLAGS NewEfl;
3394 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3395 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3396 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3397 if (enmEffOpSize != IEMMODE_16BIT)
3398 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3399 if (IEM_GET_CPL(pVCpu) == 0)
3400 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3401 else if (IEM_GET_CPL(pVCpu) <= NewEfl.Bits.u2IOPL)
3402 fEFlagsMask |= X86_EFL_IF;
3403 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3404 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3405 NewEfl.u &= ~fEFlagsMask;
3406 NewEfl.u |= fEFlagsMask & uNewFlags;
3407#ifdef DBGFTRACE_ENABLED
3408 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3409 IEM_GET_CPL(pVCpu), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3410 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3411#endif
3412
3413 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3414 pVCpu->cpum.GstCtx.rip = uNewEip;
3415 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3416 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3417 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3418 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3419 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3420 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3421 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3422 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3423 else
3424 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3425
3426 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
3427
3428 /* Done! */
3429 }
3430
3431 /* Flush the prefetch buffer. */
3432 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if same ring? */
3433
3434/** @todo single stepping */
3435 return VINF_SUCCESS;
3436}
3437
3438
3439/**
3440 * Implements iret for long mode
3441 *
3442 * @param enmEffOpSize The effective operand size.
3443 */
3444IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3445{
3446 NOREF(cbInstr);
3447
3448 /*
3449 * Nested task return is not supported in long mode.
3450 */
3451 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3452 {
3453 Log(("iret/64 with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3454 return iemRaiseGeneralProtectionFault0(pVCpu);
3455 }
3456
3457 /*
3458 * Normal return.
3459 *
3460 * Do the stack bits, but don't commit RSP before everything checks
3461 * out right.
3462 */
3463 VBOXSTRICTRC rcStrict;
3464 uint8_t bUnmapInfo;
3465 RTCPTRUNION uFrame;
3466 uint64_t uNewRip;
3467 uint16_t uNewCs;
3468 uint16_t uNewSs;
3469 uint32_t uNewFlags;
3470 uint64_t uNewRsp;
3471 if (enmEffOpSize == IEMMODE_64BIT)
3472 {
3473 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3474 if (rcStrict != VINF_SUCCESS)
3475 return rcStrict;
3476 uNewRip = uFrame.pu64[0];
3477 uNewCs = (uint16_t)uFrame.pu64[1];
3478 uNewFlags = (uint32_t)uFrame.pu64[2];
3479 uNewRsp = uFrame.pu64[3];
3480 uNewSs = (uint16_t)uFrame.pu64[4];
3481 }
3482 else if (enmEffOpSize == IEMMODE_32BIT)
3483 {
3484 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3485 if (rcStrict != VINF_SUCCESS)
3486 return rcStrict;
3487 uNewRip = uFrame.pu32[0];
3488 uNewCs = (uint16_t)uFrame.pu32[1];
3489 uNewFlags = uFrame.pu32[2];
3490 uNewRsp = uFrame.pu32[3];
3491 uNewSs = (uint16_t)uFrame.pu32[4];
3492 }
3493 else
3494 {
3495 Assert(enmEffOpSize == IEMMODE_16BIT);
3496 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
3497 if (rcStrict != VINF_SUCCESS)
3498 return rcStrict;
3499 uNewRip = uFrame.pu16[0];
3500 uNewCs = uFrame.pu16[1];
3501 uNewFlags = uFrame.pu16[2];
3502 uNewRsp = uFrame.pu16[3];
3503 uNewSs = uFrame.pu16[4];
3504 }
3505 rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
3506 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3507 { /* extremely like */ }
3508 else
3509 return rcStrict;
3510 Log7(("iret/64 stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3511
3512 /*
3513 * Check stuff.
3514 */
3515 /* Read the CS descriptor. */
3516 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3517 {
3518 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3519 return iemRaiseGeneralProtectionFault0(pVCpu);
3520 }
3521
3522 IEMSELDESC DescCS;
3523 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3524 if (rcStrict != VINF_SUCCESS)
3525 {
3526 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3527 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3528 return rcStrict;
3529 }
3530
3531 /* Must be a code descriptor. */
3532 if ( !DescCS.Legacy.Gen.u1DescType
3533 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3534 {
3535 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3536 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3537 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3538 }
3539
3540 /* Privilege checks. */
3541 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3542 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3543 {
3544 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3545 {
3546 Log(("iret/64 %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3547 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3548 }
3549 }
3550 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3551 {
3552 Log(("iret/64 %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3553 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3554 }
3555 if ((uNewCs & X86_SEL_RPL) < IEM_GET_CPL(pVCpu))
3556 {
3557 Log(("iret/64 %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, IEM_GET_CPL(pVCpu)));
3558 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3559 }
3560
3561 /* Present? */
3562 if (!DescCS.Legacy.Gen.u1Present)
3563 {
3564 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3565 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3566 }
3567
3568 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3569
3570 /* Read the SS descriptor. */
3571 IEMSELDESC DescSS;
3572 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3573 {
3574 if ( !DescCS.Legacy.Gen.u1Long
3575 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3576 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3577 {
3578 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3579 return iemRaiseGeneralProtectionFault0(pVCpu);
3580 }
3581 /* Make sure SS is sensible, marked as accessed etc. */
3582 iemMemFakeStackSelDesc(&DescSS, (uNewSs & X86_SEL_RPL));
3583 }
3584 else
3585 {
3586 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3587 if (rcStrict != VINF_SUCCESS)
3588 {
3589 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3590 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3591 return rcStrict;
3592 }
3593 }
3594
3595 /* Privilege checks. */
3596 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3597 {
3598 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3599 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3600 }
3601
3602 uint32_t cbLimitSs;
3603 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3604 cbLimitSs = UINT32_MAX;
3605 else
3606 {
3607 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3608 {
3609 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3610 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3611 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3612 }
3613
3614 /* Must be a writeable data segment descriptor. */
3615 if (!DescSS.Legacy.Gen.u1DescType)
3616 {
3617 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3618 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3619 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3620 }
3621 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3622 {
3623 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3624 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3625 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3626 }
3627
3628 /* Present? */
3629 if (!DescSS.Legacy.Gen.u1Present)
3630 {
3631 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3632 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3633 }
3634 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3635 }
3636
3637 /* Check EIP. */
3638 if (DescCS.Legacy.Gen.u1Long)
3639 {
3640 if (!IEM_IS_CANONICAL(uNewRip))
3641 {
3642 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3643 return iemRaiseNotCanonical(pVCpu);
3644 }
3645/** @todo check the location of this... Testcase. */
3646 if (RT_LIKELY(!DescCS.Legacy.Gen.u1DefBig))
3647 { /* likely */ }
3648 else
3649 {
3650 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> both L and D are set -> #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3651 return iemRaiseGeneralProtectionFault0(pVCpu);
3652 }
3653 }
3654 else
3655 {
3656 if (uNewRip > cbLimitCS)
3657 {
3658 Log(("iret/64 %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3659 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3660 /** @todo Which is it, \#GP(0) or \#GP(sel)? */
3661 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3662 }
3663 }
3664
3665 /*
3666 * Commit the changes, marking CS and SS accessed first since
3667 * that may fail.
3668 */
3669 /** @todo where exactly are these actually marked accessed by a real CPU? */
3670 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3671 {
3672 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3673 if (rcStrict != VINF_SUCCESS)
3674 return rcStrict;
3675 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3676 }
3677 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3678 {
3679 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3680 if (rcStrict != VINF_SUCCESS)
3681 return rcStrict;
3682 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3683 }
3684
3685 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3686 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3687 if (enmEffOpSize != IEMMODE_16BIT)
3688 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3689 if (IEM_GET_CPL(pVCpu) == 0)
3690 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3691 else if (IEM_GET_CPL(pVCpu) <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3692 fEFlagsMask |= X86_EFL_IF;
3693 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3694 fEFlagsNew &= ~fEFlagsMask;
3695 fEFlagsNew |= uNewFlags & fEFlagsMask;
3696#ifdef DBGFTRACE_ENABLED
3697 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/64/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3698 IEM_GET_CPL(pVCpu), uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3699#endif
3700
3701 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3702 pVCpu->cpum.GstCtx.rip = uNewRip;
3703 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3704 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3705 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3706 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3707 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3708 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3709 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3710 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3711 else
3712 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3713 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3714 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3715 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3716 {
3717 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3718 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3719 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3720 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3721 Log2(("iret/64 new SS: NULL\n"));
3722 }
3723 else
3724 {
3725 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3726 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3727 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3728 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3729 Log2(("iret/64 new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3730 }
3731
3732 if (IEM_GET_CPL(pVCpu) != uNewCpl)
3733 {
3734 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3735 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3736 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3737 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3738 }
3739
3740 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
3741
3742 /* Flush the prefetch buffer. */
3743 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr); /** @todo may light flush if the ring + mode doesn't change */
3744
3745/** @todo single stepping */
3746 return VINF_SUCCESS;
3747}
3748
3749
3750/**
3751 * Implements iret.
3752 *
3753 * @param enmEffOpSize The effective operand size.
3754 */
3755IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3756{
3757 bool fBlockingNmi = CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx);
3758
3759 if (!IEM_IS_IN_GUEST(pVCpu))
3760 { /* probable */ }
3761#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3762 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3763 {
3764 /*
3765 * Record whether NMI (or virtual-NMI) blocking is in effect during the execution
3766 * of this IRET instruction. We need to provide this information as part of some
3767 * VM-exits.
3768 *
3769 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3770 */
3771 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_VIRT_NMI))
3772 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking;
3773 else
3774 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3775
3776 /*
3777 * If "NMI exiting" is set, IRET does not affect blocking of NMIs.
3778 * See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3779 */
3780 if (IEM_VMX_IS_PINCTLS_SET(pVCpu, VMX_PIN_CTLS_NMI_EXIT))
3781 fBlockingNmi = false;
3782
3783 /* Clear virtual-NMI blocking, if any, before causing any further exceptions. */
3784 pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
3785 }
3786#endif
3787 /*
3788 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3789 * The NMI is still held pending (which I assume means blocking of further NMIs
3790 * is in effect).
3791 *
3792 * See AMD spec. 15.9 "Instruction Intercepts".
3793 * See AMD spec. 15.21.9 "NMI Support".
3794 */
3795 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3796 {
3797 Log(("iret: Guest intercept -> #VMEXIT\n"));
3798 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
3799 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3800 }
3801
3802 /*
3803 * Clear NMI blocking, if any, before causing any further exceptions.
3804 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3805 */
3806 if (fBlockingNmi)
3807 CPUMClearInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
3808
3809 /*
3810 * Call a mode specific worker.
3811 */
3812 VBOXSTRICTRC rcStrict;
3813 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3814 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3815 else
3816 {
3817 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3818 if (IEM_IS_64BIT_CODE(pVCpu))
3819 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3820 else
3821 rcStrict = IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3822 }
3823
3824#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3825 /*
3826 * Clear NMI unblocking IRET state with the completion of IRET.
3827 */
3828 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3829 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
3830#endif
3831 return rcStrict;
3832}
3833
3834
3835static void iemLoadallSetSelector(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
3836{
3837 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3838
3839 pHid->Sel = uSel;
3840 pHid->ValidSel = uSel;
3841 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3842}
3843
3844
3845static void iemLoadall286SetDescCache(PVMCPUCC pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3846{
3847 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3848
3849 /* The base is in the first three bytes. */
3850 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3851 /* The attributes are in the fourth byte. */
3852 pHid->Attr.u = pbMem[3];
3853 pHid->Attr.u &= ~(X86DESCATTR_L | X86DESCATTR_D); /* (just to be on the safe side) */
3854 /* The limit is in the last two bytes. */
3855 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3856}
3857
3858
3859/**
3860 * Implements 286 LOADALL (286 CPUs only).
3861 */
3862IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3863{
3864 NOREF(cbInstr);
3865
3866 /* Data is loaded from a buffer at 800h. No checks are done on the
3867 * validity of loaded state.
3868 *
3869 * LOADALL only loads the internal CPU state, it does not access any
3870 * GDT, LDT, or similar tables.
3871 */
3872
3873 if (IEM_GET_CPL(pVCpu) != 0)
3874 {
3875 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
3876 return iemRaiseGeneralProtectionFault0(pVCpu);
3877 }
3878
3879 uint8_t bUnmapInfo;
3880 uint8_t const *pbMem = NULL;
3881 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3882 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, &bUnmapInfo, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
3883 if (rcStrict != VINF_SUCCESS)
3884 return rcStrict;
3885
3886 /* The MSW is at offset 0x06. */
3887 uint16_t const *pau16Mem = (uint16_t const *)(pbMem + 0x06);
3888 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3889 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3890 uNewCr0 |= *pau16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3891 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3892
3893 CPUMSetGuestCR0(pVCpu, uNewCr0);
3894 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3895
3896 /* Inform PGM if mode changed. */
3897 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3898 {
3899 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3900 AssertRCReturn(rc, rc);
3901 /* ignore informational status codes */
3902 }
3903 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
3904 false /* fForce */);
3905
3906 /* TR selector is at offset 0x16. */
3907 pau16Mem = (uint16_t const *)(pbMem + 0x16);
3908 pVCpu->cpum.GstCtx.tr.Sel = pau16Mem[0];
3909 pVCpu->cpum.GstCtx.tr.ValidSel = pau16Mem[0];
3910 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
3911
3912 /* Followed by FLAGS... */
3913 pVCpu->cpum.GstCtx.eflags.u = pau16Mem[1] | X86_EFL_1;
3914 pVCpu->cpum.GstCtx.ip = pau16Mem[2]; /* ...and IP. */
3915
3916 /* LDT is at offset 0x1C. */
3917 pau16Mem = (uint16_t const *)(pbMem + 0x1C);
3918 pVCpu->cpum.GstCtx.ldtr.Sel = pau16Mem[0];
3919 pVCpu->cpum.GstCtx.ldtr.ValidSel = pau16Mem[0];
3920 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3921
3922 /* Segment registers are at offset 0x1E. */
3923 pau16Mem = (uint16_t const *)(pbMem + 0x1E);
3924 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pau16Mem[0]);
3925 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pau16Mem[1]);
3926 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pau16Mem[2]);
3927 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pau16Mem[3]);
3928
3929 /* GPRs are at offset 0x26. */
3930 pau16Mem = (uint16_t const *)(pbMem + 0x26);
3931 pVCpu->cpum.GstCtx.di = pau16Mem[0];
3932 pVCpu->cpum.GstCtx.si = pau16Mem[1];
3933 pVCpu->cpum.GstCtx.bp = pau16Mem[2];
3934 pVCpu->cpum.GstCtx.sp = pau16Mem[3];
3935 pVCpu->cpum.GstCtx.bx = pau16Mem[4];
3936 pVCpu->cpum.GstCtx.dx = pau16Mem[5];
3937 pVCpu->cpum.GstCtx.cx = pau16Mem[6];
3938 pVCpu->cpum.GstCtx.ax = pau16Mem[7];
3939
3940 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
3941 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
3942 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
3943 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
3944 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
3945
3946 /* GDTR contents are at offset 0x4E, 6 bytes. */
3947 uint8_t const *pau8Mem = pbMem + 0x4E;
3948 /* NB: Fourth byte "should be zero"; we are ignoring it. */
3949 RTGCPHYS GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
3950 uint16_t cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
3951 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
3952
3953 /* IDTR contents are at offset 0x5A, 6 bytes. */
3954 pau8Mem = pbMem + 0x5A;
3955 GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
3956 cbLimit = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
3957 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
3958
3959 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
3960 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
3961 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
3962 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
3963 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3964 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
3965
3966 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
3967 if (rcStrict != VINF_SUCCESS)
3968 return rcStrict;
3969
3970 /*
3971 * The CPL may change and protected mode may change enabled. It is taken
3972 * from the "DPL fields of the SS and CS descriptor caches" but there is no
3973 * word as to what happens if those are not identical (probably bad things).
3974 */
3975 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
3976 Assert(IEM_IS_16BIT_CODE(pVCpu));
3977
3978 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
3979
3980 /* Flush the prefetch buffer. */
3981 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
3982
3983/** @todo single stepping */
3984 return rcStrict;
3985}
3986
3987
3988/**
3989 * Implements SYSCALL (AMD and Intel64).
3990 */
3991IEM_CIMPL_DEF_0(iemCImpl_syscall)
3992{
3993
3994
3995 /*
3996 * Check preconditions.
3997 *
3998 * Note that CPUs described in the documentation may load a few odd values
3999 * into CS and SS than we allow here. This has yet to be checked on real
4000 * hardware.
4001 */
4002 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4003 {
4004 Log(("syscall: Not enabled in EFER -> #UD\n"));
4005 return iemRaiseUndefinedOpcode(pVCpu);
4006 }
4007 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4008 {
4009 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4010 return iemRaiseGeneralProtectionFault0(pVCpu);
4011 }
4012 if ( IEM_IS_GUEST_CPU_INTEL(pVCpu)
4013 && !IEM_IS_64BIT_CODE(pVCpu)) //&& !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4014 {
4015 Log(("syscall: Only available in 64-bit mode on intel -> #UD\n"));
4016 return iemRaiseUndefinedOpcode(pVCpu);
4017 }
4018
4019 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4020
4021 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4022 /** @todo what about LDT selectors? Shouldn't matter, really. */
4023 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4024 uint16_t uNewSs = uNewCs + 8;
4025 if (uNewCs == 0 || uNewSs == 0)
4026 {
4027 /** @todo Neither Intel nor AMD document this check. */
4028 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4029 return iemRaiseGeneralProtectionFault0(pVCpu);
4030 }
4031
4032 /*
4033 * Hack alert! Convert incoming debug events to slient on Intel.
4034 * See the dbg+inhibit+ringxfer test in bs3-cpu-weird-1.
4035 */
4036 if ( !(pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_DBG_HIT_DRX_MASK_NONSILENT)
4037 || !IEM_IS_GUEST_CPU_INTEL(pVCpu))
4038 { /* ignore */ }
4039 else
4040 {
4041 Log(("iemCImpl_syscall: Converting pending debug events to a silent one (intel hack)\n",
4042 pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_DBG_HIT_DRX_MASK));
4043 pVCpu->cpum.GstCtx.eflags.uBoth = (pVCpu->cpum.GstCtx.eflags.uBoth & ~CPUMCTX_DBG_HIT_DRX_MASK)
4044 | CPUMCTX_DBG_HIT_DRX_SILENT;
4045 }
4046
4047 /*
4048 * Long mode and legacy mode differs.
4049 */
4050 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4051 {
4052 uint64_t uNewRip = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4053
4054 /* This test isn't in the docs, but I'm not trusting the guys writing
4055 the MSRs to have validated the values as canonical like they should. */
4056 if (!IEM_IS_CANONICAL(uNewRip))
4057 {
4058 /** @todo Intel claims this can't happen because IA32_LSTAR MSR can't be written with non-canonical address. */
4059 Log(("syscall: New RIP not canonical -> #UD\n"));
4060 return iemRaiseUndefinedOpcode(pVCpu);
4061 }
4062
4063 /*
4064 * Commit it.
4065 */
4066 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4067 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4068 pVCpu->cpum.GstCtx.rip = uNewRip;
4069
4070 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4071 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4072 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4073 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4074
4075 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4076 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4077
4078 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4079 | IEM_F_MODE_X86_64BIT;
4080 }
4081 else
4082 {
4083 /*
4084 * Commit it.
4085 */
4086 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4087 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4088 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4089 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4090
4091 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4092 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4093
4094 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4095 | IEM_F_MODE_X86_32BIT_PROT
4096 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4097 }
4098 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4099 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4100 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4101 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4102 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4103
4104 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4105 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4106 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4107 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4108 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4109
4110 /* Flush the prefetch buffer. */
4111 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4112
4113 /*
4114 * Handle debug events.
4115 * If TF isn't masked, we're supposed to raise a single step #DB.
4116 */
4117 return iemRegFinishClearingRF(pVCpu, VINF_SUCCESS);
4118}
4119
4120
4121/**
4122 * Implements SYSRET (AMD and Intel64).
4123 *
4124 * @param enmEffOpSize The effective operand size.
4125 */
4126IEM_CIMPL_DEF_1(iemCImpl_sysret, IEMMODE, enmEffOpSize)
4127
4128{
4129 RT_NOREF_PV(cbInstr);
4130
4131 /*
4132 * Check preconditions.
4133 *
4134 * Note that CPUs described in the documentation may load a few odd values
4135 * into CS and SS than we allow here. This has yet to be checked on real
4136 * hardware.
4137 */
4138 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4139 {
4140 Log(("sysret: Not enabled in EFER -> #UD\n"));
4141 return iemRaiseUndefinedOpcode(pVCpu);
4142 }
4143 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4144 {
4145 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4146 return iemRaiseUndefinedOpcode(pVCpu);
4147 }
4148 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4149 {
4150 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4151 return iemRaiseGeneralProtectionFault0(pVCpu);
4152 }
4153 if (IEM_GET_CPL(pVCpu) != 0)
4154 {
4155 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4156 return iemRaiseGeneralProtectionFault0(pVCpu);
4157 }
4158
4159 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4160
4161 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4162 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4163 uint16_t uNewSs = uNewCs + 8;
4164 if (enmEffOpSize == IEMMODE_64BIT)
4165 uNewCs += 16;
4166 if (uNewCs == 0 || uNewSs == 0)
4167 {
4168 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4169 return iemRaiseGeneralProtectionFault0(pVCpu);
4170 }
4171
4172 /*
4173 * Commit it.
4174 */
4175 bool f32Bit = true;
4176 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4177 {
4178 if (enmEffOpSize == IEMMODE_64BIT)
4179 {
4180 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4181 /* Note! We disregard intel manual regarding the RCX canonical
4182 check, ask intel+xen why AMD doesn't do it. */
4183 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4184 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4185 | (3 << X86DESCATTR_DPL_SHIFT);
4186 f32Bit = false;
4187 }
4188 else
4189 {
4190 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4191 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4192 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4193 | (3 << X86DESCATTR_DPL_SHIFT);
4194 }
4195 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4196 * what it really ignores. RF and VM are hinted at being zero, by AMD.
4197 * Intel says: RFLAGS := (R11 & 3C7FD7H) | 2; */
4198 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4199 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_RA1_MASK;
4200 }
4201 else
4202 {
4203 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4204 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4205 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4206 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4207 | (3 << X86DESCATTR_DPL_SHIFT);
4208 }
4209 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4210 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4211 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4212 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4213 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4214
4215 /* The SS hidden bits remains unchanged says AMD, we presume they set DPL to 3.
4216 Intel (and presuably VIA) OTOH sets loads valid ring-3 values it seems, see
4217 X86_BUG_SYSRET_SS_ATTRS in linux 5.3. */
4218 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4219 {
4220 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u | (3 << X86DESCATTR_DPL_SHIFT) ));
4221 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4222 }
4223 else
4224 {
4225 Log(("sysret: ss:rsp=%04x:%08RX64 attr=%x -> %04x:%08RX64 attr=%#x\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, pVCpu->cpum.GstCtx.ss.Attr.u, uNewSs | 3, pVCpu->cpum.GstCtx.rsp, X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT) ));
4226 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC
4227 | (3 << X86DESCATTR_DPL_SHIFT);
4228 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4229 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4230 }
4231 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4232 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4233 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4234 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4235 * on sysret on AMD and not on intel. */
4236
4237 if (!f32Bit)
4238 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4239 | (3 << IEM_F_X86_CPL_SHIFT)
4240 | IEM_F_MODE_X86_64BIT
4241 | iemCalcExecAcFlag(pVCpu);
4242 else
4243 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4244 | (3 << IEM_F_X86_CPL_SHIFT)
4245 | IEM_F_MODE_X86_32BIT_PROT
4246 /** @todo sort out the SS.BASE/LIM/ATTR claim by AMD and maybe we can switch to
4247 * iemCalc32BitFlatIndicatorDsEs and move this up into the above branch. */
4248 | iemCalc32BitFlatIndicator(pVCpu)
4249 | iemCalcExecAcFlag(pVCpu);
4250
4251 /* Flush the prefetch buffer. */
4252 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4253
4254/** @todo single step */
4255 return VINF_SUCCESS;
4256}
4257
4258
4259/**
4260 * Implements SYSENTER (Intel, 32-bit AMD).
4261 */
4262IEM_CIMPL_DEF_0(iemCImpl_sysenter)
4263{
4264 RT_NOREF(cbInstr);
4265
4266 /*
4267 * Check preconditions.
4268 *
4269 * Note that CPUs described in the documentation may load a few odd values
4270 * into CS and SS than we allow here. This has yet to be checked on real
4271 * hardware.
4272 */
4273 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4274 {
4275 Log(("sysenter: not supported -=> #UD\n"));
4276 return iemRaiseUndefinedOpcode(pVCpu);
4277 }
4278 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4279 {
4280 Log(("sysenter: Protected or long mode is required -> #GP(0)\n"));
4281 return iemRaiseGeneralProtectionFault0(pVCpu);
4282 }
4283 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4284 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4285 {
4286 Log(("sysenter: Only available in protected mode on AMD -> #UD\n"));
4287 return iemRaiseUndefinedOpcode(pVCpu);
4288 }
4289 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4290 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4291 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4292 {
4293 Log(("sysenter: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4294 return iemRaiseGeneralProtectionFault0(pVCpu);
4295 }
4296
4297 /* This test isn't in the docs, it's just a safeguard against missing
4298 canonical checks when writing the registers. */
4299 if (RT_LIKELY( !fIsLongMode
4300 || ( IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.eip)
4301 && IEM_IS_CANONICAL(pVCpu->cpum.GstCtx.SysEnter.esp))))
4302 { /* likely */ }
4303 else
4304 {
4305 Log(("sysenter: SYSENTER_EIP = %#RX64 or/and SYSENTER_ESP = %#RX64 not canonical -> #GP(0)\n",
4306 pVCpu->cpum.GstCtx.SysEnter.eip, pVCpu->cpum.GstCtx.SysEnter.esp));
4307 return iemRaiseUndefinedOpcode(pVCpu);
4308 }
4309
4310/** @todo Test: Sysenter from ring-0, ring-1 and ring-2. */
4311
4312 /*
4313 * Update registers and commit.
4314 */
4315 if (fIsLongMode)
4316 {
4317 Log(("sysenter: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4318 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, pVCpu->cpum.GstCtx.SysEnter.eip));
4319 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.SysEnter.eip;
4320 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.SysEnter.esp;
4321 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4322 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4323 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4324 | IEM_F_MODE_X86_64BIT;
4325 }
4326 else
4327 {
4328 Log(("sysenter: %04x:%08RX32 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, (uint32_t)pVCpu->cpum.GstCtx.rip,
4329 pVCpu->cpum.GstCtx.rflags.u, uNewCs & X86_SEL_MASK_OFF_RPL, (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip));
4330 pVCpu->cpum.GstCtx.rip = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.eip;
4331 pVCpu->cpum.GstCtx.rsp = (uint32_t)pVCpu->cpum.GstCtx.SysEnter.esp;
4332 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4333 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC;
4334 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK | IEM_F_X86_AC))
4335 | IEM_F_MODE_X86_32BIT_PROT
4336 | iemCalc32BitFlatIndicatorEsDs(pVCpu);
4337 }
4338 pVCpu->cpum.GstCtx.cs.Sel = uNewCs & X86_SEL_MASK_OFF_RPL;
4339 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs & X86_SEL_MASK_OFF_RPL;
4340 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4341 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4342 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4343
4344 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4345 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs & X86_SEL_MASK_OFF_RPL) + 8;
4346 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4347 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4348 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4349 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC;
4350 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4351
4352 pVCpu->cpum.GstCtx.rflags.Bits.u1IF = 0;
4353 pVCpu->cpum.GstCtx.rflags.Bits.u1VM = 0;
4354 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4355
4356 /* Flush the prefetch buffer. */
4357 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4358
4359/** @todo single stepping */
4360 return VINF_SUCCESS;
4361}
4362
4363
4364/**
4365 * Implements SYSEXIT (Intel, 32-bit AMD).
4366 *
4367 * @param enmEffOpSize The effective operand size.
4368 */
4369IEM_CIMPL_DEF_1(iemCImpl_sysexit, IEMMODE, enmEffOpSize)
4370{
4371 RT_NOREF(cbInstr);
4372
4373 /*
4374 * Check preconditions.
4375 *
4376 * Note that CPUs described in the documentation may load a few odd values
4377 * into CS and SS than we allow here. This has yet to be checked on real
4378 * hardware.
4379 */
4380 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSysEnter)
4381 {
4382 Log(("sysexit: not supported -=> #UD\n"));
4383 return iemRaiseUndefinedOpcode(pVCpu);
4384 }
4385 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4386 {
4387 Log(("sysexit: Protected or long mode is required -> #GP(0)\n"));
4388 return iemRaiseGeneralProtectionFault0(pVCpu);
4389 }
4390 bool fIsLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
4391 if (IEM_IS_GUEST_CPU_AMD(pVCpu) && fIsLongMode)
4392 {
4393 Log(("sysexit: Only available in protected mode on AMD -> #UD\n"));
4394 return iemRaiseUndefinedOpcode(pVCpu);
4395 }
4396 if (IEM_GET_CPL(pVCpu) != 0)
4397 {
4398 Log(("sysexit: CPL(=%u) != 0 -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
4399 return iemRaiseGeneralProtectionFault0(pVCpu);
4400 }
4401 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSENTER_MSRS);
4402 uint16_t uNewCs = pVCpu->cpum.GstCtx.SysEnter.cs;
4403 if ((uNewCs & X86_SEL_MASK_OFF_RPL) == 0)
4404 {
4405 Log(("sysexit: SYSENTER_CS = %#x -> #GP(0)\n", uNewCs));
4406 return iemRaiseGeneralProtectionFault0(pVCpu);
4407 }
4408
4409 /*
4410 * Update registers and commit.
4411 */
4412 if (enmEffOpSize == IEMMODE_64BIT)
4413 {
4414 Log(("sysexit: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4415 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 32, pVCpu->cpum.GstCtx.rcx));
4416 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rdx;
4417 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.rcx;
4418 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_L | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4419 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4420 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 32;
4421 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 32;
4422 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 40;
4423 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 40;
4424
4425 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4426 | (3 << IEM_F_X86_CPL_SHIFT)
4427 | IEM_F_MODE_X86_64BIT
4428 | iemCalcExecAcFlag(pVCpu);
4429 }
4430 else
4431 {
4432 Log(("sysexit: %04x:%08RX64 [efl=%#llx] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
4433 pVCpu->cpum.GstCtx.rflags.u, (uNewCs | 3) + 16, (uint32_t)pVCpu->cpum.GstCtx.edx));
4434 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.edx;
4435 pVCpu->cpum.GstCtx.rsp = pVCpu->cpum.GstCtx.ecx;
4436 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4437 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_ER_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4438 pVCpu->cpum.GstCtx.cs.Sel = (uNewCs | 3) + 16;
4439 pVCpu->cpum.GstCtx.cs.ValidSel = (uNewCs | 3) + 16;
4440 pVCpu->cpum.GstCtx.ss.Sel = (uNewCs | 3) + 24;
4441 pVCpu->cpum.GstCtx.ss.ValidSel = (uNewCs | 3) + 24;
4442
4443 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~(IEM_F_MODE_MASK | IEM_F_X86_CPL_MASK))
4444 | (3 << IEM_F_X86_CPL_SHIFT)
4445 | IEM_F_MODE_X86_32BIT_PROT
4446 | iemCalc32BitFlatIndicatorEsDs(pVCpu)
4447 | iemCalcExecAcFlag(pVCpu);
4448 }
4449 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4450 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4451 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4452
4453 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4454 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4455 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_D | X86DESCATTR_G | X86DESCATTR_P | X86DESCATTR_DT
4456 | X86DESCATTR_LIMIT_HIGH | X86_SEL_TYPE_RW_ACC | (3 << X86DESCATTR_DPL_SHIFT);
4457 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4458 pVCpu->cpum.GstCtx.rflags.Bits.u1RF = 0;
4459
4460/** @todo single stepping */
4461
4462 /* Flush the prefetch buffer. */
4463 IEM_FLUSH_PREFETCH_HEAVY(pVCpu, cbInstr);
4464
4465 return VINF_SUCCESS;
4466}
4467
4468
4469/**
4470 * Completes a MOV SReg,XXX or POP SReg instruction.
4471 *
4472 * When not modifying SS or when we're already in an interrupt shadow we
4473 * can update RIP and finish the instruction the normal way.
4474 *
4475 * Otherwise, the MOV/POP SS interrupt shadow that we now enable will block
4476 * both TF and DBx events. The TF will be ignored while the DBx ones will
4477 * be delayed till the next instruction boundrary. For more details see
4478 * @sdmv3{077,200,6.8.3,Masking Exceptions and Interrupts When Switching Stacks}.
4479 */
4480DECLINLINE(VBOXSTRICTRC) iemCImpl_LoadSRegFinish(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iSegReg)
4481{
4482 if (iSegReg != X86_SREG_SS || CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
4483 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4484
4485 iemRegAddToRip(pVCpu, cbInstr);
4486 pVCpu->cpum.GstCtx.eflags.uBoth &= ~X86_EFL_RF; /* Shadow int isn't set and DRx is delayed, so only clear RF. */
4487 CPUMSetInInterruptShadowSs(&pVCpu->cpum.GstCtx);
4488
4489 return VINF_SUCCESS;
4490}
4491
4492
4493/**
4494 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4495 *
4496 * @param pVCpu The cross context virtual CPU structure of the calling
4497 * thread.
4498 * @param iSegReg The segment register number (valid).
4499 * @param uSel The new selector value.
4500 */
4501static VBOXSTRICTRC iemCImpl_LoadSRegWorker(PVMCPUCC pVCpu, uint8_t iSegReg, uint16_t uSel)
4502{
4503 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4504 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4505 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4506
4507 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4508
4509 /*
4510 * Real mode and V8086 mode are easy.
4511 */
4512 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4513 {
4514 *pSel = uSel;
4515 pHid->u64Base = (uint32_t)uSel << 4;
4516 pHid->ValidSel = uSel;
4517 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4518#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4519 /** @todo Does the CPU actually load limits and attributes in the
4520 * real/V8086 mode segment load case? It doesn't for CS in far
4521 * jumps... Affects unreal mode. */
4522 pHid->u32Limit = 0xffff;
4523 pHid->Attr.u = 0;
4524 pHid->Attr.n.u1Present = 1;
4525 pHid->Attr.n.u1DescType = 1;
4526 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4527 ? X86_SEL_TYPE_RW
4528 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4529#endif
4530
4531 /* Update the FLAT 32-bit mode flag, if we're in 32-bit unreal mode (unlikely): */
4532 if (RT_LIKELY(!IEM_IS_32BIT_CODE(pVCpu)))
4533 { /* likely */ }
4534 else if (uSel != 0)
4535 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4536 else
4537 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4538 | iemCalc32BitFlatIndicator(pVCpu);
4539 }
4540 /*
4541 * Protected / long mode - null segment.
4542 *
4543 * Check if it's a null segment selector value first, that's OK for DS, ES,
4544 * FS and GS. If not null, then we have to load and parse the descriptor.
4545 */
4546 else if (!(uSel & X86_SEL_MASK_OFF_RPL))
4547 {
4548 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4549 if (iSegReg == X86_SREG_SS)
4550 {
4551 /* In 64-bit kernel mode, the stack can be 0 because of the way
4552 interrupts are dispatched. AMD seems to have a slighly more
4553 relaxed relationship to SS.RPL than intel does. */
4554 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4555 if ( !IEM_IS_64BIT_CODE(pVCpu)
4556 || IEM_GET_CPL(pVCpu) > 2
4557 || ( uSel != IEM_GET_CPL(pVCpu)
4558 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4559 {
4560 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4561 return iemRaiseGeneralProtectionFault0(pVCpu);
4562 }
4563 }
4564
4565 *pSel = uSel; /* Not RPL, remember :-) */
4566 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4567 if (iSegReg == X86_SREG_SS)
4568 pHid->Attr.u |= IEM_GET_CPL(pVCpu) << X86DESCATTR_DPL_SHIFT;
4569
4570 /* This will affect the FLAT 32-bit mode flag: */
4571 if ( iSegReg < X86_SREG_FS
4572 && IEM_IS_32BIT_CODE(pVCpu))
4573 pVCpu->iem.s.fExec &= ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK;
4574 }
4575 /*
4576 * Protected / long mode.
4577 */
4578 else
4579 {
4580 /* Fetch the descriptor. */
4581 IEMSELDESC Desc;
4582 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4583 if (rcStrict != VINF_SUCCESS)
4584 return rcStrict;
4585
4586 /* Check GPs first. */
4587 if (!Desc.Legacy.Gen.u1DescType)
4588 {
4589 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4590 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4591 }
4592 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4593 {
4594 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4595 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4596 {
4597 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4598 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4599 }
4600 if ((uSel & X86_SEL_RPL) != IEM_GET_CPL(pVCpu))
4601 {
4602 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, IEM_GET_CPL(pVCpu)));
4603 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4604 }
4605 if (Desc.Legacy.Gen.u2Dpl != IEM_GET_CPL(pVCpu))
4606 {
4607 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, IEM_GET_CPL(pVCpu)));
4608 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4609 }
4610 }
4611 else
4612 {
4613 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4614 {
4615 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4616 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4617 }
4618 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4619 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4620 {
4621#if 0 /* this is what intel says. */
4622 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4623 && IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4624 {
4625 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4626 iSegReg, uSel, (uSel & X86_SEL_RPL), IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4627 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4628 }
4629#else /* this is what makes more sense. */
4630 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4631 {
4632 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4633 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4634 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4635 }
4636 if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4637 {
4638 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4639 iSegReg, uSel, IEM_GET_CPL(pVCpu), Desc.Legacy.Gen.u2Dpl));
4640 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4641 }
4642#endif
4643 }
4644 }
4645
4646 /* Is it there? */
4647 if (!Desc.Legacy.Gen.u1Present)
4648 {
4649 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4650 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4651 }
4652
4653 /* The base and limit. */
4654 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4655 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4656
4657 /*
4658 * Ok, everything checked out fine. Now set the accessed bit before
4659 * committing the result into the registers.
4660 */
4661 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4662 {
4663 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4664 if (rcStrict != VINF_SUCCESS)
4665 return rcStrict;
4666 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4667 }
4668
4669 /* commit */
4670 *pSel = uSel;
4671 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4672 pHid->u32Limit = cbLimit;
4673 pHid->u64Base = u64Base;
4674 pHid->ValidSel = uSel;
4675 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4676
4677 /** @todo check if the hidden bits are loaded correctly for 64-bit
4678 * mode. */
4679
4680 /* This will affect the FLAT 32-bit mode flag: */
4681 if ( iSegReg < X86_SREG_FS
4682 && IEM_IS_32BIT_CODE(pVCpu))
4683 pVCpu->iem.s.fExec = (pVCpu->iem.s.fExec & ~IEM_F_MODE_X86_FLAT_OR_PRE_386_MASK)
4684 | iemCalc32BitFlatIndicator(pVCpu);
4685 }
4686
4687 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4688 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4689 return VINF_SUCCESS;
4690}
4691
4692
4693/**
4694 * Implements 'mov SReg, r/m'.
4695 *
4696 * @param iSegReg The segment register number (valid).
4697 * @param uSel The new selector value.
4698 */
4699IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4700{
4701 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4702 if (rcStrict == VINF_SUCCESS)
4703 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4704 return rcStrict;
4705}
4706
4707
4708/**
4709 * Implements 'pop SReg'.
4710 *
4711 * @param iSegReg The segment register number (valid).
4712 * @param enmEffOpSize The efficient operand size (valid).
4713 */
4714IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4715{
4716 VBOXSTRICTRC rcStrict;
4717
4718 /*
4719 * Read the selector off the stack and join paths with mov ss, reg.
4720 */
4721 RTUINT64U TmpRsp;
4722 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4723 switch (enmEffOpSize)
4724 {
4725 case IEMMODE_16BIT:
4726 {
4727 uint16_t uSel;
4728 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4729 if (rcStrict == VINF_SUCCESS)
4730 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4731 break;
4732 }
4733
4734 case IEMMODE_32BIT:
4735 {
4736 /* Modern Intel CPU only does a WORD sized access here, both as
4737 segmentation and paging is concerned. So, we have to emulate
4738 this to make bs3-cpu-weird-1 happy. */
4739 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
4740 {
4741 /* We don't have flexible enough stack primitives here, so just
4742 do a word pop and add two bytes to SP/RSP on success. */
4743 uint16_t uSel;
4744 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4745 if (rcStrict == VINF_SUCCESS)
4746 {
4747 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint32_t) - sizeof(uint16_t));
4748 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4749 }
4750 }
4751 else
4752 {
4753 uint32_t u32Value;
4754 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4755 if (rcStrict == VINF_SUCCESS)
4756 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u32Value);
4757 }
4758 break;
4759 }
4760
4761 case IEMMODE_64BIT:
4762 {
4763 /* Like for the 32-bit case above, intel only does a WORD access. */
4764 if (IEM_IS_GUEST_CPU_INTEL(pVCpu))
4765 {
4766 uint16_t uSel;
4767 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4768 if (rcStrict == VINF_SUCCESS)
4769 {
4770 iemRegAddToRspEx(pVCpu, &TmpRsp, sizeof(uint64_t) - sizeof(uint16_t));
4771 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4772 }
4773 }
4774 else
4775 {
4776 uint64_t u64Value;
4777 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4778 if (rcStrict == VINF_SUCCESS)
4779 rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, (uint16_t)u64Value);
4780 }
4781 break;
4782 }
4783 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4784 }
4785
4786 /*
4787 * If the load succeeded, commit the stack change and finish the instruction.
4788 */
4789 if (rcStrict == VINF_SUCCESS)
4790 {
4791 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4792 rcStrict = iemCImpl_LoadSRegFinish(pVCpu, cbInstr, iSegReg);
4793 }
4794
4795 return rcStrict;
4796}
4797
4798
4799/**
4800 * Implements lgs, lfs, les, lds & lss.
4801 */
4802IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg, uint16_t, uSel, uint64_t, offSeg, uint8_t, iSegReg, uint8_t, iGReg, IEMMODE, enmEffOpSize)
4803{
4804 /*
4805 * Use iemCImpl_LoadSRegWorker to do the tricky segment register loading.
4806 */
4807 /** @todo verify and test that mov, pop and lXs works the segment
4808 * register loading in the exact same way. */
4809 VBOXSTRICTRC rcStrict = iemCImpl_LoadSRegWorker(pVCpu, iSegReg, uSel);
4810 if (rcStrict == VINF_SUCCESS)
4811 {
4812 switch (enmEffOpSize)
4813 {
4814 case IEMMODE_16BIT:
4815 iemGRegStoreU16(pVCpu, iGReg, offSeg);
4816 break;
4817 case IEMMODE_32BIT:
4818 case IEMMODE_64BIT:
4819 iemGRegStoreU64(pVCpu, iGReg, offSeg);
4820 break;
4821 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4822 }
4823 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4824 }
4825 return rcStrict;
4826}
4827
4828
4829/**
4830 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4831 *
4832 * @retval VINF_SUCCESS on success.
4833 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4834 * @retval iemMemFetchSysU64 return value.
4835 *
4836 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4837 * @param uSel The selector value.
4838 * @param fAllowSysDesc Whether system descriptors are OK or not.
4839 * @param pDesc Where to return the descriptor on success.
4840 */
4841static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPUCC pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4842{
4843 pDesc->Long.au64[0] = 0;
4844 pDesc->Long.au64[1] = 0;
4845
4846 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4847 return VINF_IEM_SELECTOR_NOT_OK;
4848
4849 /* Within the table limits? */
4850 RTGCPTR GCPtrBase;
4851 if (uSel & X86_SEL_LDT)
4852 {
4853 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4854 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4855 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4856 return VINF_IEM_SELECTOR_NOT_OK;
4857 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4858 }
4859 else
4860 {
4861 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4862 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4863 return VINF_IEM_SELECTOR_NOT_OK;
4864 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4865 }
4866
4867 /* Fetch the descriptor. */
4868 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4869 if (rcStrict != VINF_SUCCESS)
4870 return rcStrict;
4871 if (!pDesc->Legacy.Gen.u1DescType)
4872 {
4873 if (!fAllowSysDesc)
4874 return VINF_IEM_SELECTOR_NOT_OK;
4875 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4876 {
4877 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4878 if (rcStrict != VINF_SUCCESS)
4879 return rcStrict;
4880 }
4881
4882 }
4883
4884 return VINF_SUCCESS;
4885}
4886
4887
4888/**
4889 * Implements verr (fWrite = false) and verw (fWrite = true).
4890 */
4891IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4892{
4893 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4894
4895 /** @todo figure whether the accessed bit is set or not. */
4896
4897 bool fAccessible = true;
4898 IEMSELDESC Desc;
4899 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4900 if (rcStrict == VINF_SUCCESS)
4901 {
4902 /* Check the descriptor, order doesn't matter much here. */
4903 if ( !Desc.Legacy.Gen.u1DescType
4904 || !Desc.Legacy.Gen.u1Present)
4905 fAccessible = false;
4906 else
4907 {
4908 if ( fWrite
4909 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4910 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4911 fAccessible = false;
4912
4913 /** @todo testcase for the conforming behavior. */
4914 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4915 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4916 {
4917 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4918 fAccessible = false;
4919 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
4920 fAccessible = false;
4921 }
4922 }
4923
4924 }
4925 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4926 fAccessible = false;
4927 else
4928 return rcStrict;
4929
4930 /* commit */
4931 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4932
4933 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
4934}
4935
4936
4937/**
4938 * Implements LAR and LSL with 64-bit operand size.
4939 *
4940 * @returns VINF_SUCCESS.
4941 * @param pu64Dst Pointer to the destination register.
4942 * @param uSel The selector to load details for.
4943 * @param fIsLar true = LAR, false = LSL.
4944 */
4945IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4946{
4947 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4948
4949 /** @todo figure whether the accessed bit is set or not. */
4950
4951 bool fDescOk = true;
4952 IEMSELDESC Desc;
4953 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4954 if (rcStrict == VINF_SUCCESS)
4955 {
4956 /*
4957 * Check the descriptor type.
4958 */
4959 if (!Desc.Legacy.Gen.u1DescType)
4960 {
4961 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4962 {
4963 if (Desc.Long.Gen.u5Zeros)
4964 fDescOk = false;
4965 else
4966 switch (Desc.Long.Gen.u4Type)
4967 {
4968 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4969 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4970 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4971 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4972 break;
4973 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4974 fDescOk = fIsLar;
4975 break;
4976 default:
4977 fDescOk = false;
4978 break;
4979 }
4980 }
4981 else
4982 {
4983 switch (Desc.Long.Gen.u4Type)
4984 {
4985 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4986 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4987 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4988 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4989 case X86_SEL_TYPE_SYS_LDT:
4990 break;
4991 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4992 case X86_SEL_TYPE_SYS_TASK_GATE:
4993 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4994 fDescOk = fIsLar;
4995 break;
4996 default:
4997 fDescOk = false;
4998 break;
4999 }
5000 }
5001 }
5002 if (fDescOk)
5003 {
5004 /*
5005 * Check the RPL/DPL/CPL interaction..
5006 */
5007 /** @todo testcase for the conforming behavior. */
5008 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
5009 || !Desc.Legacy.Gen.u1DescType)
5010 {
5011 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
5012 fDescOk = false;
5013 else if (IEM_GET_CPL(pVCpu) > Desc.Legacy.Gen.u2Dpl)
5014 fDescOk = false;
5015 }
5016 }
5017
5018 if (fDescOk)
5019 {
5020 /*
5021 * All fine, start committing the result.
5022 */
5023 if (fIsLar)
5024 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
5025 else
5026 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
5027 }
5028
5029 }
5030 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
5031 fDescOk = false;
5032 else
5033 return rcStrict;
5034
5035 /* commit flags value and advance rip. */
5036 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
5037 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5038}
5039
5040
5041/**
5042 * Implements LAR and LSL with 16-bit operand size.
5043 *
5044 * @returns VINF_SUCCESS.
5045 * @param pu16Dst Pointer to the destination register.
5046 * @param uSel The selector to load details for.
5047 * @param fIsLar true = LAR, false = LSL.
5048 */
5049IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
5050{
5051 uint64_t u64TmpDst = *pu16Dst;
5052 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
5053 *pu16Dst = u64TmpDst;
5054 return VINF_SUCCESS;
5055}
5056
5057
5058/**
5059 * Implements lgdt.
5060 *
5061 * @param iEffSeg The segment of the new gdtr contents
5062 * @param GCPtrEffSrc The address of the new gdtr contents.
5063 * @param enmEffOpSize The effective operand size.
5064 */
5065IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5066{
5067 if (IEM_GET_CPL(pVCpu) != 0)
5068 return iemRaiseGeneralProtectionFault0(pVCpu);
5069 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5070
5071 if (!IEM_IS_IN_GUEST(pVCpu))
5072 { /* probable */ }
5073 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5074 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5075 {
5076 Log(("lgdt: Guest intercept -> VM-exit\n"));
5077 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
5078 }
5079 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
5080 {
5081 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
5082 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5083 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5084 }
5085
5086 /*
5087 * Fetch the limit and base address.
5088 */
5089 uint16_t cbLimit;
5090 RTGCPTR GCPtrBase;
5091 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5092 if (rcStrict == VINF_SUCCESS)
5093 {
5094 if ( !IEM_IS_64BIT_CODE(pVCpu)
5095 || X86_IS_CANONICAL(GCPtrBase))
5096 {
5097 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
5098 if (rcStrict == VINF_SUCCESS)
5099 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5100 }
5101 else
5102 {
5103 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5104 return iemRaiseGeneralProtectionFault0(pVCpu);
5105 }
5106 }
5107 return rcStrict;
5108}
5109
5110
5111/**
5112 * Implements sgdt.
5113 *
5114 * @param iEffSeg The segment where to store the gdtr content.
5115 * @param GCPtrEffDst The address where to store the gdtr content.
5116 */
5117IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5118{
5119 /*
5120 * Join paths with sidt.
5121 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5122 * you really must know.
5123 */
5124 if (!IEM_IS_IN_GUEST(pVCpu))
5125 { /* probable */ }
5126 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5127 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5128 {
5129 Log(("sgdt: Guest intercept -> VM-exit\n"));
5130 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
5131 }
5132 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
5133 {
5134 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
5135 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5136 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5137 }
5138
5139 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
5140 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
5141 if (rcStrict == VINF_SUCCESS)
5142 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5143 return rcStrict;
5144}
5145
5146
5147/**
5148 * Implements lidt.
5149 *
5150 * @param iEffSeg The segment of the new idtr contents
5151 * @param GCPtrEffSrc The address of the new idtr contents.
5152 * @param enmEffOpSize The effective operand size.
5153 */
5154IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
5155{
5156 if (IEM_GET_CPL(pVCpu) != 0)
5157 return iemRaiseGeneralProtectionFault0(pVCpu);
5158 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5159
5160 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
5161 { /* probable */ }
5162 else
5163 {
5164 Log(("lidt: Guest intercept -> #VMEXIT\n"));
5165 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5166 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5167 }
5168
5169 /*
5170 * Fetch the limit and base address.
5171 */
5172 uint16_t cbLimit;
5173 RTGCPTR GCPtrBase;
5174 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
5175 if (rcStrict == VINF_SUCCESS)
5176 {
5177 if ( !IEM_IS_64BIT_CODE(pVCpu)
5178 || X86_IS_CANONICAL(GCPtrBase))
5179 {
5180 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
5181 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5182 }
5183 else
5184 {
5185 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
5186 return iemRaiseGeneralProtectionFault0(pVCpu);
5187 }
5188 }
5189 return rcStrict;
5190}
5191
5192
5193/**
5194 * Implements sidt.
5195 *
5196 * @param iEffSeg The segment where to store the idtr content.
5197 * @param GCPtrEffDst The address where to store the idtr content.
5198 */
5199IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5200{
5201 /*
5202 * Join paths with sgdt.
5203 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
5204 * you really must know.
5205 */
5206 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
5207 { /* probable */ }
5208 else
5209 {
5210 Log(("sidt: Guest intercept -> #VMEXIT\n"));
5211 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5212 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5213 }
5214
5215 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
5216 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
5217 if (rcStrict == VINF_SUCCESS)
5218 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5219 return rcStrict;
5220}
5221
5222
5223/**
5224 * Implements lldt.
5225 *
5226 * @param uNewLdt The new LDT selector value.
5227 */
5228IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
5229{
5230 /*
5231 * Check preconditions.
5232 */
5233 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5234 {
5235 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
5236 return iemRaiseUndefinedOpcode(pVCpu);
5237 }
5238 if (IEM_GET_CPL(pVCpu) != 0)
5239 {
5240 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, IEM_GET_CPL(pVCpu)));
5241 return iemRaiseGeneralProtectionFault0(pVCpu);
5242 }
5243
5244 /* Nested-guest VMX intercept (SVM is after all checks). */
5245 /** @todo testcase: exit vs check order. */
5246 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5247 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5248 { /* probable */ }
5249 else
5250 {
5251 Log(("lldt: Guest intercept -> VM-exit\n"));
5252 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
5253 }
5254
5255 if (uNewLdt & X86_SEL_LDT)
5256 {
5257 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
5258 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
5259 }
5260
5261 /*
5262 * Now, loading a NULL selector is easy.
5263 */
5264 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
5265 {
5266 /* Nested-guest SVM intercept. */
5267 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5268 { /* probable */ }
5269 else
5270 {
5271 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5272 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5273 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5274 }
5275
5276 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5277 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5278 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5279 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5280 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5281 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5282 {
5283 /* AMD-V seems to leave the base and limit alone. */
5284 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5285 }
5286 else
5287 {
5288 /* VT-x (Intel 3960x) seems to be doing the following. */
5289 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5290 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5291 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5292 }
5293
5294 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5295 }
5296
5297 /*
5298 * Read the descriptor.
5299 */
5300 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5301 IEMSELDESC Desc;
5302 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5303 if (rcStrict != VINF_SUCCESS)
5304 return rcStrict;
5305
5306 /* Check GPs first. */
5307 if (Desc.Legacy.Gen.u1DescType)
5308 {
5309 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5310 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5311 }
5312 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5313 {
5314 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5315 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5316 }
5317 uint64_t u64Base;
5318 if (!IEM_IS_LONG_MODE(pVCpu))
5319 u64Base = X86DESC_BASE(&Desc.Legacy);
5320 else
5321 {
5322 if (Desc.Long.Gen.u5Zeros)
5323 {
5324 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5325 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5326 }
5327
5328 u64Base = X86DESC64_BASE(&Desc.Long);
5329 if (!IEM_IS_CANONICAL(u64Base))
5330 {
5331 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5332 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5333 }
5334 }
5335
5336 /* NP */
5337 if (!Desc.Legacy.Gen.u1Present)
5338 {
5339 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5340 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5341 }
5342
5343 /* Nested-guest SVM intercept. */
5344 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5345 { /* probable */ }
5346 else
5347 {
5348 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5349 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5350 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5351 }
5352
5353 /*
5354 * It checks out alright, update the registers.
5355 */
5356/** @todo check if the actual value is loaded or if the RPL is dropped */
5357 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5358 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5359 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5360 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5361 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5362 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5363
5364 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5365}
5366
5367
5368/**
5369 * Implements sldt GReg
5370 *
5371 * @param iGReg The general register to store the CRx value in.
5372 * @param enmEffOpSize The operand size.
5373 */
5374IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5375{
5376 if (!IEM_IS_IN_GUEST(pVCpu))
5377 { /* probable */ }
5378 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5379 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5380 {
5381 Log(("sldt: Guest intercept -> VM-exit\n"));
5382 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5383 }
5384 else
5385 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5386
5387 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5388 switch (enmEffOpSize)
5389 {
5390 case IEMMODE_16BIT:
5391 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5392 break;
5393 case IEMMODE_32BIT:
5394 case IEMMODE_64BIT:
5395 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.ldtr.Sel);
5396 break;
5397 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5398 }
5399 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5400}
5401
5402
5403/**
5404 * Implements sldt mem.
5405 *
5406 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5407 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5408 */
5409IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5410{
5411 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0, cbInstr);
5412
5413 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5414 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5415 if (rcStrict == VINF_SUCCESS)
5416 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5417 return rcStrict;
5418}
5419
5420
5421/**
5422 * Implements ltr.
5423 *
5424 * @param uNewTr The new TSS selector value.
5425 */
5426IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5427{
5428 /*
5429 * Check preconditions.
5430 */
5431 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5432 {
5433 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5434 return iemRaiseUndefinedOpcode(pVCpu);
5435 }
5436 if (IEM_GET_CPL(pVCpu) != 0)
5437 {
5438 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, IEM_GET_CPL(pVCpu)));
5439 return iemRaiseGeneralProtectionFault0(pVCpu);
5440 }
5441 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5442 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5443 { /* probable */ }
5444 else
5445 {
5446 Log(("ltr: Guest intercept -> VM-exit\n"));
5447 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5448 }
5449 if (uNewTr & X86_SEL_LDT)
5450 {
5451 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5452 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5453 }
5454 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5455 {
5456 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5457 return iemRaiseGeneralProtectionFault0(pVCpu);
5458 }
5459 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5460 { /* probable */ }
5461 else
5462 {
5463 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5464 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5465 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5466 }
5467
5468 /*
5469 * Read the descriptor.
5470 */
5471 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5472 IEMSELDESC Desc;
5473 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5474 if (rcStrict != VINF_SUCCESS)
5475 return rcStrict;
5476
5477 /* Check GPs first. */
5478 if (Desc.Legacy.Gen.u1DescType)
5479 {
5480 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5481 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5482 }
5483 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5484 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5485 || IEM_IS_LONG_MODE(pVCpu)) )
5486 {
5487 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5488 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5489 }
5490 uint64_t u64Base;
5491 if (!IEM_IS_LONG_MODE(pVCpu))
5492 u64Base = X86DESC_BASE(&Desc.Legacy);
5493 else
5494 {
5495 if (Desc.Long.Gen.u5Zeros)
5496 {
5497 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5498 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5499 }
5500
5501 u64Base = X86DESC64_BASE(&Desc.Long);
5502 if (!IEM_IS_CANONICAL(u64Base))
5503 {
5504 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5505 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5506 }
5507 }
5508
5509 /* NP */
5510 if (!Desc.Legacy.Gen.u1Present)
5511 {
5512 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5513 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5514 }
5515
5516 /*
5517 * Set it busy.
5518 * Note! Intel says this should lock down the whole descriptor, but we'll
5519 * restrict our selves to 32-bit for now due to lack of inline
5520 * assembly and such.
5521 */
5522 uint8_t bUnmapInfo;
5523 void *pvDesc;
5524 rcStrict = iemMemMap(pVCpu, &pvDesc, &bUnmapInfo, 8, UINT8_MAX,
5525 pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW, 0);
5526 if (rcStrict != VINF_SUCCESS)
5527 return rcStrict;
5528 switch ((uintptr_t)pvDesc & 3)
5529 {
5530 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5531 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5532 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5533 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5534 }
5535 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
5536 if (rcStrict != VINF_SUCCESS)
5537 return rcStrict;
5538 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5539
5540 /*
5541 * It checks out alright, update the registers.
5542 */
5543/** @todo check if the actual value is loaded or if the RPL is dropped */
5544 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5545 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5546 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5547 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5548 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5549 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5550
5551 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5552}
5553
5554
5555/**
5556 * Implements str GReg
5557 *
5558 * @param iGReg The general register to store the CRx value in.
5559 * @param enmEffOpSize The operand size.
5560 */
5561IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5562{
5563 if (!IEM_IS_IN_GUEST(pVCpu))
5564 { /* probable */ }
5565 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5566 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5567 {
5568 Log(("str_reg: Guest intercept -> VM-exit\n"));
5569 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5570 }
5571 else
5572 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5573
5574 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5575 switch (enmEffOpSize)
5576 {
5577 case IEMMODE_16BIT:
5578 iemGRegStoreU16(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5579 break;
5580 case IEMMODE_32BIT:
5581 case IEMMODE_64BIT:
5582 iemGRegStoreU64(pVCpu, iGReg, pVCpu->cpum.GstCtx.tr.Sel);
5583 break;
5584 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5585 }
5586 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5587}
5588
5589
5590/**
5591 * Implements str mem.
5592 *
5593 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5594 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5595 */
5596IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5597{
5598 if (!IEM_IS_IN_GUEST(pVCpu))
5599 { /* probable */ }
5600 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5601 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5602 {
5603 Log(("str_mem: Guest intercept -> VM-exit\n"));
5604 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5605 }
5606 else
5607 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0, cbInstr);
5608
5609 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5610 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5611 if (rcStrict == VINF_SUCCESS)
5612 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5613 return rcStrict;
5614}
5615
5616
5617/**
5618 * Implements mov GReg,CRx.
5619 *
5620 * @param iGReg The general register to store the CRx value in.
5621 * @param iCrReg The CRx register to read (valid).
5622 */
5623IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5624{
5625 if (IEM_GET_CPL(pVCpu) != 0)
5626 return iemRaiseGeneralProtectionFault0(pVCpu);
5627 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5628
5629 if (!IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5630 { /* probable */ }
5631 else
5632 {
5633 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5634 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5635 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5636 }
5637
5638 /* Read it. */
5639 uint64_t crX;
5640 switch (iCrReg)
5641 {
5642 case 0:
5643 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5644 crX = pVCpu->cpum.GstCtx.cr0;
5645 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5646 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5647 break;
5648 case 2:
5649 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5650 crX = pVCpu->cpum.GstCtx.cr2;
5651 break;
5652 case 3:
5653 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5654 crX = pVCpu->cpum.GstCtx.cr3;
5655 break;
5656 case 4:
5657 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5658 crX = pVCpu->cpum.GstCtx.cr4;
5659 break;
5660 case 8:
5661 {
5662 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5663 if (!IEM_IS_IN_GUEST(pVCpu))
5664 { /* probable */ }
5665#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5666 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5667 {
5668 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5669 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5670 return rcStrict;
5671
5672 /*
5673 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5674 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5675 * are cleared.
5676 *
5677 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5678 */
5679 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5680 {
5681 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5682 crX = (uTpr >> 4) & 0xf;
5683 break;
5684 }
5685 }
5686#endif
5687#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5688 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
5689 {
5690 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
5691 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5692 {
5693 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5694 break;
5695 }
5696 }
5697#endif
5698 uint8_t uTpr;
5699 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5700 if (RT_SUCCESS(rc))
5701 crX = uTpr >> 4;
5702 else
5703 crX = 0;
5704 break;
5705 }
5706 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5707 }
5708
5709#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5710 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5711 { /* probable */ }
5712 else
5713 switch (iCrReg)
5714 {
5715 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5716 case 0: crX = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u); break;
5717 case 4: crX = CPUMGetGuestVmxMaskedCr4(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u); break;
5718 case 3:
5719 {
5720 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5721 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5722 return rcStrict;
5723 break;
5724 }
5725 }
5726#endif
5727
5728 /* Store it. */
5729 if (IEM_IS_64BIT_CODE(pVCpu))
5730 iemGRegStoreU64(pVCpu, iGReg, crX);
5731 else
5732 iemGRegStoreU64(pVCpu, iGReg, (uint32_t)crX);
5733
5734 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5735}
5736
5737
5738/**
5739 * Implements smsw GReg.
5740 *
5741 * @param iGReg The general register to store the CRx value in.
5742 * @param enmEffOpSize The operand size.
5743 */
5744IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5745{
5746 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
5747
5748#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5749 uint64_t u64MaskedCr0;
5750 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5751 u64MaskedCr0 = pVCpu->cpum.GstCtx.cr0;
5752 else
5753 u64MaskedCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5754 uint64_t const u64GuestCr0 = u64MaskedCr0;
5755#else
5756 uint64_t const u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5757#endif
5758
5759 switch (enmEffOpSize)
5760 {
5761 case IEMMODE_16BIT:
5762 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5763 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0);
5764 /* Unused bits are set on 386 and older CPU: */
5765 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5766 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xffe0);
5767 else
5768 iemGRegStoreU16(pVCpu, iGReg, (uint16_t)u64GuestCr0 | 0xfff0);
5769 break;
5770
5771/** @todo testcase for bits 31:16. We're not doing that correctly. */
5772
5773 case IEMMODE_32BIT:
5774 if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5775 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0);
5776 else /** @todo test this! */
5777 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)u64GuestCr0 | UINT32_C(0x7fffffe0)); /* Unused bits are set on 386. */
5778 break;
5779
5780 case IEMMODE_64BIT:
5781 iemGRegStoreU64(pVCpu, iGReg, u64GuestCr0);
5782 break;
5783
5784 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5785 }
5786
5787 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5788}
5789
5790
5791/**
5792 * Implements smsw mem.
5793 *
5794 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5795 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5796 */
5797IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5798{
5799 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5800 if (!IEM_IS_IN_GUEST(pVCpu))
5801 { /* probable */ }
5802 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5803 u64GuestCr0 = CPUMGetGuestVmxMaskedCr0(&pVCpu->cpum.GstCtx, pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u);
5804 else
5805 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */, cbInstr);
5806
5807 uint16_t u16Value;
5808 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5809 u16Value = (uint16_t)u64GuestCr0;
5810 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5811 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5812 else
5813 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5814
5815 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5816 if (rcStrict == VINF_SUCCESS)
5817 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
5818 return rcStrict;
5819}
5820
5821
5822/**
5823 * Helper for mapping CR3 and PAE PDPEs for 'mov CRx,GReg'.
5824 */
5825#define IEM_MAP_PAE_PDPES_AT_CR3_RET(a_pVCpu, a_iCrReg, a_uCr3) \
5826 do \
5827 { \
5828 int const rcX = PGMGstMapPaePdpesAtCr3(a_pVCpu, a_uCr3); \
5829 if (RT_SUCCESS(rcX)) \
5830 { /* likely */ } \
5831 else \
5832 { \
5833 /* Either invalid PDPTEs or CR3 second-level translation failed. Raise #GP(0) either way. */ \
5834 Log(("iemCImpl_load_Cr%#x: Trying to load invalid PAE PDPEs\n", a_iCrReg)); \
5835 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
5836 } \
5837 } while (0)
5838
5839
5840/**
5841 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5842 *
5843 * @param iCrReg The CRx register to write (valid).
5844 * @param uNewCrX The new value.
5845 * @param enmAccessCrX The instruction that caused the CrX load.
5846 * @param iGReg The general register in case of a 'mov CRx,GReg'
5847 * instruction.
5848 */
5849IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5850{
5851 VBOXSTRICTRC rcStrict;
5852 int rc;
5853#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5854 RT_NOREF2(iGReg, enmAccessCrX);
5855#endif
5856
5857 /*
5858 * Try store it.
5859 * Unfortunately, CPUM only does a tiny bit of the work.
5860 */
5861 switch (iCrReg)
5862 {
5863 case 0:
5864 {
5865 /*
5866 * Perform checks.
5867 */
5868 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5869
5870 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5871 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5872
5873 /* ET is hardcoded on 486 and later. */
5874 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5875 uNewCrX |= X86_CR0_ET;
5876 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5877 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5878 {
5879 uNewCrX &= fValid;
5880 uNewCrX |= X86_CR0_ET;
5881 }
5882 else
5883 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5884
5885 /* Check for reserved bits. */
5886 if (uNewCrX & ~(uint64_t)fValid)
5887 {
5888 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5889 return iemRaiseGeneralProtectionFault0(pVCpu);
5890 }
5891
5892 /* Check for invalid combinations. */
5893 if ( (uNewCrX & X86_CR0_PG)
5894 && !(uNewCrX & X86_CR0_PE) )
5895 {
5896 Log(("Trying to set CR0.PG without CR0.PE\n"));
5897 return iemRaiseGeneralProtectionFault0(pVCpu);
5898 }
5899
5900 if ( !(uNewCrX & X86_CR0_CD)
5901 && (uNewCrX & X86_CR0_NW) )
5902 {
5903 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5904 return iemRaiseGeneralProtectionFault0(pVCpu);
5905 }
5906
5907 if ( !(uNewCrX & X86_CR0_PG)
5908 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5909 {
5910 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5911 return iemRaiseGeneralProtectionFault0(pVCpu);
5912 }
5913
5914 /* Long mode consistency checks. */
5915 if ( (uNewCrX & X86_CR0_PG)
5916 && !(uOldCrX & X86_CR0_PG)
5917 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5918 {
5919 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5920 {
5921 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5922 return iemRaiseGeneralProtectionFault0(pVCpu);
5923 }
5924 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5925 {
5926 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5927 return iemRaiseGeneralProtectionFault0(pVCpu);
5928 }
5929 }
5930
5931 /** @todo testcase: what happens if we disable paging while in 64-bit code? */
5932
5933 if (!IEM_IS_IN_GUEST(pVCpu))
5934 { /* probable */ }
5935#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5936 /* Check for bits that must remain set or cleared in VMX operation,
5937 see Intel spec. 23.8 "Restrictions on VMX operation". */
5938 else if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5939 {
5940 uint64_t const uCr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
5941 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5942 {
5943 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5944 return iemRaiseGeneralProtectionFault0(pVCpu);
5945 }
5946
5947 uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5948 if (uNewCrX & ~uCr0Fixed1)
5949 {
5950 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5951 return iemRaiseGeneralProtectionFault0(pVCpu);
5952 }
5953 }
5954#endif
5955 /*
5956 * SVM nested-guest CR0 write intercepts.
5957 */
5958 else if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5959 {
5960 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5961 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5962 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5963 }
5964 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5965 {
5966 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5967 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5968 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5969 {
5970 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5971 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5972 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
5973 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5974 }
5975 }
5976
5977 /*
5978 * Change EFER.LMA if entering or leaving long mode.
5979 */
5980 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5981 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5982 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5983 {
5984 if (uNewCrX & X86_CR0_PG)
5985 NewEFER |= MSR_K6_EFER_LMA;
5986 else
5987 NewEFER &= ~MSR_K6_EFER_LMA;
5988
5989 CPUMSetGuestEFER(pVCpu, NewEFER);
5990 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5991 }
5992
5993 /*
5994 * Inform PGM.
5995 */
5996 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW))
5997 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE | X86_CR0_CD | X86_CR0_NW)) )
5998 {
5999 if ( enmAccessCrX != IEMACCESSCRX_MOV_CRX
6000 || !CPUMIsPaePagingEnabled(uNewCrX, pVCpu->cpum.GstCtx.cr4, NewEFER)
6001 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6002 { /* likely */ }
6003 else
6004 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6005 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6006 AssertRCReturn(rc, rc);
6007 /* ignore informational status codes */
6008 }
6009
6010 /*
6011 * Change CR0.
6012 */
6013 CPUMSetGuestCR0(pVCpu, uNewCrX);
6014 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
6015
6016 /* Update the fExec flags if PE changed. */
6017 if ((uNewCrX ^ uOldCrX) & X86_CR0_PE)
6018 iemRecalcExecModeAndCplAndAcFlags(pVCpu);
6019
6020 /*
6021 * Inform PGM some more...
6022 */
6023 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6024 false /* fForce */);
6025 break;
6026 }
6027
6028 /*
6029 * CR2 can be changed without any restrictions.
6030 */
6031 case 2:
6032 {
6033 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
6034 { /* probable */ }
6035 else
6036 {
6037 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6038 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6039 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
6040 }
6041 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
6042 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
6043 rcStrict = VINF_SUCCESS;
6044 break;
6045 }
6046
6047 /*
6048 * CR3 is relatively simple, although AMD and Intel have different
6049 * accounts of how setting reserved bits are handled. We take intel's
6050 * word for the lower bits and AMD's for the high bits (63:52). The
6051 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
6052 * on this.
6053 */
6054 /** @todo Testcase: Setting reserved bits in CR3, especially before
6055 * enabling paging. */
6056 case 3:
6057 {
6058 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
6059
6060 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
6061 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
6062 && (uNewCrX & RT_BIT_64(63)))
6063 {
6064 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
6065 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
6066 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
6067 * Paging-Structure Caches". */
6068 uNewCrX &= ~RT_BIT_64(63);
6069 }
6070
6071 /* Check / mask the value. */
6072#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6073 /* See Intel spec. 27.2.2 "EPT Translation Mechanism" footnote. */
6074 uint64_t const fInvPhysMask = !CPUMIsGuestVmxEptPagingEnabledEx(IEM_GET_CTX(pVCpu))
6075 ? (UINT64_MAX << IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
6076 : (~X86_CR3_EPT_PAGE_MASK & X86_PAGE_4K_BASE_MASK);
6077#else
6078 uint64_t const fInvPhysMask = UINT64_C(0xfff0000000000000);
6079#endif
6080 if (uNewCrX & fInvPhysMask)
6081 {
6082 /** @todo Should we raise this only for 64-bit mode like Intel claims? AMD is
6083 * very vague in this area. As mentioned above, need testcase on real
6084 * hardware... Sigh. */
6085 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
6086 return iemRaiseGeneralProtectionFault0(pVCpu);
6087 }
6088
6089 uint64_t fValid;
6090 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
6091 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
6092 {
6093 /** @todo Redundant? This value has already been validated above. */
6094 fValid = UINT64_C(0x000fffffffffffff);
6095 }
6096 else
6097 fValid = UINT64_C(0xffffffff);
6098 if (uNewCrX & ~fValid)
6099 {
6100 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
6101 uNewCrX, uNewCrX & ~fValid));
6102 uNewCrX &= fValid;
6103 }
6104
6105 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
6106 { /* probable */ }
6107 else
6108 {
6109 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6110 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6111 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
6112 }
6113
6114 /* Inform PGM. */
6115 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
6116 {
6117 if ( !CPUMIsGuestInPAEModeEx(IEM_GET_CTX(pVCpu))
6118 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6119 { /* likely */ }
6120 else
6121 {
6122 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6123 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, uNewCrX);
6124 }
6125 rc = PGMFlushTLB(pVCpu, uNewCrX, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
6126 AssertRCReturn(rc, rc);
6127 /* ignore informational status codes */
6128 }
6129
6130 /* Make the change. */
6131 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
6132 AssertRCSuccessReturn(rc, rc);
6133
6134 rcStrict = VINF_SUCCESS;
6135 break;
6136 }
6137
6138 /*
6139 * CR4 is a bit more tedious as there are bits which cannot be cleared
6140 * under some circumstances and such.
6141 */
6142 case 4:
6143 {
6144 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6145 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
6146
6147 /* Reserved bits. */
6148 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
6149 if (uNewCrX & ~(uint64_t)fValid)
6150 {
6151 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
6152 return iemRaiseGeneralProtectionFault0(pVCpu);
6153 }
6154
6155 bool const fPcide = !(uOldCrX & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
6156 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
6157
6158 /* PCIDE check. */
6159 if ( fPcide
6160 && ( !fLongMode
6161 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
6162 {
6163 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
6164 return iemRaiseGeneralProtectionFault0(pVCpu);
6165 }
6166
6167 /* PAE check. */
6168 if ( fLongMode
6169 && (uOldCrX & X86_CR4_PAE)
6170 && !(uNewCrX & X86_CR4_PAE))
6171 {
6172 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
6173 return iemRaiseGeneralProtectionFault0(pVCpu);
6174 }
6175
6176 if (!IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
6177 { /* probable */ }
6178 else
6179 {
6180 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6181 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6182 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
6183 }
6184
6185 /* Check for bits that must remain set or cleared in VMX operation,
6186 see Intel spec. 23.8 "Restrictions on VMX operation". */
6187 if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
6188 { /* probable */ }
6189 else
6190 {
6191 uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6192 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
6193 {
6194 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
6195 return iemRaiseGeneralProtectionFault0(pVCpu);
6196 }
6197
6198 uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6199 if (uNewCrX & ~uCr4Fixed1)
6200 {
6201 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
6202 return iemRaiseGeneralProtectionFault0(pVCpu);
6203 }
6204 }
6205
6206 /*
6207 * Notify PGM.
6208 */
6209 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
6210 {
6211 if ( !CPUMIsPaePagingEnabled(pVCpu->cpum.GstCtx.cr0, uNewCrX, pVCpu->cpum.GstCtx.msrEFER)
6212 || CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
6213 { /* likely */ }
6214 else
6215 {
6216 Assert(enmAccessCrX == IEMACCESSCRX_MOV_CRX);
6217 IEM_MAP_PAE_PDPES_AT_CR3_RET(pVCpu, iCrReg, pVCpu->cpum.GstCtx.cr3);
6218 }
6219 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
6220 AssertRCReturn(rc, rc);
6221 /* ignore informational status codes */
6222 }
6223
6224 /*
6225 * Change it.
6226 */
6227 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
6228 AssertRCSuccessReturn(rc, rc);
6229 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
6230
6231 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
6232 false /* fForce */);
6233 break;
6234 }
6235
6236 /*
6237 * CR8 maps to the APIC TPR.
6238 */
6239 case 8:
6240 {
6241 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
6242 if (uNewCrX & ~(uint64_t)0xf)
6243 {
6244 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
6245 return iemRaiseGeneralProtectionFault0(pVCpu);
6246 }
6247
6248 if (!IEM_IS_IN_GUEST(pVCpu))
6249 { /* probable */ }
6250#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6251 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6252 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
6253 {
6254 /*
6255 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
6256 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
6257 * cleared. Following this the processor performs TPR virtualization.
6258 *
6259 * However, we should not perform TPR virtualization immediately here but
6260 * after this instruction has completed.
6261 *
6262 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
6263 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
6264 */
6265 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
6266 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
6267 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
6268 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
6269 rcStrict = VINF_SUCCESS;
6270 break;
6271 }
6272#endif
6273#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6274 else if (pVCpu->iem.s.fExec & IEM_F_X86_CTX_SVM)
6275 {
6276 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
6277 {
6278 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
6279 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6280 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
6281 }
6282
6283 pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.IntCtrl.n.u8VTPR = uNewCrX;
6284 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
6285 {
6286 rcStrict = VINF_SUCCESS;
6287 break;
6288 }
6289 }
6290#endif
6291 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
6292 APICSetTpr(pVCpu, u8Tpr);
6293 rcStrict = VINF_SUCCESS;
6294 break;
6295 }
6296
6297 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6298 }
6299
6300 /*
6301 * Advance the RIP on success.
6302 */
6303 if (RT_SUCCESS(rcStrict))
6304 {
6305 if (rcStrict != VINF_SUCCESS)
6306 iemSetPassUpStatus(pVCpu, rcStrict);
6307 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6308 }
6309
6310 return rcStrict;
6311}
6312
6313
6314/**
6315 * Implements mov CRx,GReg.
6316 *
6317 * @param iCrReg The CRx register to write (valid).
6318 * @param iGReg The general register to load the CRx value from.
6319 */
6320IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
6321{
6322 if (IEM_GET_CPL(pVCpu) != 0)
6323 return iemRaiseGeneralProtectionFault0(pVCpu);
6324 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6325
6326 /*
6327 * Read the new value from the source register and call common worker.
6328 */
6329 uint64_t uNewCrX;
6330 if (IEM_IS_64BIT_CODE(pVCpu))
6331 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
6332 else
6333 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
6334
6335#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6336 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6337 { /* probable */ }
6338 else
6339 {
6340 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
6341 switch (iCrReg)
6342 {
6343 case 0:
6344 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
6345 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
6346 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
6347 }
6348 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6349 return rcStrict;
6350 }
6351#endif
6352
6353 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6354}
6355
6356
6357/**
6358 * Implements 'LMSW r/m16'
6359 *
6360 * @param u16NewMsw The new value.
6361 * @param GCPtrEffDst The guest-linear address of the source operand in case
6362 * of a memory operand. For register operand, pass
6363 * NIL_RTGCPTR.
6364 */
6365IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6366{
6367 if (IEM_GET_CPL(pVCpu) != 0)
6368 return iemRaiseGeneralProtectionFault0(pVCpu);
6369 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6370 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6371
6372#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6373 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6374 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6375 { /* probable */ }
6376 else
6377 {
6378 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6379 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6380 return rcStrict;
6381 }
6382#else
6383 RT_NOREF_PV(GCPtrEffDst);
6384#endif
6385
6386 /*
6387 * Compose the new CR0 value and call common worker.
6388 */
6389 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6390 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6391 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6392}
6393
6394
6395/**
6396 * Implements 'CLTS'.
6397 */
6398IEM_CIMPL_DEF_0(iemCImpl_clts)
6399{
6400 if (IEM_GET_CPL(pVCpu) != 0)
6401 return iemRaiseGeneralProtectionFault0(pVCpu);
6402
6403 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6404 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6405 uNewCr0 &= ~X86_CR0_TS;
6406
6407#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6408 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6409 { /* probable */ }
6410 else
6411 {
6412 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6413 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6414 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6415 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6416 return rcStrict;
6417 }
6418#endif
6419
6420 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6421}
6422
6423
6424/**
6425 * Implements mov GReg,DRx.
6426 *
6427 * @param iGReg The general register to store the DRx value in.
6428 * @param iDrReg The DRx register to read (0-7).
6429 */
6430IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6431{
6432#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6433 /*
6434 * Check nested-guest VMX intercept.
6435 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6436 * over CPL and CR4.DE and even DR4/DR5 checks.
6437 *
6438 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6439 */
6440 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6441 { /* probable */ }
6442 else
6443 {
6444 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6445 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6446 return rcStrict;
6447 }
6448#endif
6449
6450 /*
6451 * Check preconditions.
6452 */
6453 /* Raise GPs. */
6454 if (IEM_GET_CPL(pVCpu) != 0)
6455 return iemRaiseGeneralProtectionFault0(pVCpu);
6456 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6457 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6458
6459 /** @todo \#UD in outside ring-0 too? */
6460 if (iDrReg == 4 || iDrReg == 5)
6461 {
6462 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6463 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6464 {
6465 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6466 return iemRaiseGeneralProtectionFault0(pVCpu);
6467 }
6468 iDrReg += 2;
6469 }
6470
6471 /* Raise #DB if general access detect is enabled. */
6472 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6473 {
6474 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6475 return iemRaiseDebugException(pVCpu);
6476 }
6477
6478 /*
6479 * Read the debug register and store it in the specified general register.
6480 */
6481 uint64_t drX;
6482 switch (iDrReg)
6483 {
6484 case 0:
6485 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6486 drX = pVCpu->cpum.GstCtx.dr[0];
6487 break;
6488 case 1:
6489 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6490 drX = pVCpu->cpum.GstCtx.dr[1];
6491 break;
6492 case 2:
6493 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6494 drX = pVCpu->cpum.GstCtx.dr[2];
6495 break;
6496 case 3:
6497 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6498 drX = pVCpu->cpum.GstCtx.dr[3];
6499 break;
6500 case 6:
6501 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6502 drX = pVCpu->cpum.GstCtx.dr[6];
6503 drX |= X86_DR6_RA1_MASK;
6504 drX &= ~X86_DR6_RAZ_MASK;
6505 break;
6506 case 7:
6507 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6508 drX = pVCpu->cpum.GstCtx.dr[7];
6509 drX |=X86_DR7_RA1_MASK;
6510 drX &= ~X86_DR7_RAZ_MASK;
6511 break;
6512 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* caller checks */
6513 }
6514
6515 /** @todo SVM nested-guest intercept for DR8-DR15? */
6516 /*
6517 * Check for any SVM nested-guest intercepts for the DRx read.
6518 */
6519 if (!IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6520 { /* probable */ }
6521 else
6522 {
6523 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6524 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6525 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6526 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6527 }
6528
6529 if (IEM_IS_64BIT_CODE(pVCpu))
6530 iemGRegStoreU64(pVCpu, iGReg, drX);
6531 else
6532 iemGRegStoreU32(pVCpu, iGReg, (uint32_t)drX);
6533
6534 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6535}
6536
6537
6538/**
6539 * Implements mov DRx,GReg.
6540 *
6541 * @param iDrReg The DRx register to write (valid).
6542 * @param iGReg The general register to load the DRx value from.
6543 */
6544IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6545{
6546#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6547 /*
6548 * Check nested-guest VMX intercept.
6549 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6550 * over CPL and CR4.DE and even DR4/DR5 checks.
6551 *
6552 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6553 */
6554 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6555 { /* probable */ }
6556 else
6557 {
6558 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6559 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6560 return rcStrict;
6561 }
6562#endif
6563
6564 /*
6565 * Check preconditions.
6566 */
6567 if (IEM_GET_CPL(pVCpu) != 0)
6568 return iemRaiseGeneralProtectionFault0(pVCpu);
6569 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6570 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6571
6572 if (iDrReg == 4 || iDrReg == 5)
6573 {
6574 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR4);
6575 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6576 {
6577 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6578 return iemRaiseGeneralProtectionFault0(pVCpu);
6579 }
6580 iDrReg += 2;
6581 }
6582
6583 /* Raise #DB if general access detect is enabled. */
6584 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6585 * \#GP? */
6586 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6587 {
6588 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6589 return iemRaiseDebugException(pVCpu);
6590 }
6591
6592 /*
6593 * Read the new value from the source register.
6594 */
6595 uint64_t uNewDrX;
6596 if (IEM_IS_64BIT_CODE(pVCpu))
6597 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6598 else
6599 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6600
6601 /*
6602 * Adjust it.
6603 */
6604 switch (iDrReg)
6605 {
6606 case 0:
6607 case 1:
6608 case 2:
6609 case 3:
6610 /* nothing to adjust */
6611 break;
6612
6613 case 6:
6614 if (uNewDrX & X86_DR6_MBZ_MASK)
6615 {
6616 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6617 return iemRaiseGeneralProtectionFault0(pVCpu);
6618 }
6619 uNewDrX |= X86_DR6_RA1_MASK;
6620 uNewDrX &= ~X86_DR6_RAZ_MASK;
6621 break;
6622
6623 case 7:
6624 if (uNewDrX & X86_DR7_MBZ_MASK)
6625 {
6626 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6627 return iemRaiseGeneralProtectionFault0(pVCpu);
6628 }
6629 uNewDrX |= X86_DR7_RA1_MASK;
6630 uNewDrX &= ~X86_DR7_RAZ_MASK;
6631 break;
6632
6633 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6634 }
6635
6636 /** @todo SVM nested-guest intercept for DR8-DR15? */
6637 /*
6638 * Check for any SVM nested-guest intercepts for the DRx write.
6639 */
6640 if (!IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6641 { /* probable */ }
6642 else
6643 {
6644 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6645 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6646 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6647 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6648 }
6649
6650 /*
6651 * Do the actual setting.
6652 */
6653 if (iDrReg < 4)
6654 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6655 else if (iDrReg == 6)
6656 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6657
6658 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6659 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6660
6661 /*
6662 * Re-init hardware breakpoint summary if it was DR7 that got changed.
6663 *
6664 * We also do this when an active data breakpoint is updated so that the
6665 * TLB entry can be correctly invalidated.
6666 */
6667 if ( iDrReg == 7
6668#ifdef IEM_WITH_DATA_TLB
6669 || ( iDrReg <= 3
6670 && (X86_DR7_L_G(iDrReg) & pVCpu->cpum.GstCtx.dr[7])
6671 && X86_DR7_IS_W_CFG(pVCpu->cpum.GstCtx.dr[7], iDrReg) )
6672#endif
6673 )
6674 iemRecalcExecDbgFlags(pVCpu);
6675
6676 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6677}
6678
6679
6680/**
6681 * Implements mov GReg,TRx.
6682 *
6683 * @param iGReg The general register to store the
6684 * TRx value in.
6685 * @param iTrReg The TRx register to read (6/7).
6686 */
6687IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Td, uint8_t, iGReg, uint8_t, iTrReg)
6688{
6689 /*
6690 * Check preconditions. NB: This instruction is 386/486 only.
6691 */
6692
6693 /* Raise GPs. */
6694 if (IEM_GET_CPL(pVCpu) != 0)
6695 return iemRaiseGeneralProtectionFault0(pVCpu);
6696 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6697
6698 if (iTrReg < 6 || iTrReg > 7)
6699 {
6700 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6701 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6702 return iemRaiseGeneralProtectionFault0(pVCpu);
6703 }
6704
6705 /*
6706 * Read the test register and store it in the specified general register.
6707 * This is currently a dummy implementation that only exists to satisfy
6708 * old debuggers like WDEB386 or OS/2 KDB which unconditionally read the
6709 * TR6/TR7 registers. Software which actually depends on the TR values
6710 * (different on 386/486) is exceedingly rare.
6711 */
6712 uint32_t trX;
6713 switch (iTrReg)
6714 {
6715 case 6:
6716 trX = 0; /* Currently a dummy. */
6717 break;
6718 case 7:
6719 trX = 0; /* Currently a dummy. */
6720 break;
6721 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6722 }
6723
6724 iemGRegStoreU32(pVCpu, iGReg, trX);
6725
6726 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6727}
6728
6729
6730/**
6731 * Implements mov TRx,GReg.
6732 *
6733 * @param iTrReg The TRx register to write (valid).
6734 * @param iGReg The general register to load the TRx
6735 * value from.
6736 */
6737IEM_CIMPL_DEF_2(iemCImpl_mov_Td_Rd, uint8_t, iTrReg, uint8_t, iGReg)
6738{
6739 /*
6740 * Check preconditions. NB: This instruction is 386/486 only.
6741 */
6742
6743 /* Raise GPs. */
6744 if (IEM_GET_CPL(pVCpu) != 0)
6745 return iemRaiseGeneralProtectionFault0(pVCpu);
6746 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6747
6748 if (iTrReg < 6 || iTrReg > 7)
6749 {
6750 /** @todo Do Intel CPUs reject this or are the TRs aliased? */
6751 Log(("mov r%u,tr%u: invalid register -> #GP(0)\n", iGReg, iTrReg));
6752 return iemRaiseGeneralProtectionFault0(pVCpu);
6753 }
6754
6755 /*
6756 * Read the new value from the source register.
6757 */
6758 uint32_t uNewTrX = iemGRegFetchU32(pVCpu, iGReg);
6759
6760 /*
6761 * Here we would do the actual setting if this weren't a dummy implementation.
6762 * This is currently a dummy implementation that only exists to prevent
6763 * old debuggers like WDEB386 or OS/2 KDB from crashing.
6764 */
6765 RT_NOREF(uNewTrX);
6766
6767 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6768}
6769
6770
6771/**
6772 * Implements 'INVLPG m'.
6773 *
6774 * @param GCPtrPage The effective address of the page to invalidate.
6775 * @remarks Updates the RIP.
6776 */
6777IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6778{
6779 /* ring-0 only. */
6780 if (IEM_GET_CPL(pVCpu) != 0)
6781 return iemRaiseGeneralProtectionFault0(pVCpu);
6782 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6783 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6784
6785 if (!IEM_IS_IN_GUEST(pVCpu))
6786 { /* probable */ }
6787#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6788 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6789 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6790 {
6791 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6792 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6793 }
6794#endif
6795 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6796 {
6797 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6798 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
6799 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6800 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6801 }
6802
6803 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6804 if (rc == VINF_SUCCESS)
6805 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6806 if (rc == VINF_PGM_SYNC_CR3)
6807 {
6808 iemSetPassUpStatus(pVCpu, rc);
6809 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6810 }
6811
6812 AssertMsg(RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6813 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6814 return rc;
6815}
6816
6817
6818/**
6819 * Implements INVPCID.
6820 *
6821 * @param iEffSeg The segment of the invpcid descriptor.
6822 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6823 * @param uInvpcidType The invalidation type.
6824 * @remarks Updates the RIP.
6825 */
6826IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint64_t, uInvpcidType)
6827{
6828 /*
6829 * Check preconditions.
6830 */
6831 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6832 return iemRaiseUndefinedOpcode(pVCpu);
6833
6834 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6835 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6836 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID)))
6837 { /* likely */ }
6838 else
6839 {
6840 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6841 return iemRaiseUndefinedOpcode(pVCpu);
6842 }
6843
6844 if (IEM_GET_CPL(pVCpu) != 0)
6845 {
6846 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6847 return iemRaiseGeneralProtectionFault0(pVCpu);
6848 }
6849
6850 if (IEM_IS_V86_MODE(pVCpu))
6851 {
6852 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6853 return iemRaiseGeneralProtectionFault0(pVCpu);
6854 }
6855
6856 /*
6857 * Check nested-guest intercept.
6858 *
6859 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6860 * both set. We have already checked the former earlier in this function.
6861 *
6862 * CPL and virtual-8086 mode checks take priority over this VM-exit.
6863 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6864 */
6865 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6866 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6867 { /* probable */ }
6868 else
6869 {
6870 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6871 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6872 }
6873
6874 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6875 {
6876 Log(("invpcid: invalid/unrecognized invpcid type %#RX64 -> #GP(0)\n", uInvpcidType));
6877 return iemRaiseGeneralProtectionFault0(pVCpu);
6878 }
6879 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6880
6881 /*
6882 * Fetch the invpcid descriptor from guest memory.
6883 */
6884 RTUINT128U uDesc;
6885 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6886 if (rcStrict == VINF_SUCCESS)
6887 {
6888 /*
6889 * Validate the descriptor.
6890 */
6891 if (uDesc.s.Lo > 0xfff)
6892 {
6893 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6894 return iemRaiseGeneralProtectionFault0(pVCpu);
6895 }
6896
6897 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6898 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6899 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6900 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6901 switch (uInvpcidType)
6902 {
6903 case X86_INVPCID_TYPE_INDV_ADDR:
6904 {
6905 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6906 {
6907 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6908 return iemRaiseGeneralProtectionFault0(pVCpu);
6909 }
6910 if ( !(uCr4 & X86_CR4_PCIDE)
6911 && uPcid != 0)
6912 {
6913 Log(("invpcid: invalid pcid %#x\n", uPcid));
6914 return iemRaiseGeneralProtectionFault0(pVCpu);
6915 }
6916
6917 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6918 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6919 break;
6920 }
6921
6922 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6923 {
6924 if ( !(uCr4 & X86_CR4_PCIDE)
6925 && uPcid != 0)
6926 {
6927 Log(("invpcid: invalid pcid %#x\n", uPcid));
6928 return iemRaiseGeneralProtectionFault0(pVCpu);
6929 }
6930 /* Invalidate all mappings associated with PCID except global translations. */
6931 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6932 break;
6933 }
6934
6935 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6936 {
6937 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6938 break;
6939 }
6940
6941 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6942 {
6943 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6944 break;
6945 }
6946 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6947 }
6948 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6949 }
6950 return rcStrict;
6951}
6952
6953
6954/**
6955 * Implements INVD.
6956 */
6957IEM_CIMPL_DEF_0(iemCImpl_invd)
6958{
6959 if (IEM_GET_CPL(pVCpu) != 0)
6960 {
6961 Log(("invd: CPL != 0 -> #GP(0)\n"));
6962 return iemRaiseGeneralProtectionFault0(pVCpu);
6963 }
6964
6965 if (!IEM_IS_IN_GUEST(pVCpu))
6966 { /* probable */ }
6967 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6968 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6969 else
6970 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0, cbInstr);
6971
6972 /* We currently take no action here. */
6973 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6974}
6975
6976
6977/**
6978 * Implements WBINVD.
6979 */
6980IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6981{
6982 if (IEM_GET_CPL(pVCpu) != 0)
6983 {
6984 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6985 return iemRaiseGeneralProtectionFault0(pVCpu);
6986 }
6987
6988 if (!IEM_IS_IN_GUEST(pVCpu))
6989 { /* probable */ }
6990 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6991 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6992 else
6993 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0, cbInstr);
6994
6995 /* We currently take no action here. */
6996 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
6997}
6998
6999
7000/** Opcode 0x0f 0xaa. */
7001IEM_CIMPL_DEF_0(iemCImpl_rsm)
7002{
7003 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0, cbInstr);
7004 NOREF(cbInstr);
7005 return iemRaiseUndefinedOpcode(pVCpu);
7006}
7007
7008
7009/**
7010 * Implements RDTSC.
7011 */
7012IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
7013{
7014 /*
7015 * Check preconditions.
7016 */
7017 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
7018 return iemRaiseUndefinedOpcode(pVCpu);
7019
7020 if (IEM_GET_CPL(pVCpu) != 0)
7021 {
7022 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7023 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7024 {
7025 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7026 return iemRaiseGeneralProtectionFault0(pVCpu);
7027 }
7028 }
7029
7030 if (!IEM_IS_IN_GUEST(pVCpu))
7031 { /* probable */ }
7032 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7033 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7034 {
7035 Log(("rdtsc: Guest intercept -> VM-exit\n"));
7036 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
7037 }
7038 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
7039 {
7040 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
7041 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7042 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7043 }
7044
7045 /*
7046 * Do the job.
7047 */
7048 uint64_t uTicks = TMCpuTickGet(pVCpu);
7049#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7050 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7051#endif
7052 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7053 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7054 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
7055 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7056}
7057
7058
7059/**
7060 * Implements RDTSC.
7061 */
7062IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
7063{
7064 /*
7065 * Check preconditions.
7066 */
7067 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
7068 return iemRaiseUndefinedOpcode(pVCpu);
7069
7070 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7071 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP)))
7072 { /* likely */ }
7073 else
7074 {
7075 Log(("rdtscp: Not enabled for VMX non-root mode -> #UD\n"));
7076 return iemRaiseUndefinedOpcode(pVCpu);
7077 }
7078
7079 if (IEM_GET_CPL(pVCpu) != 0)
7080 {
7081 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7082 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
7083 {
7084 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
7085 return iemRaiseGeneralProtectionFault0(pVCpu);
7086 }
7087 }
7088
7089 if (!IEM_IS_IN_GUEST(pVCpu))
7090 { /* probable */ }
7091 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7092 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
7093 {
7094 Log(("rdtscp: Guest intercept -> VM-exit\n"));
7095 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
7096 }
7097 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
7098 {
7099 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
7100 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7101 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7102 }
7103
7104 /*
7105 * Do the job.
7106 * Query the MSR first in case of trips to ring-3.
7107 */
7108 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
7109 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
7110 if (rcStrict == VINF_SUCCESS)
7111 {
7112 /* Low dword of the TSC_AUX msr only. */
7113 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7114
7115 uint64_t uTicks = TMCpuTickGet(pVCpu);
7116#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) || defined(VBOX_WITH_NESTED_HWVIRT_VMX)
7117 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
7118#endif
7119 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
7120 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
7121 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
7122 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7123 }
7124 return rcStrict;
7125}
7126
7127
7128/**
7129 * Implements RDPMC.
7130 */
7131IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
7132{
7133 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7134
7135 if ( IEM_GET_CPL(pVCpu) != 0
7136 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
7137 return iemRaiseGeneralProtectionFault0(pVCpu);
7138
7139 if (!IEM_IS_IN_GUEST(pVCpu))
7140 { /* probable */ }
7141 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7142 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
7143 {
7144 Log(("rdpmc: Guest intercept -> VM-exit\n"));
7145 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
7146 }
7147 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
7148 {
7149 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
7150 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7151 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7152 }
7153
7154 /** @todo Emulate performance counters, for now just return 0. */
7155 pVCpu->cpum.GstCtx.rax = 0;
7156 pVCpu->cpum.GstCtx.rdx = 0;
7157 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7158 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
7159 * ecx but see @bugref{3472}! */
7160
7161 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7162}
7163
7164
7165/**
7166 * Implements RDMSR.
7167 */
7168IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
7169{
7170 /*
7171 * Check preconditions.
7172 */
7173 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7174 return iemRaiseUndefinedOpcode(pVCpu);
7175 if (IEM_GET_CPL(pVCpu) != 0)
7176 return iemRaiseGeneralProtectionFault0(pVCpu);
7177
7178 /*
7179 * Check nested-guest intercepts.
7180 */
7181 if (!IEM_IS_IN_GUEST(pVCpu))
7182 { /* probable */ }
7183#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7184 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7185 {
7186 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
7187 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
7188 }
7189#endif
7190#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7191 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7192 {
7193 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */, cbInstr);
7194 if (rcStrict == VINF_SVM_VMEXIT)
7195 return VINF_SUCCESS;
7196 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7197 {
7198 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
7199 return rcStrict;
7200 }
7201 }
7202#endif
7203
7204 /*
7205 * Do the job.
7206 */
7207 RTUINT64U uValue;
7208 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7209 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7210
7211 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
7212 if (rcStrict == VINF_SUCCESS)
7213 {
7214 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
7215 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
7216 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
7217
7218 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7219 }
7220
7221#ifndef IN_RING3
7222 /* Deferred to ring-3. */
7223 if (rcStrict == VINF_CPUM_R3_MSR_READ)
7224 {
7225 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
7226 return rcStrict;
7227 }
7228#endif
7229
7230 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7231 if (pVCpu->iem.s.cLogRelRdMsr < 32)
7232 {
7233 pVCpu->iem.s.cLogRelRdMsr++;
7234 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7235 }
7236 else
7237 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
7238 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7239 return iemRaiseGeneralProtectionFault0(pVCpu);
7240}
7241
7242
7243/**
7244 * Implements WRMSR.
7245 */
7246IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
7247{
7248 /*
7249 * Check preconditions.
7250 */
7251 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
7252 return iemRaiseUndefinedOpcode(pVCpu);
7253 if (IEM_GET_CPL(pVCpu) != 0)
7254 return iemRaiseGeneralProtectionFault0(pVCpu);
7255
7256 RTUINT64U uValue;
7257 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
7258 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
7259
7260 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
7261
7262 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
7263 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
7264
7265 /*
7266 * Check nested-guest intercepts.
7267 */
7268 if (!IEM_IS_IN_GUEST(pVCpu))
7269 { /* probable */ }
7270#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7271 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7272 {
7273 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
7274 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
7275 }
7276#endif
7277#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7278 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
7279 {
7280 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */, cbInstr);
7281 if (rcStrict == VINF_SVM_VMEXIT)
7282 return VINF_SUCCESS;
7283 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7284 {
7285 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
7286 return rcStrict;
7287 }
7288 }
7289#endif
7290
7291 /*
7292 * Do the job.
7293 */
7294 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
7295 if (rcStrict == VINF_SUCCESS)
7296 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7297
7298#ifndef IN_RING3
7299 /* Deferred to ring-3. */
7300 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
7301 {
7302 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
7303 return rcStrict;
7304 }
7305#endif
7306
7307 /* Often a unimplemented MSR or MSR bit, so worth logging. */
7308 if (pVCpu->iem.s.cLogRelWrMsr < 32)
7309 {
7310 pVCpu->iem.s.cLogRelWrMsr++;
7311 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7312 }
7313 else
7314 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
7315 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
7316 return iemRaiseGeneralProtectionFault0(pVCpu);
7317}
7318
7319
7320/**
7321 * Implements 'IN eAX, port'.
7322 *
7323 * @param u16Port The source port.
7324 * @param cbReg The register size.
7325 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7326 * immediate operand or the implicit DX register.
7327 * Bits 3-0: Effective address mode.
7328 */
7329IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7330{
7331 /*
7332 * GCM intercept.
7333 *
7334 * This must be placed before the IOPL check as the mesa driver intercept
7335 * would otherwise trigger a #GP(0).
7336 */
7337 if (!IEM_IS_IN_GUEST(pVCpu) && GCMIsInterceptingIOPortRead(pVCpu, u16Port, cbReg))
7338 {
7339 VBOXSTRICTRC rcStrict = GCMInterceptedIOPortRead(pVCpu, &pVCpu->cpum.GstCtx, u16Port, cbReg);
7340 if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP || rcStrict == VINF_GCM_HANDLED)
7341 {
7342 Log(("iemCImpl_in: u16Port=%#x cbReg=%d was handled by GCMIOPortRead (%d)\n", u16Port, cbReg, VBOXSTRICTRC_VAL(rcStrict)));
7343 if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP)
7344 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7345 else
7346 rcStrict = VINF_SUCCESS;
7347 return rcStrict;
7348 }
7349 Assert(rcStrict == VERR_GCM_NOT_HANDLED);
7350 }
7351
7352 /*
7353 * CPL check
7354 */
7355 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7356 if (rcStrict != VINF_SUCCESS)
7357 return rcStrict;
7358
7359 if (!IEM_IS_IN_GUEST(pVCpu))
7360 { /* probable */ }
7361
7362 /*
7363 * Check VMX nested-guest IO intercept.
7364 */
7365#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7366 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7367 {
7368 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7369 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7370 return rcStrict;
7371 }
7372#endif
7373
7374 /*
7375 * Check SVM nested-guest IO intercept.
7376 */
7377#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7378 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7379 {
7380 uint8_t cAddrSizeBits;
7381 switch (bImmAndEffAddrMode & 0xf)
7382 {
7383 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7384 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7385 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7386 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7387 }
7388 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7389 false /* fRep */, false /* fStrIo */, cbInstr);
7390 if (rcStrict == VINF_SVM_VMEXIT)
7391 return VINF_SUCCESS;
7392 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7393 {
7394 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7395 VBOXSTRICTRC_VAL(rcStrict)));
7396 return rcStrict;
7397 }
7398 }
7399#endif
7400#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7401 RT_NOREF(bImmAndEffAddrMode);
7402#endif
7403
7404 /*
7405 * Perform the I/O.
7406 */
7407 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7408 uint32_t u32Value = 0;
7409 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, cbReg);
7410 if (IOM_SUCCESS(rcStrict))
7411 {
7412 switch (cbReg)
7413 {
7414 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
7415 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
7416 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
7417 default: AssertFailedReturn(VERR_IEM_IPE_3);
7418 }
7419
7420 pVCpu->iem.s.cPotentialExits++;
7421 if (rcStrict != VINF_SUCCESS)
7422 iemSetPassUpStatus(pVCpu, rcStrict);
7423
7424 /*
7425 * Check for I/O breakpoints before we complete the instruction.
7426 */
7427 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7428 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7429 && X86_DR7_ANY_RW_IO(fDr7)
7430 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7431 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7432 && rcStrict == VINF_SUCCESS))
7433 {
7434 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7435 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7436 }
7437
7438 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7439 }
7440
7441 return rcStrict;
7442}
7443
7444
7445/**
7446 * Implements 'IN eAX, DX'.
7447 *
7448 * @param cbReg The register size.
7449 * @param enmEffAddrMode Effective address mode.
7450 */
7451IEM_CIMPL_DEF_2(iemCImpl_in_eAX_DX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7452{
7453 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7454}
7455
7456
7457/**
7458 * Implements 'OUT port, eAX'.
7459 *
7460 * @param u16Port The destination port.
7461 * @param cbReg The register size.
7462 * @param bImmAndEffAddrMode Bit 7: Whether the port was specified through an
7463 * immediate operand or the implicit DX register.
7464 * Bits 3-0: Effective address mode.
7465 */
7466IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
7467{
7468 /*
7469 * CPL check
7470 */
7471 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
7472 if (rcStrict != VINF_SUCCESS)
7473 return rcStrict;
7474
7475 if (!IEM_IS_IN_GUEST(pVCpu))
7476 { /* probable */ }
7477
7478 /*
7479 * Check VMX nested-guest I/O intercept.
7480 */
7481#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7482 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7483 {
7484 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, RT_BOOL(bImmAndEffAddrMode & 0x80), cbReg, cbInstr);
7485 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
7486 return rcStrict;
7487 }
7488#endif
7489
7490 /*
7491 * Check SVM nested-guest I/O intercept.
7492 */
7493#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7494 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
7495 {
7496 uint8_t cAddrSizeBits;
7497 switch (bImmAndEffAddrMode & 0xf)
7498 {
7499 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
7500 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
7501 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
7502 IEM_NOT_REACHED_DEFAULT_CASE_RET();
7503 }
7504 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
7505 false /* fRep */, false /* fStrIo */, cbInstr);
7506 if (rcStrict == VINF_SVM_VMEXIT)
7507 return VINF_SUCCESS;
7508 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
7509 {
7510 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
7511 VBOXSTRICTRC_VAL(rcStrict)));
7512 return rcStrict;
7513 }
7514 }
7515#endif
7516#if !defined(VBOX_WITH_NESTED_HWVIRT_VMX) && !defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7517 RT_NOREF(bImmAndEffAddrMode);
7518#endif
7519
7520 /*
7521 * Perform the I/O.
7522 */
7523 PVMCC const pVM = pVCpu->CTX_SUFF(pVM);
7524 uint32_t u32Value;
7525 switch (cbReg)
7526 {
7527 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7528 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7529 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7530 default: AssertFailedReturn(VERR_IEM_IPE_4);
7531 }
7532 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, u32Value, cbReg);
7533 if (IOM_SUCCESS(rcStrict))
7534 {
7535 pVCpu->iem.s.cPotentialExits++;
7536 if (rcStrict != VINF_SUCCESS)
7537 iemSetPassUpStatus(pVCpu, rcStrict);
7538
7539 /*
7540 * Check for I/O breakpoints before we complete the instruction.
7541 */
7542 uint32_t const fDr7 = pVCpu->cpum.GstCtx.dr[7];
7543 if (RT_UNLIKELY( ( ( (fDr7 & X86_DR7_ENABLED_MASK)
7544 && X86_DR7_ANY_RW_IO(fDr7)
7545 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7546 || pVM->dbgf.ro.cEnabledHwIoBreakpoints > 0)
7547 && rcStrict == VINF_SUCCESS))
7548 {
7549 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7550 pVCpu->cpum.GstCtx.eflags.uBoth |= DBGFBpCheckIo2(pVM, pVCpu, u16Port, cbReg);
7551 }
7552
7553 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7554 }
7555 return rcStrict;
7556}
7557
7558
7559/**
7560 * Implements 'OUT DX, eAX'.
7561 *
7562 * @param cbReg The register size.
7563 * @param enmEffAddrMode Effective address mode.
7564 */
7565IEM_CIMPL_DEF_2(iemCImpl_out_DX_eAX, uint8_t, cbReg, IEMMODE, enmEffAddrMode)
7566{
7567 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, cbReg, 0 /* fImm */ | enmEffAddrMode);
7568}
7569
7570
7571/**
7572 * Implements 'CLI'.
7573 */
7574IEM_CIMPL_DEF_0(iemCImpl_cli)
7575{
7576 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7577#ifdef LOG_ENABLED
7578 uint32_t const fEflOld = fEfl;
7579#endif
7580
7581 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7582 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7583 {
7584 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7585 if (!(fEfl & X86_EFL_VM))
7586 {
7587 if (IEM_GET_CPL(pVCpu) <= uIopl)
7588 fEfl &= ~X86_EFL_IF;
7589 else if ( IEM_GET_CPL(pVCpu) == 3
7590 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7591 fEfl &= ~X86_EFL_VIF;
7592 else
7593 return iemRaiseGeneralProtectionFault0(pVCpu);
7594 }
7595 /* V8086 */
7596 else if (uIopl == 3)
7597 fEfl &= ~X86_EFL_IF;
7598 else if ( uIopl < 3
7599 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7600 fEfl &= ~X86_EFL_VIF;
7601 else
7602 return iemRaiseGeneralProtectionFault0(pVCpu);
7603 }
7604 /* real mode */
7605 else
7606 fEfl &= ~X86_EFL_IF;
7607
7608 /* Commit. */
7609 IEMMISC_SET_EFL(pVCpu, fEfl);
7610 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7611 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl));
7612 return rcStrict;
7613}
7614
7615
7616/**
7617 * Implements 'STI'.
7618 */
7619IEM_CIMPL_DEF_0(iemCImpl_sti)
7620{
7621 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7622 uint32_t const fEflOld = fEfl;
7623
7624 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7625 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7626 {
7627 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7628 if (!(fEfl & X86_EFL_VM))
7629 {
7630 if (IEM_GET_CPL(pVCpu) <= uIopl)
7631 fEfl |= X86_EFL_IF;
7632 else if ( IEM_GET_CPL(pVCpu) == 3
7633 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7634 && !(fEfl & X86_EFL_VIP) )
7635 fEfl |= X86_EFL_VIF;
7636 else
7637 return iemRaiseGeneralProtectionFault0(pVCpu);
7638 }
7639 /* V8086 */
7640 else if (uIopl == 3)
7641 fEfl |= X86_EFL_IF;
7642 else if ( uIopl < 3
7643 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7644 && !(fEfl & X86_EFL_VIP) )
7645 fEfl |= X86_EFL_VIF;
7646 else
7647 return iemRaiseGeneralProtectionFault0(pVCpu);
7648 }
7649 /* real mode */
7650 else
7651 fEfl |= X86_EFL_IF;
7652
7653 /*
7654 * Commit.
7655 *
7656 * Note! Setting the shadow interrupt flag must be done after RIP updating.
7657 */
7658 IEMMISC_SET_EFL(pVCpu, fEfl);
7659 VBOXSTRICTRC const rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7660 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7661 {
7662 /** @todo only set it the shadow flag if it was clear before? */
7663 CPUMSetInInterruptShadowSti(&pVCpu->cpum.GstCtx);
7664 }
7665 pVCpu->iem.s.fTbCurInstrIsSti = true;
7666 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7667 return rcStrict;
7668}
7669
7670
7671/**
7672 * Implements 'HLT'.
7673 */
7674IEM_CIMPL_DEF_0(iemCImpl_hlt)
7675{
7676 if (IEM_GET_CPL(pVCpu) != 0)
7677 return iemRaiseGeneralProtectionFault0(pVCpu);
7678
7679 if (!IEM_IS_IN_GUEST(pVCpu))
7680 { /* probable */ }
7681 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7682 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7683 {
7684 Log2(("hlt: Guest intercept -> VM-exit\n"));
7685 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7686 }
7687 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7688 {
7689 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7690 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7691 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7692 }
7693
7694 /** @todo finish: This ASSUMES that iemRegAddToRipAndFinishingClearingRF won't
7695 * be returning any status codes relating to non-guest events being raised, as
7696 * we'll mess up the guest HALT otherwise. */
7697 VBOXSTRICTRC rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7698 if (rcStrict == VINF_SUCCESS)
7699 rcStrict = VINF_EM_HALT;
7700 return rcStrict;
7701}
7702
7703
7704/**
7705 * Implements 'MONITOR'.
7706 */
7707IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7708{
7709 /*
7710 * Permission checks.
7711 */
7712 if (IEM_GET_CPL(pVCpu) != 0)
7713 {
7714 Log2(("monitor: CPL != 0\n"));
7715 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7716 }
7717 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7718 {
7719 Log2(("monitor: Not in CPUID\n"));
7720 return iemRaiseUndefinedOpcode(pVCpu);
7721 }
7722
7723 /*
7724 * Check VMX guest-intercept.
7725 * This should be considered a fault-like VM-exit.
7726 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7727 */
7728 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7729 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7730 { /* probable */ }
7731 else
7732 {
7733 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7734 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7735 }
7736
7737 /*
7738 * Gather the operands and validate them.
7739 */
7740 RTGCPTR GCPtrMem = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7741 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7742 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7743/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7744 * \#GP first. */
7745 if (uEcx != 0)
7746 {
7747 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7748 return iemRaiseGeneralProtectionFault0(pVCpu);
7749 }
7750
7751 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7752 if (rcStrict != VINF_SUCCESS)
7753 return rcStrict;
7754
7755 RTGCPHYS GCPhysMem;
7756 /** @todo access size */
7757 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7758 if (rcStrict != VINF_SUCCESS)
7759 return rcStrict;
7760
7761 if (!IEM_IS_IN_GUEST(pVCpu))
7762 { /* probable */ }
7763#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7764 else if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7765 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7766 {
7767 /*
7768 * MONITOR does not access the memory, just monitors the address. However,
7769 * if the address falls in the APIC-access page, the address monitored must
7770 * instead be the corresponding address in the virtual-APIC page.
7771 *
7772 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7773 */
7774 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
7775 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7776 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7777 return rcStrict;
7778 }
7779#endif
7780 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7781 {
7782 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7783 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7784 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7785 }
7786
7787 /*
7788 * Call EM to prepare the monitor/wait.
7789 */
7790 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7791 Assert(rcStrict == VINF_SUCCESS);
7792 if (rcStrict == VINF_SUCCESS)
7793 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7794 return rcStrict;
7795}
7796
7797
7798/**
7799 * Implements 'MWAIT'.
7800 */
7801IEM_CIMPL_DEF_0(iemCImpl_mwait)
7802{
7803 /*
7804 * Permission checks.
7805 */
7806 if (IEM_GET_CPL(pVCpu) != 0)
7807 {
7808 Log2(("mwait: CPL != 0\n"));
7809 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7810 * EFLAGS.VM then.) */
7811 return iemRaiseUndefinedOpcode(pVCpu);
7812 }
7813 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7814 {
7815 Log2(("mwait: Not in CPUID\n"));
7816 return iemRaiseUndefinedOpcode(pVCpu);
7817 }
7818
7819 /* Check VMX nested-guest intercept. */
7820 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7821 || !IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7822 { /* probable */ }
7823 else
7824 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7825
7826 /*
7827 * Gather the operands and validate them.
7828 */
7829 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7830 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7831 if (uEcx != 0)
7832 {
7833 /* Only supported extension is break on IRQ when IF=0. */
7834 if (uEcx > 1)
7835 {
7836 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7837 return iemRaiseGeneralProtectionFault0(pVCpu);
7838 }
7839 uint32_t fMWaitFeatures = 0;
7840 uint32_t uIgnore = 0;
7841 CPUMGetGuestCpuId(pVCpu, 5, 0, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7842 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7843 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7844 {
7845 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7846 return iemRaiseGeneralProtectionFault0(pVCpu);
7847 }
7848
7849#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7850 /*
7851 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7852 * for delivery; and interrupts are disabled the processor does not enter its
7853 * mwait state but rather passes control to the next instruction.
7854 *
7855 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7856 */
7857 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7858 || pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7859 { /* probable */ }
7860 else if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7861 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7862 /** @todo finish: check up this out after we move int window stuff out of the
7863 * run loop and into the instruction finishing logic here. */
7864 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7865#endif
7866 }
7867
7868 /*
7869 * Check SVM nested-guest mwait intercepts.
7870 */
7871 if (!IEM_IS_IN_GUEST(pVCpu))
7872 { /* probable */ }
7873 else if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7874 && EMMonitorIsArmed(pVCpu))
7875 {
7876 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7877 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7878 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7879 }
7880 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7881 {
7882 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7883 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
7884 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7885 }
7886
7887 /*
7888 * Call EM to prepare the monitor/wait.
7889 *
7890 * This will return VINF_EM_HALT. If there the trap flag is set, we may
7891 * override it when executing iemRegAddToRipAndFinishingClearingRF ASSUMING
7892 * that will only return guest related events.
7893 */
7894 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7895
7896 /** @todo finish: This needs more thinking as we should suppress internal
7897 * debugger events here, or we'll bugger up the guest state even more than we
7898 * alread do around VINF_EM_HALT. */
7899 VBOXSTRICTRC rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7900 if (rcStrict2 != VINF_SUCCESS)
7901 {
7902 Log2(("mwait: %Rrc (perform) -> %Rrc (finish)!\n", VBOXSTRICTRC_VAL(rcStrict), VBOXSTRICTRC_VAL(rcStrict2) ));
7903 rcStrict = rcStrict2;
7904 }
7905
7906 return rcStrict;
7907}
7908
7909
7910/**
7911 * Implements 'SWAPGS'.
7912 */
7913IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7914{
7915 Assert(IEM_IS_64BIT_CODE(pVCpu)); /* Caller checks this. */
7916
7917 /*
7918 * Permission checks.
7919 */
7920 if (IEM_GET_CPL(pVCpu) != 0)
7921 {
7922 Log2(("swapgs: CPL != 0\n"));
7923 return iemRaiseUndefinedOpcode(pVCpu);
7924 }
7925
7926 /*
7927 * Do the job.
7928 */
7929 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7930 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7931 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7932 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7933
7934 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7935}
7936
7937
7938#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
7939/**
7940 * Handles a CPUID call.
7941 */
7942static VBOXSTRICTRC iemCpuIdVBoxCall(PVMCPUCC pVCpu, uint32_t iFunction,
7943 uint32_t *pEax, uint32_t *pEbx, uint32_t *pEcx, uint32_t *pEdx)
7944{
7945 switch (iFunction)
7946 {
7947 case VBOX_CPUID_FN_ID:
7948 LogFlow(("iemCpuIdVBoxCall: VBOX_CPUID_FN_ID\n"));
7949 *pEax = VBOX_CPUID_RESP_ID_EAX;
7950 *pEbx = VBOX_CPUID_RESP_ID_EBX;
7951 *pEcx = VBOX_CPUID_RESP_ID_ECX;
7952 *pEdx = VBOX_CPUID_RESP_ID_EDX;
7953 break;
7954
7955 case VBOX_CPUID_FN_LOG:
7956 {
7957 CPUM_IMPORT_EXTRN_RET(pVCpu, CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI
7958 | IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK);
7959
7960 /* Validate input. */
7961 uint32_t cchToLog = *pEdx;
7962 if (cchToLog <= _2M)
7963 {
7964 uint32_t const uLogPicker = *pEbx;
7965 if (uLogPicker <= 1)
7966 {
7967 /* Resolve the logger. */
7968 PRTLOGGER const pLogger = !uLogPicker
7969 ? RTLogDefaultInstanceEx(UINT32_MAX) : RTLogRelGetDefaultInstanceEx(UINT32_MAX);
7970 if (pLogger)
7971 {
7972 /* Copy over the data: */
7973 RTGCPTR GCPtrSrc = pVCpu->cpum.GstCtx.rsi;
7974 while (cchToLog > 0)
7975 {
7976 uint32_t cbToMap = GUEST_PAGE_SIZE - (GCPtrSrc & GUEST_PAGE_OFFSET_MASK);
7977 if (cbToMap > cchToLog)
7978 cbToMap = cchToLog;
7979 /** @todo Extend iemMemMap to allowing page size accessing and avoid 7
7980 * unnecessary calls & iterations per pages. */
7981 if (cbToMap > 512)
7982 cbToMap = 512;
7983 uint8_t bUnmapInfo;
7984 void *pvSrc = NULL;
7985 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, &bUnmapInfo, cbToMap,
7986 UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
7987 if (rcStrict == VINF_SUCCESS)
7988 {
7989 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
7990 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
7991 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
7992 }
7993 else
7994 {
7995 Log(("iemCpuIdVBoxCall: %Rrc at %RGp LB %#x\n", VBOXSTRICTRC_VAL(rcStrict), GCPtrSrc, cbToMap));
7996 return rcStrict;
7997 }
7998
7999 /* Advance. */
8000 pVCpu->cpum.GstCtx.rsi = GCPtrSrc += cbToMap;
8001 *pEdx = cchToLog -= cbToMap;
8002 }
8003 *pEax = VINF_SUCCESS;
8004 }
8005 else
8006 *pEax = (uint32_t)VERR_NOT_FOUND;
8007 }
8008 else
8009 *pEax = (uint32_t)VERR_NOT_FOUND;
8010 }
8011 else
8012 *pEax = (uint32_t)VERR_TOO_MUCH_DATA;
8013 *pEdx = VBOX_CPUID_RESP_GEN_EDX;
8014 *pEcx = VBOX_CPUID_RESP_GEN_ECX;
8015 *pEbx = VBOX_CPUID_RESP_GEN_EBX;
8016 break;
8017 }
8018
8019 default:
8020 LogFlow(("iemCpuIdVBoxCall: Invalid function %#x (%#x, %#x)\n", iFunction, *pEbx, *pEdx));
8021 *pEax = (uint32_t)VERR_INVALID_FUNCTION;
8022 *pEbx = (uint32_t)VERR_INVALID_FUNCTION;
8023 *pEcx = (uint32_t)VERR_INVALID_FUNCTION;
8024 *pEdx = (uint32_t)VERR_INVALID_FUNCTION;
8025 break;
8026 }
8027 return VINF_SUCCESS;
8028}
8029#endif /* VBOX_WITHOUT_CPUID_HOST_CALL */
8030
8031/**
8032 * Implements 'CPUID'.
8033 */
8034IEM_CIMPL_DEF_0(iemCImpl_cpuid)
8035{
8036 if (!IEM_IS_IN_GUEST(pVCpu))
8037 { /* probable */ }
8038 else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8039 {
8040 Log2(("cpuid: Guest intercept -> VM-exit\n"));
8041 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
8042 }
8043 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
8044 {
8045 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
8046 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8047 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8048 }
8049
8050
8051 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
8052 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
8053
8054#ifndef VBOX_WITHOUT_CPUID_HOST_CALL
8055 /*
8056 * CPUID host call backdoor.
8057 */
8058 if ( uEax == VBOX_CPUID_REQ_EAX_FIXED
8059 && (uEcx & VBOX_CPUID_REQ_ECX_FIXED_MASK) == VBOX_CPUID_REQ_ECX_FIXED
8060 && pVCpu->CTX_SUFF(pVM)->iem.s.fCpuIdHostCall)
8061 {
8062 VBOXSTRICTRC rcStrict = iemCpuIdVBoxCall(pVCpu, uEcx & VBOX_CPUID_REQ_ECX_FN_MASK,
8063 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx,
8064 &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8065 if (rcStrict != VINF_SUCCESS)
8066 return rcStrict;
8067 }
8068 /*
8069 * Regular CPUID.
8070 */
8071 else
8072#endif
8073 CPUMGetGuestCpuId(pVCpu, uEax, uEcx, pVCpu->cpum.GstCtx.cs.Attr.n.u1Long,
8074 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
8075
8076 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
8077 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
8078 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
8079 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
8080 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
8081
8082 pVCpu->iem.s.cPotentialExits++;
8083 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8084}
8085
8086
8087/**
8088 * Implements 'AAD'.
8089 *
8090 * @param bImm The immediate operand.
8091 */
8092IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
8093{
8094 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8095 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
8096 pVCpu->cpum.GstCtx.ax = al;
8097 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8098 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8099 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8100
8101 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8102}
8103
8104
8105/**
8106 * Implements 'AAM'.
8107 *
8108 * @param bImm The immediate operand. Cannot be 0.
8109 */
8110IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
8111{
8112 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
8113
8114 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
8115 uint8_t const al = (uint8_t)ax % bImm;
8116 uint8_t const ah = (uint8_t)ax / bImm;
8117 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
8118 iemHlpUpdateArithEFlagsU8(pVCpu, al,
8119 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
8120 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
8121
8122 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8123}
8124
8125
8126/**
8127 * Implements 'DAA'.
8128 */
8129IEM_CIMPL_DEF_0(iemCImpl_daa)
8130{
8131 uint8_t const al = pVCpu->cpum.GstCtx.al;
8132 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8133
8134 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8135 || (al & 0xf) >= 10)
8136 {
8137 pVCpu->cpum.GstCtx.al = al + 6;
8138 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8139 }
8140 else
8141 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8142
8143 if (al >= 0x9a || fCarry)
8144 {
8145 pVCpu->cpum.GstCtx.al += 0x60;
8146 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8147 }
8148 else
8149 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8150
8151 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8152 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8153}
8154
8155
8156/**
8157 * Implements 'DAS'.
8158 */
8159IEM_CIMPL_DEF_0(iemCImpl_das)
8160{
8161 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
8162 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
8163
8164 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8165 || (uInputAL & 0xf) >= 10)
8166 {
8167 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8168 if (uInputAL < 6)
8169 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8170 pVCpu->cpum.GstCtx.al = uInputAL - 6;
8171 }
8172 else
8173 {
8174 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8175 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8176 }
8177
8178 if (uInputAL >= 0x9a || fCarry)
8179 {
8180 pVCpu->cpum.GstCtx.al -= 0x60;
8181 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8182 }
8183
8184 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8185 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8186}
8187
8188
8189/**
8190 * Implements 'AAA'.
8191 */
8192IEM_CIMPL_DEF_0(iemCImpl_aaa)
8193{
8194 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8195 {
8196 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8197 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8198 {
8199 pVCpu->cpum.GstCtx.eflags.uBoth = iemAImpl_add_u16(pVCpu->cpum.GstCtx.eflags.uBoth, &pVCpu->cpum.GstCtx.ax, 0x106);
8200 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8201 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8202 }
8203 else
8204 {
8205 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8206 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8207 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8208 }
8209 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8210 }
8211 else
8212 {
8213 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8214 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8215 {
8216 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
8217 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8218 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8219 }
8220 else
8221 {
8222 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8223 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8224 }
8225 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8226 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8227 }
8228
8229 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8230}
8231
8232
8233/**
8234 * Implements 'AAS'.
8235 */
8236IEM_CIMPL_DEF_0(iemCImpl_aas)
8237{
8238 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
8239 {
8240 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8241 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8242 {
8243 pVCpu->cpum.GstCtx.eflags.uBoth = iemAImpl_sub_u16(pVCpu->cpum.GstCtx.eflags.uBoth, &pVCpu->cpum.GstCtx.ax, 0x106);
8244 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8245 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8246 }
8247 else
8248 {
8249 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8250 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8251 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8252 }
8253 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8254 }
8255 else
8256 {
8257 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
8258 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
8259 {
8260 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
8261 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
8262 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
8263 }
8264 else
8265 {
8266 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
8267 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
8268 }
8269 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
8270 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
8271 }
8272
8273 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8274}
8275
8276
8277/**
8278 * Implements the 16-bit version of 'BOUND'.
8279 *
8280 * @note We have separate 16-bit and 32-bit variants of this function due to
8281 * the decoder using unsigned parameters, whereas we want signed one to
8282 * do the job. This is significant for a recompiler.
8283 */
8284IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
8285{
8286 /*
8287 * Check if the index is inside the bounds, otherwise raise #BR.
8288 */
8289 if ( idxArray >= idxLowerBound
8290 && idxArray <= idxUpperBound)
8291 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8292 return iemRaiseBoundRangeExceeded(pVCpu);
8293}
8294
8295
8296/**
8297 * Implements the 32-bit version of 'BOUND'.
8298 */
8299IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
8300{
8301 /*
8302 * Check if the index is inside the bounds, otherwise raise #BR.
8303 */
8304 if ( idxArray >= idxLowerBound
8305 && idxArray <= idxUpperBound)
8306 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8307 return iemRaiseBoundRangeExceeded(pVCpu);
8308}
8309
8310
8311
8312/*
8313 * Instantiate the various string operation combinations.
8314 */
8315#define OP_SIZE 8
8316#define ADDR_SIZE 16
8317#include "IEMAllCImplStrInstr.cpp.h"
8318#define OP_SIZE 8
8319#define ADDR_SIZE 32
8320#include "IEMAllCImplStrInstr.cpp.h"
8321#define OP_SIZE 8
8322#define ADDR_SIZE 64
8323#include "IEMAllCImplStrInstr.cpp.h"
8324
8325#define OP_SIZE 16
8326#define ADDR_SIZE 16
8327#include "IEMAllCImplStrInstr.cpp.h"
8328#define OP_SIZE 16
8329#define ADDR_SIZE 32
8330#include "IEMAllCImplStrInstr.cpp.h"
8331#define OP_SIZE 16
8332#define ADDR_SIZE 64
8333#include "IEMAllCImplStrInstr.cpp.h"
8334
8335#define OP_SIZE 32
8336#define ADDR_SIZE 16
8337#include "IEMAllCImplStrInstr.cpp.h"
8338#define OP_SIZE 32
8339#define ADDR_SIZE 32
8340#include "IEMAllCImplStrInstr.cpp.h"
8341#define OP_SIZE 32
8342#define ADDR_SIZE 64
8343#include "IEMAllCImplStrInstr.cpp.h"
8344
8345#define OP_SIZE 64
8346#define ADDR_SIZE 32
8347#include "IEMAllCImplStrInstr.cpp.h"
8348#define OP_SIZE 64
8349#define ADDR_SIZE 64
8350#include "IEMAllCImplStrInstr.cpp.h"
8351
8352
8353/**
8354 * Implements 'XGETBV'.
8355 */
8356IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
8357{
8358 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
8359 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8360 {
8361 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8362 switch (uEcx)
8363 {
8364 case 0:
8365 break;
8366
8367 case 1: /** @todo Implement XCR1 support. */
8368 default:
8369 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
8370 return iemRaiseGeneralProtectionFault0(pVCpu);
8371
8372 }
8373 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8374 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8375 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
8376
8377 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8378 }
8379 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
8380 return iemRaiseUndefinedOpcode(pVCpu);
8381}
8382
8383
8384/**
8385 * Implements 'XSETBV'.
8386 */
8387IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
8388{
8389 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
8390 {
8391 /** @todo explain why this happens before the CPL check. */
8392 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
8393 { /* probable */ }
8394 else
8395 {
8396 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
8397 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
8398 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
8399 }
8400
8401 if (IEM_GET_CPL(pVCpu) == 0)
8402 {
8403 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
8404
8405 if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8406 { /* probable */ }
8407 else
8408 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
8409
8410 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
8411 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
8412 switch (uEcx)
8413 {
8414 case 0:
8415 {
8416 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
8417 if (rc == VINF_SUCCESS)
8418 break;
8419 Assert(rc == VERR_CPUM_RAISE_GP_0);
8420 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8421 return iemRaiseGeneralProtectionFault0(pVCpu);
8422 }
8423
8424 case 1: /** @todo Implement XCR1 support. */
8425 default:
8426 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
8427 return iemRaiseGeneralProtectionFault0(pVCpu);
8428
8429 }
8430
8431 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8432 }
8433
8434 Log(("xsetbv cpl=%u -> GP(0)\n", IEM_GET_CPL(pVCpu)));
8435 return iemRaiseGeneralProtectionFault0(pVCpu);
8436 }
8437 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
8438 return iemRaiseUndefinedOpcode(pVCpu);
8439}
8440
8441#ifndef RT_ARCH_ARM64
8442# ifdef IN_RING3
8443
8444/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
8445struct IEMCIMPLCX16ARGS
8446{
8447 PRTUINT128U pu128Dst;
8448 PRTUINT128U pu128RaxRdx;
8449 PRTUINT128U pu128RbxRcx;
8450 uint32_t *pEFlags;
8451# ifdef VBOX_STRICT
8452 uint32_t cCalls;
8453# endif
8454};
8455
8456/**
8457 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
8458 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
8459 */
8460static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPUCC pVCpu, void *pvUser)
8461{
8462 RT_NOREF(pVM, pVCpu);
8463 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
8464# ifdef VBOX_STRICT
8465 Assert(pArgs->cCalls == 0);
8466 pArgs->cCalls++;
8467# endif
8468
8469 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
8470 return VINF_SUCCESS;
8471}
8472
8473# endif /* IN_RING3 */
8474
8475/**
8476 * Implements 'CMPXCHG16B' fallback using rendezvous.
8477 */
8478IEM_CIMPL_DEF_5(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
8479 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags, uint8_t, bUnmapInfo)
8480{
8481# ifdef IN_RING3
8482 struct IEMCIMPLCX16ARGS Args;
8483 Args.pu128Dst = pu128Dst;
8484 Args.pu128RaxRdx = pu128RaxRdx;
8485 Args.pu128RbxRcx = pu128RbxRcx;
8486 Args.pEFlags = pEFlags;
8487# ifdef VBOX_STRICT
8488 Args.cCalls = 0;
8489# endif
8490 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
8491 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
8492 Assert(Args.cCalls == 1);
8493 if (rcStrict == VINF_SUCCESS)
8494 {
8495 /* Duplicated tail code. */
8496 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8497 if (rcStrict == VINF_SUCCESS)
8498 {
8499 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
8500 if (!(*pEFlags & X86_EFL_ZF))
8501 {
8502 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
8503 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
8504 }
8505 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8506 }
8507 }
8508 return rcStrict;
8509# else
8510 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags, bUnmapInfo);
8511 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
8512# endif
8513}
8514
8515#endif /* RT_ARCH_ARM64 */
8516
8517/**
8518 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
8519 *
8520 * This is implemented in C because it triggers a load like behaviour without
8521 * actually reading anything. Since that's not so common, it's implemented
8522 * here.
8523 *
8524 * @param iEffSeg The effective segment.
8525 * @param GCPtrEff The address of the image.
8526 */
8527IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8528{
8529 /*
8530 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
8531 */
8532 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
8533 if (rcStrict == VINF_SUCCESS)
8534 {
8535 RTGCPHYS GCPhysMem;
8536 /** @todo access size. */
8537 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
8538 if (rcStrict == VINF_SUCCESS)
8539 {
8540#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8541 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8542 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
8543 { /* probable */ }
8544 else
8545 {
8546 /*
8547 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
8548 * that contains the address. However, if the address falls in the APIC-access
8549 * page, the address flushed must instead be the corresponding address in the
8550 * virtual-APIC page.
8551 *
8552 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
8553 */
8554 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem, 1, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA);
8555 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
8556 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
8557 return rcStrict;
8558 }
8559#endif
8560 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8561 }
8562 }
8563
8564 return rcStrict;
8565}
8566
8567
8568/**
8569 * Implements 'FINIT' and 'FNINIT'.
8570 *
8571 * @param fCheckXcpts Whether to check for umasked pending exceptions or
8572 * not.
8573 */
8574IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
8575{
8576 /*
8577 * Exceptions.
8578 */
8579 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
8580 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
8581 return iemRaiseDeviceNotAvailable(pVCpu);
8582
8583 iemFpuActualizeStateForChange(pVCpu);
8584 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
8585
8586 /* FINIT: Raise #MF on pending exception(s): */
8587 if (fCheckXcpts && (pVCpu->cpum.GstCtx.XState.x87.FSW & X86_FSW_ES))
8588 return iemRaiseMathFault(pVCpu);
8589
8590 /*
8591 * Reset the state.
8592 */
8593 PX86XSAVEAREA pXState = &pVCpu->cpum.GstCtx.XState;
8594
8595 /* Rotate the stack to account for changed TOS. */
8596 iemFpuRotateStackSetTop(&pXState->x87, 0);
8597
8598 pXState->x87.FCW = 0x37f;
8599 pXState->x87.FSW = 0;
8600 pXState->x87.FTW = 0x00; /* 0 - empty. */
8601 /** @todo Intel says the instruction and data pointers are not cleared on
8602 * 387, presume that 8087 and 287 doesn't do so either. */
8603 /** @todo test this stuff. */
8604 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
8605 {
8606 pXState->x87.FPUDP = 0;
8607 pXState->x87.DS = 0; //??
8608 pXState->x87.Rsrvd2 = 0;
8609 pXState->x87.FPUIP = 0;
8610 pXState->x87.CS = 0; //??
8611 pXState->x87.Rsrvd1 = 0;
8612 }
8613 pXState->x87.FOP = 0;
8614
8615 iemHlpUsedFpu(pVCpu);
8616 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8617}
8618
8619
8620/**
8621 * Implements 'FXSAVE'.
8622 *
8623 * @param iEffSeg The effective segment.
8624 * @param GCPtrEff The address of the image.
8625 * @param enmEffOpSize The operand size (only REX.W really matters).
8626 */
8627IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8628{
8629 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8630
8631 /** @todo check out bugref{1529} and AMD behaviour */
8632
8633 /*
8634 * Raise exceptions.
8635 */
8636 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8637 return iemRaiseDeviceNotAvailable(pVCpu);
8638
8639 /*
8640 * Access the memory.
8641 */
8642 uint8_t bUnmapInfo;
8643 void *pvMem512;
8644 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512,
8645 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8646 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8647 if (rcStrict != VINF_SUCCESS)
8648 return rcStrict;
8649 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8650 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8651
8652 /*
8653 * Store the registers.
8654 */
8655 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8656 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
8657
8658 /* common for all formats */
8659 pDst->FCW = pSrc->FCW;
8660 pDst->FSW = pSrc->FSW;
8661 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8662 pDst->FOP = pSrc->FOP;
8663 pDst->MXCSR = pSrc->MXCSR;
8664 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8665 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8666 {
8667 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8668 * them for now... */
8669 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8670 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8671 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8672 pDst->aRegs[i].au32[3] = 0;
8673 }
8674
8675 /* FPU IP, CS, DP and DS. */
8676 pDst->FPUIP = pSrc->FPUIP;
8677 pDst->CS = pSrc->CS;
8678 pDst->FPUDP = pSrc->FPUDP;
8679 pDst->DS = pSrc->DS;
8680 if (enmEffOpSize == IEMMODE_64BIT)
8681 {
8682 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8683 pDst->Rsrvd1 = pSrc->Rsrvd1;
8684 pDst->Rsrvd2 = pSrc->Rsrvd2;
8685 }
8686 else
8687 {
8688 pDst->Rsrvd1 = 0;
8689 pDst->Rsrvd2 = 0;
8690 }
8691
8692 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set. */
8693 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8694 || !IEM_IS_64BIT_CODE(pVCpu)
8695 || IEM_GET_CPL(pVCpu) != 0)
8696 {
8697 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8698 for (uint32_t i = 0; i < cXmmRegs; i++)
8699 pDst->aXMM[i] = pSrc->aXMM[i];
8700 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8701 * right? */
8702 }
8703
8704 /*
8705 * Commit the memory.
8706 */
8707 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8708 if (rcStrict != VINF_SUCCESS)
8709 return rcStrict;
8710
8711 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8712}
8713
8714
8715/**
8716 * Implements 'FXRSTOR'.
8717 *
8718 * @param iEffSeg The effective segment register for @a GCPtrEff.
8719 * @param GCPtrEff The address of the image.
8720 * @param enmEffOpSize The operand size (only REX.W really matters).
8721 */
8722IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8723{
8724 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8725
8726 /** @todo check out bugref{1529} and AMD behaviour */
8727
8728 /*
8729 * Raise exceptions.
8730 */
8731 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8732 return iemRaiseDeviceNotAvailable(pVCpu);
8733
8734 /*
8735 * Access the memory.
8736 */
8737 uint8_t bUnmapInfo;
8738 void *pvMem512;
8739 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
8740 15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8741 if (rcStrict != VINF_SUCCESS)
8742 return rcStrict;
8743 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8744 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
8745
8746 /*
8747 * Check the state for stuff which will #GP(0).
8748 */
8749 uint32_t const fMXCSR = pSrc->MXCSR;
8750 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8751 if (fMXCSR & ~fMXCSR_MASK)
8752 {
8753 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8754 return iemRaiseGeneralProtectionFault0(pVCpu);
8755 }
8756
8757 /*
8758 * Load the registers.
8759 */
8760 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8761 * implementation specific whether MXCSR and XMM0-XMM7 are
8762 * restored according to Intel.
8763 * AMD says MXCSR and XMM registers are never loaded if
8764 * CR4.OSFXSR=0.
8765 */
8766
8767 /* common for all formats */
8768 pDst->FCW = pSrc->FCW;
8769 pDst->FSW = pSrc->FSW;
8770 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8771 pDst->FOP = pSrc->FOP;
8772 pDst->MXCSR = fMXCSR;
8773 /* (MXCSR_MASK is read-only) */
8774 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8775 {
8776 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8777 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8778 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8779 pDst->aRegs[i].au32[3] = 0;
8780 }
8781
8782 /* FPU IP, CS, DP and DS. */
8783 /** @todo AMD says this is only done if FSW.ES is set after loading. */
8784 if (enmEffOpSize == IEMMODE_64BIT)
8785 {
8786 pDst->FPUIP = pSrc->FPUIP;
8787 pDst->CS = pSrc->CS;
8788 pDst->Rsrvd1 = pSrc->Rsrvd1;
8789 pDst->FPUDP = pSrc->FPUDP;
8790 pDst->DS = pSrc->DS;
8791 pDst->Rsrvd2 = pSrc->Rsrvd2;
8792 }
8793 else
8794 {
8795 pDst->FPUIP = pSrc->FPUIP;
8796 pDst->CS = pSrc->CS;
8797 pDst->Rsrvd1 = 0;
8798 pDst->FPUDP = pSrc->FPUDP;
8799 pDst->DS = pSrc->DS;
8800 pDst->Rsrvd2 = 0;
8801 }
8802
8803 /* XMM registers. Skipped in 64-bit CPL0 if EFER.FFXSR (AMD only) is set.
8804 * Does not affect MXCSR, only registers.
8805 */
8806 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8807 || !IEM_IS_64BIT_CODE(pVCpu)
8808 || IEM_GET_CPL(pVCpu) != 0)
8809 {
8810 uint32_t cXmmRegs = IEM_IS_64BIT_CODE(pVCpu) ? 16 : 8;
8811 for (uint32_t i = 0; i < cXmmRegs; i++)
8812 pDst->aXMM[i] = pSrc->aXMM[i];
8813 }
8814
8815 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
8816 iemFpuRecalcExceptionStatus(pDst);
8817
8818 if (pDst->FSW & X86_FSW_ES)
8819 Log11(("fxrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
8820 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
8821
8822 /*
8823 * Unmap the memory.
8824 */
8825 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
8826 if (rcStrict != VINF_SUCCESS)
8827 return rcStrict;
8828
8829 iemHlpUsedFpu(pVCpu);
8830 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8831}
8832
8833
8834/**
8835 * Implements 'XSAVE'.
8836 *
8837 * @param iEffSeg The effective segment.
8838 * @param GCPtrEff The address of the image.
8839 * @param enmEffOpSize The operand size (only REX.W really matters).
8840 */
8841IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8842{
8843 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8844
8845 /*
8846 * Raise exceptions.
8847 */
8848 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8849 return iemRaiseUndefinedOpcode(pVCpu);
8850 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8851 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8852 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
8853 { /* likely */ }
8854 else
8855 {
8856 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8857 return iemRaiseUndefinedOpcode(pVCpu);
8858 }
8859 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8860 return iemRaiseDeviceNotAvailable(pVCpu);
8861
8862 /*
8863 * Calc the requested mask.
8864 */
8865 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8866 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8867 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8868
8869/** @todo figure out the exact protocol for the memory access. Currently we
8870 * just need this crap to work halfways to make it possible to test
8871 * AVX instructions. */
8872/** @todo figure out the XINUSE and XMODIFIED */
8873
8874 /*
8875 * Access the x87 memory state.
8876 */
8877 /* The x87+SSE state. */
8878 uint8_t bUnmapInfoMem512;
8879 void *pvMem512;
8880 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512,
8881 iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
8882 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
8883 if (rcStrict != VINF_SUCCESS)
8884 return rcStrict;
8885 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8886 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.XState.x87;
8887
8888 /* The header. */
8889 uint8_t bUnmapInfoHdr;
8890 PX86XSAVEHDR pHdr;
8891 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, &bUnmapInfoHdr, sizeof(pHdr),
8892 iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
8893 if (rcStrict != VINF_SUCCESS)
8894 return rcStrict;
8895
8896 /*
8897 * Store the X87 state.
8898 */
8899 if (fReqComponents & XSAVE_C_X87)
8900 {
8901 /* common for all formats */
8902 pDst->FCW = pSrc->FCW;
8903 pDst->FSW = pSrc->FSW;
8904 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8905 pDst->FOP = pSrc->FOP;
8906 pDst->FPUIP = pSrc->FPUIP;
8907 pDst->CS = pSrc->CS;
8908 pDst->FPUDP = pSrc->FPUDP;
8909 pDst->DS = pSrc->DS;
8910 if (enmEffOpSize == IEMMODE_64BIT)
8911 {
8912 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8913 pDst->Rsrvd1 = pSrc->Rsrvd1;
8914 pDst->Rsrvd2 = pSrc->Rsrvd2;
8915 }
8916 else
8917 {
8918 pDst->Rsrvd1 = 0;
8919 pDst->Rsrvd2 = 0;
8920 }
8921 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8922 {
8923 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8924 * them for now... */
8925 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8926 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8927 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8928 pDst->aRegs[i].au32[3] = 0;
8929 }
8930
8931 }
8932
8933 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8934 {
8935 pDst->MXCSR = pSrc->MXCSR;
8936 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8937 }
8938
8939 if (fReqComponents & XSAVE_C_SSE)
8940 {
8941 /* XMM registers. */
8942 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8943 for (uint32_t i = 0; i < cXmmRegs; i++)
8944 pDst->aXMM[i] = pSrc->aXMM[i];
8945 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8946 * right? */
8947 }
8948
8949 /* Commit the x87 state bits. (probably wrong) */
8950 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
8951 if (rcStrict != VINF_SUCCESS)
8952 return rcStrict;
8953
8954 /*
8955 * Store AVX state.
8956 */
8957 if (fReqComponents & XSAVE_C_YMM)
8958 {
8959 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8960 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8961 uint8_t bUnmapInfoComp;
8962 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8963 PX86XSAVEYMMHI pCompDst;
8964 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, &bUnmapInfoComp, sizeof(*pCompDst), iEffSeg,
8965 GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8966 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
8967 if (rcStrict != VINF_SUCCESS)
8968 return rcStrict;
8969
8970 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8971 for (uint32_t i = 0; i < cXmmRegs; i++)
8972 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8973
8974 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
8975 if (rcStrict != VINF_SUCCESS)
8976 return rcStrict;
8977 }
8978
8979 /*
8980 * Update the header.
8981 */
8982 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8983 | (fReqComponents & fXInUse);
8984
8985 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
8986 if (rcStrict != VINF_SUCCESS)
8987 return rcStrict;
8988
8989 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8990}
8991
8992
8993/**
8994 * Implements 'XRSTOR'.
8995 *
8996 * @param iEffSeg The effective segment.
8997 * @param GCPtrEff The address of the image.
8998 * @param enmEffOpSize The operand size (only REX.W really matters).
8999 */
9000IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
9001{
9002 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
9003
9004 /*
9005 * Raise exceptions.
9006 */
9007 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9008 return iemRaiseUndefinedOpcode(pVCpu);
9009 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
9010 if (RT_LIKELY( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9011 || IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS)))
9012 { /* likely */ }
9013 else
9014 {
9015 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
9016 return iemRaiseUndefinedOpcode(pVCpu);
9017 }
9018 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
9019 return iemRaiseDeviceNotAvailable(pVCpu);
9020 if (GCPtrEff & 63)
9021 {
9022 /** @todo CPU/VM detection possible! \#AC might not be signal for
9023 * all/any misalignment sizes, intel says its an implementation detail. */
9024 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
9025 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
9026 && IEM_GET_CPL(pVCpu) == 3)
9027 return iemRaiseAlignmentCheckException(pVCpu);
9028 return iemRaiseGeneralProtectionFault0(pVCpu);
9029 }
9030
9031/** @todo figure out the exact protocol for the memory access. Currently we
9032 * just need this crap to work halfways to make it possible to test
9033 * AVX instructions. */
9034/** @todo figure out the XINUSE and XMODIFIED */
9035
9036 /*
9037 * Access the x87 memory state.
9038 */
9039 /* The x87+SSE state. */
9040 uint8_t bUnmapInfoMem512;
9041 void *pvMem512;
9042 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
9043 63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
9044 if (rcStrict != VINF_SUCCESS)
9045 return rcStrict;
9046 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
9047 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.XState.x87;
9048
9049 /*
9050 * Calc the requested mask
9051 */
9052 uint8_t bUnmapInfoHdr;
9053 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
9054 PCX86XSAVEHDR pHdrSrc;
9055 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, &bUnmapInfoHdr, sizeof(*pHdrSrc), iEffSeg, GCPtrEff + 512,
9056 IEM_ACCESS_DATA_R, 0 /* checked above */);
9057 if (rcStrict != VINF_SUCCESS)
9058 return rcStrict;
9059
9060 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
9061 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9062 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
9063 uint64_t const fRstorMask = pHdrSrc->bmXState;
9064 uint64_t const fCompMask = pHdrSrc->bmXComp;
9065
9066 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9067
9068 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
9069
9070 /* We won't need this any longer. */
9071 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
9072 if (rcStrict != VINF_SUCCESS)
9073 return rcStrict;
9074
9075 /*
9076 * Load the X87 state.
9077 */
9078 if (fReqComponents & XSAVE_C_X87)
9079 {
9080 if (fRstorMask & XSAVE_C_X87)
9081 {
9082 pDst->FCW = pSrc->FCW;
9083 pDst->FSW = pSrc->FSW;
9084 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
9085 pDst->FOP = pSrc->FOP;
9086 pDst->FPUIP = pSrc->FPUIP;
9087 pDst->CS = pSrc->CS;
9088 pDst->FPUDP = pSrc->FPUDP;
9089 pDst->DS = pSrc->DS;
9090 if (enmEffOpSize == IEMMODE_64BIT)
9091 {
9092 /* Load upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
9093 pDst->Rsrvd1 = pSrc->Rsrvd1;
9094 pDst->Rsrvd2 = pSrc->Rsrvd2;
9095 }
9096 else
9097 {
9098 pDst->Rsrvd1 = 0;
9099 pDst->Rsrvd2 = 0;
9100 }
9101 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
9102 {
9103 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
9104 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
9105 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
9106 pDst->aRegs[i].au32[3] = 0;
9107 }
9108
9109 pDst->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9110 iemFpuRecalcExceptionStatus(pDst);
9111
9112 if (pDst->FSW & X86_FSW_ES)
9113 Log11(("xrstor: %04x:%08RX64: loading state with pending FPU exception (FSW=%#x)\n",
9114 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pSrc->FSW));
9115 }
9116 else
9117 {
9118 pDst->FCW = 0x37f;
9119 pDst->FSW = 0;
9120 pDst->FTW = 0x00; /* 0 - empty. */
9121 pDst->FPUDP = 0;
9122 pDst->DS = 0; //??
9123 pDst->Rsrvd2= 0;
9124 pDst->FPUIP = 0;
9125 pDst->CS = 0; //??
9126 pDst->Rsrvd1= 0;
9127 pDst->FOP = 0;
9128 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
9129 {
9130 pDst->aRegs[i].au32[0] = 0;
9131 pDst->aRegs[i].au32[1] = 0;
9132 pDst->aRegs[i].au32[2] = 0;
9133 pDst->aRegs[i].au32[3] = 0;
9134 }
9135 }
9136 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
9137 }
9138
9139 /* MXCSR */
9140 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
9141 {
9142 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
9143 pDst->MXCSR = pSrc->MXCSR;
9144 else
9145 pDst->MXCSR = 0x1f80;
9146 }
9147
9148 /* XMM registers. */
9149 if (fReqComponents & XSAVE_C_SSE)
9150 {
9151 if (fRstorMask & XSAVE_C_SSE)
9152 {
9153 for (uint32_t i = 0; i < cXmmRegs; i++)
9154 pDst->aXMM[i] = pSrc->aXMM[i];
9155 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
9156 * right? */
9157 }
9158 else
9159 {
9160 for (uint32_t i = 0; i < cXmmRegs; i++)
9161 {
9162 pDst->aXMM[i].au64[0] = 0;
9163 pDst->aXMM[i].au64[1] = 0;
9164 }
9165 }
9166 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
9167 }
9168
9169 /* Unmap the x87 state bits (so we've don't run out of mapping). */
9170 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
9171 if (rcStrict != VINF_SUCCESS)
9172 return rcStrict;
9173
9174 /*
9175 * Restore AVX state.
9176 */
9177 if (fReqComponents & XSAVE_C_YMM)
9178 {
9179 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
9180 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
9181
9182 if (fRstorMask & XSAVE_C_YMM)
9183 {
9184 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
9185 uint8_t bUnmapInfoComp;
9186 PCX86XSAVEYMMHI pCompSrc;
9187 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, &bUnmapInfoComp, sizeof(*pCompDst),
9188 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
9189 IEM_ACCESS_DATA_R, 0 /* checked above */);
9190 if (rcStrict != VINF_SUCCESS)
9191 return rcStrict;
9192
9193 for (uint32_t i = 0; i < cXmmRegs; i++)
9194 {
9195 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
9196 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
9197 }
9198
9199 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
9200 if (rcStrict != VINF_SUCCESS)
9201 return rcStrict;
9202 }
9203 else
9204 {
9205 for (uint32_t i = 0; i < cXmmRegs; i++)
9206 {
9207 pCompDst->aYmmHi[i].au64[0] = 0;
9208 pCompDst->aYmmHi[i].au64[1] = 0;
9209 }
9210 }
9211 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
9212 }
9213
9214 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9215}
9216
9217
9218
9219
9220/**
9221 * Implements 'STMXCSR'.
9222 *
9223 * @param iEffSeg The effective segment register for @a GCPtrEff.
9224 * @param GCPtrEff The address of the image.
9225 */
9226IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9227{
9228 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9229
9230 /*
9231 * Raise exceptions.
9232 */
9233 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9234 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9235 {
9236 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9237 {
9238 /*
9239 * Do the job.
9240 */
9241 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9242 if (rcStrict == VINF_SUCCESS)
9243 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9244 return rcStrict;
9245 }
9246 return iemRaiseDeviceNotAvailable(pVCpu);
9247 }
9248 return iemRaiseUndefinedOpcode(pVCpu);
9249}
9250
9251
9252/**
9253 * Implements 'VSTMXCSR'.
9254 *
9255 * @param iEffSeg The effective segment register for @a GCPtrEff.
9256 * @param GCPtrEff The address of the image.
9257 */
9258IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9259{
9260 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
9261
9262 /*
9263 * Raise exceptions.
9264 */
9265 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
9266 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
9267 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
9268 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
9269 {
9270 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9271 {
9272 /*
9273 * Do the job.
9274 */
9275 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.XState.x87.MXCSR);
9276 if (rcStrict == VINF_SUCCESS)
9277 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9278 return rcStrict;
9279 }
9280 return iemRaiseDeviceNotAvailable(pVCpu);
9281 }
9282 return iemRaiseUndefinedOpcode(pVCpu);
9283}
9284
9285
9286/**
9287 * Implements 'LDMXCSR'.
9288 *
9289 * @param iEffSeg The effective segment register for @a GCPtrEff.
9290 * @param GCPtrEff The address of the image.
9291 */
9292IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
9293{
9294 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
9295
9296 /*
9297 * Raise exceptions.
9298 */
9299 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
9300 * happen after or before \#UD and \#EM? */
9301 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
9302 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
9303 {
9304 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
9305 {
9306 /*
9307 * Do the job.
9308 */
9309 uint32_t fNewMxCsr;
9310 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
9311 if (rcStrict == VINF_SUCCESS)
9312 {
9313 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
9314 if (!(fNewMxCsr & ~fMxCsrMask))
9315 {
9316 pVCpu->cpum.GstCtx.XState.x87.MXCSR = fNewMxCsr;
9317 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9318 }
9319 Log(("ldmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
9320 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
9321 return iemRaiseGeneralProtectionFault0(pVCpu);
9322 }
9323 return rcStrict;
9324 }
9325 return iemRaiseDeviceNotAvailable(pVCpu);
9326 }
9327 return iemRaiseUndefinedOpcode(pVCpu);
9328}
9329
9330
9331/**
9332 * Commmon routine for fnstenv and fnsave.
9333 *
9334 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9335 * @param enmEffOpSize The effective operand size.
9336 * @param uPtr Where to store the state.
9337 */
9338static void iemCImplCommonFpuStoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
9339{
9340 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9341 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.XState.x87;
9342 if (enmEffOpSize == IEMMODE_16BIT)
9343 {
9344 uPtr.pu16[0] = pSrcX87->FCW;
9345 uPtr.pu16[1] = pSrcX87->FSW;
9346 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
9347 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9348 {
9349 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
9350 * protected mode or long mode and we save it in real mode? And vice
9351 * versa? And with 32-bit operand size? I think CPU is storing the
9352 * effective address ((CS << 4) + IP) in the offset register and not
9353 * doing any address calculations here. */
9354 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
9355 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
9356 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
9357 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
9358 }
9359 else
9360 {
9361 uPtr.pu16[3] = pSrcX87->FPUIP;
9362 uPtr.pu16[4] = pSrcX87->CS;
9363 uPtr.pu16[5] = pSrcX87->FPUDP;
9364 uPtr.pu16[6] = pSrcX87->DS;
9365 }
9366 }
9367 else
9368 {
9369 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
9370 uPtr.pu16[0*2] = pSrcX87->FCW;
9371 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
9372 uPtr.pu16[1*2] = pSrcX87->FSW;
9373 uPtr.pu16[1*2+1] = 0xffff;
9374 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
9375 uPtr.pu16[2*2+1] = 0xffff;
9376 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9377 {
9378 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
9379 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
9380 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
9381 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
9382 }
9383 else
9384 {
9385 uPtr.pu32[3] = pSrcX87->FPUIP;
9386 uPtr.pu16[4*2] = pSrcX87->CS;
9387 uPtr.pu16[4*2+1] = pSrcX87->FOP;
9388 uPtr.pu32[5] = pSrcX87->FPUDP;
9389 uPtr.pu16[6*2] = pSrcX87->DS;
9390 uPtr.pu16[6*2+1] = 0xffff;
9391 }
9392 }
9393}
9394
9395
9396/**
9397 * Commmon routine for fldenv and frstor
9398 *
9399 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9400 * @param enmEffOpSize The effective operand size.
9401 * @param uPtr Where to store the state.
9402 */
9403static void iemCImplCommonFpuRestoreEnv(PVMCPUCC pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
9404{
9405 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9406 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.XState.x87;
9407 if (enmEffOpSize == IEMMODE_16BIT)
9408 {
9409 pDstX87->FCW = uPtr.pu16[0];
9410 pDstX87->FSW = uPtr.pu16[1];
9411 pDstX87->FTW = uPtr.pu16[2];
9412 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9413 {
9414 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
9415 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
9416 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
9417 pDstX87->CS = 0;
9418 pDstX87->Rsrvd1= 0;
9419 pDstX87->DS = 0;
9420 pDstX87->Rsrvd2= 0;
9421 }
9422 else
9423 {
9424 pDstX87->FPUIP = uPtr.pu16[3];
9425 pDstX87->CS = uPtr.pu16[4];
9426 pDstX87->Rsrvd1= 0;
9427 pDstX87->FPUDP = uPtr.pu16[5];
9428 pDstX87->DS = uPtr.pu16[6];
9429 pDstX87->Rsrvd2= 0;
9430 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
9431 }
9432 }
9433 else
9434 {
9435 pDstX87->FCW = uPtr.pu16[0*2];
9436 pDstX87->FSW = uPtr.pu16[1*2];
9437 pDstX87->FTW = uPtr.pu16[2*2];
9438 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
9439 {
9440 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
9441 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
9442 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
9443 pDstX87->CS = 0;
9444 pDstX87->Rsrvd1= 0;
9445 pDstX87->DS = 0;
9446 pDstX87->Rsrvd2= 0;
9447 }
9448 else
9449 {
9450 pDstX87->FPUIP = uPtr.pu32[3];
9451 pDstX87->CS = uPtr.pu16[4*2];
9452 pDstX87->Rsrvd1= 0;
9453 pDstX87->FOP = uPtr.pu16[4*2+1];
9454 pDstX87->FPUDP = uPtr.pu32[5];
9455 pDstX87->DS = uPtr.pu16[6*2];
9456 pDstX87->Rsrvd2= 0;
9457 }
9458 }
9459
9460 /* Make adjustments. */
9461 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
9462#ifdef LOG_ENABLED
9463 uint16_t const fOldFsw = pDstX87->FSW;
9464#endif
9465 pDstX87->FCW &= ~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK; /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9466 iemFpuRecalcExceptionStatus(pDstX87);
9467#ifdef LOG_ENABLED
9468 if ((pDstX87->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9469 Log11(("iemCImplCommonFpuRestoreEnv: %04x:%08RX64: %s FPU exception (FCW=%#x FSW=%#x -> %#x)\n",
9470 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fOldFsw & X86_FSW_ES ? "Supressed" : "Raised",
9471 pDstX87->FCW, fOldFsw, pDstX87->FSW));
9472#endif
9473
9474 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
9475 * exceptions are pending after loading the saved state? */
9476}
9477
9478
9479/**
9480 * Implements 'FNSTENV'.
9481 *
9482 * @param enmEffOpSize The operand size (only REX.W really matters).
9483 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9484 * @param GCPtrEffDst The address of the image.
9485 */
9486IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9487{
9488 uint8_t bUnmapInfo;
9489 RTPTRUNION uPtr;
9490 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9491 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
9492 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
9493 if (rcStrict != VINF_SUCCESS)
9494 return rcStrict;
9495
9496 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9497
9498 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9499 if (rcStrict != VINF_SUCCESS)
9500 return rcStrict;
9501
9502 /* Mask all math exceptions. Any possibly pending exceptions will be cleared. */
9503 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9504 pFpuCtx->FCW |= X86_FCW_XCPT_MASK;
9505#ifdef LOG_ENABLED
9506 uint16_t fOldFsw = pFpuCtx->FSW;
9507#endif
9508 iemFpuRecalcExceptionStatus(pFpuCtx);
9509#ifdef LOG_ENABLED
9510 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9511 Log11(("fnstenv: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9512 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9513#endif
9514
9515 iemHlpUsedFpu(pVCpu);
9516
9517 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9518 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9519}
9520
9521
9522/**
9523 * Implements 'FNSAVE'.
9524 *
9525 * @param enmEffOpSize The operand size.
9526 * @param iEffSeg The effective segment register for @a GCPtrEffDst.
9527 * @param GCPtrEffDst The address of the image.
9528 */
9529IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
9530{
9531 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9532
9533 uint8_t bUnmapInfo;
9534 RTPTRUNION uPtr;
9535 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9536 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
9537 if (rcStrict != VINF_SUCCESS)
9538 return rcStrict;
9539
9540 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9541 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
9542 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9543 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9544 {
9545 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
9546 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
9547 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
9548 }
9549
9550 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9551 if (rcStrict != VINF_SUCCESS)
9552 return rcStrict;
9553
9554 /* Rotate the stack to account for changed TOS. */
9555 iemFpuRotateStackSetTop(pFpuCtx, 0);
9556
9557 /*
9558 * Re-initialize the FPU context.
9559 */
9560 pFpuCtx->FCW = 0x37f;
9561 pFpuCtx->FSW = 0;
9562 pFpuCtx->FTW = 0x00; /* 0 - empty */
9563 pFpuCtx->FPUDP = 0;
9564 pFpuCtx->DS = 0;
9565 pFpuCtx->Rsrvd2= 0;
9566 pFpuCtx->FPUIP = 0;
9567 pFpuCtx->CS = 0;
9568 pFpuCtx->Rsrvd1= 0;
9569 pFpuCtx->FOP = 0;
9570
9571 iemHlpUsedFpu(pVCpu);
9572 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9573}
9574
9575
9576
9577/**
9578 * Implements 'FLDENV'.
9579 *
9580 * @param enmEffOpSize The operand size (only REX.W really matters).
9581 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9582 * @param GCPtrEffSrc The address of the image.
9583 */
9584IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9585{
9586 uint8_t bUnmapInfo;
9587 RTCPTRUNION uPtr;
9588 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
9589 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
9590 enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
9591 if (rcStrict != VINF_SUCCESS)
9592 return rcStrict;
9593
9594 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9595
9596 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9597 if (rcStrict != VINF_SUCCESS)
9598 return rcStrict;
9599
9600 iemHlpUsedFpu(pVCpu);
9601 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9602}
9603
9604
9605/**
9606 * Implements 'FRSTOR'.
9607 *
9608 * @param enmEffOpSize The operand size.
9609 * @param iEffSeg The effective segment register for @a GCPtrEffSrc.
9610 * @param GCPtrEffSrc The address of the image.
9611 */
9612IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
9613{
9614 uint8_t bUnmapInfo;
9615 RTCPTRUNION uPtr;
9616 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
9617 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
9618 if (rcStrict != VINF_SUCCESS)
9619 return rcStrict;
9620
9621 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9622 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
9623 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
9624 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
9625 {
9626 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
9627 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
9628 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
9629 pFpuCtx->aRegs[i].au32[3] = 0;
9630 }
9631
9632 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9633 if (rcStrict != VINF_SUCCESS)
9634 return rcStrict;
9635
9636 iemHlpUsedFpu(pVCpu);
9637 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9638}
9639
9640
9641/**
9642 * Implements 'FLDCW'.
9643 *
9644 * @param u16Fcw The new FCW.
9645 */
9646IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
9647{
9648 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9649
9650 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
9651 /** @todo Testcase: Try see what happens when trying to set undefined bits
9652 * (other than 6 and 7). Currently ignoring them. */
9653 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
9654 * according to FSW. (This is what is currently implemented.) */
9655 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9656 pFpuCtx->FCW = u16Fcw & (~X86_FCW_ZERO_MASK | X86_FCW_IC_MASK); /* Intel 10980xe allows setting the IC bit. Win 3.11 CALC.EXE sets it. */
9657#ifdef LOG_ENABLED
9658 uint16_t fOldFsw = pFpuCtx->FSW;
9659#endif
9660 iemFpuRecalcExceptionStatus(pFpuCtx);
9661#ifdef LOG_ENABLED
9662 if ((pFpuCtx->FSW & X86_FSW_ES) ^ (fOldFsw & X86_FSW_ES))
9663 Log11(("fldcw: %04x:%08RX64: %s FPU exception (FCW=%#x, FSW %#x -> %#x)\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
9664 fOldFsw & X86_FSW_ES ? "Supressed" : "Raised", pFpuCtx->FCW, fOldFsw, pFpuCtx->FSW));
9665#endif
9666
9667 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
9668 iemHlpUsedFpu(pVCpu);
9669 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9670}
9671
9672
9673
9674/**
9675 * Implements the underflow case of fxch.
9676 *
9677 * @param iStReg The other stack register.
9678 * @param uFpuOpcode The FPU opcode (for simplicity).
9679 */
9680IEM_CIMPL_DEF_2(iemCImpl_fxch_underflow, uint8_t, iStReg, uint16_t, uFpuOpcode)
9681{
9682 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9683
9684 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9685 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
9686 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9687 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
9688
9689 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
9690 * registers are read as QNaN and then exchanged. This could be
9691 * wrong... */
9692 if (pFpuCtx->FCW & X86_FCW_IM)
9693 {
9694 if (RT_BIT(iReg1) & pFpuCtx->FTW)
9695 {
9696 if (RT_BIT(iReg2) & pFpuCtx->FTW)
9697 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9698 else
9699 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
9700 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
9701 }
9702 else
9703 {
9704 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
9705 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
9706 }
9707 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
9708 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
9709 }
9710 else
9711 {
9712 /* raise underflow exception, don't change anything. */
9713 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
9714 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9715 Log11(("fxch: %04x:%08RX64: Underflow exception (FSW=%#x)\n",
9716 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9717 }
9718
9719 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, uFpuOpcode);
9720 iemHlpUsedFpu(pVCpu);
9721 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9722}
9723
9724
9725/**
9726 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9727 *
9728 * @param iStReg The other stack register.
9729 * @param fUCmp true for FUCOMI[P], false for FCOMI[P].
9730 * @param uPopAndFpuOpcode Bits 15-0: The FPU opcode.
9731 * Bit 31: Whether we should pop the stack when
9732 * done or not.
9733 */
9734IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, bool, fUCmp, uint32_t, uPopAndFpuOpcode)
9735{
9736 Assert(iStReg < 8);
9737 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9738
9739 /*
9740 * Raise exceptions.
9741 */
9742 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9743 return iemRaiseDeviceNotAvailable(pVCpu);
9744
9745 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
9746 uint16_t u16Fsw = pFpuCtx->FSW;
9747 if (u16Fsw & X86_FSW_ES)
9748 return iemRaiseMathFault(pVCpu);
9749
9750 /*
9751 * Check if any of the register accesses causes #SF + #IA.
9752 */
9753 bool fPop = RT_BOOL(uPopAndFpuOpcode & RT_BIT_32(31));
9754 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9755 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9756 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9757 {
9758 uint32_t u32Eflags;
9759 if (!fUCmp)
9760 u32Eflags = iemAImpl_fcomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9761 else
9762 u32Eflags = iemAImpl_fucomi_r80_by_r80(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9763
9764 pFpuCtx->FSW &= ~X86_FSW_C1;
9765 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9766 if ( !(u16Fsw & X86_FSW_IE)
9767 || (pFpuCtx->FCW & X86_FCW_IM) )
9768 {
9769 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9770 pVCpu->cpum.GstCtx.eflags.u |= u32Eflags & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9771 }
9772 }
9773 else if (pFpuCtx->FCW & X86_FCW_IM)
9774 {
9775 /* Masked underflow. */
9776 pFpuCtx->FSW &= ~X86_FSW_C1;
9777 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9778 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9779 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9780 }
9781 else
9782 {
9783 /* Raise underflow - don't touch EFLAGS or TOP. */
9784 pFpuCtx->FSW &= ~X86_FSW_C1;
9785 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9786 Log11(("fxch: %04x:%08RX64: Raising IE+SF exception (FSW=%#x)\n",
9787 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pFpuCtx->FSW));
9788 fPop = false;
9789 }
9790
9791 /*
9792 * Pop if necessary.
9793 */
9794 if (fPop)
9795 {
9796 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9797 iemFpuStackIncTop(pVCpu);
9798 }
9799
9800 iemFpuUpdateOpcodeAndIpWorkerEx(pVCpu, pFpuCtx, (uint16_t)uPopAndFpuOpcode);
9801 iemHlpUsedFpu(pVCpu);
9802 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9803}
9804
9805
9806/**
9807 * Implements 'RDSEED'.
9808 *
9809 * @returns VINF_SUCCESS.
9810 * @param iReg The register.
9811 * @param enmEffOpSize The operand size.
9812 */
9813IEM_CIMPL_DEF_2(iemCImpl_rdseed, uint8_t, iReg, IEMMODE, enmEffOpSize)
9814{
9815#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9816 /* Nested-guest VMX intercept. */
9817 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9818 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDSEED_EXIT))
9819 { /* probable */ }
9820 else
9821 {
9822 Log(("rdseed: Guest intercept -> VM-exit\n"));
9823 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDSEED, VMXINSTRID_RDSEED, cbInstr);
9824 }
9825#endif
9826
9827 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
9828 switch (enmEffOpSize)
9829 {
9830 case IEMMODE_16BIT:
9831 {
9832 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
9833 &iemAImpl_rdseed_u16,
9834 &iemAImpl_rdseed_u16_fallback);
9835 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
9836 (pfnImpl)(pu16Dst, pEFlags);
9837 break;
9838 }
9839 case IEMMODE_32BIT:
9840 {
9841 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
9842 &iemAImpl_rdseed_u32,
9843 &iemAImpl_rdseed_u32_fallback);
9844 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
9845 (pfnImpl)(pu32Dst, pEFlags);
9846 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
9847 break;
9848 }
9849 case IEMMODE_64BIT:
9850 {
9851 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdSeed,
9852 &iemAImpl_rdseed_u64,
9853 &iemAImpl_rdseed_u64_fallback);
9854 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
9855 (pfnImpl)(pu64Dst, pEFlags);
9856 break;
9857 }
9858 IEM_NOT_REACHED_DEFAULT_CASE_RET();
9859 }
9860 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9861}
9862
9863
9864/**
9865 * Implements 'RDRAND'.
9866 *
9867 * @returns VINF_SUCCESS.
9868 * @param iReg The register.
9869 * @param enmEffOpSize The operand size.
9870 */
9871IEM_CIMPL_DEF_2(iemCImpl_rdrand, uint8_t, iReg, IEMMODE, enmEffOpSize)
9872{
9873#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9874 /* Nested-guest VMX intercept. */
9875 if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
9876 || !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDRAND_EXIT))
9877 { /* probable */ }
9878 else
9879 {
9880 Log(("rdrand: Guest intercept -> VM-exit\n"));
9881 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_RDRAND, VMXINSTRID_RDRAND, cbInstr);
9882 }
9883#endif
9884
9885 uint32_t *pEFlags = &pVCpu->cpum.GstCtx.eflags.uBoth;
9886 switch (enmEffOpSize)
9887 {
9888 case IEMMODE_16BIT:
9889 {
9890 PFNIEMAIMPLRDRANDSEEDU16 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u16,
9891 &iemAImpl_rdrand_u16_fallback);
9892 uint16_t *pu16Dst = iemGRegRefU16(pVCpu, iReg);
9893 (pfnImpl)(pu16Dst, pEFlags);
9894 break;
9895 }
9896 case IEMMODE_32BIT:
9897 {
9898 PFNIEMAIMPLRDRANDSEEDU32 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u32,
9899 &iemAImpl_rdrand_u32_fallback);
9900 uint32_t *pu32Dst = iemGRegRefU32(pVCpu, iReg);
9901 (pfnImpl)(pu32Dst, pEFlags);
9902 iemGRegStoreU32(pVCpu, iReg, *pu32Dst);
9903 break;
9904 }
9905 case IEMMODE_64BIT:
9906 {
9907 PFNIEMAIMPLRDRANDSEEDU64 pfnImpl = IEM_SELECT_HOST_OR_FALLBACK(fRdRand, &iemAImpl_rdrand_u64,
9908 &iemAImpl_rdrand_u64_fallback);
9909 uint64_t *pu64Dst = iemGRegRefU64(pVCpu, iReg);
9910 (pfnImpl)(pu64Dst, pEFlags);
9911 break;
9912 }
9913 IEM_NOT_REACHED_DEFAULT_CASE_RET();
9914 }
9915 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9916}
9917
9918
9919/**
9920 * Worker for 'VMASKMOVPS / VPMASKMOVD' 128-bit 32-bit-masked load.
9921 *
9922 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9923 * @param cbInstr The current instruction length.
9924 * @param iXRegDst The destination XMM register index.
9925 * @param iXRegMsk The mask XMM register index.
9926 * @param iEffSeg The effective segment.
9927 * @param GCPtrEffSrc The source memory address.
9928 */
9929static VBOXSTRICTRC iemCImpl_maskmov_load_u128_32_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iXRegDst, uint8_t iXRegMsk, uint8_t iEffSeg, RTGCPTR GCPtrEffSrc)
9930{
9931 uint32_t fAccessed = 0;
9932
9933 PRTUINT128U puDst = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegDst];
9934 PCRTUINT128U puMsk = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegMsk];
9935 PCRTUINT128U puSrc;
9936
9937 for (uint32_t i = 0; i < RT_ELEMENTS(puMsk->au32); i++)
9938 {
9939 fAccessed |= puMsk->au32[i];
9940 }
9941
9942 if (fAccessed & RT_BIT(31)) {
9943 /*
9944 * Access the source memory.
9945 */
9946 uint8_t bUnmapInfo;
9947 void *pvMemSrc;
9948 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemSrc, &bUnmapInfo, sizeof(*puSrc),
9949 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 0);
9950 if (rcStrict != VINF_SUCCESS)
9951 return rcStrict;
9952
9953 puSrc = (PCRTUINT128U)pvMemSrc;
9954
9955 for (uint32_t i = 0; i < RT_ELEMENTS(puSrc->au32); i++)
9956 {
9957 puDst->au32[i] = (puMsk->au32[i] & RT_BIT(31)) ? puSrc->au32[i] : 0;
9958 }
9959 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[0] = 0;
9960 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[1] = 0;
9961
9962 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
9963 if (rcStrict != VINF_SUCCESS)
9964 return rcStrict;
9965 }
9966 else
9967 {
9968 puDst->au64[0] = 0;
9969 puDst->au64[1] = 0;
9970 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[0] = 0;
9971 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[1] = 0;
9972 }
9973
9974 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9975}
9976
9977
9978
9979/**
9980 * Worker for 'VMASKMOVPS / VPMASKMOVD' 256-bit 32-bit-masked load.
9981 *
9982 * @param pVCpu The cross context virtual CPU structure of the calling thread.
9983 * @param cbInstr The current instruction length.
9984 * @param iYRegDst The destination YMM register index.
9985 * @param iYRegMsk The mask YMM register index.
9986 * @param iEffSeg The effective segment.
9987 * @param GCPtrEffSrc The source memory address.
9988 */
9989static VBOXSTRICTRC iemCImpl_maskmov_load_u256_32_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iYRegDst, uint8_t iYRegMsk, uint8_t iEffSeg, RTGCPTR GCPtrEffSrc)
9990{
9991 uint32_t fAccessed = 0;
9992
9993 PRTUINT128U puDstLo = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegDst];
9994 PRTUINT128U puDstHi = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegDst];
9995 PCRTUINT128U puMskLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegMsk];
9996 PCRTUINT128U puMskHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegMsk];
9997 PCRTUINT256U puSrc;
9998
9999 for (uint32_t i = 0; i < RT_ELEMENTS(puMskLo->au32); i++)
10000 {
10001 fAccessed |= puMskLo->au32[i] | puMskHi->au32[i];
10002 }
10003
10004 if (fAccessed & RT_BIT(31)) {
10005 /*
10006 * Access the source memory.
10007 */
10008 uint8_t bUnmapInfo;
10009 void *pvMemSrc;
10010 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemSrc, &bUnmapInfo, sizeof(*puSrc),
10011 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 0);
10012 if (rcStrict != VINF_SUCCESS)
10013 return rcStrict;
10014
10015 puSrc = (PCRTUINT256U)pvMemSrc;
10016
10017 uint8_t const iHalf = RT_ELEMENTS(puSrc->au32) / 2;
10018
10019 for (uint32_t i = 0; i < iHalf; i++)
10020 {
10021 puDstLo->au32[i] = (puMskLo->au32[i] & RT_BIT(31)) ? puSrc->au32[i] : 0;
10022 }
10023 for (uint32_t i = iHalf; i < RT_ELEMENTS(puSrc->au32); i++)
10024 {
10025 puDstHi->au32[i - iHalf] = (puMskHi->au32[i - iHalf] & RT_BIT(31)) ? puSrc->au32[i] : 0;
10026 }
10027
10028 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10029 if (rcStrict != VINF_SUCCESS)
10030 return rcStrict;
10031 }
10032 else
10033 {
10034 puDstLo->au64[0] = 0;
10035 puDstLo->au64[1] = 0;
10036 puDstHi->au64[0] = 0;
10037 puDstHi->au64[1] = 0;
10038 }
10039
10040 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10041}
10042
10043
10044/**
10045 * Worker for 'VMASKMOVPS / VPMASKMOVD' 128-bit 32-bit-masked store.
10046 *
10047 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10048 * @param cbInstr The current instruction length.
10049 * @param iEffSeg The effective segment.
10050 * @param GCPtrEffDst The destination memory address.
10051 * @param iXRegMsk The mask XMM register index.
10052 * @param iXRegSrc The source XMM register index.
10053 */
10054static VBOXSTRICTRC iemCImpl_maskmov_store_u128_32_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrEffDst, uint8_t iXRegMsk, uint8_t iXRegSrc)
10055{
10056 uint32_t fAccessed = 0;
10057
10058 PRTUINT128U puDst;
10059 PCRTUINT128U puMsk = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegMsk];
10060 PCRTUINT128U puSrc = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegSrc];
10061
10062 for (uint32_t i = 0; i < RT_ELEMENTS(puMsk->au32); i++)
10063 {
10064 fAccessed |= puMsk->au32[i];
10065 }
10066
10067 if (fAccessed & RT_BIT(31)) {
10068 /*
10069 * Access the destination memory.
10070 */
10071 uint8_t bUnmapInfo;
10072 void *pvMemDst;
10073 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemDst, &bUnmapInfo, sizeof(*puDst),
10074 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_RW, 0);
10075 if (rcStrict != VINF_SUCCESS)
10076 return rcStrict;
10077
10078 puDst = (PRTUINT128U)pvMemDst;
10079
10080 for (uint32_t i = 0; i < RT_ELEMENTS(puDst->au32); i++)
10081 {
10082 if (puMsk->au32[i] & RT_BIT(31))
10083 puDst->au32[i] = puSrc->au32[i];
10084 }
10085
10086 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10087 if (rcStrict != VINF_SUCCESS)
10088 return rcStrict;
10089 }
10090
10091 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10092}
10093
10094
10095
10096/**
10097 * Worker for 'VMASKMOVPS / VPMASKMOVD' 256-bit 32-bit-masked store.
10098 *
10099 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10100 * @param cbInstr The current instruction length.
10101 * @param iEffSeg The effective segment.
10102 * @param GCPtrEffDst The destination memory address.
10103 * @param iYRegMsk The mask YMM register index.
10104 * @param iYRegSrc The source YMM register index.
10105 */
10106static VBOXSTRICTRC iemCImpl_maskmov_store_u256_32_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrEffDst, uint8_t iYRegMsk, uint8_t iYRegSrc)
10107{
10108 uint32_t fAccessed = 0;
10109
10110 PRTUINT256U puDst;
10111 PCRTUINT128U puMskLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegMsk];
10112 PCRTUINT128U puMskHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegMsk];
10113 PCRTUINT128U puSrcLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegSrc];
10114 PCRTUINT128U puSrcHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegSrc];
10115
10116 for (uint32_t i = 0; i < RT_ELEMENTS(puMskLo->au32); i++)
10117 {
10118 fAccessed |= puMskLo->au32[i] | puMskHi->au32[i];
10119 }
10120
10121 if (fAccessed & RT_BIT(31)) {
10122 /*
10123 * Access the destination memory.
10124 */
10125 uint8_t bUnmapInfo;
10126 void *pvMemDst;
10127 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemDst, &bUnmapInfo, sizeof(*puDst),
10128 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_RW, 0);
10129 if (rcStrict != VINF_SUCCESS)
10130 return rcStrict;
10131
10132 puDst = (PRTUINT256U)pvMemDst;
10133
10134 uint8_t const iHalf = RT_ELEMENTS(puDst->au32) / 2;
10135
10136 for (uint32_t i = 0; i < iHalf; i++)
10137 {
10138 if (puMskLo->au32[i] & RT_BIT(31))
10139 puDst->au32[i] = puSrcLo->au32[i];
10140 }
10141 for (uint32_t i = iHalf; i < RT_ELEMENTS(puDst->au32); i++)
10142 {
10143 if (puMskHi->au32[i - iHalf] & RT_BIT(31))
10144 puDst->au32[i] = puSrcHi->au32[i - iHalf];
10145 }
10146
10147 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10148 if (rcStrict != VINF_SUCCESS)
10149 return rcStrict;
10150 }
10151
10152 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10153}
10154
10155
10156/**
10157 * Worker for 'VMASKMOVPD / VPMASKMOVQ' 128-bit 64-bit-masked load.
10158 *
10159 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10160 * @param cbInstr The current instruction length.
10161 * @param iXRegDst The destination XMM register index.
10162 * @param iXRegMsk The mask XMM register index.
10163 * @param iEffSeg The effective segment.
10164 * @param GCPtrEffSrc The source memory address.
10165 */
10166static VBOXSTRICTRC iemCImpl_maskmov_load_u128_64_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iXRegDst, uint8_t iXRegMsk, uint8_t iEffSeg, RTGCPTR GCPtrEffSrc)
10167{
10168 uint64_t fAccessed = 0;
10169
10170 PRTUINT128U puDst = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegDst];
10171 PCRTUINT128U puMsk = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegMsk];
10172 PCRTUINT128U puSrc;
10173
10174 for (uint32_t i = 0; i < RT_ELEMENTS(puMsk->au64); i++)
10175 {
10176 fAccessed |= puMsk->au64[i];
10177 }
10178
10179 if (fAccessed & RT_BIT_64(63)) {
10180 /*
10181 * Access the source memory.
10182 */
10183 uint8_t bUnmapInfo;
10184 void *pvMemSrc;
10185 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemSrc, &bUnmapInfo, sizeof(*puSrc),
10186 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 0);
10187 if (rcStrict != VINF_SUCCESS)
10188 return rcStrict;
10189
10190 puSrc = (PCRTUINT128U)pvMemSrc;
10191
10192 for (uint32_t i = 0; i < RT_ELEMENTS(puSrc->au64); i++)
10193 {
10194 puDst->au64[i] = (puMsk->au64[i] & RT_BIT_64(63)) ? puSrc->au64[i] : 0;
10195 }
10196 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[0] = 0;
10197 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[1] = 0;
10198
10199 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10200 if (rcStrict != VINF_SUCCESS)
10201 return rcStrict;
10202 }
10203 else
10204 {
10205 puDst->au64[0] = 0;
10206 puDst->au64[1] = 0;
10207 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[0] = 0;
10208 pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iXRegDst].au64[1] = 0;
10209 }
10210
10211 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10212}
10213
10214
10215
10216/**
10217 * Worker for 'VMASKMOVPD / VPMASKMOVQ' 256-bit 64-bit-masked load.
10218 *
10219 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10220 * @param cbInstr The current instruction length.
10221 * @param iYRegDst The destination YMM register index.
10222 * @param iYRegMsk The mask YMM register index.
10223 * @param iEffSeg The effective segment.
10224 * @param GCPtrEffSrc The source memory address.
10225 */
10226static VBOXSTRICTRC iemCImpl_maskmov_load_u256_64_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iYRegDst, uint8_t iYRegMsk, uint8_t iEffSeg, RTGCPTR GCPtrEffSrc)
10227{
10228 uint64_t fAccessed = 0;
10229
10230 PRTUINT128U puDstLo = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegDst];
10231 PRTUINT128U puDstHi = (PRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegDst];
10232 PCRTUINT128U puMskLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegMsk];
10233 PCRTUINT128U puMskHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegMsk];
10234 PCRTUINT256U puSrc;
10235
10236 for (uint32_t i = 0; i < RT_ELEMENTS(puMskLo->au64); i++)
10237 {
10238 fAccessed |= puMskLo->au64[i] | puMskHi->au64[i];
10239 }
10240
10241 if (fAccessed & RT_BIT_64(63)) {
10242 /*
10243 * Access the source memory.
10244 */
10245 uint8_t bUnmapInfo;
10246 void *pvMemSrc;
10247 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemSrc, &bUnmapInfo, sizeof(*puSrc),
10248 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 0);
10249 if (rcStrict != VINF_SUCCESS)
10250 return rcStrict;
10251
10252 puSrc = (PCRTUINT256U)pvMemSrc;
10253
10254 uint8_t const iHalf = RT_ELEMENTS(puSrc->au64) / 2;
10255
10256 for (uint32_t i = 0; i < iHalf; i++)
10257 {
10258 puDstLo->au64[i] = (puMskLo->au64[i] & RT_BIT_64(63)) ? puSrc->au64[i] : 0;
10259 }
10260 for (uint32_t i = iHalf; i < RT_ELEMENTS(puSrc->au64); i++)
10261 {
10262 puDstHi->au64[i - iHalf] = (puMskHi->au64[i - iHalf] & RT_BIT_64(63)) ? puSrc->au64[i] : 0;
10263 }
10264
10265 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10266 if (rcStrict != VINF_SUCCESS)
10267 return rcStrict;
10268 }
10269 else
10270 {
10271 puDstLo->au64[0] = 0;
10272 puDstLo->au64[1] = 0;
10273 puDstHi->au64[0] = 0;
10274 puDstHi->au64[1] = 0;
10275 }
10276
10277 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10278}
10279
10280
10281/**
10282 * Worker for 'VMASKMOVPD / VPMASKMOVQ' 128-bit 64-bit-masked store.
10283 *
10284 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10285 * @param cbInstr The current instruction length.
10286 * @param iEffSeg The effective segment.
10287 * @param GCPtrEffDst The destination memory address.
10288 * @param iXRegMsk The mask XMM register index.
10289 * @param iXRegSrc The source XMM register index.
10290 */
10291static VBOXSTRICTRC iemCImpl_maskmov_store_u128_64_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrEffDst, uint8_t iXRegMsk, uint8_t iXRegSrc)
10292{
10293 uint64_t fAccessed = 0;
10294
10295 PRTUINT128U puDst;
10296 PCRTUINT128U puMsk = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegMsk];
10297 PCRTUINT128U puSrc = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iXRegSrc];
10298
10299 for (uint32_t i = 0; i < RT_ELEMENTS(puMsk->au64); i++)
10300 {
10301 fAccessed |= puMsk->au64[i];
10302 }
10303
10304 if (fAccessed & RT_BIT_64(63)) {
10305 /*
10306 * Access the destination memory.
10307 */
10308 uint8_t bUnmapInfo;
10309 void *pvMemDst;
10310 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemDst, &bUnmapInfo, sizeof(*puDst),
10311 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_RW, 0);
10312 if (rcStrict != VINF_SUCCESS)
10313 return rcStrict;
10314
10315 puDst = (PRTUINT128U)pvMemDst;
10316
10317 for (uint32_t i = 0; i < RT_ELEMENTS(puDst->au64); i++)
10318 {
10319 if (puMsk->au64[i] & RT_BIT_64(63))
10320 puDst->au64[i] = puSrc->au64[i];
10321 }
10322
10323 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10324 if (rcStrict != VINF_SUCCESS)
10325 return rcStrict;
10326 }
10327
10328 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10329}
10330
10331
10332
10333/**
10334 * Worker for 'VMASKMOVPD / VPMASKMOVQ' 256-bit 64-bit-masked store.
10335 *
10336 * @param pVCpu The cross context virtual CPU structure of the calling thread.
10337 * @param cbInstr The current instruction length.
10338 * @param iEffSeg The effective segment.
10339 * @param GCPtrEffDst The destination memory address.
10340 * @param iYRegMsk The mask YMM register index.
10341 * @param iYRegSrc The source YMM register index.
10342 */
10343static VBOXSTRICTRC iemCImpl_maskmov_store_u256_64_worker(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrEffDst, uint8_t iYRegMsk, uint8_t iYRegSrc)
10344{
10345 uint64_t fAccessed = 0;
10346
10347 PRTUINT256U puDst;
10348 PCRTUINT128U puMskLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegMsk];
10349 PCRTUINT128U puMskHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegMsk];
10350 PCRTUINT128U puSrcLo = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.x87.aXMM[iYRegSrc];
10351 PCRTUINT128U puSrcHi = (PCRTUINT128U)&pVCpu->cpum.GstCtx.XState.u.YmmHi.aYmmHi[iYRegSrc];
10352
10353 for (uint32_t i = 0; i < RT_ELEMENTS(puMskLo->au64); i++)
10354 {
10355 fAccessed |= puMskLo->au64[i] | puMskHi->au64[i];
10356 }
10357
10358 if (fAccessed & RT_BIT_64(63)) {
10359 /*
10360 * Access the destination memory.
10361 */
10362 uint8_t bUnmapInfo;
10363 void *pvMemDst;
10364 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMemDst, &bUnmapInfo, sizeof(*puDst),
10365 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_RW, 0);
10366 if (rcStrict != VINF_SUCCESS)
10367 return rcStrict;
10368
10369 puDst = (PRTUINT256U)pvMemDst;
10370
10371 uint8_t const iHalf = RT_ELEMENTS(puDst->au64) / 2;
10372
10373 for (uint32_t i = 0; i < iHalf; i++)
10374 {
10375 if (puMskLo->au64[i] & RT_BIT_64(63))
10376 puDst->au64[i] = puSrcLo->au64[i];
10377 }
10378 for (uint32_t i = iHalf; i < RT_ELEMENTS(puDst->au64); i++)
10379 {
10380 if (puMskHi->au64[i - iHalf] & RT_BIT_64(63))
10381 puDst->au64[i] = puSrcHi->au64[i - iHalf];
10382 }
10383
10384 rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
10385 if (rcStrict != VINF_SUCCESS)
10386 return rcStrict;
10387 }
10388
10389 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
10390}
10391
10392
10393/**
10394 * Implements 'VMASKMOVPS' 128-bit 32-bit-masked load.
10395 *
10396 * @param iXRegDst The destination XMM register index.
10397 * @param iXRegMsk The mask XMM register index.
10398 * @param iEffSeg The effective segment.
10399 * @param GCPtrEffSrc The source memory address.
10400 */
10401IEM_CIMPL_DEF_4(iemCImpl_vmaskmovps_load_u128, uint8_t, iXRegDst, uint8_t, iXRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10402{
10403 return iemCImpl_maskmov_load_u128_32_worker(pVCpu, cbInstr, iXRegDst, iXRegMsk, iEffSeg, GCPtrEffSrc);
10404}
10405
10406
10407/**
10408 * Implements 'VMASKMOVPS' 256-bit 32-bit-masked load.
10409 *
10410 * @param iYRegDst The destination YMM register index.
10411 * @param iYRegMsk The mask YMM register index.
10412 * @param iEffSeg The effective segment.
10413 * @param GCPtrEffSrc The source memory address.
10414 */
10415IEM_CIMPL_DEF_4(iemCImpl_vmaskmovps_load_u256, uint8_t, iYRegDst, uint8_t, iYRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10416{
10417 return iemCImpl_maskmov_load_u256_32_worker(pVCpu, cbInstr, iYRegDst, iYRegMsk, iEffSeg, GCPtrEffSrc);
10418}
10419
10420
10421/**
10422 * Implements 'VMASKMOVPS' 128-bit 32-bit-masked store.
10423 *
10424 * @param iEffSeg The effective segment.
10425 * @param GCPtrEffDst The destination memory address.
10426 * @param iXRegMsk The mask XMM register index.
10427 * @param iXRegSrc The source XMM register index.
10428 */
10429IEM_CIMPL_DEF_4(iemCImpl_vmaskmovps_store_u128, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iXRegMsk, uint8_t, iXRegSrc)
10430{
10431 return iemCImpl_maskmov_store_u128_32_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iXRegMsk, iXRegSrc);
10432}
10433
10434
10435/**
10436 * Implements 'VMASKMOVPS' 256-bit 32-bit-masked store.
10437 *
10438 * @param iEffSeg The effective segment.
10439 * @param GCPtrEffDst The destination memory address.
10440 * @param iYRegMsk The mask YMM register index.
10441 * @param iYRegSrc The source YMM register index.
10442 */
10443IEM_CIMPL_DEF_4(iemCImpl_vmaskmovps_store_u256, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iYRegMsk, uint8_t, iYRegSrc)
10444{
10445 return iemCImpl_maskmov_store_u256_32_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iYRegMsk, iYRegSrc);
10446}
10447
10448
10449/**
10450 * Implements 'VPMASKMOVD' 128-bit 32-bit-masked load.
10451 *
10452 * @param iXRegDst The destination XMM register index.
10453 * @param iXRegMsk The mask XMM register index.
10454 * @param iEffSeg The effective segment.
10455 * @param GCPtrEffSrc The source memory address.
10456 */
10457IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovd_load_u128, uint8_t, iXRegDst, uint8_t, iXRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10458{
10459 return iemCImpl_maskmov_load_u128_32_worker(pVCpu, cbInstr, iXRegDst, iXRegMsk, iEffSeg, GCPtrEffSrc);
10460}
10461
10462
10463/**
10464 * Implements 'VPMASKMOVD' 256-bit 32-bit-masked load.
10465 *
10466 * @param iYRegDst The destination YMM register index.
10467 * @param iYRegMsk The mask YMM register index.
10468 * @param iEffSeg The effective segment.
10469 * @param GCPtrEffSrc The source memory address.
10470 */
10471IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovd_load_u256, uint8_t, iYRegDst, uint8_t, iYRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10472{
10473 return iemCImpl_maskmov_load_u256_32_worker(pVCpu, cbInstr, iYRegDst, iYRegMsk, iEffSeg, GCPtrEffSrc);
10474}
10475
10476
10477/**
10478 * Implements 'VPMASKMOVD' 128-bit 32-bit-masked store.
10479 *
10480 * @param iEffSeg The effective segment.
10481 * @param GCPtrEffDst The destination memory address.
10482 * @param iXRegMsk The mask XMM register index.
10483 * @param iXRegSrc The source XMM register index.
10484 */
10485IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovd_store_u128, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iXRegMsk, uint8_t, iXRegSrc)
10486{
10487 return iemCImpl_maskmov_store_u128_32_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iXRegMsk, iXRegSrc);
10488}
10489
10490
10491/**
10492 * Implements 'VPMASKMOVD' 256-bit 32-bit-masked store.
10493 *
10494 * @param iEffSeg The effective segment.
10495 * @param GCPtrEffDst The destination memory address.
10496 * @param iYRegMsk The mask YMM register index.
10497 * @param iYRegSrc The source YMM register index.
10498 */
10499IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovd_store_u256, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iYRegMsk, uint8_t, iYRegSrc)
10500{
10501 return iemCImpl_maskmov_store_u256_32_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iYRegMsk, iYRegSrc);
10502}
10503
10504
10505/**
10506 * Implements 'VMASKMOVPD' 128-bit 64-bit-masked load.
10507 *
10508 * @param iXRegDst The destination XMM register index.
10509 * @param iXRegMsk The mask XMM register index.
10510 * @param iEffSeg The effective segment.
10511 * @param GCPtrEffSrc The source memory address.
10512 */
10513IEM_CIMPL_DEF_4(iemCImpl_vmaskmovpd_load_u128, uint8_t, iXRegDst, uint8_t, iXRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10514{
10515 return iemCImpl_maskmov_load_u128_64_worker(pVCpu, cbInstr, iXRegDst, iXRegMsk, iEffSeg, GCPtrEffSrc);
10516}
10517
10518
10519/**
10520 * Implements 'VMASKMOVPD' 256-bit 64-bit-masked load.
10521 *
10522 * @param iYRegDst The destination YMM register index.
10523 * @param iYRegMsk The mask YMM register index.
10524 * @param iEffSeg The effective segment.
10525 * @param GCPtrEffSrc The source memory address.
10526 */
10527IEM_CIMPL_DEF_4(iemCImpl_vmaskmovpd_load_u256, uint8_t, iYRegDst, uint8_t, iYRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10528{
10529 return iemCImpl_maskmov_load_u256_64_worker(pVCpu, cbInstr, iYRegDst, iYRegMsk, iEffSeg, GCPtrEffSrc);
10530}
10531
10532
10533/**
10534 * Implements 'VMASKMOVPD' 128-bit 64-bit-masked store.
10535 *
10536 * @param iEffSeg The effective segment.
10537 * @param GCPtrEffDst The destination memory address.
10538 * @param iXRegMsk The mask XMM register index.
10539 * @param iXRegSrc The source XMM register index.
10540 */
10541IEM_CIMPL_DEF_4(iemCImpl_vmaskmovpd_store_u128, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iXRegMsk, uint8_t, iXRegSrc)
10542{
10543 return iemCImpl_maskmov_store_u128_64_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iXRegMsk, iXRegSrc);
10544}
10545
10546
10547/**
10548 * Implements 'VMASKMOVPD' 256-bit 64-bit-masked store.
10549 *
10550 * @param iEffSeg The effective segment.
10551 * @param GCPtrEffDst The destination memory address.
10552 * @param iYRegMsk The mask YMM register index.
10553 * @param iYRegSrc The source YMM register index.
10554 */
10555IEM_CIMPL_DEF_4(iemCImpl_vmaskmovpd_store_u256, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iYRegMsk, uint8_t, iYRegSrc)
10556{
10557 return iemCImpl_maskmov_store_u256_64_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iYRegMsk, iYRegSrc);
10558}
10559
10560
10561/**
10562 * Implements 'VPMASKMOVQ' 128-bit 64-bit-masked load.
10563 *
10564 * @param iXRegDst The destination XMM register index.
10565 * @param iXRegMsk The mask XMM register index.
10566 * @param iEffSeg The effective segment.
10567 * @param GCPtrEffSrc The source memory address.
10568 */
10569IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovq_load_u128, uint8_t, iXRegDst, uint8_t, iXRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10570{
10571 return iemCImpl_maskmov_load_u128_64_worker(pVCpu, cbInstr, iXRegDst, iXRegMsk, iEffSeg, GCPtrEffSrc);
10572}
10573
10574
10575/**
10576 * Implements 'VPMASKMOVQ' 256-bit 64-bit-masked load.
10577 *
10578 * @param iYRegDst The destination YMM register index.
10579 * @param iYRegMsk The mask YMM register index.
10580 * @param iEffSeg The effective segment.
10581 * @param GCPtrEffSrc The source memory address.
10582 */
10583IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovq_load_u256, uint8_t, iYRegDst, uint8_t, iYRegMsk, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
10584{
10585 return iemCImpl_maskmov_load_u256_64_worker(pVCpu, cbInstr, iYRegDst, iYRegMsk, iEffSeg, GCPtrEffSrc);
10586}
10587
10588
10589/**
10590 * Implements 'VPMASKMOVQ' 128-bit 64-bit-masked store.
10591 *
10592 * @param iEffSeg The effective segment.
10593 * @param GCPtrEffDst The destination memory address.
10594 * @param iXRegMsk The mask XMM register index.
10595 * @param iXRegSrc The source XMM register index.
10596 */
10597IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovq_store_u128, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iXRegMsk, uint8_t, iXRegSrc)
10598{
10599 return iemCImpl_maskmov_store_u128_64_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iXRegMsk, iXRegSrc);
10600}
10601
10602
10603/**
10604 * Implements 'VPMASKMOVQ' 256-bit 64-bit-masked store.
10605 *
10606 * @param iEffSeg The effective segment.
10607 * @param GCPtrEffDst The destination memory address.
10608 * @param iYRegMsk The mask YMM register index.
10609 * @param iYRegSrc The source YMM register index.
10610 */
10611IEM_CIMPL_DEF_4(iemCImpl_vpmaskmovq_store_u256, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, uint8_t, iYRegMsk, uint8_t, iYRegSrc)
10612{
10613 return iemCImpl_maskmov_store_u256_64_worker(pVCpu, cbInstr, iEffSeg, GCPtrEffDst, iYRegMsk, iYRegSrc);
10614}
10615
10616
10617/** @} */
10618
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette