VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 60118

Last change on this file since 60118 was 60118, checked in by vboxsync, 9 years ago

IEM: another iret todo.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 232.3 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 60118 2016-03-21 12:20:33Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2015 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/** @name Misc Helpers
20 * @{
21 */
22
23
24/**
25 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
26 *
27 * @returns Strict VBox status code.
28 *
29 * @param pIemCpu The IEM per CPU data.
30 * @param pCtx The register context.
31 * @param u16Port The port number.
32 * @param cbOperand The operand size.
33 */
34static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
35{
36 /* The TSS bits we're interested in are the same on 386 and AMD64. */
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
38 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
39 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
40 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
41
42 /*
43 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
44 */
45 Assert(!pCtx->tr.Attr.n.u1DescType);
46 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
47 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
48 {
49 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
50 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
51 return iemRaiseGeneralProtectionFault0(pIemCpu);
52 }
53
54 /*
55 * Read the bitmap offset (may #PF).
56 */
57 uint16_t offBitmap;
58 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
59 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
60 if (rcStrict != VINF_SUCCESS)
61 {
62 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
63 return rcStrict;
64 }
65
66 /*
67 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
68 * describes the CPU actually reading two bytes regardless of whether the
69 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
70 */
71 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
72 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
73 * for instance sizeof(X86TSS32). */
74 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
75 {
76 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
77 offFirstBit, pCtx->tr.u32Limit));
78 return iemRaiseGeneralProtectionFault0(pIemCpu);
79 }
80
81 /*
82 * Read the necessary bits.
83 */
84 /** @todo Test the assertion in the intel manual that the CPU reads two
85 * bytes. The question is how this works wrt to #PF and #GP on the
86 * 2nd byte when it's not required. */
87 uint16_t bmBytes = UINT16_MAX;
88 rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
89 if (rcStrict != VINF_SUCCESS)
90 {
91 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
92 return rcStrict;
93 }
94
95 /*
96 * Perform the check.
97 */
98 uint16_t fPortMask = (1 << cbOperand) - 1;
99 bmBytes >>= (u16Port & 7);
100 if (bmBytes & fPortMask)
101 {
102 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
103 u16Port, cbOperand, bmBytes, fPortMask));
104 return iemRaiseGeneralProtectionFault0(pIemCpu);
105 }
106
107 return VINF_SUCCESS;
108}
109
110
111/**
112 * Checks if we are allowed to access the given I/O port, raising the
113 * appropriate exceptions if we aren't (or if the I/O bitmap is not
114 * accessible).
115 *
116 * @returns Strict VBox status code.
117 *
118 * @param pIemCpu The IEM per CPU data.
119 * @param pCtx The register context.
120 * @param u16Port The port number.
121 * @param cbOperand The operand size.
122 */
123DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
124{
125 X86EFLAGS Efl;
126 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
127 if ( (pCtx->cr0 & X86_CR0_PE)
128 && ( pIemCpu->uCpl > Efl.Bits.u2IOPL
129 || Efl.Bits.u1VM) )
130 return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
131 return VINF_SUCCESS;
132}
133
134
135#if 0
136/**
137 * Calculates the parity bit.
138 *
139 * @returns true if the bit is set, false if not.
140 * @param u8Result The least significant byte of the result.
141 */
142static bool iemHlpCalcParityFlag(uint8_t u8Result)
143{
144 /*
145 * Parity is set if the number of bits in the least significant byte of
146 * the result is even.
147 */
148 uint8_t cBits;
149 cBits = u8Result & 1; /* 0 */
150 u8Result >>= 1;
151 cBits += u8Result & 1;
152 u8Result >>= 1;
153 cBits += u8Result & 1;
154 u8Result >>= 1;
155 cBits += u8Result & 1;
156 u8Result >>= 1;
157 cBits += u8Result & 1; /* 4 */
158 u8Result >>= 1;
159 cBits += u8Result & 1;
160 u8Result >>= 1;
161 cBits += u8Result & 1;
162 u8Result >>= 1;
163 cBits += u8Result & 1;
164 return !(cBits & 1);
165}
166#endif /* not used */
167
168
169/**
170 * Updates the specified flags according to a 8-bit result.
171 *
172 * @param pIemCpu The IEM state of the calling EMT.
173 * @param u8Result The result to set the flags according to.
174 * @param fToUpdate The flags to update.
175 * @param fUndefined The flags that are specified as undefined.
176 */
177static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
178{
179 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
180
181 uint32_t fEFlags = pCtx->eflags.u;
182 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
183 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
184 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
185#ifdef IEM_VERIFICATION_MODE_FULL
186 pIemCpu->fUndefinedEFlags |= fUndefined;
187#endif
188}
189
190
191/**
192 * Helper used by iret.
193 *
194 * @param uCpl The new CPL.
195 * @param pSReg Pointer to the segment register.
196 */
197static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
198{
199#ifdef VBOX_WITH_RAW_MODE_NOT_R0
200 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
201 CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
202#else
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
204#endif
205
206 if ( uCpl > pSReg->Attr.n.u2Dpl
207 && pSReg->Attr.n.u1DescType /* code or data, not system */
208 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
209 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
210 iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, 0);
211}
212
213
214/**
215 * Indicates that we have modified the FPU state.
216 *
217 * @param pIemCpu The IEM state of the calling EMT.
218 */
219DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
220{
221 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
222}
223
224/** @} */
225
226/** @name C Implementations
227 * @{
228 */
229
230/**
231 * Implements a 16-bit popa.
232 */
233IEM_CIMPL_DEF_0(iemCImpl_popa_16)
234{
235 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
236 RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
237 RTGCPTR GCPtrLast = GCPtrStart + 15;
238 VBOXSTRICTRC rcStrict;
239
240 /*
241 * The docs are a bit hard to comprehend here, but it looks like we wrap
242 * around in real mode as long as none of the individual "popa" crosses the
243 * end of the stack segment. In protected mode we check the whole access
244 * in one go. For efficiency, only do the word-by-word thing if we're in
245 * danger of wrapping around.
246 */
247 /** @todo do popa boundary / wrap-around checks. */
248 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
249 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
250 {
251 /* word-by-word */
252 RTUINT64U TmpRsp;
253 TmpRsp.u = pCtx->rsp;
254 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
255 if (rcStrict == VINF_SUCCESS)
256 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
257 if (rcStrict == VINF_SUCCESS)
258 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
259 if (rcStrict == VINF_SUCCESS)
260 {
261 iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
262 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
263 }
264 if (rcStrict == VINF_SUCCESS)
265 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
266 if (rcStrict == VINF_SUCCESS)
267 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 {
272 pCtx->rsp = TmpRsp.u;
273 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
274 }
275 }
276 else
277 {
278 uint16_t const *pa16Mem = NULL;
279 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
280 if (rcStrict == VINF_SUCCESS)
281 {
282 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
283 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
284 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
285 /* skip sp */
286 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
287 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
288 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
289 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
290 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
291 if (rcStrict == VINF_SUCCESS)
292 {
293 iemRegAddToRsp(pIemCpu, pCtx, 16);
294 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
295 }
296 }
297 }
298 return rcStrict;
299}
300
301
302/**
303 * Implements a 32-bit popa.
304 */
305IEM_CIMPL_DEF_0(iemCImpl_popa_32)
306{
307 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
308 RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
309 RTGCPTR GCPtrLast = GCPtrStart + 31;
310 VBOXSTRICTRC rcStrict;
311
312 /*
313 * The docs are a bit hard to comprehend here, but it looks like we wrap
314 * around in real mode as long as none of the individual "popa" crosses the
315 * end of the stack segment. In protected mode we check the whole access
316 * in one go. For efficiency, only do the word-by-word thing if we're in
317 * danger of wrapping around.
318 */
319 /** @todo do popa boundary / wrap-around checks. */
320 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
321 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
322 {
323 /* word-by-word */
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pCtx->rsp;
326 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
334 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
335 }
336 if (rcStrict == VINF_SUCCESS)
337 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
338 if (rcStrict == VINF_SUCCESS)
339 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
340 if (rcStrict == VINF_SUCCESS)
341 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 {
344#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
345 pCtx->rdi &= UINT32_MAX;
346 pCtx->rsi &= UINT32_MAX;
347 pCtx->rbp &= UINT32_MAX;
348 pCtx->rbx &= UINT32_MAX;
349 pCtx->rdx &= UINT32_MAX;
350 pCtx->rcx &= UINT32_MAX;
351 pCtx->rax &= UINT32_MAX;
352#endif
353 pCtx->rsp = TmpRsp.u;
354 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
355 }
356 }
357 else
358 {
359 uint32_t const *pa32Mem;
360 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
361 if (rcStrict == VINF_SUCCESS)
362 {
363 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
364 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
365 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
366 /* skip esp */
367 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
368 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
369 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
370 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
371 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
372 if (rcStrict == VINF_SUCCESS)
373 {
374 iemRegAddToRsp(pIemCpu, pCtx, 32);
375 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
376 }
377 }
378 }
379 return rcStrict;
380}
381
382
383/**
384 * Implements a 16-bit pusha.
385 */
386IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
387{
388 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
389 RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
390 RTGCPTR GCPtrBottom = GCPtrTop - 15;
391 VBOXSTRICTRC rcStrict;
392
393 /*
394 * The docs are a bit hard to comprehend here, but it looks like we wrap
395 * around in real mode as long as none of the individual "pushd" crosses the
396 * end of the stack segment. In protected mode we check the whole access
397 * in one go. For efficiency, only do the word-by-word thing if we're in
398 * danger of wrapping around.
399 */
400 /** @todo do pusha boundary / wrap-around checks. */
401 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
402 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
403 {
404 /* word-by-word */
405 RTUINT64U TmpRsp;
406 TmpRsp.u = pCtx->rsp;
407 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
408 if (rcStrict == VINF_SUCCESS)
409 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
410 if (rcStrict == VINF_SUCCESS)
411 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
416 if (rcStrict == VINF_SUCCESS)
417 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 {
424 pCtx->rsp = TmpRsp.u;
425 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
426 }
427 }
428 else
429 {
430 GCPtrBottom--;
431 uint16_t *pa16Mem = NULL;
432 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
433 if (rcStrict == VINF_SUCCESS)
434 {
435 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
436 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
437 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
438 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
439 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
440 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
441 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
442 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
443 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
444 if (rcStrict == VINF_SUCCESS)
445 {
446 iemRegSubFromRsp(pIemCpu, pCtx, 16);
447 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
448 }
449 }
450 }
451 return rcStrict;
452}
453
454
455/**
456 * Implements a 32-bit pusha.
457 */
458IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
459{
460 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
461 RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
462 RTGCPTR GCPtrBottom = GCPtrTop - 31;
463 VBOXSTRICTRC rcStrict;
464
465 /*
466 * The docs are a bit hard to comprehend here, but it looks like we wrap
467 * around in real mode as long as none of the individual "pusha" crosses the
468 * end of the stack segment. In protected mode we check the whole access
469 * in one go. For efficiency, only do the word-by-word thing if we're in
470 * danger of wrapping around.
471 */
472 /** @todo do pusha boundary / wrap-around checks. */
473 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
474 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
475 {
476 /* word-by-word */
477 RTUINT64U TmpRsp;
478 TmpRsp.u = pCtx->rsp;
479 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
480 if (rcStrict == VINF_SUCCESS)
481 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
490 if (rcStrict == VINF_SUCCESS)
491 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 {
496 pCtx->rsp = TmpRsp.u;
497 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
498 }
499 }
500 else
501 {
502 GCPtrBottom--;
503 uint32_t *pa32Mem;
504 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
505 if (rcStrict == VINF_SUCCESS)
506 {
507 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
508 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
509 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
510 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
511 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
512 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
513 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
514 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
515 rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
516 if (rcStrict == VINF_SUCCESS)
517 {
518 iemRegSubFromRsp(pIemCpu, pCtx, 32);
519 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
520 }
521 }
522 }
523 return rcStrict;
524}
525
526
527/**
528 * Implements pushf.
529 *
530 *
531 * @param enmEffOpSize The effective operand size.
532 */
533IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
534{
535 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
536
537 /*
538 * If we're in V8086 mode some care is required (which is why we're in
539 * doing this in a C implementation).
540 */
541 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
542 if ( (fEfl & X86_EFL_VM)
543 && X86_EFL_GET_IOPL(fEfl) != 3 )
544 {
545 Assert(pCtx->cr0 & X86_CR0_PE);
546 if ( enmEffOpSize != IEMMODE_16BIT
547 || !(pCtx->cr4 & X86_CR4_VME))
548 return iemRaiseGeneralProtectionFault0(pIemCpu);
549 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
550 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
551 return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
552 }
553
554 /*
555 * Ok, clear RF and VM and push the flags.
556 */
557 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
558
559 VBOXSTRICTRC rcStrict;
560 switch (enmEffOpSize)
561 {
562 case IEMMODE_16BIT:
563 rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
564 break;
565 case IEMMODE_32BIT:
566 rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
567 break;
568 case IEMMODE_64BIT:
569 rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
570 break;
571 IEM_NOT_REACHED_DEFAULT_CASE_RET();
572 }
573 if (rcStrict != VINF_SUCCESS)
574 return rcStrict;
575
576 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
577 return VINF_SUCCESS;
578}
579
580
581/**
582 * Implements popf.
583 *
584 * @param enmEffOpSize The effective operand size.
585 */
586IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
587{
588 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
589 uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
590 VBOXSTRICTRC rcStrict;
591 uint32_t fEflNew;
592
593 /*
594 * V8086 is special as usual.
595 */
596 if (fEflOld & X86_EFL_VM)
597 {
598 /*
599 * Almost anything goes if IOPL is 3.
600 */
601 if (X86_EFL_GET_IOPL(fEflOld) == 3)
602 {
603 switch (enmEffOpSize)
604 {
605 case IEMMODE_16BIT:
606 {
607 uint16_t u16Value;
608 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
609 if (rcStrict != VINF_SUCCESS)
610 return rcStrict;
611 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
612 break;
613 }
614 case IEMMODE_32BIT:
615 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
616 if (rcStrict != VINF_SUCCESS)
617 return rcStrict;
618 break;
619 IEM_NOT_REACHED_DEFAULT_CASE_RET();
620 }
621
622 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
623 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
624 }
625 /*
626 * Interrupt flag virtualization with CR4.VME=1.
627 */
628 else if ( enmEffOpSize == IEMMODE_16BIT
629 && (pCtx->cr4 & X86_CR4_VME) )
630 {
631 uint16_t u16Value;
632 RTUINT64U TmpRsp;
633 TmpRsp.u = pCtx->rsp;
634 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
635 if (rcStrict != VINF_SUCCESS)
636 return rcStrict;
637
638 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
639 * or before? */
640 if ( ( (u16Value & X86_EFL_IF)
641 && (fEflOld & X86_EFL_VIP))
642 || (u16Value & X86_EFL_TF) )
643 return iemRaiseGeneralProtectionFault0(pIemCpu);
644
645 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
646 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
647 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
648 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
649
650 pCtx->rsp = TmpRsp.u;
651 }
652 else
653 return iemRaiseGeneralProtectionFault0(pIemCpu);
654
655 }
656 /*
657 * Not in V8086 mode.
658 */
659 else
660 {
661 /* Pop the flags. */
662 switch (enmEffOpSize)
663 {
664 case IEMMODE_16BIT:
665 {
666 uint16_t u16Value;
667 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
668 if (rcStrict != VINF_SUCCESS)
669 return rcStrict;
670 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
671 break;
672 }
673 case IEMMODE_32BIT:
674 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
675 if (rcStrict != VINF_SUCCESS)
676 return rcStrict;
677 break;
678 case IEMMODE_64BIT:
679 {
680 uint64_t u64Value;
681 rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
682 if (rcStrict != VINF_SUCCESS)
683 return rcStrict;
684 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
685 break;
686 }
687 IEM_NOT_REACHED_DEFAULT_CASE_RET();
688 }
689
690 /* Merge them with the current flags. */
691 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
692 || pIemCpu->uCpl == 0)
693 {
694 fEflNew &= X86_EFL_POPF_BITS;
695 fEflNew |= ~X86_EFL_POPF_BITS & fEflOld;
696 }
697 else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
698 {
699 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
700 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
701 }
702 else
703 {
704 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
705 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
706 }
707 }
708
709 /*
710 * Commit the flags.
711 */
712 Assert(fEflNew & RT_BIT_32(1));
713 IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
714 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
715
716 return VINF_SUCCESS;
717}
718
719
720/**
721 * Implements an indirect call.
722 *
723 * @param uNewPC The new program counter (RIP) value (loaded from the
724 * operand).
725 * @param enmEffOpSize The effective operand size.
726 */
727IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
728{
729 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
730 uint16_t uOldPC = pCtx->ip + cbInstr;
731 if (uNewPC > pCtx->cs.u32Limit)
732 return iemRaiseGeneralProtectionFault0(pIemCpu);
733
734 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
735 if (rcStrict != VINF_SUCCESS)
736 return rcStrict;
737
738 pCtx->rip = uNewPC;
739 pCtx->eflags.Bits.u1RF = 0;
740 return VINF_SUCCESS;
741}
742
743
744/**
745 * Implements a 16-bit relative call.
746 *
747 * @param offDisp The displacment offset.
748 */
749IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
750{
751 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
752 uint16_t uOldPC = pCtx->ip + cbInstr;
753 uint16_t uNewPC = uOldPC + offDisp;
754 if (uNewPC > pCtx->cs.u32Limit)
755 return iemRaiseGeneralProtectionFault0(pIemCpu);
756
757 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
758 if (rcStrict != VINF_SUCCESS)
759 return rcStrict;
760
761 pCtx->rip = uNewPC;
762 pCtx->eflags.Bits.u1RF = 0;
763 return VINF_SUCCESS;
764}
765
766
767/**
768 * Implements a 32-bit indirect call.
769 *
770 * @param uNewPC The new program counter (RIP) value (loaded from the
771 * operand).
772 * @param enmEffOpSize The effective operand size.
773 */
774IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
775{
776 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
777 uint32_t uOldPC = pCtx->eip + cbInstr;
778 if (uNewPC > pCtx->cs.u32Limit)
779 return iemRaiseGeneralProtectionFault0(pIemCpu);
780
781 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
782 if (rcStrict != VINF_SUCCESS)
783 return rcStrict;
784
785#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
786 /*
787 * CASM hook for recording interesting indirect calls.
788 */
789 if ( !pCtx->eflags.Bits.u1IF
790 && (pCtx->cr0 & X86_CR0_PG)
791 && !CSAMIsEnabled(IEMCPU_TO_VM(pIemCpu))
792 && pIemCpu->uCpl == 0)
793 {
794 EMSTATE enmState = EMGetState(IEMCPU_TO_VMCPU(pIemCpu));
795 if ( enmState == EMSTATE_IEM_THEN_REM
796 || enmState == EMSTATE_IEM
797 || enmState == EMSTATE_REM)
798 CSAMR3RecordCallAddress(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
799 }
800#endif
801
802 pCtx->rip = uNewPC;
803 pCtx->eflags.Bits.u1RF = 0;
804 return VINF_SUCCESS;
805}
806
807
808/**
809 * Implements a 32-bit relative call.
810 *
811 * @param offDisp The displacment offset.
812 */
813IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
814{
815 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
816 uint32_t uOldPC = pCtx->eip + cbInstr;
817 uint32_t uNewPC = uOldPC + offDisp;
818 if (uNewPC > pCtx->cs.u32Limit)
819 return iemRaiseGeneralProtectionFault0(pIemCpu);
820
821 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
822 if (rcStrict != VINF_SUCCESS)
823 return rcStrict;
824
825 pCtx->rip = uNewPC;
826 pCtx->eflags.Bits.u1RF = 0;
827 return VINF_SUCCESS;
828}
829
830
831/**
832 * Implements a 64-bit indirect call.
833 *
834 * @param uNewPC The new program counter (RIP) value (loaded from the
835 * operand).
836 * @param enmEffOpSize The effective operand size.
837 */
838IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
839{
840 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
841 uint64_t uOldPC = pCtx->rip + cbInstr;
842 if (!IEM_IS_CANONICAL(uNewPC))
843 return iemRaiseGeneralProtectionFault0(pIemCpu);
844
845 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
846 if (rcStrict != VINF_SUCCESS)
847 return rcStrict;
848
849 pCtx->rip = uNewPC;
850 pCtx->eflags.Bits.u1RF = 0;
851 return VINF_SUCCESS;
852}
853
854
855/**
856 * Implements a 64-bit relative call.
857 *
858 * @param offDisp The displacment offset.
859 */
860IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
861{
862 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
863 uint64_t uOldPC = pCtx->rip + cbInstr;
864 uint64_t uNewPC = uOldPC + offDisp;
865 if (!IEM_IS_CANONICAL(uNewPC))
866 return iemRaiseNotCanonical(pIemCpu);
867
868 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
869 if (rcStrict != VINF_SUCCESS)
870 return rcStrict;
871
872 pCtx->rip = uNewPC;
873 pCtx->eflags.Bits.u1RF = 0;
874 return VINF_SUCCESS;
875}
876
877
878/**
879 * Implements far jumps and calls thru task segments (TSS).
880 *
881 * @param uSel The selector.
882 * @param enmBranch The kind of branching we're performing.
883 * @param enmEffOpSize The effective operand size.
884 * @param pDesc The descriptor corresponding to @a uSel. The type is
885 * task gate.
886 */
887IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
888{
889#ifndef IEM_IMPLEMENTS_TASKSWITCH
890 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
891#else
892 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
893 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
894 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
895
896 if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
897 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
898 {
899 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
900 pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
901 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
902 }
903
904 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
905 * far calls (see iemCImpl_callf). Most likely in both cases it should be
906 * checked here, need testcases. */
907 if (!pDesc->Legacy.Gen.u1Present)
908 {
909 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
910 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
911 }
912
913 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
914 uint32_t uNextEip = pCtx->eip + cbInstr;
915 return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
916 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
917#endif
918}
919
920
921/**
922 * Implements far jumps and calls thru task gates.
923 *
924 * @param uSel The selector.
925 * @param enmBranch The kind of branching we're performing.
926 * @param enmEffOpSize The effective operand size.
927 * @param pDesc The descriptor corresponding to @a uSel. The type is
928 * task gate.
929 */
930IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
931{
932#ifndef IEM_IMPLEMENTS_TASKSWITCH
933 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
934#else
935 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
936
937 if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
938 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
939 {
940 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
941 pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
942 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
943 }
944
945 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
946 * far calls (see iemCImpl_callf). Most likely in both cases it should be
947 * checked here, need testcases. */
948 if (!pDesc->Legacy.Gen.u1Present)
949 {
950 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
951 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
952 }
953
954 /*
955 * Fetch the new TSS descriptor from the GDT.
956 */
957 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
958 if (uSelTss & X86_SEL_LDT)
959 {
960 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
961 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
962 }
963
964 IEMSELDESC TssDesc;
965 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelTss, X86_XCPT_GP);
966 if (rcStrict != VINF_SUCCESS)
967 return rcStrict;
968
969 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
970 {
971 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
972 TssDesc.Legacy.Gate.u4Type));
973 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
974 }
975
976 if (!TssDesc.Legacy.Gate.u1Present)
977 {
978 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
979 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
980 }
981
982 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
983 uint32_t uNextEip = pCtx->eip + cbInstr;
984 return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
985 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
986#endif
987}
988
989
990/**
991 * Implements far jumps and calls thru call gates.
992 *
993 * @param uSel The selector.
994 * @param enmBranch The kind of branching we're performing.
995 * @param enmEffOpSize The effective operand size.
996 * @param pDesc The descriptor corresponding to @a uSel. The type is
997 * call gate.
998 */
999IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1000{
1001#ifndef IEM_IMPLEMENTS_CALLGATE
1002 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1003#else
1004 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1005 * inter-privilege calls and are much more complex.
1006 *
1007 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1008 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1009 * must be 16-bit or 32-bit.
1010 */
1011 /** @todo: effective operand size is probably irrelevant here, only the
1012 * call gate bitness matters??
1013 */
1014 VBOXSTRICTRC rcStrict;
1015 RTPTRUNION uPtrRet;
1016 uint64_t uNewRsp;
1017 uint64_t uNewRip;
1018 uint64_t u64Base;
1019 uint32_t cbLimit;
1020 RTSEL uNewCS;
1021 IEMSELDESC DescCS;
1022 PCPUMCTX pCtx;
1023
1024 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1025 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1026 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1027 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1028
1029 /* Determine the new instruction pointer from the gate descriptor. */
1030 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1031 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1032 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1033
1034 /* Perform DPL checks on the gate descriptor. */
1035 if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
1036 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1037 {
1038 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1039 pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
1040 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1041 }
1042
1043 /** @todo does this catch NULL selectors, too? */
1044 if (!pDesc->Legacy.Gen.u1Present)
1045 {
1046 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1047 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1048 }
1049
1050 /*
1051 * Fetch the target CS descriptor from the GDT or LDT.
1052 */
1053 uNewCS = pDesc->Legacy.Gate.u16Sel;
1054 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS, X86_XCPT_GP);
1055 if (rcStrict != VINF_SUCCESS)
1056 return rcStrict;
1057
1058 /* Target CS must be a code selector. */
1059 if ( !DescCS.Legacy.Gen.u1DescType
1060 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1061 {
1062 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1063 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1064 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1065 }
1066
1067 /* Privilege checks on target CS. */
1068 if (enmBranch == IEMBRANCH_JUMP)
1069 {
1070 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1071 {
1072 if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
1073 {
1074 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1075 uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1076 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1077 }
1078 }
1079 else
1080 {
1081 if (DescCS.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
1082 {
1083 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1084 uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1085 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1086 }
1087 }
1088 }
1089 else
1090 {
1091 Assert(enmBranch == IEMBRANCH_CALL);
1092 if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
1093 {
1094 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1095 uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1096 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1097 }
1098 }
1099
1100 /* Additional long mode checks. */
1101 if (IEM_IS_LONG_MODE(pIemCpu))
1102 {
1103 if (!DescCS.Legacy.Gen.u1Long)
1104 {
1105 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1106 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1107 }
1108
1109 /* L vs D. */
1110 if ( DescCS.Legacy.Gen.u1Long
1111 && DescCS.Legacy.Gen.u1DefBig)
1112 {
1113 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1114 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1115 }
1116 }
1117
1118 if (!DescCS.Legacy.Gate.u1Present)
1119 {
1120 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1121 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCS);
1122 }
1123
1124 pCtx = pIemCpu->CTX_SUFF(pCtx);
1125
1126 if (enmBranch == IEMBRANCH_JUMP)
1127 {
1128 /** @todo: This is very similar to regular far jumps; merge! */
1129 /* Jumps are fairly simple... */
1130
1131 /* Chop the high bits off if 16-bit gate (Intel says so). */
1132 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1133 uNewRip = (uint16_t)uNewRip;
1134
1135 /* Limit check for non-long segments. */
1136 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1137 if (DescCS.Legacy.Gen.u1Long)
1138 u64Base = 0;
1139 else
1140 {
1141 if (uNewRip > cbLimit)
1142 {
1143 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1144 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1145 }
1146 u64Base = X86DESC_BASE(&DescCS.Legacy);
1147 }
1148
1149 /* Canonical address check. */
1150 if (!IEM_IS_CANONICAL(uNewRip))
1151 {
1152 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1153 return iemRaiseNotCanonical(pIemCpu);
1154 }
1155
1156 /*
1157 * Ok, everything checked out fine. Now set the accessed bit before
1158 * committing the result into CS, CSHID and RIP.
1159 */
1160 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1161 {
1162 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1163 if (rcStrict != VINF_SUCCESS)
1164 return rcStrict;
1165 /** @todo check what VT-x and AMD-V does. */
1166 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1167 }
1168
1169 /* commit */
1170 pCtx->rip = uNewRip;
1171 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1172 pCtx->cs.Sel |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1173 pCtx->cs.ValidSel = pCtx->cs.Sel;
1174 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1175 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1176 pCtx->cs.u32Limit = cbLimit;
1177 pCtx->cs.u64Base = u64Base;
1178 }
1179 else
1180 {
1181 Assert(enmBranch == IEMBRANCH_CALL);
1182 /* Calls are much more complicated. */
1183
1184 if (DescCS.Legacy.Gen.u2Dpl < pIemCpu->uCpl)
1185 {
1186 uint16_t offNewStack; /* Offset of new stack in TSS. */
1187 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1188 uint8_t uNewCSDpl;
1189 uint8_t cbWords;
1190 RTSEL uNewSS;
1191 RTSEL uOldSS;
1192 uint64_t uOldRsp;
1193 IEMSELDESC DescSS;
1194 RTPTRUNION uPtrTSS;
1195 RTGCPTR GCPtrTSS;
1196 RTPTRUNION uPtrParmWds;
1197 RTGCPTR GCPtrParmWds;
1198
1199 /* More privilege. This is the fun part. */
1200 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1201
1202 /*
1203 * Determine new SS:rSP from the TSS.
1204 */
1205 Assert(!pCtx->tr.Attr.n.u1DescType);
1206
1207 /* Figure out where the new stack pointer is stored in the TSS. */
1208 uNewCSDpl = uNewCS & X86_SEL_RPL;
1209 if (!IEM_IS_LONG_MODE(pIemCpu))
1210 {
1211 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1212 {
1213 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1214 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1215 }
1216 else
1217 {
1218 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1219 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1220 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1221 }
1222 }
1223 else
1224 {
1225 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1226 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1227 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1228 }
1229
1230 /* Check against TSS limit. */
1231 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1232 {
1233 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1234 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, pCtx->tr.Sel);
1235 }
1236
1237 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1238 rcStrict = iemMemMap(pIemCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1239 if (rcStrict != VINF_SUCCESS)
1240 {
1241 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1242 return rcStrict;
1243 }
1244
1245 if (!IEM_IS_LONG_MODE(pIemCpu))
1246 {
1247 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1248 {
1249 uNewRsp = uPtrTSS.pu32[0];
1250 uNewSS = uPtrTSS.pu16[2];
1251 }
1252 else
1253 {
1254 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1255 uNewRsp = uPtrTSS.pu16[0];
1256 uNewSS = uPtrTSS.pu16[1];
1257 }
1258 }
1259 else
1260 {
1261 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1262 /* SS will be a NULL selector, but that's valid. */
1263 uNewRsp = uPtrTSS.pu64[0];
1264 uNewSS = uNewCSDpl;
1265 }
1266
1267 /* Done with the TSS now. */
1268 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1269 if (rcStrict != VINF_SUCCESS)
1270 {
1271 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1272 return rcStrict;
1273 }
1274
1275 /* Only used outside of long mode. */
1276 cbWords = pDesc->Legacy.Gate.u4ParmCount;
1277
1278 /* If EFER.LMA is 0, there's extra work to do. */
1279 if (!IEM_IS_LONG_MODE(pIemCpu))
1280 {
1281 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1282 {
1283 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1284 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1285 }
1286
1287 /* Grab the new SS descriptor. */
1288 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
1289 if (rcStrict != VINF_SUCCESS)
1290 return rcStrict;
1291
1292 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1293 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1294 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1295 {
1296 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1297 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1298 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1299 }
1300
1301 /* Ensure new SS is a writable data segment. */
1302 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1303 {
1304 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1305 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1306 }
1307
1308 if (!DescSS.Legacy.Gen.u1Present)
1309 {
1310 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1311 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
1312 }
1313 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1314 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1315 else
1316 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1317 }
1318 else
1319 {
1320 /* Just grab the new (NULL) SS descriptor. */
1321 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
1322 if (rcStrict != VINF_SUCCESS)
1323 return rcStrict;
1324
1325 cbNewStack = sizeof(uint64_t) * 4;
1326 }
1327
1328 /** @todo: According to Intel, new stack is checked for enough space first,
1329 * then switched. According to AMD, the stack is switched first and
1330 * then pushes might fault!
1331 */
1332
1333 /** @todo: According to AMD, CS is loaded first, then SS.
1334 * According to Intel, it's the other way around!?
1335 */
1336
1337 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1338
1339 /* Set the accessed bit before committing new SS. */
1340 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1341 {
1342 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
1343 if (rcStrict != VINF_SUCCESS)
1344 return rcStrict;
1345 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1346 }
1347
1348 /* Remember the old SS:rSP and their linear address. */
1349 uOldSS = pCtx->ss.Sel;
1350 uOldRsp = pCtx->rsp;
1351
1352 GCPtrParmWds = pCtx->ss.u64Base + pCtx->rsp;
1353
1354 /* Commit new SS:rSP. */
1355 pCtx->ss.Sel = uNewSS;
1356 pCtx->ss.ValidSel = uNewSS;
1357 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1358 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1359 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1360 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1361 pCtx->rsp = uNewRsp;
1362 pIemCpu->uCpl = uNewCSDpl;
1363 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->ss));
1364 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
1365
1366 /* Check new stack - may #SS(NewSS). */
1367 rcStrict = iemMemStackPushBeginSpecial(pIemCpu, cbNewStack,
1368 &uPtrRet.pv, &uNewRsp);
1369 if (rcStrict != VINF_SUCCESS)
1370 {
1371 Log(("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1372 return rcStrict;
1373 }
1374
1375 if (!IEM_IS_LONG_MODE(pIemCpu))
1376 {
1377 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1378 {
1379 /* Push the old CS:rIP. */
1380 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1381 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1382
1383 /* Map the relevant chunk of the old stack. */
1384 rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1385 if (rcStrict != VINF_SUCCESS)
1386 {
1387 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1388 return rcStrict;
1389 }
1390
1391 /* Copy the parameter (d)words. */
1392 for (int i = 0; i < cbWords; ++i)
1393 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1394
1395 /* Unmap the old stack. */
1396 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1397 if (rcStrict != VINF_SUCCESS)
1398 {
1399 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1400 return rcStrict;
1401 }
1402
1403 /* Push the old SS:rSP. */
1404 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1405 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1406 }
1407 else
1408 {
1409 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1410
1411 /* Push the old CS:rIP. */
1412 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1413 uPtrRet.pu16[1] = pCtx->cs.Sel;
1414
1415 /* Map the relevant chunk of the old stack. */
1416 rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1417 if (rcStrict != VINF_SUCCESS)
1418 {
1419 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1420 return rcStrict;
1421 }
1422
1423 /* Copy the parameter words. */
1424 for (int i = 0; i < cbWords; ++i)
1425 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1426
1427 /* Unmap the old stack. */
1428 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1429 if (rcStrict != VINF_SUCCESS)
1430 {
1431 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1432 return rcStrict;
1433 }
1434
1435 /* Push the old SS:rSP. */
1436 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1437 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1438 }
1439 }
1440 else
1441 {
1442 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1443
1444 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1445 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1446 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1447 uPtrRet.pu64[2] = uOldRsp;
1448 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1449 }
1450
1451 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1452 if (rcStrict != VINF_SUCCESS)
1453 {
1454 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1455 return rcStrict;
1456 }
1457
1458 /* Chop the high bits off if 16-bit gate (Intel says so). */
1459 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1460 uNewRip = (uint16_t)uNewRip;
1461
1462 /* Limit / canonical check. */
1463 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1464 if (!IEM_IS_LONG_MODE(pIemCpu))
1465 {
1466 if (uNewRip > cbLimit)
1467 {
1468 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1469 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1470 }
1471 u64Base = X86DESC_BASE(&DescCS.Legacy);
1472 }
1473 else
1474 {
1475 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1476 if (!IEM_IS_CANONICAL(uNewRip))
1477 {
1478 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1479 return iemRaiseNotCanonical(pIemCpu);
1480 }
1481 u64Base = 0;
1482 }
1483
1484 /*
1485 * Now set the accessed bit before
1486 * writing the return address to the stack and committing the result into
1487 * CS, CSHID and RIP.
1488 */
1489 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1490 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1491 {
1492 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1493 if (rcStrict != VINF_SUCCESS)
1494 return rcStrict;
1495 /** @todo check what VT-x and AMD-V does. */
1496 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1497 }
1498
1499 /* Commit new CS:rIP. */
1500 pCtx->rip = uNewRip;
1501 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1502 pCtx->cs.Sel |= pIemCpu->uCpl;
1503 pCtx->cs.ValidSel = pCtx->cs.Sel;
1504 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1505 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1506 pCtx->cs.u32Limit = cbLimit;
1507 pCtx->cs.u64Base = u64Base;
1508 }
1509 else
1510 {
1511 /* Same privilege. */
1512 /** @todo: This is very similar to regular far calls; merge! */
1513
1514 /* Check stack first - may #SS(0). */
1515 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1516 * 16-bit code cause a two or four byte CS to be pushed? */
1517 rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1518 IEM_IS_LONG_MODE(pIemCpu) ? 8+8
1519 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1520 &uPtrRet.pv, &uNewRsp);
1521 if (rcStrict != VINF_SUCCESS)
1522 return rcStrict;
1523
1524 /* Chop the high bits off if 16-bit gate (Intel says so). */
1525 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1526 uNewRip = (uint16_t)uNewRip;
1527
1528 /* Limit / canonical check. */
1529 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1530 if (!IEM_IS_LONG_MODE(pIemCpu))
1531 {
1532 if (uNewRip > cbLimit)
1533 {
1534 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1535 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1536 }
1537 u64Base = X86DESC_BASE(&DescCS.Legacy);
1538 }
1539 else
1540 {
1541 if (!IEM_IS_CANONICAL(uNewRip))
1542 {
1543 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1544 return iemRaiseNotCanonical(pIemCpu);
1545 }
1546 u64Base = 0;
1547 }
1548
1549 /*
1550 * Now set the accessed bit before
1551 * writing the return address to the stack and committing the result into
1552 * CS, CSHID and RIP.
1553 */
1554 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1555 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1556 {
1557 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1558 if (rcStrict != VINF_SUCCESS)
1559 return rcStrict;
1560 /** @todo check what VT-x and AMD-V does. */
1561 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1562 }
1563
1564 /* stack */
1565 if (!IEM_IS_LONG_MODE(pIemCpu))
1566 {
1567 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1568 {
1569 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1570 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1571 }
1572 else
1573 {
1574 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1575 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1576 uPtrRet.pu16[1] = pCtx->cs.Sel;
1577 }
1578 }
1579 else
1580 {
1581 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1582 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1583 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1584 }
1585
1586 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1587 if (rcStrict != VINF_SUCCESS)
1588 return rcStrict;
1589
1590 /* commit */
1591 pCtx->rip = uNewRip;
1592 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1593 pCtx->cs.Sel |= pIemCpu->uCpl;
1594 pCtx->cs.ValidSel = pCtx->cs.Sel;
1595 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1596 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1597 pCtx->cs.u32Limit = cbLimit;
1598 pCtx->cs.u64Base = u64Base;
1599 }
1600 }
1601 pCtx->eflags.Bits.u1RF = 0;
1602 return VINF_SUCCESS;
1603#endif
1604}
1605
1606
1607/**
1608 * Implements far jumps and calls thru system selectors.
1609 *
1610 * @param uSel The selector.
1611 * @param enmBranch The kind of branching we're performing.
1612 * @param enmEffOpSize The effective operand size.
1613 * @param pDesc The descriptor corresponding to @a uSel.
1614 */
1615IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1616{
1617 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1618 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1619
1620 if (IEM_IS_LONG_MODE(pIemCpu))
1621 switch (pDesc->Legacy.Gen.u4Type)
1622 {
1623 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1624 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1625
1626 default:
1627 case AMD64_SEL_TYPE_SYS_LDT:
1628 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1629 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1630 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1631 case AMD64_SEL_TYPE_SYS_INT_GATE:
1632 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1633 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1634 }
1635
1636 switch (pDesc->Legacy.Gen.u4Type)
1637 {
1638 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1639 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1640 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1641
1642 case X86_SEL_TYPE_SYS_TASK_GATE:
1643 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1644
1645 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1646 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1647 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1648
1649 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1650 Log(("branch %04x -> busy 286 TSS\n", uSel));
1651 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1652
1653 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1654 Log(("branch %04x -> busy 386 TSS\n", uSel));
1655 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1656
1657 default:
1658 case X86_SEL_TYPE_SYS_LDT:
1659 case X86_SEL_TYPE_SYS_286_INT_GATE:
1660 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1661 case X86_SEL_TYPE_SYS_386_INT_GATE:
1662 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1663 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1664 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1665 }
1666}
1667
1668
1669/**
1670 * Implements far jumps.
1671 *
1672 * @param uSel The selector.
1673 * @param offSeg The segment offset.
1674 * @param enmEffOpSize The effective operand size.
1675 */
1676IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1677{
1678 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1679 NOREF(cbInstr);
1680 Assert(offSeg <= UINT32_MAX);
1681
1682 /*
1683 * Real mode and V8086 mode are easy. The only snag seems to be that
1684 * CS.limit doesn't change and the limit check is done against the current
1685 * limit.
1686 */
1687 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1688 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1689 {
1690 if (offSeg > pCtx->cs.u32Limit)
1691 return iemRaiseGeneralProtectionFault0(pIemCpu);
1692
1693 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1694 pCtx->rip = offSeg;
1695 else
1696 pCtx->rip = offSeg & UINT16_MAX;
1697 pCtx->cs.Sel = uSel;
1698 pCtx->cs.ValidSel = uSel;
1699 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1700 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1701 pCtx->eflags.Bits.u1RF = 0;
1702 return VINF_SUCCESS;
1703 }
1704
1705 /*
1706 * Protected mode. Need to parse the specified descriptor...
1707 */
1708 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1709 {
1710 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1711 return iemRaiseGeneralProtectionFault0(pIemCpu);
1712 }
1713
1714 /* Fetch the descriptor. */
1715 IEMSELDESC Desc;
1716 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1717 if (rcStrict != VINF_SUCCESS)
1718 return rcStrict;
1719
1720 /* Is it there? */
1721 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1722 {
1723 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1724 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1725 }
1726
1727 /*
1728 * Deal with it according to its type. We do the standard code selectors
1729 * here and dispatch the system selectors to worker functions.
1730 */
1731 if (!Desc.Legacy.Gen.u1DescType)
1732 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1733
1734 /* Only code segments. */
1735 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1736 {
1737 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1738 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1739 }
1740
1741 /* L vs D. */
1742 if ( Desc.Legacy.Gen.u1Long
1743 && Desc.Legacy.Gen.u1DefBig
1744 && IEM_IS_LONG_MODE(pIemCpu))
1745 {
1746 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1747 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1748 }
1749
1750 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1751 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1752 {
1753 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1754 {
1755 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1756 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1757 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1758 }
1759 }
1760 else
1761 {
1762 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1763 {
1764 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1765 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1766 }
1767 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1768 {
1769 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1770 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1771 }
1772 }
1773
1774 /* Chop the high bits if 16-bit (Intel says so). */
1775 if (enmEffOpSize == IEMMODE_16BIT)
1776 offSeg &= UINT16_MAX;
1777
1778 /* Limit check. (Should alternatively check for non-canonical addresses
1779 here, but that is ruled out by offSeg being 32-bit, right?) */
1780 uint64_t u64Base;
1781 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1782 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1783 u64Base = 0;
1784 else
1785 {
1786 if (offSeg > cbLimit)
1787 {
1788 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1789 /** @todo: Intel says this is #GP(0)! */
1790 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1791 }
1792 u64Base = X86DESC_BASE(&Desc.Legacy);
1793 }
1794
1795 /*
1796 * Ok, everything checked out fine. Now set the accessed bit before
1797 * committing the result into CS, CSHID and RIP.
1798 */
1799 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1800 {
1801 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1802 if (rcStrict != VINF_SUCCESS)
1803 return rcStrict;
1804 /** @todo check what VT-x and AMD-V does. */
1805 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1806 }
1807
1808 /* commit */
1809 pCtx->rip = offSeg;
1810 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1811 pCtx->cs.Sel |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1812 pCtx->cs.ValidSel = pCtx->cs.Sel;
1813 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1814 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1815 pCtx->cs.u32Limit = cbLimit;
1816 pCtx->cs.u64Base = u64Base;
1817 pCtx->eflags.Bits.u1RF = 0;
1818 /** @todo check if the hidden bits are loaded correctly for 64-bit
1819 * mode. */
1820 return VINF_SUCCESS;
1821}
1822
1823
1824/**
1825 * Implements far calls.
1826 *
1827 * This very similar to iemCImpl_FarJmp.
1828 *
1829 * @param uSel The selector.
1830 * @param offSeg The segment offset.
1831 * @param enmEffOpSize The operand size (in case we need it).
1832 */
1833IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1834{
1835 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1836 VBOXSTRICTRC rcStrict;
1837 uint64_t uNewRsp;
1838 RTPTRUNION uPtrRet;
1839
1840 /*
1841 * Real mode and V8086 mode are easy. The only snag seems to be that
1842 * CS.limit doesn't change and the limit check is done against the current
1843 * limit.
1844 */
1845 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1846 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1847 {
1848 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1849
1850 /* Check stack first - may #SS(0). */
1851 rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1852 &uPtrRet.pv, &uNewRsp);
1853 if (rcStrict != VINF_SUCCESS)
1854 return rcStrict;
1855
1856 /* Check the target address range. */
1857 if (offSeg > UINT32_MAX)
1858 return iemRaiseGeneralProtectionFault0(pIemCpu);
1859
1860 /* Everything is fine, push the return address. */
1861 if (enmEffOpSize == IEMMODE_16BIT)
1862 {
1863 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1864 uPtrRet.pu16[1] = pCtx->cs.Sel;
1865 }
1866 else
1867 {
1868 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1869 uPtrRet.pu16[3] = pCtx->cs.Sel;
1870 }
1871 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1872 if (rcStrict != VINF_SUCCESS)
1873 return rcStrict;
1874
1875 /* Branch. */
1876 pCtx->rip = offSeg;
1877 pCtx->cs.Sel = uSel;
1878 pCtx->cs.ValidSel = uSel;
1879 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1880 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1881 pCtx->eflags.Bits.u1RF = 0;
1882 return VINF_SUCCESS;
1883 }
1884
1885 /*
1886 * Protected mode. Need to parse the specified descriptor...
1887 */
1888 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1889 {
1890 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1891 return iemRaiseGeneralProtectionFault0(pIemCpu);
1892 }
1893
1894 /* Fetch the descriptor. */
1895 IEMSELDESC Desc;
1896 rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1897 if (rcStrict != VINF_SUCCESS)
1898 return rcStrict;
1899
1900 /*
1901 * Deal with it according to its type. We do the standard code selectors
1902 * here and dispatch the system selectors to worker functions.
1903 */
1904 if (!Desc.Legacy.Gen.u1DescType)
1905 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1906
1907 /* Only code segments. */
1908 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1909 {
1910 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1911 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1912 }
1913
1914 /* L vs D. */
1915 if ( Desc.Legacy.Gen.u1Long
1916 && Desc.Legacy.Gen.u1DefBig
1917 && IEM_IS_LONG_MODE(pIemCpu))
1918 {
1919 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1920 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1921 }
1922
1923 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1924 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1925 {
1926 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1927 {
1928 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1929 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1930 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1931 }
1932 }
1933 else
1934 {
1935 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1936 {
1937 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1938 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1939 }
1940 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1941 {
1942 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1943 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1944 }
1945 }
1946
1947 /* Is it there? */
1948 if (!Desc.Legacy.Gen.u1Present)
1949 {
1950 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1951 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1952 }
1953
1954 /* Check stack first - may #SS(0). */
1955 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1956 * 16-bit code cause a two or four byte CS to be pushed? */
1957 rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1958 enmEffOpSize == IEMMODE_64BIT ? 8+8
1959 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1960 &uPtrRet.pv, &uNewRsp);
1961 if (rcStrict != VINF_SUCCESS)
1962 return rcStrict;
1963
1964 /* Chop the high bits if 16-bit (Intel says so). */
1965 if (enmEffOpSize == IEMMODE_16BIT)
1966 offSeg &= UINT16_MAX;
1967
1968 /* Limit / canonical check. */
1969 uint64_t u64Base;
1970 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1971 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1972 {
1973 if (!IEM_IS_CANONICAL(offSeg))
1974 {
1975 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1976 return iemRaiseNotCanonical(pIemCpu);
1977 }
1978 u64Base = 0;
1979 }
1980 else
1981 {
1982 if (offSeg > cbLimit)
1983 {
1984 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1985 /** @todo: Intel says this is #GP(0)! */
1986 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1987 }
1988 u64Base = X86DESC_BASE(&Desc.Legacy);
1989 }
1990
1991 /*
1992 * Now set the accessed bit before
1993 * writing the return address to the stack and committing the result into
1994 * CS, CSHID and RIP.
1995 */
1996 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1997 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1998 {
1999 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
2000 if (rcStrict != VINF_SUCCESS)
2001 return rcStrict;
2002 /** @todo check what VT-x and AMD-V does. */
2003 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2004 }
2005
2006 /* stack */
2007 if (enmEffOpSize == IEMMODE_16BIT)
2008 {
2009 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2010 uPtrRet.pu16[1] = pCtx->cs.Sel;
2011 }
2012 else if (enmEffOpSize == IEMMODE_32BIT)
2013 {
2014 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2015 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2016 }
2017 else
2018 {
2019 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2020 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2021 }
2022 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
2023 if (rcStrict != VINF_SUCCESS)
2024 return rcStrict;
2025
2026 /* commit */
2027 pCtx->rip = offSeg;
2028 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2029 pCtx->cs.Sel |= pIemCpu->uCpl;
2030 pCtx->cs.ValidSel = pCtx->cs.Sel;
2031 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2032 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2033 pCtx->cs.u32Limit = cbLimit;
2034 pCtx->cs.u64Base = u64Base;
2035 pCtx->eflags.Bits.u1RF = 0;
2036 /** @todo check if the hidden bits are loaded correctly for 64-bit
2037 * mode. */
2038 return VINF_SUCCESS;
2039}
2040
2041
2042/**
2043 * Implements retf.
2044 *
2045 * @param enmEffOpSize The effective operand size.
2046 * @param cbPop The amount of arguments to pop from the stack
2047 * (bytes).
2048 */
2049IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2050{
2051 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2052 VBOXSTRICTRC rcStrict;
2053 RTCPTRUNION uPtrFrame;
2054 uint64_t uNewRsp;
2055 uint64_t uNewRip;
2056 uint16_t uNewCs;
2057 NOREF(cbInstr);
2058
2059 /*
2060 * Read the stack values first.
2061 */
2062 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2063 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2064 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2065 if (rcStrict != VINF_SUCCESS)
2066 return rcStrict;
2067 if (enmEffOpSize == IEMMODE_16BIT)
2068 {
2069 uNewRip = uPtrFrame.pu16[0];
2070 uNewCs = uPtrFrame.pu16[1];
2071 }
2072 else if (enmEffOpSize == IEMMODE_32BIT)
2073 {
2074 uNewRip = uPtrFrame.pu32[0];
2075 uNewCs = uPtrFrame.pu16[2];
2076 }
2077 else
2078 {
2079 uNewRip = uPtrFrame.pu64[0];
2080 uNewCs = uPtrFrame.pu16[4];
2081 }
2082
2083 /*
2084 * Real mode and V8086 mode are easy.
2085 */
2086 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2087 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2088 {
2089 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2090 /** @todo check how this is supposed to work if sp=0xfffe. */
2091
2092 /* Check the limit of the new EIP. */
2093 /** @todo Intel pseudo code only does the limit check for 16-bit
2094 * operands, AMD does not make any distinction. What is right? */
2095 if (uNewRip > pCtx->cs.u32Limit)
2096 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2097
2098 /* commit the operation. */
2099 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2100 if (rcStrict != VINF_SUCCESS)
2101 return rcStrict;
2102 pCtx->rip = uNewRip;
2103 pCtx->cs.Sel = uNewCs;
2104 pCtx->cs.ValidSel = uNewCs;
2105 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2106 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2107 pCtx->eflags.Bits.u1RF = 0;
2108 /** @todo do we load attribs and limit as well? */
2109 if (cbPop)
2110 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2111 return VINF_SUCCESS;
2112 }
2113
2114 /*
2115 * Protected mode is complicated, of course.
2116 */
2117 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2118 {
2119 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2120 return iemRaiseGeneralProtectionFault0(pIemCpu);
2121 }
2122
2123 /* Fetch the descriptor. */
2124 IEMSELDESC DescCs;
2125 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
2126 if (rcStrict != VINF_SUCCESS)
2127 return rcStrict;
2128
2129 /* Can only return to a code selector. */
2130 if ( !DescCs.Legacy.Gen.u1DescType
2131 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2132 {
2133 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2134 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2135 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2136 }
2137
2138 /* L vs D. */
2139 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2140 && DescCs.Legacy.Gen.u1DefBig
2141 && IEM_IS_LONG_MODE(pIemCpu))
2142 {
2143 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2144 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2145 }
2146
2147 /* DPL/RPL/CPL checks. */
2148 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2149 {
2150 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
2151 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2152 }
2153
2154 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2155 {
2156 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2157 {
2158 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2159 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2160 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2161 }
2162 }
2163 else
2164 {
2165 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2166 {
2167 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2168 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2169 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2170 }
2171 }
2172
2173 /* Is it there? */
2174 if (!DescCs.Legacy.Gen.u1Present)
2175 {
2176 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2177 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2178 }
2179
2180 /*
2181 * Return to outer privilege? (We'll typically have entered via a call gate.)
2182 */
2183 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2184 {
2185 /* Read the outer stack pointer stored *after* the parameters. */
2186 RTCPTRUNION uPtrStack;
2187 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
2188 if (rcStrict != VINF_SUCCESS)
2189 return rcStrict;
2190
2191 uPtrStack.pu8 += cbPop; /* Skip the parameters. */
2192
2193 uint16_t uNewOuterSs;
2194 uint64_t uNewOuterRsp;
2195 if (enmEffOpSize == IEMMODE_16BIT)
2196 {
2197 uNewOuterRsp = uPtrStack.pu16[0];
2198 uNewOuterSs = uPtrStack.pu16[1];
2199 }
2200 else if (enmEffOpSize == IEMMODE_32BIT)
2201 {
2202 uNewOuterRsp = uPtrStack.pu32[0];
2203 uNewOuterSs = uPtrStack.pu16[2];
2204 }
2205 else
2206 {
2207 uNewOuterRsp = uPtrStack.pu64[0];
2208 uNewOuterSs = uPtrStack.pu16[4];
2209 }
2210
2211 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2212 and read the selector. */
2213 IEMSELDESC DescSs;
2214 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2215 {
2216 if ( !DescCs.Legacy.Gen.u1Long
2217 || (uNewOuterSs & X86_SEL_RPL) == 3)
2218 {
2219 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2220 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2221 return iemRaiseGeneralProtectionFault0(pIemCpu);
2222 }
2223 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2224 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2225 }
2226 else
2227 {
2228 /* Fetch the descriptor for the new stack segment. */
2229 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2230 if (rcStrict != VINF_SUCCESS)
2231 return rcStrict;
2232 }
2233
2234 /* Check that RPL of stack and code selectors match. */
2235 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2236 {
2237 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2238 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2239 }
2240
2241 /* Must be a writable data segment. */
2242 if ( !DescSs.Legacy.Gen.u1DescType
2243 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2244 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2245 {
2246 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2247 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2248 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2249 }
2250
2251 /* L vs D. (Not mentioned by intel.) */
2252 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2253 && DescSs.Legacy.Gen.u1DefBig
2254 && IEM_IS_LONG_MODE(pIemCpu))
2255 {
2256 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2257 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2258 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2259 }
2260
2261 /* DPL/RPL/CPL checks. */
2262 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2263 {
2264 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2265 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2266 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2267 }
2268
2269 /* Is it there? */
2270 if (!DescSs.Legacy.Gen.u1Present)
2271 {
2272 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2273 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2274 }
2275
2276 /* Calc SS limit.*/
2277 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2278
2279 /* Is RIP canonical or within CS.limit? */
2280 uint64_t u64Base;
2281 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2282
2283 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2284 {
2285 if (!IEM_IS_CANONICAL(uNewRip))
2286 {
2287 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2288 return iemRaiseNotCanonical(pIemCpu);
2289 }
2290 u64Base = 0;
2291 }
2292 else
2293 {
2294 if (uNewRip > cbLimitCs)
2295 {
2296 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2297 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2298 /** @todo: Intel says this is #GP(0)! */
2299 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2300 }
2301 u64Base = X86DESC_BASE(&DescCs.Legacy);
2302 }
2303
2304 /*
2305 * Now set the accessed bit before
2306 * writing the return address to the stack and committing the result into
2307 * CS, CSHID and RIP.
2308 */
2309 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2310 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2311 {
2312 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2313 if (rcStrict != VINF_SUCCESS)
2314 return rcStrict;
2315 /** @todo check what VT-x and AMD-V does. */
2316 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2317 }
2318 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2319 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2320 {
2321 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
2322 if (rcStrict != VINF_SUCCESS)
2323 return rcStrict;
2324 /** @todo check what VT-x and AMD-V does. */
2325 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2326 }
2327
2328 /* commit */
2329 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2330 if (rcStrict != VINF_SUCCESS)
2331 return rcStrict;
2332 if (enmEffOpSize == IEMMODE_16BIT)
2333 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2334 else
2335 pCtx->rip = uNewRip;
2336 pCtx->cs.Sel = uNewCs;
2337 pCtx->cs.ValidSel = uNewCs;
2338 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2339 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2340 pCtx->cs.u32Limit = cbLimitCs;
2341 pCtx->cs.u64Base = u64Base;
2342 pCtx->rsp = uNewOuterRsp;
2343 pCtx->ss.Sel = uNewOuterSs;
2344 pCtx->ss.ValidSel = uNewOuterSs;
2345 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2346 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2347 pCtx->ss.u32Limit = cbLimitSs;
2348 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2349 pCtx->ss.u64Base = 0;
2350 else
2351 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2352
2353 pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
2354 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2355 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2356 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2357 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2358
2359 /** @todo check if the hidden bits are loaded correctly for 64-bit
2360 * mode. */
2361
2362 if (cbPop)
2363 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2364 pCtx->eflags.Bits.u1RF = 0;
2365
2366 /* Done! */
2367 }
2368 /*
2369 * Return to the same privilege level
2370 */
2371 else
2372 {
2373 /* Limit / canonical check. */
2374 uint64_t u64Base;
2375 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2376
2377 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2378 {
2379 if (!IEM_IS_CANONICAL(uNewRip))
2380 {
2381 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2382 return iemRaiseNotCanonical(pIemCpu);
2383 }
2384 u64Base = 0;
2385 }
2386 else
2387 {
2388 if (uNewRip > cbLimitCs)
2389 {
2390 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2391 /** @todo: Intel says this is #GP(0)! */
2392 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2393 }
2394 u64Base = X86DESC_BASE(&DescCs.Legacy);
2395 }
2396
2397 /*
2398 * Now set the accessed bit before
2399 * writing the return address to the stack and committing the result into
2400 * CS, CSHID and RIP.
2401 */
2402 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2403 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2404 {
2405 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2406 if (rcStrict != VINF_SUCCESS)
2407 return rcStrict;
2408 /** @todo check what VT-x and AMD-V does. */
2409 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2410 }
2411
2412 /* commit */
2413 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2414 if (rcStrict != VINF_SUCCESS)
2415 return rcStrict;
2416 if (enmEffOpSize == IEMMODE_16BIT)
2417 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2418 else
2419 pCtx->rip = uNewRip;
2420 pCtx->cs.Sel = uNewCs;
2421 pCtx->cs.ValidSel = uNewCs;
2422 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2423 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2424 pCtx->cs.u32Limit = cbLimitCs;
2425 pCtx->cs.u64Base = u64Base;
2426 /** @todo check if the hidden bits are loaded correctly for 64-bit
2427 * mode. */
2428 if (cbPop)
2429 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2430 pCtx->eflags.Bits.u1RF = 0;
2431 }
2432 return VINF_SUCCESS;
2433}
2434
2435
2436/**
2437 * Implements retn.
2438 *
2439 * We're doing this in C because of the \#GP that might be raised if the popped
2440 * program counter is out of bounds.
2441 *
2442 * @param enmEffOpSize The effective operand size.
2443 * @param cbPop The amount of arguments to pop from the stack
2444 * (bytes).
2445 */
2446IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2447{
2448 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2449 NOREF(cbInstr);
2450
2451 /* Fetch the RSP from the stack. */
2452 VBOXSTRICTRC rcStrict;
2453 RTUINT64U NewRip;
2454 RTUINT64U NewRsp;
2455 NewRsp.u = pCtx->rsp;
2456 switch (enmEffOpSize)
2457 {
2458 case IEMMODE_16BIT:
2459 NewRip.u = 0;
2460 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
2461 break;
2462 case IEMMODE_32BIT:
2463 NewRip.u = 0;
2464 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
2465 break;
2466 case IEMMODE_64BIT:
2467 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
2468 break;
2469 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2470 }
2471 if (rcStrict != VINF_SUCCESS)
2472 return rcStrict;
2473
2474 /* Check the new RSP before loading it. */
2475 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2476 * of it. The canonical test is performed here and for call. */
2477 if (enmEffOpSize != IEMMODE_64BIT)
2478 {
2479 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2480 {
2481 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2482 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2483 }
2484 }
2485 else
2486 {
2487 if (!IEM_IS_CANONICAL(NewRip.u))
2488 {
2489 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2490 return iemRaiseNotCanonical(pIemCpu);
2491 }
2492 }
2493
2494 /* Commit it. */
2495 pCtx->rip = NewRip.u;
2496 pCtx->rsp = NewRsp.u;
2497 if (cbPop)
2498 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2499 pCtx->eflags.Bits.u1RF = 0;
2500
2501 return VINF_SUCCESS;
2502}
2503
2504
2505/**
2506 * Implements enter.
2507 *
2508 * We're doing this in C because the instruction is insane, even for the
2509 * u8NestingLevel=0 case dealing with the stack is tedious.
2510 *
2511 * @param enmEffOpSize The effective operand size.
2512 */
2513IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2514{
2515 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2516
2517 /* Push RBP, saving the old value in TmpRbp. */
2518 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2519 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2520 RTUINT64U NewRbp;
2521 VBOXSTRICTRC rcStrict;
2522 if (enmEffOpSize == IEMMODE_64BIT)
2523 {
2524 rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
2525 NewRbp = NewRsp;
2526 }
2527 else if (enmEffOpSize == IEMMODE_32BIT)
2528 {
2529 rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
2530 NewRbp = NewRsp;
2531 }
2532 else
2533 {
2534 rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
2535 NewRbp = TmpRbp;
2536 NewRbp.Words.w0 = NewRsp.Words.w0;
2537 }
2538 if (rcStrict != VINF_SUCCESS)
2539 return rcStrict;
2540
2541 /* Copy the parameters (aka nesting levels by Intel). */
2542 cParameters &= 0x1f;
2543 if (cParameters > 0)
2544 {
2545 switch (enmEffOpSize)
2546 {
2547 case IEMMODE_16BIT:
2548 if (pCtx->ss.Attr.n.u1DefBig)
2549 TmpRbp.DWords.dw0 -= 2;
2550 else
2551 TmpRbp.Words.w0 -= 2;
2552 do
2553 {
2554 uint16_t u16Tmp;
2555 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
2556 if (rcStrict != VINF_SUCCESS)
2557 break;
2558 rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
2559 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2560 break;
2561
2562 case IEMMODE_32BIT:
2563 if (pCtx->ss.Attr.n.u1DefBig)
2564 TmpRbp.DWords.dw0 -= 4;
2565 else
2566 TmpRbp.Words.w0 -= 4;
2567 do
2568 {
2569 uint32_t u32Tmp;
2570 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
2571 if (rcStrict != VINF_SUCCESS)
2572 break;
2573 rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
2574 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2575 break;
2576
2577 case IEMMODE_64BIT:
2578 TmpRbp.u -= 8;
2579 do
2580 {
2581 uint64_t u64Tmp;
2582 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
2583 if (rcStrict != VINF_SUCCESS)
2584 break;
2585 rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
2586 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2587 break;
2588
2589 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2590 }
2591 if (rcStrict != VINF_SUCCESS)
2592 return VINF_SUCCESS;
2593
2594 /* Push the new RBP */
2595 if (enmEffOpSize == IEMMODE_64BIT)
2596 rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
2597 else if (enmEffOpSize == IEMMODE_32BIT)
2598 rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
2599 else
2600 rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
2601 if (rcStrict != VINF_SUCCESS)
2602 return rcStrict;
2603
2604 }
2605
2606 /* Recalc RSP. */
2607 iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
2608
2609 /** @todo Should probe write access at the new RSP according to AMD. */
2610
2611 /* Commit it. */
2612 pCtx->rbp = NewRbp.u;
2613 pCtx->rsp = NewRsp.u;
2614 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2615
2616 return VINF_SUCCESS;
2617}
2618
2619
2620
2621/**
2622 * Implements leave.
2623 *
2624 * We're doing this in C because messing with the stack registers is annoying
2625 * since they depends on SS attributes.
2626 *
2627 * @param enmEffOpSize The effective operand size.
2628 */
2629IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2630{
2631 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2632
2633 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2634 RTUINT64U NewRsp;
2635 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2636 NewRsp.u = pCtx->rbp;
2637 else if (pCtx->ss.Attr.n.u1DefBig)
2638 NewRsp.u = pCtx->ebp;
2639 else
2640 {
2641 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2642 NewRsp.u = pCtx->rsp;
2643 NewRsp.Words.w0 = pCtx->bp;
2644 }
2645
2646 /* Pop RBP according to the operand size. */
2647 VBOXSTRICTRC rcStrict;
2648 RTUINT64U NewRbp;
2649 switch (enmEffOpSize)
2650 {
2651 case IEMMODE_16BIT:
2652 NewRbp.u = pCtx->rbp;
2653 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
2654 break;
2655 case IEMMODE_32BIT:
2656 NewRbp.u = 0;
2657 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
2658 break;
2659 case IEMMODE_64BIT:
2660 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
2661 break;
2662 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2663 }
2664 if (rcStrict != VINF_SUCCESS)
2665 return rcStrict;
2666
2667
2668 /* Commit it. */
2669 pCtx->rbp = NewRbp.u;
2670 pCtx->rsp = NewRsp.u;
2671 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2672
2673 return VINF_SUCCESS;
2674}
2675
2676
2677/**
2678 * Implements int3 and int XX.
2679 *
2680 * @param u8Int The interrupt vector number.
2681 * @param fIsBpInstr Is it the breakpoint instruction.
2682 */
2683IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2684{
2685 Assert(pIemCpu->cXcptRecursions == 0);
2686 return iemRaiseXcptOrInt(pIemCpu,
2687 cbInstr,
2688 u8Int,
2689 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2690 0,
2691 0);
2692}
2693
2694
2695/**
2696 * Implements iret for real mode and V8086 mode.
2697 *
2698 * @param enmEffOpSize The effective operand size.
2699 */
2700IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2701{
2702 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2703 X86EFLAGS Efl;
2704 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2705 NOREF(cbInstr);
2706
2707 /*
2708 * iret throws an exception if VME isn't enabled.
2709 */
2710 if ( Efl.Bits.u1VM
2711 && Efl.Bits.u2IOPL != 3
2712 && !(pCtx->cr4 & X86_CR4_VME))
2713 return iemRaiseGeneralProtectionFault0(pIemCpu);
2714
2715 /*
2716 * Do the stack bits, but don't commit RSP before everything checks
2717 * out right.
2718 */
2719 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2720 VBOXSTRICTRC rcStrict;
2721 RTCPTRUNION uFrame;
2722 uint16_t uNewCs;
2723 uint32_t uNewEip;
2724 uint32_t uNewFlags;
2725 uint64_t uNewRsp;
2726 if (enmEffOpSize == IEMMODE_32BIT)
2727 {
2728 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2729 if (rcStrict != VINF_SUCCESS)
2730 return rcStrict;
2731 uNewEip = uFrame.pu32[0];
2732 if (uNewEip > UINT16_MAX)
2733 return iemRaiseGeneralProtectionFault0(pIemCpu);
2734
2735 uNewCs = (uint16_t)uFrame.pu32[1];
2736 uNewFlags = uFrame.pu32[2];
2737 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2738 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2739 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2740 | X86_EFL_ID;
2741 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2742 }
2743 else
2744 {
2745 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2746 if (rcStrict != VINF_SUCCESS)
2747 return rcStrict;
2748 uNewEip = uFrame.pu16[0];
2749 uNewCs = uFrame.pu16[1];
2750 uNewFlags = uFrame.pu16[2];
2751 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2752 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2753 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2754 /** @todo The intel pseudo code does not indicate what happens to
2755 * reserved flags. We just ignore them. */
2756 }
2757 /** @todo Check how this is supposed to work if sp=0xfffe. */
2758 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2759 uNewCs, uNewEip, uNewFlags, uNewRsp));
2760
2761 /*
2762 * Check the limit of the new EIP.
2763 */
2764 /** @todo Only the AMD pseudo code check the limit here, what's
2765 * right? */
2766 if (uNewEip > pCtx->cs.u32Limit)
2767 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2768
2769 /*
2770 * V8086 checks and flag adjustments
2771 */
2772 if (Efl.Bits.u1VM)
2773 {
2774 if (Efl.Bits.u2IOPL == 3)
2775 {
2776 /* Preserve IOPL and clear RF. */
2777 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2778 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2779 }
2780 else if ( enmEffOpSize == IEMMODE_16BIT
2781 && ( !(uNewFlags & X86_EFL_IF)
2782 || !Efl.Bits.u1VIP )
2783 && !(uNewFlags & X86_EFL_TF) )
2784 {
2785 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2786 uNewFlags &= ~X86_EFL_VIF;
2787 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2788 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2789 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2790 }
2791 else
2792 return iemRaiseGeneralProtectionFault0(pIemCpu);
2793 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2794 }
2795
2796 /*
2797 * Commit the operation.
2798 */
2799 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2800 if (rcStrict != VINF_SUCCESS)
2801 return rcStrict;
2802#ifdef DBGFTRACE_ENABLED
2803 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2804 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2805#endif
2806
2807 pCtx->rip = uNewEip;
2808 pCtx->cs.Sel = uNewCs;
2809 pCtx->cs.ValidSel = uNewCs;
2810 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2811 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2812 /** @todo do we load attribs and limit as well? */
2813 Assert(uNewFlags & X86_EFL_1);
2814 IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2815
2816 return VINF_SUCCESS;
2817}
2818
2819
2820/**
2821 * Loads a segment register when entering V8086 mode.
2822 *
2823 * @param pSReg The segment register.
2824 * @param uSeg The segment to load.
2825 */
2826static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2827{
2828 pSReg->Sel = uSeg;
2829 pSReg->ValidSel = uSeg;
2830 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2831 pSReg->u64Base = (uint32_t)uSeg << 4;
2832 pSReg->u32Limit = 0xffff;
2833 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2834 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2835 * IRET'ing to V8086. */
2836}
2837
2838
2839/**
2840 * Implements iret for protected mode returning to V8086 mode.
2841 *
2842 * @param pCtx Pointer to the CPU context.
2843 * @param uNewEip The new EIP.
2844 * @param uNewCs The new CS.
2845 * @param uNewFlags The new EFLAGS.
2846 * @param uNewRsp The RSP after the initial IRET frame.
2847 *
2848 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2849 */
2850IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2851 uint32_t, uNewFlags, uint64_t, uNewRsp)
2852{
2853 /*
2854 * Pop the V8086 specific frame bits off the stack.
2855 */
2856 VBOXSTRICTRC rcStrict;
2857 RTCPTRUNION uFrame;
2858 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2859 if (rcStrict != VINF_SUCCESS)
2860 return rcStrict;
2861 uint32_t uNewEsp = uFrame.pu32[0];
2862 uint16_t uNewSs = uFrame.pu32[1];
2863 uint16_t uNewEs = uFrame.pu32[2];
2864 uint16_t uNewDs = uFrame.pu32[3];
2865 uint16_t uNewFs = uFrame.pu32[4];
2866 uint16_t uNewGs = uFrame.pu32[5];
2867 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2868 if (rcStrict != VINF_SUCCESS)
2869 return rcStrict;
2870
2871 /*
2872 * Commit the operation.
2873 */
2874 uNewFlags &= X86_EFL_LIVE_MASK;
2875 uNewFlags |= X86_EFL_RA1_MASK;
2876#ifdef DBGFTRACE_ENABLED
2877 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2878 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2879#endif
2880
2881 IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2882 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2883 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2884 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2885 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2886 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2887 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2888 pCtx->rip = uNewEip;
2889 pCtx->rsp = uNewEsp;
2890 pIemCpu->uCpl = 3;
2891
2892 return VINF_SUCCESS;
2893}
2894
2895
2896/**
2897 * Implements iret for protected mode returning via a nested task.
2898 *
2899 * @param enmEffOpSize The effective operand size.
2900 */
2901IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2902{
2903 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
2904#ifndef IEM_IMPLEMENTS_TASKSWITCH
2905 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2906#else
2907 /*
2908 * Read the segment selector in the link-field of the current TSS.
2909 */
2910 RTSEL uSelRet;
2911 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2912 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
2913 if (rcStrict != VINF_SUCCESS)
2914 return rcStrict;
2915
2916 /*
2917 * Fetch the returning task's TSS descriptor from the GDT.
2918 */
2919 if (uSelRet & X86_SEL_LDT)
2920 {
2921 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
2922 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet);
2923 }
2924
2925 IEMSELDESC TssDesc;
2926 rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelRet, X86_XCPT_GP);
2927 if (rcStrict != VINF_SUCCESS)
2928 return rcStrict;
2929
2930 if (TssDesc.Legacy.Gate.u1DescType)
2931 {
2932 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
2933 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2934 }
2935
2936 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
2937 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
2938 {
2939 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
2940 return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2941 }
2942
2943 if (!TssDesc.Legacy.Gate.u1Present)
2944 {
2945 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
2946 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2947 }
2948
2949 uint32_t uNextEip = pCtx->eip + cbInstr;
2950 return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
2951 0 /* uCr2 */, uSelRet, &TssDesc);
2952#endif
2953}
2954
2955
2956/**
2957 * Implements iret for protected mode
2958 *
2959 * @param enmEffOpSize The effective operand size.
2960 */
2961IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2962{
2963 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2964 NOREF(cbInstr);
2965
2966 /*
2967 * Nested task return.
2968 */
2969 if (pCtx->eflags.Bits.u1NT)
2970 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2971
2972 /*
2973 * Normal return.
2974 *
2975 * Do the stack bits, but don't commit RSP before everything checks
2976 * out right.
2977 */
2978 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2979 VBOXSTRICTRC rcStrict;
2980 RTCPTRUNION uFrame;
2981 uint16_t uNewCs;
2982 uint32_t uNewEip;
2983 uint32_t uNewFlags;
2984 uint64_t uNewRsp;
2985 if (enmEffOpSize == IEMMODE_32BIT)
2986 {
2987 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2988 if (rcStrict != VINF_SUCCESS)
2989 return rcStrict;
2990 uNewEip = uFrame.pu32[0];
2991 uNewCs = (uint16_t)uFrame.pu32[1];
2992 uNewFlags = uFrame.pu32[2];
2993 }
2994 else
2995 {
2996 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2997 if (rcStrict != VINF_SUCCESS)
2998 return rcStrict;
2999 uNewEip = uFrame.pu16[0];
3000 uNewCs = uFrame.pu16[1];
3001 uNewFlags = uFrame.pu16[2];
3002 }
3003 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3004 if (rcStrict != VINF_SUCCESS)
3005 return rcStrict;
3006 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3007
3008 /*
3009 * We're hopefully not returning to V8086 mode...
3010 */
3011 if ( (uNewFlags & X86_EFL_VM)
3012 && pIemCpu->uCpl == 0)
3013 {
3014 Assert(enmEffOpSize == IEMMODE_32BIT);
3015 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3016 }
3017
3018 /*
3019 * Protected mode.
3020 */
3021 /* Read the CS descriptor. */
3022 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3023 {
3024 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3025 return iemRaiseGeneralProtectionFault0(pIemCpu);
3026 }
3027
3028 IEMSELDESC DescCS;
3029 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
3030 if (rcStrict != VINF_SUCCESS)
3031 {
3032 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3033 return rcStrict;
3034 }
3035
3036 /* Must be a code descriptor. */
3037 if (!DescCS.Legacy.Gen.u1DescType)
3038 {
3039 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3040 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3041 }
3042 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3043 {
3044 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3045 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3046 }
3047
3048#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3049 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3050 PVM pVM = IEMCPU_TO_VM(pIemCpu);
3051 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3052 {
3053 if ((uNewCs & X86_SEL_RPL) == 1)
3054 {
3055 if ( pIemCpu->uCpl == 0
3056 && ( !EMIsRawRing1Enabled(pVM)
3057 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3058 {
3059 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3060 uNewCs &= X86_SEL_MASK_OFF_RPL;
3061 }
3062# ifdef LOG_ENABLED
3063 else if (pIemCpu->uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3064 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3065# endif
3066 }
3067 else if ( (uNewCs & X86_SEL_RPL) == 2
3068 && EMIsRawRing1Enabled(pVM)
3069 && pIemCpu->uCpl <= 1)
3070 {
3071 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3072 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3073 }
3074 }
3075#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3076
3077
3078 /* Privilege checks. */
3079 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
3080 {
3081 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
3082 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3083 }
3084 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
3085 && (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3086 {
3087 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3088 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3089 }
3090
3091 /* Present? */
3092 if (!DescCS.Legacy.Gen.u1Present)
3093 {
3094 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3095 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
3096 }
3097
3098 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3099
3100 /*
3101 * Return to outer level?
3102 */
3103 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
3104 {
3105 uint16_t uNewSS;
3106 uint32_t uNewESP;
3107 if (enmEffOpSize == IEMMODE_32BIT)
3108 {
3109 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
3110 if (rcStrict != VINF_SUCCESS)
3111 return rcStrict;
3112/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3113 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3114 * bit of the popped SS selector it turns out. */
3115 uNewESP = uFrame.pu32[0];
3116 uNewSS = (uint16_t)uFrame.pu32[1];
3117 }
3118 else
3119 {
3120 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 4, &uFrame.pv, &uNewRsp);
3121 if (rcStrict != VINF_SUCCESS)
3122 return rcStrict;
3123 uNewESP = uFrame.pu16[0];
3124 uNewSS = uFrame.pu16[1];
3125 }
3126 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3127 if (rcStrict != VINF_SUCCESS)
3128 return rcStrict;
3129 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3130
3131 /* Read the SS descriptor. */
3132 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3133 {
3134 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3135 return iemRaiseGeneralProtectionFault0(pIemCpu);
3136 }
3137
3138 IEMSELDESC DescSS;
3139 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3140 if (rcStrict != VINF_SUCCESS)
3141 {
3142 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3143 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3144 return rcStrict;
3145 }
3146
3147 /* Privilege checks. */
3148 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3149 {
3150 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3151 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3152 }
3153 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3154 {
3155 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3156 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3157 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3158 }
3159
3160 /* Must be a writeable data segment descriptor. */
3161 if (!DescSS.Legacy.Gen.u1DescType)
3162 {
3163 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3164 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3165 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3166 }
3167 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3168 {
3169 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3170 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3171 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3172 }
3173
3174 /* Present? */
3175 if (!DescSS.Legacy.Gen.u1Present)
3176 {
3177 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3178 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
3179 }
3180
3181 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3182
3183 /* Check EIP. */
3184 if (uNewEip > cbLimitCS)
3185 {
3186 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3187 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3188 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3189 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3190 }
3191
3192 /*
3193 * Commit the changes, marking CS and SS accessed first since
3194 * that may fail.
3195 */
3196 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3197 {
3198 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3199 if (rcStrict != VINF_SUCCESS)
3200 return rcStrict;
3201 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3202 }
3203 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3204 {
3205 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
3206 if (rcStrict != VINF_SUCCESS)
3207 return rcStrict;
3208 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3209 }
3210
3211 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3212 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3213 if (enmEffOpSize != IEMMODE_16BIT)
3214 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3215 if (pIemCpu->uCpl == 0)
3216 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3217 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
3218 fEFlagsMask |= X86_EFL_IF;
3219 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
3220 fEFlagsNew &= ~fEFlagsMask;
3221 fEFlagsNew |= uNewFlags & fEFlagsMask;
3222#ifdef DBGFTRACE_ENABLED
3223 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3224 pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3225 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3226#endif
3227
3228 IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
3229 pCtx->rip = uNewEip;
3230 pCtx->cs.Sel = uNewCs;
3231 pCtx->cs.ValidSel = uNewCs;
3232 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3233 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3234 pCtx->cs.u32Limit = cbLimitCS;
3235 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3236 if (!pCtx->ss.Attr.n.u1DefBig)
3237 pCtx->sp = (uint16_t)uNewESP;
3238 else
3239 pCtx->rsp = uNewESP;
3240 pCtx->ss.Sel = uNewSS;
3241 pCtx->ss.ValidSel = uNewSS;
3242 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3243 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3244 pCtx->ss.u32Limit = cbLimitSs;
3245 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3246
3247 pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
3248 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3249 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3250 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3251 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3252
3253 /* Done! */
3254
3255 }
3256 /*
3257 * Return to the same level.
3258 */
3259 else
3260 {
3261 /* Check EIP. */
3262 if (uNewEip > cbLimitCS)
3263 {
3264 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3265 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3266 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3267 }
3268
3269 /*
3270 * Commit the changes, marking CS first since it may fail.
3271 */
3272 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3273 {
3274 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3275 if (rcStrict != VINF_SUCCESS)
3276 return rcStrict;
3277 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3278 }
3279
3280 X86EFLAGS NewEfl;
3281 NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
3282 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3283 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3284 if (enmEffOpSize != IEMMODE_16BIT)
3285 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3286 if (pIemCpu->uCpl == 0)
3287 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3288 else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
3289 fEFlagsMask |= X86_EFL_IF;
3290 NewEfl.u &= ~fEFlagsMask;
3291 NewEfl.u |= fEFlagsMask & uNewFlags;
3292#ifdef DBGFTRACE_ENABLED
3293 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3294 pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
3295 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3296#endif
3297
3298 IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
3299 pCtx->rip = uNewEip;
3300 pCtx->cs.Sel = uNewCs;
3301 pCtx->cs.ValidSel = uNewCs;
3302 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3303 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3304 pCtx->cs.u32Limit = cbLimitCS;
3305 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3306 pCtx->rsp = uNewRsp;
3307 /* Done! */
3308 }
3309 return VINF_SUCCESS;
3310}
3311
3312
3313/**
3314 * Implements iret for long mode
3315 *
3316 * @param enmEffOpSize The effective operand size.
3317 */
3318IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
3319{
3320 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3321 NOREF(cbInstr);
3322
3323 /*
3324 * Nested task return is not supported in long mode.
3325 */
3326 if (pCtx->eflags.Bits.u1NT)
3327 {
3328 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3329 return iemRaiseGeneralProtectionFault0(pIemCpu);
3330 }
3331
3332 /*
3333 * Normal return.
3334 *
3335 * Do the stack bits, but don't commit RSP before everything checks
3336 * out right.
3337 */
3338 VBOXSTRICTRC rcStrict;
3339 RTCPTRUNION uFrame;
3340 uint64_t uNewRip;
3341 uint16_t uNewCs;
3342 uint16_t uNewSs;
3343 uint32_t uNewFlags;
3344 uint64_t uNewRsp;
3345 if (enmEffOpSize == IEMMODE_64BIT)
3346 {
3347 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
3348 if (rcStrict != VINF_SUCCESS)
3349 return rcStrict;
3350 uNewRip = uFrame.pu64[0];
3351 uNewCs = (uint16_t)uFrame.pu64[1];
3352 uNewFlags = (uint32_t)uFrame.pu64[2];
3353 uNewRsp = uFrame.pu64[3];
3354 uNewSs = (uint16_t)uFrame.pu64[4];
3355 }
3356 else if (enmEffOpSize == IEMMODE_32BIT)
3357 {
3358 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
3359 if (rcStrict != VINF_SUCCESS)
3360 return rcStrict;
3361 uNewRip = uFrame.pu32[0];
3362 uNewCs = (uint16_t)uFrame.pu32[1];
3363 uNewFlags = uFrame.pu32[2];
3364 uNewRsp = uFrame.pu32[3];
3365 uNewSs = (uint16_t)uFrame.pu32[4];
3366 }
3367 else
3368 {
3369 Assert(enmEffOpSize == IEMMODE_16BIT);
3370 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
3371 if (rcStrict != VINF_SUCCESS)
3372 return rcStrict;
3373 uNewRip = uFrame.pu16[0];
3374 uNewCs = uFrame.pu16[1];
3375 uNewFlags = uFrame.pu16[2];
3376 uNewRsp = uFrame.pu16[3];
3377 uNewSs = uFrame.pu16[4];
3378 }
3379 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3380 if (rcStrict != VINF_SUCCESS)
3381 return rcStrict;
3382 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3383
3384 /*
3385 * Check stuff.
3386 */
3387 /* Read the CS descriptor. */
3388 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3389 {
3390 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3391 return iemRaiseGeneralProtectionFault0(pIemCpu);
3392 }
3393
3394 IEMSELDESC DescCS;
3395 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
3396 if (rcStrict != VINF_SUCCESS)
3397 {
3398 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3399 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3400 return rcStrict;
3401 }
3402
3403 /* Must be a code descriptor. */
3404 if ( !DescCS.Legacy.Gen.u1DescType
3405 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3406 {
3407 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3408 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3409 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3410 }
3411
3412 /* Privilege checks. */
3413 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3414 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
3415 {
3416 Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp, pIemCpu->uCpl));
3417 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3418 }
3419 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
3420 && (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3421 {
3422 Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < DPL (%d) -> #GP\n",
3423 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u2Dpl));
3424 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3425 }
3426
3427 /* Present? */
3428 if (!DescCS.Legacy.Gen.u1Present)
3429 {
3430 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3431 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
3432 }
3433
3434 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3435
3436 /* Read the SS descriptor. */
3437 IEMSELDESC DescSS;
3438 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3439 {
3440 if ( !DescCS.Legacy.Gen.u1Long
3441 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3442 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3443 {
3444 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3445 return iemRaiseGeneralProtectionFault0(pIemCpu);
3446 }
3447 DescSS.Legacy.u = 0;
3448 }
3449 else
3450 {
3451 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3452 if (rcStrict != VINF_SUCCESS)
3453 {
3454 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3455 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3456 return rcStrict;
3457 }
3458 }
3459
3460 /* Privilege checks. */
3461 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3462 {
3463 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3464 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3465 }
3466
3467 uint32_t cbLimitSs;
3468 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3469 cbLimitSs = UINT32_MAX;
3470 else
3471 {
3472 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3473 {
3474 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3475 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3476 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3477 }
3478
3479 /* Must be a writeable data segment descriptor. */
3480 if (!DescSS.Legacy.Gen.u1DescType)
3481 {
3482 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3483 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3484 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3485 }
3486 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3487 {
3488 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3489 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3490 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3491 }
3492
3493 /* Present? */
3494 if (!DescSS.Legacy.Gen.u1Present)
3495 {
3496 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3497 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
3498 }
3499 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3500 }
3501
3502 /* Check EIP. */
3503 if (DescCS.Legacy.Gen.u1Long)
3504 {
3505 if (!IEM_IS_CANONICAL(uNewRip))
3506 {
3507 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3508 uNewCs, uNewRip, uNewSs, uNewRsp));
3509 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3510 }
3511 }
3512 else
3513 {
3514 if (uNewRip > cbLimitCS)
3515 {
3516 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3517 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3518 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3519 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3520 }
3521 }
3522
3523 /*
3524 * Commit the changes, marking CS and SS accessed first since
3525 * that may fail.
3526 */
3527 /** @todo where exactly are these actually marked accessed by a real CPU? */
3528 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3529 {
3530 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3531 if (rcStrict != VINF_SUCCESS)
3532 return rcStrict;
3533 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3534 }
3535 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3536 {
3537 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
3538 if (rcStrict != VINF_SUCCESS)
3539 return rcStrict;
3540 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3541 }
3542
3543 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3544 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3545 if (enmEffOpSize != IEMMODE_16BIT)
3546 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3547 if (pIemCpu->uCpl == 0)
3548 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3549 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
3550 fEFlagsMask |= X86_EFL_IF;
3551 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
3552 fEFlagsNew &= ~fEFlagsMask;
3553 fEFlagsNew |= uNewFlags & fEFlagsMask;
3554#ifdef DBGFTRACE_ENABLED
3555 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3556 pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3557#endif
3558
3559 IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
3560 pCtx->rip = uNewRip;
3561 pCtx->cs.Sel = uNewCs;
3562 pCtx->cs.ValidSel = uNewCs;
3563 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3564 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3565 pCtx->cs.u32Limit = cbLimitCS;
3566 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3567 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3568 pCtx->rsp = uNewRsp;
3569 else
3570 pCtx->sp = (uint16_t)uNewRsp;
3571 pCtx->ss.Sel = uNewSs;
3572 pCtx->ss.ValidSel = uNewSs;
3573 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3574 {
3575 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3576 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3577 pCtx->ss.u32Limit = UINT32_MAX;
3578 pCtx->ss.u64Base = 0;
3579 Log2(("iretq new SS: NULL\n"));
3580 }
3581 else
3582 {
3583 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3584 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3585 pCtx->ss.u32Limit = cbLimitSs;
3586 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3587 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3588 }
3589
3590 if (pIemCpu->uCpl != uNewCpl)
3591 {
3592 pIemCpu->uCpl = uNewCpl;
3593 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
3594 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
3595 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
3596 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
3597 }
3598
3599 return VINF_SUCCESS;
3600}
3601
3602
3603/**
3604 * Implements iret.
3605 *
3606 * @param enmEffOpSize The effective operand size.
3607 */
3608IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3609{
3610 /*
3611 * First, clear NMI blocking, if any, before causing any exceptions.
3612 */
3613 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3614 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3615
3616 /*
3617 * Call a mode specific worker.
3618 */
3619 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3620 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3621 if (IEM_IS_LONG_MODE(pIemCpu))
3622 return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
3623 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3624}
3625
3626
3627/**
3628 * Implements SYSCALL (AMD and Intel64).
3629 *
3630 * @param enmEffOpSize The effective operand size.
3631 */
3632IEM_CIMPL_DEF_0(iemCImpl_syscall)
3633{
3634 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3635
3636 /*
3637 * Check preconditions.
3638 *
3639 * Note that CPUs described in the documentation may load a few odd values
3640 * into CS and SS than we allow here. This has yet to be checked on real
3641 * hardware.
3642 */
3643 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3644 {
3645 Log(("syscall: Not enabled in EFER -> #UD\n"));
3646 return iemRaiseUndefinedOpcode(pIemCpu);
3647 }
3648 if (!(pCtx->cr0 & X86_CR0_PE))
3649 {
3650 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3651 return iemRaiseGeneralProtectionFault0(pIemCpu);
3652 }
3653 if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3654 {
3655 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3656 return iemRaiseUndefinedOpcode(pIemCpu);
3657 }
3658
3659 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3660 /** @todo what about LDT selectors? Shouldn't matter, really. */
3661 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3662 uint16_t uNewSs = uNewCs + 8;
3663 if (uNewCs == 0 || uNewSs == 0)
3664 {
3665 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3666 return iemRaiseGeneralProtectionFault0(pIemCpu);
3667 }
3668
3669 /* Long mode and legacy mode differs. */
3670 if (CPUMIsGuestInLongModeEx(pCtx))
3671 {
3672 uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3673
3674 /* This test isn't in the docs, but I'm not trusting the guys writing
3675 the MSRs to have validated the values as canonical like they should. */
3676 if (!IEM_IS_CANONICAL(uNewRip))
3677 {
3678 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3679 return iemRaiseUndefinedOpcode(pIemCpu);
3680 }
3681
3682 /*
3683 * Commit it.
3684 */
3685 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3686 pCtx->rcx = pCtx->rip + cbInstr;
3687 pCtx->rip = uNewRip;
3688
3689 pCtx->rflags.u &= ~X86_EFL_RF;
3690 pCtx->r11 = pCtx->rflags.u;
3691 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3692 pCtx->rflags.u |= X86_EFL_1;
3693
3694 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3695 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3696 }
3697 else
3698 {
3699 /*
3700 * Commit it.
3701 */
3702 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3703 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3704 pCtx->rcx = pCtx->eip + cbInstr;
3705 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3706 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3707
3708 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3709 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3710 }
3711 pCtx->cs.Sel = uNewCs;
3712 pCtx->cs.ValidSel = uNewCs;
3713 pCtx->cs.u64Base = 0;
3714 pCtx->cs.u32Limit = UINT32_MAX;
3715 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3716
3717 pCtx->ss.Sel = uNewSs;
3718 pCtx->ss.ValidSel = uNewSs;
3719 pCtx->ss.u64Base = 0;
3720 pCtx->ss.u32Limit = UINT32_MAX;
3721 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3722
3723 return VINF_SUCCESS;
3724}
3725
3726
3727/**
3728 * Implements SYSRET (AMD and Intel64).
3729 */
3730IEM_CIMPL_DEF_0(iemCImpl_sysret)
3731
3732{
3733 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3734
3735 /*
3736 * Check preconditions.
3737 *
3738 * Note that CPUs described in the documentation may load a few odd values
3739 * into CS and SS than we allow here. This has yet to be checked on real
3740 * hardware.
3741 */
3742 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3743 {
3744 Log(("sysret: Not enabled in EFER -> #UD\n"));
3745 return iemRaiseUndefinedOpcode(pIemCpu);
3746 }
3747 if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3748 {
3749 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3750 return iemRaiseUndefinedOpcode(pIemCpu);
3751 }
3752 if (!(pCtx->cr0 & X86_CR0_PE))
3753 {
3754 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3755 return iemRaiseGeneralProtectionFault0(pIemCpu);
3756 }
3757 if (pIemCpu->uCpl != 0)
3758 {
3759 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
3760 return iemRaiseGeneralProtectionFault0(pIemCpu);
3761 }
3762
3763 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3764 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3765 uint16_t uNewSs = uNewCs + 8;
3766 if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3767 uNewCs += 16;
3768 if (uNewCs == 0 || uNewSs == 0)
3769 {
3770 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3771 return iemRaiseGeneralProtectionFault0(pIemCpu);
3772 }
3773
3774 /*
3775 * Commit it.
3776 */
3777 if (CPUMIsGuestInLongModeEx(pCtx))
3778 {
3779 if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3780 {
3781 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3782 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3783 /* Note! We disregard intel manual regarding the RCX cananonical
3784 check, ask intel+xen why AMD doesn't do it. */
3785 pCtx->rip = pCtx->rcx;
3786 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3787 | (3 << X86DESCATTR_DPL_SHIFT);
3788 }
3789 else
3790 {
3791 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3792 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3793 pCtx->rip = pCtx->ecx;
3794 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3795 | (3 << X86DESCATTR_DPL_SHIFT);
3796 }
3797 /** @todo testcase: See what kind of flags we can make SYSRET restore and
3798 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
3799 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
3800 pCtx->rflags.u |= X86_EFL_1;
3801 }
3802 else
3803 {
3804 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3805 pCtx->rip = pCtx->rcx;
3806 pCtx->rflags.u |= X86_EFL_IF;
3807 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3808 | (3 << X86DESCATTR_DPL_SHIFT);
3809 }
3810 pCtx->cs.Sel = uNewCs | 3;
3811 pCtx->cs.ValidSel = uNewCs | 3;
3812 pCtx->cs.u64Base = 0;
3813 pCtx->cs.u32Limit = UINT32_MAX;
3814 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3815
3816 pCtx->ss.Sel = uNewSs | 3;
3817 pCtx->ss.ValidSel = uNewSs | 3;
3818 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3819 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3820 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
3821 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3822 * on sysret. */
3823
3824 return VINF_SUCCESS;
3825}
3826
3827
3828/**
3829 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3830 *
3831 * @param iSegReg The segment register number (valid).
3832 * @param uSel The new selector value.
3833 */
3834IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3835{
3836 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
3837 uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3838 PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3839
3840 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3841
3842 /*
3843 * Real mode and V8086 mode are easy.
3844 */
3845 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3846 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3847 {
3848 *pSel = uSel;
3849 pHid->u64Base = (uint32_t)uSel << 4;
3850 pHid->ValidSel = uSel;
3851 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3852#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3853 /** @todo Does the CPU actually load limits and attributes in the
3854 * real/V8086 mode segment load case? It doesn't for CS in far
3855 * jumps... Affects unreal mode. */
3856 pHid->u32Limit = 0xffff;
3857 pHid->Attr.u = 0;
3858 pHid->Attr.n.u1Present = 1;
3859 pHid->Attr.n.u1DescType = 1;
3860 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3861 ? X86_SEL_TYPE_RW
3862 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
3863#endif
3864 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3865 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3866 return VINF_SUCCESS;
3867 }
3868
3869 /*
3870 * Protected mode.
3871 *
3872 * Check if it's a null segment selector value first, that's OK for DS, ES,
3873 * FS and GS. If not null, then we have to load and parse the descriptor.
3874 */
3875 if (!(uSel & X86_SEL_MASK_OFF_RPL))
3876 {
3877 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3878 if (iSegReg == X86_SREG_SS)
3879 {
3880 /* In 64-bit kernel mode, the stack can be 0 because of the way
3881 interrupts are dispatched. AMD seems to have a slighly more
3882 relaxed relationship to SS.RPL than intel does. */
3883 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3884 if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3885 || pIemCpu->uCpl > 2
3886 || ( uSel != pIemCpu->uCpl
3887 && !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3888 {
3889 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3890 return iemRaiseGeneralProtectionFault0(pIemCpu);
3891 }
3892 }
3893
3894 *pSel = uSel; /* Not RPL, remember :-) */
3895 iemHlpLoadNullDataSelectorProt(pIemCpu, pHid, uSel);
3896 if (iSegReg == X86_SREG_SS)
3897 pHid->Attr.u |= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3898
3899 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3900 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3901
3902 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3903 return VINF_SUCCESS;
3904 }
3905
3906 /* Fetch the descriptor. */
3907 IEMSELDESC Desc;
3908 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3909 if (rcStrict != VINF_SUCCESS)
3910 return rcStrict;
3911
3912 /* Check GPs first. */
3913 if (!Desc.Legacy.Gen.u1DescType)
3914 {
3915 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3916 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3917 }
3918 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3919 {
3920 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3921 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3922 {
3923 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3924 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3925 }
3926 if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3927 {
3928 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3929 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3930 }
3931 if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3932 {
3933 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3934 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3935 }
3936 }
3937 else
3938 {
3939 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3940 {
3941 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
3942 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3943 }
3944 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3945 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3946 {
3947#if 0 /* this is what intel says. */
3948 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
3949 && pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3950 {
3951 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
3952 iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3953 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3954 }
3955#else /* this is what makes more sense. */
3956 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3957 {
3958 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
3959 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
3960 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3961 }
3962 if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3963 {
3964 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
3965 iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3966 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3967 }
3968#endif
3969 }
3970 }
3971
3972 /* Is it there? */
3973 if (!Desc.Legacy.Gen.u1Present)
3974 {
3975 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
3976 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
3977 }
3978
3979 /* The base and limit. */
3980 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
3981 uint64_t u64Base;
3982 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
3983 && iSegReg < X86_SREG_FS)
3984 u64Base = 0;
3985 else
3986 u64Base = X86DESC_BASE(&Desc.Legacy);
3987
3988 /*
3989 * Ok, everything checked out fine. Now set the accessed bit before
3990 * committing the result into the registers.
3991 */
3992 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3993 {
3994 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
3995 if (rcStrict != VINF_SUCCESS)
3996 return rcStrict;
3997 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3998 }
3999
4000 /* commit */
4001 *pSel = uSel;
4002 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4003 pHid->u32Limit = cbLimit;
4004 pHid->u64Base = u64Base;
4005 pHid->ValidSel = uSel;
4006 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4007
4008 /** @todo check if the hidden bits are loaded correctly for 64-bit
4009 * mode. */
4010 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
4011
4012 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
4013 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4014 return VINF_SUCCESS;
4015}
4016
4017
4018/**
4019 * Implements 'mov SReg, r/m'.
4020 *
4021 * @param iSegReg The segment register number (valid).
4022 * @param uSel The new selector value.
4023 */
4024IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4025{
4026 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4027 if (rcStrict == VINF_SUCCESS)
4028 {
4029 if (iSegReg == X86_SREG_SS)
4030 {
4031 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4032 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4033 }
4034 }
4035 return rcStrict;
4036}
4037
4038
4039/**
4040 * Implements 'pop SReg'.
4041 *
4042 * @param iSegReg The segment register number (valid).
4043 * @param enmEffOpSize The efficient operand size (valid).
4044 */
4045IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4046{
4047 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4048 VBOXSTRICTRC rcStrict;
4049
4050 /*
4051 * Read the selector off the stack and join paths with mov ss, reg.
4052 */
4053 RTUINT64U TmpRsp;
4054 TmpRsp.u = pCtx->rsp;
4055 switch (enmEffOpSize)
4056 {
4057 case IEMMODE_16BIT:
4058 {
4059 uint16_t uSel;
4060 rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
4061 if (rcStrict == VINF_SUCCESS)
4062 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4063 break;
4064 }
4065
4066 case IEMMODE_32BIT:
4067 {
4068 uint32_t u32Value;
4069 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
4070 if (rcStrict == VINF_SUCCESS)
4071 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4072 break;
4073 }
4074
4075 case IEMMODE_64BIT:
4076 {
4077 uint64_t u64Value;
4078 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
4079 if (rcStrict == VINF_SUCCESS)
4080 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4081 break;
4082 }
4083 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4084 }
4085
4086 /*
4087 * Commit the stack on success.
4088 */
4089 if (rcStrict == VINF_SUCCESS)
4090 {
4091 pCtx->rsp = TmpRsp.u;
4092 if (iSegReg == X86_SREG_SS)
4093 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4094 }
4095 return rcStrict;
4096}
4097
4098
4099/**
4100 * Implements lgs, lfs, les, lds & lss.
4101 */
4102IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4103 uint16_t, uSel,
4104 uint64_t, offSeg,
4105 uint8_t, iSegReg,
4106 uint8_t, iGReg,
4107 IEMMODE, enmEffOpSize)
4108{
4109 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
4110 VBOXSTRICTRC rcStrict;
4111
4112 /*
4113 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4114 */
4115 /** @todo verify and test that mov, pop and lXs works the segment
4116 * register loading in the exact same way. */
4117 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4118 if (rcStrict == VINF_SUCCESS)
4119 {
4120 switch (enmEffOpSize)
4121 {
4122 case IEMMODE_16BIT:
4123 *(uint16_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
4124 break;
4125 case IEMMODE_32BIT:
4126 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
4127 break;
4128 case IEMMODE_64BIT:
4129 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
4130 break;
4131 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4132 }
4133 }
4134
4135 return rcStrict;
4136}
4137
4138
4139/**
4140 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4141 *
4142 * @retval VINF_SUCCESS on success.
4143 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4144 * @retval iemMemFetchSysU64 return value.
4145 *
4146 * @param pIemCpu The IEM state of the calling EMT.
4147 * @param uSel The selector value.
4148 * @param fAllowSysDesc Whether system descriptors are OK or not.
4149 * @param pDesc Where to return the descriptor on success.
4150 */
4151static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4152{
4153 pDesc->Long.au64[0] = 0;
4154 pDesc->Long.au64[1] = 0;
4155
4156 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4157 return VINF_IEM_SELECTOR_NOT_OK;
4158
4159 /* Within the table limits? */
4160 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4161 RTGCPTR GCPtrBase;
4162 if (uSel & X86_SEL_LDT)
4163 {
4164 if ( !pCtx->ldtr.Attr.n.u1Present
4165 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4166 return VINF_IEM_SELECTOR_NOT_OK;
4167 GCPtrBase = pCtx->ldtr.u64Base;
4168 }
4169 else
4170 {
4171 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4172 return VINF_IEM_SELECTOR_NOT_OK;
4173 GCPtrBase = pCtx->gdtr.pGdt;
4174 }
4175
4176 /* Fetch the descriptor. */
4177 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4178 if (rcStrict != VINF_SUCCESS)
4179 return rcStrict;
4180 if (!pDesc->Legacy.Gen.u1DescType)
4181 {
4182 if (!fAllowSysDesc)
4183 return VINF_IEM_SELECTOR_NOT_OK;
4184 if (CPUMIsGuestInLongModeEx(pCtx))
4185 {
4186 rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4187 if (rcStrict != VINF_SUCCESS)
4188 return rcStrict;
4189 }
4190
4191 }
4192
4193 return VINF_SUCCESS;
4194}
4195
4196
4197/**
4198 * Implements verr (fWrite = false) and verw (fWrite = true).
4199 */
4200IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4201{
4202 Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
4203
4204 /** @todo figure whether the accessed bit is set or not. */
4205
4206 bool fAccessible = true;
4207 IEMSELDESC Desc;
4208 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4209 if (rcStrict == VINF_SUCCESS)
4210 {
4211 /* Check the descriptor, order doesn't matter much here. */
4212 if ( !Desc.Legacy.Gen.u1DescType
4213 || !Desc.Legacy.Gen.u1Present)
4214 fAccessible = false;
4215 else
4216 {
4217 if ( fWrite
4218 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4219 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4220 fAccessible = false;
4221
4222 /** @todo testcase for the conforming behavior. */
4223 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4224 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4225 {
4226 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4227 fAccessible = false;
4228 else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4229 fAccessible = false;
4230 }
4231 }
4232
4233 }
4234 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4235 fAccessible = false;
4236 else
4237 return rcStrict;
4238
4239 /* commit */
4240 pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
4241
4242 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4243 return VINF_SUCCESS;
4244}
4245
4246
4247/**
4248 * Implements LAR and LSL with 64-bit operand size.
4249 *
4250 * @returns VINF_SUCCESS.
4251 * @param pu16Dst Pointer to the destination register.
4252 * @param uSel The selector to load details for.
4253 * @param pEFlags Pointer to the eflags register.
4254 * @param fIsLar true = LAR, false = LSL.
4255 */
4256IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
4257{
4258 Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
4259
4260 /** @todo figure whether the accessed bit is set or not. */
4261
4262 bool fDescOk = true;
4263 IEMSELDESC Desc;
4264 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4265 if (rcStrict == VINF_SUCCESS)
4266 {
4267 /*
4268 * Check the descriptor type.
4269 */
4270 if (!Desc.Legacy.Gen.u1DescType)
4271 {
4272 if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
4273 {
4274 if (Desc.Long.Gen.u5Zeros)
4275 fDescOk = false;
4276 else
4277 switch (Desc.Long.Gen.u4Type)
4278 {
4279 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4280 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4281 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4282 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4283 break;
4284 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4285 fDescOk = fIsLar;
4286 break;
4287 default:
4288 fDescOk = false;
4289 break;
4290 }
4291 }
4292 else
4293 {
4294 switch (Desc.Long.Gen.u4Type)
4295 {
4296 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4297 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4298 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4299 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4300 case X86_SEL_TYPE_SYS_LDT:
4301 break;
4302 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4303 case X86_SEL_TYPE_SYS_TASK_GATE:
4304 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4305 fDescOk = fIsLar;
4306 break;
4307 default:
4308 fDescOk = false;
4309 break;
4310 }
4311 }
4312 }
4313 if (fDescOk)
4314 {
4315 /*
4316 * Check the RPL/DPL/CPL interaction..
4317 */
4318 /** @todo testcase for the conforming behavior. */
4319 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4320 || !Desc.Legacy.Gen.u1DescType)
4321 {
4322 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4323 fDescOk = false;
4324 else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4325 fDescOk = false;
4326 }
4327 }
4328
4329 if (fDescOk)
4330 {
4331 /*
4332 * All fine, start committing the result.
4333 */
4334 if (fIsLar)
4335 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4336 else
4337 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4338 }
4339
4340 }
4341 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4342 fDescOk = false;
4343 else
4344 return rcStrict;
4345
4346 /* commit flags value and advance rip. */
4347 pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
4348 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4349
4350 return VINF_SUCCESS;
4351}
4352
4353
4354/**
4355 * Implements LAR and LSL with 16-bit operand size.
4356 *
4357 * @returns VINF_SUCCESS.
4358 * @param pu16Dst Pointer to the destination register.
4359 * @param u16Sel The selector to load details for.
4360 * @param pEFlags Pointer to the eflags register.
4361 * @param fIsLar true = LAR, false = LSL.
4362 */
4363IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
4364{
4365 uint64_t u64TmpDst = *pu16Dst;
4366 IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
4367 *pu16Dst = (uint16_t)u64TmpDst;
4368 return VINF_SUCCESS;
4369}
4370
4371
4372/**
4373 * Implements lgdt.
4374 *
4375 * @param iEffSeg The segment of the new gdtr contents
4376 * @param GCPtrEffSrc The address of the new gdtr contents.
4377 * @param enmEffOpSize The effective operand size.
4378 */
4379IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4380{
4381 if (pIemCpu->uCpl != 0)
4382 return iemRaiseGeneralProtectionFault0(pIemCpu);
4383 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4384
4385 /*
4386 * Fetch the limit and base address.
4387 */
4388 uint16_t cbLimit;
4389 RTGCPTR GCPtrBase;
4390 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4391 if (rcStrict == VINF_SUCCESS)
4392 {
4393 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4394 rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
4395 else
4396 {
4397 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4398 pCtx->gdtr.cbGdt = cbLimit;
4399 pCtx->gdtr.pGdt = GCPtrBase;
4400 }
4401 if (rcStrict == VINF_SUCCESS)
4402 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4403 }
4404 return rcStrict;
4405}
4406
4407
4408/**
4409 * Implements sgdt.
4410 *
4411 * @param iEffSeg The segment where to store the gdtr content.
4412 * @param GCPtrEffDst The address where to store the gdtr content.
4413 * @param enmEffOpSize The effective operand size.
4414 */
4415IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
4416{
4417 /*
4418 * Join paths with sidt.
4419 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4420 * you really must know.
4421 */
4422 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4423 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
4424 if (rcStrict == VINF_SUCCESS)
4425 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4426 return rcStrict;
4427}
4428
4429
4430/**
4431 * Implements lidt.
4432 *
4433 * @param iEffSeg The segment of the new idtr contents
4434 * @param GCPtrEffSrc The address of the new idtr contents.
4435 * @param enmEffOpSize The effective operand size.
4436 */
4437IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4438{
4439 if (pIemCpu->uCpl != 0)
4440 return iemRaiseGeneralProtectionFault0(pIemCpu);
4441 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4442
4443 /*
4444 * Fetch the limit and base address.
4445 */
4446 uint16_t cbLimit;
4447 RTGCPTR GCPtrBase;
4448 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4449 if (rcStrict == VINF_SUCCESS)
4450 {
4451 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4452 CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
4453 else
4454 {
4455 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4456 pCtx->idtr.cbIdt = cbLimit;
4457 pCtx->idtr.pIdt = GCPtrBase;
4458 }
4459 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4460 }
4461 return rcStrict;
4462}
4463
4464
4465/**
4466 * Implements sidt.
4467 *
4468 * @param iEffSeg The segment where to store the idtr content.
4469 * @param GCPtrEffDst The address where to store the idtr content.
4470 * @param enmEffOpSize The effective operand size.
4471 */
4472IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
4473{
4474 /*
4475 * Join paths with sgdt.
4476 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4477 * you really must know.
4478 */
4479 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4480 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
4481 if (rcStrict == VINF_SUCCESS)
4482 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4483 return rcStrict;
4484}
4485
4486
4487/**
4488 * Implements lldt.
4489 *
4490 * @param uNewLdt The new LDT selector value.
4491 */
4492IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4493{
4494 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4495
4496 /*
4497 * Check preconditions.
4498 */
4499 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4500 {
4501 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4502 return iemRaiseUndefinedOpcode(pIemCpu);
4503 }
4504 if (pIemCpu->uCpl != 0)
4505 {
4506 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
4507 return iemRaiseGeneralProtectionFault0(pIemCpu);
4508 }
4509 if (uNewLdt & X86_SEL_LDT)
4510 {
4511 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4512 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
4513 }
4514
4515 /*
4516 * Now, loading a NULL selector is easy.
4517 */
4518 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4519 {
4520 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4521 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4522 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
4523 else
4524 pCtx->ldtr.Sel = uNewLdt;
4525 pCtx->ldtr.ValidSel = uNewLdt;
4526 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4527 if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4528 {
4529 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4530 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4531 }
4532 else if (IEM_IS_GUEST_CPU_AMD(pIemCpu))
4533 {
4534 /* AMD-V seems to leave the base and limit alone. */
4535 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4536 }
4537 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4538 {
4539 /* VT-x (Intel 3960x) seems to be doing the following. */
4540 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4541 pCtx->ldtr.u64Base = 0;
4542 pCtx->ldtr.u32Limit = UINT32_MAX;
4543 }
4544
4545 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4546 return VINF_SUCCESS;
4547 }
4548
4549 /*
4550 * Read the descriptor.
4551 */
4552 IEMSELDESC Desc;
4553 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4554 if (rcStrict != VINF_SUCCESS)
4555 return rcStrict;
4556
4557 /* Check GPs first. */
4558 if (Desc.Legacy.Gen.u1DescType)
4559 {
4560 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4561 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4562 }
4563 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4564 {
4565 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4566 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4567 }
4568 uint64_t u64Base;
4569 if (!IEM_IS_LONG_MODE(pIemCpu))
4570 u64Base = X86DESC_BASE(&Desc.Legacy);
4571 else
4572 {
4573 if (Desc.Long.Gen.u5Zeros)
4574 {
4575 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4576 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4577 }
4578
4579 u64Base = X86DESC64_BASE(&Desc.Long);
4580 if (!IEM_IS_CANONICAL(u64Base))
4581 {
4582 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4583 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4584 }
4585 }
4586
4587 /* NP */
4588 if (!Desc.Legacy.Gen.u1Present)
4589 {
4590 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4591 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
4592 }
4593
4594 /*
4595 * It checks out alright, update the registers.
4596 */
4597/** @todo check if the actual value is loaded or if the RPL is dropped */
4598 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4599 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
4600 else
4601 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4602 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4603 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4604 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4605 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4606 pCtx->ldtr.u64Base = u64Base;
4607
4608 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4609 return VINF_SUCCESS;
4610}
4611
4612
4613/**
4614 * Implements lldt.
4615 *
4616 * @param uNewLdt The new LDT selector value.
4617 */
4618IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4619{
4620 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4621
4622 /*
4623 * Check preconditions.
4624 */
4625 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4626 {
4627 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4628 return iemRaiseUndefinedOpcode(pIemCpu);
4629 }
4630 if (pIemCpu->uCpl != 0)
4631 {
4632 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
4633 return iemRaiseGeneralProtectionFault0(pIemCpu);
4634 }
4635 if (uNewTr & X86_SEL_LDT)
4636 {
4637 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4638 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
4639 }
4640 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4641 {
4642 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4643 return iemRaiseGeneralProtectionFault0(pIemCpu);
4644 }
4645
4646 /*
4647 * Read the descriptor.
4648 */
4649 IEMSELDESC Desc;
4650 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4651 if (rcStrict != VINF_SUCCESS)
4652 return rcStrict;
4653
4654 /* Check GPs first. */
4655 if (Desc.Legacy.Gen.u1DescType)
4656 {
4657 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4658 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4659 }
4660 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4661 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4662 || IEM_IS_LONG_MODE(pIemCpu)) )
4663 {
4664 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4665 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4666 }
4667 uint64_t u64Base;
4668 if (!IEM_IS_LONG_MODE(pIemCpu))
4669 u64Base = X86DESC_BASE(&Desc.Legacy);
4670 else
4671 {
4672 if (Desc.Long.Gen.u5Zeros)
4673 {
4674 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4675 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4676 }
4677
4678 u64Base = X86DESC64_BASE(&Desc.Long);
4679 if (!IEM_IS_CANONICAL(u64Base))
4680 {
4681 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4682 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4683 }
4684 }
4685
4686 /* NP */
4687 if (!Desc.Legacy.Gen.u1Present)
4688 {
4689 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4690 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
4691 }
4692
4693 /*
4694 * Set it busy.
4695 * Note! Intel says this should lock down the whole descriptor, but we'll
4696 * restrict our selves to 32-bit for now due to lack of inline
4697 * assembly and such.
4698 */
4699 void *pvDesc;
4700 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4701 if (rcStrict != VINF_SUCCESS)
4702 return rcStrict;
4703 switch ((uintptr_t)pvDesc & 3)
4704 {
4705 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4706 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4707 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4708 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4709 }
4710 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
4711 if (rcStrict != VINF_SUCCESS)
4712 return rcStrict;
4713 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4714
4715 /*
4716 * It checks out alright, update the registers.
4717 */
4718/** @todo check if the actual value is loaded or if the RPL is dropped */
4719 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4720 CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
4721 else
4722 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4723 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4724 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4725 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4726 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4727 pCtx->tr.u64Base = u64Base;
4728
4729 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4730 return VINF_SUCCESS;
4731}
4732
4733
4734/**
4735 * Implements mov GReg,CRx.
4736 *
4737 * @param iGReg The general register to store the CRx value in.
4738 * @param iCrReg The CRx register to read (valid).
4739 */
4740IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4741{
4742 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4743 if (pIemCpu->uCpl != 0)
4744 return iemRaiseGeneralProtectionFault0(pIemCpu);
4745 Assert(!pCtx->eflags.Bits.u1VM);
4746
4747 /* read it */
4748 uint64_t crX;
4749 switch (iCrReg)
4750 {
4751 case 0: crX = pCtx->cr0; break;
4752 case 2: crX = pCtx->cr2; break;
4753 case 3: crX = pCtx->cr3; break;
4754 case 4: crX = pCtx->cr4; break;
4755 case 8:
4756 {
4757 uint8_t uTpr;
4758 int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
4759 if (RT_SUCCESS(rc))
4760 crX = uTpr >> 4;
4761 else
4762 crX = 0;
4763 break;
4764 }
4765 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4766 }
4767
4768 /* store it */
4769 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4770 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = crX;
4771 else
4772 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
4773
4774 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4775 return VINF_SUCCESS;
4776}
4777
4778
4779/**
4780 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4781 *
4782 * @param iCrReg The CRx register to write (valid).
4783 * @param uNewCrX The new value.
4784 */
4785IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4786{
4787 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4788 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4789 VBOXSTRICTRC rcStrict;
4790 int rc;
4791
4792 /*
4793 * Try store it.
4794 * Unfortunately, CPUM only does a tiny bit of the work.
4795 */
4796 switch (iCrReg)
4797 {
4798 case 0:
4799 {
4800 /*
4801 * Perform checks.
4802 */
4803 uint64_t const uOldCrX = pCtx->cr0;
4804 uNewCrX |= X86_CR0_ET; /* hardcoded */
4805
4806 /* Check for reserved bits. */
4807 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
4808 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
4809 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
4810 if (uNewCrX & ~(uint64_t)fValid)
4811 {
4812 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4813 return iemRaiseGeneralProtectionFault0(pIemCpu);
4814 }
4815
4816 /* Check for invalid combinations. */
4817 if ( (uNewCrX & X86_CR0_PG)
4818 && !(uNewCrX & X86_CR0_PE) )
4819 {
4820 Log(("Trying to set CR0.PG without CR0.PE\n"));
4821 return iemRaiseGeneralProtectionFault0(pIemCpu);
4822 }
4823
4824 if ( !(uNewCrX & X86_CR0_CD)
4825 && (uNewCrX & X86_CR0_NW) )
4826 {
4827 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4828 return iemRaiseGeneralProtectionFault0(pIemCpu);
4829 }
4830
4831 /* Long mode consistency checks. */
4832 if ( (uNewCrX & X86_CR0_PG)
4833 && !(uOldCrX & X86_CR0_PG)
4834 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
4835 {
4836 if (!(pCtx->cr4 & X86_CR4_PAE))
4837 {
4838 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4839 return iemRaiseGeneralProtectionFault0(pIemCpu);
4840 }
4841 if (pCtx->cs.Attr.n.u1Long)
4842 {
4843 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4844 return iemRaiseGeneralProtectionFault0(pIemCpu);
4845 }
4846 }
4847
4848 /** @todo check reserved PDPTR bits as AMD states. */
4849
4850 /*
4851 * Change CR0.
4852 */
4853 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4854 CPUMSetGuestCR0(pVCpu, uNewCrX);
4855 else
4856 pCtx->cr0 = uNewCrX;
4857 Assert(pCtx->cr0 == uNewCrX);
4858
4859 /*
4860 * Change EFER.LMA if entering or leaving long mode.
4861 */
4862 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4863 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
4864 {
4865 uint64_t NewEFER = pCtx->msrEFER;
4866 if (uNewCrX & X86_CR0_PG)
4867 NewEFER |= MSR_K6_EFER_LMA;
4868 else
4869 NewEFER &= ~MSR_K6_EFER_LMA;
4870
4871 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4872 CPUMSetGuestEFER(pVCpu, NewEFER);
4873 else
4874 pCtx->msrEFER = NewEFER;
4875 Assert(pCtx->msrEFER == NewEFER);
4876 }
4877
4878 /*
4879 * Inform PGM.
4880 */
4881 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4882 {
4883 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
4884 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
4885 {
4886 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4887 AssertRCReturn(rc, rc);
4888 /* ignore informational status codes */
4889 }
4890 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4891 }
4892 else
4893 rcStrict = VINF_SUCCESS;
4894
4895#ifdef IN_RC
4896 /* Return to ring-3 for rescheduling if WP or AM changes. */
4897 if ( rcStrict == VINF_SUCCESS
4898 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
4899 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
4900 rcStrict = VINF_EM_RESCHEDULE;
4901#endif
4902 break;
4903 }
4904
4905 /*
4906 * CR2 can be changed without any restrictions.
4907 */
4908 case 2:
4909 pCtx->cr2 = uNewCrX;
4910 rcStrict = VINF_SUCCESS;
4911 break;
4912
4913 /*
4914 * CR3 is relatively simple, although AMD and Intel have different
4915 * accounts of how setting reserved bits are handled. We take intel's
4916 * word for the lower bits and AMD's for the high bits (63:52). The
4917 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
4918 * on this.
4919 */
4920 /** @todo Testcase: Setting reserved bits in CR3, especially before
4921 * enabling paging. */
4922 case 3:
4923 {
4924 /* check / mask the value. */
4925 if (uNewCrX & UINT64_C(0xfff0000000000000))
4926 {
4927 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
4928 return iemRaiseGeneralProtectionFault0(pIemCpu);
4929 }
4930
4931 uint64_t fValid;
4932 if ( (pCtx->cr4 & X86_CR4_PAE)
4933 && (pCtx->msrEFER & MSR_K6_EFER_LME))
4934 fValid = UINT64_C(0x000fffffffffffff);
4935 else
4936 fValid = UINT64_C(0xffffffff);
4937 if (uNewCrX & ~fValid)
4938 {
4939 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
4940 uNewCrX, uNewCrX & ~fValid));
4941 uNewCrX &= fValid;
4942 }
4943
4944 /** @todo If we're in PAE mode we should check the PDPTRs for
4945 * invalid bits. */
4946
4947 /* Make the change. */
4948 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4949 {
4950 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
4951 AssertRCSuccessReturn(rc, rc);
4952 }
4953 else
4954 pCtx->cr3 = uNewCrX;
4955
4956 /* Inform PGM. */
4957 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4958 {
4959 if (pCtx->cr0 & X86_CR0_PG)
4960 {
4961 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
4962 AssertRCReturn(rc, rc);
4963 /* ignore informational status codes */
4964 }
4965 }
4966 rcStrict = VINF_SUCCESS;
4967 break;
4968 }
4969
4970 /*
4971 * CR4 is a bit more tedious as there are bits which cannot be cleared
4972 * under some circumstances and such.
4973 */
4974 case 4:
4975 {
4976 uint64_t const uOldCrX = pCtx->cr4;
4977
4978 /** @todo Shouldn't this look at the guest CPUID bits to determine
4979 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
4980 * should #GP(0). */
4981 /* reserved bits */
4982 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
4983 | X86_CR4_TSD | X86_CR4_DE
4984 | X86_CR4_PSE | X86_CR4_PAE
4985 | X86_CR4_MCE | X86_CR4_PGE
4986 | X86_CR4_PCE | X86_CR4_OSFXSR
4987 | X86_CR4_OSXMMEEXCPT;
4988 //if (xxx)
4989 // fValid |= X86_CR4_VMXE;
4990 if (IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fXSaveRstor)
4991 fValid |= X86_CR4_OSXSAVE;
4992 if (uNewCrX & ~(uint64_t)fValid)
4993 {
4994 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4995 return iemRaiseGeneralProtectionFault0(pIemCpu);
4996 }
4997
4998 /* long mode checks. */
4999 if ( (uOldCrX & X86_CR4_PAE)
5000 && !(uNewCrX & X86_CR4_PAE)
5001 && CPUMIsGuestInLongModeEx(pCtx) )
5002 {
5003 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5004 return iemRaiseGeneralProtectionFault0(pIemCpu);
5005 }
5006
5007
5008 /*
5009 * Change it.
5010 */
5011 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5012 {
5013 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5014 AssertRCSuccessReturn(rc, rc);
5015 }
5016 else
5017 pCtx->cr4 = uNewCrX;
5018 Assert(pCtx->cr4 == uNewCrX);
5019
5020 /*
5021 * Notify SELM and PGM.
5022 */
5023 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5024 {
5025 /* SELM - VME may change things wrt to the TSS shadowing. */
5026 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5027 {
5028 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5029 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5030#ifdef VBOX_WITH_RAW_MODE
5031 if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
5032 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5033#endif
5034 }
5035
5036 /* PGM - flushing and mode. */
5037 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
5038 {
5039 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5040 AssertRCReturn(rc, rc);
5041 /* ignore informational status codes */
5042 }
5043 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5044 }
5045 else
5046 rcStrict = VINF_SUCCESS;
5047 break;
5048 }
5049
5050 /*
5051 * CR8 maps to the APIC TPR.
5052 */
5053 case 8:
5054 if (uNewCrX & ~(uint64_t)0xf)
5055 {
5056 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5057 return iemRaiseGeneralProtectionFault0(pIemCpu);
5058 }
5059
5060 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5061 PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
5062 rcStrict = VINF_SUCCESS;
5063 break;
5064
5065 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5066 }
5067
5068 /*
5069 * Advance the RIP on success.
5070 */
5071 if (RT_SUCCESS(rcStrict))
5072 {
5073 if (rcStrict != VINF_SUCCESS)
5074 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5075 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5076 }
5077
5078 return rcStrict;
5079}
5080
5081
5082/**
5083 * Implements mov CRx,GReg.
5084 *
5085 * @param iCrReg The CRx register to write (valid).
5086 * @param iGReg The general register to load the DRx value from.
5087 */
5088IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5089{
5090 if (pIemCpu->uCpl != 0)
5091 return iemRaiseGeneralProtectionFault0(pIemCpu);
5092 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5093
5094 /*
5095 * Read the new value from the source register and call common worker.
5096 */
5097 uint64_t uNewCrX;
5098 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5099 uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
5100 else
5101 uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
5102 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5103}
5104
5105
5106/**
5107 * Implements 'LMSW r/m16'
5108 *
5109 * @param u16NewMsw The new value.
5110 */
5111IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5112{
5113 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5114
5115 if (pIemCpu->uCpl != 0)
5116 return iemRaiseGeneralProtectionFault0(pIemCpu);
5117 Assert(!pCtx->eflags.Bits.u1VM);
5118
5119 /*
5120 * Compose the new CR0 value and call common worker.
5121 */
5122 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5123 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5124 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5125}
5126
5127
5128/**
5129 * Implements 'CLTS'.
5130 */
5131IEM_CIMPL_DEF_0(iemCImpl_clts)
5132{
5133 if (pIemCpu->uCpl != 0)
5134 return iemRaiseGeneralProtectionFault0(pIemCpu);
5135
5136 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5137 uint64_t uNewCr0 = pCtx->cr0;
5138 uNewCr0 &= ~X86_CR0_TS;
5139 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5140}
5141
5142
5143/**
5144 * Implements mov GReg,DRx.
5145 *
5146 * @param iGReg The general register to store the DRx value in.
5147 * @param iDrReg The DRx register to read (0-7).
5148 */
5149IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5150{
5151 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5152
5153 /*
5154 * Check preconditions.
5155 */
5156
5157 /* Raise GPs. */
5158 if (pIemCpu->uCpl != 0)
5159 return iemRaiseGeneralProtectionFault0(pIemCpu);
5160 Assert(!pCtx->eflags.Bits.u1VM);
5161
5162 if ( (iDrReg == 4 || iDrReg == 5)
5163 && (pCtx->cr4 & X86_CR4_DE) )
5164 {
5165 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5166 return iemRaiseGeneralProtectionFault0(pIemCpu);
5167 }
5168
5169 /* Raise #DB if general access detect is enabled. */
5170 if (pCtx->dr[7] & X86_DR7_GD)
5171 {
5172 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5173 return iemRaiseDebugException(pIemCpu);
5174 }
5175
5176 /*
5177 * Read the debug register and store it in the specified general register.
5178 */
5179 uint64_t drX;
5180 switch (iDrReg)
5181 {
5182 case 0: drX = pCtx->dr[0]; break;
5183 case 1: drX = pCtx->dr[1]; break;
5184 case 2: drX = pCtx->dr[2]; break;
5185 case 3: drX = pCtx->dr[3]; break;
5186 case 6:
5187 case 4:
5188 drX = pCtx->dr[6];
5189 drX |= X86_DR6_RA1_MASK;
5190 drX &= ~X86_DR6_RAZ_MASK;
5191 break;
5192 case 7:
5193 case 5:
5194 drX = pCtx->dr[7];
5195 drX |=X86_DR7_RA1_MASK;
5196 drX &= ~X86_DR7_RAZ_MASK;
5197 break;
5198 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5199 }
5200
5201 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5202 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = drX;
5203 else
5204 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
5205
5206 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5207 return VINF_SUCCESS;
5208}
5209
5210
5211/**
5212 * Implements mov DRx,GReg.
5213 *
5214 * @param iDrReg The DRx register to write (valid).
5215 * @param iGReg The general register to load the DRx value from.
5216 */
5217IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5218{
5219 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5220
5221 /*
5222 * Check preconditions.
5223 */
5224 if (pIemCpu->uCpl != 0)
5225 return iemRaiseGeneralProtectionFault0(pIemCpu);
5226 Assert(!pCtx->eflags.Bits.u1VM);
5227
5228 if (iDrReg == 4 || iDrReg == 5)
5229 {
5230 if (pCtx->cr4 & X86_CR4_DE)
5231 {
5232 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5233 return iemRaiseGeneralProtectionFault0(pIemCpu);
5234 }
5235 iDrReg += 2;
5236 }
5237
5238 /* Raise #DB if general access detect is enabled. */
5239 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5240 * \#GP? */
5241 if (pCtx->dr[7] & X86_DR7_GD)
5242 {
5243 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5244 return iemRaiseDebugException(pIemCpu);
5245 }
5246
5247 /*
5248 * Read the new value from the source register.
5249 */
5250 uint64_t uNewDrX;
5251 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5252 uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
5253 else
5254 uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
5255
5256 /*
5257 * Adjust it.
5258 */
5259 switch (iDrReg)
5260 {
5261 case 0:
5262 case 1:
5263 case 2:
5264 case 3:
5265 /* nothing to adjust */
5266 break;
5267
5268 case 6:
5269 if (uNewDrX & X86_DR6_MBZ_MASK)
5270 {
5271 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5272 return iemRaiseGeneralProtectionFault0(pIemCpu);
5273 }
5274 uNewDrX |= X86_DR6_RA1_MASK;
5275 uNewDrX &= ~X86_DR6_RAZ_MASK;
5276 break;
5277
5278 case 7:
5279 if (uNewDrX & X86_DR7_MBZ_MASK)
5280 {
5281 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5282 return iemRaiseGeneralProtectionFault0(pIemCpu);
5283 }
5284 uNewDrX |= X86_DR7_RA1_MASK;
5285 uNewDrX &= ~X86_DR7_RAZ_MASK;
5286 break;
5287
5288 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5289 }
5290
5291 /*
5292 * Do the actual setting.
5293 */
5294 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5295 {
5296 int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
5297 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5298 }
5299 else
5300 pCtx->dr[iDrReg] = uNewDrX;
5301
5302 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5303 return VINF_SUCCESS;
5304}
5305
5306
5307/**
5308 * Implements 'INVLPG m'.
5309 *
5310 * @param GCPtrPage The effective address of the page to invalidate.
5311 * @remarks Updates the RIP.
5312 */
5313IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5314{
5315 /* ring-0 only. */
5316 if (pIemCpu->uCpl != 0)
5317 return iemRaiseGeneralProtectionFault0(pIemCpu);
5318 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5319
5320 int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
5321 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5322
5323 if (rc == VINF_SUCCESS)
5324 return VINF_SUCCESS;
5325 if (rc == VINF_PGM_SYNC_CR3)
5326 return iemSetPassUpStatus(pIemCpu, rc);
5327
5328 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5329 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5330 return rc;
5331}
5332
5333
5334/**
5335 * Implements RDTSC.
5336 */
5337IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5338{
5339 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5340
5341 /*
5342 * Check preconditions.
5343 */
5344 if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fTsc)
5345 return iemRaiseUndefinedOpcode(pIemCpu);
5346
5347 if ( (pCtx->cr4 & X86_CR4_TSD)
5348 && pIemCpu->uCpl != 0)
5349 {
5350 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
5351 return iemRaiseGeneralProtectionFault0(pIemCpu);
5352 }
5353
5354 /*
5355 * Do the job.
5356 */
5357 uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
5358 pCtx->rax = (uint32_t)uTicks;
5359 pCtx->rdx = uTicks >> 32;
5360#ifdef IEM_VERIFICATION_MODE_FULL
5361 pIemCpu->fIgnoreRaxRdx = true;
5362#endif
5363
5364 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5365 return VINF_SUCCESS;
5366}
5367
5368
5369/**
5370 * Implements RDMSR.
5371 */
5372IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5373{
5374 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5375
5376 /*
5377 * Check preconditions.
5378 */
5379 if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
5380 return iemRaiseUndefinedOpcode(pIemCpu);
5381 if (pIemCpu->uCpl != 0)
5382 return iemRaiseGeneralProtectionFault0(pIemCpu);
5383
5384 /*
5385 * Do the job.
5386 */
5387 RTUINT64U uValue;
5388 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
5389 if (rcStrict == VINF_SUCCESS)
5390 {
5391 pCtx->rax = uValue.s.Lo;
5392 pCtx->rdx = uValue.s.Hi;
5393
5394 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5395 return VINF_SUCCESS;
5396 }
5397
5398#ifndef IN_RING3
5399 /* Deferred to ring-3. */
5400 if (rcStrict == VINF_CPUM_R3_MSR_READ)
5401 {
5402 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5403 return rcStrict;
5404 }
5405#else /* IN_RING3 */
5406 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5407 static uint32_t s_cTimes = 0;
5408 if (s_cTimes++ < 10)
5409 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5410 else
5411#endif
5412 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5413 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5414 return iemRaiseGeneralProtectionFault0(pIemCpu);
5415}
5416
5417
5418/**
5419 * Implements WRMSR.
5420 */
5421IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5422{
5423 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5424
5425 /*
5426 * Check preconditions.
5427 */
5428 if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
5429 return iemRaiseUndefinedOpcode(pIemCpu);
5430 if (pIemCpu->uCpl != 0)
5431 return iemRaiseGeneralProtectionFault0(pIemCpu);
5432
5433 /*
5434 * Do the job.
5435 */
5436 RTUINT64U uValue;
5437 uValue.s.Lo = pCtx->eax;
5438 uValue.s.Hi = pCtx->edx;
5439
5440 VBOXSTRICTRC rcStrict;
5441 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5442 rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
5443 else
5444 {
5445#ifdef IN_RING3
5446 CPUMCTX CtxTmp = *pCtx;
5447 rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
5448 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
5449 *pCtx = *pCtx2;
5450 *pCtx2 = CtxTmp;
5451#else
5452 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5453#endif
5454 }
5455 if (rcStrict == VINF_SUCCESS)
5456 {
5457 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5458 return VINF_SUCCESS;
5459 }
5460
5461#ifndef IN_RING3
5462 /* Deferred to ring-3. */
5463 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5464 {
5465 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5466 return rcStrict;
5467 }
5468#else /* IN_RING3 */
5469 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5470 static uint32_t s_cTimes = 0;
5471 if (s_cTimes++ < 10)
5472 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5473 else
5474#endif
5475 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5476 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5477 return iemRaiseGeneralProtectionFault0(pIemCpu);
5478}
5479
5480
5481/**
5482 * Implements 'IN eAX, port'.
5483 *
5484 * @param u16Port The source port.
5485 * @param cbReg The register size.
5486 */
5487IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5488{
5489 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5490
5491 /*
5492 * CPL check
5493 */
5494 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
5495 if (rcStrict != VINF_SUCCESS)
5496 return rcStrict;
5497
5498 /*
5499 * Perform the I/O.
5500 */
5501 uint32_t u32Value;
5502 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5503 rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
5504 else
5505 rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
5506 if (IOM_SUCCESS(rcStrict))
5507 {
5508 switch (cbReg)
5509 {
5510 case 1: pCtx->al = (uint8_t)u32Value; break;
5511 case 2: pCtx->ax = (uint16_t)u32Value; break;
5512 case 4: pCtx->rax = u32Value; break;
5513 default: AssertFailedReturn(VERR_IEM_IPE_3);
5514 }
5515 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5516 pIemCpu->cPotentialExits++;
5517 if (rcStrict != VINF_SUCCESS)
5518 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5519 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5520
5521 /*
5522 * Check for I/O breakpoints.
5523 */
5524 uint32_t const uDr7 = pCtx->dr[7];
5525 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5526 && X86_DR7_ANY_RW_IO(uDr7)
5527 && (pCtx->cr4 & X86_CR4_DE))
5528 || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
5529 {
5530 rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
5531 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5532 rcStrict = iemRaiseDebugException(pIemCpu);
5533 }
5534 }
5535
5536 return rcStrict;
5537}
5538
5539
5540/**
5541 * Implements 'IN eAX, DX'.
5542 *
5543 * @param cbReg The register size.
5544 */
5545IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5546{
5547 return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
5548}
5549
5550
5551/**
5552 * Implements 'OUT port, eAX'.
5553 *
5554 * @param u16Port The destination port.
5555 * @param cbReg The register size.
5556 */
5557IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5558{
5559 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5560
5561 /*
5562 * CPL check
5563 */
5564 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
5565 if (rcStrict != VINF_SUCCESS)
5566 return rcStrict;
5567
5568 /*
5569 * Perform the I/O.
5570 */
5571 uint32_t u32Value;
5572 switch (cbReg)
5573 {
5574 case 1: u32Value = pCtx->al; break;
5575 case 2: u32Value = pCtx->ax; break;
5576 case 4: u32Value = pCtx->eax; break;
5577 default: AssertFailedReturn(VERR_IEM_IPE_4);
5578 }
5579 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5580 rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
5581 else
5582 rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
5583 if (IOM_SUCCESS(rcStrict))
5584 {
5585 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5586 pIemCpu->cPotentialExits++;
5587 if (rcStrict != VINF_SUCCESS)
5588 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5589 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5590
5591 /*
5592 * Check for I/O breakpoints.
5593 */
5594 uint32_t const uDr7 = pCtx->dr[7];
5595 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5596 && X86_DR7_ANY_RW_IO(uDr7)
5597 && (pCtx->cr4 & X86_CR4_DE))
5598 || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
5599 {
5600 rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
5601 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5602 rcStrict = iemRaiseDebugException(pIemCpu);
5603 }
5604 }
5605 return rcStrict;
5606}
5607
5608
5609/**
5610 * Implements 'OUT DX, eAX'.
5611 *
5612 * @param cbReg The register size.
5613 */
5614IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5615{
5616 return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
5617}
5618
5619
5620/**
5621 * Implements 'CLI'.
5622 */
5623IEM_CIMPL_DEF_0(iemCImpl_cli)
5624{
5625 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5626 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
5627 uint32_t const fEflOld = fEfl;
5628 if (pCtx->cr0 & X86_CR0_PE)
5629 {
5630 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5631 if (!(fEfl & X86_EFL_VM))
5632 {
5633 if (pIemCpu->uCpl <= uIopl)
5634 fEfl &= ~X86_EFL_IF;
5635 else if ( pIemCpu->uCpl == 3
5636 && (pCtx->cr4 & X86_CR4_PVI) )
5637 fEfl &= ~X86_EFL_VIF;
5638 else
5639 return iemRaiseGeneralProtectionFault0(pIemCpu);
5640 }
5641 /* V8086 */
5642 else if (uIopl == 3)
5643 fEfl &= ~X86_EFL_IF;
5644 else if ( uIopl < 3
5645 && (pCtx->cr4 & X86_CR4_VME) )
5646 fEfl &= ~X86_EFL_VIF;
5647 else
5648 return iemRaiseGeneralProtectionFault0(pIemCpu);
5649 }
5650 /* real mode */
5651 else
5652 fEfl &= ~X86_EFL_IF;
5653
5654 /* Commit. */
5655 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
5656 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5657 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5658 return VINF_SUCCESS;
5659}
5660
5661
5662/**
5663 * Implements 'STI'.
5664 */
5665IEM_CIMPL_DEF_0(iemCImpl_sti)
5666{
5667 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5668 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
5669 uint32_t const fEflOld = fEfl;
5670
5671 if (pCtx->cr0 & X86_CR0_PE)
5672 {
5673 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5674 if (!(fEfl & X86_EFL_VM))
5675 {
5676 if (pIemCpu->uCpl <= uIopl)
5677 fEfl |= X86_EFL_IF;
5678 else if ( pIemCpu->uCpl == 3
5679 && (pCtx->cr4 & X86_CR4_PVI)
5680 && !(fEfl & X86_EFL_VIP) )
5681 fEfl |= X86_EFL_VIF;
5682 else
5683 return iemRaiseGeneralProtectionFault0(pIemCpu);
5684 }
5685 /* V8086 */
5686 else if (uIopl == 3)
5687 fEfl |= X86_EFL_IF;
5688 else if ( uIopl < 3
5689 && (pCtx->cr4 & X86_CR4_VME)
5690 && !(fEfl & X86_EFL_VIP) )
5691 fEfl |= X86_EFL_VIF;
5692 else
5693 return iemRaiseGeneralProtectionFault0(pIemCpu);
5694 }
5695 /* real mode */
5696 else
5697 fEfl |= X86_EFL_IF;
5698
5699 /* Commit. */
5700 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
5701 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5702 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
5703 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
5704 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5705 return VINF_SUCCESS;
5706}
5707
5708
5709/**
5710 * Implements 'HLT'.
5711 */
5712IEM_CIMPL_DEF_0(iemCImpl_hlt)
5713{
5714 if (pIemCpu->uCpl != 0)
5715 return iemRaiseGeneralProtectionFault0(pIemCpu);
5716 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5717 return VINF_EM_HALT;
5718}
5719
5720
5721/**
5722 * Implements 'MONITOR'.
5723 */
5724IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5725{
5726 /*
5727 * Permission checks.
5728 */
5729 if (pIemCpu->uCpl != 0)
5730 {
5731 Log2(("monitor: CPL != 0\n"));
5732 return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5733 }
5734 if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
5735 {
5736 Log2(("monitor: Not in CPUID\n"));
5737 return iemRaiseUndefinedOpcode(pIemCpu);
5738 }
5739
5740 /*
5741 * Gather the operands and validate them.
5742 */
5743 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5744 RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5745 uint32_t uEcx = pCtx->ecx;
5746 uint32_t uEdx = pCtx->edx;
5747/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5748 * \#GP first. */
5749 if (uEcx != 0)
5750 {
5751 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
5752 return iemRaiseGeneralProtectionFault0(pIemCpu);
5753 }
5754
5755 VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
5756 if (rcStrict != VINF_SUCCESS)
5757 return rcStrict;
5758
5759 RTGCPHYS GCPhysMem;
5760 rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
5761 if (rcStrict != VINF_SUCCESS)
5762 return rcStrict;
5763
5764 /*
5765 * Call EM to prepare the monitor/wait.
5766 */
5767 rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
5768 Assert(rcStrict == VINF_SUCCESS);
5769
5770 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5771 return rcStrict;
5772}
5773
5774
5775/**
5776 * Implements 'MWAIT'.
5777 */
5778IEM_CIMPL_DEF_0(iemCImpl_mwait)
5779{
5780 /*
5781 * Permission checks.
5782 */
5783 if (pIemCpu->uCpl != 0)
5784 {
5785 Log2(("mwait: CPL != 0\n"));
5786 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
5787 * EFLAGS.VM then.) */
5788 return iemRaiseUndefinedOpcode(pIemCpu);
5789 }
5790 if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
5791 {
5792 Log2(("mwait: Not in CPUID\n"));
5793 return iemRaiseUndefinedOpcode(pIemCpu);
5794 }
5795
5796 /*
5797 * Gather the operands and validate them.
5798 */
5799 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5800 uint32_t uEax = pCtx->eax;
5801 uint32_t uEcx = pCtx->ecx;
5802 if (uEcx != 0)
5803 {
5804 /* Only supported extension is break on IRQ when IF=0. */
5805 if (uEcx > 1)
5806 {
5807 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5808 return iemRaiseGeneralProtectionFault0(pIemCpu);
5809 }
5810 uint32_t fMWaitFeatures = 0;
5811 uint32_t uIgnore = 0;
5812 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5813 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5814 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5815 {
5816 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5817 return iemRaiseGeneralProtectionFault0(pIemCpu);
5818 }
5819 }
5820
5821 /*
5822 * Call EM to prepare the monitor/wait.
5823 */
5824 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
5825
5826 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5827 return rcStrict;
5828}
5829
5830
5831/**
5832 * Implements 'SWAPGS'.
5833 */
5834IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5835{
5836 Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5837
5838 /*
5839 * Permission checks.
5840 */
5841 if (pIemCpu->uCpl != 0)
5842 {
5843 Log2(("swapgs: CPL != 0\n"));
5844 return iemRaiseUndefinedOpcode(pIemCpu);
5845 }
5846
5847 /*
5848 * Do the job.
5849 */
5850 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5851 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5852 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5853 pCtx->gs.u64Base = uOtherGsBase;
5854
5855 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5856 return VINF_SUCCESS;
5857}
5858
5859
5860/**
5861 * Implements 'CPUID'.
5862 */
5863IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5864{
5865 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5866
5867 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5868 pCtx->rax &= UINT32_C(0xffffffff);
5869 pCtx->rbx &= UINT32_C(0xffffffff);
5870 pCtx->rcx &= UINT32_C(0xffffffff);
5871 pCtx->rdx &= UINT32_C(0xffffffff);
5872
5873 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5874 return VINF_SUCCESS;
5875}
5876
5877
5878/**
5879 * Implements 'AAD'.
5880 *
5881 * @param bImm The immediate operand.
5882 */
5883IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5884{
5885 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5886
5887 uint16_t const ax = pCtx->ax;
5888 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5889 pCtx->ax = al;
5890 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5891 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
5892 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
5893
5894 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5895 return VINF_SUCCESS;
5896}
5897
5898
5899/**
5900 * Implements 'AAM'.
5901 *
5902 * @param bImm The immediate operand. Cannot be 0.
5903 */
5904IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5905{
5906 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5907 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5908
5909 uint16_t const ax = pCtx->ax;
5910 uint8_t const al = (uint8_t)ax % bImm;
5911 uint8_t const ah = (uint8_t)ax / bImm;
5912 pCtx->ax = (ah << 8) + al;
5913 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5914 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
5915 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
5916
5917 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5918 return VINF_SUCCESS;
5919}
5920
5921
5922/**
5923 * Implements 'DAA'.
5924 */
5925IEM_CIMPL_DEF_0(iemCImpl_daa)
5926{
5927 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5928
5929 uint8_t const al = pCtx->al;
5930 bool const fCarry = pCtx->eflags.Bits.u1CF;
5931
5932 if ( pCtx->eflags.Bits.u1AF
5933 || (al & 0xf) >= 10)
5934 {
5935 pCtx->al = al + 6;
5936 pCtx->eflags.Bits.u1AF = 1;
5937 }
5938 else
5939 pCtx->eflags.Bits.u1AF = 0;
5940
5941 if (al >= 0x9a || fCarry)
5942 {
5943 pCtx->al += 0x60;
5944 pCtx->eflags.Bits.u1CF = 1;
5945 }
5946 else
5947 pCtx->eflags.Bits.u1CF = 0;
5948
5949 iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
5950 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5951 return VINF_SUCCESS;
5952}
5953
5954
5955/**
5956 * Implements 'DAS'.
5957 */
5958IEM_CIMPL_DEF_0(iemCImpl_das)
5959{
5960 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5961
5962 uint8_t const uInputAL = pCtx->al;
5963 bool const fCarry = pCtx->eflags.Bits.u1CF;
5964
5965 if ( pCtx->eflags.Bits.u1AF
5966 || (uInputAL & 0xf) >= 10)
5967 {
5968 pCtx->eflags.Bits.u1AF = 1;
5969 if (uInputAL < 6)
5970 pCtx->eflags.Bits.u1CF = 1;
5971 pCtx->al = uInputAL - 6;
5972 }
5973 else
5974 {
5975 pCtx->eflags.Bits.u1AF = 0;
5976 pCtx->eflags.Bits.u1CF = 0;
5977 }
5978
5979 if (uInputAL >= 0x9a || fCarry)
5980 {
5981 pCtx->al -= 0x60;
5982 pCtx->eflags.Bits.u1CF = 1;
5983 }
5984
5985 iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
5986 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5987 return VINF_SUCCESS;
5988}
5989
5990
5991
5992
5993/*
5994 * Instantiate the various string operation combinations.
5995 */
5996#define OP_SIZE 8
5997#define ADDR_SIZE 16
5998#include "IEMAllCImplStrInstr.cpp.h"
5999#define OP_SIZE 8
6000#define ADDR_SIZE 32
6001#include "IEMAllCImplStrInstr.cpp.h"
6002#define OP_SIZE 8
6003#define ADDR_SIZE 64
6004#include "IEMAllCImplStrInstr.cpp.h"
6005
6006#define OP_SIZE 16
6007#define ADDR_SIZE 16
6008#include "IEMAllCImplStrInstr.cpp.h"
6009#define OP_SIZE 16
6010#define ADDR_SIZE 32
6011#include "IEMAllCImplStrInstr.cpp.h"
6012#define OP_SIZE 16
6013#define ADDR_SIZE 64
6014#include "IEMAllCImplStrInstr.cpp.h"
6015
6016#define OP_SIZE 32
6017#define ADDR_SIZE 16
6018#include "IEMAllCImplStrInstr.cpp.h"
6019#define OP_SIZE 32
6020#define ADDR_SIZE 32
6021#include "IEMAllCImplStrInstr.cpp.h"
6022#define OP_SIZE 32
6023#define ADDR_SIZE 64
6024#include "IEMAllCImplStrInstr.cpp.h"
6025
6026#define OP_SIZE 64
6027#define ADDR_SIZE 32
6028#include "IEMAllCImplStrInstr.cpp.h"
6029#define OP_SIZE 64
6030#define ADDR_SIZE 64
6031#include "IEMAllCImplStrInstr.cpp.h"
6032
6033
6034/**
6035 * Implements 'XGETBV'.
6036 */
6037IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6038{
6039 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6040 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6041 {
6042 uint32_t uEcx = pCtx->ecx;
6043 switch (uEcx)
6044 {
6045 case 0:
6046 break;
6047
6048 case 1: /** @todo Implement XCR1 support. */
6049 default:
6050 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6051 return iemRaiseGeneralProtectionFault0(pIemCpu);
6052
6053 }
6054 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6055 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6056
6057 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6058 return VINF_SUCCESS;
6059 }
6060 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6061 return iemRaiseUndefinedOpcode(pIemCpu);
6062}
6063
6064
6065/**
6066 * Implements 'XSETBV'.
6067 */
6068IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6069{
6070 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6071 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6072 {
6073 if (pIemCpu->uCpl == 0)
6074 {
6075 uint32_t uEcx = pCtx->ecx;
6076 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6077 switch (uEcx)
6078 {
6079 case 0:
6080 {
6081 int rc = CPUMSetGuestXcr0(IEMCPU_TO_VMCPU(pIemCpu), uNewValue);
6082 if (rc == VINF_SUCCESS)
6083 break;
6084 Assert(rc == VERR_CPUM_RAISE_GP_0);
6085 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6086 return iemRaiseGeneralProtectionFault0(pIemCpu);
6087 }
6088
6089 case 1: /** @todo Implement XCR1 support. */
6090 default:
6091 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6092 return iemRaiseGeneralProtectionFault0(pIemCpu);
6093
6094 }
6095
6096 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6097 return VINF_SUCCESS;
6098 }
6099
6100 Log(("xsetbv cpl=%u -> GP(0)\n", pIemCpu->uCpl));
6101 return iemRaiseGeneralProtectionFault0(pIemCpu);
6102 }
6103 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6104 return iemRaiseUndefinedOpcode(pIemCpu);
6105}
6106
6107
6108
6109/**
6110 * Implements 'FINIT' and 'FNINIT'.
6111 *
6112 * @param fCheckXcpts Whether to check for umasked pending exceptions or
6113 * not.
6114 */
6115IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6116{
6117 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6118
6119 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6120 return iemRaiseDeviceNotAvailable(pIemCpu);
6121
6122 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6123 if (fCheckXcpts && TODO )
6124 return iemRaiseMathFault(pIemCpu);
6125 */
6126
6127 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6128 pXState->x87.FCW = 0x37f;
6129 pXState->x87.FSW = 0;
6130 pXState->x87.FTW = 0x00; /* 0 - empty. */
6131 pXState->x87.FPUDP = 0;
6132 pXState->x87.DS = 0; //??
6133 pXState->x87.Rsrvd2= 0;
6134 pXState->x87.FPUIP = 0;
6135 pXState->x87.CS = 0; //??
6136 pXState->x87.Rsrvd1= 0;
6137 pXState->x87.FOP = 0;
6138
6139 iemHlpUsedFpu(pIemCpu);
6140 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6141 return VINF_SUCCESS;
6142}
6143
6144
6145/**
6146 * Implements 'FXSAVE'.
6147 *
6148 * @param iEffSeg The effective segment.
6149 * @param GCPtrEff The address of the image.
6150 * @param enmEffOpSize The operand size (only REX.W really matters).
6151 */
6152IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6153{
6154 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6155
6156 /*
6157 * Raise exceptions.
6158 */
6159 if (pCtx->cr0 & X86_CR0_EM)
6160 return iemRaiseUndefinedOpcode(pIemCpu);
6161 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6162 return iemRaiseDeviceNotAvailable(pIemCpu);
6163 if (GCPtrEff & 15)
6164 {
6165 /** @todo CPU/VM detection possible! \#AC might not be signal for
6166 * all/any misalignment sizes, intel says its an implementation detail. */
6167 if ( (pCtx->cr0 & X86_CR0_AM)
6168 && pCtx->eflags.Bits.u1AC
6169 && pIemCpu->uCpl == 3)
6170 return iemRaiseAlignmentCheckException(pIemCpu);
6171 return iemRaiseGeneralProtectionFault0(pIemCpu);
6172 }
6173
6174 /*
6175 * Access the memory.
6176 */
6177 void *pvMem512;
6178 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6179 if (rcStrict != VINF_SUCCESS)
6180 return rcStrict;
6181 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6182 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6183
6184 /*
6185 * Store the registers.
6186 */
6187 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6188 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6189
6190 /* common for all formats */
6191 pDst->FCW = pSrc->FCW;
6192 pDst->FSW = pSrc->FSW;
6193 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6194 pDst->FOP = pSrc->FOP;
6195 pDst->MXCSR = pSrc->MXCSR;
6196 pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6197 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6198 {
6199 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6200 * them for now... */
6201 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6202 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6203 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6204 pDst->aRegs[i].au32[3] = 0;
6205 }
6206
6207 /* FPU IP, CS, DP and DS. */
6208 pDst->FPUIP = pSrc->FPUIP;
6209 pDst->CS = pSrc->CS;
6210 pDst->FPUDP = pSrc->FPUDP;
6211 pDst->DS = pSrc->DS;
6212 if (enmEffOpSize == IEMMODE_64BIT)
6213 {
6214 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6215 pDst->Rsrvd1 = pSrc->Rsrvd1;
6216 pDst->Rsrvd2 = pSrc->Rsrvd2;
6217 pDst->au32RsrvdForSoftware[0] = 0;
6218 }
6219 else
6220 {
6221 pDst->Rsrvd1 = 0;
6222 pDst->Rsrvd2 = 0;
6223 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6224 }
6225
6226 /* XMM registers. */
6227 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6228 || pIemCpu->enmCpuMode != IEMMODE_64BIT
6229 || pIemCpu->uCpl != 0)
6230 {
6231 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6232 for (uint32_t i = 0; i < cXmmRegs; i++)
6233 pDst->aXMM[i] = pSrc->aXMM[i];
6234 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6235 * right? */
6236 }
6237
6238 /*
6239 * Commit the memory.
6240 */
6241 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6242 if (rcStrict != VINF_SUCCESS)
6243 return rcStrict;
6244
6245 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6246 return VINF_SUCCESS;
6247}
6248
6249
6250/**
6251 * Implements 'FXRSTOR'.
6252 *
6253 * @param GCPtrEff The address of the image.
6254 * @param enmEffOpSize The operand size (only REX.W really matters).
6255 */
6256IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6257{
6258 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6259
6260 /*
6261 * Raise exceptions.
6262 */
6263 if (pCtx->cr0 & X86_CR0_EM)
6264 return iemRaiseUndefinedOpcode(pIemCpu);
6265 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6266 return iemRaiseDeviceNotAvailable(pIemCpu);
6267 if (GCPtrEff & 15)
6268 {
6269 /** @todo CPU/VM detection possible! \#AC might not be signal for
6270 * all/any misalignment sizes, intel says its an implementation detail. */
6271 if ( (pCtx->cr0 & X86_CR0_AM)
6272 && pCtx->eflags.Bits.u1AC
6273 && pIemCpu->uCpl == 3)
6274 return iemRaiseAlignmentCheckException(pIemCpu);
6275 return iemRaiseGeneralProtectionFault0(pIemCpu);
6276 }
6277
6278 /*
6279 * Access the memory.
6280 */
6281 void *pvMem512;
6282 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6283 if (rcStrict != VINF_SUCCESS)
6284 return rcStrict;
6285 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6286 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6287
6288 /*
6289 * Check the state for stuff which will #GP(0).
6290 */
6291 uint32_t const fMXCSR = pSrc->MXCSR;
6292 uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6293 if (fMXCSR & ~fMXCSR_MASK)
6294 {
6295 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6296 return iemRaiseGeneralProtectionFault0(pIemCpu);
6297 }
6298
6299 /*
6300 * Load the registers.
6301 */
6302 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6303 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6304
6305 /* common for all formats */
6306 pDst->FCW = pSrc->FCW;
6307 pDst->FSW = pSrc->FSW;
6308 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6309 pDst->FOP = pSrc->FOP;
6310 pDst->MXCSR = fMXCSR;
6311 /* (MXCSR_MASK is read-only) */
6312 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6313 {
6314 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6315 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6316 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6317 pDst->aRegs[i].au32[3] = 0;
6318 }
6319
6320 /* FPU IP, CS, DP and DS. */
6321 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
6322 {
6323 pDst->FPUIP = pSrc->FPUIP;
6324 pDst->CS = pSrc->CS;
6325 pDst->Rsrvd1 = pSrc->Rsrvd1;
6326 pDst->FPUDP = pSrc->FPUDP;
6327 pDst->DS = pSrc->DS;
6328 pDst->Rsrvd2 = pSrc->Rsrvd2;
6329 }
6330 else
6331 {
6332 pDst->FPUIP = pSrc->FPUIP;
6333 pDst->CS = pSrc->CS;
6334 pDst->Rsrvd1 = 0;
6335 pDst->FPUDP = pSrc->FPUDP;
6336 pDst->DS = pSrc->DS;
6337 pDst->Rsrvd2 = 0;
6338 }
6339
6340 /* XMM registers. */
6341 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6342 || pIemCpu->enmCpuMode != IEMMODE_64BIT
6343 || pIemCpu->uCpl != 0)
6344 {
6345 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6346 for (uint32_t i = 0; i < cXmmRegs; i++)
6347 pDst->aXMM[i] = pSrc->aXMM[i];
6348 }
6349
6350 /*
6351 * Commit the memory.
6352 */
6353 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
6354 if (rcStrict != VINF_SUCCESS)
6355 return rcStrict;
6356
6357 iemHlpUsedFpu(pIemCpu);
6358 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6359 return VINF_SUCCESS;
6360}
6361
6362
6363/**
6364 * Commmon routine for fnstenv and fnsave.
6365 *
6366 * @param uPtr Where to store the state.
6367 * @param pCtx The CPU context.
6368 */
6369static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6370{
6371 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6372 if (enmEffOpSize == IEMMODE_16BIT)
6373 {
6374 uPtr.pu16[0] = pSrcX87->FCW;
6375 uPtr.pu16[1] = pSrcX87->FSW;
6376 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6377 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6378 {
6379 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
6380 * protected mode or long mode and we save it in real mode? And vice
6381 * versa? And with 32-bit operand size? I think CPU is storing the
6382 * effective address ((CS << 4) + IP) in the offset register and not
6383 * doing any address calculations here. */
6384 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6385 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
6386 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6387 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6388 }
6389 else
6390 {
6391 uPtr.pu16[3] = pSrcX87->FPUIP;
6392 uPtr.pu16[4] = pSrcX87->CS;
6393 uPtr.pu16[5] = pSrcX87->FPUDP;
6394 uPtr.pu16[6] = pSrcX87->DS;
6395 }
6396 }
6397 else
6398 {
6399 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6400 uPtr.pu16[0*2] = pSrcX87->FCW;
6401 uPtr.pu16[1*2] = pSrcX87->FSW;
6402 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6403 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6404 {
6405 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6406 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
6407 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6408 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6409 }
6410 else
6411 {
6412 uPtr.pu32[3] = pSrcX87->FPUIP;
6413 uPtr.pu16[4*2] = pSrcX87->CS;
6414 uPtr.pu16[4*2+1]= pSrcX87->FOP;
6415 uPtr.pu32[5] = pSrcX87->FPUDP;
6416 uPtr.pu16[6*2] = pSrcX87->DS;
6417 }
6418 }
6419}
6420
6421
6422/**
6423 * Commmon routine for fldenv and frstor
6424 *
6425 * @param uPtr Where to store the state.
6426 * @param pCtx The CPU context.
6427 */
6428static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6429{
6430 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6431 if (enmEffOpSize == IEMMODE_16BIT)
6432 {
6433 pDstX87->FCW = uPtr.pu16[0];
6434 pDstX87->FSW = uPtr.pu16[1];
6435 pDstX87->FTW = uPtr.pu16[2];
6436 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6437 {
6438 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6439 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6440 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6441 pDstX87->CS = 0;
6442 pDstX87->Rsrvd1= 0;
6443 pDstX87->DS = 0;
6444 pDstX87->Rsrvd2= 0;
6445 }
6446 else
6447 {
6448 pDstX87->FPUIP = uPtr.pu16[3];
6449 pDstX87->CS = uPtr.pu16[4];
6450 pDstX87->Rsrvd1= 0;
6451 pDstX87->FPUDP = uPtr.pu16[5];
6452 pDstX87->DS = uPtr.pu16[6];
6453 pDstX87->Rsrvd2= 0;
6454 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6455 }
6456 }
6457 else
6458 {
6459 pDstX87->FCW = uPtr.pu16[0*2];
6460 pDstX87->FSW = uPtr.pu16[1*2];
6461 pDstX87->FTW = uPtr.pu16[2*2];
6462 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6463 {
6464 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6465 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6466 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6467 pDstX87->CS = 0;
6468 pDstX87->Rsrvd1= 0;
6469 pDstX87->DS = 0;
6470 pDstX87->Rsrvd2= 0;
6471 }
6472 else
6473 {
6474 pDstX87->FPUIP = uPtr.pu32[3];
6475 pDstX87->CS = uPtr.pu16[4*2];
6476 pDstX87->Rsrvd1= 0;
6477 pDstX87->FOP = uPtr.pu16[4*2+1];
6478 pDstX87->FPUDP = uPtr.pu32[5];
6479 pDstX87->DS = uPtr.pu16[6*2];
6480 pDstX87->Rsrvd2= 0;
6481 }
6482 }
6483
6484 /* Make adjustments. */
6485 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6486 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6487 iemFpuRecalcExceptionStatus(pDstX87);
6488 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
6489 * exceptions are pending after loading the saved state? */
6490}
6491
6492
6493/**
6494 * Implements 'FNSTENV'.
6495 *
6496 * @param enmEffOpSize The operand size (only REX.W really matters).
6497 * @param iEffSeg The effective segment register for @a GCPtrEff.
6498 * @param GCPtrEffDst The address of the image.
6499 */
6500IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6501{
6502 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6503 RTPTRUNION uPtr;
6504 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6505 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6506 if (rcStrict != VINF_SUCCESS)
6507 return rcStrict;
6508
6509 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6510
6511 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6512 if (rcStrict != VINF_SUCCESS)
6513 return rcStrict;
6514
6515 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6516 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6517 return VINF_SUCCESS;
6518}
6519
6520
6521/**
6522 * Implements 'FNSAVE'.
6523 *
6524 * @param GCPtrEffDst The address of the image.
6525 * @param enmEffOpSize The operand size.
6526 */
6527IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6528{
6529 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6530 RTPTRUNION uPtr;
6531 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6532 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6533 if (rcStrict != VINF_SUCCESS)
6534 return rcStrict;
6535
6536 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6537 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6538 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6539 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6540 {
6541 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6542 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6543 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6544 }
6545
6546 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6547 if (rcStrict != VINF_SUCCESS)
6548 return rcStrict;
6549
6550 /*
6551 * Re-initialize the FPU context.
6552 */
6553 pFpuCtx->FCW = 0x37f;
6554 pFpuCtx->FSW = 0;
6555 pFpuCtx->FTW = 0x00; /* 0 - empty */
6556 pFpuCtx->FPUDP = 0;
6557 pFpuCtx->DS = 0;
6558 pFpuCtx->Rsrvd2= 0;
6559 pFpuCtx->FPUIP = 0;
6560 pFpuCtx->CS = 0;
6561 pFpuCtx->Rsrvd1= 0;
6562 pFpuCtx->FOP = 0;
6563
6564 iemHlpUsedFpu(pIemCpu);
6565 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6566 return VINF_SUCCESS;
6567}
6568
6569
6570
6571/**
6572 * Implements 'FLDENV'.
6573 *
6574 * @param enmEffOpSize The operand size (only REX.W really matters).
6575 * @param iEffSeg The effective segment register for @a GCPtrEff.
6576 * @param GCPtrEffSrc The address of the image.
6577 */
6578IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6579{
6580 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6581 RTCPTRUNION uPtr;
6582 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6583 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6584 if (rcStrict != VINF_SUCCESS)
6585 return rcStrict;
6586
6587 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6588
6589 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6590 if (rcStrict != VINF_SUCCESS)
6591 return rcStrict;
6592
6593 iemHlpUsedFpu(pIemCpu);
6594 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6595 return VINF_SUCCESS;
6596}
6597
6598
6599/**
6600 * Implements 'FRSTOR'.
6601 *
6602 * @param GCPtrEffSrc The address of the image.
6603 * @param enmEffOpSize The operand size.
6604 */
6605IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6606{
6607 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6608 RTCPTRUNION uPtr;
6609 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6610 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6611 if (rcStrict != VINF_SUCCESS)
6612 return rcStrict;
6613
6614 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6615 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6616 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6617 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6618 {
6619 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6620 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6621 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6622 pFpuCtx->aRegs[i].au32[3] = 0;
6623 }
6624
6625 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6626 if (rcStrict != VINF_SUCCESS)
6627 return rcStrict;
6628
6629 iemHlpUsedFpu(pIemCpu);
6630 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6631 return VINF_SUCCESS;
6632}
6633
6634
6635/**
6636 * Implements 'FLDCW'.
6637 *
6638 * @param u16Fcw The new FCW.
6639 */
6640IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6641{
6642 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6643
6644 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6645 /** @todo Testcase: Try see what happens when trying to set undefined bits
6646 * (other than 6 and 7). Currently ignoring them. */
6647 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
6648 * according to FSW. (This is was is currently implemented.) */
6649 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6650 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6651 iemFpuRecalcExceptionStatus(pFpuCtx);
6652
6653 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6654 iemHlpUsedFpu(pIemCpu);
6655 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6656 return VINF_SUCCESS;
6657}
6658
6659
6660
6661/**
6662 * Implements the underflow case of fxch.
6663 *
6664 * @param iStReg The other stack register.
6665 */
6666IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6667{
6668 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6669
6670 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6671 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6672 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6673 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
6674
6675 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
6676 * registers are read as QNaN and then exchanged. This could be
6677 * wrong... */
6678 if (pFpuCtx->FCW & X86_FCW_IM)
6679 {
6680 if (RT_BIT(iReg1) & pFpuCtx->FTW)
6681 {
6682 if (RT_BIT(iReg2) & pFpuCtx->FTW)
6683 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6684 else
6685 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6686 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6687 }
6688 else
6689 {
6690 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6691 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6692 }
6693 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6694 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
6695 }
6696 else
6697 {
6698 /* raise underflow exception, don't change anything. */
6699 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
6700 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6701 }
6702
6703 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
6704 iemHlpUsedFpu(pIemCpu);
6705 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6706 return VINF_SUCCESS;
6707}
6708
6709
6710/**
6711 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6712 *
6713 * @param cToAdd 1 or 7.
6714 */
6715IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6716{
6717 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6718 Assert(iStReg < 8);
6719
6720 /*
6721 * Raise exceptions.
6722 */
6723 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6724 return iemRaiseDeviceNotAvailable(pIemCpu);
6725
6726 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6727 uint16_t u16Fsw = pFpuCtx->FSW;
6728 if (u16Fsw & X86_FSW_ES)
6729 return iemRaiseMathFault(pIemCpu);
6730
6731 /*
6732 * Check if any of the register accesses causes #SF + #IA.
6733 */
6734 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
6735 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6736 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
6737 {
6738 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
6739 NOREF(u32Eflags);
6740
6741 pFpuCtx->FSW &= ~X86_FSW_C1;
6742 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
6743 if ( !(u16Fsw & X86_FSW_IE)
6744 || (pFpuCtx->FCW & X86_FCW_IM) )
6745 {
6746 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6747 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6748 }
6749 }
6750 else if (pFpuCtx->FCW & X86_FCW_IM)
6751 {
6752 /* Masked underflow. */
6753 pFpuCtx->FSW &= ~X86_FSW_C1;
6754 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
6755 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6756 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
6757 }
6758 else
6759 {
6760 /* Raise underflow - don't touch EFLAGS or TOP. */
6761 pFpuCtx->FSW &= ~X86_FSW_C1;
6762 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6763 fPop = false;
6764 }
6765
6766 /*
6767 * Pop if necessary.
6768 */
6769 if (fPop)
6770 {
6771 pFpuCtx->FTW &= ~RT_BIT(iReg1);
6772 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
6773 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
6774 }
6775
6776 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
6777 iemHlpUsedFpu(pIemCpu);
6778 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6779 return VINF_SUCCESS;
6780}
6781
6782/** @} */
6783
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette