IEMAllCImpl.cpp.h@ 47764

Last change on this file since 47764 was 47749, checked in by vboxsync, 12 years ago
null selector fix.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 195.6 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 47749 2013-08-15 10:53:43Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @name Misc Helpers
20	* @{
21	*/
22
23
24	/**
25	* Worker function for iemHlpCheckPortIOPermission, don't call directly.
26	*
27	* @returns Strict VBox status code.
28	*
29	* @param pIemCpu The IEM per CPU data.
30	* @param pCtx The register context.
31	* @param u16Port The port number.
32	* @param cbOperand The operand size.
33	*/
34	static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
35	{
36	/* The TSS bits we're interested in are the same on 386 and AMD64. */
37	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
38	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
39	AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
40	AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
41
42	/*
43	* Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
44	*/
45	Assert(!pCtx->tr.Attr.n.u1DescType);
46	if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
47	&& pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
48	{
49	Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
50	u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
51	return iemRaiseGeneralProtectionFault0(pIemCpu);
52	}
53
54	/*
55	* Read the bitmap offset (may #PF).
56	*/
57	uint16_t offBitmap;
58	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
59	pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
60	if (rcStrict != VINF_SUCCESS)
61	{
62	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
63	return rcStrict;
64	}
65
66	/*
67	* The bit range from u16Port to (u16Port + cbOperand - 1), however intel
68	* describes the CPU actually reading two bytes regardless of whether the
69	* bit range crosses a byte boundrary. Thus the + 1 in the test below.
70	*/
71	uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
72	/** @todo check if real CPUs ensures that offBitmap has a minimum value of
73	* for instance sizeof(X86TSS32). */
74	if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
75	{
76	Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
77	offFirstBit, pCtx->tr.u32Limit));
78	return iemRaiseGeneralProtectionFault0(pIemCpu);
79	}
80
81	/*
82	* Read the necessary bits.
83	*/
84	/** @todo Test the assertion in the intel manual that the CPU reads two
85	* bytes. The question is how this works wrt to #PF and #GP on the
86	* 2nd byte when it's not required. */
87	uint16_t bmBytes = UINT16_MAX;
88	rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
89	if (rcStrict != VINF_SUCCESS)
90	{
91	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
92	return rcStrict;
93	}
94
95	/*
96	* Perform the check.
97	*/
98	uint16_t fPortMask = (1 << cbOperand) - 1;
99	bmBytes >>= (u16Port & 7);
100	if (bmBytes & fPortMask)
101	{
102	Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
103	u16Port, cbOperand, bmBytes, fPortMask));
104	return iemRaiseGeneralProtectionFault0(pIemCpu);
105	}
106
107	return VINF_SUCCESS;
108	}
109
110
111	/**
112	* Checks if we are allowed to access the given I/O port, raising the
113	* appropriate exceptions if we aren't (or if the I/O bitmap is not
114	* accessible).
115	*
116	* @returns Strict VBox status code.
117	*
118	* @param pIemCpu The IEM per CPU data.
119	* @param pCtx The register context.
120	* @param u16Port The port number.
121	* @param cbOperand The operand size.
122	*/
123	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
124	{
125	X86EFLAGS Efl;
126	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
127	if ( (pCtx->cr0 & X86_CR0_PE)
128	&& ( pIemCpu->uCpl > Efl.Bits.u2IOPL
129	\|\| Efl.Bits.u1VM) )
130	return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
131	return VINF_SUCCESS;
132	}
133
134
135	#if 0
136	/**
137	* Calculates the parity bit.
138	*
139	* @returns true if the bit is set, false if not.
140	* @param u8Result The least significant byte of the result.
141	*/
142	static bool iemHlpCalcParityFlag(uint8_t u8Result)
143	{
144	/*
145	* Parity is set if the number of bits in the least significant byte of
146	* the result is even.
147	*/
148	uint8_t cBits;
149	cBits = u8Result & 1; /* 0 */
150	u8Result >>= 1;
151	cBits += u8Result & 1;
152	u8Result >>= 1;
153	cBits += u8Result & 1;
154	u8Result >>= 1;
155	cBits += u8Result & 1;
156	u8Result >>= 1;
157	cBits += u8Result & 1; /* 4 */
158	u8Result >>= 1;
159	cBits += u8Result & 1;
160	u8Result >>= 1;
161	cBits += u8Result & 1;
162	u8Result >>= 1;
163	cBits += u8Result & 1;
164	return !(cBits & 1);
165	}
166	#endif /* not used */
167
168
169	/**
170	* Updates the specified flags according to a 8-bit result.
171	*
172	* @param pIemCpu The IEM state of the calling EMT.
173	* @param u8Result The result to set the flags according to.
174	* @param fToUpdate The flags to update.
175	* @param fUndefined The flags that are specified as undefined.
176	*/
177	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
178	{
179	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
180
181	uint32_t fEFlags = pCtx->eflags.u;
182	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
183	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
184	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
185	#ifdef IEM_VERIFICATION_MODE_FULL
186	pIemCpu->fUndefinedEFlags \|= fUndefined;
187	#endif
188	}
189
190
191	/**
192	* Loads a NULL data selector into a selector register, both the hidden and
193	* visible parts, in protected mode.
194	*
195	* @param pIemCpu The IEM state of the calling EMT.
196	* @param pSReg Pointer to the segment register.
197	* @param uRpl The RPL.
198	*/
199	static void iemHlpLoadNullDataSelectorProt(PIEMCPU pIemCpu, PCPUMSELREG pSReg, RTSEL uRpl)
200	{
201	/** @todo Testcase: write a testcase checking what happends when loading a NULL
202	* data selector in protected mode. */
203	pSReg->Sel = uRpl;
204	pSReg->ValidSel = uRpl;
205	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
206	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
207	{
208	/* VT-x (Intel 3960x) observed doing something like this. */
209	pSReg->Attr.u = X86DESCATTR_UNUSABLE \| X86DESCATTR_G \| X86DESCATTR_D \| (pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT);
210	pSReg->u32Limit = UINT32_MAX;
211	pSReg->u64Base = 0;
212	}
213	else
214	{
215	pSReg->Attr.u = X86DESCATTR_UNUSABLE;
216	pSReg->u32Limit = 0;
217	pSReg->u64Base = 0;
218	}
219	}
220
221
222	/**
223	* Helper used by iret.
224	*
225	* @param uCpl The new CPL.
226	* @param pSReg Pointer to the segment register.
227	*/
228	static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
229	{
230	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
231	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
232	CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
233	#else
234	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
235	#endif
236
237	if ( uCpl > pSReg->Attr.n.u2Dpl
238	&& pSReg->Attr.n.u1DescType /* code or data, not system */
239	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
240	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
241	iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, 0);
242	}
243
244
245	/**
246	* Indicates that we have modified the FPU state.
247	*
248	* @param pIemCpu The IEM state of the calling EMT.
249	*/
250	DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
251	{
252	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
253	}
254
255	/** @} */
256
257	/** @name C Implementations
258	* @{
259	*/
260
261	/**
262	* Implements a 16-bit popa.
263	*/
264	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
265	{
266	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
267	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
268	RTGCPTR GCPtrLast = GCPtrStart + 15;
269	VBOXSTRICTRC rcStrict;
270
271	/*
272	* The docs are a bit hard to comprehend here, but it looks like we wrap
273	* around in real mode as long as none of the individual "popa" crosses the
274	* end of the stack segment. In protected mode we check the whole access
275	* in one go. For efficiency, only do the word-by-word thing if we're in
276	* danger of wrapping around.
277	*/
278	/** @todo do popa boundary / wrap-around checks. */
279	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
280	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
281	{
282	/* word-by-word */
283	RTUINT64U TmpRsp;
284	TmpRsp.u = pCtx->rsp;
285	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
286	if (rcStrict == VINF_SUCCESS)
287	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
288	if (rcStrict == VINF_SUCCESS)
289	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
290	if (rcStrict == VINF_SUCCESS)
291	{
292	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
293	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
294	}
295	if (rcStrict == VINF_SUCCESS)
296	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
297	if (rcStrict == VINF_SUCCESS)
298	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
299	if (rcStrict == VINF_SUCCESS)
300	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
301	if (rcStrict == VINF_SUCCESS)
302	{
303	pCtx->rsp = TmpRsp.u;
304	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
305	}
306	}
307	else
308	{
309	uint16_t const *pa16Mem = NULL;
310	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
311	if (rcStrict == VINF_SUCCESS)
312	{
313	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
314	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
315	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
316	/* skip sp */
317	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
318	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
319	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
320	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
321	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
322	if (rcStrict == VINF_SUCCESS)
323	{
324	iemRegAddToRsp(pIemCpu, pCtx, 16);
325	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
326	}
327	}
328	}
329	return rcStrict;
330	}
331
332
333	/**
334	* Implements a 32-bit popa.
335	*/
336	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
337	{
338	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
339	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
340	RTGCPTR GCPtrLast = GCPtrStart + 31;
341	VBOXSTRICTRC rcStrict;
342
343	/*
344	* The docs are a bit hard to comprehend here, but it looks like we wrap
345	* around in real mode as long as none of the individual "popa" crosses the
346	* end of the stack segment. In protected mode we check the whole access
347	* in one go. For efficiency, only do the word-by-word thing if we're in
348	* danger of wrapping around.
349	*/
350	/** @todo do popa boundary / wrap-around checks. */
351	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
352	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
353	{
354	/* word-by-word */
355	RTUINT64U TmpRsp;
356	TmpRsp.u = pCtx->rsp;
357	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
358	if (rcStrict == VINF_SUCCESS)
359	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
360	if (rcStrict == VINF_SUCCESS)
361	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
362	if (rcStrict == VINF_SUCCESS)
363	{
364	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
365	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
366	}
367	if (rcStrict == VINF_SUCCESS)
368	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
369	if (rcStrict == VINF_SUCCESS)
370	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
371	if (rcStrict == VINF_SUCCESS)
372	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
373	if (rcStrict == VINF_SUCCESS)
374	{
375	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
376	pCtx->rdi &= UINT32_MAX;
377	pCtx->rsi &= UINT32_MAX;
378	pCtx->rbp &= UINT32_MAX;
379	pCtx->rbx &= UINT32_MAX;
380	pCtx->rdx &= UINT32_MAX;
381	pCtx->rcx &= UINT32_MAX;
382	pCtx->rax &= UINT32_MAX;
383	#endif
384	pCtx->rsp = TmpRsp.u;
385	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
386	}
387	}
388	else
389	{
390	uint32_t const *pa32Mem;
391	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
392	if (rcStrict == VINF_SUCCESS)
393	{
394	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
395	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
396	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
397	/* skip esp */
398	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
399	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
400	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
401	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
402	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
403	if (rcStrict == VINF_SUCCESS)
404	{
405	iemRegAddToRsp(pIemCpu, pCtx, 32);
406	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
407	}
408	}
409	}
410	return rcStrict;
411	}
412
413
414	/**
415	* Implements a 16-bit pusha.
416	*/
417	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
418	{
419	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
420	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
421	RTGCPTR GCPtrBottom = GCPtrTop - 15;
422	VBOXSTRICTRC rcStrict;
423
424	/*
425	* The docs are a bit hard to comprehend here, but it looks like we wrap
426	* around in real mode as long as none of the individual "pushd" crosses the
427	* end of the stack segment. In protected mode we check the whole access
428	* in one go. For efficiency, only do the word-by-word thing if we're in
429	* danger of wrapping around.
430	*/
431	/** @todo do pusha boundary / wrap-around checks. */
432	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
433	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
434	{
435	/* word-by-word */
436	RTUINT64U TmpRsp;
437	TmpRsp.u = pCtx->rsp;
438	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
439	if (rcStrict == VINF_SUCCESS)
440	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
441	if (rcStrict == VINF_SUCCESS)
442	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
443	if (rcStrict == VINF_SUCCESS)
444	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
445	if (rcStrict == VINF_SUCCESS)
446	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
447	if (rcStrict == VINF_SUCCESS)
448	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
449	if (rcStrict == VINF_SUCCESS)
450	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
451	if (rcStrict == VINF_SUCCESS)
452	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
453	if (rcStrict == VINF_SUCCESS)
454	{
455	pCtx->rsp = TmpRsp.u;
456	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
457	}
458	}
459	else
460	{
461	GCPtrBottom--;
462	uint16_t *pa16Mem = NULL;
463	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
464	if (rcStrict == VINF_SUCCESS)
465	{
466	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
467	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
468	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
469	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
470	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
471	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
472	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
473	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
474	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
475	if (rcStrict == VINF_SUCCESS)
476	{
477	iemRegSubFromRsp(pIemCpu, pCtx, 16);
478	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
479	}
480	}
481	}
482	return rcStrict;
483	}
484
485
486	/**
487	* Implements a 32-bit pusha.
488	*/
489	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
490	{
491	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
492	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
493	RTGCPTR GCPtrBottom = GCPtrTop - 31;
494	VBOXSTRICTRC rcStrict;
495
496	/*
497	* The docs are a bit hard to comprehend here, but it looks like we wrap
498	* around in real mode as long as none of the individual "pusha" crosses the
499	* end of the stack segment. In protected mode we check the whole access
500	* in one go. For efficiency, only do the word-by-word thing if we're in
501	* danger of wrapping around.
502	*/
503	/** @todo do pusha boundary / wrap-around checks. */
504	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
505	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
506	{
507	/* word-by-word */
508	RTUINT64U TmpRsp;
509	TmpRsp.u = pCtx->rsp;
510	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
511	if (rcStrict == VINF_SUCCESS)
512	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
513	if (rcStrict == VINF_SUCCESS)
514	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
515	if (rcStrict == VINF_SUCCESS)
516	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
517	if (rcStrict == VINF_SUCCESS)
518	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
519	if (rcStrict == VINF_SUCCESS)
520	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
521	if (rcStrict == VINF_SUCCESS)
522	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
523	if (rcStrict == VINF_SUCCESS)
524	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
525	if (rcStrict == VINF_SUCCESS)
526	{
527	pCtx->rsp = TmpRsp.u;
528	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
529	}
530	}
531	else
532	{
533	GCPtrBottom--;
534	uint32_t *pa32Mem;
535	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
536	if (rcStrict == VINF_SUCCESS)
537	{
538	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
539	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
540	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
541	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
542	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
543	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
544	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
545	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
546	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
547	if (rcStrict == VINF_SUCCESS)
548	{
549	iemRegSubFromRsp(pIemCpu, pCtx, 32);
550	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
551	}
552	}
553	}
554	return rcStrict;
555	}
556
557
558	/**
559	* Implements pushf.
560	*
561	*
562	* @param enmEffOpSize The effective operand size.
563	*/
564	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
565	{
566	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
567
568	/*
569	* If we're in V8086 mode some care is required (which is why we're in
570	* doing this in a C implementation).
571	*/
572	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
573	if ( (fEfl & X86_EFL_VM)
574	&& X86_EFL_GET_IOPL(fEfl) != 3 )
575	{
576	Assert(pCtx->cr0 & X86_CR0_PE);
577	if ( enmEffOpSize != IEMMODE_16BIT
578	\|\| !(pCtx->cr4 & X86_CR4_VME))
579	return iemRaiseGeneralProtectionFault0(pIemCpu);
580	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
581	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
582	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
583	}
584
585	/*
586	* Ok, clear RF and VM and push the flags.
587	*/
588	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
589
590	VBOXSTRICTRC rcStrict;
591	switch (enmEffOpSize)
592	{
593	case IEMMODE_16BIT:
594	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
595	break;
596	case IEMMODE_32BIT:
597	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
598	break;
599	case IEMMODE_64BIT:
600	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
601	break;
602	IEM_NOT_REACHED_DEFAULT_CASE_RET();
603	}
604	if (rcStrict != VINF_SUCCESS)
605	return rcStrict;
606
607	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
608	return VINF_SUCCESS;
609	}
610
611
612	/**
613	* Implements popf.
614	*
615	* @param enmEffOpSize The effective operand size.
616	*/
617	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
618	{
619	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
620	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
621	uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
622	VBOXSTRICTRC rcStrict;
623	uint32_t fEflNew;
624
625	/*
626	* V8086 is special as usual.
627	*/
628	if (fEflOld & X86_EFL_VM)
629	{
630	/*
631	* Almost anything goes if IOPL is 3.
632	*/
633	if (X86_EFL_GET_IOPL(fEflOld) == 3)
634	{
635	switch (enmEffOpSize)
636	{
637	case IEMMODE_16BIT:
638	{
639	uint16_t u16Value;
640	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
641	if (rcStrict != VINF_SUCCESS)
642	return rcStrict;
643	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
644	break;
645	}
646	case IEMMODE_32BIT:
647	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
648	if (rcStrict != VINF_SUCCESS)
649	return rcStrict;
650	break;
651	IEM_NOT_REACHED_DEFAULT_CASE_RET();
652	}
653
654	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
655	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
656	}
657	/*
658	* Interrupt flag virtualization with CR4.VME=1.
659	*/
660	else if ( enmEffOpSize == IEMMODE_16BIT
661	&& (pCtx->cr4 & X86_CR4_VME) )
662	{
663	uint16_t u16Value;
664	RTUINT64U TmpRsp;
665	TmpRsp.u = pCtx->rsp;
666	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
667	if (rcStrict != VINF_SUCCESS)
668	return rcStrict;
669
670	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
671	* or before? */
672	if ( ( (u16Value & X86_EFL_IF)
673	&& (fEflOld & X86_EFL_VIP))
674	\|\| (u16Value & X86_EFL_TF) )
675	return iemRaiseGeneralProtectionFault0(pIemCpu);
676
677	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
678	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
679	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
680	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
681
682	pCtx->rsp = TmpRsp.u;
683	}
684	else
685	return iemRaiseGeneralProtectionFault0(pIemCpu);
686
687	}
688	/*
689	* Not in V8086 mode.
690	*/
691	else
692	{
693	/* Pop the flags. */
694	switch (enmEffOpSize)
695	{
696	case IEMMODE_16BIT:
697	{
698	uint16_t u16Value;
699	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
700	if (rcStrict != VINF_SUCCESS)
701	return rcStrict;
702	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
703	break;
704	}
705	case IEMMODE_32BIT:
706	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
707	if (rcStrict != VINF_SUCCESS)
708	return rcStrict;
709	break;
710	case IEMMODE_64BIT:
711	{
712	uint64_t u64Value;
713	rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
714	if (rcStrict != VINF_SUCCESS)
715	return rcStrict;
716	fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
717	break;
718	}
719	IEM_NOT_REACHED_DEFAULT_CASE_RET();
720	}
721
722	/* Merge them with the current flags. */
723	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
724	\|\| pIemCpu->uCpl == 0)
725	{
726	fEflNew &= X86_EFL_POPF_BITS;
727	fEflNew \|= ~X86_EFL_POPF_BITS & fEflOld;
728	}
729	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
730	{
731	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
732	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
733	}
734	else
735	{
736	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
737	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
738	}
739	}
740
741	/*
742	* Commit the flags.
743	*/
744	Assert(fEflNew & RT_BIT_32(1));
745	IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
746	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
747
748	return VINF_SUCCESS;
749	}
750
751
752	/**
753	* Implements an indirect call.
754	*
755	* @param uNewPC The new program counter (RIP) value (loaded from the
756	* operand).
757	* @param enmEffOpSize The effective operand size.
758	*/
759	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
760	{
761	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
762	uint16_t uOldPC = pCtx->ip + cbInstr;
763	if (uNewPC > pCtx->cs.u32Limit)
764	return iemRaiseGeneralProtectionFault0(pIemCpu);
765
766	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
767	if (rcStrict != VINF_SUCCESS)
768	return rcStrict;
769
770	pCtx->rip = uNewPC;
771	pCtx->eflags.Bits.u1RF = 0;
772	return VINF_SUCCESS;
773	}
774
775
776	/**
777	* Implements a 16-bit relative call.
778	*
779	* @param offDisp The displacment offset.
780	*/
781	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
782	{
783	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
784	uint16_t uOldPC = pCtx->ip + cbInstr;
785	uint16_t uNewPC = uOldPC + offDisp;
786	if (uNewPC > pCtx->cs.u32Limit)
787	return iemRaiseGeneralProtectionFault0(pIemCpu);
788
789	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
790	if (rcStrict != VINF_SUCCESS)
791	return rcStrict;
792
793	pCtx->rip = uNewPC;
794	pCtx->eflags.Bits.u1RF = 0;
795	return VINF_SUCCESS;
796	}
797
798
799	/**
800	* Implements a 32-bit indirect call.
801	*
802	* @param uNewPC The new program counter (RIP) value (loaded from the
803	* operand).
804	* @param enmEffOpSize The effective operand size.
805	*/
806	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
807	{
808	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
809	uint32_t uOldPC = pCtx->eip + cbInstr;
810	if (uNewPC > pCtx->cs.u32Limit)
811	return iemRaiseGeneralProtectionFault0(pIemCpu);
812
813	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
814	if (rcStrict != VINF_SUCCESS)
815	return rcStrict;
816
817	pCtx->rip = uNewPC;
818	pCtx->eflags.Bits.u1RF = 0;
819	return VINF_SUCCESS;
820	}
821
822
823	/**
824	* Implements a 32-bit relative call.
825	*
826	* @param offDisp The displacment offset.
827	*/
828	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
829	{
830	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
831	uint32_t uOldPC = pCtx->eip + cbInstr;
832	uint32_t uNewPC = uOldPC + offDisp;
833	if (uNewPC > pCtx->cs.u32Limit)
834	return iemRaiseGeneralProtectionFault0(pIemCpu);
835
836	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
837	if (rcStrict != VINF_SUCCESS)
838	return rcStrict;
839
840	pCtx->rip = uNewPC;
841	pCtx->eflags.Bits.u1RF = 0;
842	return VINF_SUCCESS;
843	}
844
845
846	/**
847	* Implements a 64-bit indirect call.
848	*
849	* @param uNewPC The new program counter (RIP) value (loaded from the
850	* operand).
851	* @param enmEffOpSize The effective operand size.
852	*/
853	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
854	{
855	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
856	uint64_t uOldPC = pCtx->rip + cbInstr;
857	if (!IEM_IS_CANONICAL(uNewPC))
858	return iemRaiseGeneralProtectionFault0(pIemCpu);
859
860	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
861	if (rcStrict != VINF_SUCCESS)
862	return rcStrict;
863
864	pCtx->rip = uNewPC;
865	pCtx->eflags.Bits.u1RF = 0;
866	return VINF_SUCCESS;
867	}
868
869
870	/**
871	* Implements a 64-bit relative call.
872	*
873	* @param offDisp The displacment offset.
874	*/
875	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
876	{
877	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
878	uint64_t uOldPC = pCtx->rip + cbInstr;
879	uint64_t uNewPC = uOldPC + offDisp;
880	if (!IEM_IS_CANONICAL(uNewPC))
881	return iemRaiseNotCanonical(pIemCpu);
882
883	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
884	if (rcStrict != VINF_SUCCESS)
885	return rcStrict;
886
887	pCtx->rip = uNewPC;
888	pCtx->eflags.Bits.u1RF = 0;
889	return VINF_SUCCESS;
890	}
891
892
893	/**
894	* Implements far jumps and calls thru task segments (TSS).
895	*
896	* @param uSel The selector.
897	* @param enmBranch The kind of branching we're performing.
898	* @param enmEffOpSize The effective operand size.
899	* @param pDesc The descriptor corrsponding to @a uSel. The type is
900	* call gate.
901	*/
902	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
903	{
904	/* Call various functions to do the work. Clear RF? */
905	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
906	}
907
908
909	/**
910	* Implements far jumps and calls thru task gates.
911	*
912	* @param uSel The selector.
913	* @param enmBranch The kind of branching we're performing.
914	* @param enmEffOpSize The effective operand size.
915	* @param pDesc The descriptor corrsponding to @a uSel. The type is
916	* call gate.
917	*/
918	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
919	{
920	/* Call various functions to do the work. Don't clear RF */
921	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
922	}
923
924
925	/**
926	* Implements far jumps and calls thru call gates.
927	*
928	* @param uSel The selector.
929	* @param enmBranch The kind of branching we're performing.
930	* @param enmEffOpSize The effective operand size.
931	* @param pDesc The descriptor corrsponding to @a uSel. The type is
932	* call gate.
933	*/
934	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
935	{
936	/* Call various functions to do the work. Clear RF. */
937	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
938	}
939
940
941	/**
942	* Implements far jumps and calls thru system selectors.
943	*
944	* @param uSel The selector.
945	* @param enmBranch The kind of branching we're performing.
946	* @param enmEffOpSize The effective operand size.
947	* @param pDesc The descriptor corrsponding to @a uSel.
948	*/
949	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
950	{
951	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
952	Assert((uSel & X86_SEL_MASK_OFF_RPL));
953
954	if (IEM_IS_LONG_MODE(pIemCpu))
955	switch (pDesc->Legacy.Gen.u4Type)
956	{
957	case AMD64_SEL_TYPE_SYS_CALL_GATE:
958	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
959
960	default:
961	case AMD64_SEL_TYPE_SYS_LDT:
962	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
963	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
964	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
965	case AMD64_SEL_TYPE_SYS_INT_GATE:
966	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
967	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
968
969	}
970
971	switch (pDesc->Legacy.Gen.u4Type)
972	{
973	case X86_SEL_TYPE_SYS_286_CALL_GATE:
974	case X86_SEL_TYPE_SYS_386_CALL_GATE:
975	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
976
977	case X86_SEL_TYPE_SYS_TASK_GATE:
978	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
979
980	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
981	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
982	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
983
984	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
985	Log(("branch %04x -> busy 286 TSS\n", uSel));
986	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
987
988	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
989	Log(("branch %04x -> busy 386 TSS\n", uSel));
990	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
991
992	default:
993	case X86_SEL_TYPE_SYS_LDT:
994	case X86_SEL_TYPE_SYS_286_INT_GATE:
995	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
996	case X86_SEL_TYPE_SYS_386_INT_GATE:
997	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
998	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
999	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1000	}
1001	}
1002
1003
1004	/**
1005	* Implements far jumps.
1006	*
1007	* @param uSel The selector.
1008	* @param offSeg The segment offset.
1009	* @param enmEffOpSize The effective operand size.
1010	*/
1011	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1012	{
1013	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1014	NOREF(cbInstr);
1015	Assert(offSeg <= UINT32_MAX);
1016
1017	/*
1018	* Real mode and V8086 mode are easy. The only snag seems to be that
1019	* CS.limit doesn't change and the limit check is done against the current
1020	* limit.
1021	*/
1022	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1023	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1024	{
1025	if (offSeg > pCtx->cs.u32Limit)
1026	return iemRaiseGeneralProtectionFault0(pIemCpu);
1027
1028	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1029	pCtx->rip = offSeg;
1030	else
1031	pCtx->rip = offSeg & UINT16_MAX;
1032	pCtx->cs.Sel = uSel;
1033	pCtx->cs.ValidSel = uSel;
1034	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1035	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1036	pCtx->eflags.Bits.u1RF = 0;
1037	return VINF_SUCCESS;
1038	}
1039
1040	/*
1041	* Protected mode. Need to parse the specified descriptor...
1042	*/
1043	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1044	{
1045	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1046	return iemRaiseGeneralProtectionFault0(pIemCpu);
1047	}
1048
1049	/* Fetch the descriptor. */
1050	IEMSELDESC Desc;
1051	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1052	if (rcStrict != VINF_SUCCESS)
1053	return rcStrict;
1054
1055	/* Is it there? */
1056	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1057	{
1058	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1059	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1060	}
1061
1062	/*
1063	* Deal with it according to its type. We do the standard code selectors
1064	* here and dispatch the system selectors to worker functions.
1065	*/
1066	if (!Desc.Legacy.Gen.u1DescType)
1067	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1068
1069	/* Only code segments. */
1070	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1071	{
1072	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1073	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1074	}
1075
1076	/* L vs D. */
1077	if ( Desc.Legacy.Gen.u1Long
1078	&& Desc.Legacy.Gen.u1DefBig
1079	&& IEM_IS_LONG_MODE(pIemCpu))
1080	{
1081	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1082	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1083	}
1084
1085	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1086	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1087	{
1088	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1089	{
1090	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1091	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1092	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1093	}
1094	}
1095	else
1096	{
1097	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1098	{
1099	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1100	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1101	}
1102	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1103	{
1104	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1105	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1106	}
1107	}
1108
1109	/* Chop the high bits if 16-bit (Intel says so). */
1110	if (enmEffOpSize == IEMMODE_16BIT)
1111	offSeg &= UINT16_MAX;
1112
1113	/* Limit check. (Should alternatively check for non-canonical addresses
1114	here, but that is ruled out by offSeg being 32-bit, right?) */
1115	uint64_t u64Base;
1116	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1117	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1118	u64Base = 0;
1119	else
1120	{
1121	if (offSeg > cbLimit)
1122	{
1123	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1124	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1125	}
1126	u64Base = X86DESC_BASE(&Desc.Legacy);
1127	}
1128
1129	/*
1130	* Ok, everything checked out fine. Now set the accessed bit before
1131	* committing the result into CS, CSHID and RIP.
1132	*/
1133	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1134	{
1135	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1136	if (rcStrict != VINF_SUCCESS)
1137	return rcStrict;
1138	/** @todo check what VT-x and AMD-V does. */
1139	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1140	}
1141
1142	/* commit */
1143	pCtx->rip = offSeg;
1144	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1145	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1146	pCtx->cs.ValidSel = pCtx->cs.Sel;
1147	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1148	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1149	pCtx->cs.u32Limit = cbLimit;
1150	pCtx->cs.u64Base = u64Base;
1151	pCtx->eflags.Bits.u1RF = 0;
1152	/** @todo check if the hidden bits are loaded correctly for 64-bit
1153	* mode. */
1154	return VINF_SUCCESS;
1155	}
1156
1157
1158	/**
1159	* Implements far calls.
1160	*
1161	* This very similar to iemCImpl_FarJmp.
1162	*
1163	* @param uSel The selector.
1164	* @param offSeg The segment offset.
1165	* @param enmEffOpSize The operand size (in case we need it).
1166	*/
1167	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1168	{
1169	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1170	VBOXSTRICTRC rcStrict;
1171	uint64_t uNewRsp;
1172	RTPTRUNION uPtrRet;
1173
1174	/*
1175	* Real mode and V8086 mode are easy. The only snag seems to be that
1176	* CS.limit doesn't change and the limit check is done against the current
1177	* limit.
1178	*/
1179	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1180	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1181	{
1182	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1183
1184	/* Check stack first - may #SS(0). */
1185	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1186	&uPtrRet.pv, &uNewRsp);
1187	if (rcStrict != VINF_SUCCESS)
1188	return rcStrict;
1189
1190	/* Check the target address range. */
1191	if (offSeg > UINT32_MAX)
1192	return iemRaiseGeneralProtectionFault0(pIemCpu);
1193
1194	/* Everything is fine, push the return address. */
1195	if (enmEffOpSize == IEMMODE_16BIT)
1196	{
1197	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1198	uPtrRet.pu16[1] = pCtx->cs.Sel;
1199	}
1200	else
1201	{
1202	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1203	uPtrRet.pu16[3] = pCtx->cs.Sel;
1204	}
1205	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1206	if (rcStrict != VINF_SUCCESS)
1207	return rcStrict;
1208
1209	/* Branch. */
1210	pCtx->rip = offSeg;
1211	pCtx->cs.Sel = uSel;
1212	pCtx->cs.ValidSel = uSel;
1213	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1214	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1215	pCtx->eflags.Bits.u1RF = 0;
1216	return VINF_SUCCESS;
1217	}
1218
1219	/*
1220	* Protected mode. Need to parse the specified descriptor...
1221	*/
1222	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1223	{
1224	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1225	return iemRaiseGeneralProtectionFault0(pIemCpu);
1226	}
1227
1228	/* Fetch the descriptor. */
1229	IEMSELDESC Desc;
1230	rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1231	if (rcStrict != VINF_SUCCESS)
1232	return rcStrict;
1233
1234	/*
1235	* Deal with it according to its type. We do the standard code selectors
1236	* here and dispatch the system selectors to worker functions.
1237	*/
1238	if (!Desc.Legacy.Gen.u1DescType)
1239	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1240
1241	/* Only code segments. */
1242	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1243	{
1244	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1245	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1246	}
1247
1248	/* L vs D. */
1249	if ( Desc.Legacy.Gen.u1Long
1250	&& Desc.Legacy.Gen.u1DefBig
1251	&& IEM_IS_LONG_MODE(pIemCpu))
1252	{
1253	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1254	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1255	}
1256
1257	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1258	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1259	{
1260	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1261	{
1262	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1263	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1264	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1265	}
1266	}
1267	else
1268	{
1269	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1270	{
1271	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1272	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1273	}
1274	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1275	{
1276	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1277	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1278	}
1279	}
1280
1281	/* Is it there? */
1282	if (!Desc.Legacy.Gen.u1Present)
1283	{
1284	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1285	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1286	}
1287
1288	/* Check stack first - may #SS(0). */
1289	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1290	* 16-bit code cause a two or four byte CS to be pushed? */
1291	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1292	enmEffOpSize == IEMMODE_64BIT ? 8+8
1293	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1294	&uPtrRet.pv, &uNewRsp);
1295	if (rcStrict != VINF_SUCCESS)
1296	return rcStrict;
1297
1298	/* Chop the high bits if 16-bit (Intel says so). */
1299	if (enmEffOpSize == IEMMODE_16BIT)
1300	offSeg &= UINT16_MAX;
1301
1302	/* Limit / canonical check. */
1303	uint64_t u64Base;
1304	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1305	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1306	{
1307	if (!IEM_IS_CANONICAL(offSeg))
1308	{
1309	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1310	return iemRaiseNotCanonical(pIemCpu);
1311	}
1312	u64Base = 0;
1313	}
1314	else
1315	{
1316	if (offSeg > cbLimit)
1317	{
1318	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1319	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1320	}
1321	u64Base = X86DESC_BASE(&Desc.Legacy);
1322	}
1323
1324	/*
1325	* Now set the accessed bit before
1326	* writing the return address to the stack and committing the result into
1327	* CS, CSHID and RIP.
1328	*/
1329	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1330	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1331	{
1332	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1333	if (rcStrict != VINF_SUCCESS)
1334	return rcStrict;
1335	/** @todo check what VT-x and AMD-V does. */
1336	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1337	}
1338
1339	/* stack */
1340	if (enmEffOpSize == IEMMODE_16BIT)
1341	{
1342	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1343	uPtrRet.pu16[1] = pCtx->cs.Sel;
1344	}
1345	else if (enmEffOpSize == IEMMODE_32BIT)
1346	{
1347	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1348	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1349	}
1350	else
1351	{
1352	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1353	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1354	}
1355	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1356	if (rcStrict != VINF_SUCCESS)
1357	return rcStrict;
1358
1359	/* commit */
1360	pCtx->rip = offSeg;
1361	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1362	pCtx->cs.Sel \|= pIemCpu->uCpl;
1363	pCtx->cs.ValidSel = pCtx->cs.Sel;
1364	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1365	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1366	pCtx->cs.u32Limit = cbLimit;
1367	pCtx->cs.u64Base = u64Base;
1368	pCtx->eflags.Bits.u1RF = 0;
1369	/** @todo check if the hidden bits are loaded correctly for 64-bit
1370	* mode. */
1371	return VINF_SUCCESS;
1372	}
1373
1374
1375	/**
1376	* Implements retf.
1377	*
1378	* @param enmEffOpSize The effective operand size.
1379	* @param cbPop The amount of arguments to pop from the stack
1380	* (bytes).
1381	*/
1382	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1383	{
1384	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1385	VBOXSTRICTRC rcStrict;
1386	RTCPTRUNION uPtrFrame;
1387	uint64_t uNewRsp;
1388	uint64_t uNewRip;
1389	uint16_t uNewCs;
1390	NOREF(cbInstr);
1391
1392	/*
1393	* Read the stack values first.
1394	*/
1395	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1396	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1397	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1398	if (rcStrict != VINF_SUCCESS)
1399	return rcStrict;
1400	if (enmEffOpSize == IEMMODE_16BIT)
1401	{
1402	uNewRip = uPtrFrame.pu16[0];
1403	uNewCs = uPtrFrame.pu16[1];
1404	}
1405	else if (enmEffOpSize == IEMMODE_32BIT)
1406	{
1407	uNewRip = uPtrFrame.pu32[0];
1408	uNewCs = uPtrFrame.pu16[2];
1409	}
1410	else
1411	{
1412	uNewRip = uPtrFrame.pu64[0];
1413	uNewCs = uPtrFrame.pu16[4];
1414	}
1415
1416	/*
1417	* Real mode and V8086 mode are easy.
1418	*/
1419	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1420	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1421	{
1422	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
1423	/** @todo check how this is supposed to work if sp=0xfffe. */
1424
1425	/* Check the limit of the new EIP. */
1426	/** @todo Intel pseudo code only does the limit check for 16-bit
1427	* operands, AMD does not make any distinction. What is right? */
1428	if (uNewRip > pCtx->cs.u32Limit)
1429	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1430
1431	/* commit the operation. */
1432	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1433	if (rcStrict != VINF_SUCCESS)
1434	return rcStrict;
1435	pCtx->rip = uNewRip;
1436	pCtx->cs.Sel = uNewCs;
1437	pCtx->cs.ValidSel = uNewCs;
1438	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1439	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1440	pCtx->eflags.Bits.u1RF = 0;
1441	/** @todo do we load attribs and limit as well? */
1442	if (cbPop)
1443	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1444	return VINF_SUCCESS;
1445	}
1446
1447	/*
1448	* Protected mode is complicated, of course.
1449	*/
1450	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1451	{
1452	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1453	return iemRaiseGeneralProtectionFault0(pIemCpu);
1454	}
1455
1456	/* Fetch the descriptor. */
1457	IEMSELDESC DescCs;
1458	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
1459	if (rcStrict != VINF_SUCCESS)
1460	return rcStrict;
1461
1462	/* Can only return to a code selector. */
1463	if ( !DescCs.Legacy.Gen.u1DescType
1464	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1465	{
1466	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1467	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1468	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1469	}
1470
1471	/* L vs D. */
1472	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1473	&& DescCs.Legacy.Gen.u1DefBig
1474	&& IEM_IS_LONG_MODE(pIemCpu))
1475	{
1476	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1477	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1478	}
1479
1480	/* DPL/RPL/CPL checks. */
1481	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1482	{
1483	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1484	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1485	}
1486
1487	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1488	{
1489	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1490	{
1491	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1492	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1493	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1494	}
1495	}
1496	else
1497	{
1498	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1499	{
1500	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1501	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1502	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1503	}
1504	}
1505
1506	/* Is it there? */
1507	if (!DescCs.Legacy.Gen.u1Present)
1508	{
1509	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1510	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1511	}
1512
1513	/*
1514	* Return to outer privilege? (We'll typically have entered via a call gate.)
1515	*/
1516	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1517	{
1518	/* Read the return pointer, it comes before the parameters. */
1519	RTCPTRUNION uPtrStack;
1520	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1521	if (rcStrict != VINF_SUCCESS)
1522	return rcStrict;
1523	uint16_t uNewOuterSs;
1524	uint64_t uNewOuterRsp;
1525	if (enmEffOpSize == IEMMODE_16BIT)
1526	{
1527	uNewOuterRsp = uPtrFrame.pu16[0];
1528	uNewOuterSs = uPtrFrame.pu16[1];
1529	}
1530	else if (enmEffOpSize == IEMMODE_32BIT)
1531	{
1532	uNewOuterRsp = uPtrFrame.pu32[0];
1533	uNewOuterSs = uPtrFrame.pu16[2];
1534	}
1535	else
1536	{
1537	uNewOuterRsp = uPtrFrame.pu64[0];
1538	uNewOuterSs = uPtrFrame.pu16[4];
1539	}
1540
1541	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1542	and read the selector. */
1543	IEMSELDESC DescSs;
1544	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1545	{
1546	if ( !DescCs.Legacy.Gen.u1Long
1547	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
1548	{
1549	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1550	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1551	return iemRaiseGeneralProtectionFault0(pIemCpu);
1552	}
1553	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1554	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1555	}
1556	else
1557	{
1558	/* Fetch the descriptor for the new stack segment. */
1559	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
1560	if (rcStrict != VINF_SUCCESS)
1561	return rcStrict;
1562	}
1563
1564	/* Check that RPL of stack and code selectors match. */
1565	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1566	{
1567	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1568	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1569	}
1570
1571	/* Must be a writable data segment. */
1572	if ( !DescSs.Legacy.Gen.u1DescType
1573	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1574	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1575	{
1576	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1577	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1578	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1579	}
1580
1581	/* L vs D. (Not mentioned by intel.) */
1582	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1583	&& DescSs.Legacy.Gen.u1DefBig
1584	&& IEM_IS_LONG_MODE(pIemCpu))
1585	{
1586	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1587	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1588	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1589	}
1590
1591	/* DPL/RPL/CPL checks. */
1592	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1593	{
1594	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1595	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1596	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1597	}
1598
1599	/* Is it there? */
1600	if (!DescSs.Legacy.Gen.u1Present)
1601	{
1602	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1603	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1604	}
1605
1606	/* Calc SS limit.*/
1607	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1608
1609	/* Is RIP canonical or within CS.limit? */
1610	uint64_t u64Base;
1611	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1612
1613	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1614	{
1615	if (!IEM_IS_CANONICAL(uNewRip))
1616	{
1617	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1618	return iemRaiseNotCanonical(pIemCpu);
1619	}
1620	u64Base = 0;
1621	}
1622	else
1623	{
1624	if (uNewRip > cbLimitCs)
1625	{
1626	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1627	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1628	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1629	}
1630	u64Base = X86DESC_BASE(&DescCs.Legacy);
1631	}
1632
1633	/*
1634	* Now set the accessed bit before
1635	* writing the return address to the stack and committing the result into
1636	* CS, CSHID and RIP.
1637	*/
1638	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1639	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1640	{
1641	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1642	if (rcStrict != VINF_SUCCESS)
1643	return rcStrict;
1644	/** @todo check what VT-x and AMD-V does. */
1645	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1646	}
1647	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1648	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1649	{
1650	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1651	if (rcStrict != VINF_SUCCESS)
1652	return rcStrict;
1653	/** @todo check what VT-x and AMD-V does. */
1654	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1655	}
1656
1657	/* commit */
1658	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1659	if (rcStrict != VINF_SUCCESS)
1660	return rcStrict;
1661	if (enmEffOpSize == IEMMODE_16BIT)
1662	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1663	else
1664	pCtx->rip = uNewRip;
1665	pCtx->cs.Sel = uNewCs;
1666	pCtx->cs.ValidSel = uNewCs;
1667	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1668	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1669	pCtx->cs.u32Limit = cbLimitCs;
1670	pCtx->cs.u64Base = u64Base;
1671	pCtx->rsp = uNewRsp;
1672	pCtx->ss.Sel = uNewOuterSs;
1673	pCtx->ss.ValidSel = uNewOuterSs;
1674	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1675	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1676	pCtx->ss.u32Limit = cbLimitSs;
1677	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1678	pCtx->ss.u64Base = 0;
1679	else
1680	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1681
1682	pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1683	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1684	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1685	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1686	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1687
1688	/** @todo check if the hidden bits are loaded correctly for 64-bit
1689	* mode. */
1690
1691	if (cbPop)
1692	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1693	pCtx->eflags.Bits.u1RF = 0;
1694
1695	/* Done! */
1696	}
1697	/*
1698	* Return to the same privilege level
1699	*/
1700	else
1701	{
1702	/* Limit / canonical check. */
1703	uint64_t u64Base;
1704	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1705
1706	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1707	{
1708	if (!IEM_IS_CANONICAL(uNewRip))
1709	{
1710	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1711	return iemRaiseNotCanonical(pIemCpu);
1712	}
1713	u64Base = 0;
1714	}
1715	else
1716	{
1717	if (uNewRip > cbLimitCs)
1718	{
1719	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1720	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1721	}
1722	u64Base = X86DESC_BASE(&DescCs.Legacy);
1723	}
1724
1725	/*
1726	* Now set the accessed bit before
1727	* writing the return address to the stack and committing the result into
1728	* CS, CSHID and RIP.
1729	*/
1730	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1731	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1732	{
1733	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1734	if (rcStrict != VINF_SUCCESS)
1735	return rcStrict;
1736	/** @todo check what VT-x and AMD-V does. */
1737	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1738	}
1739
1740	/* commit */
1741	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1742	if (rcStrict != VINF_SUCCESS)
1743	return rcStrict;
1744	if (enmEffOpSize == IEMMODE_16BIT)
1745	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1746	else
1747	pCtx->rip = uNewRip;
1748	pCtx->cs.Sel = uNewCs;
1749	pCtx->cs.ValidSel = uNewCs;
1750	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1751	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1752	pCtx->cs.u32Limit = cbLimitCs;
1753	pCtx->cs.u64Base = u64Base;
1754	/** @todo check if the hidden bits are loaded correctly for 64-bit
1755	* mode. */
1756	if (cbPop)
1757	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1758	pCtx->eflags.Bits.u1RF = 0;
1759	}
1760	return VINF_SUCCESS;
1761	}
1762
1763
1764	/**
1765	* Implements retn.
1766	*
1767	* We're doing this in C because of the \#GP that might be raised if the popped
1768	* program counter is out of bounds.
1769	*
1770	* @param enmEffOpSize The effective operand size.
1771	* @param cbPop The amount of arguments to pop from the stack
1772	* (bytes).
1773	*/
1774	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1775	{
1776	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1777	NOREF(cbInstr);
1778
1779	/* Fetch the RSP from the stack. */
1780	VBOXSTRICTRC rcStrict;
1781	RTUINT64U NewRip;
1782	RTUINT64U NewRsp;
1783	NewRsp.u = pCtx->rsp;
1784	switch (enmEffOpSize)
1785	{
1786	case IEMMODE_16BIT:
1787	NewRip.u = 0;
1788	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1789	break;
1790	case IEMMODE_32BIT:
1791	NewRip.u = 0;
1792	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1793	break;
1794	case IEMMODE_64BIT:
1795	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1796	break;
1797	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1798	}
1799	if (rcStrict != VINF_SUCCESS)
1800	return rcStrict;
1801
1802	/* Check the new RSP before loading it. */
1803	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
1804	* of it. The canonical test is performed here and for call. */
1805	if (enmEffOpSize != IEMMODE_64BIT)
1806	{
1807	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1808	{
1809	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1810	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1811	}
1812	}
1813	else
1814	{
1815	if (!IEM_IS_CANONICAL(NewRip.u))
1816	{
1817	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1818	return iemRaiseNotCanonical(pIemCpu);
1819	}
1820	}
1821
1822	/* Commit it. */
1823	pCtx->rip = NewRip.u;
1824	pCtx->rsp = NewRsp.u;
1825	if (cbPop)
1826	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1827	pCtx->eflags.Bits.u1RF = 0;
1828
1829	return VINF_SUCCESS;
1830	}
1831
1832
1833	/**
1834	* Implements enter.
1835	*
1836	* We're doing this in C because the instruction is insane, even for the
1837	* u8NestingLevel=0 case dealing with the stack is tedious.
1838	*
1839	* @param enmEffOpSize The effective operand size.
1840	*/
1841	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1842	{
1843	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1844
1845	/* Push RBP, saving the old value in TmpRbp. */
1846	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1847	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1848	RTUINT64U NewRbp;
1849	VBOXSTRICTRC rcStrict;
1850	if (enmEffOpSize == IEMMODE_64BIT)
1851	{
1852	rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1853	NewRbp = NewRsp;
1854	}
1855	else if (pCtx->ss.Attr.n.u1DefBig)
1856	{
1857	rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1858	NewRbp = NewRsp;
1859	}
1860	else
1861	{
1862	rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1863	NewRbp = TmpRbp;
1864	NewRbp.Words.w0 = NewRsp.Words.w0;
1865	}
1866	if (rcStrict != VINF_SUCCESS)
1867	return rcStrict;
1868
1869	/* Copy the parameters (aka nesting levels by Intel). */
1870	cParameters &= 0x1f;
1871	if (cParameters > 0)
1872	{
1873	switch (enmEffOpSize)
1874	{
1875	case IEMMODE_16BIT:
1876	if (pCtx->ss.Attr.n.u1DefBig)
1877	TmpRbp.DWords.dw0 -= 2;
1878	else
1879	TmpRbp.Words.w0 -= 2;
1880	do
1881	{
1882	uint16_t u16Tmp;
1883	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1884	if (rcStrict != VINF_SUCCESS)
1885	break;
1886	rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1887	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1888	break;
1889
1890	case IEMMODE_32BIT:
1891	if (pCtx->ss.Attr.n.u1DefBig)
1892	TmpRbp.DWords.dw0 -= 4;
1893	else
1894	TmpRbp.Words.w0 -= 4;
1895	do
1896	{
1897	uint32_t u32Tmp;
1898	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1899	if (rcStrict != VINF_SUCCESS)
1900	break;
1901	rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1902	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1903	break;
1904
1905	case IEMMODE_64BIT:
1906	TmpRbp.u -= 8;
1907	do
1908	{
1909	uint64_t u64Tmp;
1910	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1911	if (rcStrict != VINF_SUCCESS)
1912	break;
1913	rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1914	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1915	break;
1916
1917	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1918	}
1919	if (rcStrict != VINF_SUCCESS)
1920	return VINF_SUCCESS;
1921
1922	/* Push the new RBP */
1923	if (enmEffOpSize == IEMMODE_64BIT)
1924	rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1925	else if (pCtx->ss.Attr.n.u1DefBig)
1926	rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1927	else
1928	rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1929	if (rcStrict != VINF_SUCCESS)
1930	return rcStrict;
1931
1932	}
1933
1934	/* Recalc RSP. */
1935	iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
1936
1937	/** @todo Should probe write access at the new RSP according to AMD. */
1938
1939	/* Commit it. */
1940	pCtx->rbp = NewRbp.u;
1941	pCtx->rsp = NewRsp.u;
1942	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
1943
1944	return VINF_SUCCESS;
1945	}
1946
1947
1948
1949	/**
1950	* Implements leave.
1951	*
1952	* We're doing this in C because messing with the stack registers is annoying
1953	* since they depends on SS attributes.
1954	*
1955	* @param enmEffOpSize The effective operand size.
1956	*/
1957	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1958	{
1959	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1960
1961	/* Calculate the intermediate RSP from RBP and the stack attributes. */
1962	RTUINT64U NewRsp;
1963	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1964	NewRsp.u = pCtx->rbp;
1965	else if (pCtx->ss.Attr.n.u1DefBig)
1966	NewRsp.u = pCtx->ebp;
1967	else
1968	{
1969	/** @todo Check that LEAVE actually preserve the high EBP bits. */
1970	NewRsp.u = pCtx->rsp;
1971	NewRsp.Words.w0 = pCtx->bp;
1972	}
1973
1974	/* Pop RBP according to the operand size. */
1975	VBOXSTRICTRC rcStrict;
1976	RTUINT64U NewRbp;
1977	switch (enmEffOpSize)
1978	{
1979	case IEMMODE_16BIT:
1980	NewRbp.u = pCtx->rbp;
1981	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1982	break;
1983	case IEMMODE_32BIT:
1984	NewRbp.u = 0;
1985	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1986	break;
1987	case IEMMODE_64BIT:
1988	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1989	break;
1990	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1991	}
1992	if (rcStrict != VINF_SUCCESS)
1993	return rcStrict;
1994
1995
1996	/* Commit it. */
1997	pCtx->rbp = NewRbp.u;
1998	pCtx->rsp = NewRsp.u;
1999	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2000
2001	return VINF_SUCCESS;
2002	}
2003
2004
2005	/**
2006	* Implements int3 and int XX.
2007	*
2008	* @param u8Int The interrupt vector number.
2009	* @param fIsBpInstr Is it the breakpoint instruction.
2010	*/
2011	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2012	{
2013	Assert(pIemCpu->cXcptRecursions == 0);
2014	return iemRaiseXcptOrInt(pIemCpu,
2015	cbInstr,
2016	u8Int,
2017	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
2018	0,
2019	0);
2020	}
2021
2022
2023	/**
2024	* Implements iret for real mode and V8086 mode.
2025	*
2026	* @param enmEffOpSize The effective operand size.
2027	*/
2028	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2029	{
2030	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2031	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2032	X86EFLAGS Efl;
2033	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2034	NOREF(cbInstr);
2035
2036	/*
2037	* iret throws an exception if VME isn't enabled.
2038	*/
2039	if ( Efl.Bits.u1VM
2040	&& Efl.Bits.u2IOPL != 3
2041	&& !(pCtx->cr4 & X86_CR4_VME))
2042	return iemRaiseGeneralProtectionFault0(pIemCpu);
2043
2044	/*
2045	* Do the stack bits, but don't commit RSP before everything checks
2046	* out right.
2047	*/
2048	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2049	VBOXSTRICTRC rcStrict;
2050	RTCPTRUNION uFrame;
2051	uint16_t uNewCs;
2052	uint32_t uNewEip;
2053	uint32_t uNewFlags;
2054	uint64_t uNewRsp;
2055	if (enmEffOpSize == IEMMODE_32BIT)
2056	{
2057	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2058	if (rcStrict != VINF_SUCCESS)
2059	return rcStrict;
2060	uNewEip = uFrame.pu32[0];
2061	if (uNewEip > UINT16_MAX)
2062	return iemRaiseGeneralProtectionFault0(pIemCpu);
2063
2064	uNewCs = (uint16_t)uFrame.pu32[1];
2065	uNewFlags = uFrame.pu32[2];
2066	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2067	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
2068	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
2069	\| X86_EFL_ID;
2070	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
2071	}
2072	else
2073	{
2074	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2075	if (rcStrict != VINF_SUCCESS)
2076	return rcStrict;
2077	uNewEip = uFrame.pu16[0];
2078	uNewCs = uFrame.pu16[1];
2079	uNewFlags = uFrame.pu16[2];
2080	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2081	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
2082	uNewFlags \|= Efl.u & (UINT32_C(0xffff0000) \| X86_EFL_1);
2083	/** @todo The intel pseudo code does not indicate what happens to
2084	* reserved flags. We just ignore them. */
2085	}
2086	/** @todo Check how this is supposed to work if sp=0xfffe. */
2087
2088	/*
2089	* Check the limit of the new EIP.
2090	*/
2091	/** @todo Only the AMD pseudo code check the limit here, what's
2092	* right? */
2093	if (uNewEip > pCtx->cs.u32Limit)
2094	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2095
2096	/*
2097	* V8086 checks and flag adjustments
2098	*/
2099	if (Efl.Bits.u1VM)
2100	{
2101	if (Efl.Bits.u2IOPL == 3)
2102	{
2103	/* Preserve IOPL and clear RF. */
2104	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
2105	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
2106	}
2107	else if ( enmEffOpSize == IEMMODE_16BIT
2108	&& ( !(uNewFlags & X86_EFL_IF)
2109	\|\| !Efl.Bits.u1VIP )
2110	&& !(uNewFlags & X86_EFL_TF) )
2111	{
2112	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2113	uNewFlags &= ~X86_EFL_VIF;
2114	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
2115	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
2116	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2117	}
2118	else
2119	return iemRaiseGeneralProtectionFault0(pIemCpu);
2120	}
2121
2122	/*
2123	* Commit the operation.
2124	*/
2125	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2126	if (rcStrict != VINF_SUCCESS)
2127	return rcStrict;
2128	#ifdef DBGFTRACE_ENABLED
2129	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2130	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2131	#endif
2132
2133	pCtx->rip = uNewEip;
2134	pCtx->cs.Sel = uNewCs;
2135	pCtx->cs.ValidSel = uNewCs;
2136	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2137	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2138	/** @todo do we load attribs and limit as well? */
2139	Assert(uNewFlags & X86_EFL_1);
2140	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2141
2142	return VINF_SUCCESS;
2143	}
2144
2145
2146	/**
2147	* Loads a segment register when entering V8086 mode.
2148	*
2149	* @param pSReg The segment register.
2150	* @param uSeg The segment to load.
2151	*/
2152	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2153	{
2154	pSReg->Sel = uSeg;
2155	pSReg->ValidSel = uSeg;
2156	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2157	pSReg->u64Base = (uint32_t)uSeg << 4;
2158	pSReg->u32Limit = 0xffff;
2159	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2160	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2161	* IRET'ing to V8086. */
2162	}
2163
2164
2165	/**
2166	* Implements iret for protected mode returning to V8086 mode.
2167	*
2168	* @param pCtx Pointer to the CPU context.
2169	* @param uNewEip The new EIP.
2170	* @param uNewCs The new CS.
2171	* @param uNewFlags The new EFLAGS.
2172	* @param uNewRsp The RSP after the initial IRET frame.
2173	*
2174	* @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2175	*/
2176	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2177	uint32_t, uNewFlags, uint64_t, uNewRsp)
2178	{
2179	#if 0
2180	if (!LogIs6Enabled())
2181	{
2182	RTLogGroupSettings(NULL, "iem.eo.l6.l2");
2183	RTLogFlags(NULL, "enabled");
2184	return VERR_IEM_RESTART_INSTRUCTION;
2185	}
2186	#endif
2187
2188	/*
2189	* Pop the V8086 specific frame bits off the stack.
2190	*/
2191	VBOXSTRICTRC rcStrict;
2192	RTCPTRUNION uFrame;
2193	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2194	if (rcStrict != VINF_SUCCESS)
2195	return rcStrict;
2196	uint32_t uNewEsp = uFrame.pu32[0];
2197	uint16_t uNewSs = uFrame.pu32[1];
2198	uint16_t uNewEs = uFrame.pu32[2];
2199	uint16_t uNewDs = uFrame.pu32[3];
2200	uint16_t uNewFs = uFrame.pu32[4];
2201	uint16_t uNewGs = uFrame.pu32[5];
2202	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2203	if (rcStrict != VINF_SUCCESS)
2204	return rcStrict;
2205
2206	/*
2207	* Commit the operation.
2208	*/
2209	uNewFlags &= X86_EFL_LIVE_MASK;
2210	uNewFlags \|= X86_EFL_RA1_MASK;
2211	#ifdef DBGFTRACE_ENABLED
2212	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2213	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2214	#endif
2215
2216	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2217	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2218	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2219	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2220	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2221	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2222	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2223	pCtx->rip = uNewEip;
2224	pCtx->rsp = uNewEsp;
2225	pIemCpu->uCpl = 3;
2226
2227	return VINF_SUCCESS;
2228	}
2229
2230
2231	/**
2232	* Implements iret for protected mode returning via a nested task.
2233	*
2234	* @param enmEffOpSize The effective operand size.
2235	*/
2236	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2237	{
2238	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2239	}
2240
2241
2242	/**
2243	* Implements iret for protected mode
2244	*
2245	* @param enmEffOpSize The effective operand size.
2246	*/
2247	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2248	{
2249	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2250	NOREF(cbInstr);
2251
2252	/*
2253	* Nested task return.
2254	*/
2255	if (pCtx->eflags.Bits.u1NT)
2256	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2257
2258	/*
2259	* Normal return.
2260	*
2261	* Do the stack bits, but don't commit RSP before everything checks
2262	* out right.
2263	*/
2264	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2265	VBOXSTRICTRC rcStrict;
2266	RTCPTRUNION uFrame;
2267	uint16_t uNewCs;
2268	uint32_t uNewEip;
2269	uint32_t uNewFlags;
2270	uint64_t uNewRsp;
2271	if (enmEffOpSize == IEMMODE_32BIT)
2272	{
2273	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2274	if (rcStrict != VINF_SUCCESS)
2275	return rcStrict;
2276	uNewEip = uFrame.pu32[0];
2277	uNewCs = (uint16_t)uFrame.pu32[1];
2278	uNewFlags = uFrame.pu32[2];
2279	}
2280	else
2281	{
2282	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2283	if (rcStrict != VINF_SUCCESS)
2284	return rcStrict;
2285	uNewEip = uFrame.pu16[0];
2286	uNewCs = uFrame.pu16[1];
2287	uNewFlags = uFrame.pu16[2];
2288	}
2289	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2290	if (rcStrict != VINF_SUCCESS)
2291	return rcStrict;
2292
2293	/*
2294	* We're hopefully not returning to V8086 mode...
2295	*/
2296	if ( (uNewFlags & X86_EFL_VM)
2297	&& pIemCpu->uCpl == 0)
2298	{
2299	Assert(enmEffOpSize == IEMMODE_32BIT);
2300	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2301	}
2302
2303	/*
2304	* Protected mode.
2305	*/
2306	/* Read the CS descriptor. */
2307	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2308	{
2309	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2310	return iemRaiseGeneralProtectionFault0(pIemCpu);
2311	}
2312
2313	IEMSELDESC DescCS;
2314	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2315	if (rcStrict != VINF_SUCCESS)
2316	{
2317	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2318	return rcStrict;
2319	}
2320
2321	/* Must be a code descriptor. */
2322	if (!DescCS.Legacy.Gen.u1DescType)
2323	{
2324	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2325	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2326	}
2327	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2328	{
2329	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2330	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2331	}
2332
2333	/* Privilege checks. */
2334	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2335	{
2336	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2337	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2338	}
2339	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2340	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2341	{
2342	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2343	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2344	}
2345
2346	/* Present? */
2347	if (!DescCS.Legacy.Gen.u1Present)
2348	{
2349	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2350	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2351	}
2352
2353	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2354
2355	/*
2356	* Return to outer level?
2357	*/
2358	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2359	{
2360	uint16_t uNewSS;
2361	uint32_t uNewESP;
2362	if (enmEffOpSize == IEMMODE_32BIT)
2363	{
2364	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2365	if (rcStrict != VINF_SUCCESS)
2366	return rcStrict;
2367	uNewESP = uFrame.pu32[0];
2368	uNewSS = (uint16_t)uFrame.pu32[1];
2369	}
2370	else
2371	{
2372	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2373	if (rcStrict != VINF_SUCCESS)
2374	return rcStrict;
2375	uNewESP = uFrame.pu16[0];
2376	uNewSS = uFrame.pu16[1];
2377	}
2378	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2379	if (rcStrict != VINF_SUCCESS)
2380	return rcStrict;
2381
2382	/* Read the SS descriptor. */
2383	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2384	{
2385	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2386	return iemRaiseGeneralProtectionFault0(pIemCpu);
2387	}
2388
2389	IEMSELDESC DescSS;
2390	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
2391	if (rcStrict != VINF_SUCCESS)
2392	{
2393	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2394	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2395	return rcStrict;
2396	}
2397
2398	/* Privilege checks. */
2399	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2400	{
2401	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2402	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2403	}
2404	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2405	{
2406	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2407	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2408	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2409	}
2410
2411	/* Must be a writeable data segment descriptor. */
2412	if (!DescSS.Legacy.Gen.u1DescType)
2413	{
2414	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2415	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2416	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2417	}
2418	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2419	{
2420	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2421	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2422	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2423	}
2424
2425	/* Present? */
2426	if (!DescSS.Legacy.Gen.u1Present)
2427	{
2428	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2429	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2430	}
2431
2432	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2433
2434	/* Check EIP. */
2435	if (uNewEip > cbLimitCS)
2436	{
2437	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2438	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2439	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2440	}
2441
2442	/*
2443	* Commit the changes, marking CS and SS accessed first since
2444	* that may fail.
2445	*/
2446	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2447	{
2448	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2449	if (rcStrict != VINF_SUCCESS)
2450	return rcStrict;
2451	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2452	}
2453	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2454	{
2455	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2456	if (rcStrict != VINF_SUCCESS)
2457	return rcStrict;
2458	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2459	}
2460
2461	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2462	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2463	if (enmEffOpSize != IEMMODE_16BIT)
2464	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2465	if (pIemCpu->uCpl == 0)
2466	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2467	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2468	fEFlagsMask \|= X86_EFL_IF;
2469	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2470	fEFlagsNew &= ~fEFlagsMask;
2471	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2472	#ifdef DBGFTRACE_ENABLED
2473	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
2474	pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
2475	uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
2476	#endif
2477
2478	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2479	pCtx->rip = uNewEip;
2480	pCtx->cs.Sel = uNewCs;
2481	pCtx->cs.ValidSel = uNewCs;
2482	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2483	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2484	pCtx->cs.u32Limit = cbLimitCS;
2485	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2486	if (!pCtx->cs.Attr.n.u1DefBig)
2487	pCtx->sp = (uint16_t)uNewESP;
2488	else
2489	pCtx->rsp = uNewESP;
2490	pCtx->ss.Sel = uNewSS;
2491	pCtx->ss.ValidSel = uNewSS;
2492	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2493	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2494	pCtx->ss.u32Limit = cbLimitSs;
2495	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2496
2497	pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2498	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2499	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2500	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2501	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2502
2503	/* Done! */
2504
2505	}
2506	/*
2507	* Return to the same level.
2508	*/
2509	else
2510	{
2511	/* Check EIP. */
2512	if (uNewEip > cbLimitCS)
2513	{
2514	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2515	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2516	}
2517
2518	/*
2519	* Commit the changes, marking CS first since it may fail.
2520	*/
2521	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2522	{
2523	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2524	if (rcStrict != VINF_SUCCESS)
2525	return rcStrict;
2526	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2527	}
2528
2529	X86EFLAGS NewEfl;
2530	NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2531	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2532	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2533	if (enmEffOpSize != IEMMODE_16BIT)
2534	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2535	if (pIemCpu->uCpl == 0)
2536	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
2537	else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2538	fEFlagsMask \|= X86_EFL_IF;
2539	NewEfl.u &= ~fEFlagsMask;
2540	NewEfl.u \|= fEFlagsMask & uNewFlags;
2541	#ifdef DBGFTRACE_ENABLED
2542	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
2543	pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
2544	uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
2545	#endif
2546
2547	IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2548	pCtx->rip = uNewEip;
2549	pCtx->cs.Sel = uNewCs;
2550	pCtx->cs.ValidSel = uNewCs;
2551	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2552	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2553	pCtx->cs.u32Limit = cbLimitCS;
2554	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2555	pCtx->rsp = uNewRsp;
2556	/* Done! */
2557	}
2558	return VINF_SUCCESS;
2559	}
2560
2561
2562	/**
2563	* Implements iret for long mode
2564	*
2565	* @param enmEffOpSize The effective operand size.
2566	*/
2567	IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2568	{
2569	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2570	NOREF(cbInstr);
2571
2572	/*
2573	* Nested task return is not supported in long mode.
2574	*/
2575	if (pCtx->eflags.Bits.u1NT)
2576	{
2577	Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
2578	return iemRaiseGeneralProtectionFault0(pIemCpu);
2579	}
2580
2581	/*
2582	* Normal return.
2583	*
2584	* Do the stack bits, but don't commit RSP before everything checks
2585	* out right.
2586	*/
2587	VBOXSTRICTRC rcStrict;
2588	RTCPTRUNION uFrame;
2589	uint64_t uNewRip;
2590	uint16_t uNewCs;
2591	uint16_t uNewSs;
2592	uint32_t uNewFlags;
2593	uint64_t uNewRsp;
2594	if (enmEffOpSize == IEMMODE_64BIT)
2595	{
2596	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
2597	if (rcStrict != VINF_SUCCESS)
2598	return rcStrict;
2599	uNewRip = uFrame.pu64[0];
2600	uNewCs = (uint16_t)uFrame.pu64[1];
2601	uNewFlags = (uint32_t)uFrame.pu64[2];
2602	uNewRsp = uFrame.pu64[3];
2603	uNewSs = (uint16_t)uFrame.pu64[4];
2604	}
2605	else if (enmEffOpSize == IEMMODE_32BIT)
2606	{
2607	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
2608	if (rcStrict != VINF_SUCCESS)
2609	return rcStrict;
2610	uNewRip = uFrame.pu32[0];
2611	uNewCs = (uint16_t)uFrame.pu32[1];
2612	uNewFlags = uFrame.pu32[2];
2613	uNewRsp = uFrame.pu32[3];
2614	uNewSs = (uint16_t)uFrame.pu32[4];
2615	}
2616	else
2617	{
2618	Assert(enmEffOpSize == IEMMODE_16BIT);
2619	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
2620	if (rcStrict != VINF_SUCCESS)
2621	return rcStrict;
2622	uNewRip = uFrame.pu16[0];
2623	uNewCs = uFrame.pu16[1];
2624	uNewFlags = uFrame.pu16[2];
2625	uNewRsp = uFrame.pu16[3];
2626	uNewSs = uFrame.pu16[4];
2627	}
2628	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2629	if (rcStrict != VINF_SUCCESS)
2630	return rcStrict;
2631	Log2(("iretq stack: cs:rip=%04x:%016RX16 rflags=%016RX16 ss:rsp=%04x:%016RX16\n",
2632	uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
2633
2634	/*
2635	* Check stuff.
2636	*/
2637	/* Read the CS descriptor. */
2638	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2639	{
2640	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2641	return iemRaiseGeneralProtectionFault0(pIemCpu);
2642	}
2643
2644	IEMSELDESC DescCS;
2645	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2646	if (rcStrict != VINF_SUCCESS)
2647	{
2648	Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
2649	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2650	return rcStrict;
2651	}
2652
2653	/* Must be a code descriptor. */
2654	if ( !DescCS.Legacy.Gen.u1DescType
2655	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2656	{
2657	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
2658	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
2659	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2660	}
2661
2662	/* Privilege checks. */
2663	uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
2664	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2665	{
2666	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp, pIemCpu->uCpl));
2667	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2668	}
2669	if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2670	&& (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2671	{
2672	Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < DPL (%d) -> #GP\n",
2673	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u2Dpl));
2674	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2675	}
2676
2677	/* Present? */
2678	if (!DescCS.Legacy.Gen.u1Present)
2679	{
2680	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2681	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2682	}
2683
2684	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2685
2686	/* Read the SS descriptor. */
2687	IEMSELDESC DescSS;
2688	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2689	{
2690	if ( !DescCS.Legacy.Gen.u1Long
2691	\|\| DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
2692	\|\| uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
2693	{
2694	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2695	return iemRaiseGeneralProtectionFault0(pIemCpu);
2696	}
2697	DescSS.Legacy.u = 0;
2698	}
2699	else
2700	{
2701	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
2702	if (rcStrict != VINF_SUCCESS)
2703	{
2704	Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
2705	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2706	return rcStrict;
2707	}
2708	}
2709
2710	/* Privilege checks. */
2711	if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2712	{
2713	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2714	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2715	}
2716
2717	uint32_t cbLimitSs;
2718	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2719	cbLimitSs = UINT32_MAX;
2720	else
2721	{
2722	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2723	{
2724	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
2725	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
2726	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2727	}
2728
2729	/* Must be a writeable data segment descriptor. */
2730	if (!DescSS.Legacy.Gen.u1DescType)
2731	{
2732	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
2733	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2734	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2735	}
2736	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2737	{
2738	Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
2739	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2740	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2741	}
2742
2743	/* Present? */
2744	if (!DescSS.Legacy.Gen.u1Present)
2745	{
2746	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2747	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
2748	}
2749	cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2750	}
2751
2752	/* Check EIP. */
2753	if (DescCS.Legacy.Gen.u1Long)
2754	{
2755	if (!IEM_IS_CANONICAL(uNewRip))
2756	{
2757	Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
2758	uNewCs, uNewRip, uNewSs, uNewRsp));
2759	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2760	}
2761	}
2762	else
2763	{
2764	if (uNewRip > cbLimitCS)
2765	{
2766	Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
2767	uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
2768	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2769	}
2770	}
2771
2772	/*
2773	* Commit the changes, marking CS and SS accessed first since
2774	* that may fail.
2775	*/
2776	/** @todo where exactly are these actually marked accessed by a real CPU? */
2777	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2778	{
2779	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2780	if (rcStrict != VINF_SUCCESS)
2781	return rcStrict;
2782	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2783	}
2784	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2785	{
2786	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
2787	if (rcStrict != VINF_SUCCESS)
2788	return rcStrict;
2789	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2790	}
2791
2792	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2793	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
2794	if (enmEffOpSize != IEMMODE_16BIT)
2795	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
2796	if (pIemCpu->uCpl == 0)
2797	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is ignored */
2798	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2799	fEFlagsMask \|= X86_EFL_IF;
2800	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2801	fEFlagsNew &= ~fEFlagsMask;
2802	fEFlagsNew \|= uNewFlags & fEFlagsMask;
2803	#ifdef DBGFTRACE_ENABLED
2804	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
2805	pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
2806	#endif
2807
2808	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2809	pCtx->rip = uNewRip;
2810	pCtx->cs.Sel = uNewCs;
2811	pCtx->cs.ValidSel = uNewCs;
2812	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2813	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2814	pCtx->cs.u32Limit = cbLimitCS;
2815	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2816	if (pCtx->cs.Attr.n.u1Long \|\| pCtx->cs.Attr.n.u1DefBig)
2817	pCtx->rsp = uNewRsp;
2818	else
2819	pCtx->sp = (uint16_t)uNewRsp;
2820	pCtx->ss.Sel = uNewSs;
2821	pCtx->ss.ValidSel = uNewSs;
2822	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2823	{
2824	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2825	pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE \| (uNewCpl << X86DESCATTR_DPL_SHIFT);
2826	pCtx->ss.u32Limit = UINT32_MAX;
2827	pCtx->ss.u64Base = 0;
2828	Log2(("iretq new SS: NULL\n"));
2829	}
2830	else
2831	{
2832	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2833	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2834	pCtx->ss.u32Limit = cbLimitSs;
2835	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2836	Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
2837	}
2838
2839	if (pIemCpu->uCpl != uNewCpl)
2840	{
2841	pIemCpu->uCpl = uNewCpl;
2842	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
2843	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
2844	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
2845	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
2846	}
2847
2848	return VINF_SUCCESS;
2849	}
2850
2851
2852	/**
2853	* Implements iret.
2854	*
2855	* @param enmEffOpSize The effective operand size.
2856	*/
2857	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2858	{
2859	/*
2860	* Call a mode specific worker.
2861	*/
2862	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2863	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2864	if (IEM_IS_LONG_MODE(pIemCpu))
2865	return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2866
2867	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2868	}
2869
2870
2871	/**
2872	* Implements SYSCALL (AMD and Intel64).
2873	*
2874	* @param enmEffOpSize The effective operand size.
2875	*/
2876	IEM_CIMPL_DEF_0(iemCImpl_syscall)
2877	{
2878	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2879
2880	/*
2881	* Check preconditions.
2882	*
2883	* Note that CPUs described in the documentation may load a few odd values
2884	* into CS and SS than we allow here. This has yet to be checked on real
2885	* hardware.
2886	*/
2887	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2888	{
2889	Log(("syscall: Not enabled in EFER -> #UD\n"));
2890	return iemRaiseUndefinedOpcode(pIemCpu);
2891	}
2892	if (!(pCtx->cr0 & X86_CR0_PE))
2893	{
2894	Log(("syscall: Protected mode is required -> #GP(0)\n"));
2895	return iemRaiseGeneralProtectionFault0(pIemCpu);
2896	}
2897	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2898	{
2899	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2900	return iemRaiseUndefinedOpcode(pIemCpu);
2901	}
2902
2903	/** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
2904	/** @todo what about LDT selectors? Shouldn't matter, really. */
2905	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2906	uint16_t uNewSs = uNewCs + 8;
2907	if (uNewCs == 0 \|\| uNewSs == 0)
2908	{
2909	Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2910	return iemRaiseGeneralProtectionFault0(pIemCpu);
2911	}
2912
2913	/* Long mode and legacy mode differs. */
2914	if (CPUMIsGuestInLongModeEx(pCtx))
2915	{
2916	uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
2917
2918	/* This test isn't in the docs, but I'm not trusting the guys writing
2919	the MSRs to have validated the values as canonical like they should. */
2920	if (!IEM_IS_CANONICAL(uNewRip))
2921	{
2922	Log(("syscall: Only available in long mode on intel -> #UD\n"));
2923	return iemRaiseUndefinedOpcode(pIemCpu);
2924	}
2925
2926	/*
2927	* Commit it.
2928	*/
2929	Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
2930	pCtx->rcx = pCtx->rip + cbInstr;
2931	pCtx->rip = uNewRip;
2932
2933	pCtx->rflags.u &= ~X86_EFL_RF;
2934	pCtx->r11 = pCtx->rflags.u;
2935	pCtx->rflags.u &= ~pCtx->msrSFMASK;
2936	pCtx->rflags.u \|= X86_EFL_1;
2937
2938	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2939	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2940	}
2941	else
2942	{
2943	/*
2944	* Commit it.
2945	*/
2946	Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
2947	pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
2948	pCtx->rcx = pCtx->eip + cbInstr;
2949	pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
2950	pCtx->rflags.u &= ~(X86_EFL_VM \| X86_EFL_IF \| X86_EFL_RF);
2951
2952	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
2953	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
2954	}
2955	pCtx->cs.Sel = uNewCs;
2956	pCtx->cs.ValidSel = uNewCs;
2957	pCtx->cs.u64Base = 0;
2958	pCtx->cs.u32Limit = UINT32_MAX;
2959	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2960
2961	pCtx->ss.Sel = uNewSs;
2962	pCtx->ss.ValidSel = uNewSs;
2963	pCtx->ss.u64Base = 0;
2964	pCtx->ss.u32Limit = UINT32_MAX;
2965	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2966
2967	return VINF_SUCCESS;
2968	}
2969
2970
2971	/**
2972	* Implements SYSRET (AMD and Intel64).
2973	*/
2974	IEM_CIMPL_DEF_0(iemCImpl_sysret)
2975
2976	{
2977	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2978
2979	/*
2980	* Check preconditions.
2981	*
2982	* Note that CPUs described in the documentation may load a few odd values
2983	* into CS and SS than we allow here. This has yet to be checked on real
2984	* hardware.
2985	*/
2986	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2987	{
2988	Log(("sysret: Not enabled in EFER -> #UD\n"));
2989	return iemRaiseUndefinedOpcode(pIemCpu);
2990	}
2991	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2992	{
2993	Log(("sysret: Only available in long mode on intel -> #UD\n"));
2994	return iemRaiseUndefinedOpcode(pIemCpu);
2995	}
2996	if (!(pCtx->cr0 & X86_CR0_PE))
2997	{
2998	Log(("sysret: Protected mode is required -> #GP(0)\n"));
2999	return iemRaiseGeneralProtectionFault0(pIemCpu);
3000	}
3001	if (pIemCpu->uCpl != 0)
3002	{
3003	Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
3004	return iemRaiseGeneralProtectionFault0(pIemCpu);
3005	}
3006
3007	/** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3008	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3009	uint16_t uNewSs = uNewCs + 8;
3010	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3011	uNewCs += 16;
3012	if (uNewCs == 0 \|\| uNewSs == 0)
3013	{
3014	Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3015	return iemRaiseGeneralProtectionFault0(pIemCpu);
3016	}
3017
3018	/*
3019	* Commit it.
3020	*/
3021	if (CPUMIsGuestInLongModeEx(pCtx))
3022	{
3023	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3024	{
3025	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3026	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3027	/* Note! We disregard intel manual regarding the RCX cananonical
3028	check, ask intel+xen why AMD doesn't do it. */
3029	pCtx->rip = pCtx->rcx;
3030	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3031	\| (3 << X86DESCATTR_DPL_SHIFT);
3032	}
3033	else
3034	{
3035	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3036	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3037	pCtx->rip = pCtx->ecx;
3038	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3039	\| (3 << X86DESCATTR_DPL_SHIFT);
3040	}
3041	/** @todo testcase: See what kind of flags we can make SYSRET restore and
3042	* what it really ignores. RF and VM are hinted at being zero, by AMD. */
3043	pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS \| X86_EFL_VIF \| X86_EFL_VIP);
3044	pCtx->rflags.u \|= X86_EFL_1;
3045	}
3046	else
3047	{
3048	Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3049	pCtx->rip = pCtx->rcx;
3050	pCtx->rflags.u \|= X86_EFL_IF;
3051	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3052	\| (3 << X86DESCATTR_DPL_SHIFT);
3053	}
3054	pCtx->cs.Sel = uNewCs \| 3;
3055	pCtx->cs.ValidSel = uNewCs \| 3;
3056	pCtx->cs.u64Base = 0;
3057	pCtx->cs.u32Limit = UINT32_MAX;
3058	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3059
3060	pCtx->ss.Sel = uNewSs \| 3;
3061	pCtx->ss.ValidSel = uNewSs \| 3;
3062	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3063	/* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3064	pCtx->ss.Attr.u \|= (3 << X86DESCATTR_DPL_SHIFT);
3065	/** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3066	* on sysret. */
3067
3068	return VINF_SUCCESS;
3069	}
3070
3071
3072	/**
3073	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3074	*
3075	* @param iSegReg The segment register number (valid).
3076	* @param uSel The new selector value.
3077	*/
3078	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3079	{
3080	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3081	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3082	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3083
3084	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3085
3086	/*
3087	* Real mode and V8086 mode are easy.
3088	*/
3089	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3090	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3091	{
3092	*pSel = uSel;
3093	pHid->u64Base = (uint32_t)uSel << 4;
3094	pHid->ValidSel = uSel;
3095	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3096	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3097	/** @todo Does the CPU actually load limits and attributes in the
3098	* real/V8086 mode segment load case? It doesn't for CS in far
3099	* jumps... Affects unreal mode. */
3100	pHid->u32Limit = 0xffff;
3101	pHid->Attr.u = 0;
3102	pHid->Attr.n.u1Present = 1;
3103	pHid->Attr.n.u1DescType = 1;
3104	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3105	? X86_SEL_TYPE_RW
3106	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
3107	#endif
3108	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3109	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3110	return VINF_SUCCESS;
3111	}
3112
3113	/*
3114	* Protected mode.
3115	*
3116	* Check if it's a null segment selector value first, that's OK for DS, ES,
3117	* FS and GS. If not null, then we have to load and parse the descriptor.
3118	*/
3119	if (!(uSel & X86_SEL_MASK_OFF_RPL))
3120	{
3121	Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3122	if (iSegReg == X86_SREG_SS)
3123	{
3124	/* In 64-bit kernel mode, the stack can be 0 because of the way
3125	interrupts are dispatched. AMD seems to have a slighly more
3126	relaxed relationship to SS.RPL than intel does. */
3127	/** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3128	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3129	\|\| pIemCpu->uCpl > 2
3130	\|\| ( uSel != pIemCpu->uCpl
3131	&& !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3132	{
3133	Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3134	return iemRaiseGeneralProtectionFault0(pIemCpu);
3135	}
3136	}
3137
3138	pSel = uSel; / Not RPL, remember :-) */
3139	iemHlpLoadNullDataSelectorProt(pIemCpu, pHid, uSel);
3140	if (iSegReg == X86_SREG_SS)
3141	pHid->Attr.u \|= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3142
3143	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3144	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3145
3146	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3147	return VINF_SUCCESS;
3148	}
3149
3150	/* Fetch the descriptor. */
3151	IEMSELDESC Desc;
3152	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3153	if (rcStrict != VINF_SUCCESS)
3154	return rcStrict;
3155
3156	/* Check GPs first. */
3157	if (!Desc.Legacy.Gen.u1DescType)
3158	{
3159	Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3160	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3161	}
3162	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3163	{
3164	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3165	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3166	{
3167	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3168	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3169	}
3170	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3171	{
3172	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3173	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3174	}
3175	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3176	{
3177	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3178	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3179	}
3180	}
3181	else
3182	{
3183	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3184	{
3185	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
3186	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3187	}
3188	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3189	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3190	{
3191	#if 0 /* this is what intel says. */
3192	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
3193	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3194	{
3195	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
3196	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3197	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3198	}
3199	#else /* this is what makes more sense. */
3200	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3201	{
3202	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
3203	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
3204	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3205	}
3206	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3207	{
3208	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
3209	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3210	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3211	}
3212	#endif
3213	}
3214	}
3215
3216	/* Is it there? */
3217	if (!Desc.Legacy.Gen.u1Present)
3218	{
3219	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
3220	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
3221	}
3222
3223	/* The base and limit. */
3224	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
3225	uint64_t u64Base;
3226	if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
3227	&& iSegReg < X86_SREG_FS)
3228	u64Base = 0;
3229	else
3230	u64Base = X86DESC_BASE(&Desc.Legacy);
3231
3232	/*
3233	* Ok, everything checked out fine. Now set the accessed bit before
3234	* committing the result into the registers.
3235	*/
3236	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3237	{
3238	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
3239	if (rcStrict != VINF_SUCCESS)
3240	return rcStrict;
3241	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3242	}
3243
3244	/* commit */
3245	*pSel = uSel;
3246	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3247	pHid->u32Limit = cbLimit;
3248	pHid->u64Base = u64Base;
3249	pHid->ValidSel = uSel;
3250	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3251
3252	/** @todo check if the hidden bits are loaded correctly for 64-bit
3253	* mode. */
3254	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3255
3256	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3257	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3258	return VINF_SUCCESS;
3259	}
3260
3261
3262	/**
3263	* Implements 'mov SReg, r/m'.
3264	*
3265	* @param iSegReg The segment register number (valid).
3266	* @param uSel The new selector value.
3267	*/
3268	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
3269	{
3270	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3271	if (rcStrict == VINF_SUCCESS)
3272	{
3273	if (iSegReg == X86_SREG_SS)
3274	{
3275	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3276	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3277	}
3278	}
3279	return rcStrict;
3280	}
3281
3282
3283	/**
3284	* Implements 'pop SReg'.
3285	*
3286	* @param iSegReg The segment register number (valid).
3287	* @param enmEffOpSize The efficient operand size (valid).
3288	*/
3289	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
3290	{
3291	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3292	VBOXSTRICTRC rcStrict;
3293
3294	/*
3295	* Read the selector off the stack and join paths with mov ss, reg.
3296	*/
3297	RTUINT64U TmpRsp;
3298	TmpRsp.u = pCtx->rsp;
3299	switch (enmEffOpSize)
3300	{
3301	case IEMMODE_16BIT:
3302	{
3303	uint16_t uSel;
3304	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
3305	if (rcStrict == VINF_SUCCESS)
3306	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3307	break;
3308	}
3309
3310	case IEMMODE_32BIT:
3311	{
3312	uint32_t u32Value;
3313	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
3314	if (rcStrict == VINF_SUCCESS)
3315	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
3316	break;
3317	}
3318
3319	case IEMMODE_64BIT:
3320	{
3321	uint64_t u64Value;
3322	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
3323	if (rcStrict == VINF_SUCCESS)
3324	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
3325	break;
3326	}
3327	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3328	}
3329
3330	/*
3331	* Commit the stack on success.
3332	*/
3333	if (rcStrict == VINF_SUCCESS)
3334	{
3335	pCtx->rsp = TmpRsp.u;
3336	if (iSegReg == X86_SREG_SS)
3337	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3338	}
3339	return rcStrict;
3340	}
3341
3342
3343	/**
3344	* Implements lgs, lfs, les, lds & lss.
3345	*/
3346	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
3347	uint16_t, uSel,
3348	uint64_t, offSeg,
3349	uint8_t, iSegReg,
3350	uint8_t, iGReg,
3351	IEMMODE, enmEffOpSize)
3352	{
3353	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3354	VBOXSTRICTRC rcStrict;
3355
3356	/*
3357	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
3358	*/
3359	/** @todo verify and test that mov, pop and lXs works the segment
3360	* register loading in the exact same way. */
3361	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3362	if (rcStrict == VINF_SUCCESS)
3363	{
3364	switch (enmEffOpSize)
3365	{
3366	case IEMMODE_16BIT:
3367	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3368	break;
3369	case IEMMODE_32BIT:
3370	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3371	break;
3372	case IEMMODE_64BIT:
3373	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
3374	break;
3375	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3376	}
3377	}
3378
3379	return rcStrict;
3380	}
3381
3382
3383	/**
3384	* Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
3385	*
3386	* @retval VINF_SUCCESS on success.
3387	* @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
3388	* @retval iemMemFetchSysU64 return value.
3389	*
3390	* @param pIemCpu The IEM state of the calling EMT.
3391	* @param uSel The selector value.
3392	* @param fAllowSysDesc Whether system descriptors are OK or not.
3393	* @param pDesc Where to return the descriptor on success.
3394	*/
3395	static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
3396	{
3397	pDesc->Long.au64[0] = 0;
3398	pDesc->Long.au64[1] = 0;
3399
3400	if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
3401	return VINF_IEM_SELECTOR_NOT_OK;
3402
3403	/* Within the table limits? */
3404	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3405	RTGCPTR GCPtrBase;
3406	if (uSel & X86_SEL_LDT)
3407	{
3408	if ( !pCtx->ldtr.Attr.n.u1Present
3409	\|\| (uSel \| X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
3410	return VINF_IEM_SELECTOR_NOT_OK;
3411	GCPtrBase = pCtx->ldtr.u64Base;
3412	}
3413	else
3414	{
3415	if ((uSel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
3416	return VINF_IEM_SELECTOR_NOT_OK;
3417	GCPtrBase = pCtx->gdtr.pGdt;
3418	}
3419
3420	/* Fetch the descriptor. */
3421	VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
3422	if (rcStrict != VINF_SUCCESS)
3423	return rcStrict;
3424	if (!pDesc->Legacy.Gen.u1DescType)
3425	{
3426	if (!fAllowSysDesc)
3427	return VINF_IEM_SELECTOR_NOT_OK;
3428	if (CPUMIsGuestInLongModeEx(pCtx))
3429	{
3430	rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
3431	if (rcStrict != VINF_SUCCESS)
3432	return rcStrict;
3433	}
3434
3435	}
3436
3437	return VINF_SUCCESS;
3438	}
3439
3440
3441	/**
3442	* Implements verr (fWrite = false) and verw (fWrite = true).
3443	*/
3444	IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
3445	{
3446	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3447
3448	/** @todo figure whether the accessed bit is set or not. */
3449
3450	bool fAccessible = true;
3451	IEMSELDESC Desc;
3452	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3453	if (rcStrict == VINF_SUCCESS)
3454	{
3455	/* Check the descriptor, order doesn't matter much here. */
3456	if ( !Desc.Legacy.Gen.u1DescType
3457	\|\| !Desc.Legacy.Gen.u1Present)
3458	fAccessible = false;
3459	else
3460	{
3461	if ( fWrite
3462	? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
3463	: (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3464	fAccessible = false;
3465
3466	/** @todo testcase for the conforming behavior. */
3467	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3468	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
3469	{
3470	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3471	fAccessible = false;
3472	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3473	fAccessible = false;
3474	}
3475	}
3476
3477	}
3478	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3479	fAccessible = false;
3480	else
3481	return rcStrict;
3482
3483	/* commit */
3484	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
3485
3486	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3487	return VINF_SUCCESS;
3488	}
3489
3490
3491	/**
3492	* Implements LAR and LSL with 64-bit operand size.
3493	*
3494	* @returns VINF_SUCCESS.
3495	* @param pu16Dst Pointer to the destination register.
3496	* @param uSel The selector to load details for.
3497	* @param pEFlags Pointer to the eflags register.
3498	* @param fIsLar true = LAR, false = LSL.
3499	*/
3500	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t , pu64Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3501	{
3502	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3503
3504	/** @todo figure whether the accessed bit is set or not. */
3505
3506	bool fDescOk = true;
3507	IEMSELDESC Desc;
3508	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
3509	if (rcStrict == VINF_SUCCESS)
3510	{
3511	/*
3512	* Check the descriptor type.
3513	*/
3514	if (!Desc.Legacy.Gen.u1DescType)
3515	{
3516	if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
3517	{
3518	if (Desc.Long.Gen.u5Zeros)
3519	fDescOk = false;
3520	else
3521	switch (Desc.Long.Gen.u4Type)
3522	{
3523	/** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
3524	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
3525	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
3526	case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
3527	break;
3528	case AMD64_SEL_TYPE_SYS_CALL_GATE:
3529	fDescOk = fIsLar;
3530	break;
3531	default:
3532	fDescOk = false;
3533	break;
3534	}
3535	}
3536	else
3537	{
3538	switch (Desc.Long.Gen.u4Type)
3539	{
3540	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
3541	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
3542	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
3543	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
3544	case X86_SEL_TYPE_SYS_LDT:
3545	break;
3546	case X86_SEL_TYPE_SYS_286_CALL_GATE:
3547	case X86_SEL_TYPE_SYS_TASK_GATE:
3548	case X86_SEL_TYPE_SYS_386_CALL_GATE:
3549	fDescOk = fIsLar;
3550	break;
3551	default:
3552	fDescOk = false;
3553	break;
3554	}
3555	}
3556	}
3557	if (fDescOk)
3558	{
3559	/*
3560	* Check the RPL/DPL/CPL interaction..
3561	*/
3562	/** @todo testcase for the conforming behavior. */
3563	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)
3564	\|\| !Desc.Legacy.Gen.u1DescType)
3565	{
3566	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3567	fDescOk = false;
3568	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3569	fDescOk = false;
3570	}
3571	}
3572
3573	if (fDescOk)
3574	{
3575	/*
3576	* All fine, start committing the result.
3577	*/
3578	if (fIsLar)
3579	*pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
3580	else
3581	*pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
3582	}
3583
3584	}
3585	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3586	fDescOk = false;
3587	else
3588	return rcStrict;
3589
3590	/* commit flags value and advance rip. */
3591	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
3592	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3593
3594	return VINF_SUCCESS;
3595	}
3596
3597
3598	/**
3599	* Implements LAR and LSL with 16-bit operand size.
3600	*
3601	* @returns VINF_SUCCESS.
3602	* @param pu16Dst Pointer to the destination register.
3603	* @param u16Sel The selector to load details for.
3604	* @param pEFlags Pointer to the eflags register.
3605	* @param fIsLar true = LAR, false = LSL.
3606	*/
3607	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t , pu16Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
3608	{
3609	uint64_t u64TmpDst = *pu16Dst;
3610	IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
3611	*pu16Dst = (uint16_t)u64TmpDst;
3612	return VINF_SUCCESS;
3613	}
3614
3615
3616	/**
3617	* Implements lgdt.
3618	*
3619	* @param iEffSeg The segment of the new gdtr contents
3620	* @param GCPtrEffSrc The address of the new gdtr contents.
3621	* @param enmEffOpSize The effective operand size.
3622	*/
3623	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3624	{
3625	if (pIemCpu->uCpl != 0)
3626	return iemRaiseGeneralProtectionFault0(pIemCpu);
3627	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3628
3629	/*
3630	* Fetch the limit and base address.
3631	*/
3632	uint16_t cbLimit;
3633	RTGCPTR GCPtrBase;
3634	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3635	if (rcStrict == VINF_SUCCESS)
3636	{
3637	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3638	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3639	else
3640	{
3641	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3642	pCtx->gdtr.cbGdt = cbLimit;
3643	pCtx->gdtr.pGdt = GCPtrBase;
3644	}
3645	if (rcStrict == VINF_SUCCESS)
3646	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3647	}
3648	return rcStrict;
3649	}
3650
3651
3652	/**
3653	* Implements sgdt.
3654	*
3655	* @param iEffSeg The segment where to store the gdtr content.
3656	* @param GCPtrEffDst The address where to store the gdtr content.
3657	* @param enmEffOpSize The effective operand size.
3658	*/
3659	IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3660	{
3661	/*
3662	* Join paths with sidt.
3663	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3664	* you really must know.
3665	*/
3666	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3667	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3668	if (rcStrict == VINF_SUCCESS)
3669	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3670	return rcStrict;
3671	}
3672
3673
3674	/**
3675	* Implements lidt.
3676	*
3677	* @param iEffSeg The segment of the new idtr contents
3678	* @param GCPtrEffSrc The address of the new idtr contents.
3679	* @param enmEffOpSize The effective operand size.
3680	*/
3681	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3682	{
3683	if (pIemCpu->uCpl != 0)
3684	return iemRaiseGeneralProtectionFault0(pIemCpu);
3685	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3686
3687	/*
3688	* Fetch the limit and base address.
3689	*/
3690	uint16_t cbLimit;
3691	RTGCPTR GCPtrBase;
3692	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3693	if (rcStrict == VINF_SUCCESS)
3694	{
3695	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3696	CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3697	else
3698	{
3699	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3700	pCtx->idtr.cbIdt = cbLimit;
3701	pCtx->idtr.pIdt = GCPtrBase;
3702	}
3703	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3704	}
3705	return rcStrict;
3706	}
3707
3708
3709	/**
3710	* Implements sidt.
3711	*
3712	* @param iEffSeg The segment where to store the idtr content.
3713	* @param GCPtrEffDst The address where to store the idtr content.
3714	* @param enmEffOpSize The effective operand size.
3715	*/
3716	IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3717	{
3718	/*
3719	* Join paths with sgdt.
3720	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3721	* you really must know.
3722	*/
3723	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3724	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3725	if (rcStrict == VINF_SUCCESS)
3726	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3727	return rcStrict;
3728	}
3729
3730
3731	/**
3732	* Implements lldt.
3733	*
3734	* @param uNewLdt The new LDT selector value.
3735	*/
3736	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
3737	{
3738	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3739
3740	/*
3741	* Check preconditions.
3742	*/
3743	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3744	{
3745	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
3746	return iemRaiseUndefinedOpcode(pIemCpu);
3747	}
3748	if (pIemCpu->uCpl != 0)
3749	{
3750	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
3751	return iemRaiseGeneralProtectionFault0(pIemCpu);
3752	}
3753	if (uNewLdt & X86_SEL_LDT)
3754	{
3755	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
3756	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
3757	}
3758
3759	/*
3760	* Now, loading a NULL selector is easy.
3761	*/
3762	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
3763	{
3764	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
3765	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3766	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
3767	else
3768	pCtx->ldtr.Sel = uNewLdt;
3769	pCtx->ldtr.ValidSel = uNewLdt;
3770	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3771	if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
3772	{
3773	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3774	pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
3775	}
3776	else if (IEM_IS_GUEST_CPU_AMD(pIemCpu))
3777	{
3778	/* AMD-V seems to leave the base and limit alone. */
3779	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3780	}
3781	else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
3782	{
3783	/* VT-x (Intel 3960x) seems to be doing the following. */
3784	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE \| X86DESCATTR_G \| X86DESCATTR_D;
3785	pCtx->ldtr.u64Base = 0;
3786	pCtx->ldtr.u32Limit = UINT32_MAX;
3787	}
3788
3789	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3790	return VINF_SUCCESS;
3791	}
3792
3793	/*
3794	* Read the descriptor.
3795	*/
3796	IEMSELDESC Desc;
3797	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
3798	if (rcStrict != VINF_SUCCESS)
3799	return rcStrict;
3800
3801	/* Check GPs first. */
3802	if (Desc.Legacy.Gen.u1DescType)
3803	{
3804	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3805	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3806	}
3807	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
3808	{
3809	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3810	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3811	}
3812	uint64_t u64Base;
3813	if (!IEM_IS_LONG_MODE(pIemCpu))
3814	u64Base = X86DESC_BASE(&Desc.Legacy);
3815	else
3816	{
3817	if (Desc.Long.Gen.u5Zeros)
3818	{
3819	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
3820	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3821	}
3822
3823	u64Base = X86DESC64_BASE(&Desc.Long);
3824	if (!IEM_IS_CANONICAL(u64Base))
3825	{
3826	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
3827	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3828	}
3829	}
3830
3831	/* NP */
3832	if (!Desc.Legacy.Gen.u1Present)
3833	{
3834	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
3835	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
3836	}
3837
3838	/*
3839	* It checks out alright, update the registers.
3840	*/
3841	/** @todo check if the actual value is loaded or if the RPL is dropped */
3842	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3843	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
3844	else
3845	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3846	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3847	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3848	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3849	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3850	pCtx->ldtr.u64Base = u64Base;
3851
3852	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3853	return VINF_SUCCESS;
3854	}
3855
3856
3857	/**
3858	* Implements lldt.
3859	*
3860	* @param uNewLdt The new LDT selector value.
3861	*/
3862	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3863	{
3864	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3865
3866	/*
3867	* Check preconditions.
3868	*/
3869	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3870	{
3871	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3872	return iemRaiseUndefinedOpcode(pIemCpu);
3873	}
3874	if (pIemCpu->uCpl != 0)
3875	{
3876	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3877	return iemRaiseGeneralProtectionFault0(pIemCpu);
3878	}
3879	if (uNewTr & X86_SEL_LDT)
3880	{
3881	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3882	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3883	}
3884	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3885	{
3886	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3887	return iemRaiseGeneralProtectionFault0(pIemCpu);
3888	}
3889
3890	/*
3891	* Read the descriptor.
3892	*/
3893	IEMSELDESC Desc;
3894	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
3895	if (rcStrict != VINF_SUCCESS)
3896	return rcStrict;
3897
3898	/* Check GPs first. */
3899	if (Desc.Legacy.Gen.u1DescType)
3900	{
3901	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3902	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3903	}
3904	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3905	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3906	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
3907	{
3908	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3909	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3910	}
3911	uint64_t u64Base;
3912	if (!IEM_IS_LONG_MODE(pIemCpu))
3913	u64Base = X86DESC_BASE(&Desc.Legacy);
3914	else
3915	{
3916	if (Desc.Long.Gen.u5Zeros)
3917	{
3918	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3919	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3920	}
3921
3922	u64Base = X86DESC64_BASE(&Desc.Long);
3923	if (!IEM_IS_CANONICAL(u64Base))
3924	{
3925	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3926	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3927	}
3928	}
3929
3930	/* NP */
3931	if (!Desc.Legacy.Gen.u1Present)
3932	{
3933	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3934	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3935	}
3936
3937	/*
3938	* Set it busy.
3939	* Note! Intel says this should lock down the whole descriptor, but we'll
3940	* restrict our selves to 32-bit for now due to lack of inline
3941	* assembly and such.
3942	*/
3943	void *pvDesc;
3944	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
3945	if (rcStrict != VINF_SUCCESS)
3946	return rcStrict;
3947	switch ((uintptr_t)pvDesc & 3)
3948	{
3949	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3950	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3951	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
3952	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
3953	}
3954	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
3955	if (rcStrict != VINF_SUCCESS)
3956	return rcStrict;
3957	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3958
3959	/*
3960	* It checks out alright, update the registers.
3961	*/
3962	/** @todo check if the actual value is loaded or if the RPL is dropped */
3963	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3964	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
3965	else
3966	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
3967	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
3968	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
3969	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3970	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3971	pCtx->tr.u64Base = u64Base;
3972
3973	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3974	return VINF_SUCCESS;
3975	}
3976
3977
3978	/**
3979	* Implements mov GReg,CRx.
3980	*
3981	* @param iGReg The general register to store the CRx value in.
3982	* @param iCrReg The CRx register to read (valid).
3983	*/
3984	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
3985	{
3986	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3987	if (pIemCpu->uCpl != 0)
3988	return iemRaiseGeneralProtectionFault0(pIemCpu);
3989	Assert(!pCtx->eflags.Bits.u1VM);
3990
3991	/* read it */
3992	uint64_t crX;
3993	switch (iCrReg)
3994	{
3995	case 0: crX = pCtx->cr0; break;
3996	case 2: crX = pCtx->cr2; break;
3997	case 3: crX = pCtx->cr3; break;
3998	case 4: crX = pCtx->cr4; break;
3999	case 8:
4000	{
4001	uint8_t uTpr;
4002	int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
4003	if (RT_SUCCESS(rc))
4004	crX = uTpr >> 4;
4005	else
4006	crX = 0;
4007	break;
4008	}
4009	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4010	}
4011
4012	/* store it */
4013	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4014	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
4015	else
4016	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
4017
4018	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4019	return VINF_SUCCESS;
4020	}
4021
4022
4023	/**
4024	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4025	*
4026	* @param iCrReg The CRx register to write (valid).
4027	* @param uNewCrX The new value.
4028	*/
4029	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4030	{
4031	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4032	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4033	VBOXSTRICTRC rcStrict;
4034	int rc;
4035
4036	/*
4037	* Try store it.
4038	* Unfortunately, CPUM only does a tiny bit of the work.
4039	*/
4040	switch (iCrReg)
4041	{
4042	case 0:
4043	{
4044	/*
4045	* Perform checks.
4046	*/
4047	uint64_t const uOldCrX = pCtx->cr0;
4048	uNewCrX \|= X86_CR0_ET; /* hardcoded */
4049
4050	/* Check for reserved bits. */
4051	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
4052	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
4053	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
4054	if (uNewCrX & ~(uint64_t)fValid)
4055	{
4056	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4057	return iemRaiseGeneralProtectionFault0(pIemCpu);
4058	}
4059
4060	/* Check for invalid combinations. */
4061	if ( (uNewCrX & X86_CR0_PG)
4062	&& !(uNewCrX & X86_CR0_PE) )
4063	{
4064	Log(("Trying to set CR0.PG without CR0.PE\n"));
4065	return iemRaiseGeneralProtectionFault0(pIemCpu);
4066	}
4067
4068	if ( !(uNewCrX & X86_CR0_CD)
4069	&& (uNewCrX & X86_CR0_NW) )
4070	{
4071	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4072	return iemRaiseGeneralProtectionFault0(pIemCpu);
4073	}
4074
4075	/* Long mode consistency checks. */
4076	if ( (uNewCrX & X86_CR0_PG)
4077	&& !(uOldCrX & X86_CR0_PG)
4078	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4079	{
4080	if (!(pCtx->cr4 & X86_CR4_PAE))
4081	{
4082	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4083	return iemRaiseGeneralProtectionFault0(pIemCpu);
4084	}
4085	if (pCtx->cs.Attr.n.u1Long)
4086	{
4087	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4088	return iemRaiseGeneralProtectionFault0(pIemCpu);
4089	}
4090	}
4091
4092	/** @todo check reserved PDPTR bits as AMD states. */
4093
4094	/*
4095	* Change CR0.
4096	*/
4097	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4098	CPUMSetGuestCR0(pVCpu, uNewCrX);
4099	else
4100	pCtx->cr0 = uNewCrX;
4101	Assert(pCtx->cr0 == uNewCrX);
4102
4103	/*
4104	* Change EFER.LMA if entering or leaving long mode.
4105	*/
4106	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4107	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4108	{
4109	uint64_t NewEFER = pCtx->msrEFER;
4110	if (uNewCrX & X86_CR0_PG)
4111	NewEFER \|= MSR_K6_EFER_LMA;
4112	else
4113	NewEFER &= ~MSR_K6_EFER_LMA;
4114
4115	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4116	CPUMSetGuestEFER(pVCpu, NewEFER);
4117	else
4118	pCtx->msrEFER = NewEFER;
4119	Assert(pCtx->msrEFER == NewEFER);
4120	}
4121
4122	/*
4123	* Inform PGM.
4124	*/
4125	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4126	{
4127	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
4128	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
4129	{
4130	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4131	AssertRCReturn(rc, rc);
4132	/* ignore informational status codes */
4133	}
4134	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4135	}
4136	else
4137	rcStrict = VINF_SUCCESS;
4138
4139	#ifdef IN_RC
4140	/* Return to ring-3 for rescheduling if WP or AM changes. */
4141	if ( rcStrict == VINF_SUCCESS
4142	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
4143	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
4144	rcStrict = VINF_EM_RESCHEDULE;
4145	#endif
4146	break;
4147	}
4148
4149	/*
4150	* CR2 can be changed without any restrictions.
4151	*/
4152	case 2:
4153	pCtx->cr2 = uNewCrX;
4154	rcStrict = VINF_SUCCESS;
4155	break;
4156
4157	/*
4158	* CR3 is relatively simple, although AMD and Intel have different
4159	* accounts of how setting reserved bits are handled. We take intel's
4160	* word for the lower bits and AMD's for the high bits (63:52).
4161	*/
4162	/** @todo Testcase: Setting reserved bits in CR3, especially before
4163	* enabling paging. */
4164	case 3:
4165	{
4166	/* check / mask the value. */
4167	if (uNewCrX & UINT64_C(0xfff0000000000000))
4168	{
4169	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
4170	return iemRaiseGeneralProtectionFault0(pIemCpu);
4171	}
4172
4173	uint64_t fValid;
4174	if ( (pCtx->cr4 & X86_CR4_PAE)
4175	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
4176	fValid = UINT64_C(0x000ffffffffff014);
4177	else if (pCtx->cr4 & X86_CR4_PAE)
4178	fValid = UINT64_C(0xfffffff4);
4179	else
4180	fValid = UINT64_C(0xfffff014);
4181	if (uNewCrX & ~fValid)
4182	{
4183	Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
4184	uNewCrX, uNewCrX & ~fValid));
4185	uNewCrX &= fValid;
4186	}
4187
4188	/** @todo If we're in PAE mode we should check the PDPTRs for
4189	* invalid bits. */
4190
4191	/* Make the change. */
4192	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4193	{
4194	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
4195	AssertRCSuccessReturn(rc, rc);
4196	}
4197	else
4198	pCtx->cr3 = uNewCrX;
4199
4200	/* Inform PGM. */
4201	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4202	{
4203	if (pCtx->cr0 & X86_CR0_PG)
4204	{
4205	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
4206	AssertRCReturn(rc, rc);
4207	/* ignore informational status codes */
4208	}
4209	}
4210	rcStrict = VINF_SUCCESS;
4211	break;
4212	}
4213
4214	/*
4215	* CR4 is a bit more tedious as there are bits which cannot be cleared
4216	* under some circumstances and such.
4217	*/
4218	case 4:
4219	{
4220	uint64_t const uOldCrX = pCtx->cr4;
4221
4222	/* reserved bits */
4223	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
4224	\| X86_CR4_TSD \| X86_CR4_DE
4225	\| X86_CR4_PSE \| X86_CR4_PAE
4226	\| X86_CR4_MCE \| X86_CR4_PGE
4227	\| X86_CR4_PCE \| X86_CR4_OSFSXR
4228	\| X86_CR4_OSXMMEEXCPT;
4229	//if (xxx)
4230	// fValid \|= X86_CR4_VMXE;
4231	//if (xxx)
4232	// fValid \|= X86_CR4_OSXSAVE;
4233	if (uNewCrX & ~(uint64_t)fValid)
4234	{
4235	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4236	return iemRaiseGeneralProtectionFault0(pIemCpu);
4237	}
4238
4239	/* long mode checks. */
4240	if ( (uOldCrX & X86_CR4_PAE)
4241	&& !(uNewCrX & X86_CR4_PAE)
4242	&& CPUMIsGuestInLongModeEx(pCtx) )
4243	{
4244	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
4245	return iemRaiseGeneralProtectionFault0(pIemCpu);
4246	}
4247
4248
4249	/*
4250	* Change it.
4251	*/
4252	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4253	{
4254	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
4255	AssertRCSuccessReturn(rc, rc);
4256	}
4257	else
4258	pCtx->cr4 = uNewCrX;
4259	Assert(pCtx->cr4 == uNewCrX);
4260
4261	/*
4262	* Notify SELM and PGM.
4263	*/
4264	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4265	{
4266	/* SELM - VME may change things wrt to the TSS shadowing. */
4267	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
4268	{
4269	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
4270	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
4271	#ifdef VBOX_WITH_RAW_MODE
4272	if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
4273	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
4274	#endif
4275	}
4276
4277	/* PGM - flushing and mode. */
4278	if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_PGE))
4279	{
4280	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4281	AssertRCReturn(rc, rc);
4282	/* ignore informational status codes */
4283	}
4284	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4285	}
4286	else
4287	rcStrict = VINF_SUCCESS;
4288	break;
4289	}
4290
4291	/*
4292	* CR8 maps to the APIC TPR.
4293	*/
4294	case 8:
4295	if (uNewCrX & ~(uint64_t)0xf)
4296	{
4297	Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
4298	return iemRaiseGeneralProtectionFault0(pIemCpu);
4299	}
4300
4301	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4302	PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
4303	rcStrict = VINF_SUCCESS;
4304	break;
4305
4306	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4307	}
4308
4309	/*
4310	* Advance the RIP on success.
4311	*/
4312	if (RT_SUCCESS(rcStrict))
4313	{
4314	if (rcStrict != VINF_SUCCESS)
4315	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4316	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4317	}
4318
4319	return rcStrict;
4320	}
4321
4322
4323	/**
4324	* Implements mov CRx,GReg.
4325	*
4326	* @param iCrReg The CRx register to write (valid).
4327	* @param iGReg The general register to load the DRx value from.
4328	*/
4329	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
4330	{
4331	if (pIemCpu->uCpl != 0)
4332	return iemRaiseGeneralProtectionFault0(pIemCpu);
4333	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4334
4335	/*
4336	* Read the new value from the source register and call common worker.
4337	*/
4338	uint64_t uNewCrX;
4339	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4340	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
4341	else
4342	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
4343	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
4344	}
4345
4346
4347	/**
4348	* Implements 'LMSW r/m16'
4349	*
4350	* @param u16NewMsw The new value.
4351	*/
4352	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
4353	{
4354	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4355
4356	if (pIemCpu->uCpl != 0)
4357	return iemRaiseGeneralProtectionFault0(pIemCpu);
4358	Assert(!pCtx->eflags.Bits.u1VM);
4359
4360	/*
4361	* Compose the new CR0 value and call common worker.
4362	*/
4363	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4364	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
4365	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4366	}
4367
4368
4369	/**
4370	* Implements 'CLTS'.
4371	*/
4372	IEM_CIMPL_DEF_0(iemCImpl_clts)
4373	{
4374	if (pIemCpu->uCpl != 0)
4375	return iemRaiseGeneralProtectionFault0(pIemCpu);
4376
4377	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4378	uint64_t uNewCr0 = pCtx->cr0;
4379	uNewCr0 &= ~X86_CR0_TS;
4380	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
4381	}
4382
4383
4384	/**
4385	* Implements mov GReg,DRx.
4386	*
4387	* @param iGReg The general register to store the DRx value in.
4388	* @param iDrReg The DRx register to read (0-7).
4389	*/
4390	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
4391	{
4392	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4393
4394	/*
4395	* Check preconditions.
4396	*/
4397
4398	/* Raise GPs. */
4399	if (pIemCpu->uCpl != 0)
4400	return iemRaiseGeneralProtectionFault0(pIemCpu);
4401	Assert(!pCtx->eflags.Bits.u1VM);
4402
4403	if ( (iDrReg == 4 \|\| iDrReg == 5)
4404	&& (pCtx->cr4 & X86_CR4_DE) )
4405	{
4406	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
4407	return iemRaiseGeneralProtectionFault0(pIemCpu);
4408	}
4409
4410	/* Raise #DB if general access detect is enabled. */
4411	if (pCtx->dr[7] & X86_DR7_GD)
4412	{
4413	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
4414	return iemRaiseDebugException(pIemCpu);
4415	}
4416
4417	/*
4418	* Read the debug register and store it in the specified general register.
4419	*/
4420	uint64_t drX;
4421	switch (iDrReg)
4422	{
4423	case 0: drX = pCtx->dr[0]; break;
4424	case 1: drX = pCtx->dr[1]; break;
4425	case 2: drX = pCtx->dr[2]; break;
4426	case 3: drX = pCtx->dr[3]; break;
4427	case 6:
4428	case 4:
4429	drX = pCtx->dr[6];
4430	drX \|= X86_DR6_RA1_MASK;
4431	drX &= ~X86_DR6_RAZ_MASK;
4432	break;
4433	case 7:
4434	case 5:
4435	drX = pCtx->dr[7];
4436	drX \|=X86_DR7_RA1_MASK;
4437	drX &= ~X86_DR7_RAZ_MASK;
4438	break;
4439	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4440	}
4441
4442	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4443	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
4444	else
4445	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
4446
4447	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4448	return VINF_SUCCESS;
4449	}
4450
4451
4452	/**
4453	* Implements mov DRx,GReg.
4454	*
4455	* @param iDrReg The DRx register to write (valid).
4456	* @param iGReg The general register to load the DRx value from.
4457	*/
4458	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
4459	{
4460	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4461
4462	/*
4463	* Check preconditions.
4464	*/
4465	if (pIemCpu->uCpl != 0)
4466	return iemRaiseGeneralProtectionFault0(pIemCpu);
4467	Assert(!pCtx->eflags.Bits.u1VM);
4468
4469	if (iDrReg == 4 \|\| iDrReg == 5)
4470	{
4471	if (pCtx->cr4 & X86_CR4_DE)
4472	{
4473	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
4474	return iemRaiseGeneralProtectionFault0(pIemCpu);
4475	}
4476	iDrReg += 2;
4477	}
4478
4479	/* Raise #DB if general access detect is enabled. */
4480	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
4481	* \#GP? */
4482	if (pCtx->dr[7] & X86_DR7_GD)
4483	{
4484	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
4485	return iemRaiseDebugException(pIemCpu);
4486	}
4487
4488	/*
4489	* Read the new value from the source register.
4490	*/
4491	uint64_t uNewDrX;
4492	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4493	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
4494	else
4495	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
4496
4497	/*
4498	* Adjust it.
4499	*/
4500	switch (iDrReg)
4501	{
4502	case 0:
4503	case 1:
4504	case 2:
4505	case 3:
4506	/* nothing to adjust */
4507	break;
4508
4509	case 6:
4510	if (uNewDrX & X86_DR6_MBZ_MASK)
4511	{
4512	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4513	return iemRaiseGeneralProtectionFault0(pIemCpu);
4514	}
4515	uNewDrX \|= X86_DR6_RA1_MASK;
4516	uNewDrX &= ~X86_DR6_RAZ_MASK;
4517	break;
4518
4519	case 7:
4520	if (uNewDrX & X86_DR7_MBZ_MASK)
4521	{
4522	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4523	return iemRaiseGeneralProtectionFault0(pIemCpu);
4524	}
4525	uNewDrX \|= X86_DR7_RA1_MASK;
4526	uNewDrX &= ~X86_DR7_RAZ_MASK;
4527	break;
4528
4529	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4530	}
4531
4532	/*
4533	* Do the actual setting.
4534	*/
4535	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4536	{
4537	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
4538	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
4539	}
4540	else
4541	pCtx->dr[iDrReg] = uNewDrX;
4542
4543	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4544	return VINF_SUCCESS;
4545	}
4546
4547
4548	/**
4549	* Implements 'INVLPG m'.
4550	*
4551	* @param GCPtrPage The effective address of the page to invalidate.
4552	* @remarks Updates the RIP.
4553	*/
4554	IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
4555	{
4556	/* ring-0 only. */
4557	if (pIemCpu->uCpl != 0)
4558	return iemRaiseGeneralProtectionFault0(pIemCpu);
4559	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4560
4561	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
4562	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4563
4564	if (rc == VINF_SUCCESS)
4565	return VINF_SUCCESS;
4566	if (rc == VINF_PGM_SYNC_CR3)
4567	return iemSetPassUpStatus(pIemCpu, rc);
4568
4569	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
4570	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
4571	return rc;
4572	}
4573
4574
4575	/**
4576	* Implements RDTSC.
4577	*/
4578	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
4579	{
4580	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4581
4582	/*
4583	* Check preconditions.
4584	*/
4585	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
4586	return iemRaiseUndefinedOpcode(pIemCpu);
4587
4588	if ( (pCtx->cr4 & X86_CR4_TSD)
4589	&& pIemCpu->uCpl != 0)
4590	{
4591	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
4592	return iemRaiseGeneralProtectionFault0(pIemCpu);
4593	}
4594
4595	/*
4596	* Do the job.
4597	*/
4598	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
4599	pCtx->rax = (uint32_t)uTicks;
4600	pCtx->rdx = uTicks >> 32;
4601	#ifdef IEM_VERIFICATION_MODE_FULL
4602	pIemCpu->fIgnoreRaxRdx = true;
4603	#endif
4604
4605	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4606	return VINF_SUCCESS;
4607	}
4608
4609
4610	/**
4611	* Implements RDMSR.
4612	*/
4613	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
4614	{
4615	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4616
4617	/*
4618	* Check preconditions.
4619	*/
4620	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4621	return iemRaiseUndefinedOpcode(pIemCpu);
4622	if (pIemCpu->uCpl != 0)
4623	return iemRaiseGeneralProtectionFault0(pIemCpu);
4624
4625	/*
4626	* Do the job.
4627	*/
4628	RTUINT64U uValue;
4629	int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
4630	if (rc != VINF_SUCCESS)
4631	{
4632	Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
4633	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4634	return iemRaiseGeneralProtectionFault0(pIemCpu);
4635	}
4636
4637	pCtx->rax = uValue.s.Lo;
4638	pCtx->rdx = uValue.s.Hi;
4639
4640	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4641	return VINF_SUCCESS;
4642	}
4643
4644
4645	/**
4646	* Implements WRMSR.
4647	*/
4648	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
4649	{
4650	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4651
4652	/*
4653	* Check preconditions.
4654	*/
4655	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4656	return iemRaiseUndefinedOpcode(pIemCpu);
4657	if (pIemCpu->uCpl != 0)
4658	return iemRaiseGeneralProtectionFault0(pIemCpu);
4659
4660	/*
4661	* Do the job.
4662	*/
4663	RTUINT64U uValue;
4664	uValue.s.Lo = pCtx->eax;
4665	uValue.s.Hi = pCtx->edx;
4666
4667	int rc;
4668	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4669	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4670	else
4671	{
4672	CPUMCTX CtxTmp = *pCtx;
4673	rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4674	PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
4675	pCtx = pCtx2;
4676	*pCtx2 = CtxTmp;
4677	}
4678	if (rc != VINF_SUCCESS)
4679	{
4680	Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
4681	AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4682	return iemRaiseGeneralProtectionFault0(pIemCpu);
4683	}
4684
4685	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4686	return VINF_SUCCESS;
4687	}
4688
4689
4690	/**
4691	* Implements 'IN eAX, port'.
4692	*
4693	* @param u16Port The source port.
4694	* @param cbReg The register size.
4695	*/
4696	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
4697	{
4698	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4699
4700	/*
4701	* CPL check
4702	*/
4703	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4704	if (rcStrict != VINF_SUCCESS)
4705	return rcStrict;
4706
4707	/*
4708	* Perform the I/O.
4709	*/
4710	uint32_t u32Value;
4711	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4712	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
4713	else
4714	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
4715	if (IOM_SUCCESS(rcStrict))
4716	{
4717	switch (cbReg)
4718	{
4719	case 1: pCtx->al = (uint8_t)u32Value; break;
4720	case 2: pCtx->ax = (uint16_t)u32Value; break;
4721	case 4: pCtx->rax = u32Value; break;
4722	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4723	}
4724	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4725	pIemCpu->cPotentialExits++;
4726	if (rcStrict != VINF_SUCCESS)
4727	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4728	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
4729
4730	/*
4731	* Check for I/O breakpoints.
4732	*/
4733	uint32_t const uDr7 = pCtx->dr[7];
4734	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
4735	&& X86_DR7_ANY_RW_IO(uDr7)
4736	&& (pCtx->cr4 & X86_CR4_DE))
4737	\|\| DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
4738	{
4739	rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
4740	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
4741	rcStrict = iemRaiseDebugException(pIemCpu);
4742	}
4743	}
4744
4745	return rcStrict;
4746	}
4747
4748
4749	/**
4750	* Implements 'IN eAX, DX'.
4751	*
4752	* @param cbReg The register size.
4753	*/
4754	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
4755	{
4756	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4757	}
4758
4759
4760	/**
4761	* Implements 'OUT port, eAX'.
4762	*
4763	* @param u16Port The destination port.
4764	* @param cbReg The register size.
4765	*/
4766	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
4767	{
4768	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4769
4770	/*
4771	* CPL check
4772	*/
4773	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4774	if (rcStrict != VINF_SUCCESS)
4775	return rcStrict;
4776
4777	/*
4778	* Perform the I/O.
4779	*/
4780	uint32_t u32Value;
4781	switch (cbReg)
4782	{
4783	case 1: u32Value = pCtx->al; break;
4784	case 2: u32Value = pCtx->ax; break;
4785	case 4: u32Value = pCtx->eax; break;
4786	default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4787	}
4788	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4789	rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
4790	else
4791	rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
4792	if (IOM_SUCCESS(rcStrict))
4793	{
4794	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4795	pIemCpu->cPotentialExits++;
4796	if (rcStrict != VINF_SUCCESS)
4797	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4798	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
4799
4800	/*
4801	* Check for I/O breakpoints.
4802	*/
4803	uint32_t const uDr7 = pCtx->dr[7];
4804	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
4805	&& X86_DR7_ANY_RW_IO(uDr7)
4806	&& (pCtx->cr4 & X86_CR4_DE))
4807	\|\| DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
4808	{
4809	rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
4810	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
4811	rcStrict = iemRaiseDebugException(pIemCpu);
4812	}
4813	}
4814	return rcStrict;
4815	}
4816
4817
4818	/**
4819	* Implements 'OUT DX, eAX'.
4820	*
4821	* @param cbReg The register size.
4822	*/
4823	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
4824	{
4825	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4826	}
4827
4828
4829	/**
4830	* Implements 'CLI'.
4831	*/
4832	IEM_CIMPL_DEF_0(iemCImpl_cli)
4833	{
4834	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4835	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4836	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4837	uint32_t const fEflOld = fEfl;
4838	if (pCtx->cr0 & X86_CR0_PE)
4839	{
4840	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4841	if (!(fEfl & X86_EFL_VM))
4842	{
4843	if (pIemCpu->uCpl <= uIopl)
4844	fEfl &= ~X86_EFL_IF;
4845	else if ( pIemCpu->uCpl == 3
4846	&& (pCtx->cr4 & X86_CR4_PVI) )
4847	fEfl &= ~X86_EFL_VIF;
4848	else
4849	return iemRaiseGeneralProtectionFault0(pIemCpu);
4850	}
4851	/* V8086 */
4852	else if (uIopl == 3)
4853	fEfl &= ~X86_EFL_IF;
4854	else if ( uIopl < 3
4855	&& (pCtx->cr4 & X86_CR4_VME) )
4856	fEfl &= ~X86_EFL_VIF;
4857	else
4858	return iemRaiseGeneralProtectionFault0(pIemCpu);
4859	}
4860	/* real mode */
4861	else
4862	fEfl &= ~X86_EFL_IF;
4863
4864	/* Commit. */
4865	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4866	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4867	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
4868	return VINF_SUCCESS;
4869	}
4870
4871
4872	/**
4873	* Implements 'STI'.
4874	*/
4875	IEM_CIMPL_DEF_0(iemCImpl_sti)
4876	{
4877	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4878	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4879	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4880	uint32_t const fEflOld = fEfl;
4881
4882	if (pCtx->cr0 & X86_CR0_PE)
4883	{
4884	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4885	if (!(fEfl & X86_EFL_VM))
4886	{
4887	if (pIemCpu->uCpl <= uIopl)
4888	fEfl \|= X86_EFL_IF;
4889	else if ( pIemCpu->uCpl == 3
4890	&& (pCtx->cr4 & X86_CR4_PVI)
4891	&& !(fEfl & X86_EFL_VIP) )
4892	fEfl \|= X86_EFL_VIF;
4893	else
4894	return iemRaiseGeneralProtectionFault0(pIemCpu);
4895	}
4896	/* V8086 */
4897	else if (uIopl == 3)
4898	fEfl \|= X86_EFL_IF;
4899	else if ( uIopl < 3
4900	&& (pCtx->cr4 & X86_CR4_VME)
4901	&& !(fEfl & X86_EFL_VIP) )
4902	fEfl \|= X86_EFL_VIF;
4903	else
4904	return iemRaiseGeneralProtectionFault0(pIemCpu);
4905	}
4906	/* real mode */
4907	else
4908	fEfl \|= X86_EFL_IF;
4909
4910	/* Commit. */
4911	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4912	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4913	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4914	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4915	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4916	return VINF_SUCCESS;
4917	}
4918
4919
4920	/**
4921	* Implements 'HLT'.
4922	*/
4923	IEM_CIMPL_DEF_0(iemCImpl_hlt)
4924	{
4925	if (pIemCpu->uCpl != 0)
4926	return iemRaiseGeneralProtectionFault0(pIemCpu);
4927	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4928	return VINF_EM_HALT;
4929	}
4930
4931
4932	/**
4933	* Implements 'MONITOR'.
4934	*/
4935	IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
4936	{
4937	/*
4938	* Permission checks.
4939	*/
4940	if (pIemCpu->uCpl != 0)
4941	{
4942	Log2(("monitor: CPL != 0\n"));
4943	return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
4944	}
4945	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4946	{
4947	Log2(("monitor: Not in CPUID\n"));
4948	return iemRaiseUndefinedOpcode(pIemCpu);
4949	}
4950
4951	/*
4952	* Gather the operands and validate them.
4953	*/
4954	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4955	RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
4956	uint32_t uEcx = pCtx->ecx;
4957	uint32_t uEdx = pCtx->edx;
4958	/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
4959	* \#GP first. */
4960	if (uEcx != 0)
4961	{
4962	Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx));
4963	return iemRaiseGeneralProtectionFault0(pIemCpu);
4964	}
4965
4966	VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
4967	if (rcStrict != VINF_SUCCESS)
4968	return rcStrict;
4969
4970	RTGCPHYS GCPhysMem;
4971	rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, &GCPhysMem);
4972	if (rcStrict != VINF_SUCCESS)
4973	return rcStrict;
4974
4975	/*
4976	* Call EM to prepare the monitor/wait.
4977	*/
4978	rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
4979	Assert(rcStrict == VINF_SUCCESS);
4980
4981	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4982	return rcStrict;
4983	}
4984
4985
4986	/**
4987	* Implements 'MWAIT'.
4988	*/
4989	IEM_CIMPL_DEF_0(iemCImpl_mwait)
4990	{
4991	/*
4992	* Permission checks.
4993	*/
4994	if (pIemCpu->uCpl != 0)
4995	{
4996	Log2(("mwait: CPL != 0\n"));
4997	/** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
4998	* EFLAGS.VM then.) */
4999	return iemRaiseUndefinedOpcode(pIemCpu);
5000	}
5001	if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
5002	{
5003	Log2(("mwait: Not in CPUID\n"));
5004	return iemRaiseUndefinedOpcode(pIemCpu);
5005	}
5006
5007	/*
5008	* Gather the operands and validate them.
5009	*/
5010	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5011	uint32_t uEax = pCtx->eax;
5012	uint32_t uEcx = pCtx->ecx;
5013	if (uEcx != 0)
5014	{
5015	/* Only supported extension is break on IRQ when IF=0. */
5016	if (uEcx > 1)
5017	{
5018	Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5019	return iemRaiseGeneralProtectionFault0(pIemCpu);
5020	}
5021	uint32_t fMWaitFeatures = 0;
5022	uint32_t uIgnore = 0;
5023	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5024	if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5025	!= (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5026	{
5027	Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5028	return iemRaiseGeneralProtectionFault0(pIemCpu);
5029	}
5030	}
5031
5032	/*
5033	* Call EM to prepare the monitor/wait.
5034	*/
5035	VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
5036
5037	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5038	return rcStrict;
5039	}
5040
5041
5042	/**
5043	* Implements 'SWAPGS'.
5044	*/
5045	IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5046	{
5047	Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5048
5049	/*
5050	* Permission checks.
5051	*/
5052	if (pIemCpu->uCpl != 0)
5053	{
5054	Log2(("swapgs: CPL != 0\n"));
5055	return iemRaiseUndefinedOpcode(pIemCpu);
5056	}
5057
5058	/*
5059	* Do the job.
5060	*/
5061	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5062	uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5063	pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5064	pCtx->gs.u64Base = uOtherGsBase;
5065
5066	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5067	return VINF_SUCCESS;
5068	}
5069
5070
5071	/**
5072	* Implements 'CPUID'.
5073	*/
5074	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5075	{
5076	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5077
5078	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5079	pCtx->rax &= UINT32_C(0xffffffff);
5080	pCtx->rbx &= UINT32_C(0xffffffff);
5081	pCtx->rcx &= UINT32_C(0xffffffff);
5082	pCtx->rdx &= UINT32_C(0xffffffff);
5083
5084	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5085	return VINF_SUCCESS;
5086	}
5087
5088
5089	/**
5090	* Implements 'AAD'.
5091	*
5092	* @param enmEffOpSize The effective operand size.
5093	*/
5094	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5095	{
5096	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5097
5098	uint16_t const ax = pCtx->ax;
5099	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5100	pCtx->ax = al;
5101	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5102	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5103	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5104
5105	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5106	return VINF_SUCCESS;
5107	}
5108
5109
5110	/**
5111	* Implements 'AAM'.
5112	*
5113	* @param bImm The immediate operand. Cannot be 0.
5114	*/
5115	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5116	{
5117	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5118	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5119
5120	uint16_t const ax = pCtx->ax;
5121	uint8_t const al = (uint8_t)ax % bImm;
5122	uint8_t const ah = (uint8_t)ax / bImm;
5123	pCtx->ax = (ah << 8) + al;
5124	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5125	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5126	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5127
5128	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5129	return VINF_SUCCESS;
5130	}
5131
5132
5133
5134
5135	/*
5136	* Instantiate the various string operation combinations.
5137	*/
5138	#define OP_SIZE 8
5139	#define ADDR_SIZE 16
5140	#include "IEMAllCImplStrInstr.cpp.h"
5141	#define OP_SIZE 8
5142	#define ADDR_SIZE 32
5143	#include "IEMAllCImplStrInstr.cpp.h"
5144	#define OP_SIZE 8
5145	#define ADDR_SIZE 64
5146	#include "IEMAllCImplStrInstr.cpp.h"
5147
5148	#define OP_SIZE 16
5149	#define ADDR_SIZE 16
5150	#include "IEMAllCImplStrInstr.cpp.h"
5151	#define OP_SIZE 16
5152	#define ADDR_SIZE 32
5153	#include "IEMAllCImplStrInstr.cpp.h"
5154	#define OP_SIZE 16
5155	#define ADDR_SIZE 64
5156	#include "IEMAllCImplStrInstr.cpp.h"
5157
5158	#define OP_SIZE 32
5159	#define ADDR_SIZE 16
5160	#include "IEMAllCImplStrInstr.cpp.h"
5161	#define OP_SIZE 32
5162	#define ADDR_SIZE 32
5163	#include "IEMAllCImplStrInstr.cpp.h"
5164	#define OP_SIZE 32
5165	#define ADDR_SIZE 64
5166	#include "IEMAllCImplStrInstr.cpp.h"
5167
5168	#define OP_SIZE 64
5169	#define ADDR_SIZE 32
5170	#include "IEMAllCImplStrInstr.cpp.h"
5171	#define OP_SIZE 64
5172	#define ADDR_SIZE 64
5173	#include "IEMAllCImplStrInstr.cpp.h"
5174
5175
5176	/**
5177	* Implements 'FINIT' and 'FNINIT'.
5178	*
5179	* @param fCheckXcpts Whether to check for umasked pending exceptions or
5180	* not.
5181	*/
5182	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
5183	{
5184	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5185
5186	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5187	return iemRaiseDeviceNotAvailable(pIemCpu);
5188
5189	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
5190	if (fCheckXcpts && TODO )
5191	return iemRaiseMathFault(pIemCpu);
5192	*/
5193
5194	if (iemFRegIsFxSaveFormat(pIemCpu))
5195	{
5196	pCtx->fpu.FCW = 0x37f;
5197	pCtx->fpu.FSW = 0;
5198	pCtx->fpu.FTW = 0x00; /* 0 - empty. */
5199	pCtx->fpu.FPUDP = 0;
5200	pCtx->fpu.DS = 0; //??
5201	pCtx->fpu.Rsrvd2= 0;
5202	pCtx->fpu.FPUIP = 0;
5203	pCtx->fpu.CS = 0; //??
5204	pCtx->fpu.Rsrvd1= 0;
5205	pCtx->fpu.FOP = 0;
5206	}
5207	else
5208	{
5209	PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
5210	pFpu->FCW = 0x37f;
5211	pFpu->FSW = 0;
5212	pFpu->FTW = 0xffff; /* 11 - empty */
5213	pFpu->FPUOO = 0; //??
5214	pFpu->FPUOS = 0; //??
5215	pFpu->FPUIP = 0;
5216	pFpu->CS = 0; //??
5217	pFpu->FOP = 0;
5218	}
5219
5220	iemHlpUsedFpu(pIemCpu);
5221	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5222	return VINF_SUCCESS;
5223	}
5224
5225
5226	/**
5227	* Implements 'FXSAVE'.
5228	*
5229	* @param iEffSeg The effective segment.
5230	* @param GCPtrEff The address of the image.
5231	* @param enmEffOpSize The operand size (only REX.W really matters).
5232	*/
5233	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5234	{
5235	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5236
5237	/*
5238	* Raise exceptions.
5239	*/
5240	if (pCtx->cr0 & X86_CR0_EM)
5241	return iemRaiseUndefinedOpcode(pIemCpu);
5242	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5243	return iemRaiseDeviceNotAvailable(pIemCpu);
5244	if (GCPtrEff & 15)
5245	{
5246	/** @todo CPU/VM detection possible! \#AC might not be signal for
5247	* all/any misalignment sizes, intel says its an implementation detail. */
5248	if ( (pCtx->cr0 & X86_CR0_AM)
5249	&& pCtx->eflags.Bits.u1AC
5250	&& pIemCpu->uCpl == 3)
5251	return iemRaiseAlignmentCheckException(pIemCpu);
5252	return iemRaiseGeneralProtectionFault0(pIemCpu);
5253	}
5254	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5255
5256	/*
5257	* Access the memory.
5258	*/
5259	void *pvMem512;
5260	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5261	if (rcStrict != VINF_SUCCESS)
5262	return rcStrict;
5263	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
5264
5265	/*
5266	* Store the registers.
5267	*/
5268	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5269	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
5270
5271	/* common for all formats */
5272	pDst->FCW = pCtx->fpu.FCW;
5273	pDst->FSW = pCtx->fpu.FSW;
5274	pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
5275	pDst->FOP = pCtx->fpu.FOP;
5276	pDst->MXCSR = pCtx->fpu.MXCSR;
5277	pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
5278	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
5279	{
5280	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
5281	* them for now... */
5282	pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5283	pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5284	pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
5285	pDst->aRegs[i].au32[3] = 0;
5286	}
5287
5288	/* FPU IP, CS, DP and DS. */
5289	/** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
5290	* state information. :-/
5291	* Storing zeros now to prevent any potential leakage of host info. */
5292	pDst->FPUIP = 0;
5293	pDst->CS = 0;
5294	pDst->Rsrvd1 = 0;
5295	pDst->FPUDP = 0;
5296	pDst->DS = 0;
5297	pDst->Rsrvd2 = 0;
5298
5299	/* XMM registers. */
5300	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5301	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5302	\|\| pIemCpu->uCpl != 0)
5303	{
5304	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5305	for (uint32_t i = 0; i < cXmmRegs; i++)
5306	pDst->aXMM[i] = pCtx->fpu.aXMM[i];
5307	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
5308	* right? */
5309	}
5310
5311	/*
5312	* Commit the memory.
5313	*/
5314	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5315	if (rcStrict != VINF_SUCCESS)
5316	return rcStrict;
5317
5318	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5319	return VINF_SUCCESS;
5320	}
5321
5322
5323	/**
5324	* Implements 'FXRSTOR'.
5325	*
5326	* @param GCPtrEff The address of the image.
5327	* @param enmEffOpSize The operand size (only REX.W really matters).
5328	*/
5329	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5330	{
5331	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5332
5333	/*
5334	* Raise exceptions.
5335	*/
5336	if (pCtx->cr0 & X86_CR0_EM)
5337	return iemRaiseUndefinedOpcode(pIemCpu);
5338	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
5339	return iemRaiseDeviceNotAvailable(pIemCpu);
5340	if (GCPtrEff & 15)
5341	{
5342	/** @todo CPU/VM detection possible! \#AC might not be signal for
5343	* all/any misalignment sizes, intel says its an implementation detail. */
5344	if ( (pCtx->cr0 & X86_CR0_AM)
5345	&& pCtx->eflags.Bits.u1AC
5346	&& pIemCpu->uCpl == 3)
5347	return iemRaiseAlignmentCheckException(pIemCpu);
5348	return iemRaiseGeneralProtectionFault0(pIemCpu);
5349	}
5350	AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5351
5352	/*
5353	* Access the memory.
5354	*/
5355	void *pvMem512;
5356	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
5357	if (rcStrict != VINF_SUCCESS)
5358	return rcStrict;
5359	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
5360
5361	/*
5362	* Check the state for stuff which will GP(0).
5363	*/
5364	uint32_t const fMXCSR = pSrc->MXCSR;
5365	uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
5366	if (fMXCSR & ~fMXCSR_MASK)
5367	{
5368	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
5369	return iemRaiseGeneralProtectionFault0(pIemCpu);
5370	}
5371
5372	/*
5373	* Load the registers.
5374	*/
5375	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5376	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
5377
5378	/* common for all formats */
5379	pCtx->fpu.FCW = pSrc->FCW;
5380	pCtx->fpu.FSW = pSrc->FSW;
5381	pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
5382	pCtx->fpu.FOP = pSrc->FOP;
5383	pCtx->fpu.MXCSR = fMXCSR;
5384	/* (MXCSR_MASK is read-only) */
5385	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
5386	{
5387	pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
5388	pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
5389	pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
5390	pCtx->fpu.aRegs[i].au32[3] = 0;
5391	}
5392
5393	/* FPU IP, CS, DP and DS. */
5394	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5395	{
5396	pCtx->fpu.FPUIP = pSrc->FPUIP;
5397	pCtx->fpu.CS = pSrc->CS;
5398	pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
5399	pCtx->fpu.FPUDP = pSrc->FPUDP;
5400	pCtx->fpu.DS = pSrc->DS;
5401	pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
5402	}
5403	else
5404	{
5405	pCtx->fpu.FPUIP = pSrc->FPUIP;
5406	pCtx->fpu.CS = pSrc->CS;
5407	pCtx->fpu.Rsrvd1 = 0;
5408	pCtx->fpu.FPUDP = pSrc->FPUDP;
5409	pCtx->fpu.DS = pSrc->DS;
5410	pCtx->fpu.Rsrvd2 = 0;
5411	}
5412
5413	/* XMM registers. */
5414	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5415	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
5416	\|\| pIemCpu->uCpl != 0)
5417	{
5418	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5419	for (uint32_t i = 0; i < cXmmRegs; i++)
5420	pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
5421	}
5422
5423	/*
5424	* Commit the memory.
5425	*/
5426	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
5427	if (rcStrict != VINF_SUCCESS)
5428	return rcStrict;
5429
5430	iemHlpUsedFpu(pIemCpu);
5431	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5432	return VINF_SUCCESS;
5433	}
5434
5435
5436	/**
5437	* Commmon routine for fnstenv and fnsave.
5438	*
5439	* @param uPtr Where to store the state.
5440	* @param pCtx The CPU context.
5441	*/
5442	static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
5443	{
5444	if (enmEffOpSize == IEMMODE_16BIT)
5445	{
5446	uPtr.pu16[0] = pCtx->fpu.FCW;
5447	uPtr.pu16[1] = pCtx->fpu.FSW;
5448	uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
5449	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5450	{
5451	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
5452	* protected mode or long mode and we save it in real mode? And vice
5453	* versa? And with 32-bit operand size? I think CPU is storing the
5454	* effective address ((CS << 4) + IP) in the offset register and not
5455	* doing any address calculations here. */
5456	uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
5457	uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) \| pCtx->fpu.FOP;
5458	uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
5459	uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
5460	}
5461	else
5462	{
5463	uPtr.pu16[3] = pCtx->fpu.FPUIP;
5464	uPtr.pu16[4] = pCtx->fpu.CS;
5465	uPtr.pu16[5] = pCtx->fpu.FPUDP;
5466	uPtr.pu16[6] = pCtx->fpu.DS;
5467	}
5468	}
5469	else
5470	{
5471	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
5472	uPtr.pu16[0*2] = pCtx->fpu.FCW;
5473	uPtr.pu16[1*2] = pCtx->fpu.FSW;
5474	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
5475	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5476	{
5477	uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
5478	uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) \| pCtx->fpu.FOP;
5479	uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
5480	uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
5481	}
5482	else
5483	{
5484	uPtr.pu32[3] = pCtx->fpu.FPUIP;
5485	uPtr.pu16[4*2] = pCtx->fpu.CS;
5486	uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
5487	uPtr.pu32[5] = pCtx->fpu.FPUDP;
5488	uPtr.pu16[6*2] = pCtx->fpu.DS;
5489	}
5490	}
5491	}
5492
5493
5494	/**
5495	* Commmon routine for fldenv and frstor
5496	*
5497	* @param uPtr Where to store the state.
5498	* @param pCtx The CPU context.
5499	*/
5500	static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
5501	{
5502	if (enmEffOpSize == IEMMODE_16BIT)
5503	{
5504	pCtx->fpu.FCW = uPtr.pu16[0];
5505	pCtx->fpu.FSW = uPtr.pu16[1];
5506	pCtx->fpu.FTW = uPtr.pu16[2];
5507	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5508	{
5509	pCtx->fpu.FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
5510	pCtx->fpu.FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
5511	pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
5512	pCtx->fpu.CS = 0;
5513	pCtx->fpu.Rsrvd1= 0;
5514	pCtx->fpu.DS = 0;
5515	pCtx->fpu.Rsrvd2= 0;
5516	}
5517	else
5518	{
5519	pCtx->fpu.FPUIP = uPtr.pu16[3];
5520	pCtx->fpu.CS = uPtr.pu16[4];
5521	pCtx->fpu.Rsrvd1= 0;
5522	pCtx->fpu.FPUDP = uPtr.pu16[5];
5523	pCtx->fpu.DS = uPtr.pu16[6];
5524	pCtx->fpu.Rsrvd2= 0;
5525	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
5526	}
5527	}
5528	else
5529	{
5530	pCtx->fpu.FCW = uPtr.pu16[0*2];
5531	pCtx->fpu.FSW = uPtr.pu16[1*2];
5532	pCtx->fpu.FTW = uPtr.pu16[2*2];
5533	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5534	{
5535	pCtx->fpu.FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
5536	pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
5537	pCtx->fpu.FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
5538	pCtx->fpu.CS = 0;
5539	pCtx->fpu.Rsrvd1= 0;
5540	pCtx->fpu.DS = 0;
5541	pCtx->fpu.Rsrvd2= 0;
5542	}
5543	else
5544	{
5545	pCtx->fpu.FPUIP = uPtr.pu32[3];
5546	pCtx->fpu.CS = uPtr.pu16[4*2];
5547	pCtx->fpu.Rsrvd1= 0;
5548	pCtx->fpu.FOP = uPtr.pu16[4*2+1];
5549	pCtx->fpu.FPUDP = uPtr.pu32[5];
5550	pCtx->fpu.DS = uPtr.pu16[6*2];
5551	pCtx->fpu.Rsrvd2= 0;
5552	}
5553	}
5554
5555	/* Make adjustments. */
5556	pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
5557	pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
5558	iemFpuRecalcExceptionStatus(pCtx);
5559	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
5560	* exceptions are pending after loading the saved state? */
5561	}
5562
5563
5564	/**
5565	* Implements 'FNSTENV'.
5566	*
5567	* @param enmEffOpSize The operand size (only REX.W really matters).
5568	* @param iEffSeg The effective segment register for @a GCPtrEff.
5569	* @param GCPtrEffDst The address of the image.
5570	*/
5571	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5572	{
5573	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5574	RTPTRUNION uPtr;
5575	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5576	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5577	if (rcStrict != VINF_SUCCESS)
5578	return rcStrict;
5579
5580	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5581
5582	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5583	if (rcStrict != VINF_SUCCESS)
5584	return rcStrict;
5585
5586	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5587	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5588	return VINF_SUCCESS;
5589	}
5590
5591
5592	/**
5593	* Implements 'FNSAVE'.
5594	*
5595	* @param GCPtrEffDst The address of the image.
5596	* @param enmEffOpSize The operand size.
5597	*/
5598	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5599	{
5600	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5601	RTPTRUNION uPtr;
5602	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5603	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5604	if (rcStrict != VINF_SUCCESS)
5605	return rcStrict;
5606
5607	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5608	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5609	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5610	{
5611	paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5612	paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5613	paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
5614	}
5615
5616	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
5617	if (rcStrict != VINF_SUCCESS)
5618	return rcStrict;
5619
5620	/*
5621	* Re-initialize the FPU.
5622	*/
5623	pCtx->fpu.FCW = 0x37f;
5624	pCtx->fpu.FSW = 0;
5625	pCtx->fpu.FTW = 0x00; /* 0 - empty */
5626	pCtx->fpu.FPUDP = 0;
5627	pCtx->fpu.DS = 0;
5628	pCtx->fpu.Rsrvd2= 0;
5629	pCtx->fpu.FPUIP = 0;
5630	pCtx->fpu.CS = 0;
5631	pCtx->fpu.Rsrvd1= 0;
5632	pCtx->fpu.FOP = 0;
5633
5634	iemHlpUsedFpu(pIemCpu);
5635	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5636	return VINF_SUCCESS;
5637	}
5638
5639
5640
5641	/**
5642	* Implements 'FLDENV'.
5643	*
5644	* @param enmEffOpSize The operand size (only REX.W really matters).
5645	* @param iEffSeg The effective segment register for @a GCPtrEff.
5646	* @param GCPtrEffSrc The address of the image.
5647	*/
5648	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5649	{
5650	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5651	RTCPTRUNION uPtr;
5652	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5653	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5654	if (rcStrict != VINF_SUCCESS)
5655	return rcStrict;
5656
5657	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5658
5659	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5660	if (rcStrict != VINF_SUCCESS)
5661	return rcStrict;
5662
5663	iemHlpUsedFpu(pIemCpu);
5664	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5665	return VINF_SUCCESS;
5666	}
5667
5668
5669	/**
5670	* Implements 'FRSTOR'.
5671	*
5672	* @param GCPtrEffSrc The address of the image.
5673	* @param enmEffOpSize The operand size.
5674	*/
5675	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5676	{
5677	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5678	RTCPTRUNION uPtr;
5679	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5680	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5681	if (rcStrict != VINF_SUCCESS)
5682	return rcStrict;
5683
5684	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5685	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5686	for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5687	{
5688	pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
5689	pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
5690	pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
5691	pCtx->fpu.aRegs[i].au32[3] = 0;
5692	}
5693
5694	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5695	if (rcStrict != VINF_SUCCESS)
5696	return rcStrict;
5697
5698	iemHlpUsedFpu(pIemCpu);
5699	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5700	return VINF_SUCCESS;
5701	}
5702
5703
5704	/**
5705	* Implements 'FLDCW'.
5706	*
5707	* @param u16Fcw The new FCW.
5708	*/
5709	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
5710	{
5711	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5712
5713	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
5714	/** @todo Testcase: Try see what happens when trying to set undefined bits
5715	* (other than 6 and 7). Currently ignoring them. */
5716	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
5717	* according to FSW. (This is was is currently implemented.) */
5718	pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
5719	iemFpuRecalcExceptionStatus(pCtx);
5720
5721	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5722	iemHlpUsedFpu(pIemCpu);
5723	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5724	return VINF_SUCCESS;
5725	}
5726
5727
5728
5729	/**
5730	* Implements the underflow case of fxch.
5731	*
5732	* @param iStReg The other stack register.
5733	*/
5734	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
5735	{
5736	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5737
5738	unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
5739	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5740	Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) \|\| !(RT_BIT(iReg2) & pCtx->fpu.FTW));
5741
5742	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
5743	* registers are read as QNaN and then exchanged. This could be
5744	* wrong... */
5745	if (pCtx->fpu.FCW & X86_FCW_IM)
5746	{
5747	if (RT_BIT(iReg1) & pCtx->fpu.FTW)
5748	{
5749	if (RT_BIT(iReg2) & pCtx->fpu.FTW)
5750	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5751	else
5752	pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
5753	iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
5754	}
5755	else
5756	{
5757	pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
5758	iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5759	}
5760	pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
5761	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
5762	}
5763	else
5764	{
5765	/* raise underflow exception, don't change anything. */
5766	pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
5767	pCtx->fpu.FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5768	}
5769
5770	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5771	iemHlpUsedFpu(pIemCpu);
5772	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5773	return VINF_SUCCESS;
5774	}
5775
5776
5777	/**
5778	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
5779	*
5780	* @param cToAdd 1 or 7.
5781	*/
5782	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
5783	{
5784	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5785	Assert(iStReg < 8);
5786
5787	/*
5788	* Raise exceptions.
5789	*/
5790	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
5791	return iemRaiseDeviceNotAvailable(pIemCpu);
5792	uint16_t u16Fsw = pCtx->fpu.FSW;
5793	if (u16Fsw & X86_FSW_ES)
5794	return iemRaiseMathFault(pIemCpu);
5795
5796	/*
5797	* Check if any of the register accesses causes #SF + #IA.
5798	*/
5799	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
5800	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5801	if ((pCtx->fpu.FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
5802	{
5803	uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
5804	pCtx->fpu.FSW &= ~X86_FSW_C1;
5805	pCtx->fpu.FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
5806	if ( !(u16Fsw & X86_FSW_IE)
5807	\|\| (pCtx->fpu.FCW & X86_FCW_IM) )
5808	{
5809	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5810	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5811	}
5812	}
5813	else if (pCtx->fpu.FCW & X86_FCW_IM)
5814	{
5815	/* Masked underflow. */
5816	pCtx->fpu.FSW &= ~X86_FSW_C1;
5817	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF;
5818	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
5819	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
5820	}
5821	else
5822	{
5823	/* Raise underflow - don't touch EFLAGS or TOP. */
5824	pCtx->fpu.FSW &= ~X86_FSW_C1;
5825	pCtx->fpu.FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
5826	fPop = false;
5827	}
5828
5829	/*
5830	* Pop if necessary.
5831	*/
5832	if (fPop)
5833	{
5834	pCtx->fpu.FTW &= ~RT_BIT(iReg1);
5835	pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
5836	pCtx->fpu.FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
5837	}
5838
5839	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5840	iemHlpUsedFpu(pIemCpu);
5841	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5842	return VINF_SUCCESS;
5843	}
5844
5845	/** @} */
5846

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 47764

Download in other formats: