IEMAllCImpl.cpp.h@ 47568

Last change on this file since 47568 was 47568, checked in by vboxsync, 11 years ago
IEM: LAR,LSL,ARPL, and some tracing (RTTraceBuf*).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 192.1 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 47568 2013-08-07 03:11:58Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @name Misc Helpers
20	* @{
21	*/
22
23
24	/**
25	* Worker function for iemHlpCheckPortIOPermission, don't call directly.
26	*
27	* @returns Strict VBox status code.
28	*
29	* @param pIemCpu The IEM per CPU data.
30	* @param pCtx The register context.
31	* @param u16Port The port number.
32	* @param cbOperand The operand size.
33	*/
34	static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
35	{
36	/* The TSS bits we're interested in are the same on 386 and AMD64. */
37	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
38	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
39	AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
40	AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
41
42	/*
43	* Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
44	*/
45	Assert(!pCtx->tr.Attr.n.u1DescType);
46	if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
47	&& pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
48	{
49	Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
50	u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
51	return iemRaiseGeneralProtectionFault0(pIemCpu);
52	}
53
54	/*
55	* Read the bitmap offset (may #PF).
56	*/
57	uint16_t offBitmap;
58	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
59	pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
60	if (rcStrict != VINF_SUCCESS)
61	{
62	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
63	return rcStrict;
64	}
65
66	/*
67	* The bit range from u16Port to (u16Port + cbOperand - 1), however intel
68	* describes the CPU actually reading two bytes regardless of whether the
69	* bit range crosses a byte boundrary. Thus the + 1 in the test below.
70	*/
71	uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
72	/** @todo check if real CPUs ensures that offBitmap has a minimum value of
73	* for instance sizeof(X86TSS32). */
74	if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
75	{
76	Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
77	offFirstBit, pCtx->tr.u32Limit));
78	return iemRaiseGeneralProtectionFault0(pIemCpu);
79	}
80
81	/*
82	* Read the necessary bits.
83	*/
84	/** @todo Test the assertion in the intel manual that the CPU reads two
85	* bytes. The question is how this works wrt to #PF and #GP on the
86	* 2nd byte when it's not required. */
87	uint16_t bmBytes = UINT16_MAX;
88	rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
89	if (rcStrict != VINF_SUCCESS)
90	{
91	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
92	return rcStrict;
93	}
94
95	/*
96	* Perform the check.
97	*/
98	uint16_t fPortMask = (1 << cbOperand) - 1;
99	bmBytes >>= (u16Port & 7);
100	if (bmBytes & fPortMask)
101	{
102	Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
103	u16Port, cbOperand, bmBytes, fPortMask));
104	return iemRaiseGeneralProtectionFault0(pIemCpu);
105	}
106
107	return VINF_SUCCESS;
108	}
109
110
111	/**
112	* Checks if we are allowed to access the given I/O port, raising the
113	* appropriate exceptions if we aren't (or if the I/O bitmap is not
114	* accessible).
115	*
116	* @returns Strict VBox status code.
117	*
118	* @param pIemCpu The IEM per CPU data.
119	* @param pCtx The register context.
120	* @param u16Port The port number.
121	* @param cbOperand The operand size.
122	*/
123	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
124	{
125	X86EFLAGS Efl;
126	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
127	if ( (pCtx->cr0 & X86_CR0_PE)
128	&& ( pIemCpu->uCpl > Efl.Bits.u2IOPL
129	\|\| Efl.Bits.u1VM) )
130	return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
131	return VINF_SUCCESS;
132	}
133
134
135	#if 0
136	/**
137	* Calculates the parity bit.
138	*
139	* @returns true if the bit is set, false if not.
140	* @param u8Result The least significant byte of the result.
141	*/
142	static bool iemHlpCalcParityFlag(uint8_t u8Result)
143	{
144	/*
145	* Parity is set if the number of bits in the least significant byte of
146	* the result is even.
147	*/
148	uint8_t cBits;
149	cBits = u8Result & 1; /* 0 */
150	u8Result >>= 1;
151	cBits += u8Result & 1;
152	u8Result >>= 1;
153	cBits += u8Result & 1;
154	u8Result >>= 1;
155	cBits += u8Result & 1;
156	u8Result >>= 1;
157	cBits += u8Result & 1; /* 4 */
158	u8Result >>= 1;
159	cBits += u8Result & 1;
160	u8Result >>= 1;
161	cBits += u8Result & 1;
162	u8Result >>= 1;
163	cBits += u8Result & 1;
164	return !(cBits & 1);
165	}
166	#endif /* not used */
167
168
169	/**
170	* Updates the specified flags according to a 8-bit result.
171	*
172	* @param pIemCpu The IEM state of the calling EMT.
173	* @param u8Result The result to set the flags according to.
174	* @param fToUpdate The flags to update.
175	* @param fUndefined The flags that are specified as undefined.
176	*/
177	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
178	{
179	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
180
181	uint32_t fEFlags = pCtx->eflags.u;
182	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
183	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
184	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
185	}
186
187
188	/**
189	* Loads a NULL data selector into a selector register, both the hidden and
190	* visible parts, in protected mode.
191	*
192	* @param pSReg Pointer to the segment register.
193	* @param uRpl The RPL.
194	*/
195	static void iemHlpLoadNullDataSelectorProt(PCPUMSELREG pSReg, RTSEL uRpl)
196	{
197	/** @todo Testcase: write a testcase checking what happends when loading a NULL
198	* data selector in protected mode. */
199	pSReg->Sel = uRpl;
200	pSReg->ValidSel = uRpl;
201	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
202	pSReg->u64Base = 0;
203	pSReg->u32Limit = 0;
204	pSReg->Attr.u = X86DESCATTR_UNUSABLE;
205	}
206
207
208	/**
209	* Helper used by iret.
210	*
211	* @param uCpl The new CPL.
212	* @param pSReg Pointer to the segment register.
213	*/
214	static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
215	{
216	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
217	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
218	CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
219	#else
220	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
221	#endif
222
223	if ( uCpl > pSReg->Attr.n.u2Dpl
224	&& pSReg->Attr.n.u1DescType /* code or data, not system */
225	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
226	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
227	iemHlpLoadNullDataSelectorProt(pSReg, 0);
228	}
229
230
231	/**
232	* Indicates that we have modified the FPU state.
233	*
234	* @param pIemCpu The IEM state of the calling EMT.
235	*/
236	DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
237	{
238	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
239	}
240
241	/** @} */
242
243	/** @name C Implementations
244	* @{
245	*/
246
247	/**
248	* Implements a 16-bit popa.
249	*/
250	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
251	{
252	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
253	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
254	RTGCPTR GCPtrLast = GCPtrStart + 15;
255	VBOXSTRICTRC rcStrict;
256
257	/*
258	* The docs are a bit hard to comprehend here, but it looks like we wrap
259	* around in real mode as long as none of the individual "popa" crosses the
260	* end of the stack segment. In protected mode we check the whole access
261	* in one go. For efficiency, only do the word-by-word thing if we're in
262	* danger of wrapping around.
263	*/
264	/** @todo do popa boundary / wrap-around checks. */
265	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
266	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
267	{
268	/* word-by-word */
269	RTUINT64U TmpRsp;
270	TmpRsp.u = pCtx->rsp;
271	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
272	if (rcStrict == VINF_SUCCESS)
273	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
274	if (rcStrict == VINF_SUCCESS)
275	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
276	if (rcStrict == VINF_SUCCESS)
277	{
278	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
279	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
280	}
281	if (rcStrict == VINF_SUCCESS)
282	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
283	if (rcStrict == VINF_SUCCESS)
284	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
285	if (rcStrict == VINF_SUCCESS)
286	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
287	if (rcStrict == VINF_SUCCESS)
288	{
289	pCtx->rsp = TmpRsp.u;
290	iemRegAddToRip(pIemCpu, cbInstr);
291	}
292	}
293	else
294	{
295	uint16_t const *pa16Mem = NULL;
296	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
297	if (rcStrict == VINF_SUCCESS)
298	{
299	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
300	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
301	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
302	/* skip sp */
303	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
304	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
305	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
306	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
307	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
308	if (rcStrict == VINF_SUCCESS)
309	{
310	iemRegAddToRsp(pIemCpu, pCtx, 16);
311	iemRegAddToRip(pIemCpu, cbInstr);
312	}
313	}
314	}
315	return rcStrict;
316	}
317
318
319	/**
320	* Implements a 32-bit popa.
321	*/
322	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
323	{
324	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
325	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
326	RTGCPTR GCPtrLast = GCPtrStart + 31;
327	VBOXSTRICTRC rcStrict;
328
329	/*
330	* The docs are a bit hard to comprehend here, but it looks like we wrap
331	* around in real mode as long as none of the individual "popa" crosses the
332	* end of the stack segment. In protected mode we check the whole access
333	* in one go. For efficiency, only do the word-by-word thing if we're in
334	* danger of wrapping around.
335	*/
336	/** @todo do popa boundary / wrap-around checks. */
337	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
338	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
339	{
340	/* word-by-word */
341	RTUINT64U TmpRsp;
342	TmpRsp.u = pCtx->rsp;
343	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
344	if (rcStrict == VINF_SUCCESS)
345	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
346	if (rcStrict == VINF_SUCCESS)
347	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
348	if (rcStrict == VINF_SUCCESS)
349	{
350	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
351	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
352	}
353	if (rcStrict == VINF_SUCCESS)
354	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
355	if (rcStrict == VINF_SUCCESS)
356	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
357	if (rcStrict == VINF_SUCCESS)
358	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
359	if (rcStrict == VINF_SUCCESS)
360	{
361	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
362	pCtx->rdi &= UINT32_MAX;
363	pCtx->rsi &= UINT32_MAX;
364	pCtx->rbp &= UINT32_MAX;
365	pCtx->rbx &= UINT32_MAX;
366	pCtx->rdx &= UINT32_MAX;
367	pCtx->rcx &= UINT32_MAX;
368	pCtx->rax &= UINT32_MAX;
369	#endif
370	pCtx->rsp = TmpRsp.u;
371	iemRegAddToRip(pIemCpu, cbInstr);
372	}
373	}
374	else
375	{
376	uint32_t const *pa32Mem;
377	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
378	if (rcStrict == VINF_SUCCESS)
379	{
380	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
381	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
382	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
383	/* skip esp */
384	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
385	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
386	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
387	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
388	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
389	if (rcStrict == VINF_SUCCESS)
390	{
391	iemRegAddToRsp(pIemCpu, pCtx, 32);
392	iemRegAddToRip(pIemCpu, cbInstr);
393	}
394	}
395	}
396	return rcStrict;
397	}
398
399
400	/**
401	* Implements a 16-bit pusha.
402	*/
403	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
404	{
405	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
406	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
407	RTGCPTR GCPtrBottom = GCPtrTop - 15;
408	VBOXSTRICTRC rcStrict;
409
410	/*
411	* The docs are a bit hard to comprehend here, but it looks like we wrap
412	* around in real mode as long as none of the individual "pushd" crosses the
413	* end of the stack segment. In protected mode we check the whole access
414	* in one go. For efficiency, only do the word-by-word thing if we're in
415	* danger of wrapping around.
416	*/
417	/** @todo do pusha boundary / wrap-around checks. */
418	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
419	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
420	{
421	/* word-by-word */
422	RTUINT64U TmpRsp;
423	TmpRsp.u = pCtx->rsp;
424	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
425	if (rcStrict == VINF_SUCCESS)
426	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
427	if (rcStrict == VINF_SUCCESS)
428	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
429	if (rcStrict == VINF_SUCCESS)
430	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
431	if (rcStrict == VINF_SUCCESS)
432	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
433	if (rcStrict == VINF_SUCCESS)
434	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
435	if (rcStrict == VINF_SUCCESS)
436	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
437	if (rcStrict == VINF_SUCCESS)
438	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
439	if (rcStrict == VINF_SUCCESS)
440	{
441	pCtx->rsp = TmpRsp.u;
442	iemRegAddToRip(pIemCpu, cbInstr);
443	}
444	}
445	else
446	{
447	GCPtrBottom--;
448	uint16_t *pa16Mem = NULL;
449	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
450	if (rcStrict == VINF_SUCCESS)
451	{
452	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
453	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
454	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
455	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
456	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
457	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
458	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
459	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
460	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
461	if (rcStrict == VINF_SUCCESS)
462	{
463	iemRegSubFromRsp(pIemCpu, pCtx, 16);
464	iemRegAddToRip(pIemCpu, cbInstr);
465	}
466	}
467	}
468	return rcStrict;
469	}
470
471
472	/**
473	* Implements a 32-bit pusha.
474	*/
475	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
476	{
477	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
478	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
479	RTGCPTR GCPtrBottom = GCPtrTop - 31;
480	VBOXSTRICTRC rcStrict;
481
482	/*
483	* The docs are a bit hard to comprehend here, but it looks like we wrap
484	* around in real mode as long as none of the individual "pusha" crosses the
485	* end of the stack segment. In protected mode we check the whole access
486	* in one go. For efficiency, only do the word-by-word thing if we're in
487	* danger of wrapping around.
488	*/
489	/** @todo do pusha boundary / wrap-around checks. */
490	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
491	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
492	{
493	/* word-by-word */
494	RTUINT64U TmpRsp;
495	TmpRsp.u = pCtx->rsp;
496	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
497	if (rcStrict == VINF_SUCCESS)
498	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
499	if (rcStrict == VINF_SUCCESS)
500	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
501	if (rcStrict == VINF_SUCCESS)
502	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
503	if (rcStrict == VINF_SUCCESS)
504	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
505	if (rcStrict == VINF_SUCCESS)
506	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
507	if (rcStrict == VINF_SUCCESS)
508	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
509	if (rcStrict == VINF_SUCCESS)
510	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
511	if (rcStrict == VINF_SUCCESS)
512	{
513	pCtx->rsp = TmpRsp.u;
514	iemRegAddToRip(pIemCpu, cbInstr);
515	}
516	}
517	else
518	{
519	GCPtrBottom--;
520	uint32_t *pa32Mem;
521	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
522	if (rcStrict == VINF_SUCCESS)
523	{
524	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
525	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
526	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
527	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
528	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
529	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
530	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
531	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
532	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
533	if (rcStrict == VINF_SUCCESS)
534	{
535	iemRegSubFromRsp(pIemCpu, pCtx, 32);
536	iemRegAddToRip(pIemCpu, cbInstr);
537	}
538	}
539	}
540	return rcStrict;
541	}
542
543
544	/**
545	* Implements pushf.
546	*
547	*
548	* @param enmEffOpSize The effective operand size.
549	*/
550	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
551	{
552	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
553
554	/*
555	* If we're in V8086 mode some care is required (which is why we're in
556	* doing this in a C implementation).
557	*/
558	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
559	if ( (fEfl & X86_EFL_VM)
560	&& X86_EFL_GET_IOPL(fEfl) != 3 )
561	{
562	Assert(pCtx->cr0 & X86_CR0_PE);
563	if ( enmEffOpSize != IEMMODE_16BIT
564	\|\| !(pCtx->cr4 & X86_CR4_VME))
565	return iemRaiseGeneralProtectionFault0(pIemCpu);
566	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
567	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
568	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
569	}
570
571	/*
572	* Ok, clear RF and VM and push the flags.
573	*/
574	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
575
576	VBOXSTRICTRC rcStrict;
577	switch (enmEffOpSize)
578	{
579	case IEMMODE_16BIT:
580	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
581	break;
582	case IEMMODE_32BIT:
583	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
584	break;
585	case IEMMODE_64BIT:
586	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
587	break;
588	IEM_NOT_REACHED_DEFAULT_CASE_RET();
589	}
590	if (rcStrict != VINF_SUCCESS)
591	return rcStrict;
592
593	iemRegAddToRip(pIemCpu, cbInstr);
594	return VINF_SUCCESS;
595	}
596
597
598	/**
599	* Implements popf.
600	*
601	* @param enmEffOpSize The effective operand size.
602	*/
603	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
604	{
605	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
606	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
607	uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
608	VBOXSTRICTRC rcStrict;
609	uint32_t fEflNew;
610
611	/*
612	* V8086 is special as usual.
613	*/
614	if (fEflOld & X86_EFL_VM)
615	{
616	/*
617	* Almost anything goes if IOPL is 3.
618	*/
619	if (X86_EFL_GET_IOPL(fEflOld) == 3)
620	{
621	switch (enmEffOpSize)
622	{
623	case IEMMODE_16BIT:
624	{
625	uint16_t u16Value;
626	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
627	if (rcStrict != VINF_SUCCESS)
628	return rcStrict;
629	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
630	break;
631	}
632	case IEMMODE_32BIT:
633	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
634	if (rcStrict != VINF_SUCCESS)
635	return rcStrict;
636	break;
637	IEM_NOT_REACHED_DEFAULT_CASE_RET();
638	}
639
640	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
641	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
642	}
643	/*
644	* Interrupt flag virtualization with CR4.VME=1.
645	*/
646	else if ( enmEffOpSize == IEMMODE_16BIT
647	&& (pCtx->cr4 & X86_CR4_VME) )
648	{
649	uint16_t u16Value;
650	RTUINT64U TmpRsp;
651	TmpRsp.u = pCtx->rsp;
652	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
653	if (rcStrict != VINF_SUCCESS)
654	return rcStrict;
655
656	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
657	* or before? */
658	if ( ( (u16Value & X86_EFL_IF)
659	&& (fEflOld & X86_EFL_VIP))
660	\|\| (u16Value & X86_EFL_TF) )
661	return iemRaiseGeneralProtectionFault0(pIemCpu);
662
663	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
664	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
665	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
666	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
667
668	pCtx->rsp = TmpRsp.u;
669	}
670	else
671	return iemRaiseGeneralProtectionFault0(pIemCpu);
672
673	}
674	/*
675	* Not in V8086 mode.
676	*/
677	else
678	{
679	/* Pop the flags. */
680	switch (enmEffOpSize)
681	{
682	case IEMMODE_16BIT:
683	{
684	uint16_t u16Value;
685	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
686	if (rcStrict != VINF_SUCCESS)
687	return rcStrict;
688	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
689	break;
690	}
691	case IEMMODE_32BIT:
692	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
693	if (rcStrict != VINF_SUCCESS)
694	return rcStrict;
695	break;
696	case IEMMODE_64BIT:
697	{
698	uint64_t u64Value;
699	rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
700	if (rcStrict != VINF_SUCCESS)
701	return rcStrict;
702	fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
703	break;
704	}
705	IEM_NOT_REACHED_DEFAULT_CASE_RET();
706	}
707
708	/* Merge them with the current flags. */
709	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
710	\|\| pIemCpu->uCpl == 0)
711	{
712	fEflNew &= X86_EFL_POPF_BITS;
713	fEflNew \|= ~X86_EFL_POPF_BITS & fEflOld;
714	}
715	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
716	{
717	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
718	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
719	}
720	else
721	{
722	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
723	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
724	}
725	}
726
727	/*
728	* Commit the flags.
729	*/
730	Assert(fEflNew & RT_BIT_32(1));
731	IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
732	iemRegAddToRip(pIemCpu, cbInstr);
733
734	return VINF_SUCCESS;
735	}
736
737
738	/**
739	* Implements an indirect call.
740	*
741	* @param uNewPC The new program counter (RIP) value (loaded from the
742	* operand).
743	* @param enmEffOpSize The effective operand size.
744	*/
745	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
746	{
747	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
748	uint16_t uOldPC = pCtx->ip + cbInstr;
749	if (uNewPC > pCtx->cs.u32Limit)
750	return iemRaiseGeneralProtectionFault0(pIemCpu);
751
752	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
753	if (rcStrict != VINF_SUCCESS)
754	return rcStrict;
755
756	pCtx->rip = uNewPC;
757	return VINF_SUCCESS;
758
759	}
760
761
762	/**
763	* Implements a 16-bit relative call.
764	*
765	* @param offDisp The displacment offset.
766	*/
767	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
768	{
769	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
770	uint16_t uOldPC = pCtx->ip + cbInstr;
771	uint16_t uNewPC = uOldPC + offDisp;
772	if (uNewPC > pCtx->cs.u32Limit)
773	return iemRaiseGeneralProtectionFault0(pIemCpu);
774
775	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
776	if (rcStrict != VINF_SUCCESS)
777	return rcStrict;
778
779	pCtx->rip = uNewPC;
780	return VINF_SUCCESS;
781	}
782
783
784	/**
785	* Implements a 32-bit indirect call.
786	*
787	* @param uNewPC The new program counter (RIP) value (loaded from the
788	* operand).
789	* @param enmEffOpSize The effective operand size.
790	*/
791	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
792	{
793	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
794	uint32_t uOldPC = pCtx->eip + cbInstr;
795	if (uNewPC > pCtx->cs.u32Limit)
796	return iemRaiseGeneralProtectionFault0(pIemCpu);
797
798	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
799	if (rcStrict != VINF_SUCCESS)
800	return rcStrict;
801
802	pCtx->rip = uNewPC;
803	return VINF_SUCCESS;
804
805	}
806
807
808	/**
809	* Implements a 32-bit relative call.
810	*
811	* @param offDisp The displacment offset.
812	*/
813	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
814	{
815	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
816	uint32_t uOldPC = pCtx->eip + cbInstr;
817	uint32_t uNewPC = uOldPC + offDisp;
818	if (uNewPC > pCtx->cs.u32Limit)
819	return iemRaiseGeneralProtectionFault0(pIemCpu);
820
821	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
822	if (rcStrict != VINF_SUCCESS)
823	return rcStrict;
824
825	pCtx->rip = uNewPC;
826	return VINF_SUCCESS;
827	}
828
829
830	/**
831	* Implements a 64-bit indirect call.
832	*
833	* @param uNewPC The new program counter (RIP) value (loaded from the
834	* operand).
835	* @param enmEffOpSize The effective operand size.
836	*/
837	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
838	{
839	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
840	uint64_t uOldPC = pCtx->rip + cbInstr;
841	if (!IEM_IS_CANONICAL(uNewPC))
842	return iemRaiseGeneralProtectionFault0(pIemCpu);
843
844	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
845	if (rcStrict != VINF_SUCCESS)
846	return rcStrict;
847
848	pCtx->rip = uNewPC;
849	return VINF_SUCCESS;
850
851	}
852
853
854	/**
855	* Implements a 64-bit relative call.
856	*
857	* @param offDisp The displacment offset.
858	*/
859	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
860	{
861	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
862	uint64_t uOldPC = pCtx->rip + cbInstr;
863	uint64_t uNewPC = uOldPC + offDisp;
864	if (!IEM_IS_CANONICAL(uNewPC))
865	return iemRaiseNotCanonical(pIemCpu);
866
867	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
868	if (rcStrict != VINF_SUCCESS)
869	return rcStrict;
870
871	pCtx->rip = uNewPC;
872	return VINF_SUCCESS;
873	}
874
875
876	/**
877	* Implements far jumps and calls thru task segments (TSS).
878	*
879	* @param uSel The selector.
880	* @param enmBranch The kind of branching we're performing.
881	* @param enmEffOpSize The effective operand size.
882	* @param pDesc The descriptor corrsponding to @a uSel. The type is
883	* call gate.
884	*/
885	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
886	{
887	/* Call various functions to do the work. */
888	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
889	}
890
891
892	/**
893	* Implements far jumps and calls thru task gates.
894	*
895	* @param uSel The selector.
896	* @param enmBranch The kind of branching we're performing.
897	* @param enmEffOpSize The effective operand size.
898	* @param pDesc The descriptor corrsponding to @a uSel. The type is
899	* call gate.
900	*/
901	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
902	{
903	/* Call various functions to do the work. */
904	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
905	}
906
907
908	/**
909	* Implements far jumps and calls thru call gates.
910	*
911	* @param uSel The selector.
912	* @param enmBranch The kind of branching we're performing.
913	* @param enmEffOpSize The effective operand size.
914	* @param pDesc The descriptor corrsponding to @a uSel. The type is
915	* call gate.
916	*/
917	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
918	{
919	/* Call various functions to do the work. */
920	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
921	}
922
923
924	/**
925	* Implements far jumps and calls thru system selectors.
926	*
927	* @param uSel The selector.
928	* @param enmBranch The kind of branching we're performing.
929	* @param enmEffOpSize The effective operand size.
930	* @param pDesc The descriptor corrsponding to @a uSel.
931	*/
932	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
933	{
934	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
935	Assert((uSel & X86_SEL_MASK_OFF_RPL));
936
937	if (IEM_IS_LONG_MODE(pIemCpu))
938	switch (pDesc->Legacy.Gen.u4Type)
939	{
940	case AMD64_SEL_TYPE_SYS_CALL_GATE:
941	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
942
943	default:
944	case AMD64_SEL_TYPE_SYS_LDT:
945	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
946	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
947	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
948	case AMD64_SEL_TYPE_SYS_INT_GATE:
949	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
950	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
951
952	}
953
954	switch (pDesc->Legacy.Gen.u4Type)
955	{
956	case X86_SEL_TYPE_SYS_286_CALL_GATE:
957	case X86_SEL_TYPE_SYS_386_CALL_GATE:
958	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
959
960	case X86_SEL_TYPE_SYS_TASK_GATE:
961	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
962
963	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
964	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
965	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
966
967	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
968	Log(("branch %04x -> busy 286 TSS\n", uSel));
969	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
970
971	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
972	Log(("branch %04x -> busy 386 TSS\n", uSel));
973	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
974
975	default:
976	case X86_SEL_TYPE_SYS_LDT:
977	case X86_SEL_TYPE_SYS_286_INT_GATE:
978	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
979	case X86_SEL_TYPE_SYS_386_INT_GATE:
980	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
981	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
982	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
983	}
984	}
985
986
987	/**
988	* Implements far jumps.
989	*
990	* @param uSel The selector.
991	* @param offSeg The segment offset.
992	* @param enmEffOpSize The effective operand size.
993	*/
994	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
995	{
996	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
997	NOREF(cbInstr);
998	Assert(offSeg <= UINT32_MAX);
999
1000	/*
1001	* Real mode and V8086 mode are easy. The only snag seems to be that
1002	* CS.limit doesn't change and the limit check is done against the current
1003	* limit.
1004	*/
1005	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1006	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1007	{
1008	if (offSeg > pCtx->cs.u32Limit)
1009	return iemRaiseGeneralProtectionFault0(pIemCpu);
1010
1011	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1012	pCtx->rip = offSeg;
1013	else
1014	pCtx->rip = offSeg & UINT16_MAX;
1015	pCtx->cs.Sel = uSel;
1016	pCtx->cs.ValidSel = uSel;
1017	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1018	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1019	return VINF_SUCCESS;
1020	}
1021
1022	/*
1023	* Protected mode. Need to parse the specified descriptor...
1024	*/
1025	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1026	{
1027	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1028	return iemRaiseGeneralProtectionFault0(pIemCpu);
1029	}
1030
1031	/* Fetch the descriptor. */
1032	IEMSELDESC Desc;
1033	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1034	if (rcStrict != VINF_SUCCESS)
1035	return rcStrict;
1036
1037	/* Is it there? */
1038	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1039	{
1040	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1041	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1042	}
1043
1044	/*
1045	* Deal with it according to its type. We do the standard code selectors
1046	* here and dispatch the system selectors to worker functions.
1047	*/
1048	if (!Desc.Legacy.Gen.u1DescType)
1049	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1050
1051	/* Only code segments. */
1052	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1053	{
1054	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1055	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1056	}
1057
1058	/* L vs D. */
1059	if ( Desc.Legacy.Gen.u1Long
1060	&& Desc.Legacy.Gen.u1DefBig
1061	&& IEM_IS_LONG_MODE(pIemCpu))
1062	{
1063	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1064	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1065	}
1066
1067	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1068	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1069	{
1070	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1071	{
1072	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1073	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1074	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1075	}
1076	}
1077	else
1078	{
1079	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1080	{
1081	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1082	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1083	}
1084	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1085	{
1086	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1087	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1088	}
1089	}
1090
1091	/* Chop the high bits if 16-bit (Intel says so). */
1092	if (enmEffOpSize == IEMMODE_16BIT)
1093	offSeg &= UINT16_MAX;
1094
1095	/* Limit check. (Should alternatively check for non-canonical addresses
1096	here, but that is ruled out by offSeg being 32-bit, right?) */
1097	uint64_t u64Base;
1098	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1099	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1100	u64Base = 0;
1101	else
1102	{
1103	if (offSeg > cbLimit)
1104	{
1105	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1106	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1107	}
1108	u64Base = X86DESC_BASE(&Desc.Legacy);
1109	}
1110
1111	/*
1112	* Ok, everything checked out fine. Now set the accessed bit before
1113	* committing the result into CS, CSHID and RIP.
1114	*/
1115	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1116	{
1117	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1118	if (rcStrict != VINF_SUCCESS)
1119	return rcStrict;
1120	/** @todo check what VT-x and AMD-V does. */
1121	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1122	}
1123
1124	/* commit */
1125	pCtx->rip = offSeg;
1126	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1127	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1128	pCtx->cs.ValidSel = pCtx->cs.Sel;
1129	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1130	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1131	pCtx->cs.u32Limit = cbLimit;
1132	pCtx->cs.u64Base = u64Base;
1133	/** @todo check if the hidden bits are loaded correctly for 64-bit
1134	* mode. */
1135	return VINF_SUCCESS;
1136	}
1137
1138
1139	/**
1140	* Implements far calls.
1141	*
1142	* This very similar to iemCImpl_FarJmp.
1143	*
1144	* @param uSel The selector.
1145	* @param offSeg The segment offset.
1146	* @param enmEffOpSize The operand size (in case we need it).
1147	*/
1148	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1149	{
1150	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1151	VBOXSTRICTRC rcStrict;
1152	uint64_t uNewRsp;
1153	RTPTRUNION uPtrRet;
1154
1155	/*
1156	* Real mode and V8086 mode are easy. The only snag seems to be that
1157	* CS.limit doesn't change and the limit check is done against the current
1158	* limit.
1159	*/
1160	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1161	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1162	{
1163	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1164
1165	/* Check stack first - may #SS(0). */
1166	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1167	&uPtrRet.pv, &uNewRsp);
1168	if (rcStrict != VINF_SUCCESS)
1169	return rcStrict;
1170
1171	/* Check the target address range. */
1172	if (offSeg > UINT32_MAX)
1173	return iemRaiseGeneralProtectionFault0(pIemCpu);
1174
1175	/* Everything is fine, push the return address. */
1176	if (enmEffOpSize == IEMMODE_16BIT)
1177	{
1178	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1179	uPtrRet.pu16[1] = pCtx->cs.Sel;
1180	}
1181	else
1182	{
1183	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1184	uPtrRet.pu16[3] = pCtx->cs.Sel;
1185	}
1186	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1187	if (rcStrict != VINF_SUCCESS)
1188	return rcStrict;
1189
1190	/* Branch. */
1191	pCtx->rip = offSeg;
1192	pCtx->cs.Sel = uSel;
1193	pCtx->cs.ValidSel = uSel;
1194	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1195	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1196	return VINF_SUCCESS;
1197	}
1198
1199	/*
1200	* Protected mode. Need to parse the specified descriptor...
1201	*/
1202	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1203	{
1204	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1205	return iemRaiseGeneralProtectionFault0(pIemCpu);
1206	}
1207
1208	/* Fetch the descriptor. */
1209	IEMSELDESC Desc;
1210	rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1211	if (rcStrict != VINF_SUCCESS)
1212	return rcStrict;
1213
1214	/*
1215	* Deal with it according to its type. We do the standard code selectors
1216	* here and dispatch the system selectors to worker functions.
1217	*/
1218	if (!Desc.Legacy.Gen.u1DescType)
1219	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1220
1221	/* Only code segments. */
1222	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1223	{
1224	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1225	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1226	}
1227
1228	/* L vs D. */
1229	if ( Desc.Legacy.Gen.u1Long
1230	&& Desc.Legacy.Gen.u1DefBig
1231	&& IEM_IS_LONG_MODE(pIemCpu))
1232	{
1233	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1234	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1235	}
1236
1237	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1238	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1239	{
1240	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1241	{
1242	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1243	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1244	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1245	}
1246	}
1247	else
1248	{
1249	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1250	{
1251	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1252	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1253	}
1254	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1255	{
1256	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1257	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1258	}
1259	}
1260
1261	/* Is it there? */
1262	if (!Desc.Legacy.Gen.u1Present)
1263	{
1264	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1265	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1266	}
1267
1268	/* Check stack first - may #SS(0). */
1269	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1270	* 16-bit code cause a two or four byte CS to be pushed? */
1271	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1272	enmEffOpSize == IEMMODE_64BIT ? 8+8
1273	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1274	&uPtrRet.pv, &uNewRsp);
1275	if (rcStrict != VINF_SUCCESS)
1276	return rcStrict;
1277
1278	/* Chop the high bits if 16-bit (Intel says so). */
1279	if (enmEffOpSize == IEMMODE_16BIT)
1280	offSeg &= UINT16_MAX;
1281
1282	/* Limit / canonical check. */
1283	uint64_t u64Base;
1284	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1285	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1286	{
1287	if (!IEM_IS_CANONICAL(offSeg))
1288	{
1289	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1290	return iemRaiseNotCanonical(pIemCpu);
1291	}
1292	u64Base = 0;
1293	}
1294	else
1295	{
1296	if (offSeg > cbLimit)
1297	{
1298	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1299	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1300	}
1301	u64Base = X86DESC_BASE(&Desc.Legacy);
1302	}
1303
1304	/*
1305	* Now set the accessed bit before
1306	* writing the return address to the stack and committing the result into
1307	* CS, CSHID and RIP.
1308	*/
1309	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1310	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1311	{
1312	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1313	if (rcStrict != VINF_SUCCESS)
1314	return rcStrict;
1315	/** @todo check what VT-x and AMD-V does. */
1316	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1317	}
1318
1319	/* stack */
1320	if (enmEffOpSize == IEMMODE_16BIT)
1321	{
1322	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1323	uPtrRet.pu16[1] = pCtx->cs.Sel;
1324	}
1325	else if (enmEffOpSize == IEMMODE_32BIT)
1326	{
1327	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1328	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1329	}
1330	else
1331	{
1332	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1333	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1334	}
1335	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1336	if (rcStrict != VINF_SUCCESS)
1337	return rcStrict;
1338
1339	/* commit */
1340	pCtx->rip = offSeg;
1341	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1342	pCtx->cs.Sel \|= pIemCpu->uCpl;
1343	pCtx->cs.ValidSel = pCtx->cs.Sel;
1344	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1345	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1346	pCtx->cs.u32Limit = cbLimit;
1347	pCtx->cs.u64Base = u64Base;
1348	/** @todo check if the hidden bits are loaded correctly for 64-bit
1349	* mode. */
1350	return VINF_SUCCESS;
1351	}
1352
1353
1354	/**
1355	* Implements retf.
1356	*
1357	* @param enmEffOpSize The effective operand size.
1358	* @param cbPop The amount of arguments to pop from the stack
1359	* (bytes).
1360	*/
1361	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1362	{
1363	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1364	VBOXSTRICTRC rcStrict;
1365	RTCPTRUNION uPtrFrame;
1366	uint64_t uNewRsp;
1367	uint64_t uNewRip;
1368	uint16_t uNewCs;
1369	NOREF(cbInstr);
1370
1371	/*
1372	* Read the stack values first.
1373	*/
1374	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1375	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1376	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1377	if (rcStrict != VINF_SUCCESS)
1378	return rcStrict;
1379	if (enmEffOpSize == IEMMODE_16BIT)
1380	{
1381	uNewRip = uPtrFrame.pu16[0];
1382	uNewCs = uPtrFrame.pu16[1];
1383	}
1384	else if (enmEffOpSize == IEMMODE_32BIT)
1385	{
1386	uNewRip = uPtrFrame.pu32[0];
1387	uNewCs = uPtrFrame.pu16[2];
1388	}
1389	else
1390	{
1391	uNewRip = uPtrFrame.pu64[0];
1392	uNewCs = uPtrFrame.pu16[4];
1393	}
1394
1395	/*
1396	* Real mode and V8086 mode are easy.
1397	*/
1398	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1399	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1400	{
1401	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1402	/** @todo check how this is supposed to work if sp=0xfffe. */
1403
1404	/* Check the limit of the new EIP. */
1405	/** @todo Intel pseudo code only does the limit check for 16-bit
1406	* operands, AMD does not make any distinction. What is right? */
1407	if (uNewRip > pCtx->cs.u32Limit)
1408	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1409
1410	/* commit the operation. */
1411	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1412	if (rcStrict != VINF_SUCCESS)
1413	return rcStrict;
1414	pCtx->rip = uNewRip;
1415	pCtx->cs.Sel = uNewCs;
1416	pCtx->cs.ValidSel = uNewCs;
1417	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1418	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1419	/** @todo do we load attribs and limit as well? */
1420	if (cbPop)
1421	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1422	return VINF_SUCCESS;
1423	}
1424
1425	/*
1426	* Protected mode is complicated, of course.
1427	*/
1428	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1429	{
1430	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1431	return iemRaiseGeneralProtectionFault0(pIemCpu);
1432	}
1433
1434	/* Fetch the descriptor. */
1435	IEMSELDESC DescCs;
1436	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
1437	if (rcStrict != VINF_SUCCESS)
1438	return rcStrict;
1439
1440	/* Can only return to a code selector. */
1441	if ( !DescCs.Legacy.Gen.u1DescType
1442	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1443	{
1444	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1445	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1446	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1447	}
1448
1449	/* L vs D. */
1450	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1451	&& DescCs.Legacy.Gen.u1DefBig
1452	&& IEM_IS_LONG_MODE(pIemCpu))
1453	{
1454	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1455	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1456	}
1457
1458	/* DPL/RPL/CPL checks. */
1459	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1460	{
1461	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1462	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1463	}
1464
1465	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1466	{
1467	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1468	{
1469	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1470	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1471	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1472	}
1473	}
1474	else
1475	{
1476	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1477	{
1478	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1479	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1480	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1481	}
1482	}
1483
1484	/* Is it there? */
1485	if (!DescCs.Legacy.Gen.u1Present)
1486	{
1487	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1488	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1489	}
1490
1491	/*
1492	* Return to outer privilege? (We'll typically have entered via a call gate.)
1493	*/
1494	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1495	{
1496	/* Read the return pointer, it comes before the parameters. */
1497	RTCPTRUNION uPtrStack;
1498	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1499	if (rcStrict != VINF_SUCCESS)
1500	return rcStrict;
1501	uint16_t uNewOuterSs;
1502	uint64_t uNewOuterRsp;
1503	if (enmEffOpSize == IEMMODE_16BIT)
1504	{
1505	uNewOuterRsp = uPtrFrame.pu16[0];
1506	uNewOuterSs = uPtrFrame.pu16[1];
1507	}
1508	else if (enmEffOpSize == IEMMODE_32BIT)
1509	{
1510	uNewOuterRsp = uPtrFrame.pu32[0];
1511	uNewOuterSs = uPtrFrame.pu16[2];
1512	}
1513	else
1514	{
1515	uNewOuterRsp = uPtrFrame.pu64[0];
1516	uNewOuterSs = uPtrFrame.pu16[4];
1517	}
1518
1519	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1520	and read the selector. */
1521	IEMSELDESC DescSs;
1522	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1523	{
1524	if ( !DescCs.Legacy.Gen.u1Long
1525	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
1526	{
1527	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1528	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1529	return iemRaiseGeneralProtectionFault0(pIemCpu);
1530	}
1531	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1532	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1533	}
1534	else
1535	{
1536	/* Fetch the descriptor for the new stack segment. */
1537	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
1538	if (rcStrict != VINF_SUCCESS)
1539	return rcStrict;
1540	}
1541
1542	/* Check that RPL of stack and code selectors match. */
1543	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1544	{
1545	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1546	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1547	}
1548
1549	/* Must be a writable data segment. */
1550	if ( !DescSs.Legacy.Gen.u1DescType
1551	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1552	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1553	{
1554	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1555	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1556	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1557	}
1558
1559	/* L vs D. (Not mentioned by intel.) */
1560	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1561	&& DescSs.Legacy.Gen.u1DefBig
1562	&& IEM_IS_LONG_MODE(pIemCpu))
1563	{
1564	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1565	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1566	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1567	}
1568
1569	/* DPL/RPL/CPL checks. */
1570	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1571	{
1572	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1573	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1574	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1575	}
1576
1577	/* Is it there? */
1578	if (!DescSs.Legacy.Gen.u1Present)
1579	{
1580	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1581	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1582	}
1583
1584	/* Calc SS limit.*/
1585	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1586
1587	/* Is RIP canonical or within CS.limit? */
1588	uint64_t u64Base;
1589	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1590
1591	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1592	{
1593	if (!IEM_IS_CANONICAL(uNewRip))
1594	{
1595	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1596	return iemRaiseNotCanonical(pIemCpu);
1597	}
1598	u64Base = 0;
1599	}
1600	else
1601	{
1602	if (uNewRip > cbLimitCs)
1603	{
1604	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1605	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1606	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1607	}
1608	u64Base = X86DESC_BASE(&DescCs.Legacy);
1609	}
1610
1611	/*
1612	* Now set the accessed bit before
1613	* writing the return address to the stack and committing the result into
1614	* CS, CSHID and RIP.
1615	*/
1616	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1617	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1618	{
1619	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1620	if (rcStrict != VINF_SUCCESS)
1621	return rcStrict;
1622	/** @todo check what VT-x and AMD-V does. */
1623	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1624	}
1625	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1626	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1627	{
1628	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1629	if (rcStrict != VINF_SUCCESS)
1630	return rcStrict;
1631	/** @todo check what VT-x and AMD-V does. */
1632	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1633	}
1634
1635	/* commit */
1636	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1637	if (rcStrict != VINF_SUCCESS)
1638	return rcStrict;
1639	if (enmEffOpSize == IEMMODE_16BIT)
1640	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1641	else
1642	pCtx->rip = uNewRip;
1643	pCtx->cs.Sel = uNewCs;
1644	pCtx->cs.ValidSel = uNewCs;
1645	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1646	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1647	pCtx->cs.u32Limit = cbLimitCs;
1648	pCtx->cs.u64Base = u64Base;
1649	pCtx->rsp = uNewRsp;
1650	pCtx->ss.Sel = uNewOuterSs;
1651	pCtx->ss.ValidSel = uNewOuterSs;
1652	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1653	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1654	pCtx->ss.u32Limit = cbLimitSs;
1655	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1656	pCtx->ss.u64Base = 0;
1657	else
1658	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1659
1660	pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1661	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1662	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1663	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1664	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1665
1666	/** @todo check if the hidden bits are loaded correctly for 64-bit
1667	* mode. */
1668
1669	if (cbPop)
1670	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1671
1672	/* Done! */
1673	}
1674	/*
1675	* Return to the same privilege level
1676	*/
1677	else
1678	{
1679	/* Limit / canonical check. */
1680	uint64_t u64Base;
1681	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1682
1683	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1684	{
1685	if (!IEM_IS_CANONICAL(uNewRip))
1686	{
1687	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1688	return iemRaiseNotCanonical(pIemCpu);
1689	}
1690	u64Base = 0;
1691	}
1692	else
1693	{
1694	if (uNewRip > cbLimitCs)
1695	{
1696	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1697	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1698	}
1699	u64Base = X86DESC_BASE(&DescCs.Legacy);
1700	}
1701
1702	/*
1703	* Now set the accessed bit before
1704	* writing the return address to the stack and committing the result into
1705	* CS, CSHID and RIP.
1706	*/
1707	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1708	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1709	{
1710	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1711	if (rcStrict != VINF_SUCCESS)
1712	return rcStrict;
1713	/** @todo check what VT-x and AMD-V does. */
1714	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1715	}
1716
1717	/* commit */
1718	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1719	if (rcStrict != VINF_SUCCESS)
1720	return rcStrict;
1721	if (enmEffOpSize == IEMMODE_16BIT)
1722	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1723	else
1724	pCtx->rip = uNewRip;
1725	pCtx->cs.Sel = uNewCs;
1726	pCtx->cs.ValidSel = uNewCs;
1727	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1728	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1729	pCtx->cs.u32Limit = cbLimitCs;
1730	pCtx->cs.u64Base = u64Base;
1731	/** @todo check if the hidden bits are loaded correctly for 64-bit
1732	* mode. */
1733	if (cbPop)
1734	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1735	}
1736	return VINF_SUCCESS;
1737	}
1738
1739
1740	/**
1741	* Implements retn.
1742	*
1743	* We're doing this in C because of the \#GP that might be raised if the popped
1744	* program counter is out of bounds.
1745	*
1746	* @param enmEffOpSize The effective operand size.
1747	* @param cbPop The amount of arguments to pop from the stack
1748	* (bytes).
1749	*/
1750	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1751	{
1752	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1753	NOREF(cbInstr);
1754
1755	/* Fetch the RSP from the stack. */
1756	VBOXSTRICTRC rcStrict;
1757	RTUINT64U NewRip;
1758	RTUINT64U NewRsp;
1759	NewRsp.u = pCtx->rsp;
1760	switch (enmEffOpSize)
1761	{
1762	case IEMMODE_16BIT:
1763	NewRip.u = 0;
1764	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1765	break;
1766	case IEMMODE_32BIT:
1767	NewRip.u = 0;
1768	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1769	break;
1770	case IEMMODE_64BIT:
1771	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1772	break;
1773	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1774	}
1775	if (rcStrict != VINF_SUCCESS)
1776	return rcStrict;
1777
1778	/* Check the new RSP before loading it. */
1779	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
1780	* of it. The canonical test is performed here and for call. */
1781	if (enmEffOpSize != IEMMODE_64BIT)
1782	{
1783	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1784	{
1785	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1786	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1787	}
1788	}
1789	else
1790	{
1791	if (!IEM_IS_CANONICAL(NewRip.u))
1792	{
1793	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1794	return iemRaiseNotCanonical(pIemCpu);
1795	}
1796	}
1797
1798	/* Commit it. */
1799	pCtx->rip = NewRip.u;
1800	pCtx->rsp = NewRsp.u;
1801	if (cbPop)
1802	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1803
1804	return VINF_SUCCESS;
1805	}
1806
1807
1808	/**
1809	* Implements enter.
1810	*
1811	* We're doing this in C because the instruction is insane, even for the
1812	* u8NestingLevel=0 case dealing with the stack is tedious.
1813	*
1814	* @param enmEffOpSize The effective operand size.
1815	*/
1816	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1817	{
1818	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1819
1820	/* Push RBP, saving the old value in TmpRbp. */
1821	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1822	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1823	RTUINT64U NewRbp;
1824	VBOXSTRICTRC rcStrict;
1825	if (enmEffOpSize == IEMMODE_64BIT)
1826	{
1827	rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1828	NewRbp = NewRsp;
1829	}
1830	else if (pCtx->ss.Attr.n.u1DefBig)
1831	{
1832	rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1833	NewRbp = NewRsp;
1834	}
1835	else
1836	{
1837	rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1838	NewRbp = TmpRbp;
1839	NewRbp.Words.w0 = NewRsp.Words.w0;
1840	}
1841	if (rcStrict != VINF_SUCCESS)
1842	return rcStrict;
1843
1844	/* Copy the parameters (aka nesting levels by Intel). */
1845	cParameters &= 0x1f;
1846	if (cParameters > 0)
1847	{
1848	switch (enmEffOpSize)
1849	{
1850	case IEMMODE_16BIT:
1851	if (pCtx->ss.Attr.n.u1DefBig)
1852	TmpRbp.DWords.dw0 -= 2;
1853	else
1854	TmpRbp.Words.w0 -= 2;
1855	do
1856	{
1857	uint16_t u16Tmp;
1858	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1859	if (rcStrict != VINF_SUCCESS)
1860	break;
1861	rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1862	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1863	break;
1864
1865	case IEMMODE_32BIT:
1866	if (pCtx->ss.Attr.n.u1DefBig)
1867	TmpRbp.DWords.dw0 -= 4;
1868	else
1869	TmpRbp.Words.w0 -= 4;
1870	do
1871	{
1872	uint32_t u32Tmp;
1873	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1874	if (rcStrict != VINF_SUCCESS)
1875	break;
1876	rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1877	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1878	break;
1879
1880	case IEMMODE_64BIT:
1881	TmpRbp.u -= 8;
1882	do
1883	{
1884	uint64_t u64Tmp;
1885	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1886	if (rcStrict != VINF_SUCCESS)
1887	break;
1888	rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1889	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1890	break;
1891
1892	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1893	}
1894	if (rcStrict != VINF_SUCCESS)
1895	return VINF_SUCCESS;
1896
1897	/* Push the new RBP */
1898	if (enmEffOpSize == IEMMODE_64BIT)
1899	rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1900	else if (pCtx->ss.Attr.n.u1DefBig)
1901	rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1902	else
1903	rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1904	if (rcStrict != VINF_SUCCESS)
1905	return rcStrict;
1906
1907	}
1908
1909	/* Recalc RSP. */
1910	iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
1911
1912	/** @todo Should probe write access at the new RSP according to AMD. */
1913
1914	/* Commit it. */
1915	pCtx->rbp = NewRbp.u;
1916	pCtx->rsp = NewRsp.u;
1917	iemRegAddToRip(pIemCpu, cbInstr);
1918
1919	return VINF_SUCCESS;
1920	}
1921
1922
1923
1924	/**
1925	* Implements leave.
1926	*
1927	* We're doing this in C because messing with the stack registers is annoying
1928	* since they depends on SS attributes.
1929	*
1930	* @param enmEffOpSize The effective operand size.
1931	*/
1932	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1933	{
1934	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1935
1936	/* Calculate the intermediate RSP from RBP and the stack attributes. */
1937	RTUINT64U NewRsp;
1938	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1939	NewRsp.u = pCtx->rbp;
1940	else if (pCtx->ss.Attr.n.u1DefBig)
1941	NewRsp.u = pCtx->ebp;
1942	else
1943	{
1944	/** @todo Check that LEAVE actually preserve the high EBP bits. */
1945	NewRsp.u = pCtx->rsp;
1946	NewRsp.Words.w0 = pCtx->bp;
1947	}
1948
1949	/* Pop RBP according to the operand size. */
1950	VBOXSTRICTRC rcStrict;
1951	RTUINT64U NewRbp;
1952	switch (enmEffOpSize)
1953	{
1954	case IEMMODE_16BIT:
1955	NewRbp.u = pCtx->rbp;
1956	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1957	break;
1958	case IEMMODE_32BIT:
1959	NewRbp.u = 0;
1960	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1961	break;
1962	case IEMMODE_64BIT:
1963	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1964	break;
1965	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1966	}
1967	if (rcStrict != VINF_SUCCESS)
1968	return rcStrict;
1969
1970
1971	/* Commit it. */
1972	pCtx->rbp = NewRbp.u;
1973	pCtx->rsp = NewRsp.u;
1974	iemRegAddToRip(pIemCpu, cbInstr);
1975
1976	return VINF_SUCCESS;
1977	}
1978
1979
1980	/**
1981	* Implements int3 and int XX.
1982	*
1983	* @param u8Int The interrupt vector number.
1984	* @param fIsBpInstr Is it the breakpoint instruction.
1985	*/
1986	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1987	{
1988	Assert(pIemCpu->cXcptRecursions == 0);
1989	return iemRaiseXcptOrInt(pIemCpu,
1990	cbInstr,
1991	u8Int,
1992	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
1993	0,
1994	0);
1995	}
1996
1997
1998	/**
1999	* Implements iret for real mode and V8086 mode.
2000	*
2001	* @param enmEffOpSize The effective operand size.
2002	*/
2003	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2004	{
2005	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2006	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2007	X86EFLAGS Efl;
2008	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2009	NOREF(cbInstr);
2010
2011	/*
2012	* iret throws an exception if VME isn't enabled.
2013	*/
2014	if ( Efl.Bits.u1VM
2015	&& Efl.Bits.u2IOPL != 3
2016	&& !(pCtx->cr4 & X86_CR4_VME))
2017	return iemRaiseGeneralProtectionFault0(pIemCpu);
2018
2019	/*
2020	* Do the stack bits, but don't commit RSP before everything checks
2021	* out right.
2022	*/
2023	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2024	VBOXSTRICTRC rcStrict;
2025	RTCPTRUNION uFrame;
2026	uint16_t uNewCs;
2027	uint32_t uNewEip;
2028	uint32_t uNewFlags;
2029	uint64_t uNewRsp;
2030	if (enmEffOpSize == IEMMODE_32BIT)
2031	{
2032	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2033	if (rcStrict != VINF_SUCCESS)
2034	return rcStrict;
2035	uNewEip = uFrame.pu32[0];
2036	if (uNewEip > UINT16_MAX)
2037	return iemRaiseGeneralProtectionFault0(pIemCpu);
2038
2039	uNewCs = (uint16_t)uFrame.pu32[1];
2040	uNewFlags = uFrame.pu32[2];
2041	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2042	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
2043	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
2044	\| X86_EFL_ID;
2045	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
2046	}
2047	else
2048	{
2049	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2050	if (rcStrict != VINF_SUCCESS)
2051	return rcStrict;
2052	uNewEip = uFrame.pu16[0];
2053	uNewCs = uFrame.pu16[1];
2054	uNewFlags = uFrame.pu16[2];
2055	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2056	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
2057	uNewFlags \|= Efl.u & (UINT32_C(0xffff0000) \| X86_EFL_1);
2058	/** @todo The intel pseudo code does not indicate what happens to
2059	* reserved flags. We just ignore them. */
2060	}
2061	/** @todo Check how this is supposed to work if sp=0xfffe. */
2062
2063	/*
2064	* Check the limit of the new EIP.
2065	*/
2066	/** @todo Only the AMD pseudo code check the limit here, what's
2067	* right? */
2068	if (uNewEip > pCtx->cs.u32Limit)
2069	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2070
2071	/*
2072	* V8086 checks and flag adjustments
2073	*/
2074	if (Efl.Bits.u1VM)
2075	{
2076	if (Efl.Bits.u2IOPL == 3)
2077	{
2078	/* Preserve IOPL and clear RF. */
2079	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
2080	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
2081	}
2082	else if ( enmEffOpSize == IEMMODE_16BIT
2083	&& ( !(uNewFlags & X86_EFL_IF)
2084	\|\| !Efl.Bits.u1VIP )
2085	&& !(uNewFlags & X86_EFL_TF) )
2086	{
2087	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2088	uNewFlags &= ~X86_EFL_VIF;
2089	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
2090	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
2091	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2092	}
2093	else
2094	return iemRaiseGeneralProtectionFault0(pIemCpu);
2095	}
2096
2097	/*
2098	* Commit the operation.
2099	*/
2100	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2101	if (rcStrict != VINF_SUCCESS)
2102	return rcStrict;
2103	#ifdef DBGFTRACE_ENABLED
2104	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2105	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2106	#endif
2107
2108	pCtx->rip = uNewEip;
2109	pCtx->cs.Sel = uNewCs;
2110	pCtx->cs.ValidSel = uNewCs;
2111	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2112	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2113	/** @todo do we load attribs and limit as well? */
2114	Assert(uNewFlags & X86_EFL_1);
2115	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2116
2117	return VINF_SUCCESS;
2118	}
2119
2120
2121	/**
2122	* Loads a segment register when entering V8086 mode.
2123	*
2124	* @param pSReg The segment register.
2125	* @param uSeg The segment to load.
2126	*/
2127	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2128	{
2129	pSReg->Sel = uSeg;
2130	pSReg->ValidSel = uSeg;
2131	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2132	pSReg->u64Base = (uint32_t)uSeg << 4;
2133	pSReg->u32Limit = 0xffff;
2134	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2135	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2136	* IRET'ing to V8086. */
2137	}
2138
2139
2140	/**
2141	* Implements iret for protected mode returning to V8086 mode.
2142	*
2143	* @param pCtx Pointer to the CPU context.
2144	* @param uNewEip The new EIP.
2145	* @param uNewCs The new CS.
2146	* @param uNewFlags The new EFLAGS.
2147	* @param uNewRsp The RSP after the initial IRET frame.
2148	*
2149	* @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2150	*/
2151	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2152	uint32_t, uNewFlags, uint64_t, uNewRsp)
2153	{
2154	#if 0
2155	if (!LogIs6Enabled())
2156	{
2157	RTLogGroupSettings(NULL, "iem.eo.l6.l2");
2158	RTLogFlags(NULL, "enabled");
2159	return VERR_IEM_RESTART_INSTRUCTION;
2160	}
2161	#endif
2162
2163	/*
2164	* Pop the V8086 specific frame bits off the stack.
2165	*/
2166	VBOXSTRICTRC rcStrict;
2167	RTCPTRUNION uFrame;
2168	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2169	if (rcStrict != VINF_SUCCESS)
2170	return rcStrict;
2171	uint32_t uNewEsp = uFrame.pu32[0];
2172	uint16_t uNewSs = uFrame.pu32[1];
2173	uint16_t uNewEs = uFrame.pu32[2];
2174	uint16_t uNewDs = uFrame.pu32[3];
2175	uint16_t uNewFs = uFrame.pu32[4];
2176	uint16_t uNewGs = uFrame.pu32[5];
2177	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2178	if (rcStrict != VINF_SUCCESS)
2179	return rcStrict;
2180
2181	/*
2182	* Commit the operation.
2183	*/
2184	uNewFlags &= X86_EFL_LIVE_MASK;
2185	uNewFlags \|= X86_EFL_RA1_MASK;
2186	#ifdef DBGFTRACE_ENABLED
2187	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2188	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2189	#endif
2190
2191	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2192	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2193	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2194	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2195	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2196	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2197	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2198	pCtx->rip = uNewEip;
2199	pCtx->rsp = uNewEsp;
2200	pIemCpu->uCpl = 3;
2201
2202	return VINF_SUCCESS;
2203	}
2204
2205
2206	/**
2207	* Implements iret for protected mode returning via a nested task.
2208	*
2209	* @param enmEffOpSize The effective operand size.
2210	*/
2211	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2212	{
2213	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2214	}
2215
2216
2217	/**
2218	* Implements iret for protected mode
2219	*
2220	* @param enmEffOpSize The effective operand size.
2221	*/
2222	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2223	{
2224	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2225	NOREF(cbInstr);
2226
2227	/*
2228	* Nested task return.
2229	*/
2230	if (pCtx->eflags.Bits.u1NT)
2231	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2232
2233	/*
2234	* Normal return.
2235	*
2236	* Do the stack bits, but don't commit RSP before everything checks
2237	* out right.
2238	*/
2239	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2240	VBOXSTRICTRC rcStrict;
2241	RTCPTRUNION uFrame;
2242	uint16_t uNewCs;
2243	uint32_t uNewEip;
2244	uint32_t uNewFlags;
2245	uint64_t uNewRsp;
2246	if (enmEffOpSize == IEMMODE_32BIT)
2247	{
2248	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2249	if (rcStrict != VINF_SUCCESS)
2250	return rcStrict;
2251	uNewEip = uFrame.pu32[0];
2252	uNewCs = (uint16_t)uFrame.pu32[1];
2253	uNewFlags = uFrame.pu32[2];
2254	}
2255	else
2256	{
2257	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2258	if (rcStrict != VINF_SUCCESS)
2259	return rcStrict;
2260	uNewEip = uFrame.pu16[0];
2261	uNewCs = uFrame.pu16[1];
2262	uNewFlags = uFrame.pu16[2];
2263	}
2264	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2265	if (rcStrict != VINF_SUCCESS)
2266	return rcStrict;
2267
2268	/*
2269	* We're hopefully not returning to V8086 mode...
2270	*/
2271	if ( (uNewFlags & X86_EFL_VM)
2272	&& pIemCpu->uCpl == 0)
2273	{
2274	Assert(enmEffOpSize == IEMMODE_32BIT);
2275	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2276	}
2277
2278	/*
2279	* Protected mode.
2280	*/
2281	/* Read the CS descriptor. */
2282	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2283	{
2284	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2285	return iemRaiseGeneralProtectionFault0(pIemCpu);
2286	}
2287
2288	IEMSELDESC DescCS;
2289	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2290	if (rcStrict != VINF_SUCCESS)
2291	{
2292	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2293	return rcStrict;
2294	}
2295
2296	/* Must be a code descriptor. */
2297	if (!DescCS.Legacy.Gen.u1DescType)
2298	{
2299	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2300	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2301	}
2302	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2303	{
2304	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2305	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2306	}
2307
2308	/* Privilege checks. */
2309	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2310	{
2311	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2312	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2313	}
2314	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2315	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2316	{
2317	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2318	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2319	}
2320
2321	/* Present? */
2322	if (!DescCS.Legacy.Gen.u1Present)
2323	{
2324	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2325	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2326	}
2327
2328	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2329
2330	/*
2331	* Return to outer level?
2332	*/
2333	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2334	{
2335	uint16_t uNewSS;
2336	uint32_t uNewESP;
2337	if (enmEffOpSize == IEMMODE_32BIT)
2338	{
2339	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2340	if (rcStrict != VINF_SUCCESS)
2341	return rcStrict;
2342	uNewESP = uFrame.pu32[0];
2343	uNewSS = (uint16_t)uFrame.pu32[1];
2344	}
2345	else
2346	{
2347	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2348	if (rcStrict != VINF_SUCCESS)
2349	return rcStrict;
2350	uNewESP = uFrame.pu16[0];
2351	uNewSS = uFrame.pu16[1];
2352	}
2353	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2354	if (rcStrict != VINF_SUCCESS)
2355	return rcStrict;
2356
2357	/* Read the SS descriptor. */
2358	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2359	{
2360	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2361	return iemRaiseGeneralProtectionFault0(pIemCpu);
2362	}
2363
2364	IEMSELDESC DescSS;
2365	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
2366	if (rcStrict != VINF_SUCCESS)
2367	{
2368	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2369	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2370	return rcStrict;
2371	}
2372
2373	/* Privilege checks. */
2374	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2375	{
2376	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2377	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2378	}
2379	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2380	{
2381	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2382	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2383	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2384	}
2385
2386	/* Must be a writeable data segment descriptor. */
2387	if (!DescSS.Legacy.Gen.u1DescType)
2388	{
2389	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2390	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2391	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2392	}
2393	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2394	{
2395	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2396	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2397	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2398	}
2399
2400	/* Present? */
2401	if (!DescSS.Legacy.Gen.u1Present)
2402	{
2403	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2404	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2405	}
2406
2407	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2408
2409	/* Check EIP. */
2410	if (uNewEip > cbLimitCS)
2411	{
2412	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2413	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2414	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2415	}
2416
2417	/*
2418	* Commit the changes, marking CS and SS accessed first since
2419	* that may fail.
2420	*/
2421	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2422	{
2423	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2424	if (rcStrict != VINF_SUCCESS)
2425	return rcStrict;
2426	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2427	}
2428	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2429	{
2430	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2431	if (rcStrict != VINF_SUCCESS)
2432	return rcStrict;
2433	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2434	}
2435
2436	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2437	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2438	if (enmEffOpSize != IEMMODE_16BIT)
2439	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2440	if (pIemCpu->uCpl == 0)
2441	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2442	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2443	fEFlagsMask \|= X86_EFL_IF;
2444	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2445	fEFlagsNew &= ~fEFlagsMask;
2446	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2447	#ifdef DBGFTRACE_ENABLED
2448	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
2449	pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
2450	uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
2451	#endif
2452
2453	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2454	pCtx->rip = uNewEip;
2455	pCtx->cs.Sel = uNewCs;
2456	pCtx->cs.ValidSel = uNewCs;
2457	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2458	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2459	pCtx->cs.u32Limit = cbLimitCS;
2460	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2461	pCtx->rsp = uNewESP;
2462	pCtx->ss.Sel = uNewSS;
2463	pCtx->ss.ValidSel = uNewSS;
2464	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2465	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2466	pCtx->ss.u32Limit = cbLimitSs;
2467	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2468
2469	pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2470	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2471	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2472	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2473	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2474
2475	/* Done! */
2476
2477	}
2478	/*
2479	* Return to the same level.
2480	*/
2481	else
2482	{
2483	/* Check EIP. */
2484	if (uNewEip > cbLimitCS)
2485	{
2486	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2487	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2488	}
2489
2490	/*
2491	* Commit the changes, marking CS first since it may fail.
2492	*/
2493	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2494	{
2495	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2496	if (rcStrict != VINF_SUCCESS)
2497	return rcStrict;
2498	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2499	}
2500
2501	X86EFLAGS NewEfl;
2502	NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2503	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2504	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2505	if (enmEffOpSize != IEMMODE_16BIT)
2506	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2507	if (pIemCpu->uCpl == 0)
2508	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2509	else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2510	fEFlagsMask \|= X86_EFL_IF;
2511	NewEfl.u &= ~fEFlagsMask;
2512	NewEfl.u \|= fEFlagsMask & uNewFlags;
2513	#ifdef DBGFTRACE_ENABLED
2514	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
2515	pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
2516	uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
2517	#endif
2518
2519	IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2520	pCtx->rip = uNewEip;
2521	pCtx->cs.Sel = uNewCs;
2522	pCtx->cs.ValidSel = uNewCs;
2523	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2524	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2525	pCtx->cs.u32Limit = cbLimitCS;
2526	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2527	pCtx->rsp = uNewRsp;
2528	/* Done! */
2529	}
2530	return VINF_SUCCESS;
2531	}
2532
2533
2534	/**
2535	* Implements iret for long mode
2536	*
2537	* @param enmEffOpSize The effective operand size.
2538	*/
2539	IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2540	{
2541	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2542	NOREF(cbInstr);
2543
2544	/*
2545	* Nested task return is not supported in long mode.
2546	*/
2547	if (pCtx->eflags.Bits.u1NT)
2548	{
2549	Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
2550	return iemRaiseGeneralProtectionFault0(pIemCpu);
2551	}
2552
2553	/*
2554	* Normal return.
2555	*
2556	* Do the stack bits, but don't commit RSP before everything checks
2557	* out right.
2558	*/
2559	VBOXSTRICTRC rcStrict;
2560	RTCPTRUNION uFrame;
2561	uint64_t uNewRip;
2562	uint16_t uNewCs;
2563	uint16_t uNewSs;
2564	uint32_t uNewFlags;
2565	uint64_t uNewRsp;
2566	if (enmEffOpSize == IEMMODE_64BIT)
2567	{
2568	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
2569	if (rcStrict != VINF_SUCCESS)
2570	return rcStrict;
2571	uNewRip = uFrame.pu64[0];
2572	uNewCs = (uint16_t)uFrame.pu64[1];
2573	uNewFlags = (uint32_t)uFrame.pu64[2];
2574	uNewRsp = uFrame.pu64[3];
2575	uNewSs = (uint16_t)uFrame.pu64[4];
2576	}
2577	else if (enmEffOpSize == IEMMODE_32BIT)
2578	{
2579	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
2580	if (rcStrict != VINF_SUCCESS)
2581	return rcStrict;
2582	uNewRip = uFrame.pu32[0];
2583	uNewCs = (uint16_t)uFrame.pu32[1];
2584	uNewFlags = uFrame.pu32[2];
2585	uNewRsp = uFrame.pu32[3];
2586	uNewSs = (uint16_t)uFrame.pu32[4];
2587	}
2588	else
2589	{
2590	Assert(enmEffOpSize == IEMMODE_16BIT);
2591	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
2592	if (rcStrict != VINF_SUCCESS)
2593	return rcStrict;
2594	uNewRip = uFrame.pu16[0];
2595	uNewCs = uFrame.pu16[1];
2596	uNewFlags = uFrame.pu16[2];
2597	uNewRsp = uFrame.pu16[3];
2598	uNewSs = uFrame.pu16[4];
2599	}
2600	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2601	if (rcStrict != VINF_SUCCESS)
2602	return rcStrict;
2603	Log2(("iretq stack: cs:rip=%04x:%016RX16 rflags=%016RX16 ss:rsp=%04x:%016RX16\n",
2604	uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
2605
2606	/*
2607	* Check stuff.
2608	*/
2609	/* Read the CS descriptor. */
2610	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2611	{
2612	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2613	return iemRaiseGeneralProtectionFault0(pIemCpu);
2614	}
2615
2616	IEMSELDESC DescCS;
2617	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2618	if (rcStrict != VINF_SUCCESS)
2619	{
2620	Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
2621	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2622	return rcStrict;
2623	}
2624
2625	/* Must be a code descriptor. */
2626	if ( !DescCS.Legacy.Gen.u1DescType
2627	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2628	{
2629	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
2630	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
2631	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2632	}
2633
2634	/* Privilege checks. */
2635	uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
2636	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2637	{
2638	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp, pIemCpu->uCpl));
2639	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2640	}
2641	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2642	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2643	{
2644	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < DPL (%d) -> #GP\n",
2645	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u2Dpl));
2646	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2647	}
2648
2649	/* Present? */
2650	if (!DescCS.Legacy.Gen.u1Present)
2651	{
2652	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2653	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2654	}
2655
2656	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2657
2658	/* Read the SS descriptor. */
2659	IEMSELDESC DescSS;
2660	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2661	{
2662	if ( !DescCS.Legacy.Gen.u1Long
2663	\|\| DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
2664	\|\| uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
2665	{
2666	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2667	return iemRaiseGeneralProtectionFault0(pIemCpu);
2668	}
2669	DescSS.Legacy.u = 0;
2670	}
2671	else
2672	{
2673	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
2674	if (rcStrict != VINF_SUCCESS)
2675	{
2676	Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
2677	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2678	return rcStrict;
2679	}
2680	}
2681
2682	/* Privilege checks. */
2683	if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2684	{
2685	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2686	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2687	}
2688
2689	uint32_t cbLimitSs;
2690	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2691	cbLimitSs = UINT32_MAX;
2692	else
2693	{
2694	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2695	{
2696	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
2697	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
2698	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2699	}
2700
2701	/* Must be a writeable data segment descriptor. */
2702	if (!DescSS.Legacy.Gen.u1DescType)
2703	{
2704	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
2705	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2706	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2707	}
2708	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2709	{
2710	Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
2711	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2712	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2713	}
2714
2715	/* Present? */
2716	if (!DescSS.Legacy.Gen.u1Present)
2717	{
2718	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2719	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
2720	}
2721	cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2722	}
2723
2724	/* Check EIP. */
2725	if (DescCS.Legacy.Gen.u1Long)
2726	{
2727	if (!IEM_IS_CANONICAL(uNewRip))
2728	{
2729	Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
2730	uNewCs, uNewRip, uNewSs, uNewRsp));
2731	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2732	}
2733	}
2734	else
2735	{
2736	if (uNewRip > cbLimitCS)
2737	{
2738	Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
2739	uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
2740	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2741	}
2742	}
2743
2744	/*
2745	* Commit the changes, marking CS and SS accessed first since
2746	* that may fail.
2747	*/
2748	/** @todo where exactly are these actually marked accessed by a real CPU? */
2749	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2750	{
2751	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2752	if (rcStrict != VINF_SUCCESS)
2753	return rcStrict;
2754	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2755	}
2756	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2757	{
2758	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
2759	if (rcStrict != VINF_SUCCESS)
2760	return rcStrict;
2761	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2762	}
2763
2764	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2765	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2766	if (enmEffOpSize != IEMMODE_16BIT)
2767	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2768	if (pIemCpu->uCpl == 0)
2769	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is ignored */
2770	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2771	fEFlagsMask \|= X86_EFL_IF;
2772	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2773	fEFlagsNew &= ~fEFlagsMask;
2774	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2775	#ifdef DBGFTRACE_ENABLED
2776	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
2777	pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
2778	#endif
2779
2780	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2781	pCtx->rip = uNewRip;
2782	pCtx->cs.Sel = uNewCs;
2783	pCtx->cs.ValidSel = uNewCs;
2784	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2785	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2786	pCtx->cs.u32Limit = cbLimitCS;
2787	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2788	pCtx->rsp = uNewRsp;
2789	pCtx->ss.Sel = uNewSs;
2790	pCtx->ss.ValidSel = uNewSs;
2791	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2792	{
2793	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2794	pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE \| (uNewCpl << X86DESCATTR_DPL_SHIFT);
2795	pCtx->ss.u32Limit = UINT32_MAX;
2796	pCtx->ss.u64Base = 0;
2797	Log2(("iretq new SS: NULL\n"));
2798	}
2799	else
2800	{
2801	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2802	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2803	pCtx->ss.u32Limit = cbLimitSs;
2804	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2805	Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
2806	}
2807
2808	if (pIemCpu->uCpl != uNewCpl)
2809	{
2810	pIemCpu->uCpl = uNewCpl;
2811	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
2812	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
2813	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
2814	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
2815	}
2816
2817	return VINF_SUCCESS;
2818	}
2819
2820
2821	/**
2822	* Implements iret.
2823	*
2824	* @param enmEffOpSize The effective operand size.
2825	*/
2826	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2827	{
2828	/*
2829	* Call a mode specific worker.
2830	*/
2831	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2832	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2833	if (IEM_IS_LONG_MODE(pIemCpu))
2834	return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2835
2836	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2837	}
2838
2839
2840	/**
2841	* Implements SYSCALL (AMD and Intel64).
2842	*
2843	* @param enmEffOpSize The effective operand size.
2844	*/
2845	IEM_CIMPL_DEF_0(iemCImpl_syscall)
2846	{
2847	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2848
2849	/*
2850	* Check preconditions.
2851	*
2852	* Note that CPUs described in the documentation may load a few odd values
2853	* into CS and SS than we allow here. This has yet to be checked on real
2854	* hardware.
2855	*/
2856	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2857	{
2858	Log(("syscall: Not enabled in EFER -> #UD\n"));
2859	return iemRaiseUndefinedOpcode(pIemCpu);
2860	}
2861	if (!(pCtx->cr0 & X86_CR0_PE))
2862	{
2863	Log(("syscall: Protected mode is required -> #GP(0)\n"));
2864	return iemRaiseGeneralProtectionFault0(pIemCpu);
2865	}
2866	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2867	{
2868	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2869	return iemRaiseUndefinedOpcode(pIemCpu);
2870	}
2871
2872	/** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
2873	/** @todo what about LDT selectors? Shouldn't matter, really. */
2874	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2875	uint16_t uNewSs = uNewCs + 8;
2876	if (uNewCs == 0 \|\| uNewSs == 0)
2877	{
2878	Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2879	return iemRaiseGeneralProtectionFault0(pIemCpu);
2880	}
2881
2882	/* Long mode and legacy mode differs. */
2883	if (CPUMIsGuestInLongModeEx(pCtx))
2884	{
2885	uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
2886
2887	/* This test isn't in the docs, but I'm not trusting the guys writing
2888	the MSRs to have validated the values as canonical like they should. */
2889	if (!IEM_IS_CANONICAL(uNewRip))
2890	{
2891	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2892	return iemRaiseUndefinedOpcode(pIemCpu);
2893	}
2894
2895	/*
2896	* Commit it.
2897	*/
2898	Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
2899	pCtx->rcx = pCtx->rip + cbInstr;
2900	pCtx->rip = uNewRip;
2901
2902	pCtx->rflags.u &= ~X86_EFL_RF;
2903	pCtx->r11 = pCtx->rflags.u;
2904	pCtx->rflags.u &= ~pCtx->msrSFMASK;
2905	pCtx->rflags.u \|= X86_EFL_1;
2906
2907	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2908	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2909	}
2910	else
2911	{
2912	/*
2913	* Commit it.
2914	*/
2915	Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
2916	pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
2917	pCtx->rcx = pCtx->eip + cbInstr;
2918	pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
2919	pCtx->rflags.u &= ~(X86_EFL_VM \| X86_EFL_IF \| X86_EFL_RF);
2920
2921	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2922	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2923	}
2924	pCtx->cs.Sel = uNewCs;
2925	pCtx->cs.ValidSel = uNewCs;
2926	pCtx->cs.u64Base = 0;
2927	pCtx->cs.u32Limit = UINT32_MAX;
2928	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2929
2930	pCtx->ss.Sel = uNewSs;
2931	pCtx->ss.ValidSel = uNewSs;
2932	pCtx->ss.u64Base = 0;
2933	pCtx->ss.u32Limit = UINT32_MAX;
2934	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2935
2936	return VINF_SUCCESS;
2937	}
2938
2939
2940	/**
2941	* Implements SYSRET (AMD and Intel64).
2942	*/
2943	IEM_CIMPL_DEF_0(iemCImpl_sysret)
2944
2945	{
2946	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2947
2948	/*
2949	* Check preconditions.
2950	*
2951	* Note that CPUs described in the documentation may load a few odd values
2952	* into CS and SS than we allow here. This has yet to be checked on real
2953	* hardware.
2954	*/
2955	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2956	{
2957	Log(("sysret: Not enabled in EFER -> #UD\n"));
2958	return iemRaiseUndefinedOpcode(pIemCpu);
2959	}
2960	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2961	{
2962	Log(("sysret: Only available in long mode on intel -> #UD\n"));
2963	return iemRaiseUndefinedOpcode(pIemCpu);
2964	}
2965	if (!(pCtx->cr0 & X86_CR0_PE))
2966	{
2967	Log(("sysret: Protected mode is required -> #GP(0)\n"));
2968	return iemRaiseGeneralProtectionFault0(pIemCpu);
2969	}
2970	if (pIemCpu->uCpl != 0)
2971	{
2972	Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
2973	return iemRaiseGeneralProtectionFault0(pIemCpu);
2974	}
2975
2976	/** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
2977	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2978	uint16_t uNewSs = uNewCs + 8;
2979	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
2980	uNewCs += 16;
2981	if (uNewCs == 0 \|\| uNewSs == 0)
2982	{
2983	Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2984	return iemRaiseGeneralProtectionFault0(pIemCpu);
2985	}
2986
2987	/*
2988	* Commit it.
2989	*/
2990	if (CPUMIsGuestInLongModeEx(pCtx))
2991	{
2992	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
2993	{
2994	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
2995	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
2996	/* Note! We disregard intel manual regarding the RCX cananonical
2997	check, ask intel+xen why AMD doesn't do it. */
2998	pCtx->rip = pCtx->rcx;
2999	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3000	\| (3 << X86DESCATTR_DPL_SHIFT);
3001	}
3002	else
3003	{
3004	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3005	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3006	pCtx->rip = pCtx->ecx;
3007	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3008	\| (3 << X86DESCATTR_DPL_SHIFT);
3009	}
3010	/** @todo testcase: See what kind of flags we can make SYSRET restore and
3011	* what it really ignores. RF and VM are hinted at being zero, by AMD. */
3012	pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS \| X86_EFL_VIF \| X86_EFL_VIP);
3013	pCtx->rflags.u \|= X86_EFL_1;
3014	}
3015	else
3016	{
3017	Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3018	pCtx->rip = pCtx->rcx;
3019	pCtx->rflags.u \|= X86_EFL_IF;
3020	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3021	\| (3 << X86DESCATTR_DPL_SHIFT);
3022	}
3023	pCtx->cs.Sel = uNewCs \| 3;
3024	pCtx->cs.ValidSel = uNewCs \| 3;
3025	pCtx->cs.u64Base = 0;
3026	pCtx->cs.u32Limit = UINT32_MAX;
3027	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3028
3029	pCtx->ss.Sel = uNewSs \| 3;
3030	pCtx->ss.ValidSel = uNewSs \| 3;
3031	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3032	/* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3033	pCtx->ss.Attr.u \|= (3 << X86DESCATTR_DPL_SHIFT);
3034	/** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3035	* on sysret. */
3036
3037	return VINF_SUCCESS;
3038	}
3039
3040
3041	/**
3042	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3043	*
3044	* @param iSegReg The segment register number (valid).
3045	* @param uSel The new selector value.
3046	*/
3047	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3048	{
3049	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3050	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3051	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3052
3053	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3054
3055	/*
3056	* Real mode and V8086 mode are easy.
3057	*/
3058	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3059	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3060	{
3061	*pSel = uSel;
3062	pHid->u64Base = (uint32_t)uSel << 4;
3063	pHid->ValidSel = uSel;
3064	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3065	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3066	/** @todo Does the CPU actually load limits and attributes in the
3067	* real/V8086 mode segment load case? It doesn't for CS in far
3068	* jumps... Affects unreal mode. */
3069	pHid->u32Limit = 0xffff;
3070	pHid->Attr.u = 0;
3071	pHid->Attr.n.u1Present = 1;
3072	pHid->Attr.n.u1DescType = 1;
3073	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3074	? X86_SEL_TYPE_RW
3075	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
3076	#endif
3077	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3078	iemRegAddToRip(pIemCpu, cbInstr);
3079	return VINF_SUCCESS;
3080	}
3081
3082	/*
3083	* Protected mode.
3084	*
3085	* Check if it's a null segment selector value first, that's OK for DS, ES,
3086	* FS and GS. If not null, then we have to load and parse the descriptor.
3087	*/
3088	if (!(uSel & X86_SEL_MASK_OFF_RPL))
3089	{
3090	Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3091	if (iSegReg == X86_SREG_SS)
3092	{
3093	/* In 64-bit kernel mode, the stack can be 0 because of the way
3094	interrupts are dispatched. AMD seems to have a slighly more
3095	relaxed relationship to SS.RPL than intel does. */
3096	/** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3097	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3098	\|\| pIemCpu->uCpl > 2
3099	\|\| ( uSel != pIemCpu->uCpl
3100	&& !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3101	{
3102	Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3103	return iemRaiseGeneralProtectionFault0(pIemCpu);
3104	}
3105	}
3106
3107	pSel = uSel; / Not RPL, remember :-) */
3108	iemHlpLoadNullDataSelectorProt(pHid, uSel);
3109	if (iSegReg == X86_SREG_SS)
3110	pHid->Attr.u \|= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3111
3112	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3113	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3114
3115	iemRegAddToRip(pIemCpu, cbInstr);
3116	return VINF_SUCCESS;
3117	}
3118
3119	/* Fetch the descriptor. */
3120	IEMSELDESC Desc;
3121	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3122	if (rcStrict != VINF_SUCCESS)
3123	return rcStrict;
3124
3125	/* Check GPs first. */
3126	if (!Desc.Legacy.Gen.u1DescType)
3127	{
3128	Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3129	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3130	}
3131	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3132	{
3133	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3134	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3135	{
3136	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3137	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3138	}
3139	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3140	{
3141	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3142	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3143	}
3144	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3145	{
3146	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3147	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3148	}
3149	}
3150	else
3151	{
3152	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3153	{
3154	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
3155	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3156	}
3157	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3158	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3159	{
3160	#if 0 /* this is what intel says. */
3161	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
3162	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3163	{
3164	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
3165	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3166	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3167	}
3168	#else /* this is what makes more sense. */
3169	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3170	{
3171	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
3172	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
3173	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3174	}
3175	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3176	{
3177	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
3178	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3179	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3180	}
3181	#endif
3182	}
3183	}
3184
3185	/* Is it there? */
3186	if (!Desc.Legacy.Gen.u1Present)
3187	{
3188	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
3189	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
3190	}
3191
3192	/* The base and limit. */
3193	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
3194	uint64_t u64Base;
3195	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
3196	&& iSegReg < X86_SREG_FS)
3197	u64Base = 0;
3198	else
3199	u64Base = X86DESC_BASE(&Desc.Legacy);
3200
3201	/*
3202	* Ok, everything checked out fine. Now set the accessed bit before
3203	* committing the result into the registers.
3204	*/
3205	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3206	{
3207	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
3208	if (rcStrict != VINF_SUCCESS)
3209	return rcStrict;
3210	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3211	}
3212
3213	/* commit */
3214	*pSel = uSel;
3215	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3216	pHid->u32Limit = cbLimit;
3217	pHid->u64Base = u64Base;
3218	pHid->ValidSel = uSel;
3219	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3220
3221	/** @todo check if the hidden bits are loaded correctly for 64-bit
3222	* mode. */
3223	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3224
3225	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3226	iemRegAddToRip(pIemCpu, cbInstr);
3227	return VINF_SUCCESS;
3228	}
3229
3230
3231	/**
3232	* Implements 'mov SReg, r/m'.
3233	*
3234	* @param iSegReg The segment register number (valid).
3235	* @param uSel The new selector value.
3236	*/
3237	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
3238	{
3239	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3240	if (rcStrict == VINF_SUCCESS)
3241	{
3242	if (iSegReg == X86_SREG_SS)
3243	{
3244	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3245	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3246	}
3247	}
3248	return rcStrict;
3249	}
3250
3251
3252	/**
3253	* Implements 'pop SReg'.
3254	*
3255	* @param iSegReg The segment register number (valid).
3256	* @param enmEffOpSize The efficient operand size (valid).
3257	*/
3258	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
3259	{
3260	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3261	VBOXSTRICTRC rcStrict;
3262
3263	/*
3264	* Read the selector off the stack and join paths with mov ss, reg.
3265	*/
3266	RTUINT64U TmpRsp;
3267	TmpRsp.u = pCtx->rsp;
3268	switch (enmEffOpSize)
3269	{
3270	case IEMMODE_16BIT:
3271	{
3272	uint16_t uSel;
3273	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
3274	if (rcStrict == VINF_SUCCESS)
3275	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3276	break;
3277	}
3278
3279	case IEMMODE_32BIT:
3280	{
3281	uint32_t u32Value;
3282	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
3283	if (rcStrict == VINF_SUCCESS)
3284	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
3285	break;
3286	}
3287
3288	case IEMMODE_64BIT:
3289	{
3290	uint64_t u64Value;
3291	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
3292	if (rcStrict == VINF_SUCCESS)
3293	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
3294	break;
3295	}
3296	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3297	}
3298
3299	/*
3300	* Commit the stack on success.
3301	*/
3302	if (rcStrict == VINF_SUCCESS)
3303	{
3304	pCtx->rsp = TmpRsp.u;
3305	if (iSegReg == X86_SREG_SS)
3306	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3307	}
3308	return rcStrict;
3309	}
3310
3311
3312	/**
3313	* Implements lgs, lfs, les, lds & lss.
3314	*/
3315	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
3316	uint16_t, uSel,
3317	uint64_t, offSeg,
3318	uint8_t, iSegReg,
3319	uint8_t, iGReg,
3320	IEMMODE, enmEffOpSize)
3321	{
3322	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3323	VBOXSTRICTRC rcStrict;
3324
3325	/*
3326	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
3327	*/
3328	/** @todo verify and test that mov, pop and lXs works the segment
3329	* register loading in the exact same way. */
3330	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3331	if (rcStrict == VINF_SUCCESS)
3332	{
3333	switch (enmEffOpSize)
3334	{
3335	case IEMMODE_16BIT:
3336	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3337	break;
3338	case IEMMODE_32BIT:
3339	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3340	break;
3341	case IEMMODE_64BIT:
3342	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3343	break;
3344	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3345	}
3346	}
3347
3348	return rcStrict;
3349	}
3350
3351
3352	/**
3353	* Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
3354	*
3355	* @retval VINF_SUCCESS on success.
3356	* @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
3357	* @retval iemMemFetchSysU64 return value.
3358	*
3359	* @param pIemCpu The IEM state of the calling EMT.
3360	* @param uSel The selector value.
3361	* @param fAllowSysDesc Whether system descriptors are OK or not.
3362	* @param pDesc Where to return the descriptor on success.
3363	*/
3364	static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
3365	{
3366	pDesc->Long.au64[0] = 0;
3367	pDesc->Long.au64[1] = 0;
3368
3369	if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
3370	return VINF_IEM_SELECTOR_NOT_OK;
3371
3372	/* Within the table limits? */
3373	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3374	RTGCPTR GCPtrBase;
3375	if (uSel & X86_SEL_LDT)
3376	{
3377	if ( !pCtx->ldtr.Attr.n.u1Present
3378	\|\| (uSel \| X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
3379	return VINF_IEM_SELECTOR_NOT_OK;
3380	GCPtrBase = pCtx->ldtr.u64Base;
3381	}
3382	else
3383	{
3384	if ((uSel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
3385	return VINF_IEM_SELECTOR_NOT_OK;
3386	GCPtrBase = pCtx->gdtr.pGdt;
3387	}
3388
3389	/* Fetch the descriptor. */
3390	VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
3391	if (rcStrict != VINF_SUCCESS)
3392	return rcStrict;
3393	if (!pDesc->Legacy.Gen.u1DescType)
3394	{
3395	if (!fAllowSysDesc)
3396	return VINF_IEM_SELECTOR_NOT_OK;
3397	if (CPUMIsGuestInLongModeEx(pCtx))
3398	{
3399	rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
3400	if (rcStrict != VINF_SUCCESS)
3401	return rcStrict;
3402	}
3403
3404	}
3405
3406	return VINF_SUCCESS;
3407	}
3408
3409
3410	/**
3411	* Implements verr (fWrite = false) and verw (fWrite = true).
3412	*/
3413	IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
3414	{
3415	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3416
3417	/** @todo figure whether the accessed bit is set or not. */
3418
3419	bool fAccessible = true;
3420	IEMSELDESC Desc;
3421	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3422	if (rcStrict == VINF_SUCCESS)
3423	{
3424	/* Check the descriptor, order doesn't matter much here. */
3425	if ( !Desc.Legacy.Gen.u1DescType
3426	\|\| !Desc.Legacy.Gen.u1Present)
3427	fAccessible = false;
3428	else
3429	{
3430	if ( fWrite
3431	? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
3432	: (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3433	fAccessible = false;
3434
3435	/** @todo testcase for the conforming behavior. */
3436	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3437	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3438	{
3439	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3440	fAccessible = false;
3441	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3442	fAccessible = false;
3443	}
3444	}
3445
3446	}
3447	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3448	fAccessible = false;
3449	else
3450	return rcStrict;
3451
3452	/* commit */
3453	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
3454
3455	iemRegAddToRip(pIemCpu, cbInstr);
3456	return VINF_SUCCESS;
3457	}
3458
3459
3460	/**
3461	* Implements LAR and LSL with 64-bit operand size.
3462	*
3463	* @returns VINF_SUCCESS.
3464	* @param pu16Dst Pointer to the destination register.
3465	* @param uSel The selector to load details for.
3466	* @param pEFlags Pointer to the eflags register.
3467	* @param fIsLar true = LAR, false = LSL.
3468	*/
3469	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t , pu64Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3470	{
3471	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3472
3473	/** @todo figure whether the accessed bit is set or not. */
3474
3475	bool fDescOk = true;
3476	IEMSELDESC Desc;
3477	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3478	if (rcStrict == VINF_SUCCESS)
3479	{
3480	/*
3481	* Check the descriptor type.
3482	*/
3483	if (!Desc.Legacy.Gen.u1DescType)
3484	{
3485	if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
3486	{
3487	if (Desc.Long.Gen.u5Zeros)
3488	fDescOk = false;
3489	else
3490	switch (Desc.Long.Gen.u4Type)
3491	{
3492	/** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
3493	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
3494	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
3495	case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
3496	break;
3497	case AMD64_SEL_TYPE_SYS_CALL_GATE:
3498	fDescOk = fIsLar;
3499	break;
3500	default:
3501	fDescOk = false;
3502	break;
3503	}
3504	}
3505	else
3506	{
3507	switch (Desc.Long.Gen.u4Type)
3508	{
3509	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
3510	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
3511	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
3512	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
3513	case X86_SEL_TYPE_SYS_LDT:
3514	break;
3515	case X86_SEL_TYPE_SYS_286_CALL_GATE:
3516	case X86_SEL_TYPE_SYS_TASK_GATE:
3517	case X86_SEL_TYPE_SYS_386_CALL_GATE:
3518	fDescOk = fIsLar;
3519	break;
3520	default:
3521	fDescOk = false;
3522	break;
3523	}
3524	}
3525	}
3526	if (fDescOk)
3527	{
3528	/*
3529	* Check the RPL/DPL/CPL interaction..
3530	*/
3531	/** @todo testcase for the conforming behavior. */
3532	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)
3533	\|\| !Desc.Legacy.Gen.u1DescType)
3534	{
3535	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3536	fDescOk = false;
3537	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3538	fDescOk = false;
3539	}
3540	}
3541
3542	if (fDescOk)
3543	{
3544	/*
3545	* All fine, start committing the result.
3546	*/
3547	if (fIsLar)
3548	*pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
3549	else
3550	*pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
3551	}
3552
3553	}
3554	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3555	fDescOk = false;
3556	else
3557	return rcStrict;
3558
3559	/* commit flags value and advance rip. */
3560	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
3561	iemRegAddToRip(pIemCpu, cbInstr);
3562
3563	return VINF_SUCCESS;
3564	}
3565
3566
3567	/**
3568	* Implements LAR and LSL with 16-bit operand size.
3569	*
3570	* @returns VINF_SUCCESS.
3571	* @param pu16Dst Pointer to the destination register.
3572	* @param u16Sel The selector to load details for.
3573	* @param pEFlags Pointer to the eflags register.
3574	* @param fIsLar true = LAR, false = LSL.
3575	*/
3576	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t , pu16Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3577	{
3578	uint64_t u64TmpDst = *pu16Dst;
3579	IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
3580	*pu16Dst = (uint16_t)u64TmpDst;
3581	return VINF_SUCCESS;
3582	}
3583
3584
3585	/**
3586	* Implements lgdt.
3587	*
3588	* @param iEffSeg The segment of the new gdtr contents
3589	* @param GCPtrEffSrc The address of the new gdtr contents.
3590	* @param enmEffOpSize The effective operand size.
3591	*/
3592	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3593	{
3594	if (pIemCpu->uCpl != 0)
3595	return iemRaiseGeneralProtectionFault0(pIemCpu);
3596	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3597
3598	/*
3599	* Fetch the limit and base address.
3600	*/
3601	uint16_t cbLimit;
3602	RTGCPTR GCPtrBase;
3603	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3604	if (rcStrict == VINF_SUCCESS)
3605	{
3606	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3607	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3608	else
3609	{
3610	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3611	pCtx->gdtr.cbGdt = cbLimit;
3612	pCtx->gdtr.pGdt = GCPtrBase;
3613	}
3614	if (rcStrict == VINF_SUCCESS)
3615	iemRegAddToRip(pIemCpu, cbInstr);
3616	}
3617	return rcStrict;
3618	}
3619
3620
3621	/**
3622	* Implements sgdt.
3623	*
3624	* @param iEffSeg The segment where to store the gdtr content.
3625	* @param GCPtrEffDst The address where to store the gdtr content.
3626	* @param enmEffOpSize The effective operand size.
3627	*/
3628	IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3629	{
3630	/*
3631	* Join paths with sidt.
3632	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3633	* you really must know.
3634	*/
3635	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3636	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3637	if (rcStrict == VINF_SUCCESS)
3638	iemRegAddToRip(pIemCpu, cbInstr);
3639	return rcStrict;
3640	}
3641
3642
3643	/**
3644	* Implements lidt.
3645	*
3646	* @param iEffSeg The segment of the new idtr contents
3647	* @param GCPtrEffSrc The address of the new idtr contents.
3648	* @param enmEffOpSize The effective operand size.
3649	*/
3650	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3651	{
3652	if (pIemCpu->uCpl != 0)
3653	return iemRaiseGeneralProtectionFault0(pIemCpu);
3654	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3655
3656	/*
3657	* Fetch the limit and base address.
3658	*/
3659	uint16_t cbLimit;
3660	RTGCPTR GCPtrBase;
3661	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3662	if (rcStrict == VINF_SUCCESS)
3663	{
3664	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3665	CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3666	else
3667	{
3668	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3669	pCtx->idtr.cbIdt = cbLimit;
3670	pCtx->idtr.pIdt = GCPtrBase;
3671	}
3672	iemRegAddToRip(pIemCpu, cbInstr);
3673	}
3674	return rcStrict;
3675	}
3676
3677
3678	/**
3679	* Implements sidt.
3680	*
3681	* @param iEffSeg The segment where to store the idtr content.
3682	* @param GCPtrEffDst The address where to store the idtr content.
3683	* @param enmEffOpSize The effective operand size.
3684	*/
3685	IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3686	{
3687	/*
3688	* Join paths with sgdt.
3689	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3690	* you really must know.
3691	*/
3692	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3693	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3694	if (rcStrict == VINF_SUCCESS)
3695	iemRegAddToRip(pIemCpu, cbInstr);
3696	return rcStrict;
3697	}
3698
3699
3700	/**
3701	* Implements lldt.
3702	*
3703	* @param uNewLdt The new LDT selector value.
3704	*/
3705	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
3706	{
3707	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3708
3709	/*
3710	* Check preconditions.
3711	*/
3712	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3713	{
3714	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
3715	return iemRaiseUndefinedOpcode(pIemCpu);
3716	}
3717	if (pIemCpu->uCpl != 0)
3718	{
3719	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
3720	return iemRaiseGeneralProtectionFault0(pIemCpu);
3721	}
3722	if (uNewLdt & X86_SEL_LDT)
3723	{
3724	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
3725	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
3726	}
3727
3728	/*
3729	* Now, loading a NULL selector is easy.
3730	*/
3731	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
3732	{
3733	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
3734	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3735	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
3736	else
3737	pCtx->ldtr.Sel = uNewLdt;
3738	pCtx->ldtr.ValidSel = uNewLdt;
3739	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3740	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3741	if (!IEM_IS_GUEST_CPU_AMD(pIemCpu) \|\| !IEM_VERIFICATION_ENABLED(pIemCpu)) /* See bs-cpu-hidden-regs-1 on AMD. */
3742	{
3743	pCtx->ldtr.u64Base = 0;
3744	pCtx->ldtr.u32Limit = 0;
3745	}
3746
3747	iemRegAddToRip(pIemCpu, cbInstr);
3748	return VINF_SUCCESS;
3749	}
3750
3751	/*
3752	* Read the descriptor.
3753	*/
3754	IEMSELDESC Desc;
3755	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
3756	if (rcStrict != VINF_SUCCESS)
3757	return rcStrict;
3758
3759	/* Check GPs first. */
3760	if (Desc.Legacy.Gen.u1DescType)
3761	{
3762	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3763	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3764	}
3765	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
3766	{
3767	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3768	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3769	}
3770	uint64_t u64Base;
3771	if (!IEM_IS_LONG_MODE(pIemCpu))
3772	u64Base = X86DESC_BASE(&Desc.Legacy);
3773	else
3774	{
3775	if (Desc.Long.Gen.u5Zeros)
3776	{
3777	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
3778	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3779	}
3780
3781	u64Base = X86DESC64_BASE(&Desc.Long);
3782	if (!IEM_IS_CANONICAL(u64Base))
3783	{
3784	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
3785	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3786	}
3787	}
3788
3789	/* NP */
3790	if (!Desc.Legacy.Gen.u1Present)
3791	{
3792	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
3793	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
3794	}
3795
3796	/*
3797	* It checks out alright, update the registers.
3798	*/
3799	/** @todo check if the actual value is loaded or if the RPL is dropped */
3800	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3801	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
3802	else
3803	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3804	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3805	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3806	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3807	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3808	pCtx->ldtr.u64Base = u64Base;
3809
3810	iemRegAddToRip(pIemCpu, cbInstr);
3811	return VINF_SUCCESS;
3812	}
3813
3814
3815	/**
3816	* Implements lldt.
3817	*
3818	* @param uNewLdt The new LDT selector value.
3819	*/
3820	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3821	{
3822	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3823
3824	/*
3825	* Check preconditions.
3826	*/
3827	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3828	{
3829	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3830	return iemRaiseUndefinedOpcode(pIemCpu);
3831	}
3832	if (pIemCpu->uCpl != 0)
3833	{
3834	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3835	return iemRaiseGeneralProtectionFault0(pIemCpu);
3836	}
3837	if (uNewTr & X86_SEL_LDT)
3838	{
3839	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3840	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3841	}
3842	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3843	{
3844	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3845	return iemRaiseGeneralProtectionFault0(pIemCpu);
3846	}
3847
3848	/*
3849	* Read the descriptor.
3850	*/
3851	IEMSELDESC Desc;
3852	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
3853	if (rcStrict != VINF_SUCCESS)
3854	return rcStrict;
3855
3856	/* Check GPs first. */
3857	if (Desc.Legacy.Gen.u1DescType)
3858	{
3859	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3860	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3861	}
3862	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3863	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3864	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
3865	{
3866	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3867	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3868	}
3869	uint64_t u64Base;
3870	if (!IEM_IS_LONG_MODE(pIemCpu))
3871	u64Base = X86DESC_BASE(&Desc.Legacy);
3872	else
3873	{
3874	if (Desc.Long.Gen.u5Zeros)
3875	{
3876	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3877	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3878	}
3879
3880	u64Base = X86DESC64_BASE(&Desc.Long);
3881	if (!IEM_IS_CANONICAL(u64Base))
3882	{
3883	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3884	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3885	}
3886	}
3887
3888	/* NP */
3889	if (!Desc.Legacy.Gen.u1Present)
3890	{
3891	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3892	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3893	}
3894
3895	/*
3896	* Set it busy.
3897	* Note! Intel says this should lock down the whole descriptor, but we'll
3898	* restrict our selves to 32-bit for now due to lack of inline
3899	* assembly and such.
3900	*/
3901	void *pvDesc;
3902	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
3903	if (rcStrict != VINF_SUCCESS)
3904	return rcStrict;
3905	switch ((uintptr_t)pvDesc & 3)
3906	{
3907	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3908	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3909	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
3910	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
3911	}
3912	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
3913	if (rcStrict != VINF_SUCCESS)
3914	return rcStrict;
3915	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3916
3917	/*
3918	* It checks out alright, update the registers.
3919	*/
3920	/** @todo check if the actual value is loaded or if the RPL is dropped */
3921	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3922	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
3923	else
3924	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
3925	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
3926	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
3927	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3928	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3929	pCtx->tr.u64Base = u64Base;
3930
3931	iemRegAddToRip(pIemCpu, cbInstr);
3932	return VINF_SUCCESS;
3933	}
3934
3935
3936	/**
3937	* Implements mov GReg,CRx.
3938	*
3939	* @param iGReg The general register to store the CRx value in.
3940	* @param iCrReg The CRx register to read (valid).
3941	*/
3942	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
3943	{
3944	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3945	if (pIemCpu->uCpl != 0)
3946	return iemRaiseGeneralProtectionFault0(pIemCpu);
3947	Assert(!pCtx->eflags.Bits.u1VM);
3948
3949	/* read it */
3950	uint64_t crX;
3951	switch (iCrReg)
3952	{
3953	case 0: crX = pCtx->cr0; break;
3954	case 2: crX = pCtx->cr2; break;
3955	case 3: crX = pCtx->cr3; break;
3956	case 4: crX = pCtx->cr4; break;
3957	case 8:
3958	{
3959	uint8_t uTpr;
3960	int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
3961	if (RT_SUCCESS(rc))
3962	crX = uTpr >> 4;
3963	else
3964	crX = 0;
3965	break;
3966	}
3967	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3968	}
3969
3970	/* store it */
3971	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3972	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
3973	else
3974	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
3975
3976	iemRegAddToRip(pIemCpu, cbInstr);
3977	return VINF_SUCCESS;
3978	}
3979
3980
3981	/**
3982	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
3983	*
3984	* @param iCrReg The CRx register to write (valid).
3985	* @param uNewCrX The new value.
3986	*/
3987	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
3988	{
3989	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3990	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3991	VBOXSTRICTRC rcStrict;
3992	int rc;
3993
3994	/*
3995	* Try store it.
3996	* Unfortunately, CPUM only does a tiny bit of the work.
3997	*/
3998	switch (iCrReg)
3999	{
4000	case 0:
4001	{
4002	/*
4003	* Perform checks.
4004	*/
4005	uint64_t const uOldCrX = pCtx->cr0;
4006	uNewCrX \|= X86_CR0_ET; /* hardcoded */
4007
4008	/* Check for reserved bits. */
4009	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
4010	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
4011	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
4012	if (uNewCrX & ~(uint64_t)fValid)
4013	{
4014	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4015	return iemRaiseGeneralProtectionFault0(pIemCpu);
4016	}
4017
4018	/* Check for invalid combinations. */
4019	if ( (uNewCrX & X86_CR0_PG)
4020	&& !(uNewCrX & X86_CR0_PE) )
4021	{
4022	Log(("Trying to set CR0.PG without CR0.PE\n"));
4023	return iemRaiseGeneralProtectionFault0(pIemCpu);
4024	}
4025
4026	if ( !(uNewCrX & X86_CR0_CD)
4027	&& (uNewCrX & X86_CR0_NW) )
4028	{
4029	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4030	return iemRaiseGeneralProtectionFault0(pIemCpu);
4031	}
4032
4033	/* Long mode consistency checks. */
4034	if ( (uNewCrX & X86_CR0_PG)
4035	&& !(uOldCrX & X86_CR0_PG)
4036	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4037	{
4038	if (!(pCtx->cr4 & X86_CR4_PAE))
4039	{
4040	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4041	return iemRaiseGeneralProtectionFault0(pIemCpu);
4042	}
4043	if (pCtx->cs.Attr.n.u1Long)
4044	{
4045	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4046	return iemRaiseGeneralProtectionFault0(pIemCpu);
4047	}
4048	}
4049
4050	/** @todo check reserved PDPTR bits as AMD states. */
4051
4052	/*
4053	* Change CR0.
4054	*/
4055	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4056	CPUMSetGuestCR0(pVCpu, uNewCrX);
4057	else
4058	pCtx->cr0 = uNewCrX;
4059	Assert(pCtx->cr0 == uNewCrX);
4060
4061	/*
4062	* Change EFER.LMA if entering or leaving long mode.
4063	*/
4064	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4065	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4066	{
4067	uint64_t NewEFER = pCtx->msrEFER;
4068	if (uNewCrX & X86_CR0_PG)
4069	NewEFER \|= MSR_K6_EFER_LMA;
4070	else
4071	NewEFER &= ~MSR_K6_EFER_LMA;
4072
4073	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4074	CPUMSetGuestEFER(pVCpu, NewEFER);
4075	else
4076	pCtx->msrEFER = NewEFER;
4077	Assert(pCtx->msrEFER == NewEFER);
4078	}
4079
4080	/*
4081	* Inform PGM.
4082	*/
4083	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4084	{
4085	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
4086	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
4087	{
4088	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4089	AssertRCReturn(rc, rc);
4090	/* ignore informational status codes */
4091	}
4092	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4093	}
4094	else
4095	rcStrict = VINF_SUCCESS;
4096
4097	#ifdef IN_RC
4098	/* Return to ring-3 for rescheduling if WP or AM changes. */
4099	if ( rcStrict == VINF_SUCCESS
4100	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
4101	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
4102	rcStrict = VINF_EM_RESCHEDULE;
4103	#endif
4104	break;
4105	}
4106
4107	/*
4108	* CR2 can be changed without any restrictions.
4109	*/
4110	case 2:
4111	pCtx->cr2 = uNewCrX;
4112	rcStrict = VINF_SUCCESS;
4113	break;
4114
4115	/*
4116	* CR3 is relatively simple, although AMD and Intel have different
4117	* accounts of how setting reserved bits are handled. We take intel's
4118	* word for the lower bits and AMD's for the high bits (63:52).
4119	*/
4120	/** @todo Testcase: Setting reserved bits in CR3, especially before
4121	* enabling paging. */
4122	case 3:
4123	{
4124	/* check / mask the value. */
4125	if (uNewCrX & UINT64_C(0xfff0000000000000))
4126	{
4127	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
4128	return iemRaiseGeneralProtectionFault0(pIemCpu);
4129	}
4130
4131	uint64_t fValid;
4132	if ( (pCtx->cr4 & X86_CR4_PAE)
4133	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
4134	fValid = UINT64_C(0x000ffffffffff014);
4135	else if (pCtx->cr4 & X86_CR4_PAE)
4136	fValid = UINT64_C(0xfffffff4);
4137	else
4138	fValid = UINT64_C(0xfffff014);
4139	if (uNewCrX & ~fValid)
4140	{
4141	Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
4142	uNewCrX, uNewCrX & ~fValid));
4143	uNewCrX &= fValid;
4144	}
4145
4146	/** @todo If we're in PAE mode we should check the PDPTRs for
4147	* invalid bits. */
4148
4149	/* Make the change. */
4150	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4151	{
4152	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
4153	AssertRCSuccessReturn(rc, rc);
4154	}
4155	else
4156	pCtx->cr3 = uNewCrX;
4157
4158	/* Inform PGM. */
4159	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4160	{
4161	if (pCtx->cr0 & X86_CR0_PG)
4162	{
4163	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
4164	AssertRCReturn(rc, rc);
4165	/* ignore informational status codes */
4166	}
4167	}
4168	rcStrict = VINF_SUCCESS;
4169	break;
4170	}
4171
4172	/*
4173	* CR4 is a bit more tedious as there are bits which cannot be cleared
4174	* under some circumstances and such.
4175	*/
4176	case 4:
4177	{
4178	uint64_t const uOldCrX = pCtx->cr4;
4179
4180	/* reserved bits */
4181	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
4182	\| X86_CR4_TSD \| X86_CR4_DE
4183	\| X86_CR4_PSE \| X86_CR4_PAE
4184	\| X86_CR4_MCE \| X86_CR4_PGE
4185	\| X86_CR4_PCE \| X86_CR4_OSFSXR
4186	\| X86_CR4_OSXMMEEXCPT;
4187	//if (xxx)
4188	// fValid \|= X86_CR4_VMXE;
4189	//if (xxx)
4190	// fValid \|= X86_CR4_OSXSAVE;
4191	if (uNewCrX & ~(uint64_t)fValid)
4192	{
4193	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4194	return iemRaiseGeneralProtectionFault0(pIemCpu);
4195	}
4196
4197	/* long mode checks. */
4198	if ( (uOldCrX & X86_CR4_PAE)
4199	&& !(uNewCrX & X86_CR4_PAE)
4200	&& CPUMIsGuestInLongModeEx(pCtx) )
4201	{
4202	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
4203	return iemRaiseGeneralProtectionFault0(pIemCpu);
4204	}
4205
4206
4207	/*
4208	* Change it.
4209	*/
4210	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4211	{
4212	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
4213	AssertRCSuccessReturn(rc, rc);
4214	}
4215	else
4216	pCtx->cr4 = uNewCrX;
4217	Assert(pCtx->cr4 == uNewCrX);
4218
4219	/*
4220	* Notify SELM and PGM.
4221	*/
4222	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4223	{
4224	/* SELM - VME may change things wrt to the TSS shadowing. */
4225	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
4226	{
4227	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
4228	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
4229	#ifdef VBOX_WITH_RAW_MODE
4230	if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
4231	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
4232	#endif
4233	}
4234
4235	/* PGM - flushing and mode. */
4236	if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_PGE))
4237	{
4238	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4239	AssertRCReturn(rc, rc);
4240	/* ignore informational status codes */
4241	}
4242	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4243	}
4244	else
4245	rcStrict = VINF_SUCCESS;
4246	break;
4247	}
4248
4249	/*
4250	* CR8 maps to the APIC TPR.
4251	*/
4252	case 8:
4253	if (uNewCrX & ~(uint64_t)0xf)
4254	{
4255	Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
4256	return iemRaiseGeneralProtectionFault0(pIemCpu);
4257	}
4258
4259	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4260	PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
4261	rcStrict = VINF_SUCCESS;
4262	break;
4263
4264	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4265	}
4266
4267	/*
4268	* Advance the RIP on success.
4269	*/
4270	if (RT_SUCCESS(rcStrict))
4271	{
4272	if (rcStrict != VINF_SUCCESS)
4273	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4274	iemRegAddToRip(pIemCpu, cbInstr);
4275	}
4276
4277	return rcStrict;
4278	}
4279
4280
4281	/**
4282	* Implements mov CRx,GReg.
4283	*
4284	* @param iCrReg The CRx register to write (valid).
4285	* @param iGReg The general register to load the DRx value from.
4286	*/
4287	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
4288	{
4289	if (pIemCpu->uCpl != 0)
4290	return iemRaiseGeneralProtectionFault0(pIemCpu);
4291	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4292
4293	/*
4294	* Read the new value from the source register and call common worker.
4295	*/
4296	uint64_t uNewCrX;
4297	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4298	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
4299	else
4300	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
4301	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
4302	}
4303
4304
4305	/**
4306	* Implements 'LMSW r/m16'
4307	*
4308	* @param u16NewMsw The new value.
4309	*/
4310	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
4311	{
4312	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4313
4314	if (pIemCpu->uCpl != 0)
4315	return iemRaiseGeneralProtectionFault0(pIemCpu);
4316	Assert(!pCtx->eflags.Bits.u1VM);
4317
4318	/*
4319	* Compose the new CR0 value and call common worker.
4320	*/
4321	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4322	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4323	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4324	}
4325
4326
4327	/**
4328	* Implements 'CLTS'.
4329	*/
4330	IEM_CIMPL_DEF_0(iemCImpl_clts)
4331	{
4332	if (pIemCpu->uCpl != 0)
4333	return iemRaiseGeneralProtectionFault0(pIemCpu);
4334
4335	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4336	uint64_t uNewCr0 = pCtx->cr0;
4337	uNewCr0 &= ~X86_CR0_TS;
4338	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4339	}
4340
4341
4342	/**
4343	* Implements mov GReg,DRx.
4344	*
4345	* @param iGReg The general register to store the DRx value in.
4346	* @param iDrReg The DRx register to read (0-7).
4347	*/
4348	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
4349	{
4350	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4351
4352	/*
4353	* Check preconditions.
4354	*/
4355
4356	/* Raise GPs. */
4357	if (pIemCpu->uCpl != 0)
4358	return iemRaiseGeneralProtectionFault0(pIemCpu);
4359	Assert(!pCtx->eflags.Bits.u1VM);
4360
4361	if ( (iDrReg == 4 \|\| iDrReg == 5)
4362	&& (pCtx->cr4 & X86_CR4_DE) )
4363	{
4364	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
4365	return iemRaiseGeneralProtectionFault0(pIemCpu);
4366	}
4367
4368	/* Raise #DB if general access detect is enabled. */
4369	if (pCtx->dr[7] & X86_DR7_GD)
4370	{
4371	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
4372	return iemRaiseDebugException(pIemCpu);
4373	}
4374
4375	/*
4376	* Read the debug register and store it in the specified general register.
4377	*/
4378	uint64_t drX;
4379	switch (iDrReg)
4380	{
4381	case 0: drX = pCtx->dr[0]; break;
4382	case 1: drX = pCtx->dr[1]; break;
4383	case 2: drX = pCtx->dr[2]; break;
4384	case 3: drX = pCtx->dr[3]; break;
4385	case 6:
4386	case 4:
4387	drX = pCtx->dr[6];
4388	drX \|= X86_DR6_RA1_MASK;
4389	drX &= ~X86_DR6_RAZ_MASK;
4390	break;
4391	case 7:
4392	case 5:
4393	drX = pCtx->dr[7];
4394	drX \|=X86_DR7_RA1_MASK;
4395	drX &= ~X86_DR7_RAZ_MASK;
4396	break;
4397	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4398	}
4399
4400	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4401	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
4402	else
4403	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
4404
4405	iemRegAddToRip(pIemCpu, cbInstr);
4406	return VINF_SUCCESS;
4407	}
4408
4409
4410	/**
4411	* Implements mov DRx,GReg.
4412	*
4413	* @param iDrReg The DRx register to write (valid).
4414	* @param iGReg The general register to load the DRx value from.
4415	*/
4416	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
4417	{
4418	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4419
4420	/*
4421	* Check preconditions.
4422	*/
4423	if (pIemCpu->uCpl != 0)
4424	return iemRaiseGeneralProtectionFault0(pIemCpu);
4425	Assert(!pCtx->eflags.Bits.u1VM);
4426
4427	if (iDrReg == 4 \|\| iDrReg == 5)
4428	{
4429	if (pCtx->cr4 & X86_CR4_DE)
4430	{
4431	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
4432	return iemRaiseGeneralProtectionFault0(pIemCpu);
4433	}
4434	iDrReg += 2;
4435	}
4436
4437	/* Raise #DB if general access detect is enabled. */
4438	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
4439	* \#GP? */
4440	if (pCtx->dr[7] & X86_DR7_GD)
4441	{
4442	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
4443	return iemRaiseDebugException(pIemCpu);
4444	}
4445
4446	/*
4447	* Read the new value from the source register.
4448	*/
4449	uint64_t uNewDrX;
4450	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4451	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
4452	else
4453	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
4454
4455	/*
4456	* Adjust it.
4457	*/
4458	switch (iDrReg)
4459	{
4460	case 0:
4461	case 1:
4462	case 2:
4463	case 3:
4464	/* nothing to adjust */
4465	break;
4466
4467	case 6:
4468	if (uNewDrX & X86_DR6_MBZ_MASK)
4469	{
4470	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4471	return iemRaiseGeneralProtectionFault0(pIemCpu);
4472	}
4473	uNewDrX \|= X86_DR6_RA1_MASK;
4474	uNewDrX &= ~X86_DR6_RAZ_MASK;
4475	break;
4476
4477	case 7:
4478	if (uNewDrX & X86_DR7_MBZ_MASK)
4479	{
4480	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4481	return iemRaiseGeneralProtectionFault0(pIemCpu);
4482	}
4483	uNewDrX \|= X86_DR7_RA1_MASK;
4484	uNewDrX &= ~X86_DR7_RAZ_MASK;
4485	break;
4486
4487	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4488	}
4489
4490	/*
4491	* Do the actual setting.
4492	*/
4493	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4494	{
4495	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
4496	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
4497	}
4498	else
4499	pCtx->dr[iDrReg] = uNewDrX;
4500
4501	iemRegAddToRip(pIemCpu, cbInstr);
4502	return VINF_SUCCESS;
4503	}
4504
4505
4506	/**
4507	* Implements 'INVLPG m'.
4508	*
4509	* @param GCPtrPage The effective address of the page to invalidate.
4510	* @remarks Updates the RIP.
4511	*/
4512	IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
4513	{
4514	/* ring-0 only. */
4515	if (pIemCpu->uCpl != 0)
4516	return iemRaiseGeneralProtectionFault0(pIemCpu);
4517	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4518
4519	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
4520	iemRegAddToRip(pIemCpu, cbInstr);
4521
4522	if (rc == VINF_SUCCESS)
4523	return VINF_SUCCESS;
4524	if (rc == VINF_PGM_SYNC_CR3)
4525	return iemSetPassUpStatus(pIemCpu, rc);
4526
4527	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
4528	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
4529	return rc;
4530	}
4531
4532
4533	/**
4534	* Implements RDTSC.
4535	*/
4536	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
4537	{
4538	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4539
4540	/*
4541	* Check preconditions.
4542	*/
4543	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
4544	return iemRaiseUndefinedOpcode(pIemCpu);
4545
4546	if ( (pCtx->cr4 & X86_CR4_TSD)
4547	&& pIemCpu->uCpl != 0)
4548	{
4549	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
4550	return iemRaiseGeneralProtectionFault0(pIemCpu);
4551	}
4552
4553	/*
4554	* Do the job.
4555	*/
4556	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
4557	pCtx->rax = (uint32_t)uTicks;
4558	pCtx->rdx = uTicks >> 32;
4559	#ifdef IEM_VERIFICATION_MODE_FULL
4560	pIemCpu->fIgnoreRaxRdx = true;
4561	#endif
4562
4563	iemRegAddToRip(pIemCpu, cbInstr);
4564	return VINF_SUCCESS;
4565	}
4566
4567
4568	/**
4569	* Implements RDMSR.
4570	*/
4571	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
4572	{
4573	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4574
4575	/*
4576	* Check preconditions.
4577	*/
4578	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4579	return iemRaiseUndefinedOpcode(pIemCpu);
4580	if (pIemCpu->uCpl != 0)
4581	return iemRaiseGeneralProtectionFault0(pIemCpu);
4582
4583	/*
4584	* Do the job.
4585	*/
4586	RTUINT64U uValue;
4587	int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
4588	if (rc != VINF_SUCCESS)
4589	{
4590	Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
4591	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4592	return iemRaiseGeneralProtectionFault0(pIemCpu);
4593	}
4594
4595	pCtx->rax = uValue.s.Lo;
4596	pCtx->rdx = uValue.s.Hi;
4597
4598	iemRegAddToRip(pIemCpu, cbInstr);
4599	return VINF_SUCCESS;
4600	}
4601
4602
4603	/**
4604	* Implements WRMSR.
4605	*/
4606	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
4607	{
4608	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4609
4610	/*
4611	* Check preconditions.
4612	*/
4613	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4614	return iemRaiseUndefinedOpcode(pIemCpu);
4615	if (pIemCpu->uCpl != 0)
4616	return iemRaiseGeneralProtectionFault0(pIemCpu);
4617
4618	/*
4619	* Do the job.
4620	*/
4621	RTUINT64U uValue;
4622	uValue.s.Lo = pCtx->eax;
4623	uValue.s.Hi = pCtx->edx;
4624
4625	int rc;
4626	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4627	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4628	else
4629	{
4630	CPUMCTX CtxTmp = *pCtx;
4631	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4632	PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
4633	pCtx = pCtx2;
4634	*pCtx2 = CtxTmp;
4635	}
4636	if (rc != VINF_SUCCESS)
4637	{
4638	Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
4639	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4640	return iemRaiseGeneralProtectionFault0(pIemCpu);
4641	}
4642
4643	iemRegAddToRip(pIemCpu, cbInstr);
4644	return VINF_SUCCESS;
4645	}
4646
4647
4648	/**
4649	* Implements 'IN eAX, port'.
4650	*
4651	* @param u16Port The source port.
4652	* @param cbReg The register size.
4653	*/
4654	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
4655	{
4656	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4657
4658	/*
4659	* CPL check
4660	*/
4661	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4662	if (rcStrict != VINF_SUCCESS)
4663	return rcStrict;
4664
4665	/*
4666	* Perform the I/O.
4667	*/
4668	uint32_t u32Value;
4669	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4670	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
4671	else
4672	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
4673	if (IOM_SUCCESS(rcStrict))
4674	{
4675	switch (cbReg)
4676	{
4677	case 1: pCtx->al = (uint8_t)u32Value; break;
4678	case 2: pCtx->ax = (uint16_t)u32Value; break;
4679	case 4: pCtx->rax = u32Value; break;
4680	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4681	}
4682	iemRegAddToRip(pIemCpu, cbInstr);
4683	pIemCpu->cPotentialExits++;
4684	if (rcStrict != VINF_SUCCESS)
4685	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4686	}
4687
4688	return rcStrict;
4689	}
4690
4691
4692	/**
4693	* Implements 'IN eAX, DX'.
4694	*
4695	* @param cbReg The register size.
4696	*/
4697	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
4698	{
4699	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4700	}
4701
4702
4703	/**
4704	* Implements 'OUT port, eAX'.
4705	*
4706	* @param u16Port The destination port.
4707	* @param cbReg The register size.
4708	*/
4709	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
4710	{
4711	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4712
4713	/*
4714	* CPL check
4715	*/
4716	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4717	if (rcStrict != VINF_SUCCESS)
4718	return rcStrict;
4719
4720	/*
4721	* Perform the I/O.
4722	*/
4723	uint32_t u32Value;
4724	switch (cbReg)
4725	{
4726	case 1: u32Value = pCtx->al; break;
4727	case 2: u32Value = pCtx->ax; break;
4728	case 4: u32Value = pCtx->eax; break;
4729	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4730	}
4731	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4732	rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
4733	else
4734	rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
4735	if (IOM_SUCCESS(rcStrict))
4736	{
4737	iemRegAddToRip(pIemCpu, cbInstr);
4738	pIemCpu->cPotentialExits++;
4739	if (rcStrict != VINF_SUCCESS)
4740	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4741	}
4742	return rcStrict;
4743	}
4744
4745
4746	/**
4747	* Implements 'OUT DX, eAX'.
4748	*
4749	* @param cbReg The register size.
4750	*/
4751	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
4752	{
4753	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4754	}
4755
4756
4757	/**
4758	* Implements 'CLI'.
4759	*/
4760	IEM_CIMPL_DEF_0(iemCImpl_cli)
4761	{
4762	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4763	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4764	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4765	uint32_t const fEflOld = fEfl;
4766	if (pCtx->cr0 & X86_CR0_PE)
4767	{
4768	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4769	if (!(fEfl & X86_EFL_VM))
4770	{
4771	if (pIemCpu->uCpl <= uIopl)
4772	fEfl &= ~X86_EFL_IF;
4773	else if ( pIemCpu->uCpl == 3
4774	&& (pCtx->cr4 & X86_CR4_PVI) )
4775	fEfl &= ~X86_EFL_VIF;
4776	else
4777	return iemRaiseGeneralProtectionFault0(pIemCpu);
4778	}
4779	/* V8086 */
4780	else if (uIopl == 3)
4781	fEfl &= ~X86_EFL_IF;
4782	else if ( uIopl < 3
4783	&& (pCtx->cr4 & X86_CR4_VME) )
4784	fEfl &= ~X86_EFL_VIF;
4785	else
4786	return iemRaiseGeneralProtectionFault0(pIemCpu);
4787	}
4788	/* real mode */
4789	else
4790	fEfl &= ~X86_EFL_IF;
4791
4792	/* Commit. */
4793	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4794	iemRegAddToRip(pIemCpu, cbInstr);
4795	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
4796	return VINF_SUCCESS;
4797	}
4798
4799
4800	/**
4801	* Implements 'STI'.
4802	*/
4803	IEM_CIMPL_DEF_0(iemCImpl_sti)
4804	{
4805	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4806	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4807	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4808	uint32_t const fEflOld = fEfl;
4809
4810	if (pCtx->cr0 & X86_CR0_PE)
4811	{
4812	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4813	if (!(fEfl & X86_EFL_VM))
4814	{
4815	if (pIemCpu->uCpl <= uIopl)
4816	fEfl \|= X86_EFL_IF;
4817	else if ( pIemCpu->uCpl == 3
4818	&& (pCtx->cr4 & X86_CR4_PVI)
4819	&& !(fEfl & X86_EFL_VIP) )
4820	fEfl \|= X86_EFL_VIF;
4821	else
4822	return iemRaiseGeneralProtectionFault0(pIemCpu);
4823	}
4824	/* V8086 */
4825	else if (uIopl == 3)
4826	fEfl \|= X86_EFL_IF;
4827	else if ( uIopl < 3
4828	&& (pCtx->cr4 & X86_CR4_VME)
4829	&& !(fEfl & X86_EFL_VIP) )
4830	fEfl \|= X86_EFL_VIF;
4831	else
4832	return iemRaiseGeneralProtectionFault0(pIemCpu);
4833	}
4834	/* real mode */
4835	else
4836	fEfl \|= X86_EFL_IF;
4837
4838	/* Commit. */
4839	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4840	iemRegAddToRip(pIemCpu, cbInstr);
4841	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_VERIFICATION_ENABLED(pIemCpu))
4842	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4843	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4844	return VINF_SUCCESS;
4845	}
4846
4847
4848	/**
4849	* Implements 'HLT'.
4850	*/
4851	IEM_CIMPL_DEF_0(iemCImpl_hlt)
4852	{
4853	if (pIemCpu->uCpl != 0)
4854	return iemRaiseGeneralProtectionFault0(pIemCpu);
4855	iemRegAddToRip(pIemCpu, cbInstr);
4856	return VINF_EM_HALT;
4857	}
4858
4859
4860	/**
4861	* Implements 'MONITOR'.
4862	*/
4863	IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
4864	{
4865	/*
4866	* Permission checks.
4867	*/
4868	if (pIemCpu->uCpl != 0)
4869	{
4870	Log2(("monitor: CPL != 0\n"));
4871	return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
4872	}
4873	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4874	{
4875	Log2(("monitor: Not in CPUID\n"));
4876	return iemRaiseUndefinedOpcode(pIemCpu);
4877	}
4878
4879	/*
4880	* Gather the operands and validate them.
4881	*/
4882	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4883	RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
4884	uint32_t uEcx = pCtx->ecx;
4885	uint32_t uEdx = pCtx->edx;
4886	/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
4887	* \#GP first. */
4888	if (uEcx != 0)
4889	{
4890	Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx));
4891	return iemRaiseGeneralProtectionFault0(pIemCpu);
4892	}
4893
4894	VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
4895	if (rcStrict != VINF_SUCCESS)
4896	return rcStrict;
4897
4898	RTGCPHYS GCPhysMem;
4899	rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, &GCPhysMem);
4900	if (rcStrict != VINF_SUCCESS)
4901	return rcStrict;
4902
4903	/*
4904	* Call EM to prepare the monitor/wait.
4905	*/
4906	rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
4907	Assert(rcStrict == VINF_SUCCESS);
4908
4909	iemRegAddToRip(pIemCpu, cbInstr);
4910	return rcStrict;
4911	}
4912
4913
4914	/**
4915	* Implements 'MWAIT'.
4916	*/
4917	IEM_CIMPL_DEF_0(iemCImpl_mwait)
4918	{
4919	/*
4920	* Permission checks.
4921	*/
4922	if (pIemCpu->uCpl != 0)
4923	{
4924	Log2(("mwait: CPL != 0\n"));
4925	/** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
4926	* EFLAGS.VM then.) */
4927	return iemRaiseUndefinedOpcode(pIemCpu);
4928	}
4929	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4930	{
4931	Log2(("mwait: Not in CPUID\n"));
4932	return iemRaiseUndefinedOpcode(pIemCpu);
4933	}
4934
4935	/*
4936	* Gather the operands and validate them.
4937	*/
4938	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4939	uint32_t uEax = pCtx->eax;
4940	uint32_t uEcx = pCtx->ecx;
4941	if (uEcx != 0)
4942	{
4943	/* Only supported extension is break on IRQ when IF=0. */
4944	if (uEcx > 1)
4945	{
4946	Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
4947	return iemRaiseGeneralProtectionFault0(pIemCpu);
4948	}
4949	uint32_t fMWaitFeatures = 0;
4950	uint32_t uIgnore = 0;
4951	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
4952	if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
4953	!= (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
4954	{
4955	Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
4956	return iemRaiseGeneralProtectionFault0(pIemCpu);
4957	}
4958	}
4959
4960	/*
4961	* Call EM to prepare the monitor/wait.
4962	*/
4963	VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
4964
4965	iemRegAddToRip(pIemCpu, cbInstr);
4966	return rcStrict;
4967	}
4968
4969
4970	/**
4971	* Implements 'SWAPGS'.
4972	*/
4973	IEM_CIMPL_DEF_0(iemCImpl_swapgs)
4974	{
4975	Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
4976
4977	/*
4978	* Permission checks.
4979	*/
4980	if (pIemCpu->uCpl != 0)
4981	{
4982	Log2(("swapgs: CPL != 0\n"));
4983	return iemRaiseUndefinedOpcode(pIemCpu);
4984	}
4985
4986	/*
4987	* Do the job.
4988	*/
4989	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4990	uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
4991	pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
4992	pCtx->gs.u64Base = uOtherGsBase;
4993
4994	iemRegAddToRip(pIemCpu, cbInstr);
4995	return VINF_SUCCESS;
4996	}
4997
4998
4999	/**
5000	* Implements 'CPUID'.
5001	*/
5002	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5003	{
5004	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5005
5006	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5007	pCtx->rax &= UINT32_C(0xffffffff);
5008	pCtx->rbx &= UINT32_C(0xffffffff);
5009	pCtx->rcx &= UINT32_C(0xffffffff);
5010	pCtx->rdx &= UINT32_C(0xffffffff);
5011
5012	iemRegAddToRip(pIemCpu, cbInstr);
5013	return VINF_SUCCESS;
5014	}
5015
5016
5017	/**
5018	* Implements 'AAD'.
5019	*
5020	* @param enmEffOpSize The effective operand size.
5021	*/
5022	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5023	{
5024	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5025
5026	uint16_t const ax = pCtx->ax;
5027	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5028	pCtx->ax = al;
5029	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5030	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5031	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5032
5033	iemRegAddToRip(pIemCpu, cbInstr);
5034	return VINF_SUCCESS;
5035	}
5036
5037
5038	/**
5039	* Implements 'AAM'.
5040	*
5041	* @param bImm The immediate operand. Cannot be 0.
5042	*/
5043	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5044	{
5045	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5046	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5047
5048	uint16_t const ax = pCtx->ax;
5049	uint8_t const al = (uint8_t)ax % bImm;
5050	uint8_t const ah = (uint8_t)ax / bImm;
5051	pCtx->ax = (ah << 8) + al;
5052	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5053	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5054	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5055
5056	iemRegAddToRip(pIemCpu, cbInstr);
5057	return VINF_SUCCESS;
5058	}
5059
5060
5061
5062
5063	/*
5064	* Instantiate the various string operation combinations.
5065	*/
5066	#define OP_SIZE 8
5067	#define ADDR_SIZE 16
5068	#include "IEMAllCImplStrInstr.cpp.h"
5069	#define OP_SIZE 8
5070	#define ADDR_SIZE 32
5071	#include "IEMAllCImplStrInstr.cpp.h"
5072	#define OP_SIZE 8
5073	#define ADDR_SIZE 64
5074	#include "IEMAllCImplStrInstr.cpp.h"
5075
5076	#define OP_SIZE 16
5077	#define ADDR_SIZE 16
5078	#include "IEMAllCImplStrInstr.cpp.h"
5079	#define OP_SIZE 16
5080	#define ADDR_SIZE 32
5081	#include "IEMAllCImplStrInstr.cpp.h"
5082	#define OP_SIZE 16
5083	#define ADDR_SIZE 64
5084	#include "IEMAllCImplStrInstr.cpp.h"
5085
5086	#define OP_SIZE 32
5087	#define ADDR_SIZE 16
5088	#include "IEMAllCImplStrInstr.cpp.h"
5089	#define OP_SIZE 32
5090	#define ADDR_SIZE 32
5091	#include "IEMAllCImplStrInstr.cpp.h"
5092	#define OP_SIZE 32
5093	#define ADDR_SIZE 64
5094	#include "IEMAllCImplStrInstr.cpp.h"
5095
5096	#define OP_SIZE 64
5097	#define ADDR_SIZE 32
5098	#include "IEMAllCImplStrInstr.cpp.h"
5099	#define OP_SIZE 64
5100	#define ADDR_SIZE 64
5101	#include "IEMAllCImplStrInstr.cpp.h"
5102
5103
5104	/**
5105	* Implements 'FINIT' and 'FNINIT'.
5106	*
5107	* @param fCheckXcpts Whether to check for umasked pending exceptions or
5108	* not.
5109	*/
5110	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
5111	{
5112	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5113
5114	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5115	return iemRaiseDeviceNotAvailable(pIemCpu);
5116
5117	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
5118	if (fCheckXcpts && TODO )
5119	return iemRaiseMathFault(pIemCpu);
5120	*/
5121
5122	if (iemFRegIsFxSaveFormat(pIemCpu))
5123	{
5124	pCtx->fpu.FCW = 0x37f;
5125	pCtx->fpu.FSW = 0;
5126	pCtx->fpu.FTW = 0x00; /* 0 - empty. */
5127	pCtx->fpu.FPUDP = 0;
5128	pCtx->fpu.DS = 0; //??
5129	pCtx->fpu.Rsrvd2= 0;
5130	pCtx->fpu.FPUIP = 0;
5131	pCtx->fpu.CS = 0; //??
5132	pCtx->fpu.Rsrvd1= 0;
5133	pCtx->fpu.FOP = 0;
5134	}
5135	else
5136	{
5137	PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
5138	pFpu->FCW = 0x37f;
5139	pFpu->FSW = 0;
5140	pFpu->FTW = 0xffff; /* 11 - empty */
5141	pFpu->FPUOO = 0; //??
5142	pFpu->FPUOS = 0; //??
5143	pFpu->FPUIP = 0;
5144	pFpu->CS = 0; //??
5145	pFpu->FOP = 0;
5146	}
5147
5148	iemHlpUsedFpu(pIemCpu);
5149	iemRegAddToRip(pIemCpu, cbInstr);
5150	return VINF_SUCCESS;
5151	}
5152
5153
5154	/**
5155	* Implements 'FXSAVE'.
5156	*
5157	* @param iEffSeg The effective segment.
5158	* @param GCPtrEff The address of the image.
5159	* @param enmEffOpSize The operand size (only REX.W really matters).
5160	*/
5161	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5162	{
5163	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5164
5165	/*
5166	* Raise exceptions.
5167	*/
5168	if (pCtx->cr0 & X86_CR0_EM)
5169	return iemRaiseUndefinedOpcode(pIemCpu);
5170	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5171	return iemRaiseDeviceNotAvailable(pIemCpu);
5172	if (GCPtrEff & 15)
5173	{
5174	/** @todo CPU/VM detection possible! \#AC might not be signal for
5175	* all/any misalignment sizes, intel says its an implementation detail. */
5176	if ( (pCtx->cr0 & X86_CR0_AM)
5177	&& pCtx->eflags.Bits.u1AC
5178	&& pIemCpu->uCpl == 3)
5179	return iemRaiseAlignmentCheckException(pIemCpu);
5180	return iemRaiseGeneralProtectionFault0(pIemCpu);
5181	}
5182	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5183
5184	/*
5185	* Access the memory.
5186	*/
5187	void *pvMem512;
5188	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5189	if (rcStrict != VINF_SUCCESS)
5190	return rcStrict;
5191	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
5192
5193	/*
5194	* Store the registers.
5195	*/
5196	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5197	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
5198
5199	/* common for all formats */
5200	pDst->FCW = pCtx->fpu.FCW;
5201	pDst->FSW = pCtx->fpu.FSW;
5202	pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
5203	pDst->FOP = pCtx->fpu.FOP;
5204	pDst->MXCSR = pCtx->fpu.MXCSR;
5205	pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
5206	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
5207	{
5208	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
5209	* them for now... */
5210	pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5211	pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5212	pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
5213	pDst->aRegs[i].au32[3] = 0;
5214	}
5215
5216	/* FPU IP, CS, DP and DS. */
5217	/** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
5218	* state information. :-/
5219	* Storing zeros now to prevent any potential leakage of host info. */
5220	pDst->FPUIP = 0;
5221	pDst->CS = 0;
5222	pDst->Rsrvd1 = 0;
5223	pDst->FPUDP = 0;
5224	pDst->DS = 0;
5225	pDst->Rsrvd2 = 0;
5226
5227	/* XMM registers. */
5228	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5229	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5230	\|\| pIemCpu->uCpl != 0)
5231	{
5232	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5233	for (uint32_t i = 0; i < cXmmRegs; i++)
5234	pDst->aXMM[i] = pCtx->fpu.aXMM[i];
5235	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
5236	* right? */
5237	}
5238
5239	/*
5240	* Commit the memory.
5241	*/
5242	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5243	if (rcStrict != VINF_SUCCESS)
5244	return rcStrict;
5245
5246	iemRegAddToRip(pIemCpu, cbInstr);
5247	return VINF_SUCCESS;
5248	}
5249
5250
5251	/**
5252	* Implements 'FXRSTOR'.
5253	*
5254	* @param GCPtrEff The address of the image.
5255	* @param enmEffOpSize The operand size (only REX.W really matters).
5256	*/
5257	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5258	{
5259	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5260
5261	/*
5262	* Raise exceptions.
5263	*/
5264	if (pCtx->cr0 & X86_CR0_EM)
5265	return iemRaiseUndefinedOpcode(pIemCpu);
5266	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5267	return iemRaiseDeviceNotAvailable(pIemCpu);
5268	if (GCPtrEff & 15)
5269	{
5270	/** @todo CPU/VM detection possible! \#AC might not be signal for
5271	* all/any misalignment sizes, intel says its an implementation detail. */
5272	if ( (pCtx->cr0 & X86_CR0_AM)
5273	&& pCtx->eflags.Bits.u1AC
5274	&& pIemCpu->uCpl == 3)
5275	return iemRaiseAlignmentCheckException(pIemCpu);
5276	return iemRaiseGeneralProtectionFault0(pIemCpu);
5277	}
5278	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5279
5280	/*
5281	* Access the memory.
5282	*/
5283	void *pvMem512;
5284	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
5285	if (rcStrict != VINF_SUCCESS)
5286	return rcStrict;
5287	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
5288
5289	/*
5290	* Check the state for stuff which will GP(0).
5291	*/
5292	uint32_t const fMXCSR = pSrc->MXCSR;
5293	uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
5294	if (fMXCSR & ~fMXCSR_MASK)
5295	{
5296	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
5297	return iemRaiseGeneralProtectionFault0(pIemCpu);
5298	}
5299
5300	/*
5301	* Load the registers.
5302	*/
5303	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5304	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
5305
5306	/* common for all formats */
5307	pCtx->fpu.FCW = pSrc->FCW;
5308	pCtx->fpu.FSW = pSrc->FSW;
5309	pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
5310	pCtx->fpu.FOP = pSrc->FOP;
5311	pCtx->fpu.MXCSR = fMXCSR;
5312	/* (MXCSR_MASK is read-only) */
5313	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
5314	{
5315	pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
5316	pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
5317	pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
5318	pCtx->fpu.aRegs[i].au32[3] = 0;
5319	}
5320
5321	/* FPU IP, CS, DP and DS. */
5322	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5323	{
5324	pCtx->fpu.FPUIP = pSrc->FPUIP;
5325	pCtx->fpu.CS = pSrc->CS;
5326	pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
5327	pCtx->fpu.FPUDP = pSrc->FPUDP;
5328	pCtx->fpu.DS = pSrc->DS;
5329	pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
5330	}
5331	else
5332	{
5333	pCtx->fpu.FPUIP = pSrc->FPUIP;
5334	pCtx->fpu.CS = pSrc->CS;
5335	pCtx->fpu.Rsrvd1 = 0;
5336	pCtx->fpu.FPUDP = pSrc->FPUDP;
5337	pCtx->fpu.DS = pSrc->DS;
5338	pCtx->fpu.Rsrvd2 = 0;
5339	}
5340
5341	/* XMM registers. */
5342	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5343	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5344	\|\| pIemCpu->uCpl != 0)
5345	{
5346	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5347	for (uint32_t i = 0; i < cXmmRegs; i++)
5348	pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
5349	}
5350
5351	/*
5352	* Commit the memory.
5353	*/
5354	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
5355	if (rcStrict != VINF_SUCCESS)
5356	return rcStrict;
5357
5358	iemHlpUsedFpu(pIemCpu);
5359	iemRegAddToRip(pIemCpu, cbInstr);
5360	return VINF_SUCCESS;
5361	}
5362
5363
5364	/**
5365	* Commmon routine for fnstenv and fnsave.
5366	*
5367	* @param uPtr Where to store the state.
5368	* @param pCtx The CPU context.
5369	*/
5370	static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
5371	{
5372	if (enmEffOpSize == IEMMODE_16BIT)
5373	{
5374	uPtr.pu16[0] = pCtx->fpu.FCW;
5375	uPtr.pu16[1] = pCtx->fpu.FSW;
5376	uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
5377	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5378	{
5379	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
5380	* protected mode or long mode and we save it in real mode? And vice
5381	* versa? And with 32-bit operand size? I think CPU is storing the
5382	* effective address ((CS << 4) + IP) in the offset register and not
5383	* doing any address calculations here. */
5384	uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
5385	uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) \| pCtx->fpu.FOP;
5386	uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
5387	uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
5388	}
5389	else
5390	{
5391	uPtr.pu16[3] = pCtx->fpu.FPUIP;
5392	uPtr.pu16[4] = pCtx->fpu.CS;
5393	uPtr.pu16[5] = pCtx->fpu.FPUDP;
5394	uPtr.pu16[6] = pCtx->fpu.DS;
5395	}
5396	}
5397	else
5398	{
5399	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
5400	uPtr.pu16[0*2] = pCtx->fpu.FCW;
5401	uPtr.pu16[1*2] = pCtx->fpu.FSW;
5402	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
5403	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5404	{
5405	uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
5406	uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) \| pCtx->fpu.FOP;
5407	uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
5408	uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
5409	}
5410	else
5411	{
5412	uPtr.pu32[3] = pCtx->fpu.FPUIP;
5413	uPtr.pu16[4*2] = pCtx->fpu.CS;
5414	uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
5415	uPtr.pu32[5] = pCtx->fpu.FPUDP;
5416	uPtr.pu16[6*2] = pCtx->fpu.DS;
5417	}
5418	}
5419	}
5420
5421
5422	/**
5423	* Commmon routine for fldenv and frstor
5424	*
5425	* @param uPtr Where to store the state.
5426	* @param pCtx The CPU context.
5427	*/
5428	static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
5429	{
5430	if (enmEffOpSize == IEMMODE_16BIT)
5431	{
5432	pCtx->fpu.FCW = uPtr.pu16[0];
5433	pCtx->fpu.FSW = uPtr.pu16[1];
5434	pCtx->fpu.FTW = uPtr.pu16[2];
5435	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5436	{
5437	pCtx->fpu.FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
5438	pCtx->fpu.FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
5439	pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
5440	pCtx->fpu.CS = 0;
5441	pCtx->fpu.Rsrvd1= 0;
5442	pCtx->fpu.DS = 0;
5443	pCtx->fpu.Rsrvd2= 0;
5444	}
5445	else
5446	{
5447	pCtx->fpu.FPUIP = uPtr.pu16[3];
5448	pCtx->fpu.CS = uPtr.pu16[4];
5449	pCtx->fpu.Rsrvd1= 0;
5450	pCtx->fpu.FPUDP = uPtr.pu16[5];
5451	pCtx->fpu.DS = uPtr.pu16[6];
5452	pCtx->fpu.Rsrvd2= 0;
5453	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
5454	}
5455	}
5456	else
5457	{
5458	pCtx->fpu.FCW = uPtr.pu16[0*2];
5459	pCtx->fpu.FSW = uPtr.pu16[1*2];
5460	pCtx->fpu.FTW = uPtr.pu16[2*2];
5461	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5462	{
5463	pCtx->fpu.FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
5464	pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
5465	pCtx->fpu.FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
5466	pCtx->fpu.CS = 0;
5467	pCtx->fpu.Rsrvd1= 0;
5468	pCtx->fpu.DS = 0;
5469	pCtx->fpu.Rsrvd2= 0;
5470	}
5471	else
5472	{
5473	pCtx->fpu.FPUIP = uPtr.pu32[3];
5474	pCtx->fpu.CS = uPtr.pu16[4*2];
5475	pCtx->fpu.Rsrvd1= 0;
5476	pCtx->fpu.FOP = uPtr.pu16[4*2+1];
5477	pCtx->fpu.FPUDP = uPtr.pu32[5];
5478	pCtx->fpu.DS = uPtr.pu16[6*2];
5479	pCtx->fpu.Rsrvd2= 0;
5480	}
5481	}
5482
5483	/* Make adjustments. */
5484	pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
5485	pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
5486	iemFpuRecalcExceptionStatus(pCtx);
5487	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
5488	* exceptions are pending after loading the saved state? */
5489	}
5490
5491
5492	/**
5493	* Implements 'FNSTENV'.
5494	*
5495	* @param enmEffOpSize The operand size (only REX.W really matters).
5496	* @param iEffSeg The effective segment register for @a GCPtrEff.
5497	* @param GCPtrEffDst The address of the image.
5498	*/
5499	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5500	{
5501	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5502	RTPTRUNION uPtr;
5503	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5504	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5505	if (rcStrict != VINF_SUCCESS)
5506	return rcStrict;
5507
5508	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5509
5510	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5511	if (rcStrict != VINF_SUCCESS)
5512	return rcStrict;
5513
5514	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5515	iemRegAddToRip(pIemCpu, cbInstr);
5516	return VINF_SUCCESS;
5517	}
5518
5519
5520	/**
5521	* Implements 'FNSAVE'.
5522	*
5523	* @param GCPtrEffDst The address of the image.
5524	* @param enmEffOpSize The operand size.
5525	*/
5526	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5527	{
5528	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5529	RTPTRUNION uPtr;
5530	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5531	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5532	if (rcStrict != VINF_SUCCESS)
5533	return rcStrict;
5534
5535	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5536	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5537	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5538	{
5539	paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5540	paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5541	paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
5542	}
5543
5544	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5545	if (rcStrict != VINF_SUCCESS)
5546	return rcStrict;
5547
5548	/*
5549	* Re-initialize the FPU.
5550	*/
5551	pCtx->fpu.FCW = 0x37f;
5552	pCtx->fpu.FSW = 0;
5553	pCtx->fpu.FTW = 0x00; /* 0 - empty */
5554	pCtx->fpu.FPUDP = 0;
5555	pCtx->fpu.DS = 0;
5556	pCtx->fpu.Rsrvd2= 0;
5557	pCtx->fpu.FPUIP = 0;
5558	pCtx->fpu.CS = 0;
5559	pCtx->fpu.Rsrvd1= 0;
5560	pCtx->fpu.FOP = 0;
5561
5562	iemHlpUsedFpu(pIemCpu);
5563	iemRegAddToRip(pIemCpu, cbInstr);
5564	return VINF_SUCCESS;
5565	}
5566
5567
5568
5569	/**
5570	* Implements 'FLDENV'.
5571	*
5572	* @param enmEffOpSize The operand size (only REX.W really matters).
5573	* @param iEffSeg The effective segment register for @a GCPtrEff.
5574	* @param GCPtrEffSrc The address of the image.
5575	*/
5576	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5577	{
5578	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5579	RTCPTRUNION uPtr;
5580	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5581	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5582	if (rcStrict != VINF_SUCCESS)
5583	return rcStrict;
5584
5585	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5586
5587	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5588	if (rcStrict != VINF_SUCCESS)
5589	return rcStrict;
5590
5591	iemHlpUsedFpu(pIemCpu);
5592	iemRegAddToRip(pIemCpu, cbInstr);
5593	return VINF_SUCCESS;
5594	}
5595
5596
5597	/**
5598	* Implements 'FRSTOR'.
5599	*
5600	* @param GCPtrEffSrc The address of the image.
5601	* @param enmEffOpSize The operand size.
5602	*/
5603	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5604	{
5605	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5606	RTCPTRUNION uPtr;
5607	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5608	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5609	if (rcStrict != VINF_SUCCESS)
5610	return rcStrict;
5611
5612	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5613	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5614	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5615	{
5616	pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
5617	pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
5618	pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
5619	pCtx->fpu.aRegs[i].au32[3] = 0;
5620	}
5621
5622	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5623	if (rcStrict != VINF_SUCCESS)
5624	return rcStrict;
5625
5626	iemHlpUsedFpu(pIemCpu);
5627	iemRegAddToRip(pIemCpu, cbInstr);
5628	return VINF_SUCCESS;
5629	}
5630
5631
5632	/**
5633	* Implements 'FLDCW'.
5634	*
5635	* @param u16Fcw The new FCW.
5636	*/
5637	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
5638	{
5639	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5640
5641	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
5642	/** @todo Testcase: Try see what happens when trying to set undefined bits
5643	* (other than 6 and 7). Currently ignoring them. */
5644	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
5645	* according to FSW. (This is was is currently implemented.) */
5646	pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
5647	iemFpuRecalcExceptionStatus(pCtx);
5648
5649	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5650	iemHlpUsedFpu(pIemCpu);
5651	iemRegAddToRip(pIemCpu, cbInstr);
5652	return VINF_SUCCESS;
5653	}
5654
5655
5656
5657	/**
5658	* Implements the underflow case of fxch.
5659	*
5660	* @param iStReg The other stack register.
5661	*/
5662	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
5663	{
5664	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5665
5666	unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
5667	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5668	Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) \|\| !(RT_BIT(iReg2) & pCtx->fpu.FTW));
5669
5670	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
5671	* registers are read as QNaN and then exchanged. This could be
5672	* wrong... */
5673	if (pCtx->fpu.FCW & X86_FCW_IM)
5674	{
5675	if (RT_BIT(iReg1) & pCtx->fpu.FTW)
5676	{
5677	if (RT_BIT(iReg2) & pCtx->fpu.FTW)
5678	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5679	else
5680	pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
5681	iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
5682	}
5683	else
5684	{
5685	pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
5686	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5687	}
5688	pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
5689	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
5690	}
5691	else
5692	{
5693	/* raise underflow exception, don't change anything. */
5694	pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
5695	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5696	}
5697
5698	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5699	iemHlpUsedFpu(pIemCpu);
5700	iemRegAddToRip(pIemCpu, cbInstr);
5701	return VINF_SUCCESS;
5702	}
5703
5704
5705	/**
5706	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
5707	*
5708	* @param cToAdd 1 or 7.
5709	*/
5710	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
5711	{
5712	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5713	Assert(iStReg < 8);
5714
5715	/*
5716	* Raise exceptions.
5717	*/
5718	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5719	return iemRaiseDeviceNotAvailable(pIemCpu);
5720	uint16_t u16Fsw = pCtx->fpu.FSW;
5721	if (u16Fsw & X86_FSW_ES)
5722	return iemRaiseMathFault(pIemCpu);
5723
5724	/*
5725	* Check if any of the register accesses causes #SF + #IA.
5726	*/
5727	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
5728	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5729	if ((pCtx->fpu.FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
5730	{
5731	uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
5732	pCtx->fpu.FSW &= ~X86_FSW_C1;
5733	pCtx->fpu.FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
5734	if ( !(u16Fsw & X86_FSW_IE)
5735	\|\| (pCtx->fpu.FCW & X86_FCW_IM) )
5736	{
5737	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5738	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5739	}
5740	}
5741	else if (pCtx->fpu.FCW & X86_FCW_IM)
5742	{
5743	/* Masked underflow. */
5744	pCtx->fpu.FSW &= ~X86_FSW_C1;
5745	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF;
5746	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5747	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
5748	}
5749	else
5750	{
5751	/* Raise underflow - don't touch EFLAGS or TOP. */
5752	pCtx->fpu.FSW &= ~X86_FSW_C1;
5753	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5754	fPop = false;
5755	}
5756
5757	/*
5758	* Pop if necessary.
5759	*/
5760	if (fPop)
5761	{
5762	pCtx->fpu.FTW &= ~RT_BIT(iReg1);
5763	pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
5764	pCtx->fpu.FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
5765	}
5766
5767	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5768	iemHlpUsedFpu(pIemCpu);
5769	iemRegAddToRip(pIemCpu, cbInstr);
5770	return VINF_SUCCESS;
5771	}
5772
5773	/** @} */
5774

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 47568

Download in other formats: