IEMAllCImpl.cpp.h@ 42724

Last change on this file since 42724 was 42724, checked in by vboxsync, 12 years ago
IEM: Fixed a copy&past bug in fnsave wrt FTW. Added a verification/rem kludge to STI.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 157.2 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 42724 2012-08-09 19:02:36Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @name Misc Helpers
20	* @{
21	*/
22
23	/**
24	* Checks if we are allowed to access the given I/O port, raising the
25	* appropriate exceptions if we aren't (or if the I/O bitmap is not
26	* accessible).
27	*
28	* @returns Strict VBox status code.
29	*
30	* @param pIemCpu The IEM per CPU data.
31	* @param pCtx The register context.
32	* @param u16Port The port number.
33	* @param cbOperand The operand size.
34	*/
35	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
36	{
37	X86EFLAGS Efl;
38	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
39	if ( (pCtx->cr0 & X86_CR0_PE)
40	&& ( pIemCpu->uCpl > Efl.Bits.u2IOPL
41	\|\| Efl.Bits.u1VM) )
42	{
43	NOREF(u16Port); NOREF(cbOperand); /** @todo I/O port permission bitmap check */
44	IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement I/O permission bitmap\n"));
45	}
46	return VINF_SUCCESS;
47	}
48
49
50	#if 0
51	/**
52	* Calculates the parity bit.
53	*
54	* @returns true if the bit is set, false if not.
55	* @param u8Result The least significant byte of the result.
56	*/
57	static bool iemHlpCalcParityFlag(uint8_t u8Result)
58	{
59	/*
60	* Parity is set if the number of bits in the least significant byte of
61	* the result is even.
62	*/
63	uint8_t cBits;
64	cBits = u8Result & 1; /* 0 */
65	u8Result >>= 1;
66	cBits += u8Result & 1;
67	u8Result >>= 1;
68	cBits += u8Result & 1;
69	u8Result >>= 1;
70	cBits += u8Result & 1;
71	u8Result >>= 1;
72	cBits += u8Result & 1; /* 4 */
73	u8Result >>= 1;
74	cBits += u8Result & 1;
75	u8Result >>= 1;
76	cBits += u8Result & 1;
77	u8Result >>= 1;
78	cBits += u8Result & 1;
79	return !(cBits & 1);
80	}
81	#endif /* not used */
82
83
84	/**
85	* Updates the specified flags according to a 8-bit result.
86	*
87	* @param pIemCpu The IEM state of the calling EMT.
88	* @param u8Result The result to set the flags according to.
89	* @param fToUpdate The flags to update.
90	* @param fUndefined The flags that are specified as undefined.
91	*/
92	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
93	{
94	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
95
96	uint32_t fEFlags = pCtx->eflags.u;
97	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
98	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
99	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
100	}
101
102
103	/**
104	* Loads a NULL data selector into a selector register, both the hidden and
105	* visible parts, in protected mode.
106	*
107	* @param pSReg Pointer to the segment register.
108	* @param uRpl The RPL.
109	*/
110	static void iemHlpLoadNullDataSelectorProt(PCPUMSELREG pSReg, RTSEL uRpl)
111	{
112	/** @todo Testcase: write a testcase checking what happends when loading a NULL
113	* data selector in protected mode. */
114	pSReg->Sel = uRpl;
115	pSReg->ValidSel = uRpl;
116	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
117	pSReg->u64Base = 0;
118	pSReg->u32Limit = 0;
119	pSReg->Attr.u = 0;
120	}
121
122
123	/**
124	* Helper used by iret.
125	*
126	* @param uCpl The new CPL.
127	* @param pSReg Pointer to the segment register.
128	*/
129	static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
130	{
131	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
132	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
133	CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
134	#else
135	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
136	#endif
137
138	if ( uCpl > pSReg->Attr.n.u2Dpl
139	&& pSReg->Attr.n.u1DescType /* code or data, not system */
140	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
141	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
142	iemHlpLoadNullDataSelectorProt(pSReg, 0);
143	}
144
145
146	/**
147	* Indicates that we have modified the FPU state.
148	*
149	* @param pIemCpu The IEM state of the calling EMT.
150	*/
151	DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
152	{
153	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
154	}
155
156	/** @} */
157
158	/** @name C Implementations
159	* @{
160	*/
161
162	/**
163	* Implements a 16-bit popa.
164	*/
165	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
166	{
167	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
168	RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
169	RTGCPTR GCPtrLast = GCPtrStart + 15;
170	VBOXSTRICTRC rcStrict;
171
172	/*
173	* The docs are a bit hard to comprehend here, but it looks like we wrap
174	* around in real mode as long as none of the individual "popa" crosses the
175	* end of the stack segment. In protected mode we check the whole access
176	* in one go. For efficiency, only do the word-by-word thing if we're in
177	* danger of wrapping around.
178	*/
179	/** @todo do popa boundary / wrap-around checks. */
180	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
181	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
182	{
183	/* word-by-word */
184	RTUINT64U TmpRsp;
185	TmpRsp.u = pCtx->rsp;
186	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
187	if (rcStrict == VINF_SUCCESS)
188	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
189	if (rcStrict == VINF_SUCCESS)
190	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
191	if (rcStrict == VINF_SUCCESS)
192	{
193	iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
194	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
195	}
196	if (rcStrict == VINF_SUCCESS)
197	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
198	if (rcStrict == VINF_SUCCESS)
199	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
200	if (rcStrict == VINF_SUCCESS)
201	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
202	if (rcStrict == VINF_SUCCESS)
203	{
204	pCtx->rsp = TmpRsp.u;
205	iemRegAddToRip(pIemCpu, cbInstr);
206	}
207	}
208	else
209	{
210	uint16_t const *pa16Mem = NULL;
211	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
212	if (rcStrict == VINF_SUCCESS)
213	{
214	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
215	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
216	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
217	/* skip sp */
218	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
219	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
220	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
221	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
222	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
223	if (rcStrict == VINF_SUCCESS)
224	{
225	iemRegAddToRsp(pCtx, 16);
226	iemRegAddToRip(pIemCpu, cbInstr);
227	}
228	}
229	}
230	return rcStrict;
231	}
232
233
234	/**
235	* Implements a 32-bit popa.
236	*/
237	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
238	{
239	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
240	RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
241	RTGCPTR GCPtrLast = GCPtrStart + 31;
242	VBOXSTRICTRC rcStrict;
243
244	/*
245	* The docs are a bit hard to comprehend here, but it looks like we wrap
246	* around in real mode as long as none of the individual "popa" crosses the
247	* end of the stack segment. In protected mode we check the whole access
248	* in one go. For efficiency, only do the word-by-word thing if we're in
249	* danger of wrapping around.
250	*/
251	/** @todo do popa boundary / wrap-around checks. */
252	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
253	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
254	{
255	/* word-by-word */
256	RTUINT64U TmpRsp;
257	TmpRsp.u = pCtx->rsp;
258	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
259	if (rcStrict == VINF_SUCCESS)
260	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
261	if (rcStrict == VINF_SUCCESS)
262	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
263	if (rcStrict == VINF_SUCCESS)
264	{
265	iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
266	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
267	}
268	if (rcStrict == VINF_SUCCESS)
269	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
270	if (rcStrict == VINF_SUCCESS)
271	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
272	if (rcStrict == VINF_SUCCESS)
273	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
274	if (rcStrict == VINF_SUCCESS)
275	{
276	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
277	pCtx->rdi &= UINT32_MAX;
278	pCtx->rsi &= UINT32_MAX;
279	pCtx->rbp &= UINT32_MAX;
280	pCtx->rbx &= UINT32_MAX;
281	pCtx->rdx &= UINT32_MAX;
282	pCtx->rcx &= UINT32_MAX;
283	pCtx->rax &= UINT32_MAX;
284	#endif
285	pCtx->rsp = TmpRsp.u;
286	iemRegAddToRip(pIemCpu, cbInstr);
287	}
288	}
289	else
290	{
291	uint32_t const *pa32Mem;
292	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
293	if (rcStrict == VINF_SUCCESS)
294	{
295	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
296	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
297	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
298	/* skip esp */
299	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
300	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
301	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
302	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
303	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
304	if (rcStrict == VINF_SUCCESS)
305	{
306	iemRegAddToRsp(pCtx, 32);
307	iemRegAddToRip(pIemCpu, cbInstr);
308	}
309	}
310	}
311	return rcStrict;
312	}
313
314
315	/**
316	* Implements a 16-bit pusha.
317	*/
318	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
319	{
320	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
321	RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
322	RTGCPTR GCPtrBottom = GCPtrTop - 15;
323	VBOXSTRICTRC rcStrict;
324
325	/*
326	* The docs are a bit hard to comprehend here, but it looks like we wrap
327	* around in real mode as long as none of the individual "pushd" crosses the
328	* end of the stack segment. In protected mode we check the whole access
329	* in one go. For efficiency, only do the word-by-word thing if we're in
330	* danger of wrapping around.
331	*/
332	/** @todo do pusha boundary / wrap-around checks. */
333	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
334	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
335	{
336	/* word-by-word */
337	RTUINT64U TmpRsp;
338	TmpRsp.u = pCtx->rsp;
339	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
340	if (rcStrict == VINF_SUCCESS)
341	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
342	if (rcStrict == VINF_SUCCESS)
343	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
344	if (rcStrict == VINF_SUCCESS)
345	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
346	if (rcStrict == VINF_SUCCESS)
347	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
348	if (rcStrict == VINF_SUCCESS)
349	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
350	if (rcStrict == VINF_SUCCESS)
351	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
352	if (rcStrict == VINF_SUCCESS)
353	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
354	if (rcStrict == VINF_SUCCESS)
355	{
356	pCtx->rsp = TmpRsp.u;
357	iemRegAddToRip(pIemCpu, cbInstr);
358	}
359	}
360	else
361	{
362	GCPtrBottom--;
363	uint16_t *pa16Mem = NULL;
364	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
365	if (rcStrict == VINF_SUCCESS)
366	{
367	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
368	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
369	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
370	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
371	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
372	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
373	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
374	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
375	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
376	if (rcStrict == VINF_SUCCESS)
377	{
378	iemRegSubFromRsp(pCtx, 16);
379	iemRegAddToRip(pIemCpu, cbInstr);
380	}
381	}
382	}
383	return rcStrict;
384	}
385
386
387	/**
388	* Implements a 32-bit pusha.
389	*/
390	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
391	{
392	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
393	RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
394	RTGCPTR GCPtrBottom = GCPtrTop - 31;
395	VBOXSTRICTRC rcStrict;
396
397	/*
398	* The docs are a bit hard to comprehend here, but it looks like we wrap
399	* around in real mode as long as none of the individual "pusha" crosses the
400	* end of the stack segment. In protected mode we check the whole access
401	* in one go. For efficiency, only do the word-by-word thing if we're in
402	* danger of wrapping around.
403	*/
404	/** @todo do pusha boundary / wrap-around checks. */
405	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
406	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
407	{
408	/* word-by-word */
409	RTUINT64U TmpRsp;
410	TmpRsp.u = pCtx->rsp;
411	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
412	if (rcStrict == VINF_SUCCESS)
413	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
414	if (rcStrict == VINF_SUCCESS)
415	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
416	if (rcStrict == VINF_SUCCESS)
417	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
418	if (rcStrict == VINF_SUCCESS)
419	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
420	if (rcStrict == VINF_SUCCESS)
421	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
422	if (rcStrict == VINF_SUCCESS)
423	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
424	if (rcStrict == VINF_SUCCESS)
425	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
426	if (rcStrict == VINF_SUCCESS)
427	{
428	pCtx->rsp = TmpRsp.u;
429	iemRegAddToRip(pIemCpu, cbInstr);
430	}
431	}
432	else
433	{
434	GCPtrBottom--;
435	uint32_t *pa32Mem;
436	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
437	if (rcStrict == VINF_SUCCESS)
438	{
439	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
440	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
441	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
442	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
443	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
444	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
445	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
446	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
447	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
448	if (rcStrict == VINF_SUCCESS)
449	{
450	iemRegSubFromRsp(pCtx, 32);
451	iemRegAddToRip(pIemCpu, cbInstr);
452	}
453	}
454	}
455	return rcStrict;
456	}
457
458
459	/**
460	* Implements pushf.
461	*
462	*
463	* @param enmEffOpSize The effective operand size.
464	*/
465	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
466	{
467	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
468
469	/*
470	* If we're in V8086 mode some care is required (which is why we're in
471	* doing this in a C implementation).
472	*/
473	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
474	if ( (fEfl & X86_EFL_VM)
475	&& X86_EFL_GET_IOPL(fEfl) != 3 )
476	{
477	Assert(pCtx->cr0 & X86_CR0_PE);
478	if ( enmEffOpSize != IEMMODE_16BIT
479	\|\| !(pCtx->cr4 & X86_CR4_VME))
480	return iemRaiseGeneralProtectionFault0(pIemCpu);
481	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
482	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
483	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
484	}
485
486	/*
487	* Ok, clear RF and VM and push the flags.
488	*/
489	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
490
491	VBOXSTRICTRC rcStrict;
492	switch (enmEffOpSize)
493	{
494	case IEMMODE_16BIT:
495	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
496	break;
497	case IEMMODE_32BIT:
498	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
499	break;
500	case IEMMODE_64BIT:
501	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
502	break;
503	IEM_NOT_REACHED_DEFAULT_CASE_RET();
504	}
505	if (rcStrict != VINF_SUCCESS)
506	return rcStrict;
507
508	iemRegAddToRip(pIemCpu, cbInstr);
509	return VINF_SUCCESS;
510	}
511
512
513	/**
514	* Implements popf.
515	*
516	* @param enmEffOpSize The effective operand size.
517	*/
518	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
519	{
520	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
521	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
522	uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
523	VBOXSTRICTRC rcStrict;
524	uint32_t fEflNew;
525
526	/*
527	* V8086 is special as usual.
528	*/
529	if (fEflOld & X86_EFL_VM)
530	{
531	/*
532	* Almost anything goes if IOPL is 3.
533	*/
534	if (X86_EFL_GET_IOPL(fEflOld) == 3)
535	{
536	switch (enmEffOpSize)
537	{
538	case IEMMODE_16BIT:
539	{
540	uint16_t u16Value;
541	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
542	if (rcStrict != VINF_SUCCESS)
543	return rcStrict;
544	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
545	break;
546	}
547	case IEMMODE_32BIT:
548	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
549	if (rcStrict != VINF_SUCCESS)
550	return rcStrict;
551	break;
552	IEM_NOT_REACHED_DEFAULT_CASE_RET();
553	}
554
555	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
556	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
557	}
558	/*
559	* Interrupt flag virtualization with CR4.VME=1.
560	*/
561	else if ( enmEffOpSize == IEMMODE_16BIT
562	&& (pCtx->cr4 & X86_CR4_VME) )
563	{
564	uint16_t u16Value;
565	RTUINT64U TmpRsp;
566	TmpRsp.u = pCtx->rsp;
567	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
568	if (rcStrict != VINF_SUCCESS)
569	return rcStrict;
570
571	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
572	* or before? */
573	if ( ( (u16Value & X86_EFL_IF)
574	&& (fEflOld & X86_EFL_VIP))
575	\|\| (u16Value & X86_EFL_TF) )
576	return iemRaiseGeneralProtectionFault0(pIemCpu);
577
578	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
579	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
580	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
581	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
582
583	pCtx->rsp = TmpRsp.u;
584	}
585	else
586	return iemRaiseGeneralProtectionFault0(pIemCpu);
587
588	}
589	/*
590	* Not in V8086 mode.
591	*/
592	else
593	{
594	/* Pop the flags. */
595	switch (enmEffOpSize)
596	{
597	case IEMMODE_16BIT:
598	{
599	uint16_t u16Value;
600	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
601	if (rcStrict != VINF_SUCCESS)
602	return rcStrict;
603	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
604	break;
605	}
606	case IEMMODE_32BIT:
607	case IEMMODE_64BIT:
608	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
609	if (rcStrict != VINF_SUCCESS)
610	return rcStrict;
611	break;
612	IEM_NOT_REACHED_DEFAULT_CASE_RET();
613	}
614
615	/* Merge them with the current flags. */
616	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
617	\|\| pIemCpu->uCpl == 0)
618	{
619	fEflNew &= X86_EFL_POPF_BITS;
620	fEflNew \|= ~X86_EFL_POPF_BITS & fEflOld;
621	}
622	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
623	{
624	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
625	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
626	}
627	else
628	{
629	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
630	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
631	}
632	}
633
634	/*
635	* Commit the flags.
636	*/
637	Assert(fEflNew & RT_BIT_32(1));
638	IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
639	iemRegAddToRip(pIemCpu, cbInstr);
640
641	return VINF_SUCCESS;
642	}
643
644
645	/**
646	* Implements an indirect call.
647	*
648	* @param uNewPC The new program counter (RIP) value (loaded from the
649	* operand).
650	* @param enmEffOpSize The effective operand size.
651	*/
652	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
653	{
654	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
655	uint16_t uOldPC = pCtx->ip + cbInstr;
656	if (uNewPC > pCtx->cs.u32Limit)
657	return iemRaiseGeneralProtectionFault0(pIemCpu);
658
659	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
660	if (rcStrict != VINF_SUCCESS)
661	return rcStrict;
662
663	pCtx->rip = uNewPC;
664	return VINF_SUCCESS;
665
666	}
667
668
669	/**
670	* Implements a 16-bit relative call.
671	*
672	* @param offDisp The displacment offset.
673	*/
674	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
675	{
676	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
677	uint16_t uOldPC = pCtx->ip + cbInstr;
678	uint16_t uNewPC = uOldPC + offDisp;
679	if (uNewPC > pCtx->cs.u32Limit)
680	return iemRaiseGeneralProtectionFault0(pIemCpu);
681
682	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
683	if (rcStrict != VINF_SUCCESS)
684	return rcStrict;
685
686	pCtx->rip = uNewPC;
687	return VINF_SUCCESS;
688	}
689
690
691	/**
692	* Implements a 32-bit indirect call.
693	*
694	* @param uNewPC The new program counter (RIP) value (loaded from the
695	* operand).
696	* @param enmEffOpSize The effective operand size.
697	*/
698	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
699	{
700	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
701	uint32_t uOldPC = pCtx->eip + cbInstr;
702	if (uNewPC > pCtx->cs.u32Limit)
703	return iemRaiseGeneralProtectionFault0(pIemCpu);
704
705	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
706	if (rcStrict != VINF_SUCCESS)
707	return rcStrict;
708
709	pCtx->rip = uNewPC;
710	return VINF_SUCCESS;
711
712	}
713
714
715	/**
716	* Implements a 32-bit relative call.
717	*
718	* @param offDisp The displacment offset.
719	*/
720	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
721	{
722	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
723	uint32_t uOldPC = pCtx->eip + cbInstr;
724	uint32_t uNewPC = uOldPC + offDisp;
725	if (uNewPC > pCtx->cs.u32Limit)
726	return iemRaiseGeneralProtectionFault0(pIemCpu);
727
728	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
729	if (rcStrict != VINF_SUCCESS)
730	return rcStrict;
731
732	pCtx->rip = uNewPC;
733	return VINF_SUCCESS;
734	}
735
736
737	/**
738	* Implements a 64-bit indirect call.
739	*
740	* @param uNewPC The new program counter (RIP) value (loaded from the
741	* operand).
742	* @param enmEffOpSize The effective operand size.
743	*/
744	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
745	{
746	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
747	uint64_t uOldPC = pCtx->rip + cbInstr;
748	if (!IEM_IS_CANONICAL(uNewPC))
749	return iemRaiseGeneralProtectionFault0(pIemCpu);
750
751	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
752	if (rcStrict != VINF_SUCCESS)
753	return rcStrict;
754
755	pCtx->rip = uNewPC;
756	return VINF_SUCCESS;
757
758	}
759
760
761	/**
762	* Implements a 64-bit relative call.
763	*
764	* @param offDisp The displacment offset.
765	*/
766	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
767	{
768	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
769	uint64_t uOldPC = pCtx->rip + cbInstr;
770	uint64_t uNewPC = uOldPC + offDisp;
771	if (!IEM_IS_CANONICAL(uNewPC))
772	return iemRaiseNotCanonical(pIemCpu);
773
774	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
775	if (rcStrict != VINF_SUCCESS)
776	return rcStrict;
777
778	pCtx->rip = uNewPC;
779	return VINF_SUCCESS;
780	}
781
782
783	/**
784	* Implements far jumps and calls thru task segments (TSS).
785	*
786	* @param uSel The selector.
787	* @param enmBranch The kind of branching we're performing.
788	* @param enmEffOpSize The effective operand size.
789	* @param pDesc The descriptor corrsponding to @a uSel. The type is
790	* call gate.
791	*/
792	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
793	{
794	/* Call various functions to do the work. */
795	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
796	}
797
798
799	/**
800	* Implements far jumps and calls thru task gates.
801	*
802	* @param uSel The selector.
803	* @param enmBranch The kind of branching we're performing.
804	* @param enmEffOpSize The effective operand size.
805	* @param pDesc The descriptor corrsponding to @a uSel. The type is
806	* call gate.
807	*/
808	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
809	{
810	/* Call various functions to do the work. */
811	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
812	}
813
814
815	/**
816	* Implements far jumps and calls thru call gates.
817	*
818	* @param uSel The selector.
819	* @param enmBranch The kind of branching we're performing.
820	* @param enmEffOpSize The effective operand size.
821	* @param pDesc The descriptor corrsponding to @a uSel. The type is
822	* call gate.
823	*/
824	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
825	{
826	/* Call various functions to do the work. */
827	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
828	}
829
830
831	/**
832	* Implements far jumps and calls thru system selectors.
833	*
834	* @param uSel The selector.
835	* @param enmBranch The kind of branching we're performing.
836	* @param enmEffOpSize The effective operand size.
837	* @param pDesc The descriptor corrsponding to @a uSel.
838	*/
839	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
840	{
841	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
842	Assert((uSel & X86_SEL_MASK_OFF_RPL));
843
844	if (IEM_IS_LONG_MODE(pIemCpu))
845	switch (pDesc->Legacy.Gen.u4Type)
846	{
847	case AMD64_SEL_TYPE_SYS_CALL_GATE:
848	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
849
850	default:
851	case AMD64_SEL_TYPE_SYS_LDT:
852	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
853	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
854	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
855	case AMD64_SEL_TYPE_SYS_INT_GATE:
856	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
857	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
858
859	}
860
861	switch (pDesc->Legacy.Gen.u4Type)
862	{
863	case X86_SEL_TYPE_SYS_286_CALL_GATE:
864	case X86_SEL_TYPE_SYS_386_CALL_GATE:
865	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
866
867	case X86_SEL_TYPE_SYS_TASK_GATE:
868	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
869
870	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
871	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
872	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
873
874	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
875	Log(("branch %04x -> busy 286 TSS\n", uSel));
876	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
877
878	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
879	Log(("branch %04x -> busy 386 TSS\n", uSel));
880	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
881
882	default:
883	case X86_SEL_TYPE_SYS_LDT:
884	case X86_SEL_TYPE_SYS_286_INT_GATE:
885	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
886	case X86_SEL_TYPE_SYS_386_INT_GATE:
887	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
888	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
889	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
890	}
891	}
892
893
894	/**
895	* Implements far jumps.
896	*
897	* @param uSel The selector.
898	* @param offSeg The segment offset.
899	* @param enmEffOpSize The effective operand size.
900	*/
901	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
902	{
903	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
904	NOREF(cbInstr);
905	Assert(offSeg <= UINT32_MAX);
906
907	/*
908	* Real mode and V8086 mode are easy. The only snag seems to be that
909	* CS.limit doesn't change and the limit check is done against the current
910	* limit.
911	*/
912	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
913	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
914	{
915	if (offSeg > pCtx->cs.u32Limit)
916	return iemRaiseGeneralProtectionFault0(pIemCpu);
917
918	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
919	pCtx->rip = offSeg;
920	else
921	pCtx->rip = offSeg & UINT16_MAX;
922	pCtx->cs.Sel = uSel;
923	pCtx->cs.ValidSel = uSel;
924	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
925	pCtx->cs.u64Base = (uint32_t)uSel << 4;
926	return VINF_SUCCESS;
927	}
928
929	/*
930	* Protected mode. Need to parse the specified descriptor...
931	*/
932	if (!(uSel & X86_SEL_MASK_OFF_RPL))
933	{
934	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
935	return iemRaiseGeneralProtectionFault0(pIemCpu);
936	}
937
938	/* Fetch the descriptor. */
939	IEMSELDESC Desc;
940	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
941	if (rcStrict != VINF_SUCCESS)
942	return rcStrict;
943
944	/* Is it there? */
945	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
946	{
947	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
948	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
949	}
950
951	/*
952	* Deal with it according to its type. We do the standard code selectors
953	* here and dispatch the system selectors to worker functions.
954	*/
955	if (!Desc.Legacy.Gen.u1DescType)
956	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
957
958	/* Only code segments. */
959	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
960	{
961	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
962	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
963	}
964
965	/* L vs D. */
966	if ( Desc.Legacy.Gen.u1Long
967	&& Desc.Legacy.Gen.u1DefBig
968	&& IEM_IS_LONG_MODE(pIemCpu))
969	{
970	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
971	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
972	}
973
974	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
975	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
976	{
977	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
978	{
979	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
980	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
981	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
982	}
983	}
984	else
985	{
986	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
987	{
988	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
989	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
990	}
991	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
992	{
993	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
994	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
995	}
996	}
997
998	/* Chop the high bits if 16-bit (Intel says so). */
999	if (enmEffOpSize == IEMMODE_16BIT)
1000	offSeg &= UINT16_MAX;
1001
1002	/* Limit check. (Should alternatively check for non-canonical addresses
1003	here, but that is ruled out by offSeg being 32-bit, right?) */
1004	uint64_t u64Base;
1005	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1006	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1007	u64Base = 0;
1008	else
1009	{
1010	if (offSeg > cbLimit)
1011	{
1012	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1013	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1014	}
1015	u64Base = X86DESC_BASE(&Desc.Legacy);
1016	}
1017
1018	/*
1019	* Ok, everything checked out fine. Now set the accessed bit before
1020	* committing the result into CS, CSHID and RIP.
1021	*/
1022	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1023	{
1024	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1025	if (rcStrict != VINF_SUCCESS)
1026	return rcStrict;
1027	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
1028	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1029	#endif
1030	}
1031
1032	/* commit */
1033	pCtx->rip = offSeg;
1034	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1035	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1036	pCtx->cs.ValidSel = pCtx->cs.Sel;
1037	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1038	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1039	pCtx->cs.u32Limit = cbLimit;
1040	pCtx->cs.u64Base = u64Base;
1041	/** @todo check if the hidden bits are loaded correctly for 64-bit
1042	* mode. */
1043	return VINF_SUCCESS;
1044	}
1045
1046
1047	/**
1048	* Implements far calls.
1049	*
1050	* This very similar to iemCImpl_FarJmp.
1051	*
1052	* @param uSel The selector.
1053	* @param offSeg The segment offset.
1054	* @param enmEffOpSize The operand size (in case we need it).
1055	*/
1056	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1057	{
1058	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1059	VBOXSTRICTRC rcStrict;
1060	uint64_t uNewRsp;
1061	RTPTRUNION uPtrRet;
1062
1063	/*
1064	* Real mode and V8086 mode are easy. The only snag seems to be that
1065	* CS.limit doesn't change and the limit check is done against the current
1066	* limit.
1067	*/
1068	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1069	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1070	{
1071	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1072
1073	/* Check stack first - may #SS(0). */
1074	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1075	&uPtrRet.pv, &uNewRsp);
1076	if (rcStrict != VINF_SUCCESS)
1077	return rcStrict;
1078
1079	/* Check the target address range. */
1080	if (offSeg > UINT32_MAX)
1081	return iemRaiseGeneralProtectionFault0(pIemCpu);
1082
1083	/* Everything is fine, push the return address. */
1084	if (enmEffOpSize == IEMMODE_16BIT)
1085	{
1086	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1087	uPtrRet.pu16[1] = pCtx->cs.Sel;
1088	}
1089	else
1090	{
1091	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1092	uPtrRet.pu16[3] = pCtx->cs.Sel;
1093	}
1094	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1095	if (rcStrict != VINF_SUCCESS)
1096	return rcStrict;
1097
1098	/* Branch. */
1099	pCtx->rip = offSeg;
1100	pCtx->cs.Sel = uSel;
1101	pCtx->cs.ValidSel = uSel;
1102	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1103	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1104	return VINF_SUCCESS;
1105	}
1106
1107	/*
1108	* Protected mode. Need to parse the specified descriptor...
1109	*/
1110	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1111	{
1112	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1113	return iemRaiseGeneralProtectionFault0(pIemCpu);
1114	}
1115
1116	/* Fetch the descriptor. */
1117	IEMSELDESC Desc;
1118	rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
1119	if (rcStrict != VINF_SUCCESS)
1120	return rcStrict;
1121
1122	/*
1123	* Deal with it according to its type. We do the standard code selectors
1124	* here and dispatch the system selectors to worker functions.
1125	*/
1126	if (!Desc.Legacy.Gen.u1DescType)
1127	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1128
1129	/* Only code segments. */
1130	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1131	{
1132	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1133	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1134	}
1135
1136	/* L vs D. */
1137	if ( Desc.Legacy.Gen.u1Long
1138	&& Desc.Legacy.Gen.u1DefBig
1139	&& IEM_IS_LONG_MODE(pIemCpu))
1140	{
1141	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1142	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1143	}
1144
1145	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1146	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1147	{
1148	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1149	{
1150	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1151	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1152	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1153	}
1154	}
1155	else
1156	{
1157	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1158	{
1159	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1160	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1161	}
1162	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1163	{
1164	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1165	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1166	}
1167	}
1168
1169	/* Is it there? */
1170	if (!Desc.Legacy.Gen.u1Present)
1171	{
1172	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1173	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1174	}
1175
1176	/* Check stack first - may #SS(0). */
1177	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1178	* 16-bit code cause a two or four byte CS to be pushed? */
1179	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1180	enmEffOpSize == IEMMODE_64BIT ? 8+8
1181	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1182	&uPtrRet.pv, &uNewRsp);
1183	if (rcStrict != VINF_SUCCESS)
1184	return rcStrict;
1185
1186	/* Chop the high bits if 16-bit (Intel says so). */
1187	if (enmEffOpSize == IEMMODE_16BIT)
1188	offSeg &= UINT16_MAX;
1189
1190	/* Limit / canonical check. */
1191	uint64_t u64Base;
1192	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1193	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1194	{
1195	if (!IEM_IS_CANONICAL(offSeg))
1196	{
1197	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1198	return iemRaiseNotCanonical(pIemCpu);
1199	}
1200	u64Base = 0;
1201	}
1202	else
1203	{
1204	if (offSeg > cbLimit)
1205	{
1206	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1207	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1208	}
1209	u64Base = X86DESC_BASE(&Desc.Legacy);
1210	}
1211
1212	/*
1213	* Now set the accessed bit before
1214	* writing the return address to the stack and committing the result into
1215	* CS, CSHID and RIP.
1216	*/
1217	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1218	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1219	{
1220	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1221	if (rcStrict != VINF_SUCCESS)
1222	return rcStrict;
1223	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
1224	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1225	#endif
1226	}
1227
1228	/* stack */
1229	if (enmEffOpSize == IEMMODE_16BIT)
1230	{
1231	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1232	uPtrRet.pu16[1] = pCtx->cs.Sel;
1233	}
1234	else if (enmEffOpSize == IEMMODE_32BIT)
1235	{
1236	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1237	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1238	}
1239	else
1240	{
1241	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1242	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1243	}
1244	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1245	if (rcStrict != VINF_SUCCESS)
1246	return rcStrict;
1247
1248	/* commit */
1249	pCtx->rip = offSeg;
1250	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1251	pCtx->cs.Sel \|= pIemCpu->uCpl;
1252	pCtx->cs.ValidSel = pCtx->cs.Sel;
1253	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1254	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1255	pCtx->cs.u32Limit = cbLimit;
1256	pCtx->cs.u64Base = u64Base;
1257	/** @todo check if the hidden bits are loaded correctly for 64-bit
1258	* mode. */
1259	return VINF_SUCCESS;
1260	}
1261
1262
1263	/**
1264	* Implements retf.
1265	*
1266	* @param enmEffOpSize The effective operand size.
1267	* @param cbPop The amount of arguments to pop from the stack
1268	* (bytes).
1269	*/
1270	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1271	{
1272	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1273	VBOXSTRICTRC rcStrict;
1274	RTCPTRUNION uPtrFrame;
1275	uint64_t uNewRsp;
1276	uint64_t uNewRip;
1277	uint16_t uNewCs;
1278	NOREF(cbInstr);
1279
1280	/*
1281	* Read the stack values first.
1282	*/
1283	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1284	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1285	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1286	if (rcStrict != VINF_SUCCESS)
1287	return rcStrict;
1288	if (enmEffOpSize == IEMMODE_16BIT)
1289	{
1290	uNewRip = uPtrFrame.pu16[0];
1291	uNewCs = uPtrFrame.pu16[1];
1292	}
1293	else if (enmEffOpSize == IEMMODE_32BIT)
1294	{
1295	uNewRip = uPtrFrame.pu32[0];
1296	uNewCs = uPtrFrame.pu16[2];
1297	}
1298	else
1299	{
1300	uNewRip = uPtrFrame.pu64[0];
1301	uNewCs = uPtrFrame.pu16[4];
1302	}
1303
1304	/*
1305	* Real mode and V8086 mode are easy.
1306	*/
1307	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1308	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1309	{
1310	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1311	/** @todo check how this is supposed to work if sp=0xfffe. */
1312
1313	/* Check the limit of the new EIP. */
1314	/** @todo Intel pseudo code only does the limit check for 16-bit
1315	* operands, AMD does not make any distinction. What is right? */
1316	if (uNewRip > pCtx->cs.u32Limit)
1317	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1318
1319	/* commit the operation. */
1320	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1321	if (rcStrict != VINF_SUCCESS)
1322	return rcStrict;
1323	pCtx->rip = uNewRip;
1324	pCtx->cs.Sel = uNewCs;
1325	pCtx->cs.ValidSel = uNewCs;
1326	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1327	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1328	/** @todo do we load attribs and limit as well? */
1329	if (cbPop)
1330	iemRegAddToRsp(pCtx, cbPop);
1331	return VINF_SUCCESS;
1332	}
1333
1334	/*
1335	* Protected mode is complicated, of course.
1336	*/
1337	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1338	{
1339	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1340	return iemRaiseGeneralProtectionFault0(pIemCpu);
1341	}
1342
1343	/* Fetch the descriptor. */
1344	IEMSELDESC DescCs;
1345	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs);
1346	if (rcStrict != VINF_SUCCESS)
1347	return rcStrict;
1348
1349	/* Can only return to a code selector. */
1350	if ( !DescCs.Legacy.Gen.u1DescType
1351	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1352	{
1353	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1354	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1355	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1356	}
1357
1358	/* L vs D. */
1359	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1360	&& DescCs.Legacy.Gen.u1DefBig
1361	&& IEM_IS_LONG_MODE(pIemCpu))
1362	{
1363	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1364	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1365	}
1366
1367	/* DPL/RPL/CPL checks. */
1368	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1369	{
1370	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1371	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1372	}
1373
1374	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1375	{
1376	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1377	{
1378	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1379	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1380	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1381	}
1382	}
1383	else
1384	{
1385	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1386	{
1387	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1388	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1389	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1390	}
1391	}
1392
1393	/* Is it there? */
1394	if (!DescCs.Legacy.Gen.u1Present)
1395	{
1396	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1397	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1398	}
1399
1400	/*
1401	* Return to outer privilege? (We'll typically have entered via a call gate.)
1402	*/
1403	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1404	{
1405	/* Read the return pointer, it comes before the parameters. */
1406	RTCPTRUNION uPtrStack;
1407	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1408	if (rcStrict != VINF_SUCCESS)
1409	return rcStrict;
1410	uint16_t uNewOuterSs;
1411	uint64_t uNewOuterRsp;
1412	if (enmEffOpSize == IEMMODE_16BIT)
1413	{
1414	uNewOuterRsp = uPtrFrame.pu16[0];
1415	uNewOuterSs = uPtrFrame.pu16[1];
1416	}
1417	else if (enmEffOpSize == IEMMODE_32BIT)
1418	{
1419	uNewOuterRsp = uPtrFrame.pu32[0];
1420	uNewOuterSs = uPtrFrame.pu16[2];
1421	}
1422	else
1423	{
1424	uNewOuterRsp = uPtrFrame.pu64[0];
1425	uNewOuterSs = uPtrFrame.pu16[4];
1426	}
1427
1428	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1429	and read the selector. */
1430	IEMSELDESC DescSs;
1431	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1432	{
1433	if ( !DescCs.Legacy.Gen.u1Long
1434	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
1435	{
1436	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1437	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1438	return iemRaiseGeneralProtectionFault0(pIemCpu);
1439	}
1440	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1441	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1442	}
1443	else
1444	{
1445	/* Fetch the descriptor for the new stack segment. */
1446	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs);
1447	if (rcStrict != VINF_SUCCESS)
1448	return rcStrict;
1449	}
1450
1451	/* Check that RPL of stack and code selectors match. */
1452	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1453	{
1454	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1455	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1456	}
1457
1458	/* Must be a writable data segment. */
1459	if ( !DescSs.Legacy.Gen.u1DescType
1460	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1461	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1462	{
1463	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1464	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1465	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1466	}
1467
1468	/* L vs D. (Not mentioned by intel.) */
1469	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1470	&& DescSs.Legacy.Gen.u1DefBig
1471	&& IEM_IS_LONG_MODE(pIemCpu))
1472	{
1473	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1474	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1475	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1476	}
1477
1478	/* DPL/RPL/CPL checks. */
1479	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1480	{
1481	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1482	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1483	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1484	}
1485
1486	/* Is it there? */
1487	if (!DescSs.Legacy.Gen.u1Present)
1488	{
1489	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1490	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1491	}
1492
1493	/* Calc SS limit.*/
1494	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1495
1496	/* Is RIP canonical or within CS.limit? */
1497	uint64_t u64Base;
1498	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1499
1500	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1501	{
1502	if (!IEM_IS_CANONICAL(uNewRip))
1503	{
1504	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1505	return iemRaiseNotCanonical(pIemCpu);
1506	}
1507	u64Base = 0;
1508	}
1509	else
1510	{
1511	if (uNewRip > cbLimitCs)
1512	{
1513	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1514	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1515	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1516	}
1517	u64Base = X86DESC_BASE(&DescCs.Legacy);
1518	}
1519
1520	/*
1521	* Now set the accessed bit before
1522	* writing the return address to the stack and committing the result into
1523	* CS, CSHID and RIP.
1524	*/
1525	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1526	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1527	{
1528	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1529	if (rcStrict != VINF_SUCCESS)
1530	return rcStrict;
1531	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
1532	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1533	#endif
1534	}
1535	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1536	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1537	{
1538	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1539	if (rcStrict != VINF_SUCCESS)
1540	return rcStrict;
1541	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
1542	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1543	#endif
1544	}
1545
1546	/* commit */
1547	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1548	if (rcStrict != VINF_SUCCESS)
1549	return rcStrict;
1550	if (enmEffOpSize == IEMMODE_16BIT)
1551	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1552	else
1553	pCtx->rip = uNewRip;
1554	pCtx->cs.Sel = uNewCs;
1555	pCtx->cs.ValidSel = uNewCs;
1556	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1557	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1558	pCtx->cs.u32Limit = cbLimitCs;
1559	pCtx->cs.u64Base = u64Base;
1560	pCtx->rsp = uNewRsp;
1561	pCtx->ss.Sel = uNewOuterSs;
1562	pCtx->ss.ValidSel = uNewOuterSs;
1563	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1564	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1565	pCtx->ss.u32Limit = cbLimitSs;
1566	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1567	pCtx->ss.u64Base = 0;
1568	else
1569	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1570
1571	pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1572	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1573	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1574	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1575	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1576
1577	/** @todo check if the hidden bits are loaded correctly for 64-bit
1578	* mode. */
1579
1580	if (cbPop)
1581	iemRegAddToRsp(pCtx, cbPop);
1582
1583	/* Done! */
1584	}
1585	/*
1586	* Return to the same privilege level
1587	*/
1588	else
1589	{
1590	/* Limit / canonical check. */
1591	uint64_t u64Base;
1592	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1593
1594	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1595	{
1596	if (!IEM_IS_CANONICAL(uNewRip))
1597	{
1598	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1599	return iemRaiseNotCanonical(pIemCpu);
1600	}
1601	u64Base = 0;
1602	}
1603	else
1604	{
1605	if (uNewRip > cbLimitCs)
1606	{
1607	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1608	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1609	}
1610	u64Base = X86DESC_BASE(&DescCs.Legacy);
1611	}
1612
1613	/*
1614	* Now set the accessed bit before
1615	* writing the return address to the stack and committing the result into
1616	* CS, CSHID and RIP.
1617	*/
1618	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1619	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1620	{
1621	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1622	if (rcStrict != VINF_SUCCESS)
1623	return rcStrict;
1624	#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
1625	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1626	#endif
1627	}
1628
1629	/* commit */
1630	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1631	if (rcStrict != VINF_SUCCESS)
1632	return rcStrict;
1633	if (enmEffOpSize == IEMMODE_16BIT)
1634	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1635	else
1636	pCtx->rip = uNewRip;
1637	pCtx->cs.Sel = uNewCs;
1638	pCtx->cs.ValidSel = uNewCs;
1639	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1640	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1641	pCtx->cs.u32Limit = cbLimitCs;
1642	pCtx->cs.u64Base = u64Base;
1643	/** @todo check if the hidden bits are loaded correctly for 64-bit
1644	* mode. */
1645	if (cbPop)
1646	iemRegAddToRsp(pCtx, cbPop);
1647	}
1648	return VINF_SUCCESS;
1649	}
1650
1651
1652	/**
1653	* Implements retn.
1654	*
1655	* We're doing this in C because of the \#GP that might be raised if the popped
1656	* program counter is out of bounds.
1657	*
1658	* @param enmEffOpSize The effective operand size.
1659	* @param cbPop The amount of arguments to pop from the stack
1660	* (bytes).
1661	*/
1662	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1663	{
1664	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1665	NOREF(cbInstr);
1666
1667	/* Fetch the RSP from the stack. */
1668	VBOXSTRICTRC rcStrict;
1669	RTUINT64U NewRip;
1670	RTUINT64U NewRsp;
1671	NewRsp.u = pCtx->rsp;
1672	switch (enmEffOpSize)
1673	{
1674	case IEMMODE_16BIT:
1675	NewRip.u = 0;
1676	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1677	break;
1678	case IEMMODE_32BIT:
1679	NewRip.u = 0;
1680	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1681	break;
1682	case IEMMODE_64BIT:
1683	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1684	break;
1685	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1686	}
1687	if (rcStrict != VINF_SUCCESS)
1688	return rcStrict;
1689
1690	/* Check the new RSP before loading it. */
1691	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
1692	* of it. The canonical test is performed here and for call. */
1693	if (enmEffOpSize != IEMMODE_64BIT)
1694	{
1695	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1696	{
1697	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1698	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1699	}
1700	}
1701	else
1702	{
1703	if (!IEM_IS_CANONICAL(NewRip.u))
1704	{
1705	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1706	return iemRaiseNotCanonical(pIemCpu);
1707	}
1708	}
1709
1710	/* Commit it. */
1711	pCtx->rip = NewRip.u;
1712	pCtx->rsp = NewRsp.u;
1713	if (cbPop)
1714	iemRegAddToRsp(pCtx, cbPop);
1715
1716	return VINF_SUCCESS;
1717	}
1718
1719
1720	/**
1721	* Implements enter.
1722	*
1723	* We're doing this in C because the instruction is insane, even for the
1724	* u8NestingLevel=0 case dealing with the stack is tedious.
1725	*
1726	* @param enmEffOpSize The effective operand size.
1727	*/
1728	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1729	{
1730	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1731
1732	/* Push RBP, saving the old value in TmpRbp. */
1733	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1734	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1735	RTUINT64U NewRbp;
1736	VBOXSTRICTRC rcStrict;
1737	if (enmEffOpSize == IEMMODE_64BIT)
1738	{
1739	rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1740	NewRbp = NewRsp;
1741	}
1742	else if (pCtx->ss.Attr.n.u1DefBig)
1743	{
1744	rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1745	NewRbp = NewRsp;
1746	}
1747	else
1748	{
1749	rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1750	NewRbp = TmpRbp;
1751	NewRbp.Words.w0 = NewRsp.Words.w0;
1752	}
1753	if (rcStrict != VINF_SUCCESS)
1754	return rcStrict;
1755
1756	/* Copy the parameters (aka nesting levels by Intel). */
1757	cParameters &= 0x1f;
1758	if (cParameters > 0)
1759	{
1760	switch (enmEffOpSize)
1761	{
1762	case IEMMODE_16BIT:
1763	if (pCtx->ss.Attr.n.u1DefBig)
1764	TmpRbp.DWords.dw0 -= 2;
1765	else
1766	TmpRbp.Words.w0 -= 2;
1767	do
1768	{
1769	uint16_t u16Tmp;
1770	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1771	if (rcStrict != VINF_SUCCESS)
1772	break;
1773	rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1774	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1775	break;
1776
1777	case IEMMODE_32BIT:
1778	if (pCtx->ss.Attr.n.u1DefBig)
1779	TmpRbp.DWords.dw0 -= 4;
1780	else
1781	TmpRbp.Words.w0 -= 4;
1782	do
1783	{
1784	uint32_t u32Tmp;
1785	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1786	if (rcStrict != VINF_SUCCESS)
1787	break;
1788	rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1789	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1790	break;
1791
1792	case IEMMODE_64BIT:
1793	TmpRbp.u -= 8;
1794	do
1795	{
1796	uint64_t u64Tmp;
1797	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1798	if (rcStrict != VINF_SUCCESS)
1799	break;
1800	rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1801	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1802	break;
1803
1804	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1805	}
1806	if (rcStrict != VINF_SUCCESS)
1807	return VINF_SUCCESS;
1808
1809	/* Push the new RBP */
1810	if (enmEffOpSize == IEMMODE_64BIT)
1811	rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1812	else if (pCtx->ss.Attr.n.u1DefBig)
1813	rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1814	else
1815	rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1816	if (rcStrict != VINF_SUCCESS)
1817	return rcStrict;
1818
1819	}
1820
1821	/* Recalc RSP. */
1822	iemRegSubFromRspEx(&NewRsp, cbFrame, pCtx);
1823
1824	/** @todo Should probe write access at the new RSP according to AMD. */
1825
1826	/* Commit it. */
1827	pCtx->rbp = NewRbp.u;
1828	pCtx->rsp = NewRsp.u;
1829	iemRegAddToRip(pIemCpu, cbInstr);
1830
1831	return VINF_SUCCESS;
1832	}
1833
1834
1835
1836	/**
1837	* Implements leave.
1838	*
1839	* We're doing this in C because messing with the stack registers is annoying
1840	* since they depends on SS attributes.
1841	*
1842	* @param enmEffOpSize The effective operand size.
1843	*/
1844	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1845	{
1846	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1847
1848	/* Calculate the intermediate RSP from RBP and the stack attributes. */
1849	RTUINT64U NewRsp;
1850	if (pCtx->ss.Attr.n.u1Long)
1851	NewRsp.u = pCtx->rbp;
1852	else if (pCtx->ss.Attr.n.u1DefBig)
1853	NewRsp.u = pCtx->ebp;
1854	else
1855	{
1856	/** @todo Check that LEAVE actually preserve the high EBP bits. */
1857	NewRsp.u = pCtx->rsp;
1858	NewRsp.Words.w0 = pCtx->bp;
1859	}
1860
1861	/* Pop RBP according to the operand size. */
1862	VBOXSTRICTRC rcStrict;
1863	RTUINT64U NewRbp;
1864	switch (enmEffOpSize)
1865	{
1866	case IEMMODE_16BIT:
1867	NewRbp.u = pCtx->rbp;
1868	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1869	break;
1870	case IEMMODE_32BIT:
1871	NewRbp.u = 0;
1872	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1873	break;
1874	case IEMMODE_64BIT:
1875	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1876	break;
1877	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1878	}
1879	if (rcStrict != VINF_SUCCESS)
1880	return rcStrict;
1881
1882
1883	/* Commit it. */
1884	pCtx->rbp = NewRbp.u;
1885	pCtx->rsp = NewRsp.u;
1886	iemRegAddToRip(pIemCpu, cbInstr);
1887
1888	return VINF_SUCCESS;
1889	}
1890
1891
1892	/**
1893	* Implements int3 and int XX.
1894	*
1895	* @param u8Int The interrupt vector number.
1896	* @param fIsBpInstr Is it the breakpoint instruction.
1897	*/
1898	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1899	{
1900	Assert(pIemCpu->cXcptRecursions == 0);
1901	return iemRaiseXcptOrInt(pIemCpu,
1902	cbInstr,
1903	u8Int,
1904	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
1905	0,
1906	0);
1907	}
1908
1909
1910	/**
1911	* Implements iret for real mode and V8086 mode.
1912	*
1913	* @param enmEffOpSize The effective operand size.
1914	*/
1915	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
1916	{
1917	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1918	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
1919	X86EFLAGS Efl;
1920	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
1921	NOREF(cbInstr);
1922
1923	/*
1924	* iret throws an exception if VME isn't enabled.
1925	*/
1926	if ( pCtx->eflags.Bits.u1VM
1927	&& !(pCtx->cr4 & X86_CR4_VME))
1928	return iemRaiseGeneralProtectionFault0(pIemCpu);
1929
1930	/*
1931	* Do the stack bits, but don't commit RSP before everything checks
1932	* out right.
1933	*/
1934	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1935	VBOXSTRICTRC rcStrict;
1936	RTCPTRUNION uFrame;
1937	uint16_t uNewCs;
1938	uint32_t uNewEip;
1939	uint32_t uNewFlags;
1940	uint64_t uNewRsp;
1941	if (enmEffOpSize == IEMMODE_32BIT)
1942	{
1943	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1944	if (rcStrict != VINF_SUCCESS)
1945	return rcStrict;
1946	uNewEip = uFrame.pu32[0];
1947	uNewCs = (uint16_t)uFrame.pu32[1];
1948	uNewFlags = uFrame.pu32[2];
1949	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1950	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
1951	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
1952	\| X86_EFL_ID;
1953	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
1954	}
1955	else
1956	{
1957	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1958	if (rcStrict != VINF_SUCCESS)
1959	return rcStrict;
1960	uNewEip = uFrame.pu16[0];
1961	uNewCs = uFrame.pu16[1];
1962	uNewFlags = uFrame.pu16[2];
1963	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
1964	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
1965	uNewFlags \|= Efl.u & (UINT32_C(0xffff0000) \| X86_EFL_1);
1966	/** @todo The intel pseudo code does not indicate what happens to
1967	* reserved flags. We just ignore them. */
1968	}
1969	/** @todo Check how this is supposed to work if sp=0xfffe. */
1970
1971	/*
1972	* Check the limit of the new EIP.
1973	*/
1974	/** @todo Only the AMD pseudo code check the limit here, what's
1975	* right? */
1976	if (uNewEip > pCtx->cs.u32Limit)
1977	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1978
1979	/*
1980	* V8086 checks and flag adjustments
1981	*/
1982	if (Efl.Bits.u1VM)
1983	{
1984	if (Efl.Bits.u2IOPL == 3)
1985	{
1986	/* Preserve IOPL and clear RF. */
1987	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
1988	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
1989	}
1990	else if ( enmEffOpSize == IEMMODE_16BIT
1991	&& ( !(uNewFlags & X86_EFL_IF)
1992	\|\| !Efl.Bits.u1VIP )
1993	&& !(uNewFlags & X86_EFL_TF) )
1994	{
1995	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
1996	uNewFlags &= ~X86_EFL_VIF;
1997	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
1998	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
1999	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2000	}
2001	else
2002	return iemRaiseGeneralProtectionFault0(pIemCpu);
2003	}
2004
2005	/*
2006	* Commit the operation.
2007	*/
2008	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2009	if (rcStrict != VINF_SUCCESS)
2010	return rcStrict;
2011	pCtx->rip = uNewEip;
2012	pCtx->cs.Sel = uNewCs;
2013	pCtx->cs.ValidSel = uNewCs;
2014	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2015	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2016	/** @todo do we load attribs and limit as well? */
2017	Assert(uNewFlags & X86_EFL_1);
2018	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2019
2020	return VINF_SUCCESS;
2021	}
2022
2023
2024	/**
2025	* Loads a segment register when entering V8086 mode.
2026	*
2027	* @param pSReg The segment register.
2028	* @param uSeg The segment to load.
2029	*/
2030	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2031	{
2032	pSReg->Sel = uSeg;
2033	pSReg->ValidSel = uSeg;
2034	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2035	pSReg->u64Base = (uint32_t)uSeg << 4;
2036	pSReg->u32Limit = 0xffff;
2037	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2038	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2039	* IRET'ing to V8086. */
2040	}
2041
2042
2043	/**
2044	* Implements iret for protected mode returning to V8086 mode.
2045	*
2046	* @param pCtx Pointer to the CPU context.
2047	* @param uNewEip The new EIP.
2048	* @param uNewCs The new CS.
2049	* @param uNewFlags The new EFLAGS.
2050	* @param uNewRsp The RSP after the initial IRET frame.
2051	*/
2052	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2053	uint32_t, uNewFlags, uint64_t, uNewRsp)
2054	{
2055	#if 0
2056	if (!LogIs6Enabled())
2057	{
2058	RTLogGroupSettings(NULL, "iem.eo.l6.l2");
2059	RTLogFlags(NULL, "enabled");
2060	return VERR_IEM_RESTART_INSTRUCTION;
2061	}
2062	#endif
2063
2064	/*
2065	* Pop the V8086 specific frame bits off the stack.
2066	*/
2067	VBOXSTRICTRC rcStrict;
2068	RTCPTRUNION uFrame;
2069	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2070	if (rcStrict != VINF_SUCCESS)
2071	return rcStrict;
2072	uint32_t uNewEsp = uFrame.pu32[0];
2073	uint16_t uNewSs = uFrame.pu32[1];
2074	uint16_t uNewEs = uFrame.pu32[2];
2075	uint16_t uNewDs = uFrame.pu32[3];
2076	uint16_t uNewFs = uFrame.pu32[4];
2077	uint16_t uNewGs = uFrame.pu32[5];
2078	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2079	if (rcStrict != VINF_SUCCESS)
2080	return rcStrict;
2081
2082	/*
2083	* Commit the operation.
2084	*/
2085	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2086	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2087	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2088	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2089	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2090	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2091	pCtx->rip = uNewEip;
2092	pCtx->rsp = uNewEsp;
2093	pCtx->rflags.u = uNewFlags;
2094	pIemCpu->uCpl = 3;
2095
2096	return VINF_SUCCESS;
2097	}
2098
2099
2100	/**
2101	* Implements iret for protected mode returning via a nested task.
2102	*
2103	* @param enmEffOpSize The effective operand size.
2104	*/
2105	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2106	{
2107	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2108	}
2109
2110
2111	/**
2112	* Implements iret for protected mode
2113	*
2114	* @param enmEffOpSize The effective operand size.
2115	*/
2116	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2117	{
2118	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2119	NOREF(cbInstr);
2120
2121	/*
2122	* Nested task return.
2123	*/
2124	if (pCtx->eflags.Bits.u1NT)
2125	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2126
2127	/*
2128	* Normal return.
2129	*
2130	* Do the stack bits, but don't commit RSP before everything checks
2131	* out right.
2132	*/
2133	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2134	VBOXSTRICTRC rcStrict;
2135	RTCPTRUNION uFrame;
2136	uint16_t uNewCs;
2137	uint32_t uNewEip;
2138	uint32_t uNewFlags;
2139	uint64_t uNewRsp;
2140	if (enmEffOpSize == IEMMODE_32BIT)
2141	{
2142	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2143	if (rcStrict != VINF_SUCCESS)
2144	return rcStrict;
2145	uNewEip = uFrame.pu32[0];
2146	uNewCs = (uint16_t)uFrame.pu32[1];
2147	uNewFlags = uFrame.pu32[2];
2148	}
2149	else
2150	{
2151	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2152	if (rcStrict != VINF_SUCCESS)
2153	return rcStrict;
2154	uNewEip = uFrame.pu16[0];
2155	uNewCs = uFrame.pu16[1];
2156	uNewFlags = uFrame.pu16[2];
2157	}
2158	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2159	if (rcStrict != VINF_SUCCESS)
2160	return rcStrict;
2161
2162	/*
2163	* We're hopefully not returning to V8086 mode...
2164	*/
2165	if ( (uNewFlags & X86_EFL_VM)
2166	&& pIemCpu->uCpl == 0)
2167	{
2168	Assert(enmEffOpSize == IEMMODE_32BIT);
2169	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2170	}
2171
2172	/*
2173	* Protected mode.
2174	*/
2175	/* Read the CS descriptor. */
2176	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2177	{
2178	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2179	return iemRaiseGeneralProtectionFault0(pIemCpu);
2180	}
2181
2182	IEMSELDESC DescCS;
2183	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs);
2184	if (rcStrict != VINF_SUCCESS)
2185	{
2186	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2187	return rcStrict;
2188	}
2189
2190	/* Must be a code descriptor. */
2191	if (!DescCS.Legacy.Gen.u1DescType)
2192	{
2193	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2194	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2195	}
2196	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2197	{
2198	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2199	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2200	}
2201
2202	/* Privilege checks. */
2203	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2204	{
2205	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2206	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2207	}
2208	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2209	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2210	{
2211	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2212	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2213	}
2214
2215	/* Present? */
2216	if (!DescCS.Legacy.Gen.u1Present)
2217	{
2218	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2219	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2220	}
2221
2222	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2223
2224	/*
2225	* Return to outer level?
2226	*/
2227	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2228	{
2229	uint16_t uNewSS;
2230	uint32_t uNewESP;
2231	if (enmEffOpSize == IEMMODE_32BIT)
2232	{
2233	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2234	if (rcStrict != VINF_SUCCESS)
2235	return rcStrict;
2236	uNewESP = uFrame.pu32[0];
2237	uNewSS = (uint16_t)uFrame.pu32[1];
2238	}
2239	else
2240	{
2241	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2242	if (rcStrict != VINF_SUCCESS)
2243	return rcStrict;
2244	uNewESP = uFrame.pu16[0];
2245	uNewSS = uFrame.pu16[1];
2246	}
2247	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2248	if (rcStrict != VINF_SUCCESS)
2249	return rcStrict;
2250
2251	/* Read the SS descriptor. */
2252	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2253	{
2254	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2255	return iemRaiseGeneralProtectionFault0(pIemCpu);
2256	}
2257
2258	IEMSELDESC DescSS;
2259	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS);
2260	if (rcStrict != VINF_SUCCESS)
2261	{
2262	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2263	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2264	return rcStrict;
2265	}
2266
2267	/* Privilege checks. */
2268	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2269	{
2270	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2271	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2272	}
2273	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2274	{
2275	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2276	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2277	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2278	}
2279
2280	/* Must be a writeable data segment descriptor. */
2281	if (!DescSS.Legacy.Gen.u1DescType)
2282	{
2283	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2284	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2285	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2286	}
2287	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2288	{
2289	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2290	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2291	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2292	}
2293
2294	/* Present? */
2295	if (!DescSS.Legacy.Gen.u1Present)
2296	{
2297	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2298	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2299	}
2300
2301	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2302
2303	/* Check EIP. */
2304	if (uNewEip > cbLimitCS)
2305	{
2306	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2307	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2308	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2309	}
2310
2311	/*
2312	* Commit the changes, marking CS and SS accessed first since
2313	* that may fail.
2314	*/
2315	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2316	{
2317	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2318	if (rcStrict != VINF_SUCCESS)
2319	return rcStrict;
2320	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2321	}
2322	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2323	{
2324	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2325	if (rcStrict != VINF_SUCCESS)
2326	return rcStrict;
2327	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2328	}
2329
2330	pCtx->rip = uNewEip;
2331	pCtx->cs.Sel = uNewCs;
2332	pCtx->cs.ValidSel = uNewCs;
2333	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2334	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2335	pCtx->cs.u32Limit = cbLimitCS;
2336	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2337	pCtx->rsp = uNewESP;
2338	pCtx->ss.Sel = uNewSS;
2339	pCtx->ss.ValidSel = uNewSS;
2340	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2341	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2342	pCtx->ss.u32Limit = cbLimitSs;
2343	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2344
2345	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2346	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2347	if (enmEffOpSize != IEMMODE_16BIT)
2348	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2349	if (pIemCpu->uCpl == 0)
2350	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2351	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2352	fEFlagsMask \|= X86_EFL_IF;
2353	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2354	fEFlagsNew &= ~fEFlagsMask;
2355	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2356	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2357
2358	pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2359	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2360	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2361	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2362	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2363
2364	/* Done! */
2365
2366	}
2367	/*
2368	* Return to the same level.
2369	*/
2370	else
2371	{
2372	/* Check EIP. */
2373	if (uNewEip > cbLimitCS)
2374	{
2375	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2376	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2377	}
2378
2379	/*
2380	* Commit the changes, marking CS first since it may fail.
2381	*/
2382	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2383	{
2384	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2385	if (rcStrict != VINF_SUCCESS)
2386	return rcStrict;
2387	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2388	}
2389
2390	pCtx->rip = uNewEip;
2391	pCtx->cs.Sel = uNewCs;
2392	pCtx->cs.ValidSel = uNewCs;
2393	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2394	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2395	pCtx->cs.u32Limit = cbLimitCS;
2396	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2397	pCtx->rsp = uNewRsp;
2398
2399	X86EFLAGS NewEfl;
2400	NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2401	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2402	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2403	if (enmEffOpSize != IEMMODE_16BIT)
2404	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2405	if (pIemCpu->uCpl == 0)
2406	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2407	else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2408	fEFlagsMask \|= X86_EFL_IF;
2409	NewEfl.u &= ~fEFlagsMask;
2410	NewEfl.u \|= fEFlagsMask & uNewFlags;
2411	IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2412	/* Done! */
2413	}
2414	return VINF_SUCCESS;
2415	}
2416
2417
2418	/**
2419	* Implements iret for long mode
2420	*
2421	* @param enmEffOpSize The effective operand size.
2422	*/
2423	IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2424	{
2425	//PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2426	//VBOXSTRICTRC rcStrict;
2427	//uint64_t uNewRsp;
2428
2429	NOREF(pIemCpu); NOREF(cbInstr); NOREF(enmEffOpSize);
2430	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2431	}
2432
2433
2434	/**
2435	* Implements iret.
2436	*
2437	* @param enmEffOpSize The effective operand size.
2438	*/
2439	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2440	{
2441	/*
2442	* Call a mode specific worker.
2443	*/
2444	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2445	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2446	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2447	if (IEM_IS_LONG_MODE(pIemCpu))
2448	return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2449
2450	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2451	}
2452
2453
2454	/**
2455	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
2456	*
2457	* @param iSegReg The segment register number (valid).
2458	* @param uSel The new selector value.
2459	*/
2460	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
2461	{
2462	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
2463	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
2464	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
2465
2466	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
2467
2468	/*
2469	* Real mode and V8086 mode are easy.
2470	*/
2471	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2472	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2473	{
2474	*pSel = uSel;
2475	pHid->u64Base = (uint32_t)uSel << 4;
2476	pHid->ValidSel = uSel;
2477	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2478	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
2479	/** @todo Does the CPU actually load limits and attributes in the
2480	* real/V8086 mode segment load case? It doesn't for CS in far
2481	* jumps... Affects unreal mode. */
2482	pHid->u32Limit = 0xffff;
2483	pHid->Attr.u = 0;
2484	pHid->Attr.n.u1Present = 1;
2485	pHid->Attr.n.u1DescType = 1;
2486	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
2487	? X86_SEL_TYPE_RW
2488	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
2489	#endif
2490	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2491	iemRegAddToRip(pIemCpu, cbInstr);
2492	return VINF_SUCCESS;
2493	}
2494
2495	/*
2496	* Protected mode.
2497	*
2498	* Check if it's a null segment selector value first, that's OK for DS, ES,
2499	* FS and GS. If not null, then we have to load and parse the descriptor.
2500	*/
2501	if (!(uSel & X86_SEL_MASK_OFF_RPL))
2502	{
2503	if (iSegReg == X86_SREG_SS)
2504	{
2505	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
2506	\|\| pIemCpu->uCpl != 0
2507	\|\| uSel != 0) /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? */
2508	{
2509	Log(("load sreg -> invalid stack selector, #GP(0)\n", uSel));
2510	return iemRaiseGeneralProtectionFault0(pIemCpu);
2511	}
2512
2513	/* In 64-bit kernel mode, the stack can be 0 because of the way
2514	interrupts are dispatched when in kernel ctx. Just load the
2515	selector value into the register and leave the hidden bits
2516	as is. */
2517	*pSel = uSel;
2518	pHid->ValidSel = uSel;
2519	iemRegAddToRip(pIemCpu, cbInstr);
2520	return VINF_SUCCESS;
2521	}
2522
2523	pSel = uSel; / Not RPL, remember :-) */
2524	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
2525	&& iSegReg != X86_SREG_FS
2526	&& iSegReg != X86_SREG_GS)
2527	{
2528	/** @todo figure out what this actually does, it works. Needs
2529	* testcase! */
2530	pHid->Attr.u = 0;
2531	pHid->Attr.n.u1Present = 1;
2532	pHid->Attr.n.u1Long = 1;
2533	pHid->Attr.n.u4Type = X86_SEL_TYPE_RW;
2534	pHid->Attr.n.u2Dpl = 3;
2535	pHid->u32Limit = 0;
2536	pHid->u64Base = 0;
2537	pHid->ValidSel = uSel;
2538	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2539	}
2540	else
2541	iemHlpLoadNullDataSelectorProt(pHid, uSel);
2542	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
2543	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2544
2545	iemRegAddToRip(pIemCpu, cbInstr);
2546	return VINF_SUCCESS;
2547	}
2548
2549	/* Fetch the descriptor. */
2550	IEMSELDESC Desc;
2551	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
2552	if (rcStrict != VINF_SUCCESS)
2553	return rcStrict;
2554
2555	/* Check GPs first. */
2556	if (!Desc.Legacy.Gen.u1DescType)
2557	{
2558	Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
2559	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2560	}
2561	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
2562	{
2563	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2564	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2565	{
2566	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
2567	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2568	}
2569	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
2570	{
2571	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
2572	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2573	}
2574	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
2575	{
2576	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
2577	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2578	}
2579	}
2580	else
2581	{
2582	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
2583	{
2584	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
2585	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2586	}
2587	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
2588	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
2589	{
2590	#if 0 /* this is what intel says. */
2591	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
2592	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
2593	{
2594	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
2595	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
2596	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2597	}
2598	#else /* this is what makes more sense. */
2599	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
2600	{
2601	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
2602	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
2603	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2604	}
2605	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
2606	{
2607	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
2608	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
2609	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2610	}
2611	#endif
2612	}
2613	}
2614
2615	/* Is it there? */
2616	if (!Desc.Legacy.Gen.u1Present)
2617	{
2618	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
2619	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
2620	}
2621
2622	/* The base and limit. */
2623	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2624	uint64_t u64Base;
2625	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
2626	&& iSegReg < X86_SREG_FS)
2627	u64Base = 0;
2628	else
2629	u64Base = X86DESC_BASE(&Desc.Legacy);
2630
2631	/*
2632	* Ok, everything checked out fine. Now set the accessed bit before
2633	* committing the result into the registers.
2634	*/
2635	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2636	{
2637	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
2638	if (rcStrict != VINF_SUCCESS)
2639	return rcStrict;
2640	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2641	}
2642
2643	/* commit */
2644	*pSel = uSel;
2645	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2646	pHid->u32Limit = cbLimit;
2647	pHid->u64Base = u64Base;
2648	pHid->ValidSel = uSel;
2649	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2650
2651	/** @todo check if the hidden bits are loaded correctly for 64-bit
2652	* mode. */
2653	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
2654
2655	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2656	iemRegAddToRip(pIemCpu, cbInstr);
2657	return VINF_SUCCESS;
2658	}
2659
2660
2661	/**
2662	* Implements 'mov SReg, r/m'.
2663	*
2664	* @param iSegReg The segment register number (valid).
2665	* @param uSel The new selector value.
2666	*/
2667	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
2668	{
2669	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2670	if (rcStrict == VINF_SUCCESS)
2671	{
2672	if (iSegReg == X86_SREG_SS)
2673	{
2674	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2675	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
2676	}
2677	}
2678	return rcStrict;
2679	}
2680
2681
2682	/**
2683	* Implements 'pop SReg'.
2684	*
2685	* @param iSegReg The segment register number (valid).
2686	* @param enmEffOpSize The efficient operand size (valid).
2687	*/
2688	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
2689	{
2690	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2691	VBOXSTRICTRC rcStrict;
2692
2693	/*
2694	* Read the selector off the stack and join paths with mov ss, reg.
2695	*/
2696	RTUINT64U TmpRsp;
2697	TmpRsp.u = pCtx->rsp;
2698	switch (enmEffOpSize)
2699	{
2700	case IEMMODE_16BIT:
2701	{
2702	uint16_t uSel;
2703	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
2704	if (rcStrict == VINF_SUCCESS)
2705	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2706	break;
2707	}
2708
2709	case IEMMODE_32BIT:
2710	{
2711	uint32_t u32Value;
2712	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
2713	if (rcStrict == VINF_SUCCESS)
2714	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
2715	break;
2716	}
2717
2718	case IEMMODE_64BIT:
2719	{
2720	uint64_t u64Value;
2721	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
2722	if (rcStrict == VINF_SUCCESS)
2723	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
2724	break;
2725	}
2726	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2727	}
2728
2729	/*
2730	* Commit the stack on success.
2731	*/
2732	if (rcStrict == VINF_SUCCESS)
2733	{
2734	pCtx->rsp = TmpRsp.u;
2735	if (iSegReg == X86_SREG_SS)
2736	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
2737	}
2738	return rcStrict;
2739	}
2740
2741
2742	/**
2743	* Implements lgs, lfs, les, lds & lss.
2744	*/
2745	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
2746	uint16_t, uSel,
2747	uint64_t, offSeg,
2748	uint8_t, iSegReg,
2749	uint8_t, iGReg,
2750	IEMMODE, enmEffOpSize)
2751	{
2752	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
2753	VBOXSTRICTRC rcStrict;
2754
2755	/*
2756	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
2757	*/
2758	/** @todo verify and test that mov, pop and lXs works the segment
2759	* register loading in the exact same way. */
2760	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2761	if (rcStrict == VINF_SUCCESS)
2762	{
2763	switch (enmEffOpSize)
2764	{
2765	case IEMMODE_16BIT:
2766	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
2767	break;
2768	case IEMMODE_32BIT:
2769	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
2770	break;
2771	case IEMMODE_64BIT:
2772	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
2773	break;
2774	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2775	}
2776	}
2777
2778	return rcStrict;
2779	}
2780
2781
2782	/**
2783	* Implements lgdt.
2784	*
2785	* @param iEffSeg The segment of the new ldtr contents
2786	* @param GCPtrEffSrc The address of the new ldtr contents.
2787	* @param enmEffOpSize The effective operand size.
2788	*/
2789	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2790	{
2791	if (pIemCpu->uCpl != 0)
2792	return iemRaiseGeneralProtectionFault0(pIemCpu);
2793	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2794
2795	/*
2796	* Fetch the limit and base address.
2797	*/
2798	uint16_t cbLimit;
2799	RTGCPTR GCPtrBase;
2800	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2801	if (rcStrict == VINF_SUCCESS)
2802	{
2803	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2804	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2805	else
2806	{
2807	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2808	pCtx->gdtr.cbGdt = cbLimit;
2809	pCtx->gdtr.pGdt = GCPtrBase;
2810	}
2811	if (rcStrict == VINF_SUCCESS)
2812	iemRegAddToRip(pIemCpu, cbInstr);
2813	}
2814	return rcStrict;
2815	}
2816
2817
2818	/**
2819	* Implements sgdt.
2820	*
2821	* @param iEffSeg The segment where to store the gdtr content.
2822	* @param GCPtrEffDst The address where to store the gdtr content.
2823	* @param enmEffOpSize The effective operand size.
2824	*/
2825	IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
2826	{
2827	/*
2828	* Join paths with sidt.
2829	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
2830	* you really must know.
2831	*/
2832	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2833	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
2834	if (rcStrict == VINF_SUCCESS)
2835	iemRegAddToRip(pIemCpu, cbInstr);
2836	return rcStrict;
2837	}
2838
2839
2840	/**
2841	* Implements lidt.
2842	*
2843	* @param iEffSeg The segment of the new ldtr contents
2844	* @param GCPtrEffSrc The address of the new ldtr contents.
2845	* @param enmEffOpSize The effective operand size.
2846	*/
2847	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2848	{
2849	if (pIemCpu->uCpl != 0)
2850	return iemRaiseGeneralProtectionFault0(pIemCpu);
2851	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2852
2853	/*
2854	* Fetch the limit and base address.
2855	*/
2856	uint16_t cbLimit;
2857	RTGCPTR GCPtrBase;
2858	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2859	if (rcStrict == VINF_SUCCESS)
2860	{
2861	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2862	CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2863	else
2864	{
2865	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2866	pCtx->idtr.cbIdt = cbLimit;
2867	pCtx->idtr.pIdt = GCPtrBase;
2868	}
2869	iemRegAddToRip(pIemCpu, cbInstr);
2870	}
2871	return rcStrict;
2872	}
2873
2874
2875	/**
2876	* Implements sidt.
2877	*
2878	* @param iEffSeg The segment where to store the idtr content.
2879	* @param GCPtrEffDst The address where to store the idtr content.
2880	* @param enmEffOpSize The effective operand size.
2881	*/
2882	IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
2883	{
2884	/*
2885	* Join paths with sgdt.
2886	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
2887	* you really must know.
2888	*/
2889	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2890	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
2891	if (rcStrict == VINF_SUCCESS)
2892	iemRegAddToRip(pIemCpu, cbInstr);
2893	return rcStrict;
2894	}
2895
2896
2897	/**
2898	* Implements lldt.
2899	*
2900	* @param uNewLdt The new LDT selector value.
2901	*/
2902	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
2903	{
2904	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2905
2906	/*
2907	* Check preconditions.
2908	*/
2909	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2910	{
2911	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
2912	return iemRaiseUndefinedOpcode(pIemCpu);
2913	}
2914	if (pIemCpu->uCpl != 0)
2915	{
2916	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
2917	return iemRaiseGeneralProtectionFault0(pIemCpu);
2918	}
2919	if (uNewLdt & X86_SEL_LDT)
2920	{
2921	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
2922	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
2923	}
2924
2925	/*
2926	* Now, loading a NULL selector is easy.
2927	*/
2928	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
2929	{
2930	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
2931	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2932	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
2933	else
2934	pCtx->ldtr.Sel = uNewLdt;
2935	pCtx->ldtr.ValidSel = uNewLdt;
2936	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
2937	if (IEM_IS_GUEST_CPU_AMD(pIemCpu) && !IEM_VERIFICATION_ENABLED(pIemCpu))
2938	pCtx->ldtr.Attr.u = 0;
2939	else
2940	{
2941	pCtx->ldtr.u64Base = 0;
2942	pCtx->ldtr.u32Limit = 0;
2943	}
2944
2945	iemRegAddToRip(pIemCpu, cbInstr);
2946	return VINF_SUCCESS;
2947	}
2948
2949	/*
2950	* Read the descriptor.
2951	*/
2952	IEMSELDESC Desc;
2953	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt);
2954	if (rcStrict != VINF_SUCCESS)
2955	return rcStrict;
2956
2957	/* Check GPs first. */
2958	if (Desc.Legacy.Gen.u1DescType)
2959	{
2960	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2961	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2962	}
2963	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
2964	{
2965	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2966	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2967	}
2968	uint64_t u64Base;
2969	if (!IEM_IS_LONG_MODE(pIemCpu))
2970	u64Base = X86DESC_BASE(&Desc.Legacy);
2971	else
2972	{
2973	if (Desc.Long.Gen.u5Zeros)
2974	{
2975	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
2976	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2977	}
2978
2979	u64Base = X86DESC64_BASE(&Desc.Long);
2980	if (!IEM_IS_CANONICAL(u64Base))
2981	{
2982	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
2983	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2984	}
2985	}
2986
2987	/* NP */
2988	if (!Desc.Legacy.Gen.u1Present)
2989	{
2990	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
2991	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
2992	}
2993
2994	/*
2995	* It checks out alright, update the registers.
2996	*/
2997	/** @todo check if the actual value is loaded or if the RPL is dropped */
2998	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2999	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
3000	else
3001	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3002	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3003	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3004	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3005	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3006	pCtx->ldtr.u64Base = u64Base;
3007
3008	iemRegAddToRip(pIemCpu, cbInstr);
3009	return VINF_SUCCESS;
3010	}
3011
3012
3013	/**
3014	* Implements lldt.
3015	*
3016	* @param uNewLdt The new LDT selector value.
3017	*/
3018	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3019	{
3020	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3021
3022	/*
3023	* Check preconditions.
3024	*/
3025	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3026	{
3027	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3028	return iemRaiseUndefinedOpcode(pIemCpu);
3029	}
3030	if (pIemCpu->uCpl != 0)
3031	{
3032	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3033	return iemRaiseGeneralProtectionFault0(pIemCpu);
3034	}
3035	if (uNewTr & X86_SEL_LDT)
3036	{
3037	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3038	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3039	}
3040	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3041	{
3042	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3043	return iemRaiseGeneralProtectionFault0(pIemCpu);
3044	}
3045
3046	/*
3047	* Read the descriptor.
3048	*/
3049	IEMSELDESC Desc;
3050	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr);
3051	if (rcStrict != VINF_SUCCESS)
3052	return rcStrict;
3053
3054	/* Check GPs first. */
3055	if (Desc.Legacy.Gen.u1DescType)
3056	{
3057	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3058	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3059	}
3060	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3061	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3062	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
3063	{
3064	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3065	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3066	}
3067	uint64_t u64Base;
3068	if (!IEM_IS_LONG_MODE(pIemCpu))
3069	u64Base = X86DESC_BASE(&Desc.Legacy);
3070	else
3071	{
3072	if (Desc.Long.Gen.u5Zeros)
3073	{
3074	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3075	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3076	}
3077
3078	u64Base = X86DESC64_BASE(&Desc.Long);
3079	if (!IEM_IS_CANONICAL(u64Base))
3080	{
3081	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3082	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3083	}
3084	}
3085
3086	/* NP */
3087	if (!Desc.Legacy.Gen.u1Present)
3088	{
3089	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3090	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3091	}
3092
3093	/*
3094	* Set it busy.
3095	* Note! Intel says this should lock down the whole descriptor, but we'll
3096	* restrict our selves to 32-bit for now due to lack of inline
3097	* assembly and such.
3098	*/
3099	void *pvDesc;
3100	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
3101	if (rcStrict != VINF_SUCCESS)
3102	return rcStrict;
3103	switch ((uintptr_t)pvDesc & 3)
3104	{
3105	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3106	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3107	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 16); break;
3108	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 8); break;
3109	}
3110	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
3111	if (rcStrict != VINF_SUCCESS)
3112	return rcStrict;
3113	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3114
3115	/*
3116	* It checks out alright, update the registers.
3117	*/
3118	/** @todo check if the actual value is loaded or if the RPL is dropped */
3119	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3120	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
3121	else
3122	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
3123	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
3124	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
3125	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3126	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3127	pCtx->tr.u64Base = u64Base;
3128
3129	iemRegAddToRip(pIemCpu, cbInstr);
3130	return VINF_SUCCESS;
3131	}
3132
3133
3134	/**
3135	* Implements mov GReg,CRx.
3136	*
3137	* @param iGReg The general register to store the CRx value in.
3138	* @param iCrReg The CRx register to read (valid).
3139	*/
3140	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
3141	{
3142	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3143	if (pIemCpu->uCpl != 0)
3144	return iemRaiseGeneralProtectionFault0(pIemCpu);
3145	Assert(!pCtx->eflags.Bits.u1VM);
3146
3147	/* read it */
3148	uint64_t crX;
3149	switch (iCrReg)
3150	{
3151	case 0: crX = pCtx->cr0; break;
3152	case 2: crX = pCtx->cr2; break;
3153	case 3: crX = pCtx->cr3; break;
3154	case 4: crX = pCtx->cr4; break;
3155	case 8:
3156	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3157	IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement CR8/TPR read\n")); /** @todo implement CR8 reading and writing. */
3158	else
3159	crX = 0xff;
3160	break;
3161	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3162	}
3163
3164	/* store it */
3165	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3166	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
3167	else
3168	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
3169
3170	iemRegAddToRip(pIemCpu, cbInstr);
3171	return VINF_SUCCESS;
3172	}
3173
3174
3175	/**
3176	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
3177	*
3178	* @param iCrReg The CRx register to write (valid).
3179	* @param uNewCrX The new value.
3180	*/
3181	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
3182	{
3183	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3184	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3185	VBOXSTRICTRC rcStrict;
3186	int rc;
3187
3188	/*
3189	* Try store it.
3190	* Unfortunately, CPUM only does a tiny bit of the work.
3191	*/
3192	switch (iCrReg)
3193	{
3194	case 0:
3195	{
3196	/*
3197	* Perform checks.
3198	*/
3199	uint64_t const uOldCrX = pCtx->cr0;
3200	uNewCrX \|= X86_CR0_ET; /* hardcoded */
3201
3202	/* Check for reserved bits. */
3203	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
3204	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
3205	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
3206	if (uNewCrX & ~(uint64_t)fValid)
3207	{
3208	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
3209	return iemRaiseGeneralProtectionFault0(pIemCpu);
3210	}
3211
3212	/* Check for invalid combinations. */
3213	if ( (uNewCrX & X86_CR0_PG)
3214	&& !(uNewCrX & X86_CR0_PE) )
3215	{
3216	Log(("Trying to set CR0.PG without CR0.PE\n"));
3217	return iemRaiseGeneralProtectionFault0(pIemCpu);
3218	}
3219
3220	if ( !(uNewCrX & X86_CR0_CD)
3221	&& (uNewCrX & X86_CR0_NW) )
3222	{
3223	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
3224	return iemRaiseGeneralProtectionFault0(pIemCpu);
3225	}
3226
3227	/* Long mode consistency checks. */
3228	if ( (uNewCrX & X86_CR0_PG)
3229	&& !(uOldCrX & X86_CR0_PG)
3230	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
3231	{
3232	if (!(pCtx->cr4 & X86_CR4_PAE))
3233	{
3234	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
3235	return iemRaiseGeneralProtectionFault0(pIemCpu);
3236	}
3237	if (pCtx->cs.Attr.n.u1Long)
3238	{
3239	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
3240	return iemRaiseGeneralProtectionFault0(pIemCpu);
3241	}
3242	}
3243
3244	/** @todo check reserved PDPTR bits as AMD states. */
3245
3246	/*
3247	* Change CR0.
3248	*/
3249	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3250	CPUMSetGuestCR0(pVCpu, uNewCrX);
3251	else
3252	pCtx->cr0 = uNewCrX;
3253	Assert(pCtx->cr0 == uNewCrX);
3254
3255	/*
3256	* Change EFER.LMA if entering or leaving long mode.
3257	*/
3258	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
3259	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
3260	{
3261	uint64_t NewEFER = pCtx->msrEFER;
3262	if (uNewCrX & X86_CR0_PG)
3263	NewEFER \|= MSR_K6_EFER_LME;
3264	else
3265	NewEFER &= ~MSR_K6_EFER_LME;
3266
3267	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3268	CPUMSetGuestEFER(pVCpu, NewEFER);
3269	else
3270	pCtx->msrEFER = NewEFER;
3271	Assert(pCtx->msrEFER == NewEFER);
3272	}
3273
3274	/*
3275	* Inform PGM.
3276	*/
3277	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3278	{
3279	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
3280	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
3281	{
3282	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
3283	AssertRCReturn(rc, rc);
3284	/* ignore informational status codes */
3285	}
3286	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
3287	}
3288	else
3289	rcStrict = VINF_SUCCESS;
3290
3291	#ifdef IN_RC
3292	/* Return to ring-3 for rescheduling if WP or AM changes. */
3293	if ( rcStrict == VINF_SUCCESS
3294	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
3295	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
3296	rcStrict = VINF_EM_RESCHEDULE;
3297	#endif
3298	break;
3299	}
3300
3301	/*
3302	* CR2 can be changed without any restrictions.
3303	*/
3304	case 2:
3305	pCtx->cr2 = uNewCrX;
3306	rcStrict = VINF_SUCCESS;
3307	break;
3308
3309	/*
3310	* CR3 is relatively simple, although AMD and Intel have different
3311	* accounts of how setting reserved bits are handled. We take intel's
3312	* word for the lower bits and AMD's for the high bits (63:52).
3313	*/
3314	/** @todo Testcase: Setting reserved bits in CR3, especially before
3315	* enabling paging. */
3316	case 3:
3317	{
3318	/* check / mask the value. */
3319	if (uNewCrX & UINT64_C(0xfff0000000000000))
3320	{
3321	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
3322	return iemRaiseGeneralProtectionFault0(pIemCpu);
3323	}
3324
3325	uint64_t fValid;
3326	if ( (pCtx->cr4 & X86_CR4_PAE)
3327	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
3328	fValid = UINT64_C(0x000ffffffffff014);
3329	else if (pCtx->cr4 & X86_CR4_PAE)
3330	fValid = UINT64_C(0xfffffff4);
3331	else
3332	fValid = UINT64_C(0xfffff014);
3333	if (uNewCrX & ~fValid)
3334	{
3335	Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
3336	uNewCrX, uNewCrX & ~fValid));
3337	uNewCrX &= fValid;
3338	}
3339
3340	/** @todo If we're in PAE mode we should check the PDPTRs for
3341	* invalid bits. */
3342
3343	/* Make the change. */
3344	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3345	{
3346	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
3347	AssertRCSuccessReturn(rc, rc);
3348	}
3349	else
3350	pCtx->cr3 = uNewCrX;
3351
3352	/* Inform PGM. */
3353	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3354	{
3355	if (pCtx->cr0 & X86_CR0_PG)
3356	{
3357	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr3 & X86_CR4_PGE));
3358	AssertRCReturn(rc, rc);
3359	/* ignore informational status codes */
3360	}
3361	}
3362	rcStrict = VINF_SUCCESS;
3363	break;
3364	}
3365
3366	/*
3367	* CR4 is a bit more tedious as there are bits which cannot be cleared
3368	* under some circumstances and such.
3369	*/
3370	case 4:
3371	{
3372	uint64_t const uOldCrX = pCtx->cr4;
3373
3374	/* reserved bits */
3375	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
3376	\| X86_CR4_TSD \| X86_CR4_DE
3377	\| X86_CR4_PSE \| X86_CR4_PAE
3378	\| X86_CR4_MCE \| X86_CR4_PGE
3379	\| X86_CR4_PCE \| X86_CR4_OSFSXR
3380	\| X86_CR4_OSXMMEEXCPT;
3381	//if (xxx)
3382	// fValid \|= X86_CR4_VMXE;
3383	//if (xxx)
3384	// fValid \|= X86_CR4_OSXSAVE;
3385	if (uNewCrX & ~(uint64_t)fValid)
3386	{
3387	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
3388	return iemRaiseGeneralProtectionFault0(pIemCpu);
3389	}
3390
3391	/* long mode checks. */
3392	if ( (uOldCrX & X86_CR4_PAE)
3393	&& !(uNewCrX & X86_CR4_PAE)
3394	&& (pCtx->msrEFER & MSR_K6_EFER_LMA) )
3395	{
3396	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
3397	return iemRaiseGeneralProtectionFault0(pIemCpu);
3398	}
3399
3400
3401	/*
3402	* Change it.
3403	*/
3404	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3405	{
3406	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
3407	AssertRCSuccessReturn(rc, rc);
3408	}
3409	else
3410	pCtx->cr4 = uNewCrX;
3411	Assert(pCtx->cr4 == uNewCrX);
3412
3413	/*
3414	* Notify SELM and PGM.
3415	*/
3416	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3417	{
3418	/* SELM - VME may change things wrt to the TSS shadowing. */
3419	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
3420	{
3421	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
3422	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
3423	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
3424	}
3425
3426	/* PGM - flushing and mode. */
3427	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
3428	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
3429	{
3430	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
3431	AssertRCReturn(rc, rc);
3432	/* ignore informational status codes */
3433	}
3434	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
3435	}
3436	else
3437	rcStrict = VINF_SUCCESS;
3438	break;
3439	}
3440
3441	/*
3442	* CR8 maps to the APIC TPR.
3443	*/
3444	case 8:
3445	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3446	IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement CR8/TPR read\n")); /** @todo implement CR8 reading and writing. */
3447	else
3448	rcStrict = VINF_SUCCESS;
3449	break;
3450
3451	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3452	}
3453
3454	/*
3455	* Advance the RIP on success.
3456	*/
3457	if (RT_SUCCESS(rcStrict))
3458	{
3459	if (rcStrict != VINF_SUCCESS)
3460	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3461	iemRegAddToRip(pIemCpu, cbInstr);
3462	}
3463
3464	return rcStrict;
3465	}
3466
3467
3468	/**
3469	* Implements mov CRx,GReg.
3470	*
3471	* @param iCrReg The CRx register to write (valid).
3472	* @param iGReg The general register to load the DRx value from.
3473	*/
3474	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
3475	{
3476	if (pIemCpu->uCpl != 0)
3477	return iemRaiseGeneralProtectionFault0(pIemCpu);
3478	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3479
3480	/*
3481	* Read the new value from the source register and call common worker.
3482	*/
3483	uint64_t uNewCrX;
3484	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3485	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
3486	else
3487	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
3488	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
3489	}
3490
3491
3492	/**
3493	* Implements 'LMSW r/m16'
3494	*
3495	* @param u16NewMsw The new value.
3496	*/
3497	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
3498	{
3499	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3500
3501	if (pIemCpu->uCpl != 0)
3502	return iemRaiseGeneralProtectionFault0(pIemCpu);
3503	Assert(!pCtx->eflags.Bits.u1VM);
3504
3505	/*
3506	* Compose the new CR0 value and call common worker.
3507	*/
3508	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3509	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3510	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
3511	}
3512
3513
3514	/**
3515	* Implements 'CLTS'.
3516	*/
3517	IEM_CIMPL_DEF_0(iemCImpl_clts)
3518	{
3519	if (pIemCpu->uCpl != 0)
3520	return iemRaiseGeneralProtectionFault0(pIemCpu);
3521
3522	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3523	uint64_t uNewCr0 = pCtx->cr0;
3524	uNewCr0 &= ~X86_CR0_TS;
3525	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
3526	}
3527
3528
3529	/**
3530	* Implements mov GReg,DRx.
3531	*
3532	* @param iGReg The general register to store the DRx value in.
3533	* @param iDrReg The DRx register to read (0-7).
3534	*/
3535	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
3536	{
3537	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3538
3539	/*
3540	* Check preconditions.
3541	*/
3542
3543	/* Raise GPs. */
3544	if (pIemCpu->uCpl != 0)
3545	return iemRaiseGeneralProtectionFault0(pIemCpu);
3546	Assert(!pCtx->eflags.Bits.u1VM);
3547
3548	if ( (iDrReg == 4 \|\| iDrReg == 5)
3549	&& (pCtx->cr4 & X86_CR4_DE) )
3550	{
3551	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
3552	return iemRaiseGeneralProtectionFault0(pIemCpu);
3553	}
3554
3555	/* Raise #DB if general access detect is enabled. */
3556	if (pCtx->dr[7] & X86_DR7_GD)
3557	{
3558	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
3559	return iemRaiseDebugException(pIemCpu);
3560	}
3561
3562	/*
3563	* Read the debug register and store it in the specified general register.
3564	*/
3565	uint64_t drX;
3566	switch (iDrReg)
3567	{
3568	case 0: drX = pCtx->dr[0]; break;
3569	case 1: drX = pCtx->dr[1]; break;
3570	case 2: drX = pCtx->dr[2]; break;
3571	case 3: drX = pCtx->dr[3]; break;
3572	case 6:
3573	case 4:
3574	drX = pCtx->dr[6];
3575	drX &= ~RT_BIT_32(12);
3576	drX \|= UINT32_C(0xffff0ff0);
3577	break;
3578	case 7:
3579	case 5:
3580	drX = pCtx->dr[7];
3581	drX &= ~(RT_BIT_32(11) \| RT_BIT_32(12) \| RT_BIT_32(14) \| RT_BIT_32(15));
3582	drX \|= RT_BIT_32(10);
3583	break;
3584	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3585	}
3586
3587	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3588	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
3589	else
3590	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
3591
3592	iemRegAddToRip(pIemCpu, cbInstr);
3593	return VINF_SUCCESS;
3594	}
3595
3596
3597	/**
3598	* Implements mov DRx,GReg.
3599	*
3600	* @param iDrReg The DRx register to write (valid).
3601	* @param iGReg The general register to load the DRx value from.
3602	*/
3603	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
3604	{
3605	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3606
3607	/*
3608	* Check preconditions.
3609	*/
3610	if (pIemCpu->uCpl != 0)
3611	return iemRaiseGeneralProtectionFault0(pIemCpu);
3612	Assert(!pCtx->eflags.Bits.u1VM);
3613
3614	if ( (iDrReg == 4 \|\| iDrReg == 5)
3615	&& (pCtx->cr4 & X86_CR4_DE) )
3616	{
3617	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
3618	return iemRaiseGeneralProtectionFault0(pIemCpu);
3619	}
3620
3621	/* Raise #DB if general access detect is enabled. */
3622	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
3623	* \#GP? */
3624	if (pCtx->dr[7] & X86_DR7_GD)
3625	{
3626	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
3627	return iemRaiseDebugException(pIemCpu);
3628	}
3629
3630	/*
3631	* Read the new value from the source register.
3632	*/
3633	uint64_t uNewDrX;
3634	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3635	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
3636	else
3637	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
3638
3639	/*
3640	* Adjust it.
3641	*/
3642	switch (iDrReg)
3643	{
3644	case 0:
3645	case 1:
3646	case 2:
3647	case 3:
3648	/* nothing to adjust */
3649	break;
3650
3651	case 6:
3652	case 4:
3653	if (uNewDrX & UINT64_C(0xffffffff00000000))
3654	{
3655	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
3656	return iemRaiseGeneralProtectionFault0(pIemCpu);
3657	}
3658	uNewDrX &= ~RT_BIT_32(12);
3659	uNewDrX \|= UINT32_C(0xffff0ff0);
3660	break;
3661
3662	case 7:
3663	case 5:
3664	if (uNewDrX & UINT64_C(0xffffffff00000000))
3665	{
3666	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
3667	return iemRaiseGeneralProtectionFault0(pIemCpu);
3668	}
3669	uNewDrX &= ~(RT_BIT_32(11) \| RT_BIT_32(12) \| RT_BIT_32(14) \| RT_BIT_32(15));
3670	uNewDrX \|= RT_BIT_32(10);
3671	break;
3672
3673	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3674	}
3675
3676	/*
3677	* Do the actual setting.
3678	*/
3679	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3680	{
3681	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
3682	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
3683	}
3684	else
3685	pCtx->dr[iDrReg] = uNewDrX;
3686
3687	iemRegAddToRip(pIemCpu, cbInstr);
3688	return VINF_SUCCESS;
3689	}
3690
3691
3692	/**
3693	* Implements 'INVLPG m'.
3694	*
3695	* @param GCPtrPage The effective address of the page to invalidate.
3696	* @remarks Updates the RIP.
3697	*/
3698	IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
3699	{
3700	/* ring-0 only. */
3701	if (pIemCpu->uCpl != 0)
3702	return iemRaiseGeneralProtectionFault0(pIemCpu);
3703	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3704
3705	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
3706	iemRegAddToRip(pIemCpu, cbInstr);
3707
3708	if (rc == VINF_SUCCESS)
3709	return VINF_SUCCESS;
3710	if (rc == VINF_PGM_SYNC_CR3)
3711	return iemSetPassUpStatus(pIemCpu, rc);
3712
3713	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
3714	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
3715	return rc;
3716	}
3717
3718
3719	/**
3720	* Implements RDTSC.
3721	*/
3722	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
3723	{
3724	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3725
3726	/*
3727	* Check preconditions.
3728	*/
3729	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
3730	return iemRaiseUndefinedOpcode(pIemCpu);
3731
3732	if ( (pCtx->cr4 & X86_CR4_TSD)
3733	&& pIemCpu->uCpl != 0)
3734	{
3735	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
3736	return iemRaiseGeneralProtectionFault0(pIemCpu);
3737	}
3738
3739	/*
3740	* Do the job.
3741	*/
3742	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
3743	pCtx->rax = (uint32_t)uTicks;
3744	pCtx->rdx = uTicks >> 32;
3745	#ifdef IEM_VERIFICATION_MODE
3746	pIemCpu->fIgnoreRaxRdx = true;
3747	#endif
3748
3749	iemRegAddToRip(pIemCpu, cbInstr);
3750	return VINF_SUCCESS;
3751	}
3752
3753
3754	/**
3755	* Implements RDMSR.
3756	*/
3757	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
3758	{
3759	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3760
3761	/*
3762	* Check preconditions.
3763	*/
3764	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
3765	return iemRaiseUndefinedOpcode(pIemCpu);
3766	if (pIemCpu->uCpl != 0)
3767	return iemRaiseGeneralProtectionFault0(pIemCpu);
3768
3769	/*
3770	* Do the job.
3771	*/
3772	RTUINT64U uValue;
3773	int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
3774	if (rc != VINF_SUCCESS)
3775	{
3776	Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
3777	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
3778	return iemRaiseGeneralProtectionFault0(pIemCpu);
3779	}
3780
3781	pCtx->rax = uValue.s.Lo;
3782	pCtx->rdx = uValue.s.Hi;
3783
3784	iemRegAddToRip(pIemCpu, cbInstr);
3785	return VINF_SUCCESS;
3786	}
3787
3788
3789	/**
3790	* Implements WRMSR.
3791	*/
3792	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
3793	{
3794	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3795
3796	/*
3797	* Check preconditions.
3798	*/
3799	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
3800	return iemRaiseUndefinedOpcode(pIemCpu);
3801	if (pIemCpu->uCpl != 0)
3802	return iemRaiseGeneralProtectionFault0(pIemCpu);
3803
3804	/*
3805	* Do the job.
3806	*/
3807	RTUINT64U uValue;
3808	uValue.s.Lo = pCtx->eax;
3809	uValue.s.Hi = pCtx->edx;
3810
3811	int rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
3812	if (rc != VINF_SUCCESS)
3813	{
3814	Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
3815	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
3816	return iemRaiseGeneralProtectionFault0(pIemCpu);
3817	}
3818
3819	iemRegAddToRip(pIemCpu, cbInstr);
3820	return VINF_SUCCESS;
3821	}
3822
3823
3824	/**
3825	* Implements 'IN eAX, port'.
3826	*
3827	* @param u16Port The source port.
3828	* @param cbReg The register size.
3829	*/
3830	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
3831	{
3832	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3833
3834	/*
3835	* CPL check
3836	*/
3837	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
3838	if (rcStrict != VINF_SUCCESS)
3839	return rcStrict;
3840
3841	/*
3842	* Perform the I/O.
3843	*/
3844	uint32_t u32Value;
3845	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3846	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), u16Port, &u32Value, cbReg);
3847	else
3848	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
3849	if (IOM_SUCCESS(rcStrict))
3850	{
3851	switch (cbReg)
3852	{
3853	case 1: pCtx->al = (uint8_t)u32Value; break;
3854	case 2: pCtx->ax = (uint16_t)u32Value; break;
3855	case 4: pCtx->rax = u32Value; break;
3856	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3857	}
3858	iemRegAddToRip(pIemCpu, cbInstr);
3859	pIemCpu->cPotentialExits++;
3860	if (rcStrict != VINF_SUCCESS)
3861	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3862	}
3863
3864	return rcStrict;
3865	}
3866
3867
3868	/**
3869	* Implements 'IN eAX, DX'.
3870	*
3871	* @param cbReg The register size.
3872	*/
3873	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
3874	{
3875	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3876	}
3877
3878
3879	/**
3880	* Implements 'OUT port, eAX'.
3881	*
3882	* @param u16Port The destination port.
3883	* @param cbReg The register size.
3884	*/
3885	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
3886	{
3887	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3888
3889	/*
3890	* CPL check
3891	*/
3892	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
3893	if (rcStrict != VINF_SUCCESS)
3894	return rcStrict;
3895
3896	/*
3897	* Perform the I/O.
3898	*/
3899	uint32_t u32Value;
3900	switch (cbReg)
3901	{
3902	case 1: u32Value = pCtx->al; break;
3903	case 2: u32Value = pCtx->ax; break;
3904	case 4: u32Value = pCtx->eax; break;
3905	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3906	}
3907	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3908	rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), u16Port, u32Value, cbReg);
3909	else
3910	rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
3911	if (IOM_SUCCESS(rcStrict))
3912	{
3913	iemRegAddToRip(pIemCpu, cbInstr);
3914	pIemCpu->cPotentialExits++;
3915	if (rcStrict != VINF_SUCCESS)
3916	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3917	}
3918	return rcStrict;
3919	}
3920
3921
3922	/**
3923	* Implements 'OUT DX, eAX'.
3924	*
3925	* @param cbReg The register size.
3926	*/
3927	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
3928	{
3929	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3930	}
3931
3932
3933	/**
3934	* Implements 'CLI'.
3935	*/
3936	IEM_CIMPL_DEF_0(iemCImpl_cli)
3937	{
3938	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3939	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3940	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
3941	uint32_t const fEflOld = fEfl;
3942	if (pCtx->cr0 & X86_CR0_PE)
3943	{
3944	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
3945	if (!(fEfl & X86_EFL_VM))
3946	{
3947	if (pIemCpu->uCpl <= uIopl)
3948	fEfl &= ~X86_EFL_IF;
3949	else if ( pIemCpu->uCpl == 3
3950	&& (pCtx->cr4 & X86_CR4_PVI) )
3951	fEfl &= ~X86_EFL_VIF;
3952	else
3953	return iemRaiseGeneralProtectionFault0(pIemCpu);
3954	}
3955	/* V8086 */
3956	else if (uIopl == 3)
3957	fEfl &= ~X86_EFL_IF;
3958	else if ( uIopl < 3
3959	&& (pCtx->cr4 & X86_CR4_VME) )
3960	fEfl &= ~X86_EFL_VIF;
3961	else
3962	return iemRaiseGeneralProtectionFault0(pIemCpu);
3963	}
3964	/* real mode */
3965	else
3966	fEfl &= ~X86_EFL_IF;
3967
3968	/* Commit. */
3969	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
3970	iemRegAddToRip(pIemCpu, cbInstr);
3971	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
3972	return VINF_SUCCESS;
3973	}
3974
3975
3976	/**
3977	* Implements 'STI'.
3978	*/
3979	IEM_CIMPL_DEF_0(iemCImpl_sti)
3980	{
3981	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3982	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3983	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
3984	uint32_t const fEflOld = fEfl;
3985
3986	if (pCtx->cr0 & X86_CR0_PE)
3987	{
3988	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
3989	if (!(fEfl & X86_EFL_VM))
3990	{
3991	if (pIemCpu->uCpl <= uIopl)
3992	fEfl \|= X86_EFL_IF;
3993	else if ( pIemCpu->uCpl == 3
3994	&& (pCtx->cr4 & X86_CR4_PVI)
3995	&& !(fEfl & X86_EFL_VIP) )
3996	fEfl \|= X86_EFL_VIF;
3997	else
3998	return iemRaiseGeneralProtectionFault0(pIemCpu);
3999	}
4000	/* V8086 */
4001	else if (uIopl == 3)
4002	fEfl \|= X86_EFL_IF;
4003	else if ( uIopl < 3
4004	&& (pCtx->cr4 & X86_CR4_VME)
4005	&& !(fEfl & X86_EFL_VIP) )
4006	fEfl \|= X86_EFL_VIF;
4007	else
4008	return iemRaiseGeneralProtectionFault0(pIemCpu);
4009	}
4010	/* real mode */
4011	else
4012	fEfl \|= X86_EFL_IF;
4013
4014	/* Commit. */
4015	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4016	iemRegAddToRip(pIemCpu, cbInstr);
4017	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_VERIFICATION_ENABLED(pIemCpu))
4018	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4019	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4020	return VINF_SUCCESS;
4021	}
4022
4023
4024	/**
4025	* Implements 'HLT'.
4026	*/
4027	IEM_CIMPL_DEF_0(iemCImpl_hlt)
4028	{
4029	if (pIemCpu->uCpl != 0)
4030	return iemRaiseGeneralProtectionFault0(pIemCpu);
4031	iemRegAddToRip(pIemCpu, cbInstr);
4032	return VINF_EM_HALT;
4033	}
4034
4035
4036	/**
4037	* Implements 'CPUID'.
4038	*/
4039	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
4040	{
4041	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4042
4043	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
4044	pCtx->rax &= UINT32_C(0xffffffff);
4045	pCtx->rbx &= UINT32_C(0xffffffff);
4046	pCtx->rcx &= UINT32_C(0xffffffff);
4047	pCtx->rdx &= UINT32_C(0xffffffff);
4048
4049	iemRegAddToRip(pIemCpu, cbInstr);
4050	return VINF_SUCCESS;
4051	}
4052
4053
4054	/**
4055	* Implements 'AAD'.
4056	*
4057	* @param enmEffOpSize The effective operand size.
4058	*/
4059	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
4060	{
4061	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4062
4063	uint16_t const ax = pCtx->ax;
4064	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
4065	pCtx->ax = al;
4066	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
4067	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
4068	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
4069
4070	iemRegAddToRip(pIemCpu, cbInstr);
4071	return VINF_SUCCESS;
4072	}
4073
4074
4075	/**
4076	* Implements 'AAM'.
4077	*
4078	* @param bImm The immediate operand. Cannot be 0.
4079	*/
4080	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
4081	{
4082	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4083	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
4084
4085	uint16_t const ax = pCtx->ax;
4086	uint8_t const al = (uint8_t)ax % bImm;
4087	uint8_t const ah = (uint8_t)ax / bImm;
4088	pCtx->ax = (ah << 8) + al;
4089	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
4090	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
4091	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
4092
4093	iemRegAddToRip(pIemCpu, cbInstr);
4094	return VINF_SUCCESS;
4095	}
4096
4097
4098
4099
4100	/*
4101	* Instantiate the various string operation combinations.
4102	*/
4103	#define OP_SIZE 8
4104	#define ADDR_SIZE 16
4105	#include "IEMAllCImplStrInstr.cpp.h"
4106	#define OP_SIZE 8
4107	#define ADDR_SIZE 32
4108	#include "IEMAllCImplStrInstr.cpp.h"
4109	#define OP_SIZE 8
4110	#define ADDR_SIZE 64
4111	#include "IEMAllCImplStrInstr.cpp.h"
4112
4113	#define OP_SIZE 16
4114	#define ADDR_SIZE 16
4115	#include "IEMAllCImplStrInstr.cpp.h"
4116	#define OP_SIZE 16
4117	#define ADDR_SIZE 32
4118	#include "IEMAllCImplStrInstr.cpp.h"
4119	#define OP_SIZE 16
4120	#define ADDR_SIZE 64
4121	#include "IEMAllCImplStrInstr.cpp.h"
4122
4123	#define OP_SIZE 32
4124	#define ADDR_SIZE 16
4125	#include "IEMAllCImplStrInstr.cpp.h"
4126	#define OP_SIZE 32
4127	#define ADDR_SIZE 32
4128	#include "IEMAllCImplStrInstr.cpp.h"
4129	#define OP_SIZE 32
4130	#define ADDR_SIZE 64
4131	#include "IEMAllCImplStrInstr.cpp.h"
4132
4133	#define OP_SIZE 64
4134	#define ADDR_SIZE 32
4135	#include "IEMAllCImplStrInstr.cpp.h"
4136	#define OP_SIZE 64
4137	#define ADDR_SIZE 64
4138	#include "IEMAllCImplStrInstr.cpp.h"
4139
4140
4141	/**
4142	* Implements 'FINIT' and 'FNINIT'.
4143	*
4144	* @param fCheckXcpts Whether to check for umasked pending exceptions or
4145	* not.
4146	*/
4147	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
4148	{
4149	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4150
4151	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
4152	return iemRaiseDeviceNotAvailable(pIemCpu);
4153
4154	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
4155	if (fCheckXcpts && TODO )
4156	return iemRaiseMathFault(pIemCpu);
4157	*/
4158
4159	if (iemFRegIsFxSaveFormat(pIemCpu))
4160	{
4161	pCtx->fpu.FCW = 0x37f;
4162	pCtx->fpu.FSW = 0;
4163	pCtx->fpu.FTW = 0x00; /* 0 - empty. */
4164	pCtx->fpu.FPUDP = 0;
4165	pCtx->fpu.DS = 0; //??
4166	pCtx->fpu.Rsrvd2= 0;
4167	pCtx->fpu.FPUIP = 0;
4168	pCtx->fpu.CS = 0; //??
4169	pCtx->fpu.Rsrvd1= 0;
4170	pCtx->fpu.FOP = 0;
4171	}
4172	else
4173	{
4174	PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
4175	pFpu->FCW = 0x37f;
4176	pFpu->FSW = 0;
4177	pFpu->FTW = 0xffff; /* 11 - empty */
4178	pFpu->FPUOO = 0; //??
4179	pFpu->FPUOS = 0; //??
4180	pFpu->FPUIP = 0;
4181	pFpu->CS = 0; //??
4182	pFpu->FOP = 0;
4183	}
4184
4185	iemHlpUsedFpu(pIemCpu);
4186	iemRegAddToRip(pIemCpu, cbInstr);
4187	return VINF_SUCCESS;
4188	}
4189
4190
4191	/**
4192	* Implements 'FXSAVE'.
4193	*
4194	* @param iEffSeg The effective segment.
4195	* @param GCPtrEff The address of the image.
4196	* @param enmEffOpSize The operand size (only REX.W really matters).
4197	*/
4198	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
4199	{
4200	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4201
4202	/*
4203	* Raise exceptions.
4204	*/
4205	if (pCtx->cr0 & X86_CR0_EM)
4206	return iemRaiseUndefinedOpcode(pIemCpu);
4207	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
4208	return iemRaiseDeviceNotAvailable(pIemCpu);
4209	if (GCPtrEff & 15)
4210	{
4211	/** @todo CPU/VM detection possible! \#AC might not be signal for
4212	* all/any misalignment sizes, intel says its an implementation detail. */
4213	if ( (pCtx->cr0 & X86_CR0_AM)
4214	&& pCtx->eflags.Bits.u1AC
4215	&& pIemCpu->uCpl == 3)
4216	return iemRaiseAlignmentCheckException(pIemCpu);
4217	return iemRaiseGeneralProtectionFault0(pIemCpu);
4218	}
4219	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
4220
4221	/*
4222	* Access the memory.
4223	*/
4224	void *pvMem512;
4225	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4226	if (rcStrict != VINF_SUCCESS)
4227	return rcStrict;
4228	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
4229
4230	/*
4231	* Store the registers.
4232	*/
4233	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
4234	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
4235
4236	/* common for all formats */
4237	pDst->FCW = pCtx->fpu.FCW;
4238	pDst->FSW = pCtx->fpu.FSW;
4239	pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
4240	pDst->FOP = pCtx->fpu.FOP;
4241	pDst->MXCSR = pCtx->fpu.MXCSR;
4242	pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
4243	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
4244	{
4245	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
4246	* them for now... */
4247	pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
4248	pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
4249	pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
4250	pDst->aRegs[i].au32[3] = 0;
4251	}
4252
4253	/* FPU IP, CS, DP and DS. */
4254	/** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
4255	* state information. :-/
4256	* Storing zeros now to prevent any potential leakage of host info. */
4257	pDst->FPUIP = 0;
4258	pDst->CS = 0;
4259	pDst->Rsrvd1 = 0;
4260	pDst->FPUDP = 0;
4261	pDst->DS = 0;
4262	pDst->Rsrvd2 = 0;
4263
4264	/* XMM registers. */
4265	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
4266	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
4267	\|\| pIemCpu->uCpl != 0)
4268	{
4269	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
4270	for (uint32_t i = 0; i < cXmmRegs; i++)
4271	pDst->aXMM[i] = pCtx->fpu.aXMM[i];
4272	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
4273	* right? */
4274	}
4275
4276	/*
4277	* Commit the memory.
4278	*/
4279	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4280	if (rcStrict != VINF_SUCCESS)
4281	return rcStrict;
4282
4283	iemRegAddToRip(pIemCpu, cbInstr);
4284	return VINF_SUCCESS;
4285	}
4286
4287
4288	/**
4289	* Implements 'FXRSTOR'.
4290	*
4291	* @param GCPtrEff The address of the image.
4292	* @param enmEffOpSize The operand size (only REX.W really matters).
4293	*/
4294	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
4295	{
4296	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4297
4298	/*
4299	* Raise exceptions.
4300	*/
4301	if (pCtx->cr0 & X86_CR0_EM)
4302	return iemRaiseUndefinedOpcode(pIemCpu);
4303	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
4304	return iemRaiseDeviceNotAvailable(pIemCpu);
4305	if (GCPtrEff & 15)
4306	{
4307	/** @todo CPU/VM detection possible! \#AC might not be signal for
4308	* all/any misalignment sizes, intel says its an implementation detail. */
4309	if ( (pCtx->cr0 & X86_CR0_AM)
4310	&& pCtx->eflags.Bits.u1AC
4311	&& pIemCpu->uCpl == 3)
4312	return iemRaiseAlignmentCheckException(pIemCpu);
4313	return iemRaiseGeneralProtectionFault0(pIemCpu);
4314	}
4315	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
4316
4317	/*
4318	* Access the memory.
4319	*/
4320	void *pvMem512;
4321	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
4322	if (rcStrict != VINF_SUCCESS)
4323	return rcStrict;
4324	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
4325
4326	/*
4327	* Check the state for stuff which will GP(0).
4328	*/
4329	uint32_t const fMXCSR = pSrc->MXCSR;
4330	uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
4331	if (fMXCSR & ~fMXCSR_MASK)
4332	{
4333	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
4334	return iemRaiseGeneralProtectionFault0(pIemCpu);
4335	}
4336
4337	/*
4338	* Load the registers.
4339	*/
4340	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
4341	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
4342
4343	/* common for all formats */
4344	pCtx->fpu.FCW = pSrc->FCW;
4345	pCtx->fpu.FSW = pSrc->FSW;
4346	pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
4347	pCtx->fpu.FOP = pSrc->FOP;
4348	pCtx->fpu.MXCSR = fMXCSR;
4349	/* (MXCSR_MASK is read-only) */
4350	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
4351	{
4352	pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
4353	pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
4354	pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
4355	pCtx->fpu.aRegs[i].au32[3] = 0;
4356	}
4357
4358	/* FPU IP, CS, DP and DS. */
4359	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4360	{
4361	pCtx->fpu.FPUIP = pSrc->FPUIP;
4362	pCtx->fpu.CS = pSrc->CS;
4363	pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
4364	pCtx->fpu.FPUDP = pSrc->FPUDP;
4365	pCtx->fpu.DS = pSrc->DS;
4366	pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
4367	}
4368	else
4369	{
4370	pCtx->fpu.FPUIP = pSrc->FPUIP;
4371	pCtx->fpu.CS = pSrc->CS;
4372	pCtx->fpu.Rsrvd1 = 0;
4373	pCtx->fpu.FPUDP = pSrc->FPUDP;
4374	pCtx->fpu.DS = pSrc->DS;
4375	pCtx->fpu.Rsrvd2 = 0;
4376	}
4377
4378	/* XMM registers. */
4379	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
4380	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
4381	\|\| pIemCpu->uCpl != 0)
4382	{
4383	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
4384	for (uint32_t i = 0; i < cXmmRegs; i++)
4385	pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
4386	}
4387
4388	/*
4389	* Commit the memory.
4390	*/
4391	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
4392	if (rcStrict != VINF_SUCCESS)
4393	return rcStrict;
4394
4395	iemHlpUsedFpu(pIemCpu);
4396	iemRegAddToRip(pIemCpu, cbInstr);
4397	return VINF_SUCCESS;
4398	}
4399
4400
4401	/**
4402	* Commmon routine for fnstenv and fnsave.
4403	*
4404	* @param uPtr Where to store the state.
4405	* @param pCtx The CPU context.
4406	*/
4407	static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
4408	{
4409	if (enmEffOpSize == IEMMODE_16BIT)
4410	{
4411	uPtr.pu16[0] = pCtx->fpu.FCW;
4412	uPtr.pu16[1] = pCtx->fpu.FSW;
4413	uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
4414	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4415	{
4416	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
4417	* protected mode or long mode and we save it in real mode? And vice
4418	* versa? And with 32-bit operand size? I think CPU is storing the
4419	* effective address ((CS << 4) + IP) in the offset register and not
4420	* doing any address calculations here. */
4421	uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
4422	uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) \| pCtx->fpu.FOP;
4423	uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
4424	uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
4425	}
4426	else
4427	{
4428	uPtr.pu16[3] = pCtx->fpu.FPUIP;
4429	uPtr.pu16[4] = pCtx->fpu.CS;
4430	uPtr.pu16[5] = pCtx->fpu.FPUDP;
4431	uPtr.pu16[6] = pCtx->fpu.DS;
4432	}
4433	}
4434	else
4435	{
4436	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
4437	uPtr.pu16[0*2] = pCtx->fpu.FCW;
4438	uPtr.pu16[1*2] = pCtx->fpu.FSW;
4439	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
4440	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4441	{
4442	uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
4443	uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) \| pCtx->fpu.FOP;
4444	uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
4445	uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
4446	}
4447	else
4448	{
4449	uPtr.pu32[3] = pCtx->fpu.FPUIP;
4450	uPtr.pu16[4*2] = pCtx->fpu.CS;
4451	uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
4452	uPtr.pu32[5] = pCtx->fpu.FPUDP;
4453	uPtr.pu16[6*2] = pCtx->fpu.DS;
4454	}
4455	}
4456	}
4457
4458
4459	/**
4460	* Commmon routine for fldenv and frstor
4461	*
4462	* @param uPtr Where to store the state.
4463	* @param pCtx The CPU context.
4464	*/
4465	static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
4466	{
4467	if (enmEffOpSize == IEMMODE_16BIT)
4468	{
4469	pCtx->fpu.FCW = uPtr.pu16[0];
4470	pCtx->fpu.FSW = uPtr.pu16[1];
4471	pCtx->fpu.FTW = uPtr.pu16[2];
4472	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4473	{
4474	pCtx->fpu.FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
4475	pCtx->fpu.FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
4476	pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
4477	pCtx->fpu.CS = 0;
4478	pCtx->fpu.Rsrvd1= 0;
4479	pCtx->fpu.DS = 0;
4480	pCtx->fpu.Rsrvd2= 0;
4481	}
4482	else
4483	{
4484	pCtx->fpu.FPUIP = uPtr.pu16[3];
4485	pCtx->fpu.CS = uPtr.pu16[4];
4486	pCtx->fpu.Rsrvd1= 0;
4487	pCtx->fpu.FPUDP = uPtr.pu16[5];
4488	pCtx->fpu.DS = uPtr.pu16[6];
4489	pCtx->fpu.Rsrvd2= 0;
4490	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
4491	}
4492	}
4493	else
4494	{
4495	pCtx->fpu.FCW = uPtr.pu16[0*2];
4496	pCtx->fpu.FSW = uPtr.pu16[1*2];
4497	pCtx->fpu.FTW = uPtr.pu16[2*2];
4498	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4499	{
4500	pCtx->fpu.FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
4501	pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
4502	pCtx->fpu.FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
4503	pCtx->fpu.CS = 0;
4504	pCtx->fpu.Rsrvd1= 0;
4505	pCtx->fpu.DS = 0;
4506	pCtx->fpu.Rsrvd2= 0;
4507	}
4508	else
4509	{
4510	pCtx->fpu.FPUIP = uPtr.pu32[3];
4511	pCtx->fpu.CS = uPtr.pu16[4*2];
4512	pCtx->fpu.Rsrvd1= 0;
4513	pCtx->fpu.FOP = uPtr.pu16[4*2+1];
4514	pCtx->fpu.FPUDP = uPtr.pu32[5];
4515	pCtx->fpu.DS = uPtr.pu16[6*2];
4516	pCtx->fpu.Rsrvd2= 0;
4517	}
4518	}
4519
4520	/* Make adjustments. */
4521	pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
4522	pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
4523	iemFpuRecalcExceptionStatus(pCtx);
4524	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
4525	* exceptions are pending after loading the saved state? */
4526	}
4527
4528
4529	/**
4530	* Implements 'FNSTENV'.
4531	*
4532	* @param enmEffOpSize The operand size (only REX.W really matters).
4533	* @param iEffSeg The effective segment register for @a GCPtrEff.
4534	* @param GCPtrEffDst The address of the image.
4535	*/
4536	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4537	{
4538	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4539	RTPTRUNION uPtr;
4540	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
4541	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4542	if (rcStrict != VINF_SUCCESS)
4543	return rcStrict;
4544
4545	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4546
4547	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4548	if (rcStrict != VINF_SUCCESS)
4549	return rcStrict;
4550
4551	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
4552	iemRegAddToRip(pIemCpu, cbInstr);
4553	return VINF_SUCCESS;
4554	}
4555
4556
4557	/**
4558	* Implements 'FNSAVE'.
4559	*
4560	* @param GCPtrEffDst The address of the image.
4561	* @param enmEffOpSize The operand size.
4562	*/
4563	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4564	{
4565	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4566	RTPTRUNION uPtr;
4567	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
4568	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4569	if (rcStrict != VINF_SUCCESS)
4570	return rcStrict;
4571
4572	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4573	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
4574	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
4575	{
4576	paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
4577	paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
4578	paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
4579	}
4580
4581	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
4582	if (rcStrict != VINF_SUCCESS)
4583	return rcStrict;
4584
4585	/*
4586	* Re-initialize the FPU.
4587	*/
4588	pCtx->fpu.FCW = 0x37f;
4589	pCtx->fpu.FSW = 0;
4590	pCtx->fpu.FTW = 0x00; /* 0 - empty */
4591	pCtx->fpu.FPUDP = 0;
4592	pCtx->fpu.DS = 0;
4593	pCtx->fpu.Rsrvd2= 0;
4594	pCtx->fpu.FPUIP = 0;
4595	pCtx->fpu.CS = 0;
4596	pCtx->fpu.Rsrvd1= 0;
4597	pCtx->fpu.FOP = 0;
4598
4599	iemHlpUsedFpu(pIemCpu);
4600	iemRegAddToRip(pIemCpu, cbInstr);
4601	return VINF_SUCCESS;
4602	}
4603
4604
4605
4606	/**
4607	* Implements 'FLDENV'.
4608	*
4609	* @param enmEffOpSize The operand size (only REX.W really matters).
4610	* @param iEffSeg The effective segment register for @a GCPtrEff.
4611	* @param GCPtrEffSrc The address of the image.
4612	*/
4613	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
4614	{
4615	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4616	RTCPTRUNION uPtr;
4617	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
4618	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
4619	if (rcStrict != VINF_SUCCESS)
4620	return rcStrict;
4621
4622	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4623
4624	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
4625	if (rcStrict != VINF_SUCCESS)
4626	return rcStrict;
4627
4628	iemHlpUsedFpu(pIemCpu);
4629	iemRegAddToRip(pIemCpu, cbInstr);
4630	return VINF_SUCCESS;
4631	}
4632
4633
4634	/**
4635	* Implements 'FRSTOR'.
4636	*
4637	* @param GCPtrEffSrc The address of the image.
4638	* @param enmEffOpSize The operand size.
4639	*/
4640	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
4641	{
4642	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4643	RTCPTRUNION uPtr;
4644	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
4645	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
4646	if (rcStrict != VINF_SUCCESS)
4647	return rcStrict;
4648
4649	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4650	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
4651	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
4652	{
4653	pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
4654	pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
4655	pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
4656	pCtx->fpu.aRegs[i].au32[3] = 0;
4657	}
4658
4659	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
4660	if (rcStrict != VINF_SUCCESS)
4661	return rcStrict;
4662
4663	iemHlpUsedFpu(pIemCpu);
4664	iemRegAddToRip(pIemCpu, cbInstr);
4665	return VINF_SUCCESS;
4666	}
4667
4668
4669	/**
4670	* Implements 'FLDCW'.
4671	*
4672	* @param u16Fcw The new FCW.
4673	*/
4674	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
4675	{
4676	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4677
4678	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
4679	/** @todo Testcase: Try see what happens when trying to set undefined bits
4680	* (other than 6 and 7). Currently ignoring them. */
4681	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
4682	* according to FSW. (This is was is currently implemented.) */
4683	pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
4684	iemFpuRecalcExceptionStatus(pCtx);
4685
4686	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
4687	iemHlpUsedFpu(pIemCpu);
4688	iemRegAddToRip(pIemCpu, cbInstr);
4689	return VINF_SUCCESS;
4690	}
4691
4692
4693
4694	/**
4695	* Implements the underflow case of fxch.
4696	*
4697	* @param iStReg The other stack register.
4698	*/
4699	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
4700	{
4701	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4702
4703	unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
4704	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
4705	Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) \|\| !(RT_BIT(iReg2) & pCtx->fpu.FTW));
4706
4707	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
4708	* registers are read as QNaN and then exchanged. This could be
4709	* wrong... */
4710	if (pCtx->fpu.FCW & X86_FCW_IM)
4711	{
4712	if (RT_BIT(iReg1) & pCtx->fpu.FTW)
4713	{
4714	if (RT_BIT(iReg2) & pCtx->fpu.FTW)
4715	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
4716	else
4717	pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
4718	iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
4719	}
4720	else
4721	{
4722	pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
4723	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
4724	}
4725	pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
4726	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
4727	}
4728	else
4729	{
4730	/* raise underflow exception, don't change anything. */
4731	pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
4732	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
4733	}
4734
4735	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
4736	iemHlpUsedFpu(pIemCpu);
4737	iemRegAddToRip(pIemCpu, cbInstr);
4738	return VINF_SUCCESS;
4739	}
4740
4741
4742	/**
4743	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
4744	*
4745	* @param cToAdd 1 or 7.
4746	*/
4747	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
4748	{
4749	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4750	Assert(iStReg < 8);
4751
4752	/*
4753	* Raise exceptions.
4754	*/
4755	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
4756	return iemRaiseDeviceNotAvailable(pIemCpu);
4757	uint16_t u16Fsw = pCtx->fpu.FSW;
4758	if (u16Fsw & X86_FSW_ES)
4759	return iemRaiseMathFault(pIemCpu);
4760
4761	/*
4762	* Check if any of the register accesses causes #SF + #IA.
4763	*/
4764	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
4765	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
4766	if ((pCtx->fpu.FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
4767	{
4768	uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
4769	pCtx->fpu.FSW &= ~X86_FSW_C1;
4770	pCtx->fpu.FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
4771	if ( !(u16Fsw & X86_FSW_IE)
4772	\|\| (pCtx->fpu.FCW & X86_FCW_IM) )
4773	{
4774	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
4775	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
4776	}
4777	}
4778	else if (pCtx->fpu.FCW & X86_FCW_IM)
4779	{
4780	/* Masked underflow. */
4781	pCtx->fpu.FSW &= ~X86_FSW_C1;
4782	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF;
4783	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
4784	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
4785	}
4786	else
4787	{
4788	/* Raise underflow - don't touch EFLAGS or TOP. */
4789	pCtx->fpu.FSW &= ~X86_FSW_C1;
4790	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
4791	fPop = false;
4792	}
4793
4794	/*
4795	* Pop if necessary.
4796	*/
4797	if (fPop)
4798	{
4799	pCtx->fpu.FTW &= ~RT_BIT(iReg1);
4800	pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
4801	pCtx->fpu.FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
4802	}
4803
4804	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
4805	iemHlpUsedFpu(pIemCpu);
4806	iemRegAddToRip(pIemCpu, cbInstr);
4807	return VINF_SUCCESS;
4808	}
4809
4810	/** @} */
4811

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 42724

Download in other formats: