IEMAllCImpl.cpp.h@ 40022

Last change on this file since 40022 was 40022, checked in by vboxsync, 13 years ago
IEM: fxsave & fxrstor.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 112.9 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 40022 2012-02-07 20:29:04Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @name Misc Helpers
20	* @{
21	*/
22
23	/**
24	* Checks if we are allowed to access the given I/O port, raising the
25	* appropriate exceptions if we aren't (or if the I/O bitmap is not
26	* accessible).
27	*
28	* @returns Strict VBox status code.
29	*
30	* @param pIemCpu The IEM per CPU data.
31	* @param pCtx The register context.
32	* @param u16Port The port number.
33	* @param cbOperand The operand size.
34	*/
35	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
36	{
37	if ( (pCtx->cr0 & X86_CR0_PE)
38	&& ( pIemCpu->uCpl > pCtx->eflags.Bits.u2IOPL
39	\|\| pCtx->eflags.Bits.u1VM) )
40	{
41	NOREF(u16Port); NOREF(cbOperand); /** @todo I/O port permission bitmap check */
42	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
43	}
44	return VINF_SUCCESS;
45	}
46
47
48	#if 0
49	/**
50	* Calculates the parity bit.
51	*
52	* @returns true if the bit is set, false if not.
53	* @param u8Result The least significant byte of the result.
54	*/
55	static bool iemHlpCalcParityFlag(uint8_t u8Result)
56	{
57	/*
58	* Parity is set if the number of bits in the least significant byte of
59	* the result is even.
60	*/
61	uint8_t cBits;
62	cBits = u8Result & 1; /* 0 */
63	u8Result >>= 1;
64	cBits += u8Result & 1;
65	u8Result >>= 1;
66	cBits += u8Result & 1;
67	u8Result >>= 1;
68	cBits += u8Result & 1;
69	u8Result >>= 1;
70	cBits += u8Result & 1; /* 4 */
71	u8Result >>= 1;
72	cBits += u8Result & 1;
73	u8Result >>= 1;
74	cBits += u8Result & 1;
75	u8Result >>= 1;
76	cBits += u8Result & 1;
77	return !(cBits & 1);
78	}
79	#endif /* not used */
80
81
82	/**
83	* Updates the specified flags according to a 8-bit result.
84	*
85	* @param pIemCpu The.
86	* @param u8Result The result to set the flags according to.
87	* @param fToUpdate The flags to update.
88	* @param fUndefined The flags that are specified as undefined.
89	*/
90	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
91	{
92	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
93
94	uint32_t fEFlags = pCtx->eflags.u;
95	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
96	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
97	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
98	}
99
100
101	/**
102	* Loads a NULL data selector into a selector register, both the hidden and
103	* visible parts, in protected mode.
104	*
105	* @param puSel The selector register.
106	* @param pHid The hidden register part.
107	*/
108	static void iemHlpLoadNullDataSelectorProt(PRTSEL puSel, PCPUMSELREGHID pHid)
109	{
110	/** @todo write a testcase checking what happends when loading a NULL data
111	* selector in protected mode. */
112	pHid->u64Base = 0;
113	pHid->u32Limit = 0;
114	pHid->Attr.u = 0;
115	*puSel = 0;
116	}
117
118
119	/**
120	* Helper used by iret.
121	*
122	* @param uCpl The new CPL.
123	* @param puSel The selector register.
124	* @param pHid The corresponding hidden register.
125	*/
126	static void iemHlpAdjustSelectorForNewCpl(uint8_t uCpl, PRTSEL puSel, PCPUMSELREGHID pHid)
127	{
128	if ( uCpl > pHid->Attr.n.u2Dpl
129	&& pHid->Attr.n.u1DescType /* code or data, not system */
130	&& (pHid->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
131	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
132	iemHlpLoadNullDataSelectorProt(puSel, pHid);
133	}
134
135
136	/** @} */
137
138	/** @name C Implementations
139	* @{
140	*/
141
142	/**
143	* Implements a 16-bit popa.
144	*/
145	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
146	{
147	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
148	RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
149	RTGCPTR GCPtrLast = GCPtrStart + 15;
150	VBOXSTRICTRC rcStrict;
151
152	/*
153	* The docs are a bit hard to comprehend here, but it looks like we wrap
154	* around in real mode as long as none of the individual "popa" crosses the
155	* end of the stack segment. In protected mode we check the whole access
156	* in one go. For efficiency, only do the word-by-word thing if we're in
157	* danger of wrapping around.
158	*/
159	/** @todo do popa boundary / wrap-around checks. */
160	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
161	&& (pCtx->csHid.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
162	{
163	/* word-by-word */
164	RTUINT64U TmpRsp;
165	TmpRsp.u = pCtx->rsp;
166	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
167	if (rcStrict == VINF_SUCCESS)
168	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
169	if (rcStrict == VINF_SUCCESS)
170	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
171	if (rcStrict == VINF_SUCCESS)
172	{
173	iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
174	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
175	}
176	if (rcStrict == VINF_SUCCESS)
177	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
178	if (rcStrict == VINF_SUCCESS)
179	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
180	if (rcStrict == VINF_SUCCESS)
181	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
182	if (rcStrict == VINF_SUCCESS)
183	{
184	pCtx->rsp = TmpRsp.u;
185	iemRegAddToRip(pIemCpu, cbInstr);
186	}
187	}
188	else
189	{
190	uint16_t const *pa16Mem = NULL;
191	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
192	if (rcStrict == VINF_SUCCESS)
193	{
194	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
195	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
196	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
197	/* skip sp */
198	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
199	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
200	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
201	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
202	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
203	if (rcStrict == VINF_SUCCESS)
204	{
205	iemRegAddToRsp(pCtx, 16);
206	iemRegAddToRip(pIemCpu, cbInstr);
207	}
208	}
209	}
210	return rcStrict;
211	}
212
213
214	/**
215	* Implements a 32-bit popa.
216	*/
217	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
218	{
219	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
220	RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
221	RTGCPTR GCPtrLast = GCPtrStart + 31;
222	VBOXSTRICTRC rcStrict;
223
224	/*
225	* The docs are a bit hard to comprehend here, but it looks like we wrap
226	* around in real mode as long as none of the individual "popa" crosses the
227	* end of the stack segment. In protected mode we check the whole access
228	* in one go. For efficiency, only do the word-by-word thing if we're in
229	* danger of wrapping around.
230	*/
231	/** @todo do popa boundary / wrap-around checks. */
232	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
233	&& (pCtx->csHid.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
234	{
235	/* word-by-word */
236	RTUINT64U TmpRsp;
237	TmpRsp.u = pCtx->rsp;
238	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
239	if (rcStrict == VINF_SUCCESS)
240	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
241	if (rcStrict == VINF_SUCCESS)
242	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
243	if (rcStrict == VINF_SUCCESS)
244	{
245	iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
246	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
247	}
248	if (rcStrict == VINF_SUCCESS)
249	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
250	if (rcStrict == VINF_SUCCESS)
251	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
252	if (rcStrict == VINF_SUCCESS)
253	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
254	if (rcStrict == VINF_SUCCESS)
255	{
256	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
257	pCtx->rdi &= UINT32_MAX;
258	pCtx->rsi &= UINT32_MAX;
259	pCtx->rbp &= UINT32_MAX;
260	pCtx->rbx &= UINT32_MAX;
261	pCtx->rdx &= UINT32_MAX;
262	pCtx->rcx &= UINT32_MAX;
263	pCtx->rax &= UINT32_MAX;
264	#endif
265	pCtx->rsp = TmpRsp.u;
266	iemRegAddToRip(pIemCpu, cbInstr);
267	}
268	}
269	else
270	{
271	uint32_t const *pa32Mem;
272	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
273	if (rcStrict == VINF_SUCCESS)
274	{
275	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
276	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
277	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
278	/* skip esp */
279	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
280	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
281	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
282	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
283	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
284	if (rcStrict == VINF_SUCCESS)
285	{
286	iemRegAddToRsp(pCtx, 32);
287	iemRegAddToRip(pIemCpu, cbInstr);
288	}
289	}
290	}
291	return rcStrict;
292	}
293
294
295	/**
296	* Implements a 16-bit pusha.
297	*/
298	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
299	{
300	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
301	RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
302	RTGCPTR GCPtrBottom = GCPtrTop - 15;
303	VBOXSTRICTRC rcStrict;
304
305	/*
306	* The docs are a bit hard to comprehend here, but it looks like we wrap
307	* around in real mode as long as none of the individual "pushd" crosses the
308	* end of the stack segment. In protected mode we check the whole access
309	* in one go. For efficiency, only do the word-by-word thing if we're in
310	* danger of wrapping around.
311	*/
312	/** @todo do pusha boundary / wrap-around checks. */
313	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
314	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
315	{
316	/* word-by-word */
317	RTUINT64U TmpRsp;
318	TmpRsp.u = pCtx->rsp;
319	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
320	if (rcStrict == VINF_SUCCESS)
321	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
322	if (rcStrict == VINF_SUCCESS)
323	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
324	if (rcStrict == VINF_SUCCESS)
325	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
326	if (rcStrict == VINF_SUCCESS)
327	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
328	if (rcStrict == VINF_SUCCESS)
329	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
330	if (rcStrict == VINF_SUCCESS)
331	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
332	if (rcStrict == VINF_SUCCESS)
333	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
334	if (rcStrict == VINF_SUCCESS)
335	{
336	pCtx->rsp = TmpRsp.u;
337	iemRegAddToRip(pIemCpu, cbInstr);
338	}
339	}
340	else
341	{
342	GCPtrBottom--;
343	uint16_t *pa16Mem = NULL;
344	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
345	if (rcStrict == VINF_SUCCESS)
346	{
347	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
348	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
349	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
350	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
351	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
352	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
353	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
354	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
355	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
356	if (rcStrict == VINF_SUCCESS)
357	{
358	iemRegSubFromRsp(pCtx, 16);
359	iemRegAddToRip(pIemCpu, cbInstr);
360	}
361	}
362	}
363	return rcStrict;
364	}
365
366
367	/**
368	* Implements a 32-bit pusha.
369	*/
370	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
371	{
372	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
373	RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
374	RTGCPTR GCPtrBottom = GCPtrTop - 31;
375	VBOXSTRICTRC rcStrict;
376
377	/*
378	* The docs are a bit hard to comprehend here, but it looks like we wrap
379	* around in real mode as long as none of the individual "pusha" crosses the
380	* end of the stack segment. In protected mode we check the whole access
381	* in one go. For efficiency, only do the word-by-word thing if we're in
382	* danger of wrapping around.
383	*/
384	/** @todo do pusha boundary / wrap-around checks. */
385	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
386	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
387	{
388	/* word-by-word */
389	RTUINT64U TmpRsp;
390	TmpRsp.u = pCtx->rsp;
391	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
392	if (rcStrict == VINF_SUCCESS)
393	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
394	if (rcStrict == VINF_SUCCESS)
395	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
396	if (rcStrict == VINF_SUCCESS)
397	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
398	if (rcStrict == VINF_SUCCESS)
399	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
400	if (rcStrict == VINF_SUCCESS)
401	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
402	if (rcStrict == VINF_SUCCESS)
403	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
404	if (rcStrict == VINF_SUCCESS)
405	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
406	if (rcStrict == VINF_SUCCESS)
407	{
408	pCtx->rsp = TmpRsp.u;
409	iemRegAddToRip(pIemCpu, cbInstr);
410	}
411	}
412	else
413	{
414	GCPtrBottom--;
415	uint32_t *pa32Mem;
416	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
417	if (rcStrict == VINF_SUCCESS)
418	{
419	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
420	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
421	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
422	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
423	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
424	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
425	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
426	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
427	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
428	if (rcStrict == VINF_SUCCESS)
429	{
430	iemRegSubFromRsp(pCtx, 32);
431	iemRegAddToRip(pIemCpu, cbInstr);
432	}
433	}
434	}
435	return rcStrict;
436	}
437
438
439	/**
440	* Implements pushf.
441	*
442	*
443	* @param enmEffOpSize The effective operand size.
444	*/
445	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
446	{
447	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
448
449	/*
450	* If we're in V8086 mode some care is required (which is why we're in
451	* doing this in a C implementation).
452	*/
453	uint32_t fEfl = pCtx->eflags.u;
454	if ( (fEfl & X86_EFL_VM)
455	&& X86_EFL_GET_IOPL(fEfl) != 3 )
456	{
457	Assert(pCtx->cr0 & X86_CR0_PE);
458	if ( enmEffOpSize != IEMMODE_16BIT
459	\|\| !(pCtx->cr4 & X86_CR4_VME))
460	return iemRaiseGeneralProtectionFault0(pIemCpu);
461	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
462	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
463	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
464	}
465
466	/*
467	* Ok, clear RF and VM and push the flags.
468	*/
469	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
470
471	VBOXSTRICTRC rcStrict;
472	switch (enmEffOpSize)
473	{
474	case IEMMODE_16BIT:
475	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
476	break;
477	case IEMMODE_32BIT:
478	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
479	break;
480	case IEMMODE_64BIT:
481	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
482	break;
483	IEM_NOT_REACHED_DEFAULT_CASE_RET();
484	}
485	if (rcStrict != VINF_SUCCESS)
486	return rcStrict;
487
488	iemRegAddToRip(pIemCpu, cbInstr);
489	return VINF_SUCCESS;
490	}
491
492
493	/**
494	* Implements popf.
495	*
496	* @param enmEffOpSize The effective operand size.
497	*/
498	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
499	{
500	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
501	uint32_t const fEflOld = pCtx->eflags.u;
502	VBOXSTRICTRC rcStrict;
503	uint32_t fEflNew;
504
505	/*
506	* V8086 is special as usual.
507	*/
508	if (fEflOld & X86_EFL_VM)
509	{
510	/*
511	* Almost anything goes if IOPL is 3.
512	*/
513	if (X86_EFL_GET_IOPL(fEflOld) == 3)
514	{
515	switch (enmEffOpSize)
516	{
517	case IEMMODE_16BIT:
518	{
519	uint16_t u16Value;
520	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
521	if (rcStrict != VINF_SUCCESS)
522	return rcStrict;
523	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
524	break;
525	}
526	case IEMMODE_32BIT:
527	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
528	if (rcStrict != VINF_SUCCESS)
529	return rcStrict;
530	break;
531	IEM_NOT_REACHED_DEFAULT_CASE_RET();
532	}
533
534	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
535	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
536	}
537	/*
538	* Interrupt flag virtualization with CR4.VME=1.
539	*/
540	else if ( enmEffOpSize == IEMMODE_16BIT
541	&& (pCtx->cr4 & X86_CR4_VME) )
542	{
543	uint16_t u16Value;
544	RTUINT64U TmpRsp;
545	TmpRsp.u = pCtx->rsp;
546	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
547	if (rcStrict != VINF_SUCCESS)
548	return rcStrict;
549
550	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
551	* or before? */
552	if ( ( (u16Value & X86_EFL_IF)
553	&& (fEflOld & X86_EFL_VIP))
554	\|\| (u16Value & X86_EFL_TF) )
555	return iemRaiseGeneralProtectionFault0(pIemCpu);
556
557	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
558	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
559	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
560	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
561
562	pCtx->rsp = TmpRsp.u;
563	}
564	else
565	return iemRaiseGeneralProtectionFault0(pIemCpu);
566
567	}
568	/*
569	* Not in V8086 mode.
570	*/
571	else
572	{
573	/* Pop the flags. */
574	switch (enmEffOpSize)
575	{
576	case IEMMODE_16BIT:
577	{
578	uint16_t u16Value;
579	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
580	if (rcStrict != VINF_SUCCESS)
581	return rcStrict;
582	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
583	break;
584	}
585	case IEMMODE_32BIT:
586	case IEMMODE_64BIT:
587	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
588	if (rcStrict != VINF_SUCCESS)
589	return rcStrict;
590	break;
591	IEM_NOT_REACHED_DEFAULT_CASE_RET();
592	}
593
594	/* Merge them with the current flags. */
595	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
596	\|\| pIemCpu->uCpl == 0)
597	{
598	fEflNew &= X86_EFL_POPF_BITS;
599	fEflNew \|= ~X86_EFL_POPF_BITS & fEflOld;
600	}
601	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
602	{
603	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
604	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
605	}
606	else
607	{
608	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
609	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
610	}
611	}
612
613	/*
614	* Commit the flags.
615	*/
616	Assert(fEflNew & RT_BIT_32(1));
617	pCtx->eflags.u = fEflNew;
618	iemRegAddToRip(pIemCpu, cbInstr);
619
620	return VINF_SUCCESS;
621	}
622
623
624	/**
625	* Implements an indirect call.
626	*
627	* @param uNewPC The new program counter (RIP) value (loaded from the
628	* operand).
629	* @param enmEffOpSize The effective operand size.
630	*/
631	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
632	{
633	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
634	uint16_t uOldPC = pCtx->ip + cbInstr;
635	if (uNewPC > pCtx->csHid.u32Limit)
636	return iemRaiseGeneralProtectionFault0(pIemCpu);
637
638	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
639	if (rcStrict != VINF_SUCCESS)
640	return rcStrict;
641
642	pCtx->rip = uNewPC;
643	return VINF_SUCCESS;
644
645	}
646
647
648	/**
649	* Implements a 16-bit relative call.
650	*
651	* @param offDisp The displacment offset.
652	*/
653	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
654	{
655	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
656	uint16_t uOldPC = pCtx->ip + cbInstr;
657	uint16_t uNewPC = uOldPC + offDisp;
658	if (uNewPC > pCtx->csHid.u32Limit)
659	return iemRaiseGeneralProtectionFault0(pIemCpu);
660
661	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
662	if (rcStrict != VINF_SUCCESS)
663	return rcStrict;
664
665	pCtx->rip = uNewPC;
666	return VINF_SUCCESS;
667	}
668
669
670	/**
671	* Implements a 32-bit indirect call.
672	*
673	* @param uNewPC The new program counter (RIP) value (loaded from the
674	* operand).
675	* @param enmEffOpSize The effective operand size.
676	*/
677	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
678	{
679	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
680	uint32_t uOldPC = pCtx->eip + cbInstr;
681	if (uNewPC > pCtx->csHid.u32Limit)
682	return iemRaiseGeneralProtectionFault0(pIemCpu);
683
684	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
685	if (rcStrict != VINF_SUCCESS)
686	return rcStrict;
687
688	pCtx->rip = uNewPC;
689	return VINF_SUCCESS;
690
691	}
692
693
694	/**
695	* Implements a 32-bit relative call.
696	*
697	* @param offDisp The displacment offset.
698	*/
699	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
700	{
701	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
702	uint32_t uOldPC = pCtx->eip + cbInstr;
703	uint32_t uNewPC = uOldPC + offDisp;
704	if (uNewPC > pCtx->csHid.u32Limit)
705	return iemRaiseGeneralProtectionFault0(pIemCpu);
706
707	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
708	if (rcStrict != VINF_SUCCESS)
709	return rcStrict;
710
711	pCtx->rip = uNewPC;
712	return VINF_SUCCESS;
713	}
714
715
716	/**
717	* Implements a 64-bit indirect call.
718	*
719	* @param uNewPC The new program counter (RIP) value (loaded from the
720	* operand).
721	* @param enmEffOpSize The effective operand size.
722	*/
723	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
724	{
725	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
726	uint64_t uOldPC = pCtx->rip + cbInstr;
727	if (!IEM_IS_CANONICAL(uNewPC))
728	return iemRaiseGeneralProtectionFault0(pIemCpu);
729
730	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
731	if (rcStrict != VINF_SUCCESS)
732	return rcStrict;
733
734	pCtx->rip = uNewPC;
735	return VINF_SUCCESS;
736
737	}
738
739
740	/**
741	* Implements a 64-bit relative call.
742	*
743	* @param offDisp The displacment offset.
744	*/
745	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
746	{
747	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
748	uint64_t uOldPC = pCtx->rip + cbInstr;
749	uint64_t uNewPC = uOldPC + offDisp;
750	if (!IEM_IS_CANONICAL(uNewPC))
751	return iemRaiseNotCanonical(pIemCpu);
752
753	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
754	if (rcStrict != VINF_SUCCESS)
755	return rcStrict;
756
757	pCtx->rip = uNewPC;
758	return VINF_SUCCESS;
759	}
760
761
762	/**
763	* Implements far jumps.
764	*
765	* @param uSel The selector.
766	* @param offSeg The segment offset.
767	* @param enmEffOpSize The effective operand size.
768	*/
769	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint32_t, offSeg, IEMMODE, enmEffOpSize)
770	{
771	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
772	NOREF(cbInstr);
773
774	/*
775	* Real mode and V8086 mode are easy. The only snag seems to be that
776	* CS.limit doesn't change and the limit check is done against the current
777	* limit.
778	*/
779	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
780	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
781	{
782	if (offSeg > pCtx->csHid.u32Limit)
783	return iemRaiseGeneralProtectionFault0(pIemCpu);
784
785	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
786	pCtx->rip = offSeg;
787	else
788	pCtx->rip = offSeg & UINT16_MAX;
789	pCtx->cs = uSel;
790	pCtx->csHid.u64Base = (uint32_t)uSel << 4;
791	/** @todo REM reset the accessed bit (see on jmp far16 after disabling
792	* PE. Check with VT-x and AMD-V. */
793	#ifdef IEM_VERIFICATION_MODE
794	pCtx->csHid.Attr.u &= ~X86_SEL_TYPE_ACCESSED;
795	#endif
796	return VINF_SUCCESS;
797	}
798
799	/*
800	* Protected mode. Need to parse the specified descriptor...
801	*/
802	if (!(uSel & (X86_SEL_MASK \| X86_SEL_LDT)))
803	{
804	Log(("jmpf %04x:%08x -> invalid selector, #GP(0)\n", uSel, offSeg));
805	return iemRaiseGeneralProtectionFault0(pIemCpu);
806	}
807
808	/* Fetch the descriptor. */
809	IEMSELDESC Desc;
810	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
811	if (rcStrict != VINF_SUCCESS)
812	return rcStrict;
813
814	/* Is it there? */
815	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
816	{
817	Log(("jmpf %04x:%08x -> segment not present\n", uSel, offSeg));
818	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
819	}
820
821	/*
822	* Deal with it according to its type.
823	*/
824	if (Desc.Legacy.Gen.u1DescType)
825	{
826	/* Only code segments. */
827	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
828	{
829	Log(("jmpf %04x:%08x -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
830	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
831	}
832
833	/* L vs D. */
834	if ( Desc.Legacy.Gen.u1Long
835	&& Desc.Legacy.Gen.u1DefBig
836	&& IEM_IS_LONG_MODE(pIemCpu))
837	{
838	Log(("jmpf %04x:%08x -> both L and D are set.\n", uSel, offSeg));
839	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
840	}
841
842	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
843	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
844	{
845	if (Desc.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
846	{
847	Log(("jmpf %04x:%08x -> DPL violation (conforming); DPL=%d CPL=%u\n",
848	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
849	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
850	}
851	}
852	else
853	{
854	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
855	{
856	Log(("jmpf %04x:%08x -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
857	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
858	}
859	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
860	{
861	Log(("jmpf %04x:%08x -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
862	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
863	}
864	}
865
866	/* Limit check. (Should alternatively check for non-canonical addresses
867	here, but that is ruled out by offSeg being 32-bit, right?) */
868	uint64_t u64Base;
869	uint32_t cbLimit = X86DESC_LIMIT(Desc.Legacy);
870	if (Desc.Legacy.Gen.u1Granularity)
871	cbLimit = (cbLimit << PAGE_SHIFT) \| PAGE_OFFSET_MASK;
872	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
873	u64Base = 0;
874	else
875	{
876	if (offSeg > cbLimit)
877	{
878	Log(("jmpf %04x:%08x -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
879	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
880	}
881	u64Base = X86DESC_BASE(Desc.Legacy);
882	}
883
884	/*
885	* Ok, everything checked out fine. Now set the accessed bit before
886	* committing the result into CS, CSHID and RIP.
887	*/
888	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
889	{
890	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
891	if (rcStrict != VINF_SUCCESS)
892	return rcStrict;
893	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
894	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
895	#endif
896	}
897
898	/* commit */
899	pCtx->rip = offSeg;
900	pCtx->cs = uSel & (X86_SEL_MASK \| X86_SEL_LDT);
901	pCtx->cs \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
902	pCtx->csHid.Attr.u = (Desc.Legacy.u >> (16+16+8)) & UINT32_C(0xf0ff);
903	pCtx->csHid.u32Limit = cbLimit;
904	pCtx->csHid.u64Base = u64Base;
905	/** @todo check if the hidden bits are loaded correctly for 64-bit
906	* mode. */
907	return VINF_SUCCESS;
908	}
909
910	/*
911	* System selector.
912	*/
913	if (IEM_IS_LONG_MODE(pIemCpu))
914	switch (Desc.Legacy.Gen.u4Type)
915	{
916	case AMD64_SEL_TYPE_SYS_LDT:
917	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
918	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
919	case AMD64_SEL_TYPE_SYS_CALL_GATE:
920	case AMD64_SEL_TYPE_SYS_INT_GATE:
921	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
922	/* Call various functions to do the work. */
923	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
924	default:
925	Log(("jmpf %04x:%08x -> wrong sys selector (64-bit): %d\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
926	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
927
928	}
929	switch (Desc.Legacy.Gen.u4Type)
930	{
931	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
932	case X86_SEL_TYPE_SYS_LDT:
933	case X86_SEL_TYPE_SYS_286_CALL_GATE:
934	case X86_SEL_TYPE_SYS_TASK_GATE:
935	case X86_SEL_TYPE_SYS_286_INT_GATE:
936	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
937	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
938	case X86_SEL_TYPE_SYS_386_CALL_GATE:
939	case X86_SEL_TYPE_SYS_386_INT_GATE:
940	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
941	/* Call various functions to do the work. */
942	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
943
944	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
945	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
946	/* Call various functions to do the work. */
947	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
948
949	default:
950	Log(("jmpf %04x:%08x -> wrong sys selector (32-bit): %d\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
951	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
952	}
953	}
954
955
956	/**
957	* Implements far calls.
958	*
959	* @param uSel The selector.
960	* @param offSeg The segment offset.
961	* @param enmOpSize The operand size (in case we need it).
962	*/
963	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmOpSize)
964	{
965	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
966	VBOXSTRICTRC rcStrict;
967	uint64_t uNewRsp;
968	void *pvRet;
969
970	/*
971	* Real mode and V8086 mode are easy. The only snag seems to be that
972	* CS.limit doesn't change and the limit check is done against the current
973	* limit.
974	*/
975	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
976	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
977	{
978	Assert(enmOpSize == IEMMODE_16BIT \|\| enmOpSize == IEMMODE_32BIT);
979
980	/* Check stack first - may #SS(0). */
981	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmOpSize == IEMMODE_32BIT ? 6 : 4,
982	&pvRet, &uNewRsp);
983	if (rcStrict != VINF_SUCCESS)
984	return rcStrict;
985
986	/* Check the target address range. */
987	if (offSeg > UINT32_MAX)
988	return iemRaiseGeneralProtectionFault0(pIemCpu);
989
990	/* Everything is fine, push the return address. */
991	if (enmOpSize == IEMMODE_16BIT)
992	{
993	((uint16_t *)pvRet)[0] = pCtx->ip + cbInstr;
994	((uint16_t *)pvRet)[1] = pCtx->cs;
995	}
996	else
997	{
998	((uint32_t *)pvRet)[0] = pCtx->eip + cbInstr;
999	((uint16_t *)pvRet)[3] = pCtx->cs;
1000	}
1001	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, pvRet, uNewRsp);
1002	if (rcStrict != VINF_SUCCESS)
1003	return rcStrict;
1004
1005	/* Branch. */
1006	pCtx->rip = offSeg;
1007	pCtx->cs = uSel;
1008	pCtx->csHid.u64Base = (uint32_t)uSel << 4;
1009	/** @todo Does REM reset the accessed bit here to? (See on jmp far16
1010	* after disabling PE.) Check with VT-x and AMD-V. */
1011	#ifdef IEM_VERIFICATION_MODE
1012	pCtx->csHid.Attr.u &= ~X86_SEL_TYPE_ACCESSED;
1013	#endif
1014	return VINF_SUCCESS;
1015	}
1016
1017	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1018	}
1019
1020
1021	/**
1022	* Implements retf.
1023	*
1024	* @param enmEffOpSize The effective operand size.
1025	* @param cbPop The amount of arguments to pop from the stack
1026	* (bytes).
1027	*/
1028	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1029	{
1030	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1031	VBOXSTRICTRC rcStrict;
1032	uint64_t uNewRsp;
1033	NOREF(cbInstr);
1034
1035	/*
1036	* Real mode and V8086 mode are easy.
1037	*/
1038	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1039	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1040	{
1041	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1042	uint16_t const *pu16Frame;
1043	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 8 : 4,
1044	(void const **)&pu16Frame, &uNewRsp);
1045	if (rcStrict != VINF_SUCCESS)
1046	return rcStrict;
1047	uint32_t uNewEip;
1048	uint16_t uNewCS;
1049	if (enmEffOpSize == IEMMODE_32BIT)
1050	{
1051	uNewCS = pu16Frame[2];
1052	uNewEip = RT_MAKE_U32(pu16Frame[0], pu16Frame[1]);
1053	}
1054	else
1055	{
1056	uNewCS = pu16Frame[1];
1057	uNewEip = pu16Frame[0];
1058	}
1059	/** @todo check how this is supposed to work if sp=0xfffe. */
1060
1061	/* Check the limit of the new EIP. */
1062	/** @todo Intel pseudo code only does the limit check for 16-bit
1063	* operands, AMD does not make any distinction. What is right? */
1064	if (uNewEip > pCtx->csHid.u32Limit)
1065	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1066
1067	/* commit the operation. */
1068	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, pu16Frame, uNewRsp);
1069	if (rcStrict != VINF_SUCCESS)
1070	return rcStrict;
1071	pCtx->rip = uNewEip;
1072	pCtx->cs = uNewCS;
1073	pCtx->csHid.u64Base = (uint32_t)uNewCS << 4;
1074	/** @todo do we load attribs and limit as well? */
1075	if (cbPop)
1076	iemRegAddToRsp(pCtx, cbPop);
1077	return VINF_SUCCESS;
1078	}
1079
1080	AssertFailed();
1081	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1082	}
1083
1084
1085	/**
1086	* Implements retn.
1087	*
1088	* We're doing this in C because of the \#GP that might be raised if the popped
1089	* program counter is out of bounds.
1090	*
1091	* @param enmEffOpSize The effective operand size.
1092	* @param cbPop The amount of arguments to pop from the stack
1093	* (bytes).
1094	*/
1095	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1096	{
1097	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1098	NOREF(cbInstr);
1099
1100	/* Fetch the RSP from the stack. */
1101	VBOXSTRICTRC rcStrict;
1102	RTUINT64U NewRip;
1103	RTUINT64U NewRsp;
1104	NewRsp.u = pCtx->rsp;
1105	switch (enmEffOpSize)
1106	{
1107	case IEMMODE_16BIT:
1108	NewRip.u = 0;
1109	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1110	break;
1111	case IEMMODE_32BIT:
1112	NewRip.u = 0;
1113	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1114	break;
1115	case IEMMODE_64BIT:
1116	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1117	break;
1118	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1119	}
1120	if (rcStrict != VINF_SUCCESS)
1121	return rcStrict;
1122
1123	/* Check the new RSP before loading it. */
1124	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
1125	* of it. The canonical test is performed here and for call. */
1126	if (enmEffOpSize != IEMMODE_64BIT)
1127	{
1128	if (NewRip.DWords.dw0 > pCtx->csHid.u32Limit)
1129	{
1130	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->csHid.u32Limit));
1131	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1132	}
1133	}
1134	else
1135	{
1136	if (!IEM_IS_CANONICAL(NewRip.u))
1137	{
1138	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1139	return iemRaiseNotCanonical(pIemCpu);
1140	}
1141	}
1142
1143	/* Commit it. */
1144	pCtx->rip = NewRip.u;
1145	pCtx->rsp = NewRsp.u;
1146	if (cbPop)
1147	iemRegAddToRsp(pCtx, cbPop);
1148
1149	return VINF_SUCCESS;
1150	}
1151
1152
1153	/**
1154	* Implements leave.
1155	*
1156	* We're doing this in C because messing with the stack registers is annoying
1157	* since they depends on SS attributes.
1158	*
1159	* @param enmEffOpSize The effective operand size.
1160	*/
1161	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1162	{
1163	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1164
1165	/* Calculate the intermediate RSP from RBP and the stack attributes. */
1166	RTUINT64U NewRsp;
1167	if (pCtx->ssHid.Attr.n.u1Long)
1168	{
1169	/** @todo Check that LEAVE actually preserve the high EBP bits. */
1170	NewRsp.u = pCtx->rsp;
1171	NewRsp.Words.w0 = pCtx->bp;
1172	}
1173	else if (pCtx->ssHid.Attr.n.u1DefBig)
1174	NewRsp.u = pCtx->ebp;
1175	else
1176	NewRsp.u = pCtx->rbp;
1177
1178	/* Pop RBP according to the operand size. */
1179	VBOXSTRICTRC rcStrict;
1180	RTUINT64U NewRbp;
1181	switch (enmEffOpSize)
1182	{
1183	case IEMMODE_16BIT:
1184	NewRbp.u = pCtx->rbp;
1185	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1186	break;
1187	case IEMMODE_32BIT:
1188	NewRbp.u = 0;
1189	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1190	break;
1191	case IEMMODE_64BIT:
1192	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1193	break;
1194	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1195	}
1196	if (rcStrict != VINF_SUCCESS)
1197	return rcStrict;
1198
1199
1200	/* Commit it. */
1201	pCtx->rbp = NewRbp.u;
1202	pCtx->rsp = NewRsp.u;
1203	iemRegAddToRip(pIemCpu, cbInstr);
1204
1205	return VINF_SUCCESS;
1206	}
1207
1208
1209	/**
1210	* Implements int3 and int XX.
1211	*
1212	* @param u8Int The interrupt vector number.
1213	* @param fIsBpInstr Is it the breakpoint instruction.
1214	*/
1215	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1216	{
1217	Assert(pIemCpu->cXcptRecursions == 0);
1218	return iemRaiseXcptOrInt(pIemCpu,
1219	cbInstr,
1220	u8Int,
1221	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
1222	0,
1223	0);
1224	}
1225
1226
1227	/**
1228	* Implements iret for real mode and V8086 mode.
1229	*
1230	* @param enmEffOpSize The effective operand size.
1231	*/
1232	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
1233	{
1234	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1235	NOREF(cbInstr);
1236
1237	/*
1238	* iret throws an exception if VME isn't enabled.
1239	*/
1240	if ( pCtx->eflags.Bits.u1VM
1241	&& !(pCtx->cr4 & X86_CR4_VME))
1242	return iemRaiseGeneralProtectionFault0(pIemCpu);
1243
1244	/*
1245	* Do the stack bits, but don't commit RSP before everything checks
1246	* out right.
1247	*/
1248	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1249	VBOXSTRICTRC rcStrict;
1250	RTCPTRUNION uFrame;
1251	uint16_t uNewCS;
1252	uint32_t uNewEip;
1253	uint32_t uNewFlags;
1254	uint64_t uNewRsp;
1255	if (enmEffOpSize == IEMMODE_32BIT)
1256	{
1257	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1258	if (rcStrict != VINF_SUCCESS)
1259	return rcStrict;
1260	uNewEip = uFrame.pu32[0];
1261	uNewCS = (uint16_t)uFrame.pu32[1];
1262	uNewFlags = uFrame.pu32[2];
1263	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1264	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
1265	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
1266	\| X86_EFL_ID;
1267	uNewFlags \|= pCtx->eflags.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
1268	}
1269	else
1270	{
1271	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1272	if (rcStrict != VINF_SUCCESS)
1273	return rcStrict;
1274	uNewEip = uFrame.pu16[0];
1275	uNewCS = uFrame.pu16[1];
1276	uNewFlags = uFrame.pu16[2];
1277	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1278	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
1279	uNewFlags \|= pCtx->eflags.u & (UINT32_C(0xffff0000) \| X86_EFL_1);
1280	/** @todo The intel pseudo code does not indicate what happens to
1281	* reserved flags. We just ignore them. */
1282	}
1283	/** @todo Check how this is supposed to work if sp=0xfffe. */
1284
1285	/*
1286	* Check the limit of the new EIP.
1287	*/
1288	/** @todo Only the AMD pseudo code check the limit here, what's
1289	* right? */
1290	if (uNewEip > pCtx->csHid.u32Limit)
1291	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1292
1293	/*
1294	* V8086 checks and flag adjustments
1295	*/
1296	if (pCtx->eflags.Bits.u1VM)
1297	{
1298	if (pCtx->eflags.Bits.u2IOPL == 3)
1299	{
1300	/* Preserve IOPL and clear RF. */
1301	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
1302	uNewFlags \|= pCtx->eflags.u & (X86_EFL_IOPL);
1303	}
1304	else if ( enmEffOpSize == IEMMODE_16BIT
1305	&& ( !(uNewFlags & X86_EFL_IF)
1306	\|\| !pCtx->eflags.Bits.u1VIP )
1307	&& !(uNewFlags & X86_EFL_TF) )
1308	{
1309	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
1310	uNewFlags &= ~X86_EFL_VIF;
1311	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
1312	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
1313	uNewFlags \|= pCtx->eflags.u & (X86_EFL_IF \| X86_EFL_IOPL);
1314	}
1315	else
1316	return iemRaiseGeneralProtectionFault0(pIemCpu);
1317	}
1318
1319	/*
1320	* Commit the operation.
1321	*/
1322	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
1323	if (rcStrict != VINF_SUCCESS)
1324	return rcStrict;
1325	pCtx->rip = uNewEip;
1326	pCtx->cs = uNewCS;
1327	pCtx->csHid.u64Base = (uint32_t)uNewCS << 4;
1328	/** @todo do we load attribs and limit as well? */
1329	Assert(uNewFlags & X86_EFL_1);
1330	pCtx->eflags.u = uNewFlags;
1331
1332	return VINF_SUCCESS;
1333	}
1334
1335
1336	/**
1337	* Implements iret for protected mode
1338	*
1339	* @param enmEffOpSize The effective operand size.
1340	*/
1341	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
1342	{
1343	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1344	NOREF(cbInstr);
1345
1346	/*
1347	* Nested task return.
1348	*/
1349	if (pCtx->eflags.Bits.u1NT)
1350	{
1351	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1352	}
1353	/*
1354	* Normal return.
1355	*/
1356	else
1357	{
1358	/*
1359	* Do the stack bits, but don't commit RSP before everything checks
1360	* out right.
1361	*/
1362	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1363	VBOXSTRICTRC rcStrict;
1364	RTCPTRUNION uFrame;
1365	uint16_t uNewCS;
1366	uint32_t uNewEip;
1367	uint32_t uNewFlags;
1368	uint64_t uNewRsp;
1369	if (enmEffOpSize == IEMMODE_32BIT)
1370	{
1371	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1372	if (rcStrict != VINF_SUCCESS)
1373	return rcStrict;
1374	uNewEip = uFrame.pu32[0];
1375	uNewCS = (uint16_t)uFrame.pu32[1];
1376	uNewFlags = uFrame.pu32[2];
1377	}
1378	else
1379	{
1380	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1381	if (rcStrict != VINF_SUCCESS)
1382	return rcStrict;
1383	uNewEip = uFrame.pu16[0];
1384	uNewCS = uFrame.pu16[1];
1385	uNewFlags = uFrame.pu16[2];
1386	}
1387	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
1388	if (rcStrict != VINF_SUCCESS)
1389	return rcStrict;
1390
1391	/*
1392	* What are we returning to?
1393	*/
1394	if ( (uNewFlags & X86_EFL_VM)
1395	&& pIemCpu->uCpl == 0)
1396	{
1397	/* V8086 mode! */
1398	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1399	}
1400	else
1401	{
1402	/*
1403	* Protected mode.
1404	*/
1405	/* Read the CS descriptor. */
1406	if (!(uNewCS & (X86_SEL_MASK \| X86_SEL_LDT)))
1407	{
1408	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCS, uNewEip));
1409	return iemRaiseGeneralProtectionFault0(pIemCpu);
1410	}
1411
1412	IEMSELDESC DescCS;
1413	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS);
1414	if (rcStrict != VINF_SUCCESS)
1415	{
1416	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCS, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
1417	return rcStrict;
1418	}
1419
1420	/* Must be a code descriptor. */
1421	if (!DescCS.Legacy.Gen.u1DescType)
1422	{
1423	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u4Type));
1424	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1425	}
1426	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1427	{
1428	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u4Type));
1429	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1430	}
1431
1432	/* Privilege checks. */
1433	if ((uNewCS & X86_SEL_RPL) < pIemCpu->uCpl)
1434	{
1435	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCS, uNewEip, pIemCpu->uCpl));
1436	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1437	}
1438	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1439	&& (uNewCS & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
1440	{
1441	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u2Dpl));
1442	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1443	}
1444
1445	/* Present? */
1446	if (!DescCS.Legacy.Gen.u1Present)
1447	{
1448	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCS, uNewEip));
1449	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCS);
1450	}
1451
1452	uint32_t cbLimitCS = X86DESC_LIMIT(DescCS.Legacy);
1453	if (DescCS.Legacy.Gen.u1Granularity)
1454	cbLimitCS = (cbLimitCS << PAGE_SHIFT) \| PAGE_OFFSET_MASK;
1455
1456	/*
1457	* Return to outer level?
1458	*/
1459	if ((uNewCS & X86_SEL_RPL) != pIemCpu->uCpl)
1460	{
1461	uint16_t uNewSS;
1462	uint32_t uNewESP;
1463	if (enmEffOpSize == IEMMODE_32BIT)
1464	{
1465	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
1466	if (rcStrict != VINF_SUCCESS)
1467	return rcStrict;
1468	uNewESP = uFrame.pu32[0];
1469	uNewSS = (uint16_t)uFrame.pu32[1];
1470	}
1471	else
1472	{
1473	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
1474	if (rcStrict != VINF_SUCCESS)
1475	return rcStrict;
1476	uNewESP = uFrame.pu16[0];
1477	uNewSS = uFrame.pu16[1];
1478	}
1479	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
1480	if (rcStrict != VINF_SUCCESS)
1481	return rcStrict;
1482
1483	/* Read the SS descriptor. */
1484	if (!(uNewSS & (X86_SEL_MASK \| X86_SEL_LDT)))
1485	{
1486	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCS, uNewEip, uNewSS, uNewESP));
1487	return iemRaiseGeneralProtectionFault0(pIemCpu);
1488	}
1489
1490	IEMSELDESC DescSS;
1491	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS);
1492	if (rcStrict != VINF_SUCCESS)
1493	{
1494	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
1495	uNewCS, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
1496	return rcStrict;
1497	}
1498
1499	/* Privilege checks. */
1500	if ((uNewSS & X86_SEL_RPL) != (uNewCS & X86_SEL_RPL))
1501	{
1502	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCS, uNewEip, uNewSS, uNewESP));
1503	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1504	}
1505	if (DescSS.Legacy.Gen.u2Dpl != (uNewCS & X86_SEL_RPL))
1506	{
1507	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
1508	uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
1509	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1510	}
1511
1512	/* Must be a writeable data segment descriptor. */
1513	if (!DescSS.Legacy.Gen.u1DescType)
1514	{
1515	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
1516	uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
1517	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1518	}
1519	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1520	{
1521	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
1522	uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
1523	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1524	}
1525
1526	/* Present? */
1527	if (!DescSS.Legacy.Gen.u1Present)
1528	{
1529	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCS, uNewEip, uNewSS, uNewESP));
1530	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
1531	}
1532
1533	uint32_t cbLimitSS = X86DESC_LIMIT(DescSS.Legacy);
1534	if (DescSS.Legacy.Gen.u1Granularity)
1535	cbLimitSS = (cbLimitSS << PAGE_SHIFT) \| PAGE_OFFSET_MASK;
1536
1537	/* Check EIP. */
1538	if (uNewEip > cbLimitCS)
1539	{
1540	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
1541	uNewCS, uNewEip, uNewSS, uNewESP, cbLimitCS));
1542	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCS);
1543	}
1544
1545	/*
1546	* Commit the changes, marking CS and SS accessed first since
1547	* that may fail.
1548	*/
1549	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1550	{
1551	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1552	if (rcStrict != VINF_SUCCESS)
1553	return rcStrict;
1554	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1555	}
1556	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1557	{
1558	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
1559	if (rcStrict != VINF_SUCCESS)
1560	return rcStrict;
1561	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1562	}
1563
1564	pCtx->rip = uNewEip;
1565	pCtx->cs = uNewCS;
1566	pCtx->csHid.Attr.u = X86DESC_GET_HID_ATTR(DescCS.Legacy);
1567	pCtx->csHid.u32Limit = cbLimitCS;
1568	pCtx->csHid.u64Base = X86DESC_BASE(DescCS.Legacy);
1569	pCtx->rsp = uNewESP;
1570	pCtx->ss = uNewSS;
1571	pCtx->ssHid.Attr.u = X86DESC_GET_HID_ATTR(DescSS.Legacy);
1572	pCtx->ssHid.u32Limit = cbLimitSS;
1573	pCtx->ssHid.u64Base = X86DESC_BASE(DescSS.Legacy);
1574
1575	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1576	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
1577	if (enmEffOpSize != IEMMODE_16BIT)
1578	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
1579	if (pIemCpu->uCpl == 0)
1580	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
1581	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
1582	fEFlagsMask \|= X86_EFL_IF;
1583	pCtx->eflags.u &= ~fEFlagsMask;
1584	pCtx->eflags.u \|= fEFlagsMask & uNewFlags;
1585
1586	pIemCpu->uCpl = uNewCS & X86_SEL_RPL;
1587	iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->ds, &pCtx->dsHid);
1588	iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->es, &pCtx->esHid);
1589	iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->fs, &pCtx->fsHid);
1590	iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->gs, &pCtx->gsHid);
1591
1592	/* Done! */
1593
1594	}
1595	/*
1596	* Return to the same level.
1597	*/
1598	else
1599	{
1600	/* Check EIP. */
1601	if (uNewEip > cbLimitCS)
1602	{
1603	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewEip, cbLimitCS));
1604	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCS);
1605	}
1606
1607	/*
1608	* Commit the changes, marking CS first since it may fail.
1609	*/
1610	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1611	{
1612	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1613	if (rcStrict != VINF_SUCCESS)
1614	return rcStrict;
1615	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1616	}
1617
1618	pCtx->rip = uNewEip;
1619	pCtx->cs = uNewCS;
1620	pCtx->csHid.Attr.u = X86DESC_GET_HID_ATTR(DescCS.Legacy);
1621	pCtx->csHid.u32Limit = cbLimitCS;
1622	pCtx->csHid.u64Base = X86DESC_BASE(DescCS.Legacy);
1623	pCtx->rsp = uNewRsp;
1624
1625	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1626	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
1627	if (enmEffOpSize != IEMMODE_16BIT)
1628	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
1629	if (pIemCpu->uCpl == 0)
1630	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
1631	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
1632	fEFlagsMask \|= X86_EFL_IF;
1633	pCtx->eflags.u &= ~fEFlagsMask;
1634	pCtx->eflags.u \|= fEFlagsMask & uNewFlags;
1635	/* Done! */
1636	}
1637	}
1638	}
1639
1640	return VINF_SUCCESS;
1641	}
1642
1643
1644	/**
1645	* Implements iret for long mode
1646	*
1647	* @param enmEffOpSize The effective operand size.
1648	*/
1649	IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
1650	{
1651	//PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1652	//VBOXSTRICTRC rcStrict;
1653	//uint64_t uNewRsp;
1654
1655	NOREF(pIemCpu); NOREF(cbInstr); NOREF(enmEffOpSize);
1656	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1657	}
1658
1659
1660	/**
1661	* Implements iret.
1662	*
1663	* @param enmEffOpSize The effective operand size.
1664	*/
1665	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
1666	{
1667	/*
1668	* Call a mode specific worker.
1669	*/
1670	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1671	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1672	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
1673	if (IEM_IS_LONG_MODE(pIemCpu))
1674	return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
1675
1676	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
1677	}
1678
1679
1680	/**
1681	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
1682	*
1683	* @param iSegReg The segment register number (valid).
1684	* @param uSel The new selector value.
1685	*/
1686	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
1687	{
1688	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
1689	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
1690	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
1691
1692	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
1693
1694	/*
1695	* Real mode and V8086 mode are easy.
1696	*/
1697	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1698	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1699	{
1700	*pSel = uSel;
1701	pHid->u64Base = (uint32_t)uSel << 4;
1702	/** @todo Does the CPU actually load limits and attributes in the
1703	* real/V8086 mode segment load case? It doesn't for CS in far
1704	* jumps... Affects unreal mode. */
1705	pHid->u32Limit = 0xffff;
1706	pHid->Attr.u = 0;
1707	pHid->Attr.n.u1Present = 1;
1708	pHid->Attr.n.u1DescType = 1;
1709	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
1710	? X86_SEL_TYPE_RW
1711	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
1712
1713	iemRegAddToRip(pIemCpu, cbInstr);
1714	return VINF_SUCCESS;
1715	}
1716
1717	/*
1718	* Protected mode.
1719	*
1720	* Check if it's a null segment selector value first, that's OK for DS, ES,
1721	* FS and GS. If not null, then we have to load and parse the descriptor.
1722	*/
1723	if (!(uSel & (X86_SEL_MASK \| X86_SEL_LDT)))
1724	{
1725	if (iSegReg == X86_SREG_SS)
1726	{
1727	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
1728	\|\| pIemCpu->uCpl != 0
1729	\|\| uSel != 0) /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? */
1730	{
1731	Log(("load sreg -> invalid stack selector, #GP(0)\n", uSel));
1732	return iemRaiseGeneralProtectionFault0(pIemCpu);
1733	}
1734
1735	/* In 64-bit kernel mode, the stack can be 0 because of the way
1736	interrupts are dispatched when in kernel ctx. Just load the
1737	selector value into the register and leave the hidden bits
1738	as is. */
1739	*pSel = uSel;
1740	iemRegAddToRip(pIemCpu, cbInstr);
1741	return VINF_SUCCESS;
1742	}
1743
1744	pSel = uSel; / Not RPL, remember :-) */
1745	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
1746	&& iSegReg != X86_SREG_FS
1747	&& iSegReg != X86_SREG_GS)
1748	{
1749	/** @todo figure out what this actually does, it works. Needs
1750	* testcase! */
1751	pHid->Attr.u = 0;
1752	pHid->Attr.n.u1Present = 1;
1753	pHid->Attr.n.u1Long = 1;
1754	pHid->Attr.n.u4Type = X86_SEL_TYPE_RW;
1755	pHid->Attr.n.u2Dpl = 3;
1756	pHid->u32Limit = 0;
1757	pHid->u64Base = 0;
1758	}
1759	else
1760	{
1761	pHid->Attr.u = 0;
1762	pHid->u32Limit = 0;
1763	pHid->u64Base = 0;
1764	}
1765	iemRegAddToRip(pIemCpu, cbInstr);
1766	return VINF_SUCCESS;
1767	}
1768
1769	/* Fetch the descriptor. */
1770	IEMSELDESC Desc;
1771	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
1772	if (rcStrict != VINF_SUCCESS)
1773	return rcStrict;
1774
1775	/* Check GPs first. */
1776	if (!Desc.Legacy.Gen.u1DescType)
1777	{
1778	Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
1779	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1780	}
1781	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
1782	{
1783	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1784	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1785	{
1786	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
1787	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1788	}
1789	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1790	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1791	{
1792	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
1793	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1794	}
1795	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
1796	{
1797	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
1798	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1799	}
1800	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
1801	{
1802	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1803	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1804	}
1805	}
1806	else
1807	{
1808	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
1809	{
1810	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
1811	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1812	}
1813	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
1814	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
1815	{
1816	#if 0 /* this is what intel says. */
1817	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
1818	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
1819	{
1820	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
1821	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
1822	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1823	}
1824	#else /* this is what makes more sense. */
1825	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
1826	{
1827	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
1828	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
1829	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1830	}
1831	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
1832	{
1833	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
1834	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
1835	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1836	}
1837	#endif
1838	}
1839	}
1840
1841	/* Is it there? */
1842	if (!Desc.Legacy.Gen.u1Present)
1843	{
1844	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
1845	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1846	}
1847
1848	/* The the base and limit. */
1849	uint64_t u64Base;
1850	uint32_t cbLimit = X86DESC_LIMIT(Desc.Legacy);
1851	if (Desc.Legacy.Gen.u1Granularity)
1852	cbLimit = (cbLimit << PAGE_SHIFT) \| PAGE_OFFSET_MASK;
1853
1854	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
1855	&& iSegReg < X86_SREG_FS)
1856	u64Base = 0;
1857	else
1858	u64Base = X86DESC_BASE(Desc.Legacy);
1859
1860	/*
1861	* Ok, everything checked out fine. Now set the accessed bit before
1862	* committing the result into the registers.
1863	*/
1864	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1865	{
1866	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1867	if (rcStrict != VINF_SUCCESS)
1868	return rcStrict;
1869	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1870	}
1871
1872	/* commit */
1873	*pSel = uSel;
1874	pHid->Attr.u = (Desc.Legacy.u >> (16+16+8)) & UINT32_C(0xf0ff); /** @todo do we have a define for 0xf0ff? */
1875	pHid->u32Limit = cbLimit;
1876	pHid->u64Base = u64Base;
1877
1878	/** @todo check if the hidden bits are loaded correctly for 64-bit
1879	* mode. */
1880
1881	iemRegAddToRip(pIemCpu, cbInstr);
1882	return VINF_SUCCESS;
1883	}
1884
1885
1886	/**
1887	* Implements 'mov SReg, r/m'.
1888	*
1889	* @param iSegReg The segment register number (valid).
1890	* @param uSel The new selector value.
1891	*/
1892	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
1893	{
1894	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1895	if (rcStrict == VINF_SUCCESS)
1896	{
1897	if (iSegReg == X86_SREG_SS)
1898	{
1899	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1900	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
1901	}
1902	}
1903	return rcStrict;
1904	}
1905
1906
1907	/**
1908	* Implements 'pop SReg'.
1909	*
1910	* @param iSegReg The segment register number (valid).
1911	* @param enmEffOpSize The efficient operand size (valid).
1912	*/
1913	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
1914	{
1915	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1916	VBOXSTRICTRC rcStrict;
1917
1918	/*
1919	* Read the selector off the stack and join paths with mov ss, reg.
1920	*/
1921	RTUINT64U TmpRsp;
1922	TmpRsp.u = pCtx->rsp;
1923	switch (enmEffOpSize)
1924	{
1925	case IEMMODE_16BIT:
1926	{
1927	uint16_t uSel;
1928	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
1929	if (rcStrict == VINF_SUCCESS)
1930	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1931	break;
1932	}
1933
1934	case IEMMODE_32BIT:
1935	{
1936	uint32_t u32Value;
1937	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
1938	if (rcStrict == VINF_SUCCESS)
1939	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
1940	break;
1941	}
1942
1943	case IEMMODE_64BIT:
1944	{
1945	uint64_t u64Value;
1946	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
1947	if (rcStrict == VINF_SUCCESS)
1948	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
1949	break;
1950	}
1951	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1952	}
1953
1954	/*
1955	* Commit the stack on success.
1956	*/
1957	if (rcStrict == VINF_SUCCESS)
1958	{
1959	pCtx->rsp = TmpRsp.u;
1960	if (iSegReg == X86_SREG_SS)
1961	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
1962	}
1963	return rcStrict;
1964	}
1965
1966
1967	/**
1968	* Implements lgs, lfs, les, lds & lss.
1969	*/
1970	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
1971	uint16_t, uSel,
1972	uint64_t, offSeg,
1973	uint8_t, iSegReg,
1974	uint8_t, iGReg,
1975	IEMMODE, enmEffOpSize)
1976	{
1977	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
1978	VBOXSTRICTRC rcStrict;
1979
1980	/*
1981	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
1982	*/
1983	/** @todo verify and test that mov, pop and lXs works the segment
1984	* register loading in the exact same way. */
1985	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1986	if (rcStrict == VINF_SUCCESS)
1987	{
1988	switch (enmEffOpSize)
1989	{
1990	case IEMMODE_16BIT:
1991	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
1992	break;
1993	case IEMMODE_32BIT:
1994	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
1995	break;
1996	case IEMMODE_64BIT:
1997	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
1998	break;
1999	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2000	}
2001	}
2002
2003	return rcStrict;
2004	}
2005
2006
2007	/**
2008	* Implements lgdt.
2009	*
2010	* @param iEffSeg The segment of the new ldtr contents
2011	* @param GCPtrEffSrc The address of the new ldtr contents.
2012	* @param enmEffOpSize The effective operand size.
2013	*/
2014	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2015	{
2016	if (pIemCpu->uCpl != 0)
2017	return iemRaiseGeneralProtectionFault0(pIemCpu);
2018	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2019
2020	/*
2021	* Fetch the limit and base address.
2022	*/
2023	uint16_t cbLimit;
2024	RTGCPTR GCPtrBase;
2025	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2026	if (rcStrict == VINF_SUCCESS)
2027	{
2028	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2029	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2030	else
2031	{
2032	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2033	pCtx->gdtr.cbGdt = cbLimit;
2034	pCtx->gdtr.pGdt = GCPtrBase;
2035	}
2036	if (rcStrict == VINF_SUCCESS)
2037	iemRegAddToRip(pIemCpu, cbInstr);
2038	}
2039	return rcStrict;
2040	}
2041
2042
2043	/**
2044	* Implements lidt.
2045	*
2046	* @param iEffSeg The segment of the new ldtr contents
2047	* @param GCPtrEffSrc The address of the new ldtr contents.
2048	* @param enmEffOpSize The effective operand size.
2049	*/
2050	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2051	{
2052	if (pIemCpu->uCpl != 0)
2053	return iemRaiseGeneralProtectionFault0(pIemCpu);
2054	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2055
2056	/*
2057	* Fetch the limit and base address.
2058	*/
2059	uint16_t cbLimit;
2060	RTGCPTR GCPtrBase;
2061	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2062	if (rcStrict == VINF_SUCCESS)
2063	{
2064	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2065	rcStrict = CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2066	else
2067	{
2068	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2069	pCtx->idtr.cbIdt = cbLimit;
2070	pCtx->idtr.pIdt = GCPtrBase;
2071	}
2072	if (rcStrict == VINF_SUCCESS)
2073	iemRegAddToRip(pIemCpu, cbInstr);
2074	}
2075	return rcStrict;
2076	}
2077
2078
2079	/**
2080	* Implements lldt.
2081	*
2082	* @param uNewLdt The new LDT selector value.
2083	*/
2084	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
2085	{
2086	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2087
2088	/*
2089	* Check preconditions.
2090	*/
2091	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2092	{
2093	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
2094	return iemRaiseUndefinedOpcode(pIemCpu);
2095	}
2096	if (pIemCpu->uCpl != 0)
2097	{
2098	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
2099	return iemRaiseGeneralProtectionFault0(pIemCpu);
2100	}
2101	if (uNewLdt & X86_SEL_LDT)
2102	{
2103	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
2104	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
2105	}
2106
2107	/*
2108	* Now, loading a NULL selector is easy.
2109	*/
2110	if ((uNewLdt & X86_SEL_MASK) == 0)
2111	{
2112	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
2113	/** @todo check if the actual value is loaded or if it's always 0. */
2114	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2115	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), 0);
2116	else
2117	pCtx->ldtr = 0;
2118	pCtx->ldtrHid.Attr.u = 0;
2119	pCtx->ldtrHid.u64Base = 0;
2120	pCtx->ldtrHid.u32Limit = 0;
2121
2122	iemRegAddToRip(pIemCpu, cbInstr);
2123	return VINF_SUCCESS;
2124	}
2125
2126	/*
2127	* Read the descriptor.
2128	*/
2129	IEMSELDESC Desc;
2130	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt);
2131	if (rcStrict != VINF_SUCCESS)
2132	return rcStrict;
2133
2134	/* Check GPs first. */
2135	if (Desc.Legacy.Gen.u1DescType)
2136	{
2137	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2138	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2139	}
2140	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
2141	{
2142	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2143	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2144	}
2145	uint64_t u64Base;
2146	if (!IEM_IS_LONG_MODE(pIemCpu))
2147	u64Base = X86DESC_BASE(Desc.Legacy);
2148	else
2149	{
2150	if (Desc.Long.Gen.u5Zeros)
2151	{
2152	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
2153	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2154	}
2155
2156	u64Base = X86DESC64_BASE(Desc.Long);
2157	if (!IEM_IS_CANONICAL(u64Base))
2158	{
2159	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
2160	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2161	}
2162	}
2163
2164	/* NP */
2165	if (!Desc.Legacy.Gen.u1Present)
2166	{
2167	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
2168	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
2169	}
2170
2171	/*
2172	* It checks out alright, update the registers.
2173	*/
2174	/** @todo check if the actual value is loaded or if the RPL is dropped */
2175	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2176	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK);
2177	else
2178	pCtx->ldtr = uNewLdt & X86_SEL_MASK;
2179	pCtx->ldtrHid.Attr.u = X86DESC_GET_HID_ATTR(Desc.Legacy);
2180	pCtx->ldtrHid.u32Limit = X86DESC_LIMIT(Desc.Legacy);
2181	pCtx->ldtrHid.u64Base = u64Base;
2182
2183	iemRegAddToRip(pIemCpu, cbInstr);
2184	return VINF_SUCCESS;
2185	}
2186
2187
2188	/**
2189	* Implements lldt.
2190	*
2191	* @param uNewLdt The new LDT selector value.
2192	*/
2193	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
2194	{
2195	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2196
2197	/*
2198	* Check preconditions.
2199	*/
2200	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2201	{
2202	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
2203	return iemRaiseUndefinedOpcode(pIemCpu);
2204	}
2205	if (pIemCpu->uCpl != 0)
2206	{
2207	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
2208	return iemRaiseGeneralProtectionFault0(pIemCpu);
2209	}
2210	if (uNewTr & X86_SEL_LDT)
2211	{
2212	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
2213	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
2214	}
2215	if ((uNewTr & X86_SEL_MASK) == 0)
2216	{
2217	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
2218	return iemRaiseGeneralProtectionFault0(pIemCpu);
2219	}
2220
2221	/*
2222	* Read the descriptor.
2223	*/
2224	IEMSELDESC Desc;
2225	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr);
2226	if (rcStrict != VINF_SUCCESS)
2227	return rcStrict;
2228
2229	/* Check GPs first. */
2230	if (Desc.Legacy.Gen.u1DescType)
2231	{
2232	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
2233	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2234	}
2235	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
2236	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
2237	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
2238	{
2239	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
2240	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2241	}
2242	uint64_t u64Base;
2243	if (!IEM_IS_LONG_MODE(pIemCpu))
2244	u64Base = X86DESC_BASE(Desc.Legacy);
2245	else
2246	{
2247	if (Desc.Long.Gen.u5Zeros)
2248	{
2249	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
2250	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2251	}
2252
2253	u64Base = X86DESC64_BASE(Desc.Long);
2254	if (!IEM_IS_CANONICAL(u64Base))
2255	{
2256	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
2257	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2258	}
2259	}
2260
2261	/* NP */
2262	if (!Desc.Legacy.Gen.u1Present)
2263	{
2264	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
2265	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
2266	}
2267
2268	/*
2269	* Set it busy.
2270	* Note! Intel says this should lock down the whole descriptor, but we'll
2271	* restrict our selves to 32-bit for now due to lack of inline
2272	* assembly and such.
2273	*/
2274	void *pvDesc;
2275	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
2276	if (rcStrict != VINF_SUCCESS)
2277	return rcStrict;
2278	switch ((uintptr_t)pvDesc & 3)
2279	{
2280	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
2281	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
2282	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 16); break;
2283	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 8); break;
2284	}
2285	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
2286	if (rcStrict != VINF_SUCCESS)
2287	return rcStrict;
2288	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2289
2290	/*
2291	* It checks out alright, update the registers.
2292	*/
2293	/** @todo check if the actual value is loaded or if the RPL is dropped */
2294	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2295	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK);
2296	else
2297	pCtx->tr = uNewTr & X86_SEL_MASK;
2298	pCtx->trHid.Attr.u = X86DESC_GET_HID_ATTR(Desc.Legacy);
2299	pCtx->trHid.u32Limit = X86DESC_LIMIT(Desc.Legacy);
2300	pCtx->trHid.u64Base = u64Base;
2301
2302	iemRegAddToRip(pIemCpu, cbInstr);
2303	return VINF_SUCCESS;
2304	}
2305
2306
2307	/**
2308	* Implements mov GReg,CRx.
2309	*
2310	* @param iGReg The general register to store the CRx value in.
2311	* @param iCrReg The CRx register to read (valid).
2312	*/
2313	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
2314	{
2315	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2316	if (pIemCpu->uCpl != 0)
2317	return iemRaiseGeneralProtectionFault0(pIemCpu);
2318	Assert(!pCtx->eflags.Bits.u1VM);
2319
2320	/* read it */
2321	uint64_t crX;
2322	switch (iCrReg)
2323	{
2324	case 0: crX = pCtx->cr0; break;
2325	case 2: crX = pCtx->cr2; break;
2326	case 3: crX = pCtx->cr3; break;
2327	case 4: crX = pCtx->cr4; break;
2328	case 8:
2329	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2330	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED); /** @todo implement CR8 reading and writing. */
2331	else
2332	crX = 0xff;
2333	break;
2334	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2335	}
2336
2337	/* store it */
2338	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2339	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
2340	else
2341	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
2342
2343	iemRegAddToRip(pIemCpu, cbInstr);
2344	return VINF_SUCCESS;
2345	}
2346
2347
2348	/**
2349	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
2350	*
2351	* @param iCrReg The CRx register to write (valid).
2352	* @param uNewCrX The new value.
2353	*/
2354	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
2355	{
2356	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2357	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2358	VBOXSTRICTRC rcStrict;
2359	int rc;
2360
2361	/*
2362	* Try store it.
2363	* Unfortunately, CPUM only does a tiny bit of the work.
2364	*/
2365	switch (iCrReg)
2366	{
2367	case 0:
2368	{
2369	/*
2370	* Perform checks.
2371	*/
2372	uint64_t const uOldCrX = pCtx->cr0;
2373	uNewCrX \|= X86_CR0_ET; /* hardcoded */
2374
2375	/* Check for reserved bits. */
2376	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
2377	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
2378	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
2379	if (uNewCrX & ~(uint64_t)fValid)
2380	{
2381	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
2382	return iemRaiseGeneralProtectionFault0(pIemCpu);
2383	}
2384
2385	/* Check for invalid combinations. */
2386	if ( (uNewCrX & X86_CR0_PG)
2387	&& !(uNewCrX & X86_CR0_PE) )
2388	{
2389	Log(("Trying to set CR0.PG without CR0.PE\n"));
2390	return iemRaiseGeneralProtectionFault0(pIemCpu);
2391	}
2392
2393	if ( !(uNewCrX & X86_CR0_CD)
2394	&& (uNewCrX & X86_CR0_NW) )
2395	{
2396	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
2397	return iemRaiseGeneralProtectionFault0(pIemCpu);
2398	}
2399
2400	/* Long mode consistency checks. */
2401	if ( (uNewCrX & X86_CR0_PG)
2402	&& !(uOldCrX & X86_CR0_PG)
2403	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
2404	{
2405	if (!(pCtx->cr4 & X86_CR4_PAE))
2406	{
2407	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
2408	return iemRaiseGeneralProtectionFault0(pIemCpu);
2409	}
2410	if (pCtx->csHid.Attr.n.u1Long)
2411	{
2412	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
2413	return iemRaiseGeneralProtectionFault0(pIemCpu);
2414	}
2415	}
2416
2417	/** @todo check reserved PDPTR bits as AMD states. */
2418
2419	/*
2420	* Change CR0.
2421	*/
2422	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2423	{
2424	rc = CPUMSetGuestCR0(pVCpu, uNewCrX);
2425	AssertRCSuccessReturn(rc, RT_FAILURE_NP(rc) ? rc : VERR_INTERNAL_ERROR_3);
2426	}
2427	else
2428	pCtx->cr0 = uNewCrX;
2429	Assert(pCtx->cr0 == uNewCrX);
2430
2431	/*
2432	* Change EFER.LMA if entering or leaving long mode.
2433	*/
2434	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
2435	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
2436	{
2437	uint64_t NewEFER = pCtx->msrEFER;
2438	if (uNewCrX & X86_CR0_PG)
2439	NewEFER \|= MSR_K6_EFER_LME;
2440	else
2441	NewEFER &= ~MSR_K6_EFER_LME;
2442
2443	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2444	CPUMSetGuestEFER(pVCpu, NewEFER);
2445	else
2446	pCtx->msrEFER = NewEFER;
2447	Assert(pCtx->msrEFER == NewEFER);
2448	}
2449
2450	/*
2451	* Inform PGM.
2452	*/
2453	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2454	{
2455	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2456	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
2457	{
2458	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
2459	AssertRCReturn(rc, rc);
2460	/* ignore informational status codes */
2461	}
2462	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
2463	/** @todo Status code management. */
2464	}
2465	else
2466	rcStrict = VINF_SUCCESS;
2467	break;
2468	}
2469
2470	/*
2471	* CR2 can be changed without any restrictions.
2472	*/
2473	case 2:
2474	pCtx->cr2 = uNewCrX;
2475	rcStrict = VINF_SUCCESS;
2476	break;
2477
2478	/*
2479	* CR3 is relatively simple, although AMD and Intel have different
2480	* accounts of how setting reserved bits are handled. We take intel's
2481	* word for the lower bits and AMD's for the high bits (63:52).
2482	*/
2483	/** @todo Testcase: Setting reserved bits in CR3, especially before
2484	* enabling paging. */
2485	case 3:
2486	{
2487	/* check / mask the value. */
2488	if (uNewCrX & UINT64_C(0xfff0000000000000))
2489	{
2490	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
2491	return iemRaiseGeneralProtectionFault0(pIemCpu);
2492	}
2493
2494	uint64_t fValid;
2495	if ( (pCtx->cr4 & X86_CR4_PAE)
2496	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
2497	fValid = UINT64_C(0x000ffffffffff014);
2498	else if (pCtx->cr4 & X86_CR4_PAE)
2499	fValid = UINT64_C(0xfffffff4);
2500	else
2501	fValid = UINT64_C(0xfffff014);
2502	if (uNewCrX & ~fValid)
2503	{
2504	Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
2505	uNewCrX, uNewCrX & ~fValid));
2506	uNewCrX &= fValid;
2507	}
2508
2509	/** @todo If we're in PAE mode we should check the PDPTRs for
2510	* invalid bits. */
2511
2512	/* Make the change. */
2513	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2514	{
2515	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
2516	AssertRCSuccessReturn(rc, rc);
2517	}
2518	else
2519	pCtx->cr3 = uNewCrX;
2520
2521	/* Inform PGM. */
2522	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2523	{
2524	if (pCtx->cr0 & X86_CR0_PG)
2525	{
2526	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr3 & X86_CR4_PGE));
2527	AssertRCReturn(rc, rc);
2528	/* ignore informational status codes */
2529	/** @todo status code management */
2530	}
2531	}
2532	rcStrict = VINF_SUCCESS;
2533	break;
2534	}
2535
2536	/*
2537	* CR4 is a bit more tedious as there are bits which cannot be cleared
2538	* under some circumstances and such.
2539	*/
2540	case 4:
2541	{
2542	uint64_t const uOldCrX = pCtx->cr0;
2543
2544	/* reserved bits */
2545	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
2546	\| X86_CR4_TSD \| X86_CR4_DE
2547	\| X86_CR4_PSE \| X86_CR4_PAE
2548	\| X86_CR4_MCE \| X86_CR4_PGE
2549	\| X86_CR4_PCE \| X86_CR4_OSFSXR
2550	\| X86_CR4_OSXMMEEXCPT;
2551	//if (xxx)
2552	// fValid \|= X86_CR4_VMXE;
2553	//if (xxx)
2554	// fValid \|= X86_CR4_OSXSAVE;
2555	if (uNewCrX & ~(uint64_t)fValid)
2556	{
2557	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
2558	return iemRaiseGeneralProtectionFault0(pIemCpu);
2559	}
2560
2561	/* long mode checks. */
2562	if ( (uOldCrX & X86_CR4_PAE)
2563	&& !(uNewCrX & X86_CR4_PAE)
2564	&& (pCtx->msrEFER & MSR_K6_EFER_LMA) )
2565	{
2566	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
2567	return iemRaiseGeneralProtectionFault0(pIemCpu);
2568	}
2569
2570
2571	/*
2572	* Change it.
2573	*/
2574	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2575	{
2576	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
2577	AssertRCSuccessReturn(rc, rc);
2578	}
2579	else
2580	pCtx->cr4 = uNewCrX;
2581	Assert(pCtx->cr4 == uNewCrX);
2582
2583	/*
2584	* Notify SELM and PGM.
2585	*/
2586	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2587	{
2588	/* SELM - VME may change things wrt to the TSS shadowing. */
2589	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
2590	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2591
2592	/* PGM - flushing and mode. */
2593	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2594	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
2595	{
2596	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
2597	AssertRCReturn(rc, rc);
2598	/* ignore informational status codes */
2599	}
2600	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
2601	/** @todo Status code management. */
2602	}
2603	else
2604	rcStrict = VINF_SUCCESS;
2605	break;
2606	}
2607
2608	/*
2609	* CR8 maps to the APIC TPR.
2610	*/
2611	case 8:
2612	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2613	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED); /** @todo implement CR8 reading and writing. */
2614	else
2615	rcStrict = VINF_SUCCESS;
2616	break;
2617
2618	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2619	}
2620
2621	/*
2622	* Advance the RIP on success.
2623	*/
2624	/** @todo Status code management. */
2625	if (rcStrict == VINF_SUCCESS)
2626	iemRegAddToRip(pIemCpu, cbInstr);
2627	return rcStrict;
2628
2629	}
2630
2631
2632	/**
2633	* Implements mov CRx,GReg.
2634	*
2635	* @param iCrReg The CRx register to write (valid).
2636	* @param iGReg The general register to load the DRx value from.
2637	*/
2638	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
2639	{
2640	if (pIemCpu->uCpl != 0)
2641	return iemRaiseGeneralProtectionFault0(pIemCpu);
2642	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2643
2644	/*
2645	* Read the new value from the source register and call common worker.
2646	*/
2647	uint64_t uNewCrX;
2648	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2649	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
2650	else
2651	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
2652	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
2653	}
2654
2655
2656	/**
2657	* Implements 'LMSW r/m16'
2658	*
2659	* @param u16NewMsw The new value.
2660	*/
2661	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
2662	{
2663	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2664
2665	if (pIemCpu->uCpl != 0)
2666	return iemRaiseGeneralProtectionFault0(pIemCpu);
2667	Assert(!pCtx->eflags.Bits.u1VM);
2668
2669	/*
2670	* Compose the new CR0 value and call common worker.
2671	*/
2672	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
2673	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
2674	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
2675	}
2676
2677
2678	/**
2679	* Implements 'CLTS'.
2680	*/
2681	IEM_CIMPL_DEF_0(iemCImpl_clts)
2682	{
2683	if (pIemCpu->uCpl != 0)
2684	return iemRaiseGeneralProtectionFault0(pIemCpu);
2685
2686	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2687	uint64_t uNewCr0 = pCtx->cr0;
2688	uNewCr0 &= ~X86_CR0_TS;
2689	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
2690	}
2691
2692
2693	/**
2694	* Implements mov GReg,DRx.
2695	*
2696	* @param iGReg The general register to store the DRx value in.
2697	* @param iDrReg The DRx register to read (0-7).
2698	*/
2699	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
2700	{
2701	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2702
2703	/*
2704	* Check preconditions.
2705	*/
2706
2707	/* Raise GPs. */
2708	if (pIemCpu->uCpl != 0)
2709	return iemRaiseGeneralProtectionFault0(pIemCpu);
2710	Assert(!pCtx->eflags.Bits.u1VM);
2711
2712	if ( (iDrReg == 4 \|\| iDrReg == 5)
2713	&& (pCtx->cr4 & X86_CR4_DE) )
2714	{
2715	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
2716	return iemRaiseGeneralProtectionFault0(pIemCpu);
2717	}
2718
2719	/* Raise #DB if general access detect is enabled. */
2720	if (pCtx->dr[7] & X86_DR7_GD)
2721	{
2722	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
2723	return iemRaiseDebugException(pIemCpu);
2724	}
2725
2726	/*
2727	* Read the debug register and store it in the specified general register.
2728	*/
2729	uint64_t drX;
2730	switch (iDrReg)
2731	{
2732	case 0: drX = pCtx->dr[0]; break;
2733	case 1: drX = pCtx->dr[1]; break;
2734	case 2: drX = pCtx->dr[2]; break;
2735	case 3: drX = pCtx->dr[3]; break;
2736	case 6:
2737	case 4:
2738	drX = pCtx->dr[6];
2739	drX &= ~RT_BIT_32(12);
2740	drX \|= UINT32_C(0xffff0ff0);
2741	break;
2742	case 7:
2743	case 5:
2744	drX = pCtx->dr[7];
2745	drX &= ~(RT_BIT_32(11) \| RT_BIT_32(12) \| RT_BIT_32(14) \| RT_BIT_32(15));
2746	drX \|= RT_BIT_32(10);
2747	break;
2748	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2749	}
2750
2751	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2752	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
2753	else
2754	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
2755
2756	iemRegAddToRip(pIemCpu, cbInstr);
2757	return VINF_SUCCESS;
2758	}
2759
2760
2761	/**
2762	* Implements mov DRx,GReg.
2763	*
2764	* @param iDrReg The DRx register to write (valid).
2765	* @param iGReg The general register to load the DRx value from.
2766	*/
2767	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
2768	{
2769	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2770
2771	/*
2772	* Check preconditions.
2773	*/
2774	if (pIemCpu->uCpl != 0)
2775	return iemRaiseGeneralProtectionFault0(pIemCpu);
2776	Assert(!pCtx->eflags.Bits.u1VM);
2777
2778	if ( (iDrReg == 4 \|\| iDrReg == 5)
2779	&& (pCtx->cr4 & X86_CR4_DE) )
2780	{
2781	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
2782	return iemRaiseGeneralProtectionFault0(pIemCpu);
2783	}
2784
2785	/* Raise #DB if general access detect is enabled. */
2786	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
2787	* \#GP? */
2788	if (pCtx->dr[7] & X86_DR7_GD)
2789	{
2790	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
2791	return iemRaiseDebugException(pIemCpu);
2792	}
2793
2794	/*
2795	* Read the new value from the source register.
2796	*/
2797	uint64_t uNewDrX;
2798	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2799	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
2800	else
2801	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
2802
2803	/*
2804	* Adjust it.
2805	*/
2806	switch (iDrReg)
2807	{
2808	case 0:
2809	case 1:
2810	case 2:
2811	case 3:
2812	/* nothing to adjust */
2813	break;
2814
2815	case 6:
2816	case 4:
2817	if (uNewDrX & UINT64_C(0xffffffff00000000))
2818	{
2819	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
2820	return iemRaiseGeneralProtectionFault0(pIemCpu);
2821	}
2822	uNewDrX &= ~RT_BIT_32(12);
2823	uNewDrX \|= UINT32_C(0xffff0ff0);
2824	break;
2825
2826	case 7:
2827	case 5:
2828	if (uNewDrX & UINT64_C(0xffffffff00000000))
2829	{
2830	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
2831	return iemRaiseGeneralProtectionFault0(pIemCpu);
2832	}
2833	uNewDrX &= ~(RT_BIT_32(11) \| RT_BIT_32(12) \| RT_BIT_32(14) \| RT_BIT_32(15));
2834	uNewDrX \|= RT_BIT_32(10);
2835	break;
2836
2837	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2838	}
2839
2840	/*
2841	* Do the actual setting.
2842	*/
2843	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2844	{
2845	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
2846	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
2847	}
2848	else
2849	pCtx->dr[iDrReg] = uNewDrX;
2850
2851	iemRegAddToRip(pIemCpu, cbInstr);
2852	return VINF_SUCCESS;
2853	}
2854
2855
2856	/**
2857	* Implements 'INVLPG m'.
2858	*
2859	* @param GCPtrPage The effective address of the page to invalidate.
2860	* @remarks Updates the RIP.
2861	*/
2862	IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
2863	{
2864	/* ring-0 only. */
2865	if (pIemCpu->uCpl != 0)
2866	return iemRaiseGeneralProtectionFault0(pIemCpu);
2867	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2868
2869	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
2870	iemRegAddToRip(pIemCpu, cbInstr);
2871
2872	if ( rc == VINF_SUCCESS
2873	\|\| rc == VINF_PGM_SYNC_CR3)
2874	return VINF_SUCCESS;
2875	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
2876	return rc;
2877	}
2878
2879
2880	/**
2881	* Implements RDTSC.
2882	*/
2883	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
2884	{
2885	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2886
2887	/*
2888	* Check preconditions.
2889	*/
2890	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
2891	return iemRaiseUndefinedOpcode(pIemCpu);
2892
2893	if ( (pCtx->cr4 & X86_CR4_TSD)
2894	&& pIemCpu->uCpl != 0)
2895	{
2896	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
2897	return iemRaiseGeneralProtectionFault0(pIemCpu);
2898	}
2899
2900	/*
2901	* Do the job.
2902	*/
2903	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
2904	pCtx->rax = (uint32_t)uTicks;
2905	pCtx->rdx = uTicks >> 32;
2906	#ifdef IEM_VERIFICATION_MODE
2907	pIemCpu->fIgnoreRaxRdx = true;
2908	#endif
2909
2910	iemRegAddToRip(pIemCpu, cbInstr);
2911	return VINF_SUCCESS;
2912	}
2913
2914
2915	/**
2916	* Implements RDMSR.
2917	*/
2918	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
2919	{
2920	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2921
2922	/*
2923	* Check preconditions.
2924	*/
2925	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
2926	return iemRaiseUndefinedOpcode(pIemCpu);
2927	if (pIemCpu->uCpl != 0)
2928	return iemRaiseGeneralProtectionFault0(pIemCpu);
2929
2930	/*
2931	* Do the job.
2932	*/
2933	RTUINT64U uValue;
2934	int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
2935	if (rc != VINF_SUCCESS)
2936	{
2937	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
2938	return iemRaiseGeneralProtectionFault0(pIemCpu);
2939	}
2940
2941	pCtx->rax = uValue.au32[0];
2942	pCtx->rdx = uValue.au32[1];
2943
2944	iemRegAddToRip(pIemCpu, cbInstr);
2945	return VINF_SUCCESS;
2946	}
2947
2948
2949	/**
2950	* Implements 'IN eAX, port'.
2951	*
2952	* @param u16Port The source port.
2953	* @param cbReg The register size.
2954	*/
2955	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
2956	{
2957	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2958
2959	/*
2960	* CPL check
2961	*/
2962	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
2963	if (rcStrict != VINF_SUCCESS)
2964	return rcStrict;
2965
2966	/*
2967	* Perform the I/O.
2968	*/
2969	uint32_t u32Value;
2970	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2971	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), u16Port, &u32Value, cbReg);
2972	else
2973	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
2974	if (IOM_SUCCESS(rcStrict))
2975	{
2976	switch (cbReg)
2977	{
2978	case 1: pCtx->al = (uint8_t)u32Value; break;
2979	case 2: pCtx->ax = (uint16_t)u32Value; break;
2980	case 4: pCtx->rax = u32Value; break;
2981	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
2982	}
2983	iemRegAddToRip(pIemCpu, cbInstr);
2984	pIemCpu->cPotentialExits++;
2985	}
2986	/** @todo massage rcStrict. */
2987	return rcStrict;
2988	}
2989
2990
2991	/**
2992	* Implements 'IN eAX, DX'.
2993	*
2994	* @param cbReg The register size.
2995	*/
2996	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
2997	{
2998	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
2999	}
3000
3001
3002	/**
3003	* Implements 'OUT port, eAX'.
3004	*
3005	* @param u16Port The destination port.
3006	* @param cbReg The register size.
3007	*/
3008	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
3009	{
3010	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3011
3012	/*
3013	* CPL check
3014	*/
3015	if ( (pCtx->cr0 & X86_CR0_PE)
3016	&& ( pIemCpu->uCpl > pCtx->eflags.Bits.u2IOPL
3017	\|\| pCtx->eflags.Bits.u1VM) )
3018	{
3019	/** @todo I/O port permission bitmap check */
3020	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
3021	}
3022
3023	/*
3024	* Perform the I/O.
3025	*/
3026	uint32_t u32Value;
3027	switch (cbReg)
3028	{
3029	case 1: u32Value = pCtx->al; break;
3030	case 2: u32Value = pCtx->ax; break;
3031	case 4: u32Value = pCtx->eax; break;
3032	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3033	}
3034	VBOXSTRICTRC rc;
3035	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3036	rc = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), u16Port, u32Value, cbReg);
3037	else
3038	rc = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
3039	if (IOM_SUCCESS(rc))
3040	{
3041	iemRegAddToRip(pIemCpu, cbInstr);
3042	pIemCpu->cPotentialExits++;
3043	/** @todo massage rc. */
3044	}
3045	return rc;
3046	}
3047
3048
3049	/**
3050	* Implements 'OUT DX, eAX'.
3051	*
3052	* @param cbReg The register size.
3053	*/
3054	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
3055	{
3056	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3057	}
3058
3059
3060	/**
3061	* Implements 'CLI'.
3062	*/
3063	IEM_CIMPL_DEF_0(iemCImpl_cli)
3064	{
3065	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3066
3067	if (pCtx->cr0 & X86_CR0_PE)
3068	{
3069	uint8_t const uIopl = pCtx->eflags.Bits.u2IOPL;
3070	if (!pCtx->eflags.Bits.u1VM)
3071	{
3072	if (pIemCpu->uCpl <= uIopl)
3073	pCtx->eflags.Bits.u1IF = 0;
3074	else if ( pIemCpu->uCpl == 3
3075	&& (pCtx->cr4 & X86_CR4_PVI) )
3076	pCtx->eflags.Bits.u1VIF = 0;
3077	else
3078	return iemRaiseGeneralProtectionFault0(pIemCpu);
3079	}
3080	/* V8086 */
3081	else if (uIopl == 3)
3082	pCtx->eflags.Bits.u1IF = 0;
3083	else if ( uIopl < 3
3084	&& (pCtx->cr4 & X86_CR4_VME) )
3085	pCtx->eflags.Bits.u1VIF = 0;
3086	else
3087	return iemRaiseGeneralProtectionFault0(pIemCpu);
3088	}
3089	/* real mode */
3090	else
3091	pCtx->eflags.Bits.u1IF = 0;
3092	iemRegAddToRip(pIemCpu, cbInstr);
3093	return VINF_SUCCESS;
3094	}
3095
3096
3097	/**
3098	* Implements 'STI'.
3099	*/
3100	IEM_CIMPL_DEF_0(iemCImpl_sti)
3101	{
3102	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3103
3104	if (pCtx->cr0 & X86_CR0_PE)
3105	{
3106	uint8_t const uIopl = pCtx->eflags.Bits.u2IOPL;
3107	if (!pCtx->eflags.Bits.u1VM)
3108	{
3109	if (pIemCpu->uCpl <= uIopl)
3110	pCtx->eflags.Bits.u1IF = 1;
3111	else if ( pIemCpu->uCpl == 3
3112	&& (pCtx->cr4 & X86_CR4_PVI)
3113	&& !pCtx->eflags.Bits.u1VIP )
3114	pCtx->eflags.Bits.u1VIF = 1;
3115	else
3116	return iemRaiseGeneralProtectionFault0(pIemCpu);
3117	}
3118	/* V8086 */
3119	else if (uIopl == 3)
3120	pCtx->eflags.Bits.u1IF = 1;
3121	else if ( uIopl < 3
3122	&& (pCtx->cr4 & X86_CR4_VME)
3123	&& !pCtx->eflags.Bits.u1VIP )
3124	pCtx->eflags.Bits.u1VIF = 1;
3125	else
3126	return iemRaiseGeneralProtectionFault0(pIemCpu);
3127	}
3128	/* real mode */
3129	else
3130	pCtx->eflags.Bits.u1IF = 1;
3131
3132	iemRegAddToRip(pIemCpu, cbInstr);
3133	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3134	return VINF_SUCCESS;
3135	}
3136
3137
3138	/**
3139	* Implements 'HLT'.
3140	*/
3141	IEM_CIMPL_DEF_0(iemCImpl_hlt)
3142	{
3143	if (pIemCpu->uCpl != 0)
3144	return iemRaiseGeneralProtectionFault0(pIemCpu);
3145	iemRegAddToRip(pIemCpu, cbInstr);
3146	return VINF_EM_HALT;
3147	}
3148
3149
3150	/**
3151	* Implements 'CPUID'.
3152	*/
3153	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
3154	{
3155	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3156
3157	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
3158	pCtx->rax &= UINT32_C(0xffffffff);
3159	pCtx->rbx &= UINT32_C(0xffffffff);
3160	pCtx->rcx &= UINT32_C(0xffffffff);
3161	pCtx->rdx &= UINT32_C(0xffffffff);
3162
3163	iemRegAddToRip(pIemCpu, cbInstr);
3164	return VINF_SUCCESS;
3165	}
3166
3167
3168	/**
3169	* Implements 'AAD'.
3170	*
3171	* @param enmEffOpSize The effective operand size.
3172	*/
3173	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
3174	{
3175	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3176
3177	uint16_t const ax = pCtx->ax;
3178	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
3179	pCtx->ax = al;
3180	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
3181	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
3182	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
3183
3184	iemRegAddToRip(pIemCpu, cbInstr);
3185	return VINF_SUCCESS;
3186	}
3187
3188
3189	/**
3190	* Implements 'AAM'.
3191	*
3192	* @param bImm The immediate operand. Cannot be 0.
3193	*/
3194	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
3195	{
3196	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3197	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
3198
3199	uint16_t const ax = pCtx->ax;
3200	uint8_t const al = (uint8_t)ax % bImm;
3201	uint8_t const ah = (uint8_t)ax / bImm;
3202	pCtx->ax = (ah << 8) + al;
3203	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
3204	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
3205	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
3206
3207	iemRegAddToRip(pIemCpu, cbInstr);
3208	return VINF_SUCCESS;
3209	}
3210
3211
3212
3213
3214	/*
3215	* Instantiate the various string operation combinations.
3216	*/
3217	#define OP_SIZE 8
3218	#define ADDR_SIZE 16
3219	#include "IEMAllCImplStrInstr.cpp.h"
3220	#define OP_SIZE 8
3221	#define ADDR_SIZE 32
3222	#include "IEMAllCImplStrInstr.cpp.h"
3223	#define OP_SIZE 8
3224	#define ADDR_SIZE 64
3225	#include "IEMAllCImplStrInstr.cpp.h"
3226
3227	#define OP_SIZE 16
3228	#define ADDR_SIZE 16
3229	#include "IEMAllCImplStrInstr.cpp.h"
3230	#define OP_SIZE 16
3231	#define ADDR_SIZE 32
3232	#include "IEMAllCImplStrInstr.cpp.h"
3233	#define OP_SIZE 16
3234	#define ADDR_SIZE 64
3235	#include "IEMAllCImplStrInstr.cpp.h"
3236
3237	#define OP_SIZE 32
3238	#define ADDR_SIZE 16
3239	#include "IEMAllCImplStrInstr.cpp.h"
3240	#define OP_SIZE 32
3241	#define ADDR_SIZE 32
3242	#include "IEMAllCImplStrInstr.cpp.h"
3243	#define OP_SIZE 32
3244	#define ADDR_SIZE 64
3245	#include "IEMAllCImplStrInstr.cpp.h"
3246
3247	#define OP_SIZE 64
3248	#define ADDR_SIZE 32
3249	#include "IEMAllCImplStrInstr.cpp.h"
3250	#define OP_SIZE 64
3251	#define ADDR_SIZE 64
3252	#include "IEMAllCImplStrInstr.cpp.h"
3253
3254
3255	/**
3256	* Implements 'FINIT' and 'FNINIT'.
3257	*
3258	* @param fCheckXcpts Whether to check for umasked pending exceptions or
3259	* not.
3260	*/
3261	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
3262	{
3263	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3264
3265	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
3266	return iemRaiseDeviceNotAvailable(pIemCpu);
3267
3268	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
3269	if (fCheckXcpts && TODO )
3270	return iemRaiseMathFault(pIemCpu);
3271	*/
3272
3273	if (iemFRegIsFxSaveFormat(pIemCpu))
3274	{
3275	pCtx->fpu.FCW = 0x37f;
3276	pCtx->fpu.FSW = 0;
3277	pCtx->fpu.FTW = 0x00; /* 0 - empty. */
3278	pCtx->fpu.FPUDP = 0;
3279	pCtx->fpu.DS = 0; //??
3280	pCtx->fpu.FPUIP = 0;
3281	pCtx->fpu.CS = 0; //??
3282	pCtx->fpu.FOP = 0;
3283	}
3284	else
3285	{
3286	PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
3287	pFpu->FCW = 0x37f;
3288	pFpu->FSW = 0;
3289	pFpu->FTW = 0xffff; /* 11 - empty */
3290	pFpu->FPUOO = 0; //??
3291	pFpu->FPUOS = 0; //??
3292	pFpu->FPUIP = 0;
3293	pFpu->CS = 0; //??
3294	pFpu->FOP = 0;
3295	}
3296
3297	iemRegAddToRip(pIemCpu, cbInstr);
3298	return VINF_SUCCESS;
3299	}
3300
3301
3302	/**
3303	* Implements 'FXSAVE'.
3304	*
3305	* @param iEffSeg The effective segment.
3306	* @param GCPtrEff The address of the image.
3307	* @param enmEffOpSize The operand size (only REX.W really matters).
3308	*/
3309	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
3310	{
3311	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3312
3313	/*
3314	* Raise exceptions.
3315	*/
3316	if (pCtx->cr0 & X86_CR0_EM)
3317	return iemRaiseUndefinedOpcode(pIemCpu);
3318	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
3319	return iemRaiseDeviceNotAvailable(pIemCpu);
3320	if (GCPtrEff & 15)
3321	{
3322	/** @todo CPU/VM detection possible! \#AC might not be signal for
3323	* all/any misalignment sizes, intel says its an implementation detail. */
3324	if ( (pCtx->cr0 & X86_CR0_AM)
3325	&& pCtx->eflags.Bits.u1AC
3326	&& pIemCpu->uCpl == 3)
3327	return iemRaiseAlignmentCheckException(pIemCpu);
3328	return iemRaiseGeneralProtectionFault0(pIemCpu);
3329	}
3330	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
3331
3332	/*
3333	* Access the memory.
3334	*/
3335	void *pvMem512;
3336	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W);
3337	if (rcStrict != VINF_SUCCESS)
3338	return rcStrict;
3339	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
3340
3341	/*
3342	* Store the registers.
3343	*/
3344	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
3345	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
3346
3347	/* common for all formats */
3348	pDst->FCW = pCtx->fpu.FCW;
3349	pDst->FSW = pCtx->fpu.FSW;
3350	pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
3351	pDst->FOP = pCtx->fpu.FOP;
3352	pDst->MXCSR = pCtx->fpu.MXCSR;
3353	pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
3354	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
3355	{
3356	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
3357	* them for now... */
3358	pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
3359	pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
3360	pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
3361	pDst->aRegs[i].au32[3] = 0;
3362	}
3363
3364	/* FPU IP, CS, DP and DS. */
3365	/** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
3366	* state information. :-/
3367	* Storing zeros now to prevent any potential leakage of host info. */
3368	pDst->FPUIP = 0;
3369	pDst->CS = 0;
3370	pDst->Rsrvd1 = 0;
3371	pDst->FPUDP = 0;
3372	pDst->DS = 0;
3373	pDst->Rsrvd2 = 0;
3374
3375	/* XMM registers. */
3376	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
3377	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
3378	\|\| pIemCpu->uCpl != 0)
3379	{
3380	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
3381	for (uint32_t i = 0; i < cXmmRegs; i++)
3382	pDst->aXMM[i] = pCtx->fpu.aXMM[i];
3383	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
3384	* right? */
3385	}
3386
3387	/*
3388	* Commit the memory.
3389	*/
3390	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W);
3391	if (rcStrict != VINF_SUCCESS)
3392	return rcStrict;
3393
3394	iemRegAddToRip(pIemCpu, cbInstr);
3395	return VINF_SUCCESS;
3396	}
3397
3398
3399	/**
3400	* Implements 'FXRSTOR'.
3401	*
3402	* @param GCPtrEff The address of the image.
3403	* @param enmEffOpSize The operand size (only REX.W really matters).
3404	*/
3405	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
3406	{
3407	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3408
3409	/*
3410	* Raise exceptions.
3411	*/
3412	if (pCtx->cr0 & X86_CR0_EM)
3413	return iemRaiseUndefinedOpcode(pIemCpu);
3414	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
3415	return iemRaiseDeviceNotAvailable(pIemCpu);
3416	if (GCPtrEff & 15)
3417	{
3418	/** @todo CPU/VM detection possible! \#AC might not be signal for
3419	* all/any misalignment sizes, intel says its an implementation detail. */
3420	if ( (pCtx->cr0 & X86_CR0_AM)
3421	&& pCtx->eflags.Bits.u1AC
3422	&& pIemCpu->uCpl == 3)
3423	return iemRaiseAlignmentCheckException(pIemCpu);
3424	return iemRaiseGeneralProtectionFault0(pIemCpu);
3425	}
3426	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
3427
3428	/*
3429	* Access the memory.
3430	*/
3431	void *pvMem512;
3432	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
3433	if (rcStrict != VINF_SUCCESS)
3434	return rcStrict;
3435	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
3436
3437	/*
3438	* Check the state for stuff which will GP(0).
3439	*/
3440	uint32_t const fMXCSR = pSrc->MXCSR;
3441	uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
3442	if (fMXCSR & ~fMXCSR_MASK)
3443	{
3444	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
3445	return iemRaiseGeneralProtectionFault0(pIemCpu);
3446	}
3447
3448	/*
3449	* Load the registers.
3450	*/
3451	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
3452	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
3453
3454	/* common for all formats */
3455	pCtx->fpu.FCW = pSrc->FCW;
3456	pCtx->fpu.FSW = pSrc->FSW;
3457	pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
3458	pCtx->fpu.FOP = pSrc->FOP;
3459	pCtx->fpu.MXCSR = fMXCSR;
3460	/* (MXCSR_MASK is read-only) */
3461	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
3462	{
3463	pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
3464	pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
3465	pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
3466	pCtx->fpu.aRegs[i].au32[3] = 0;
3467	}
3468
3469	/* FPU IP, CS, DP and DS. */
3470	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3471	{
3472	pCtx->fpu.FPUIP = pSrc->FPUIP;
3473	pCtx->fpu.CS = pSrc->CS;
3474	pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
3475	pCtx->fpu.FPUDP = pSrc->FPUDP;
3476	pCtx->fpu.DS = pSrc->DS;
3477	pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
3478	}
3479	else
3480	{
3481	pCtx->fpu.FPUIP = pSrc->FPUIP;
3482	pCtx->fpu.CS = pSrc->CS;
3483	pCtx->fpu.Rsrvd1 = 0;
3484	pCtx->fpu.FPUDP = pSrc->FPUDP;
3485	pCtx->fpu.DS = pSrc->DS;
3486	pCtx->fpu.Rsrvd2 = 0;
3487	}
3488
3489	/* XMM registers. */
3490	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
3491	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
3492	\|\| pIemCpu->uCpl != 0)
3493	{
3494	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
3495	for (uint32_t i = 0; i < cXmmRegs; i++)
3496	pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
3497	}
3498
3499	/*
3500	* Commit the memory.
3501	*/
3502	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
3503	if (rcStrict != VINF_SUCCESS)
3504	return rcStrict;
3505
3506	iemRegAddToRip(pIemCpu, cbInstr);
3507	return VINF_SUCCESS;
3508	}
3509
3510	/** @} */
3511

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 40022

Download in other formats: