IEMAllCImpl.cpp.h@ 61632

Last change on this file since 61632 was 61506, checked in by vboxsync, 8 years ago
Not yet.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 237.0 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 61506 2016-06-06 19:39:26Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/** @name Misc Helpers
19	* @{
20	*/
21
22
23	/**
24	* Worker function for iemHlpCheckPortIOPermission, don't call directly.
25	*
26	* @returns Strict VBox status code.
27	*
28	* @param pIemCpu The IEM per CPU data.
29	* @param pCtx The register context.
30	* @param u16Port The port number.
31	* @param cbOperand The operand size.
32	*/
33	static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34	{
35	/* The TSS bits we're interested in are the same on 386 and AMD64. */
36	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38	AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39	AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41	/*
42	* Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43	*/
44	Assert(!pCtx->tr.Attr.n.u1DescType);
45	if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46	&& pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47	{
48	Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49	u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50	return iemRaiseGeneralProtectionFault0(pIemCpu);
51	}
52
53	/*
54	* Read the bitmap offset (may #PF).
55	*/
56	uint16_t offBitmap;
57	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
58	pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59	if (rcStrict != VINF_SUCCESS)
60	{
61	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62	return rcStrict;
63	}
64
65	/*
66	* The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67	* describes the CPU actually reading two bytes regardless of whether the
68	* bit range crosses a byte boundrary. Thus the + 1 in the test below.
69	*/
70	uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71	/** @todo check if real CPUs ensures that offBitmap has a minimum value of
72	* for instance sizeof(X86TSS32). */
73	if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74	{
75	Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76	offFirstBit, pCtx->tr.u32Limit));
77	return iemRaiseGeneralProtectionFault0(pIemCpu);
78	}
79
80	/*
81	* Read the necessary bits.
82	*/
83	/** @todo Test the assertion in the intel manual that the CPU reads two
84	* bytes. The question is how this works wrt to #PF and #GP on the
85	* 2nd byte when it's not required. */
86	uint16_t bmBytes = UINT16_MAX;
87	rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88	if (rcStrict != VINF_SUCCESS)
89	{
90	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91	return rcStrict;
92	}
93
94	/*
95	* Perform the check.
96	*/
97	uint16_t fPortMask = (1 << cbOperand) - 1;
98	bmBytes >>= (u16Port & 7);
99	if (bmBytes & fPortMask)
100	{
101	Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102	u16Port, cbOperand, bmBytes, fPortMask));
103	return iemRaiseGeneralProtectionFault0(pIemCpu);
104	}
105
106	return VINF_SUCCESS;
107	}
108
109
110	/**
111	* Checks if we are allowed to access the given I/O port, raising the
112	* appropriate exceptions if we aren't (or if the I/O bitmap is not
113	* accessible).
114	*
115	* @returns Strict VBox status code.
116	*
117	* @param pIemCpu The IEM per CPU data.
118	* @param pCtx The register context.
119	* @param u16Port The port number.
120	* @param cbOperand The operand size.
121	*/
122	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123	{
124	X86EFLAGS Efl;
125	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
126	if ( (pCtx->cr0 & X86_CR0_PE)
127	&& ( pIemCpu->uCpl > Efl.Bits.u2IOPL
128	\|\| Efl.Bits.u1VM) )
129	return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
130	return VINF_SUCCESS;
131	}
132
133
134	#if 0
135	/**
136	* Calculates the parity bit.
137	*
138	* @returns true if the bit is set, false if not.
139	* @param u8Result The least significant byte of the result.
140	*/
141	static bool iemHlpCalcParityFlag(uint8_t u8Result)
142	{
143	/*
144	* Parity is set if the number of bits in the least significant byte of
145	* the result is even.
146	*/
147	uint8_t cBits;
148	cBits = u8Result & 1; /* 0 */
149	u8Result >>= 1;
150	cBits += u8Result & 1;
151	u8Result >>= 1;
152	cBits += u8Result & 1;
153	u8Result >>= 1;
154	cBits += u8Result & 1;
155	u8Result >>= 1;
156	cBits += u8Result & 1; /* 4 */
157	u8Result >>= 1;
158	cBits += u8Result & 1;
159	u8Result >>= 1;
160	cBits += u8Result & 1;
161	u8Result >>= 1;
162	cBits += u8Result & 1;
163	return !(cBits & 1);
164	}
165	#endif /* not used */
166
167
168	/**
169	* Updates the specified flags according to a 8-bit result.
170	*
171	* @param pIemCpu The IEM state of the calling EMT.
172	* @param u8Result The result to set the flags according to.
173	* @param fToUpdate The flags to update.
174	* @param fUndefined The flags that are specified as undefined.
175	*/
176	static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177	{
178	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
179
180	uint32_t fEFlags = pCtx->eflags.u;
181	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
183	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
184	#ifdef IEM_VERIFICATION_MODE_FULL
185	pIemCpu->fUndefinedEFlags \|= fUndefined;
186	#endif
187	}
188
189
190	/**
191	* Helper used by iret.
192	*
193	* @param uCpl The new CPL.
194	* @param pSReg Pointer to the segment register.
195	*/
196	static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
197	{
198	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
199	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
200	CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
201	#else
202	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
203	#endif
204
205	if ( uCpl > pSReg->Attr.n.u2Dpl
206	&& pSReg->Attr.n.u1DescType /* code or data, not system */
207	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
208	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
209	iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, 0);
210	}
211
212
213	/**
214	* Indicates that we have modified the FPU state.
215	*
216	* @param pIemCpu The IEM state of the calling EMT.
217	*/
218	DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
219	{
220	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
221	}
222
223	/** @} */
224
225	/** @name C Implementations
226	* @{
227	*/
228
229	/**
230	* Implements a 16-bit popa.
231	*/
232	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
233	{
234	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
235	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
236	RTGCPTR GCPtrLast = GCPtrStart + 15;
237	VBOXSTRICTRC rcStrict;
238
239	/*
240	* The docs are a bit hard to comprehend here, but it looks like we wrap
241	* around in real mode as long as none of the individual "popa" crosses the
242	* end of the stack segment. In protected mode we check the whole access
243	* in one go. For efficiency, only do the word-by-word thing if we're in
244	* danger of wrapping around.
245	*/
246	/** @todo do popa boundary / wrap-around checks. */
247	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
248	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
249	{
250	/* word-by-word */
251	RTUINT64U TmpRsp;
252	TmpRsp.u = pCtx->rsp;
253	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
254	if (rcStrict == VINF_SUCCESS)
255	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
256	if (rcStrict == VINF_SUCCESS)
257	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
258	if (rcStrict == VINF_SUCCESS)
259	{
260	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
261	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
262	}
263	if (rcStrict == VINF_SUCCESS)
264	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
265	if (rcStrict == VINF_SUCCESS)
266	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
267	if (rcStrict == VINF_SUCCESS)
268	rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
269	if (rcStrict == VINF_SUCCESS)
270	{
271	pCtx->rsp = TmpRsp.u;
272	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
273	}
274	}
275	else
276	{
277	uint16_t const *pa16Mem = NULL;
278	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
279	if (rcStrict == VINF_SUCCESS)
280	{
281	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
282	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
283	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
284	/* skip sp */
285	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
286	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
287	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
288	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
289	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
290	if (rcStrict == VINF_SUCCESS)
291	{
292	iemRegAddToRsp(pIemCpu, pCtx, 16);
293	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
294	}
295	}
296	}
297	return rcStrict;
298	}
299
300
301	/**
302	* Implements a 32-bit popa.
303	*/
304	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
305	{
306	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
307	RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
308	RTGCPTR GCPtrLast = GCPtrStart + 31;
309	VBOXSTRICTRC rcStrict;
310
311	/*
312	* The docs are a bit hard to comprehend here, but it looks like we wrap
313	* around in real mode as long as none of the individual "popa" crosses the
314	* end of the stack segment. In protected mode we check the whole access
315	* in one go. For efficiency, only do the word-by-word thing if we're in
316	* danger of wrapping around.
317	*/
318	/** @todo do popa boundary / wrap-around checks. */
319	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
320	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
321	{
322	/* word-by-word */
323	RTUINT64U TmpRsp;
324	TmpRsp.u = pCtx->rsp;
325	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
326	if (rcStrict == VINF_SUCCESS)
327	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
328	if (rcStrict == VINF_SUCCESS)
329	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
330	if (rcStrict == VINF_SUCCESS)
331	{
332	iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
333	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
334	}
335	if (rcStrict == VINF_SUCCESS)
336	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
337	if (rcStrict == VINF_SUCCESS)
338	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
339	if (rcStrict == VINF_SUCCESS)
340	rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
341	if (rcStrict == VINF_SUCCESS)
342	{
343	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
344	pCtx->rdi &= UINT32_MAX;
345	pCtx->rsi &= UINT32_MAX;
346	pCtx->rbp &= UINT32_MAX;
347	pCtx->rbx &= UINT32_MAX;
348	pCtx->rdx &= UINT32_MAX;
349	pCtx->rcx &= UINT32_MAX;
350	pCtx->rax &= UINT32_MAX;
351	#endif
352	pCtx->rsp = TmpRsp.u;
353	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
354	}
355	}
356	else
357	{
358	uint32_t const *pa32Mem;
359	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
360	if (rcStrict == VINF_SUCCESS)
361	{
362	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
363	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
364	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
365	/* skip esp */
366	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
367	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
368	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
369	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
370	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
371	if (rcStrict == VINF_SUCCESS)
372	{
373	iemRegAddToRsp(pIemCpu, pCtx, 32);
374	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
375	}
376	}
377	}
378	return rcStrict;
379	}
380
381
382	/**
383	* Implements a 16-bit pusha.
384	*/
385	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
386	{
387	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
388	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
389	RTGCPTR GCPtrBottom = GCPtrTop - 15;
390	VBOXSTRICTRC rcStrict;
391
392	/*
393	* The docs are a bit hard to comprehend here, but it looks like we wrap
394	* around in real mode as long as none of the individual "pushd" crosses the
395	* end of the stack segment. In protected mode we check the whole access
396	* in one go. For efficiency, only do the word-by-word thing if we're in
397	* danger of wrapping around.
398	*/
399	/** @todo do pusha boundary / wrap-around checks. */
400	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
401	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
402	{
403	/* word-by-word */
404	RTUINT64U TmpRsp;
405	TmpRsp.u = pCtx->rsp;
406	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
407	if (rcStrict == VINF_SUCCESS)
408	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
409	if (rcStrict == VINF_SUCCESS)
410	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
411	if (rcStrict == VINF_SUCCESS)
412	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
413	if (rcStrict == VINF_SUCCESS)
414	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
415	if (rcStrict == VINF_SUCCESS)
416	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
417	if (rcStrict == VINF_SUCCESS)
418	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
419	if (rcStrict == VINF_SUCCESS)
420	rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
421	if (rcStrict == VINF_SUCCESS)
422	{
423	pCtx->rsp = TmpRsp.u;
424	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
425	}
426	}
427	else
428	{
429	GCPtrBottom--;
430	uint16_t *pa16Mem = NULL;
431	rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
432	if (rcStrict == VINF_SUCCESS)
433	{
434	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
435	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
436	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
437	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
438	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
439	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
440	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
441	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
442	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
443	if (rcStrict == VINF_SUCCESS)
444	{
445	iemRegSubFromRsp(pIemCpu, pCtx, 16);
446	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
447	}
448	}
449	}
450	return rcStrict;
451	}
452
453
454	/**
455	* Implements a 32-bit pusha.
456	*/
457	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
458	{
459	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
460	RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
461	RTGCPTR GCPtrBottom = GCPtrTop - 31;
462	VBOXSTRICTRC rcStrict;
463
464	/*
465	* The docs are a bit hard to comprehend here, but it looks like we wrap
466	* around in real mode as long as none of the individual "pusha" crosses the
467	* end of the stack segment. In protected mode we check the whole access
468	* in one go. For efficiency, only do the word-by-word thing if we're in
469	* danger of wrapping around.
470	*/
471	/** @todo do pusha boundary / wrap-around checks. */
472	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
473	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
474	{
475	/* word-by-word */
476	RTUINT64U TmpRsp;
477	TmpRsp.u = pCtx->rsp;
478	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
479	if (rcStrict == VINF_SUCCESS)
480	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
481	if (rcStrict == VINF_SUCCESS)
482	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
483	if (rcStrict == VINF_SUCCESS)
484	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
485	if (rcStrict == VINF_SUCCESS)
486	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
487	if (rcStrict == VINF_SUCCESS)
488	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
489	if (rcStrict == VINF_SUCCESS)
490	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
491	if (rcStrict == VINF_SUCCESS)
492	rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
493	if (rcStrict == VINF_SUCCESS)
494	{
495	pCtx->rsp = TmpRsp.u;
496	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
497	}
498	}
499	else
500	{
501	GCPtrBottom--;
502	uint32_t *pa32Mem;
503	rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
504	if (rcStrict == VINF_SUCCESS)
505	{
506	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
507	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
508	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
509	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
510	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
511	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
512	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
513	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
514	rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
515	if (rcStrict == VINF_SUCCESS)
516	{
517	iemRegSubFromRsp(pIemCpu, pCtx, 32);
518	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
519	}
520	}
521	}
522	return rcStrict;
523	}
524
525
526	/**
527	* Implements pushf.
528	*
529	*
530	* @param enmEffOpSize The effective operand size.
531	*/
532	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
533	{
534	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
535
536	/*
537	* If we're in V8086 mode some care is required (which is why we're in
538	* doing this in a C implementation).
539	*/
540	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
541	if ( (fEfl & X86_EFL_VM)
542	&& X86_EFL_GET_IOPL(fEfl) != 3 )
543	{
544	Assert(pCtx->cr0 & X86_CR0_PE);
545	if ( enmEffOpSize != IEMMODE_16BIT
546	\|\| !(pCtx->cr4 & X86_CR4_VME))
547	return iemRaiseGeneralProtectionFault0(pIemCpu);
548	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
549	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
550	return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
551	}
552
553	/*
554	* Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
555	*/
556	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
557
558	VBOXSTRICTRC rcStrict;
559	switch (enmEffOpSize)
560	{
561	case IEMMODE_16BIT:
562	AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
563	if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_186)
564	fEfl \|= UINT16_C(0xf000);
565	rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
566	break;
567	case IEMMODE_32BIT:
568	rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
569	break;
570	case IEMMODE_64BIT:
571	rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
572	break;
573	IEM_NOT_REACHED_DEFAULT_CASE_RET();
574	}
575	if (rcStrict != VINF_SUCCESS)
576	return rcStrict;
577
578	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
579	return VINF_SUCCESS;
580	}
581
582
583	/**
584	* Implements popf.
585	*
586	* @param enmEffOpSize The effective operand size.
587	*/
588	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
589	{
590	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
591	uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
592	VBOXSTRICTRC rcStrict;
593	uint32_t fEflNew;
594
595	/*
596	* V8086 is special as usual.
597	*/
598	if (fEflOld & X86_EFL_VM)
599	{
600	/*
601	* Almost anything goes if IOPL is 3.
602	*/
603	if (X86_EFL_GET_IOPL(fEflOld) == 3)
604	{
605	switch (enmEffOpSize)
606	{
607	case IEMMODE_16BIT:
608	{
609	uint16_t u16Value;
610	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
611	if (rcStrict != VINF_SUCCESS)
612	return rcStrict;
613	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
614	break;
615	}
616	case IEMMODE_32BIT:
617	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
618	if (rcStrict != VINF_SUCCESS)
619	return rcStrict;
620	break;
621	IEM_NOT_REACHED_DEFAULT_CASE_RET();
622	}
623
624	const uint32_t fPopfBits = IEMCPU_TO_VM(pIemCpu)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
625	? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
626	fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
627	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
628	}
629	/*
630	* Interrupt flag virtualization with CR4.VME=1.
631	*/
632	else if ( enmEffOpSize == IEMMODE_16BIT
633	&& (pCtx->cr4 & X86_CR4_VME) )
634	{
635	uint16_t u16Value;
636	RTUINT64U TmpRsp;
637	TmpRsp.u = pCtx->rsp;
638	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
639	if (rcStrict != VINF_SUCCESS)
640	return rcStrict;
641
642	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
643	* or before? */
644	if ( ( (u16Value & X86_EFL_IF)
645	&& (fEflOld & X86_EFL_VIP))
646	\|\| (u16Value & X86_EFL_TF) )
647	return iemRaiseGeneralProtectionFault0(pIemCpu);
648
649	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
650	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
651	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
652	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
653
654	pCtx->rsp = TmpRsp.u;
655	}
656	else
657	return iemRaiseGeneralProtectionFault0(pIemCpu);
658
659	}
660	/*
661	* Not in V8086 mode.
662	*/
663	else
664	{
665	/* Pop the flags. */
666	switch (enmEffOpSize)
667	{
668	case IEMMODE_16BIT:
669	{
670	uint16_t u16Value;
671	rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
672	if (rcStrict != VINF_SUCCESS)
673	return rcStrict;
674	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
675
676	/*
677	* Ancient CPU adjustments:
678	* - 8086, 80186, V20/30:
679	* Fixed bits 15:12 bits are not kept correctly internally, mostly for
680	* practical reasons (masking below). We add them when pushing flags.
681	* - 80286:
682	* The NT and IOPL flags cannot be popped from real mode and are
683	* therefore always zero (since a 286 can never exit from PM and
684	* their initial value is zero). This changed on a 386 and can
685	* therefore be used to detect 286 or 386 CPU in real mode.
686	*/
687	if ( IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_286
688	&& !(pCtx->cr0 & X86_CR0_PE) )
689	fEflNew &= ~(X86_EFL_NT \| X86_EFL_IOPL);
690	break;
691	}
692	case IEMMODE_32BIT:
693	rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
694	if (rcStrict != VINF_SUCCESS)
695	return rcStrict;
696	break;
697	case IEMMODE_64BIT:
698	{
699	uint64_t u64Value;
700	rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
701	if (rcStrict != VINF_SUCCESS)
702	return rcStrict;
703	fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
704	break;
705	}
706	IEM_NOT_REACHED_DEFAULT_CASE_RET();
707	}
708
709	/* Merge them with the current flags. */
710	const uint32_t fPopfBits = IEMCPU_TO_VM(pIemCpu)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
711	? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
712	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
713	\|\| pIemCpu->uCpl == 0)
714	{
715	fEflNew &= fPopfBits;
716	fEflNew \|= ~fPopfBits & fEflOld;
717	}
718	else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
719	{
720	fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
721	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
722	}
723	else
724	{
725	fEflNew &= fPopfBits & ~(X86_EFL_IOPL \| X86_EFL_IF);
726	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
727	}
728	}
729
730	/*
731	* Commit the flags.
732	*/
733	Assert(fEflNew & RT_BIT_32(1));
734	IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
735	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
736
737	return VINF_SUCCESS;
738	}
739
740
741	/**
742	* Implements an indirect call.
743	*
744	* @param uNewPC The new program counter (RIP) value (loaded from the
745	* operand).
746	* @param enmEffOpSize The effective operand size.
747	*/
748	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
749	{
750	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
751	uint16_t uOldPC = pCtx->ip + cbInstr;
752	if (uNewPC > pCtx->cs.u32Limit)
753	return iemRaiseGeneralProtectionFault0(pIemCpu);
754
755	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
756	if (rcStrict != VINF_SUCCESS)
757	return rcStrict;
758
759	pCtx->rip = uNewPC;
760	pCtx->eflags.Bits.u1RF = 0;
761	return VINF_SUCCESS;
762	}
763
764
765	/**
766	* Implements a 16-bit relative call.
767	*
768	* @param offDisp The displacment offset.
769	*/
770	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
771	{
772	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
773	uint16_t uOldPC = pCtx->ip + cbInstr;
774	uint16_t uNewPC = uOldPC + offDisp;
775	if (uNewPC > pCtx->cs.u32Limit)
776	return iemRaiseGeneralProtectionFault0(pIemCpu);
777
778	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
779	if (rcStrict != VINF_SUCCESS)
780	return rcStrict;
781
782	pCtx->rip = uNewPC;
783	pCtx->eflags.Bits.u1RF = 0;
784	return VINF_SUCCESS;
785	}
786
787
788	/**
789	* Implements a 32-bit indirect call.
790	*
791	* @param uNewPC The new program counter (RIP) value (loaded from the
792	* operand).
793	* @param enmEffOpSize The effective operand size.
794	*/
795	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
796	{
797	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
798	uint32_t uOldPC = pCtx->eip + cbInstr;
799	if (uNewPC > pCtx->cs.u32Limit)
800	return iemRaiseGeneralProtectionFault0(pIemCpu);
801
802	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
803	if (rcStrict != VINF_SUCCESS)
804	return rcStrict;
805
806	#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
807	/*
808	* CASM hook for recording interesting indirect calls.
809	*/
810	if ( !pCtx->eflags.Bits.u1IF
811	&& (pCtx->cr0 & X86_CR0_PG)
812	&& !CSAMIsEnabled(IEMCPU_TO_VM(pIemCpu))
813	&& pIemCpu->uCpl == 0)
814	{
815	EMSTATE enmState = EMGetState(IEMCPU_TO_VMCPU(pIemCpu));
816	if ( enmState == EMSTATE_IEM_THEN_REM
817	\|\| enmState == EMSTATE_IEM
818	\|\| enmState == EMSTATE_REM)
819	CSAMR3RecordCallAddress(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
820	}
821	#endif
822
823	pCtx->rip = uNewPC;
824	pCtx->eflags.Bits.u1RF = 0;
825	return VINF_SUCCESS;
826	}
827
828
829	/**
830	* Implements a 32-bit relative call.
831	*
832	* @param offDisp The displacment offset.
833	*/
834	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
835	{
836	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
837	uint32_t uOldPC = pCtx->eip + cbInstr;
838	uint32_t uNewPC = uOldPC + offDisp;
839	if (uNewPC > pCtx->cs.u32Limit)
840	return iemRaiseGeneralProtectionFault0(pIemCpu);
841
842	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
843	if (rcStrict != VINF_SUCCESS)
844	return rcStrict;
845
846	pCtx->rip = uNewPC;
847	pCtx->eflags.Bits.u1RF = 0;
848	return VINF_SUCCESS;
849	}
850
851
852	/**
853	* Implements a 64-bit indirect call.
854	*
855	* @param uNewPC The new program counter (RIP) value (loaded from the
856	* operand).
857	* @param enmEffOpSize The effective operand size.
858	*/
859	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
860	{
861	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
862	uint64_t uOldPC = pCtx->rip + cbInstr;
863	if (!IEM_IS_CANONICAL(uNewPC))
864	return iemRaiseGeneralProtectionFault0(pIemCpu);
865
866	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
867	if (rcStrict != VINF_SUCCESS)
868	return rcStrict;
869
870	pCtx->rip = uNewPC;
871	pCtx->eflags.Bits.u1RF = 0;
872	return VINF_SUCCESS;
873	}
874
875
876	/**
877	* Implements a 64-bit relative call.
878	*
879	* @param offDisp The displacment offset.
880	*/
881	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
882	{
883	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
884	uint64_t uOldPC = pCtx->rip + cbInstr;
885	uint64_t uNewPC = uOldPC + offDisp;
886	if (!IEM_IS_CANONICAL(uNewPC))
887	return iemRaiseNotCanonical(pIemCpu);
888
889	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
890	if (rcStrict != VINF_SUCCESS)
891	return rcStrict;
892
893	pCtx->rip = uNewPC;
894	pCtx->eflags.Bits.u1RF = 0;
895	return VINF_SUCCESS;
896	}
897
898
899	/**
900	* Implements far jumps and calls thru task segments (TSS).
901	*
902	* @param uSel The selector.
903	* @param enmBranch The kind of branching we're performing.
904	* @param enmEffOpSize The effective operand size.
905	* @param pDesc The descriptor corresponding to @a uSel. The type is
906	* task gate.
907	*/
908	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
909	{
910	#ifndef IEM_IMPLEMENTS_TASKSWITCH
911	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
912	#else
913	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
914	Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
915	\|\| pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
916
917	if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
918	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
919	{
920	Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
921	pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
922	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
923	}
924
925	/** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
926	* far calls (see iemCImpl_callf). Most likely in both cases it should be
927	* checked here, need testcases. */
928	if (!pDesc->Legacy.Gen.u1Present)
929	{
930	Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
931	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
932	}
933
934	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
935	uint32_t uNextEip = pCtx->eip + cbInstr;
936	return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
937	uNextEip, 0 /* fFlags /, 0 / uErr /, 0 / uCr2 */, uSel, pDesc);
938	#endif
939	}
940
941
942	/**
943	* Implements far jumps and calls thru task gates.
944	*
945	* @param uSel The selector.
946	* @param enmBranch The kind of branching we're performing.
947	* @param enmEffOpSize The effective operand size.
948	* @param pDesc The descriptor corresponding to @a uSel. The type is
949	* task gate.
950	*/
951	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
952	{
953	#ifndef IEM_IMPLEMENTS_TASKSWITCH
954	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
955	#else
956	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
957
958	if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
959	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
960	{
961	Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
962	pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
963	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
964	}
965
966	/** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
967	* far calls (see iemCImpl_callf). Most likely in both cases it should be
968	* checked here, need testcases. */
969	if (!pDesc->Legacy.Gen.u1Present)
970	{
971	Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
972	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
973	}
974
975	/*
976	* Fetch the new TSS descriptor from the GDT.
977	*/
978	RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
979	if (uSelTss & X86_SEL_LDT)
980	{
981	Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
982	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
983	}
984
985	IEMSELDESC TssDesc;
986	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelTss, X86_XCPT_GP);
987	if (rcStrict != VINF_SUCCESS)
988	return rcStrict;
989
990	if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
991	{
992	Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
993	TssDesc.Legacy.Gate.u4Type));
994	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
995	}
996
997	if (!TssDesc.Legacy.Gate.u1Present)
998	{
999	Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1000	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1001	}
1002
1003	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1004	uint32_t uNextEip = pCtx->eip + cbInstr;
1005	return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1006	uNextEip, 0 /* fFlags /, 0 / uErr /, 0 / uCr2 */, uSelTss, &TssDesc);
1007	#endif
1008	}
1009
1010
1011	/**
1012	* Implements far jumps and calls thru call gates.
1013	*
1014	* @param uSel The selector.
1015	* @param enmBranch The kind of branching we're performing.
1016	* @param enmEffOpSize The effective operand size.
1017	* @param pDesc The descriptor corresponding to @a uSel. The type is
1018	* call gate.
1019	*/
1020	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1021	{
1022	#ifndef IEM_IMPLEMENTS_CALLGATE
1023	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1024	#else
1025	/* NB: Far jumps can only do intra-privilege transfers. Far calls support
1026	* inter-privilege calls and are much more complex.
1027	*
1028	* NB: 64-bit call gate has the same type as a 32-bit call gate! If
1029	* EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1030	* must be 16-bit or 32-bit.
1031	*/
1032	/** @todo: effective operand size is probably irrelevant here, only the
1033	* call gate bitness matters??
1034	*/
1035	VBOXSTRICTRC rcStrict;
1036	RTPTRUNION uPtrRet;
1037	uint64_t uNewRsp;
1038	uint64_t uNewRip;
1039	uint64_t u64Base;
1040	uint32_t cbLimit;
1041	RTSEL uNewCS;
1042	IEMSELDESC DescCS;
1043	PCPUMCTX pCtx;
1044
1045	AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1046	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
1047	Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1048	\|\| pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1049
1050	/* Determine the new instruction pointer from the gate descriptor. */
1051	uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1052	\| ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1053	\| ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1054
1055	/* Perform DPL checks on the gate descriptor. */
1056	if ( pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
1057	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1058	{
1059	Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1060	pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
1061	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1062	}
1063
1064	/** @todo does this catch NULL selectors, too? */
1065	if (!pDesc->Legacy.Gen.u1Present)
1066	{
1067	Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1068	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1069	}
1070
1071	/*
1072	* Fetch the target CS descriptor from the GDT or LDT.
1073	*/
1074	uNewCS = pDesc->Legacy.Gate.u16Sel;
1075	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS, X86_XCPT_GP);
1076	if (rcStrict != VINF_SUCCESS)
1077	return rcStrict;
1078
1079	/* Target CS must be a code selector. */
1080	if ( !DescCS.Legacy.Gen.u1DescType
1081	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1082	{
1083	Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1084	uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1085	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1086	}
1087
1088	/* Privilege checks on target CS. */
1089	if (enmBranch == IEMBRANCH_JUMP)
1090	{
1091	if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1092	{
1093	if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
1094	{
1095	Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1096	uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1097	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1098	}
1099	}
1100	else
1101	{
1102	if (DescCS.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
1103	{
1104	Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1105	uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1106	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1107	}
1108	}
1109	}
1110	else
1111	{
1112	Assert(enmBranch == IEMBRANCH_CALL);
1113	if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
1114	{
1115	Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1116	uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1117	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1118	}
1119	}
1120
1121	/* Additional long mode checks. */
1122	if (IEM_IS_LONG_MODE(pIemCpu))
1123	{
1124	if (!DescCS.Legacy.Gen.u1Long)
1125	{
1126	Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1127	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1128	}
1129
1130	/* L vs D. */
1131	if ( DescCS.Legacy.Gen.u1Long
1132	&& DescCS.Legacy.Gen.u1DefBig)
1133	{
1134	Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1135	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1136	}
1137	}
1138
1139	if (!DescCS.Legacy.Gate.u1Present)
1140	{
1141	Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1142	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCS);
1143	}
1144
1145	pCtx = pIemCpu->CTX_SUFF(pCtx);
1146
1147	if (enmBranch == IEMBRANCH_JUMP)
1148	{
1149	/** @todo: This is very similar to regular far jumps; merge! */
1150	/* Jumps are fairly simple... */
1151
1152	/* Chop the high bits off if 16-bit gate (Intel says so). */
1153	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1154	uNewRip = (uint16_t)uNewRip;
1155
1156	/* Limit check for non-long segments. */
1157	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1158	if (DescCS.Legacy.Gen.u1Long)
1159	u64Base = 0;
1160	else
1161	{
1162	if (uNewRip > cbLimit)
1163	{
1164	Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1165	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1166	}
1167	u64Base = X86DESC_BASE(&DescCS.Legacy);
1168	}
1169
1170	/* Canonical address check. */
1171	if (!IEM_IS_CANONICAL(uNewRip))
1172	{
1173	Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1174	return iemRaiseNotCanonical(pIemCpu);
1175	}
1176
1177	/*
1178	* Ok, everything checked out fine. Now set the accessed bit before
1179	* committing the result into CS, CSHID and RIP.
1180	*/
1181	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1182	{
1183	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1184	if (rcStrict != VINF_SUCCESS)
1185	return rcStrict;
1186	/** @todo check what VT-x and AMD-V does. */
1187	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1188	}
1189
1190	/* commit */
1191	pCtx->rip = uNewRip;
1192	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1193	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1194	pCtx->cs.ValidSel = pCtx->cs.Sel;
1195	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1196	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1197	pCtx->cs.u32Limit = cbLimit;
1198	pCtx->cs.u64Base = u64Base;
1199	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
1200	}
1201	else
1202	{
1203	Assert(enmBranch == IEMBRANCH_CALL);
1204	/* Calls are much more complicated. */
1205
1206	if (DescCS.Legacy.Gen.u2Dpl < pIemCpu->uCpl)
1207	{
1208	uint16_t offNewStack; /* Offset of new stack in TSS. */
1209	uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1210	uint8_t uNewCSDpl;
1211	uint8_t cbWords;
1212	RTSEL uNewSS;
1213	RTSEL uOldSS;
1214	uint64_t uOldRsp;
1215	IEMSELDESC DescSS;
1216	RTPTRUNION uPtrTSS;
1217	RTGCPTR GCPtrTSS;
1218	RTPTRUNION uPtrParmWds;
1219	RTGCPTR GCPtrParmWds;
1220
1221	/* More privilege. This is the fun part. */
1222	Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1223
1224	/*
1225	* Determine new SS:rSP from the TSS.
1226	*/
1227	Assert(!pCtx->tr.Attr.n.u1DescType);
1228
1229	/* Figure out where the new stack pointer is stored in the TSS. */
1230	uNewCSDpl = uNewCS & X86_SEL_RPL;
1231	if (!IEM_IS_LONG_MODE(pIemCpu))
1232	{
1233	if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1234	{
1235	offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1236	cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1237	}
1238	else
1239	{
1240	Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1241	offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1242	cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1243	}
1244	}
1245	else
1246	{
1247	Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1248	offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1249	cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1250	}
1251
1252	/* Check against TSS limit. */
1253	if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1254	{
1255	Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1256	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, pCtx->tr.Sel);
1257	}
1258
1259	GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1260	rcStrict = iemMemMap(pIemCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1261	if (rcStrict != VINF_SUCCESS)
1262	{
1263	Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1264	return rcStrict;
1265	}
1266
1267	if (!IEM_IS_LONG_MODE(pIemCpu))
1268	{
1269	if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1270	{
1271	uNewRsp = uPtrTSS.pu32[0];
1272	uNewSS = uPtrTSS.pu16[2];
1273	}
1274	else
1275	{
1276	Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1277	uNewRsp = uPtrTSS.pu16[0];
1278	uNewSS = uPtrTSS.pu16[1];
1279	}
1280	}
1281	else
1282	{
1283	Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1284	/* SS will be a NULL selector, but that's valid. */
1285	uNewRsp = uPtrTSS.pu64[0];
1286	uNewSS = uNewCSDpl;
1287	}
1288
1289	/* Done with the TSS now. */
1290	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1291	if (rcStrict != VINF_SUCCESS)
1292	{
1293	Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1294	return rcStrict;
1295	}
1296
1297	/* Only used outside of long mode. */
1298	cbWords = pDesc->Legacy.Gate.u4ParmCount;
1299
1300	/* If EFER.LMA is 0, there's extra work to do. */
1301	if (!IEM_IS_LONG_MODE(pIemCpu))
1302	{
1303	if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1304	{
1305	Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1306	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1307	}
1308
1309	/* Grab the new SS descriptor. */
1310	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
1311	if (rcStrict != VINF_SUCCESS)
1312	return rcStrict;
1313
1314	/* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1315	if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1316	\|\| (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1317	{
1318	Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1319	uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1320	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1321	}
1322
1323	/* Ensure new SS is a writable data segment. */
1324	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1325	{
1326	Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1327	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
1328	}
1329
1330	if (!DescSS.Legacy.Gen.u1Present)
1331	{
1332	Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1333	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
1334	}
1335	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1336	cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1337	else
1338	cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1339	}
1340	else
1341	{
1342	/* Just grab the new (NULL) SS descriptor. */
1343	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
1344	if (rcStrict != VINF_SUCCESS)
1345	return rcStrict;
1346
1347	cbNewStack = sizeof(uint64_t) * 4;
1348	}
1349
1350	/** @todo: According to Intel, new stack is checked for enough space first,
1351	* then switched. According to AMD, the stack is switched first and
1352	* then pushes might fault!
1353	*/
1354
1355	/** @todo: According to AMD, CS is loaded first, then SS.
1356	* According to Intel, it's the other way around!?
1357	*/
1358
1359	/** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1360
1361	/* Set the accessed bit before committing new SS. */
1362	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1363	{
1364	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
1365	if (rcStrict != VINF_SUCCESS)
1366	return rcStrict;
1367	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1368	}
1369
1370	/* Remember the old SS:rSP and their linear address. */
1371	uOldSS = pCtx->ss.Sel;
1372	uOldRsp = pCtx->rsp;
1373
1374	GCPtrParmWds = pCtx->ss.u64Base + pCtx->rsp;
1375
1376	/* Commit new SS:rSP. */
1377	pCtx->ss.Sel = uNewSS;
1378	pCtx->ss.ValidSel = uNewSS;
1379	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1380	pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1381	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1382	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1383	pCtx->rsp = uNewRsp;
1384	pIemCpu->uCpl = uNewCSDpl;
1385	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->ss));
1386	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
1387
1388	/* Check new stack - may #SS(NewSS). */
1389	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, cbNewStack,
1390	&uPtrRet.pv, &uNewRsp);
1391	if (rcStrict != VINF_SUCCESS)
1392	{
1393	Log(("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1394	return rcStrict;
1395	}
1396
1397	if (!IEM_IS_LONG_MODE(pIemCpu))
1398	{
1399	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1400	{
1401	/* Push the old CS:rIP. */
1402	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1403	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1404
1405	/* Map the relevant chunk of the old stack. */
1406	rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1407	if (rcStrict != VINF_SUCCESS)
1408	{
1409	Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1410	return rcStrict;
1411	}
1412
1413	/* Copy the parameter (d)words. */
1414	for (int i = 0; i < cbWords; ++i)
1415	uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1416
1417	/* Unmap the old stack. */
1418	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1419	if (rcStrict != VINF_SUCCESS)
1420	{
1421	Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1422	return rcStrict;
1423	}
1424
1425	/* Push the old SS:rSP. */
1426	uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1427	uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1428	}
1429	else
1430	{
1431	Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1432
1433	/* Push the old CS:rIP. */
1434	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1435	uPtrRet.pu16[1] = pCtx->cs.Sel;
1436
1437	/* Map the relevant chunk of the old stack. */
1438	rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1439	if (rcStrict != VINF_SUCCESS)
1440	{
1441	Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1442	return rcStrict;
1443	}
1444
1445	/* Copy the parameter words. */
1446	for (int i = 0; i < cbWords; ++i)
1447	uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1448
1449	/* Unmap the old stack. */
1450	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1451	if (rcStrict != VINF_SUCCESS)
1452	{
1453	Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1454	return rcStrict;
1455	}
1456
1457	/* Push the old SS:rSP. */
1458	uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1459	uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1460	}
1461	}
1462	else
1463	{
1464	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1465
1466	/* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1467	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1468	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1469	uPtrRet.pu64[2] = uOldRsp;
1470	uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1471	}
1472
1473	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1474	if (rcStrict != VINF_SUCCESS)
1475	{
1476	Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1477	return rcStrict;
1478	}
1479
1480	/* Chop the high bits off if 16-bit gate (Intel says so). */
1481	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1482	uNewRip = (uint16_t)uNewRip;
1483
1484	/* Limit / canonical check. */
1485	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1486	if (!IEM_IS_LONG_MODE(pIemCpu))
1487	{
1488	if (uNewRip > cbLimit)
1489	{
1490	Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1491	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1492	}
1493	u64Base = X86DESC_BASE(&DescCS.Legacy);
1494	}
1495	else
1496	{
1497	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1498	if (!IEM_IS_CANONICAL(uNewRip))
1499	{
1500	Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1501	return iemRaiseNotCanonical(pIemCpu);
1502	}
1503	u64Base = 0;
1504	}
1505
1506	/*
1507	* Now set the accessed bit before
1508	* writing the return address to the stack and committing the result into
1509	* CS, CSHID and RIP.
1510	*/
1511	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1512	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1513	{
1514	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1515	if (rcStrict != VINF_SUCCESS)
1516	return rcStrict;
1517	/** @todo check what VT-x and AMD-V does. */
1518	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1519	}
1520
1521	/* Commit new CS:rIP. */
1522	pCtx->rip = uNewRip;
1523	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1524	pCtx->cs.Sel \|= pIemCpu->uCpl;
1525	pCtx->cs.ValidSel = pCtx->cs.Sel;
1526	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1527	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1528	pCtx->cs.u32Limit = cbLimit;
1529	pCtx->cs.u64Base = u64Base;
1530	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
1531	}
1532	else
1533	{
1534	/* Same privilege. */
1535	/** @todo: This is very similar to regular far calls; merge! */
1536
1537	/* Check stack first - may #SS(0). */
1538	/** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1539	* 16-bit code cause a two or four byte CS to be pushed? */
1540	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1541	IEM_IS_LONG_MODE(pIemCpu) ? 8+8
1542	: pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1543	&uPtrRet.pv, &uNewRsp);
1544	if (rcStrict != VINF_SUCCESS)
1545	return rcStrict;
1546
1547	/* Chop the high bits off if 16-bit gate (Intel says so). */
1548	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1549	uNewRip = (uint16_t)uNewRip;
1550
1551	/* Limit / canonical check. */
1552	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1553	if (!IEM_IS_LONG_MODE(pIemCpu))
1554	{
1555	if (uNewRip > cbLimit)
1556	{
1557	Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1558	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
1559	}
1560	u64Base = X86DESC_BASE(&DescCS.Legacy);
1561	}
1562	else
1563	{
1564	if (!IEM_IS_CANONICAL(uNewRip))
1565	{
1566	Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1567	return iemRaiseNotCanonical(pIemCpu);
1568	}
1569	u64Base = 0;
1570	}
1571
1572	/*
1573	* Now set the accessed bit before
1574	* writing the return address to the stack and committing the result into
1575	* CS, CSHID and RIP.
1576	*/
1577	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1578	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1579	{
1580	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1581	if (rcStrict != VINF_SUCCESS)
1582	return rcStrict;
1583	/** @todo check what VT-x and AMD-V does. */
1584	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1585	}
1586
1587	/* stack */
1588	if (!IEM_IS_LONG_MODE(pIemCpu))
1589	{
1590	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1591	{
1592	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1593	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1594	}
1595	else
1596	{
1597	Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1598	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1599	uPtrRet.pu16[1] = pCtx->cs.Sel;
1600	}
1601	}
1602	else
1603	{
1604	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1605	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1606	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1607	}
1608
1609	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1610	if (rcStrict != VINF_SUCCESS)
1611	return rcStrict;
1612
1613	/* commit */
1614	pCtx->rip = uNewRip;
1615	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1616	pCtx->cs.Sel \|= pIemCpu->uCpl;
1617	pCtx->cs.ValidSel = pCtx->cs.Sel;
1618	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1619	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1620	pCtx->cs.u32Limit = cbLimit;
1621	pCtx->cs.u64Base = u64Base;
1622	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
1623	}
1624	}
1625	pCtx->eflags.Bits.u1RF = 0;
1626	return VINF_SUCCESS;
1627	#endif
1628	}
1629
1630
1631	/**
1632	* Implements far jumps and calls thru system selectors.
1633	*
1634	* @param uSel The selector.
1635	* @param enmBranch The kind of branching we're performing.
1636	* @param enmEffOpSize The effective operand size.
1637	* @param pDesc The descriptor corresponding to @a uSel.
1638	*/
1639	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1640	{
1641	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
1642	Assert((uSel & X86_SEL_MASK_OFF_RPL));
1643
1644	if (IEM_IS_LONG_MODE(pIemCpu))
1645	switch (pDesc->Legacy.Gen.u4Type)
1646	{
1647	case AMD64_SEL_TYPE_SYS_CALL_GATE:
1648	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1649
1650	default:
1651	case AMD64_SEL_TYPE_SYS_LDT:
1652	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1653	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1654	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1655	case AMD64_SEL_TYPE_SYS_INT_GATE:
1656	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1657	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1658	}
1659
1660	switch (pDesc->Legacy.Gen.u4Type)
1661	{
1662	case X86_SEL_TYPE_SYS_286_CALL_GATE:
1663	case X86_SEL_TYPE_SYS_386_CALL_GATE:
1664	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1665
1666	case X86_SEL_TYPE_SYS_TASK_GATE:
1667	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1668
1669	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1670	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1671	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1672
1673	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1674	Log(("branch %04x -> busy 286 TSS\n", uSel));
1675	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1676
1677	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1678	Log(("branch %04x -> busy 386 TSS\n", uSel));
1679	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1680
1681	default:
1682	case X86_SEL_TYPE_SYS_LDT:
1683	case X86_SEL_TYPE_SYS_286_INT_GATE:
1684	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1685	case X86_SEL_TYPE_SYS_386_INT_GATE:
1686	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1687	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1688	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1689	}
1690	}
1691
1692
1693	/**
1694	* Implements far jumps.
1695	*
1696	* @param uSel The selector.
1697	* @param offSeg The segment offset.
1698	* @param enmEffOpSize The effective operand size.
1699	*/
1700	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1701	{
1702	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1703	NOREF(cbInstr);
1704	Assert(offSeg <= UINT32_MAX);
1705
1706	/*
1707	* Real mode and V8086 mode are easy. The only snag seems to be that
1708	* CS.limit doesn't change and the limit check is done against the current
1709	* limit.
1710	*/
1711	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1712	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1713	{
1714	if (offSeg > pCtx->cs.u32Limit)
1715	{
1716	Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1717	return iemRaiseGeneralProtectionFault0(pIemCpu);
1718	}
1719
1720	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1721	pCtx->rip = offSeg;
1722	else
1723	pCtx->rip = offSeg & UINT16_MAX;
1724	pCtx->cs.Sel = uSel;
1725	pCtx->cs.ValidSel = uSel;
1726	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1727	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1728	pCtx->eflags.Bits.u1RF = 0;
1729	return VINF_SUCCESS;
1730	}
1731
1732	/*
1733	* Protected mode. Need to parse the specified descriptor...
1734	*/
1735	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1736	{
1737	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1738	return iemRaiseGeneralProtectionFault0(pIemCpu);
1739	}
1740
1741	/* Fetch the descriptor. */
1742	IEMSELDESC Desc;
1743	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1744	if (rcStrict != VINF_SUCCESS)
1745	return rcStrict;
1746
1747	/* Is it there? */
1748	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1749	{
1750	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1751	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1752	}
1753
1754	/*
1755	* Deal with it according to its type. We do the standard code selectors
1756	* here and dispatch the system selectors to worker functions.
1757	*/
1758	if (!Desc.Legacy.Gen.u1DescType)
1759	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1760
1761	/* Only code segments. */
1762	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1763	{
1764	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1765	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1766	}
1767
1768	/* L vs D. */
1769	if ( Desc.Legacy.Gen.u1Long
1770	&& Desc.Legacy.Gen.u1DefBig
1771	&& IEM_IS_LONG_MODE(pIemCpu))
1772	{
1773	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1774	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1775	}
1776
1777	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1778	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1779	{
1780	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1781	{
1782	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1783	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1784	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1785	}
1786	}
1787	else
1788	{
1789	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1790	{
1791	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1792	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1793	}
1794	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1795	{
1796	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1797	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1798	}
1799	}
1800
1801	/* Chop the high bits if 16-bit (Intel says so). */
1802	if (enmEffOpSize == IEMMODE_16BIT)
1803	offSeg &= UINT16_MAX;
1804
1805	/* Limit check. (Should alternatively check for non-canonical addresses
1806	here, but that is ruled out by offSeg being 32-bit, right?) */
1807	uint64_t u64Base;
1808	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1809	if (Desc.Legacy.Gen.u1Long)
1810	u64Base = 0;
1811	else
1812	{
1813	if (offSeg > cbLimit)
1814	{
1815	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1816	/** @todo: Intel says this is #GP(0)! */
1817	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1818	}
1819	u64Base = X86DESC_BASE(&Desc.Legacy);
1820	}
1821
1822	/*
1823	* Ok, everything checked out fine. Now set the accessed bit before
1824	* committing the result into CS, CSHID and RIP.
1825	*/
1826	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1827	{
1828	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1829	if (rcStrict != VINF_SUCCESS)
1830	return rcStrict;
1831	/** @todo check what VT-x and AMD-V does. */
1832	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1833	}
1834
1835	/* commit */
1836	pCtx->rip = offSeg;
1837	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1838	pCtx->cs.Sel \|= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1839	pCtx->cs.ValidSel = pCtx->cs.Sel;
1840	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1841	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1842	pCtx->cs.u32Limit = cbLimit;
1843	pCtx->cs.u64Base = u64Base;
1844	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
1845	pCtx->eflags.Bits.u1RF = 0;
1846	/** @todo check if the hidden bits are loaded correctly for 64-bit
1847	* mode. */
1848	return VINF_SUCCESS;
1849	}
1850
1851
1852	/**
1853	* Implements far calls.
1854	*
1855	* This very similar to iemCImpl_FarJmp.
1856	*
1857	* @param uSel The selector.
1858	* @param offSeg The segment offset.
1859	* @param enmEffOpSize The operand size (in case we need it).
1860	*/
1861	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1862	{
1863	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1864	VBOXSTRICTRC rcStrict;
1865	uint64_t uNewRsp;
1866	RTPTRUNION uPtrRet;
1867
1868	/*
1869	* Real mode and V8086 mode are easy. The only snag seems to be that
1870	* CS.limit doesn't change and the limit check is done against the current
1871	* limit.
1872	*/
1873	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1874	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1875	{
1876	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1877
1878	/* Check stack first - may #SS(0). */
1879	rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1880	&uPtrRet.pv, &uNewRsp);
1881	if (rcStrict != VINF_SUCCESS)
1882	return rcStrict;
1883
1884	/* Check the target address range. */
1885	if (offSeg > UINT32_MAX)
1886	return iemRaiseGeneralProtectionFault0(pIemCpu);
1887
1888	/* Everything is fine, push the return address. */
1889	if (enmEffOpSize == IEMMODE_16BIT)
1890	{
1891	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1892	uPtrRet.pu16[1] = pCtx->cs.Sel;
1893	}
1894	else
1895	{
1896	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1897	uPtrRet.pu16[3] = pCtx->cs.Sel;
1898	}
1899	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1900	if (rcStrict != VINF_SUCCESS)
1901	return rcStrict;
1902
1903	/* Branch. */
1904	pCtx->rip = offSeg;
1905	pCtx->cs.Sel = uSel;
1906	pCtx->cs.ValidSel = uSel;
1907	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1908	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1909	pCtx->eflags.Bits.u1RF = 0;
1910	return VINF_SUCCESS;
1911	}
1912
1913	/*
1914	* Protected mode. Need to parse the specified descriptor...
1915	*/
1916	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1917	{
1918	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1919	return iemRaiseGeneralProtectionFault0(pIemCpu);
1920	}
1921
1922	/* Fetch the descriptor. */
1923	IEMSELDESC Desc;
1924	rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1925	if (rcStrict != VINF_SUCCESS)
1926	return rcStrict;
1927
1928	/*
1929	* Deal with it according to its type. We do the standard code selectors
1930	* here and dispatch the system selectors to worker functions.
1931	*/
1932	if (!Desc.Legacy.Gen.u1DescType)
1933	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1934
1935	/* Only code segments. */
1936	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1937	{
1938	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1939	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1940	}
1941
1942	/* L vs D. */
1943	if ( Desc.Legacy.Gen.u1Long
1944	&& Desc.Legacy.Gen.u1DefBig
1945	&& IEM_IS_LONG_MODE(pIemCpu))
1946	{
1947	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1948	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1949	}
1950
1951	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1952	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1953	{
1954	if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1955	{
1956	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1957	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1958	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1959	}
1960	}
1961	else
1962	{
1963	if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1964	{
1965	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1966	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1967	}
1968	if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1969	{
1970	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1971	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1972	}
1973	}
1974
1975	/* Is it there? */
1976	if (!Desc.Legacy.Gen.u1Present)
1977	{
1978	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1979	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1980	}
1981
1982	/* Check stack first - may #SS(0). */
1983	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1984	* 16-bit code cause a two or four byte CS to be pushed? */
1985	rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1986	enmEffOpSize == IEMMODE_64BIT ? 8+8
1987	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1988	&uPtrRet.pv, &uNewRsp);
1989	if (rcStrict != VINF_SUCCESS)
1990	return rcStrict;
1991
1992	/* Chop the high bits if 16-bit (Intel says so). */
1993	if (enmEffOpSize == IEMMODE_16BIT)
1994	offSeg &= UINT16_MAX;
1995
1996	/* Limit / canonical check. */
1997	uint64_t u64Base;
1998	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1999	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2000	{
2001	if (!IEM_IS_CANONICAL(offSeg))
2002	{
2003	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2004	return iemRaiseNotCanonical(pIemCpu);
2005	}
2006	u64Base = 0;
2007	}
2008	else
2009	{
2010	if (offSeg > cbLimit)
2011	{
2012	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2013	/** @todo: Intel says this is #GP(0)! */
2014	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2015	}
2016	u64Base = X86DESC_BASE(&Desc.Legacy);
2017	}
2018
2019	/*
2020	* Now set the accessed bit before
2021	* writing the return address to the stack and committing the result into
2022	* CS, CSHID and RIP.
2023	*/
2024	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2025	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2026	{
2027	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
2028	if (rcStrict != VINF_SUCCESS)
2029	return rcStrict;
2030	/** @todo check what VT-x and AMD-V does. */
2031	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2032	}
2033
2034	/* stack */
2035	if (enmEffOpSize == IEMMODE_16BIT)
2036	{
2037	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2038	uPtrRet.pu16[1] = pCtx->cs.Sel;
2039	}
2040	else if (enmEffOpSize == IEMMODE_32BIT)
2041	{
2042	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2043	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2044	}
2045	else
2046	{
2047	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2048	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2049	}
2050	rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
2051	if (rcStrict != VINF_SUCCESS)
2052	return rcStrict;
2053
2054	/* commit */
2055	pCtx->rip = offSeg;
2056	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2057	pCtx->cs.Sel \|= pIemCpu->uCpl;
2058	pCtx->cs.ValidSel = pCtx->cs.Sel;
2059	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2060	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2061	pCtx->cs.u32Limit = cbLimit;
2062	pCtx->cs.u64Base = u64Base;
2063	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
2064	pCtx->eflags.Bits.u1RF = 0;
2065	/** @todo check if the hidden bits are loaded correctly for 64-bit
2066	* mode. */
2067	return VINF_SUCCESS;
2068	}
2069
2070
2071	/**
2072	* Implements retf.
2073	*
2074	* @param enmEffOpSize The effective operand size.
2075	* @param cbPop The amount of arguments to pop from the stack
2076	* (bytes).
2077	*/
2078	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2079	{
2080	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2081	VBOXSTRICTRC rcStrict;
2082	RTCPTRUNION uPtrFrame;
2083	uint64_t uNewRsp;
2084	uint64_t uNewRip;
2085	uint16_t uNewCs;
2086	NOREF(cbInstr);
2087
2088	/*
2089	* Read the stack values first.
2090	*/
2091	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2092	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2093	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2094	if (rcStrict != VINF_SUCCESS)
2095	return rcStrict;
2096	if (enmEffOpSize == IEMMODE_16BIT)
2097	{
2098	uNewRip = uPtrFrame.pu16[0];
2099	uNewCs = uPtrFrame.pu16[1];
2100	}
2101	else if (enmEffOpSize == IEMMODE_32BIT)
2102	{
2103	uNewRip = uPtrFrame.pu32[0];
2104	uNewCs = uPtrFrame.pu16[2];
2105	}
2106	else
2107	{
2108	uNewRip = uPtrFrame.pu64[0];
2109	uNewCs = uPtrFrame.pu16[4];
2110	}
2111
2112	/*
2113	* Real mode and V8086 mode are easy.
2114	*/
2115	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2116	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2117	{
2118	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2119	/** @todo check how this is supposed to work if sp=0xfffe. */
2120
2121	/* Check the limit of the new EIP. */
2122	/** @todo Intel pseudo code only does the limit check for 16-bit
2123	* operands, AMD does not make any distinction. What is right? */
2124	if (uNewRip > pCtx->cs.u32Limit)
2125	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2126
2127	/* commit the operation. */
2128	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2129	if (rcStrict != VINF_SUCCESS)
2130	return rcStrict;
2131	pCtx->rip = uNewRip;
2132	pCtx->cs.Sel = uNewCs;
2133	pCtx->cs.ValidSel = uNewCs;
2134	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2135	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2136	pCtx->eflags.Bits.u1RF = 0;
2137	/** @todo do we load attribs and limit as well? */
2138	if (cbPop)
2139	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2140	return VINF_SUCCESS;
2141	}
2142
2143	/*
2144	* Protected mode is complicated, of course.
2145	*/
2146	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2147	{
2148	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2149	return iemRaiseGeneralProtectionFault0(pIemCpu);
2150	}
2151
2152	/* Fetch the descriptor. */
2153	IEMSELDESC DescCs;
2154	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
2155	if (rcStrict != VINF_SUCCESS)
2156	return rcStrict;
2157
2158	/* Can only return to a code selector. */
2159	if ( !DescCs.Legacy.Gen.u1DescType
2160	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2161	{
2162	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2163	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2164	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2165	}
2166
2167	/* L vs D. */
2168	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2169	&& DescCs.Legacy.Gen.u1DefBig
2170	&& IEM_IS_LONG_MODE(pIemCpu))
2171	{
2172	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2173	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2174	}
2175
2176	/* DPL/RPL/CPL checks. */
2177	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2178	{
2179	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
2180	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2181	}
2182
2183	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2184	{
2185	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2186	{
2187	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2188	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2189	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2190	}
2191	}
2192	else
2193	{
2194	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2195	{
2196	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2197	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2198	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2199	}
2200	}
2201
2202	/* Is it there? */
2203	if (!DescCs.Legacy.Gen.u1Present)
2204	{
2205	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2206	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2207	}
2208
2209	/*
2210	* Return to outer privilege? (We'll typically have entered via a call gate.)
2211	*/
2212	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2213	{
2214	/* Read the outer stack pointer stored after the parameters. */
2215	RTCPTRUNION uPtrStack;
2216	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
2217	if (rcStrict != VINF_SUCCESS)
2218	return rcStrict;
2219
2220	uPtrStack.pu8 += cbPop; /* Skip the parameters. */
2221
2222	uint16_t uNewOuterSs;
2223	uint64_t uNewOuterRsp;
2224	if (enmEffOpSize == IEMMODE_16BIT)
2225	{
2226	uNewOuterRsp = uPtrStack.pu16[0];
2227	uNewOuterSs = uPtrStack.pu16[1];
2228	}
2229	else if (enmEffOpSize == IEMMODE_32BIT)
2230	{
2231	uNewOuterRsp = uPtrStack.pu32[0];
2232	uNewOuterSs = uPtrStack.pu16[2];
2233	}
2234	else
2235	{
2236	uNewOuterRsp = uPtrStack.pu64[0];
2237	uNewOuterSs = uPtrStack.pu16[4];
2238	}
2239
2240	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2241	and read the selector. */
2242	IEMSELDESC DescSs;
2243	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2244	{
2245	if ( !DescCs.Legacy.Gen.u1Long
2246	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
2247	{
2248	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2249	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2250	return iemRaiseGeneralProtectionFault0(pIemCpu);
2251	}
2252	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2253	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2254	}
2255	else
2256	{
2257	/* Fetch the descriptor for the new stack segment. */
2258	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2259	if (rcStrict != VINF_SUCCESS)
2260	return rcStrict;
2261	}
2262
2263	/* Check that RPL of stack and code selectors match. */
2264	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2265	{
2266	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2267	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2268	}
2269
2270	/* Must be a writable data segment. */
2271	if ( !DescSs.Legacy.Gen.u1DescType
2272	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2273	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2274	{
2275	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2276	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2277	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2278	}
2279
2280	/* L vs D. (Not mentioned by intel.) */
2281	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2282	&& DescSs.Legacy.Gen.u1DefBig
2283	&& IEM_IS_LONG_MODE(pIemCpu))
2284	{
2285	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2286	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2287	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2288	}
2289
2290	/* DPL/RPL/CPL checks. */
2291	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2292	{
2293	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2294	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2295	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
2296	}
2297
2298	/* Is it there? */
2299	if (!DescSs.Legacy.Gen.u1Present)
2300	{
2301	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2302	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2303	}
2304
2305	/* Calc SS limit.*/
2306	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2307
2308	/* Is RIP canonical or within CS.limit? */
2309	uint64_t u64Base;
2310	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2311
2312	/** @todo Testcase: Is this correct? */
2313	if ( DescCs.Legacy.Gen.u1Long
2314	&& IEM_IS_LONG_MODE(pIemCpu) )
2315	{
2316	if (!IEM_IS_CANONICAL(uNewRip))
2317	{
2318	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2319	return iemRaiseNotCanonical(pIemCpu);
2320	}
2321	u64Base = 0;
2322	}
2323	else
2324	{
2325	if (uNewRip > cbLimitCs)
2326	{
2327	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2328	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2329	/** @todo: Intel says this is #GP(0)! */
2330	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2331	}
2332	u64Base = X86DESC_BASE(&DescCs.Legacy);
2333	}
2334
2335	/*
2336	* Now set the accessed bit before
2337	* writing the return address to the stack and committing the result into
2338	* CS, CSHID and RIP.
2339	*/
2340	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2341	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2342	{
2343	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2344	if (rcStrict != VINF_SUCCESS)
2345	return rcStrict;
2346	/** @todo check what VT-x and AMD-V does. */
2347	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2348	}
2349	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2350	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2351	{
2352	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
2353	if (rcStrict != VINF_SUCCESS)
2354	return rcStrict;
2355	/** @todo check what VT-x and AMD-V does. */
2356	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2357	}
2358
2359	/* commit */
2360	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2361	if (rcStrict != VINF_SUCCESS)
2362	return rcStrict;
2363	if (enmEffOpSize == IEMMODE_16BIT)
2364	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2365	else
2366	pCtx->rip = uNewRip;
2367	pCtx->cs.Sel = uNewCs;
2368	pCtx->cs.ValidSel = uNewCs;
2369	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2370	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2371	pCtx->cs.u32Limit = cbLimitCs;
2372	pCtx->cs.u64Base = u64Base;
2373	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
2374	pCtx->rsp = uNewOuterRsp;
2375	pCtx->ss.Sel = uNewOuterSs;
2376	pCtx->ss.ValidSel = uNewOuterSs;
2377	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2378	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2379	pCtx->ss.u32Limit = cbLimitSs;
2380	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2381	pCtx->ss.u64Base = 0;
2382	else
2383	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2384
2385	pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
2386	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2387	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2388	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2389	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2390
2391	/** @todo check if the hidden bits are loaded correctly for 64-bit
2392	* mode. */
2393
2394	if (cbPop)
2395	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2396	pCtx->eflags.Bits.u1RF = 0;
2397
2398	/* Done! */
2399	}
2400	/*
2401	* Return to the same privilege level
2402	*/
2403	else
2404	{
2405	/* Limit / canonical check. */
2406	uint64_t u64Base;
2407	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2408
2409	/** @todo Testcase: Is this correct? */
2410	if ( DescCs.Legacy.Gen.u1Long
2411	&& IEM_IS_LONG_MODE(pIemCpu) )
2412	{
2413	if (!IEM_IS_CANONICAL(uNewRip))
2414	{
2415	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2416	return iemRaiseNotCanonical(pIemCpu);
2417	}
2418	u64Base = 0;
2419	}
2420	else
2421	{
2422	if (uNewRip > cbLimitCs)
2423	{
2424	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2425	/** @todo: Intel says this is #GP(0)! */
2426	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2427	}
2428	u64Base = X86DESC_BASE(&DescCs.Legacy);
2429	}
2430
2431	/*
2432	* Now set the accessed bit before
2433	* writing the return address to the stack and committing the result into
2434	* CS, CSHID and RIP.
2435	*/
2436	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2437	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2438	{
2439	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2440	if (rcStrict != VINF_SUCCESS)
2441	return rcStrict;
2442	/** @todo check what VT-x and AMD-V does. */
2443	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2444	}
2445
2446	/* commit */
2447	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
2448	if (rcStrict != VINF_SUCCESS)
2449	return rcStrict;
2450	if (enmEffOpSize == IEMMODE_16BIT)
2451	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2452	else
2453	pCtx->rip = uNewRip;
2454	pCtx->cs.Sel = uNewCs;
2455	pCtx->cs.ValidSel = uNewCs;
2456	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2457	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2458	pCtx->cs.u32Limit = cbLimitCs;
2459	pCtx->cs.u64Base = u64Base;
2460	/** @todo check if the hidden bits are loaded correctly for 64-bit
2461	* mode. */
2462	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
2463	if (cbPop)
2464	iemRegAddToRsp(pIemCpu, pCtx, cbPop);
2465	pCtx->eflags.Bits.u1RF = 0;
2466	}
2467	return VINF_SUCCESS;
2468	}
2469
2470
2471	/**
2472	* Implements retn.
2473	*
2474	* We're doing this in C because of the \#GP that might be raised if the popped
2475	* program counter is out of bounds.
2476	*
2477	* @param enmEffOpSize The effective operand size.
2478	* @param cbPop The amount of arguments to pop from the stack
2479	* (bytes).
2480	*/
2481	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2482	{
2483	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2484	NOREF(cbInstr);
2485
2486	/* Fetch the RSP from the stack. */
2487	VBOXSTRICTRC rcStrict;
2488	RTUINT64U NewRip;
2489	RTUINT64U NewRsp;
2490	NewRsp.u = pCtx->rsp;
2491	switch (enmEffOpSize)
2492	{
2493	case IEMMODE_16BIT:
2494	NewRip.u = 0;
2495	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
2496	break;
2497	case IEMMODE_32BIT:
2498	NewRip.u = 0;
2499	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
2500	break;
2501	case IEMMODE_64BIT:
2502	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
2503	break;
2504	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2505	}
2506	if (rcStrict != VINF_SUCCESS)
2507	return rcStrict;
2508
2509	/* Check the new RSP before loading it. */
2510	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
2511	* of it. The canonical test is performed here and for call. */
2512	if (enmEffOpSize != IEMMODE_64BIT)
2513	{
2514	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2515	{
2516	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2517	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2518	}
2519	}
2520	else
2521	{
2522	if (!IEM_IS_CANONICAL(NewRip.u))
2523	{
2524	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2525	return iemRaiseNotCanonical(pIemCpu);
2526	}
2527	}
2528
2529	/* Apply cbPop */
2530	if (cbPop)
2531	iemRegAddToRspEx(pIemCpu, pCtx, &NewRsp, cbPop);
2532
2533	/* Commit it. */
2534	pCtx->rip = NewRip.u;
2535	pCtx->rsp = NewRsp.u;
2536	pCtx->eflags.Bits.u1RF = 0;
2537
2538	return VINF_SUCCESS;
2539	}
2540
2541
2542	/**
2543	* Implements enter.
2544	*
2545	* We're doing this in C because the instruction is insane, even for the
2546	* u8NestingLevel=0 case dealing with the stack is tedious.
2547	*
2548	* @param enmEffOpSize The effective operand size.
2549	*/
2550	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2551	{
2552	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2553
2554	/* Push RBP, saving the old value in TmpRbp. */
2555	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2556	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2557	RTUINT64U NewRbp;
2558	VBOXSTRICTRC rcStrict;
2559	if (enmEffOpSize == IEMMODE_64BIT)
2560	{
2561	rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
2562	NewRbp = NewRsp;
2563	}
2564	else if (enmEffOpSize == IEMMODE_32BIT)
2565	{
2566	rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
2567	NewRbp = NewRsp;
2568	}
2569	else
2570	{
2571	rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
2572	NewRbp = TmpRbp;
2573	NewRbp.Words.w0 = NewRsp.Words.w0;
2574	}
2575	if (rcStrict != VINF_SUCCESS)
2576	return rcStrict;
2577
2578	/* Copy the parameters (aka nesting levels by Intel). */
2579	cParameters &= 0x1f;
2580	if (cParameters > 0)
2581	{
2582	switch (enmEffOpSize)
2583	{
2584	case IEMMODE_16BIT:
2585	if (pCtx->ss.Attr.n.u1DefBig)
2586	TmpRbp.DWords.dw0 -= 2;
2587	else
2588	TmpRbp.Words.w0 -= 2;
2589	do
2590	{
2591	uint16_t u16Tmp;
2592	rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
2593	if (rcStrict != VINF_SUCCESS)
2594	break;
2595	rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
2596	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2597	break;
2598
2599	case IEMMODE_32BIT:
2600	if (pCtx->ss.Attr.n.u1DefBig)
2601	TmpRbp.DWords.dw0 -= 4;
2602	else
2603	TmpRbp.Words.w0 -= 4;
2604	do
2605	{
2606	uint32_t u32Tmp;
2607	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
2608	if (rcStrict != VINF_SUCCESS)
2609	break;
2610	rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
2611	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2612	break;
2613
2614	case IEMMODE_64BIT:
2615	TmpRbp.u -= 8;
2616	do
2617	{
2618	uint64_t u64Tmp;
2619	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
2620	if (rcStrict != VINF_SUCCESS)
2621	break;
2622	rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
2623	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2624	break;
2625
2626	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2627	}
2628	if (rcStrict != VINF_SUCCESS)
2629	return VINF_SUCCESS;
2630
2631	/* Push the new RBP */
2632	if (enmEffOpSize == IEMMODE_64BIT)
2633	rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
2634	else if (enmEffOpSize == IEMMODE_32BIT)
2635	rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
2636	else
2637	rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
2638	if (rcStrict != VINF_SUCCESS)
2639	return rcStrict;
2640
2641	}
2642
2643	/* Recalc RSP. */
2644	iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
2645
2646	/** @todo Should probe write access at the new RSP according to AMD. */
2647
2648	/* Commit it. */
2649	pCtx->rbp = NewRbp.u;
2650	pCtx->rsp = NewRsp.u;
2651	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2652
2653	return VINF_SUCCESS;
2654	}
2655
2656
2657
2658	/**
2659	* Implements leave.
2660	*
2661	* We're doing this in C because messing with the stack registers is annoying
2662	* since they depends on SS attributes.
2663	*
2664	* @param enmEffOpSize The effective operand size.
2665	*/
2666	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2667	{
2668	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2669
2670	/* Calculate the intermediate RSP from RBP and the stack attributes. */
2671	RTUINT64U NewRsp;
2672	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2673	NewRsp.u = pCtx->rbp;
2674	else if (pCtx->ss.Attr.n.u1DefBig)
2675	NewRsp.u = pCtx->ebp;
2676	else
2677	{
2678	/** @todo Check that LEAVE actually preserve the high EBP bits. */
2679	NewRsp.u = pCtx->rsp;
2680	NewRsp.Words.w0 = pCtx->bp;
2681	}
2682
2683	/* Pop RBP according to the operand size. */
2684	VBOXSTRICTRC rcStrict;
2685	RTUINT64U NewRbp;
2686	switch (enmEffOpSize)
2687	{
2688	case IEMMODE_16BIT:
2689	NewRbp.u = pCtx->rbp;
2690	rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
2691	break;
2692	case IEMMODE_32BIT:
2693	NewRbp.u = 0;
2694	rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
2695	break;
2696	case IEMMODE_64BIT:
2697	rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
2698	break;
2699	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2700	}
2701	if (rcStrict != VINF_SUCCESS)
2702	return rcStrict;
2703
2704
2705	/* Commit it. */
2706	pCtx->rbp = NewRbp.u;
2707	pCtx->rsp = NewRsp.u;
2708	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2709
2710	return VINF_SUCCESS;
2711	}
2712
2713
2714	/**
2715	* Implements int3 and int XX.
2716	*
2717	* @param u8Int The interrupt vector number.
2718	* @param fIsBpInstr Is it the breakpoint instruction.
2719	*/
2720	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2721	{
2722	Assert(pIemCpu->cXcptRecursions == 0);
2723	return iemRaiseXcptOrInt(pIemCpu,
2724	cbInstr,
2725	u8Int,
2726	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
2727	0,
2728	0);
2729	}
2730
2731
2732	/**
2733	* Implements iret for real mode and V8086 mode.
2734	*
2735	* @param enmEffOpSize The effective operand size.
2736	*/
2737	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2738	{
2739	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2740	X86EFLAGS Efl;
2741	Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2742	NOREF(cbInstr);
2743
2744	/*
2745	* iret throws an exception if VME isn't enabled.
2746	*/
2747	if ( Efl.Bits.u1VM
2748	&& Efl.Bits.u2IOPL != 3
2749	&& !(pCtx->cr4 & X86_CR4_VME))
2750	return iemRaiseGeneralProtectionFault0(pIemCpu);
2751
2752	/*
2753	* Do the stack bits, but don't commit RSP before everything checks
2754	* out right.
2755	*/
2756	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2757	VBOXSTRICTRC rcStrict;
2758	RTCPTRUNION uFrame;
2759	uint16_t uNewCs;
2760	uint32_t uNewEip;
2761	uint32_t uNewFlags;
2762	uint64_t uNewRsp;
2763	if (enmEffOpSize == IEMMODE_32BIT)
2764	{
2765	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2766	if (rcStrict != VINF_SUCCESS)
2767	return rcStrict;
2768	uNewEip = uFrame.pu32[0];
2769	if (uNewEip > UINT16_MAX)
2770	return iemRaiseGeneralProtectionFault0(pIemCpu);
2771
2772	uNewCs = (uint16_t)uFrame.pu32[1];
2773	uNewFlags = uFrame.pu32[2];
2774	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2775	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
2776	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
2777	\| X86_EFL_ID;
2778	if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
2779	uNewFlags &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
2780	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
2781	}
2782	else
2783	{
2784	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2785	if (rcStrict != VINF_SUCCESS)
2786	return rcStrict;
2787	uNewEip = uFrame.pu16[0];
2788	uNewCs = uFrame.pu16[1];
2789	uNewFlags = uFrame.pu16[2];
2790	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2791	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
2792	uNewFlags \|= Efl.u & ((UINT32_C(0xffff0000) \| X86_EFL_1) & ~X86_EFL_RF);
2793	/** @todo The intel pseudo code does not indicate what happens to
2794	* reserved flags. We just ignore them. */
2795	/* Ancient CPU adjustments: See iemCImpl_popf. */
2796	if (IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_286)
2797	uNewFlags &= ~(X86_EFL_NT \| X86_EFL_IOPL);
2798	}
2799	/** @todo Check how this is supposed to work if sp=0xfffe. */
2800	Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2801	uNewCs, uNewEip, uNewFlags, uNewRsp));
2802
2803	/*
2804	* Check the limit of the new EIP.
2805	*/
2806	/** @todo Only the AMD pseudo code check the limit here, what's
2807	* right? */
2808	if (uNewEip > pCtx->cs.u32Limit)
2809	return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2810
2811	/*
2812	* V8086 checks and flag adjustments
2813	*/
2814	if (Efl.Bits.u1VM)
2815	{
2816	if (Efl.Bits.u2IOPL == 3)
2817	{
2818	/* Preserve IOPL and clear RF. */
2819	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
2820	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
2821	}
2822	else if ( enmEffOpSize == IEMMODE_16BIT
2823	&& ( !(uNewFlags & X86_EFL_IF)
2824	\|\| !Efl.Bits.u1VIP )
2825	&& !(uNewFlags & X86_EFL_TF) )
2826	{
2827	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2828	uNewFlags &= ~X86_EFL_VIF;
2829	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
2830	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
2831	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2832	}
2833	else
2834	return iemRaiseGeneralProtectionFault0(pIemCpu);
2835	Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2836	}
2837
2838	/*
2839	* Commit the operation.
2840	*/
2841	rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2842	if (rcStrict != VINF_SUCCESS)
2843	return rcStrict;
2844	#ifdef DBGFTRACE_ENABLED
2845	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2846	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2847	#endif
2848
2849	pCtx->rip = uNewEip;
2850	pCtx->cs.Sel = uNewCs;
2851	pCtx->cs.ValidSel = uNewCs;
2852	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2853	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2854	/** @todo do we load attribs and limit as well? */
2855	Assert(uNewFlags & X86_EFL_1);
2856	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2857
2858	return VINF_SUCCESS;
2859	}
2860
2861
2862	/**
2863	* Loads a segment register when entering V8086 mode.
2864	*
2865	* @param pSReg The segment register.
2866	* @param uSeg The segment to load.
2867	*/
2868	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2869	{
2870	pSReg->Sel = uSeg;
2871	pSReg->ValidSel = uSeg;
2872	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2873	pSReg->u64Base = (uint32_t)uSeg << 4;
2874	pSReg->u32Limit = 0xffff;
2875	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2876	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2877	* IRET'ing to V8086. */
2878	}
2879
2880
2881	/**
2882	* Implements iret for protected mode returning to V8086 mode.
2883	*
2884	* @param pCtx Pointer to the CPU context.
2885	* @param uNewEip The new EIP.
2886	* @param uNewCs The new CS.
2887	* @param uNewFlags The new EFLAGS.
2888	* @param uNewRsp The RSP after the initial IRET frame.
2889	*
2890	* @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2891	*/
2892	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2893	uint32_t, uNewFlags, uint64_t, uNewRsp)
2894	{
2895	/*
2896	* Pop the V8086 specific frame bits off the stack.
2897	*/
2898	VBOXSTRICTRC rcStrict;
2899	RTCPTRUNION uFrame;
2900	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2901	if (rcStrict != VINF_SUCCESS)
2902	return rcStrict;
2903	uint32_t uNewEsp = uFrame.pu32[0];
2904	uint16_t uNewSs = uFrame.pu32[1];
2905	uint16_t uNewEs = uFrame.pu32[2];
2906	uint16_t uNewDs = uFrame.pu32[3];
2907	uint16_t uNewFs = uFrame.pu32[4];
2908	uint16_t uNewGs = uFrame.pu32[5];
2909	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2910	if (rcStrict != VINF_SUCCESS)
2911	return rcStrict;
2912
2913	/*
2914	* Commit the operation.
2915	*/
2916	uNewFlags &= X86_EFL_LIVE_MASK;
2917	uNewFlags \|= X86_EFL_RA1_MASK;
2918	#ifdef DBGFTRACE_ENABLED
2919	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2920	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2921	#endif
2922
2923	IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2924	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2925	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2926	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2927	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2928	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2929	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2930	pCtx->rip = (uint16_t)uNewEip;
2931	pCtx->rsp = uNewEsp; /** @todo check this out! */
2932	pIemCpu->uCpl = 3;
2933
2934	return VINF_SUCCESS;
2935	}
2936
2937
2938	/**
2939	* Implements iret for protected mode returning via a nested task.
2940	*
2941	* @param enmEffOpSize The effective operand size.
2942	*/
2943	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2944	{
2945	Log7(("iemCImpl_iret_prot_NestedTask:\n"));
2946	#ifndef IEM_IMPLEMENTS_TASKSWITCH
2947	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2948	#else
2949	/*
2950	* Read the segment selector in the link-field of the current TSS.
2951	*/
2952	RTSEL uSelRet;
2953	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2954	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
2955	if (rcStrict != VINF_SUCCESS)
2956	return rcStrict;
2957
2958	/*
2959	* Fetch the returning task's TSS descriptor from the GDT.
2960	*/
2961	if (uSelRet & X86_SEL_LDT)
2962	{
2963	Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
2964	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet);
2965	}
2966
2967	IEMSELDESC TssDesc;
2968	rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelRet, X86_XCPT_GP);
2969	if (rcStrict != VINF_SUCCESS)
2970	return rcStrict;
2971
2972	if (TssDesc.Legacy.Gate.u1DescType)
2973	{
2974	Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
2975	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2976	}
2977
2978	if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
2979	&& TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
2980	{
2981	Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
2982	return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2983	}
2984
2985	if (!TssDesc.Legacy.Gate.u1Present)
2986	{
2987	Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
2988	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
2989	}
2990
2991	uint32_t uNextEip = pCtx->eip + cbInstr;
2992	return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags /, 0 / uErr */,
2993	0 /* uCr2 */, uSelRet, &TssDesc);
2994	#endif
2995	}
2996
2997
2998	/**
2999	* Implements iret for protected mode
3000	*
3001	* @param enmEffOpSize The effective operand size.
3002	*/
3003	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3004	{
3005	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3006	NOREF(cbInstr);
3007	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
3008
3009	/*
3010	* Nested task return.
3011	*/
3012	if (pCtx->eflags.Bits.u1NT)
3013	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3014
3015	/*
3016	* Normal return.
3017	*
3018	* Do the stack bits, but don't commit RSP before everything checks
3019	* out right.
3020	*/
3021	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
3022	VBOXSTRICTRC rcStrict;
3023	RTCPTRUNION uFrame;
3024	uint16_t uNewCs;
3025	uint32_t uNewEip;
3026	uint32_t uNewFlags;
3027	uint64_t uNewRsp;
3028	if (enmEffOpSize == IEMMODE_32BIT)
3029	{
3030	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
3031	if (rcStrict != VINF_SUCCESS)
3032	return rcStrict;
3033	uNewEip = uFrame.pu32[0];
3034	uNewCs = (uint16_t)uFrame.pu32[1];
3035	uNewFlags = uFrame.pu32[2];
3036	}
3037	else
3038	{
3039	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
3040	if (rcStrict != VINF_SUCCESS)
3041	return rcStrict;
3042	uNewEip = uFrame.pu16[0];
3043	uNewCs = uFrame.pu16[1];
3044	uNewFlags = uFrame.pu16[2];
3045	}
3046	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
3047	if (rcStrict != VINF_SUCCESS)
3048	return rcStrict;
3049	Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3050
3051	/*
3052	* We're hopefully not returning to V8086 mode...
3053	*/
3054	if ( (uNewFlags & X86_EFL_VM)
3055	&& pIemCpu->uCpl == 0)
3056	{
3057	Assert(enmEffOpSize == IEMMODE_32BIT);
3058	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3059	}
3060
3061	/*
3062	* Protected mode.
3063	*/
3064	/* Read the CS descriptor. */
3065	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3066	{
3067	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3068	return iemRaiseGeneralProtectionFault0(pIemCpu);
3069	}
3070
3071	IEMSELDESC DescCS;
3072	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
3073	if (rcStrict != VINF_SUCCESS)
3074	{
3075	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3076	return rcStrict;
3077	}
3078
3079	/* Must be a code descriptor. */
3080	if (!DescCS.Legacy.Gen.u1DescType)
3081	{
3082	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3083	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3084	}
3085	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3086	{
3087	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3088	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3089	}
3090
3091	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3092	/* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3093	PVM pVM = IEMCPU_TO_VM(pIemCpu);
3094	if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3095	{
3096	if ((uNewCs & X86_SEL_RPL) == 1)
3097	{
3098	if ( pIemCpu->uCpl == 0
3099	&& ( !EMIsRawRing1Enabled(pVM)
3100	\|\| pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3101	{
3102	Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3103	uNewCs &= X86_SEL_MASK_OFF_RPL;
3104	}
3105	# ifdef LOG_ENABLED
3106	else if (pIemCpu->uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3107	Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3108	# endif
3109	}
3110	else if ( (uNewCs & X86_SEL_RPL) == 2
3111	&& EMIsRawRing1Enabled(pVM)
3112	&& pIemCpu->uCpl <= 1)
3113	{
3114	Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) \| 1));
3115	uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) \| 2;
3116	}
3117	}
3118	#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3119
3120
3121	/* Privilege checks. */
3122	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3123	{
3124	if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3125	{
3126	Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3127	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3128	}
3129	}
3130	else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3131	{
3132	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3133	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3134	}
3135	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
3136	{
3137	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
3138	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3139	}
3140
3141	/* Present? */
3142	if (!DescCS.Legacy.Gen.u1Present)
3143	{
3144	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3145	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
3146	}
3147
3148	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3149
3150	/*
3151	* Return to outer level?
3152	*/
3153	if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
3154	{
3155	uint16_t uNewSS;
3156	uint32_t uNewESP;
3157	if (enmEffOpSize == IEMMODE_32BIT)
3158	{
3159	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
3160	if (rcStrict != VINF_SUCCESS)
3161	return rcStrict;
3162	/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3163	* 16-bit or 32-bit are being loaded into SP depends on the D/B
3164	* bit of the popped SS selector it turns out. */
3165	uNewESP = uFrame.pu32[0];
3166	uNewSS = (uint16_t)uFrame.pu32[1];
3167	}
3168	else
3169	{
3170	rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 4, &uFrame.pv, &uNewRsp);
3171	if (rcStrict != VINF_SUCCESS)
3172	return rcStrict;
3173	uNewESP = uFrame.pu16[0];
3174	uNewSS = uFrame.pu16[1];
3175	}
3176	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3177	if (rcStrict != VINF_SUCCESS)
3178	return rcStrict;
3179	Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3180
3181	/* Read the SS descriptor. */
3182	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3183	{
3184	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3185	return iemRaiseGeneralProtectionFault0(pIemCpu);
3186	}
3187
3188	IEMSELDESC DescSS;
3189	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3190	if (rcStrict != VINF_SUCCESS)
3191	{
3192	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3193	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3194	return rcStrict;
3195	}
3196
3197	/* Privilege checks. */
3198	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3199	{
3200	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3201	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3202	}
3203	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3204	{
3205	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3206	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3207	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3208	}
3209
3210	/* Must be a writeable data segment descriptor. */
3211	if (!DescSS.Legacy.Gen.u1DescType)
3212	{
3213	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3214	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3215	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3216	}
3217	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3218	{
3219	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3220	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3221	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
3222	}
3223
3224	/* Present? */
3225	if (!DescSS.Legacy.Gen.u1Present)
3226	{
3227	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3228	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
3229	}
3230
3231	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3232
3233	/* Check EIP. */
3234	if (uNewEip > cbLimitCS)
3235	{
3236	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3237	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3238	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3239	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3240	}
3241
3242	/*
3243	* Commit the changes, marking CS and SS accessed first since
3244	* that may fail.
3245	*/
3246	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3247	{
3248	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3249	if (rcStrict != VINF_SUCCESS)
3250	return rcStrict;
3251	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3252	}
3253	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3254	{
3255	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
3256	if (rcStrict != VINF_SUCCESS)
3257	return rcStrict;
3258	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3259	}
3260
3261	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3262	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3263	if (enmEffOpSize != IEMMODE_16BIT)
3264	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3265	if (pIemCpu->uCpl == 0)
3266	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
3267	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
3268	fEFlagsMask \|= X86_EFL_IF;
3269	if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
3270	fEFlagsMask &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
3271	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
3272	fEFlagsNew &= ~fEFlagsMask;
3273	fEFlagsNew \|= uNewFlags & fEFlagsMask;
3274	#ifdef DBGFTRACE_ENABLED
3275	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3276	pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3277	uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3278	#endif
3279
3280	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
3281	pCtx->rip = uNewEip;
3282	pCtx->cs.Sel = uNewCs;
3283	pCtx->cs.ValidSel = uNewCs;
3284	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3285	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3286	pCtx->cs.u32Limit = cbLimitCS;
3287	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3288	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
3289	if (!pCtx->ss.Attr.n.u1DefBig)
3290	pCtx->sp = (uint16_t)uNewESP;
3291	else
3292	pCtx->rsp = uNewESP;
3293	pCtx->ss.Sel = uNewSS;
3294	pCtx->ss.ValidSel = uNewSS;
3295	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3296	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3297	pCtx->ss.u32Limit = cbLimitSs;
3298	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3299
3300	pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
3301	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3302	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3303	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3304	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3305
3306	/* Done! */
3307
3308	}
3309	/*
3310	* Return to the same level.
3311	*/
3312	else
3313	{
3314	/* Check EIP. */
3315	if (uNewEip > cbLimitCS)
3316	{
3317	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3318	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3319	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3320	}
3321
3322	/*
3323	* Commit the changes, marking CS first since it may fail.
3324	*/
3325	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3326	{
3327	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3328	if (rcStrict != VINF_SUCCESS)
3329	return rcStrict;
3330	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3331	}
3332
3333	X86EFLAGS NewEfl;
3334	NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
3335	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3336	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3337	if (enmEffOpSize != IEMMODE_16BIT)
3338	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3339	if (pIemCpu->uCpl == 0)
3340	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
3341	else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
3342	fEFlagsMask \|= X86_EFL_IF;
3343	if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
3344	fEFlagsMask &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
3345	NewEfl.u &= ~fEFlagsMask;
3346	NewEfl.u \|= fEFlagsMask & uNewFlags;
3347	#ifdef DBGFTRACE_ENABLED
3348	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3349	pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
3350	uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3351	#endif
3352
3353	IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
3354	pCtx->rip = uNewEip;
3355	pCtx->cs.Sel = uNewCs;
3356	pCtx->cs.ValidSel = uNewCs;
3357	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3358	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3359	pCtx->cs.u32Limit = cbLimitCS;
3360	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3361	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
3362	pCtx->rsp = uNewRsp;
3363	/* Done! */
3364	}
3365	return VINF_SUCCESS;
3366	}
3367
3368
3369	/**
3370	* Implements iret for long mode
3371	*
3372	* @param enmEffOpSize The effective operand size.
3373	*/
3374	IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3375	{
3376	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3377	NOREF(cbInstr);
3378
3379	/*
3380	* Nested task return is not supported in long mode.
3381	*/
3382	if (pCtx->eflags.Bits.u1NT)
3383	{
3384	Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3385	return iemRaiseGeneralProtectionFault0(pIemCpu);
3386	}
3387
3388	/*
3389	* Normal return.
3390	*
3391	* Do the stack bits, but don't commit RSP before everything checks
3392	* out right.
3393	*/
3394	VBOXSTRICTRC rcStrict;
3395	RTCPTRUNION uFrame;
3396	uint64_t uNewRip;
3397	uint16_t uNewCs;
3398	uint16_t uNewSs;
3399	uint32_t uNewFlags;
3400	uint64_t uNewRsp;
3401	if (enmEffOpSize == IEMMODE_64BIT)
3402	{
3403	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
3404	if (rcStrict != VINF_SUCCESS)
3405	return rcStrict;
3406	uNewRip = uFrame.pu64[0];
3407	uNewCs = (uint16_t)uFrame.pu64[1];
3408	uNewFlags = (uint32_t)uFrame.pu64[2];
3409	uNewRsp = uFrame.pu64[3];
3410	uNewSs = (uint16_t)uFrame.pu64[4];
3411	}
3412	else if (enmEffOpSize == IEMMODE_32BIT)
3413	{
3414	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
3415	if (rcStrict != VINF_SUCCESS)
3416	return rcStrict;
3417	uNewRip = uFrame.pu32[0];
3418	uNewCs = (uint16_t)uFrame.pu32[1];
3419	uNewFlags = uFrame.pu32[2];
3420	uNewRsp = uFrame.pu32[3];
3421	uNewSs = (uint16_t)uFrame.pu32[4];
3422	}
3423	else
3424	{
3425	Assert(enmEffOpSize == IEMMODE_16BIT);
3426	rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
3427	if (rcStrict != VINF_SUCCESS)
3428	return rcStrict;
3429	uNewRip = uFrame.pu16[0];
3430	uNewCs = uFrame.pu16[1];
3431	uNewFlags = uFrame.pu16[2];
3432	uNewRsp = uFrame.pu16[3];
3433	uNewSs = uFrame.pu16[4];
3434	}
3435	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
3436	if (rcStrict != VINF_SUCCESS)
3437	return rcStrict;
3438	Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3439
3440	/*
3441	* Check stuff.
3442	*/
3443	/* Read the CS descriptor. */
3444	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3445	{
3446	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3447	return iemRaiseGeneralProtectionFault0(pIemCpu);
3448	}
3449
3450	IEMSELDESC DescCS;
3451	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
3452	if (rcStrict != VINF_SUCCESS)
3453	{
3454	Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3455	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3456	return rcStrict;
3457	}
3458
3459	/* Must be a code descriptor. */
3460	if ( !DescCS.Legacy.Gen.u1DescType
3461	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3462	{
3463	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3464	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3465	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3466	}
3467
3468	/* Privilege checks. */
3469	uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3470	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3471	{
3472	if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3473	{
3474	Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3475	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3476	}
3477	}
3478	else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3479	{
3480	Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3481	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3482	}
3483	if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
3484	{
3485	Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pIemCpu->uCpl));
3486	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
3487	}
3488
3489	/* Present? */
3490	if (!DescCS.Legacy.Gen.u1Present)
3491	{
3492	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3493	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
3494	}
3495
3496	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3497
3498	/* Read the SS descriptor. */
3499	IEMSELDESC DescSS;
3500	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3501	{
3502	if ( !DescCS.Legacy.Gen.u1Long
3503	\|\| DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3504	\|\| uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3505	{
3506	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3507	return iemRaiseGeneralProtectionFault0(pIemCpu);
3508	}
3509	DescSS.Legacy.u = 0;
3510	}
3511	else
3512	{
3513	rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3514	if (rcStrict != VINF_SUCCESS)
3515	{
3516	Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3517	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3518	return rcStrict;
3519	}
3520	}
3521
3522	/* Privilege checks. */
3523	if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3524	{
3525	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3526	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3527	}
3528
3529	uint32_t cbLimitSs;
3530	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3531	cbLimitSs = UINT32_MAX;
3532	else
3533	{
3534	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3535	{
3536	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3537	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3538	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3539	}
3540
3541	/* Must be a writeable data segment descriptor. */
3542	if (!DescSS.Legacy.Gen.u1DescType)
3543	{
3544	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3545	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3546	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3547	}
3548	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3549	{
3550	Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3551	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3552	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
3553	}
3554
3555	/* Present? */
3556	if (!DescSS.Legacy.Gen.u1Present)
3557	{
3558	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3559	return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
3560	}
3561	cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3562	}
3563
3564	/* Check EIP. */
3565	if (DescCS.Legacy.Gen.u1Long)
3566	{
3567	if (!IEM_IS_CANONICAL(uNewRip))
3568	{
3569	Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3570	uNewCs, uNewRip, uNewSs, uNewRsp));
3571	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3572	}
3573	}
3574	else
3575	{
3576	if (uNewRip > cbLimitCS)
3577	{
3578	Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3579	uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3580	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3581	return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
3582	}
3583	}
3584
3585	/*
3586	* Commit the changes, marking CS and SS accessed first since
3587	* that may fail.
3588	*/
3589	/** @todo where exactly are these actually marked accessed by a real CPU? */
3590	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3591	{
3592	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
3593	if (rcStrict != VINF_SUCCESS)
3594	return rcStrict;
3595	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3596	}
3597	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3598	{
3599	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
3600	if (rcStrict != VINF_SUCCESS)
3601	return rcStrict;
3602	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3603	}
3604
3605	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3606	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3607	if (enmEffOpSize != IEMMODE_16BIT)
3608	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3609	if (pIemCpu->uCpl == 0)
3610	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is ignored */
3611	else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
3612	fEFlagsMask \|= X86_EFL_IF;
3613	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
3614	fEFlagsNew &= ~fEFlagsMask;
3615	fEFlagsNew \|= uNewFlags & fEFlagsMask;
3616	#ifdef DBGFTRACE_ENABLED
3617	RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3618	pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3619	#endif
3620
3621	IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
3622	pCtx->rip = uNewRip;
3623	pCtx->cs.Sel = uNewCs;
3624	pCtx->cs.ValidSel = uNewCs;
3625	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3626	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3627	pCtx->cs.u32Limit = cbLimitCS;
3628	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3629	pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
3630	if (pCtx->cs.Attr.n.u1Long \|\| pCtx->cs.Attr.n.u1DefBig)
3631	pCtx->rsp = uNewRsp;
3632	else
3633	pCtx->sp = (uint16_t)uNewRsp;
3634	pCtx->ss.Sel = uNewSs;
3635	pCtx->ss.ValidSel = uNewSs;
3636	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3637	{
3638	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3639	pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE \| (uNewCpl << X86DESCATTR_DPL_SHIFT);
3640	pCtx->ss.u32Limit = UINT32_MAX;
3641	pCtx->ss.u64Base = 0;
3642	Log2(("iretq new SS: NULL\n"));
3643	}
3644	else
3645	{
3646	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3647	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3648	pCtx->ss.u32Limit = cbLimitSs;
3649	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3650	Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3651	}
3652
3653	if (pIemCpu->uCpl != uNewCpl)
3654	{
3655	pIemCpu->uCpl = uNewCpl;
3656	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
3657	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
3658	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
3659	iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
3660	}
3661
3662	return VINF_SUCCESS;
3663	}
3664
3665
3666	/**
3667	* Implements iret.
3668	*
3669	* @param enmEffOpSize The effective operand size.
3670	*/
3671	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3672	{
3673	/*
3674	* First, clear NMI blocking, if any, before causing any exceptions.
3675	*/
3676	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3677	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3678
3679	/*
3680	* Call a mode specific worker.
3681	*/
3682	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3683	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3684	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3685	return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3686	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3687	}
3688
3689
3690	/**
3691	* Implements SYSCALL (AMD and Intel64).
3692	*
3693	* @param enmEffOpSize The effective operand size.
3694	*/
3695	IEM_CIMPL_DEF_0(iemCImpl_syscall)
3696	{
3697	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3698
3699	/*
3700	* Check preconditions.
3701	*
3702	* Note that CPUs described in the documentation may load a few odd values
3703	* into CS and SS than we allow here. This has yet to be checked on real
3704	* hardware.
3705	*/
3706	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3707	{
3708	Log(("syscall: Not enabled in EFER -> #UD\n"));
3709	return iemRaiseUndefinedOpcode(pIemCpu);
3710	}
3711	if (!(pCtx->cr0 & X86_CR0_PE))
3712	{
3713	Log(("syscall: Protected mode is required -> #GP(0)\n"));
3714	return iemRaiseGeneralProtectionFault0(pIemCpu);
3715	}
3716	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3717	{
3718	Log(("syscall: Only available in long mode on intel -> #UD\n"));
3719	return iemRaiseUndefinedOpcode(pIemCpu);
3720	}
3721
3722	/** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3723	/** @todo what about LDT selectors? Shouldn't matter, really. */
3724	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3725	uint16_t uNewSs = uNewCs + 8;
3726	if (uNewCs == 0 \|\| uNewSs == 0)
3727	{
3728	Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3729	return iemRaiseGeneralProtectionFault0(pIemCpu);
3730	}
3731
3732	/* Long mode and legacy mode differs. */
3733	if (CPUMIsGuestInLongModeEx(pCtx))
3734	{
3735	uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3736
3737	/* This test isn't in the docs, but I'm not trusting the guys writing
3738	the MSRs to have validated the values as canonical like they should. */
3739	if (!IEM_IS_CANONICAL(uNewRip))
3740	{
3741	Log(("syscall: Only available in long mode on intel -> #UD\n"));
3742	return iemRaiseUndefinedOpcode(pIemCpu);
3743	}
3744
3745	/*
3746	* Commit it.
3747	*/
3748	Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3749	pCtx->rcx = pCtx->rip + cbInstr;
3750	pCtx->rip = uNewRip;
3751
3752	pCtx->rflags.u &= ~X86_EFL_RF;
3753	pCtx->r11 = pCtx->rflags.u;
3754	pCtx->rflags.u &= ~pCtx->msrSFMASK;
3755	pCtx->rflags.u \|= X86_EFL_1;
3756
3757	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
3758	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
3759	}
3760	else
3761	{
3762	/*
3763	* Commit it.
3764	*/
3765	Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3766	pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3767	pCtx->rcx = pCtx->eip + cbInstr;
3768	pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3769	pCtx->rflags.u &= ~(X86_EFL_VM \| X86_EFL_IF \| X86_EFL_RF);
3770
3771	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
3772	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
3773	}
3774	pCtx->cs.Sel = uNewCs;
3775	pCtx->cs.ValidSel = uNewCs;
3776	pCtx->cs.u64Base = 0;
3777	pCtx->cs.u32Limit = UINT32_MAX;
3778	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3779
3780	pCtx->ss.Sel = uNewSs;
3781	pCtx->ss.ValidSel = uNewSs;
3782	pCtx->ss.u64Base = 0;
3783	pCtx->ss.u32Limit = UINT32_MAX;
3784	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3785
3786	return VINF_SUCCESS;
3787	}
3788
3789
3790	/**
3791	* Implements SYSRET (AMD and Intel64).
3792	*/
3793	IEM_CIMPL_DEF_0(iemCImpl_sysret)
3794
3795	{
3796	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3797
3798	/*
3799	* Check preconditions.
3800	*
3801	* Note that CPUs described in the documentation may load a few odd values
3802	* into CS and SS than we allow here. This has yet to be checked on real
3803	* hardware.
3804	*/
3805	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3806	{
3807	Log(("sysret: Not enabled in EFER -> #UD\n"));
3808	return iemRaiseUndefinedOpcode(pIemCpu);
3809	}
3810	if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3811	{
3812	Log(("sysret: Only available in long mode on intel -> #UD\n"));
3813	return iemRaiseUndefinedOpcode(pIemCpu);
3814	}
3815	if (!(pCtx->cr0 & X86_CR0_PE))
3816	{
3817	Log(("sysret: Protected mode is required -> #GP(0)\n"));
3818	return iemRaiseGeneralProtectionFault0(pIemCpu);
3819	}
3820	if (pIemCpu->uCpl != 0)
3821	{
3822	Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
3823	return iemRaiseGeneralProtectionFault0(pIemCpu);
3824	}
3825
3826	/** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3827	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3828	uint16_t uNewSs = uNewCs + 8;
3829	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3830	uNewCs += 16;
3831	if (uNewCs == 0 \|\| uNewSs == 0)
3832	{
3833	Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3834	return iemRaiseGeneralProtectionFault0(pIemCpu);
3835	}
3836
3837	/*
3838	* Commit it.
3839	*/
3840	if (CPUMIsGuestInLongModeEx(pCtx))
3841	{
3842	if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3843	{
3844	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3845	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3846	/* Note! We disregard intel manual regarding the RCX cananonical
3847	check, ask intel+xen why AMD doesn't do it. */
3848	pCtx->rip = pCtx->rcx;
3849	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3850	\| (3 << X86DESCATTR_DPL_SHIFT);
3851	}
3852	else
3853	{
3854	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3855	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3856	pCtx->rip = pCtx->ecx;
3857	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3858	\| (3 << X86DESCATTR_DPL_SHIFT);
3859	}
3860	/** @todo testcase: See what kind of flags we can make SYSRET restore and
3861	* what it really ignores. RF and VM are hinted at being zero, by AMD. */
3862	pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS \| X86_EFL_VIF \| X86_EFL_VIP);
3863	pCtx->rflags.u \|= X86_EFL_1;
3864	}
3865	else
3866	{
3867	Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3868	pCtx->rip = pCtx->rcx;
3869	pCtx->rflags.u \|= X86_EFL_IF;
3870	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3871	\| (3 << X86DESCATTR_DPL_SHIFT);
3872	}
3873	pCtx->cs.Sel = uNewCs \| 3;
3874	pCtx->cs.ValidSel = uNewCs \| 3;
3875	pCtx->cs.u64Base = 0;
3876	pCtx->cs.u32Limit = UINT32_MAX;
3877	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3878
3879	pCtx->ss.Sel = uNewSs \| 3;
3880	pCtx->ss.ValidSel = uNewSs \| 3;
3881	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3882	/* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3883	pCtx->ss.Attr.u \|= (3 << X86DESCATTR_DPL_SHIFT);
3884	/** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3885	* on sysret. */
3886
3887	return VINF_SUCCESS;
3888	}
3889
3890
3891	/**
3892	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3893	*
3894	* @param iSegReg The segment register number (valid).
3895	* @param uSel The new selector value.
3896	*/
3897	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3898	{
3899	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
3900	uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3901	PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3902
3903	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3904
3905	/*
3906	* Real mode and V8086 mode are easy.
3907	*/
3908	if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3909	&& IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3910	{
3911	*pSel = uSel;
3912	pHid->u64Base = (uint32_t)uSel << 4;
3913	pHid->ValidSel = uSel;
3914	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3915	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3916	/** @todo Does the CPU actually load limits and attributes in the
3917	* real/V8086 mode segment load case? It doesn't for CS in far
3918	* jumps... Affects unreal mode. */
3919	pHid->u32Limit = 0xffff;
3920	pHid->Attr.u = 0;
3921	pHid->Attr.n.u1Present = 1;
3922	pHid->Attr.n.u1DescType = 1;
3923	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3924	? X86_SEL_TYPE_RW
3925	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
3926	#endif
3927	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3928	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3929	return VINF_SUCCESS;
3930	}
3931
3932	/*
3933	* Protected mode.
3934	*
3935	* Check if it's a null segment selector value first, that's OK for DS, ES,
3936	* FS and GS. If not null, then we have to load and parse the descriptor.
3937	*/
3938	if (!(uSel & X86_SEL_MASK_OFF_RPL))
3939	{
3940	Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3941	if (iSegReg == X86_SREG_SS)
3942	{
3943	/* In 64-bit kernel mode, the stack can be 0 because of the way
3944	interrupts are dispatched. AMD seems to have a slighly more
3945	relaxed relationship to SS.RPL than intel does. */
3946	/** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3947	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3948	\|\| pIemCpu->uCpl > 2
3949	\|\| ( uSel != pIemCpu->uCpl
3950	&& !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3951	{
3952	Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3953	return iemRaiseGeneralProtectionFault0(pIemCpu);
3954	}
3955	}
3956
3957	pSel = uSel; / Not RPL, remember :-) */
3958	iemHlpLoadNullDataSelectorProt(pIemCpu, pHid, uSel);
3959	if (iSegReg == X86_SREG_SS)
3960	pHid->Attr.u \|= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3961
3962	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3963	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3964
3965	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3966	return VINF_SUCCESS;
3967	}
3968
3969	/* Fetch the descriptor. */
3970	IEMSELDESC Desc;
3971	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3972	if (rcStrict != VINF_SUCCESS)
3973	return rcStrict;
3974
3975	/* Check GPs first. */
3976	if (!Desc.Legacy.Gen.u1DescType)
3977	{
3978	Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3979	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3980	}
3981	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3982	{
3983	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3984	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3985	{
3986	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3987	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3988	}
3989	if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3990	{
3991	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3992	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3993	}
3994	if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3995	{
3996	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3997	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3998	}
3999	}
4000	else
4001	{
4002	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4003	{
4004	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4005	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
4006	}
4007	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4008	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4009	{
4010	#if 0 /* this is what intel says. */
4011	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4012	&& pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4013	{
4014	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4015	iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
4016	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
4017	}
4018	#else /* this is what makes more sense. */
4019	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4020	{
4021	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4022	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4023	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
4024	}
4025	if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4026	{
4027	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4028	iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
4029	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
4030	}
4031	#endif
4032	}
4033	}
4034
4035	/* Is it there? */
4036	if (!Desc.Legacy.Gen.u1Present)
4037	{
4038	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4039	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
4040	}
4041
4042	/* The base and limit. */
4043	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4044	uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4045
4046	/*
4047	* Ok, everything checked out fine. Now set the accessed bit before
4048	* committing the result into the registers.
4049	*/
4050	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4051	{
4052	rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
4053	if (rcStrict != VINF_SUCCESS)
4054	return rcStrict;
4055	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
4056	}
4057
4058	/* commit */
4059	*pSel = uSel;
4060	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4061	pHid->u32Limit = cbLimit;
4062	pHid->u64Base = u64Base;
4063	pHid->ValidSel = uSel;
4064	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4065
4066	/** @todo check if the hidden bits are loaded correctly for 64-bit
4067	* mode. */
4068	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
4069
4070	CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
4071	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4072	return VINF_SUCCESS;
4073	}
4074
4075
4076	/**
4077	* Implements 'mov SReg, r/m'.
4078	*
4079	* @param iSegReg The segment register number (valid).
4080	* @param uSel The new selector value.
4081	*/
4082	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4083	{
4084	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4085	if (rcStrict == VINF_SUCCESS)
4086	{
4087	if (iSegReg == X86_SREG_SS)
4088	{
4089	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4090	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4091	}
4092	}
4093	return rcStrict;
4094	}
4095
4096
4097	/**
4098	* Implements 'pop SReg'.
4099	*
4100	* @param iSegReg The segment register number (valid).
4101	* @param enmEffOpSize The efficient operand size (valid).
4102	*/
4103	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4104	{
4105	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4106	VBOXSTRICTRC rcStrict;
4107
4108	/*
4109	* Read the selector off the stack and join paths with mov ss, reg.
4110	*/
4111	RTUINT64U TmpRsp;
4112	TmpRsp.u = pCtx->rsp;
4113	switch (enmEffOpSize)
4114	{
4115	case IEMMODE_16BIT:
4116	{
4117	uint16_t uSel;
4118	rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
4119	if (rcStrict == VINF_SUCCESS)
4120	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4121	break;
4122	}
4123
4124	case IEMMODE_32BIT:
4125	{
4126	uint32_t u32Value;
4127	rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
4128	if (rcStrict == VINF_SUCCESS)
4129	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4130	break;
4131	}
4132
4133	case IEMMODE_64BIT:
4134	{
4135	uint64_t u64Value;
4136	rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
4137	if (rcStrict == VINF_SUCCESS)
4138	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4139	break;
4140	}
4141	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4142	}
4143
4144	/*
4145	* Commit the stack on success.
4146	*/
4147	if (rcStrict == VINF_SUCCESS)
4148	{
4149	pCtx->rsp = TmpRsp.u;
4150	if (iSegReg == X86_SREG_SS)
4151	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4152	}
4153	return rcStrict;
4154	}
4155
4156
4157	/**
4158	* Implements lgs, lfs, les, lds & lss.
4159	*/
4160	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4161	uint16_t, uSel,
4162	uint64_t, offSeg,
4163	uint8_t, iSegReg,
4164	uint8_t, iGReg,
4165	IEMMODE, enmEffOpSize)
4166	{
4167	/PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);/
4168	VBOXSTRICTRC rcStrict;
4169
4170	/*
4171	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
4172	*/
4173	/** @todo verify and test that mov, pop and lXs works the segment
4174	* register loading in the exact same way. */
4175	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4176	if (rcStrict == VINF_SUCCESS)
4177	{
4178	switch (enmEffOpSize)
4179	{
4180	case IEMMODE_16BIT:
4181	(uint16_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
4182	break;
4183	case IEMMODE_32BIT:
4184	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
4185	break;
4186	case IEMMODE_64BIT:
4187	(uint64_t )iemGRegRef(pIemCpu, iGReg) = offSeg;
4188	break;
4189	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4190	}
4191	}
4192
4193	return rcStrict;
4194	}
4195
4196
4197	/**
4198	* Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4199	*
4200	* @retval VINF_SUCCESS on success.
4201	* @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4202	* @retval iemMemFetchSysU64 return value.
4203	*
4204	* @param pIemCpu The IEM state of the calling EMT.
4205	* @param uSel The selector value.
4206	* @param fAllowSysDesc Whether system descriptors are OK or not.
4207	* @param pDesc Where to return the descriptor on success.
4208	*/
4209	static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4210	{
4211	pDesc->Long.au64[0] = 0;
4212	pDesc->Long.au64[1] = 0;
4213
4214	if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4215	return VINF_IEM_SELECTOR_NOT_OK;
4216
4217	/* Within the table limits? */
4218	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4219	RTGCPTR GCPtrBase;
4220	if (uSel & X86_SEL_LDT)
4221	{
4222	if ( !pCtx->ldtr.Attr.n.u1Present
4223	\|\| (uSel \| X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4224	return VINF_IEM_SELECTOR_NOT_OK;
4225	GCPtrBase = pCtx->ldtr.u64Base;
4226	}
4227	else
4228	{
4229	if ((uSel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4230	return VINF_IEM_SELECTOR_NOT_OK;
4231	GCPtrBase = pCtx->gdtr.pGdt;
4232	}
4233
4234	/* Fetch the descriptor. */
4235	VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4236	if (rcStrict != VINF_SUCCESS)
4237	return rcStrict;
4238	if (!pDesc->Legacy.Gen.u1DescType)
4239	{
4240	if (!fAllowSysDesc)
4241	return VINF_IEM_SELECTOR_NOT_OK;
4242	if (CPUMIsGuestInLongModeEx(pCtx))
4243	{
4244	rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4245	if (rcStrict != VINF_SUCCESS)
4246	return rcStrict;
4247	}
4248
4249	}
4250
4251	return VINF_SUCCESS;
4252	}
4253
4254
4255	/**
4256	* Implements verr (fWrite = false) and verw (fWrite = true).
4257	*/
4258	IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4259	{
4260	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
4261
4262	/** @todo figure whether the accessed bit is set or not. */
4263
4264	bool fAccessible = true;
4265	IEMSELDESC Desc;
4266	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
4267	if (rcStrict == VINF_SUCCESS)
4268	{
4269	/* Check the descriptor, order doesn't matter much here. */
4270	if ( !Desc.Legacy.Gen.u1DescType
4271	\|\| !Desc.Legacy.Gen.u1Present)
4272	fAccessible = false;
4273	else
4274	{
4275	if ( fWrite
4276	? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4277	: (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4278	fAccessible = false;
4279
4280	/** @todo testcase for the conforming behavior. */
4281	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4282	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4283	{
4284	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4285	fAccessible = false;
4286	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4287	fAccessible = false;
4288	}
4289	}
4290
4291	}
4292	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4293	fAccessible = false;
4294	else
4295	return rcStrict;
4296
4297	/* commit */
4298	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
4299
4300	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4301	return VINF_SUCCESS;
4302	}
4303
4304
4305	/**
4306	* Implements LAR and LSL with 64-bit operand size.
4307	*
4308	* @returns VINF_SUCCESS.
4309	* @param pu16Dst Pointer to the destination register.
4310	* @param uSel The selector to load details for.
4311	* @param pEFlags Pointer to the eflags register.
4312	* @param fIsLar true = LAR, false = LSL.
4313	*/
4314	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t , pu64Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
4315	{
4316	Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
4317
4318	/** @todo figure whether the accessed bit is set or not. */
4319
4320	bool fDescOk = true;
4321	IEMSELDESC Desc;
4322	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /fAllowSysDesc/, &Desc);
4323	if (rcStrict == VINF_SUCCESS)
4324	{
4325	/*
4326	* Check the descriptor type.
4327	*/
4328	if (!Desc.Legacy.Gen.u1DescType)
4329	{
4330	if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
4331	{
4332	if (Desc.Long.Gen.u5Zeros)
4333	fDescOk = false;
4334	else
4335	switch (Desc.Long.Gen.u4Type)
4336	{
4337	/** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4338	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4339	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4340	case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4341	break;
4342	case AMD64_SEL_TYPE_SYS_CALL_GATE:
4343	fDescOk = fIsLar;
4344	break;
4345	default:
4346	fDescOk = false;
4347	break;
4348	}
4349	}
4350	else
4351	{
4352	switch (Desc.Long.Gen.u4Type)
4353	{
4354	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4355	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4356	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4357	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4358	case X86_SEL_TYPE_SYS_LDT:
4359	break;
4360	case X86_SEL_TYPE_SYS_286_CALL_GATE:
4361	case X86_SEL_TYPE_SYS_TASK_GATE:
4362	case X86_SEL_TYPE_SYS_386_CALL_GATE:
4363	fDescOk = fIsLar;
4364	break;
4365	default:
4366	fDescOk = false;
4367	break;
4368	}
4369	}
4370	}
4371	if (fDescOk)
4372	{
4373	/*
4374	* Check the RPL/DPL/CPL interaction..
4375	*/
4376	/** @todo testcase for the conforming behavior. */
4377	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)
4378	\|\| !Desc.Legacy.Gen.u1DescType)
4379	{
4380	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4381	fDescOk = false;
4382	else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
4383	fDescOk = false;
4384	}
4385	}
4386
4387	if (fDescOk)
4388	{
4389	/*
4390	* All fine, start committing the result.
4391	*/
4392	if (fIsLar)
4393	*pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4394	else
4395	*pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4396	}
4397
4398	}
4399	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4400	fDescOk = false;
4401	else
4402	return rcStrict;
4403
4404	/* commit flags value and advance rip. */
4405	pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
4406	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4407
4408	return VINF_SUCCESS;
4409	}
4410
4411
4412	/**
4413	* Implements LAR and LSL with 16-bit operand size.
4414	*
4415	* @returns VINF_SUCCESS.
4416	* @param pu16Dst Pointer to the destination register.
4417	* @param u16Sel The selector to load details for.
4418	* @param pEFlags Pointer to the eflags register.
4419	* @param fIsLar true = LAR, false = LSL.
4420	*/
4421	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t , pu16Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
4422	{
4423	uint64_t u64TmpDst = *pu16Dst;
4424	IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
4425	*pu16Dst = (uint16_t)u64TmpDst;
4426	return VINF_SUCCESS;
4427	}
4428
4429
4430	/**
4431	* Implements lgdt.
4432	*
4433	* @param iEffSeg The segment of the new gdtr contents
4434	* @param GCPtrEffSrc The address of the new gdtr contents.
4435	* @param enmEffOpSize The effective operand size.
4436	*/
4437	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4438	{
4439	if (pIemCpu->uCpl != 0)
4440	return iemRaiseGeneralProtectionFault0(pIemCpu);
4441	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4442
4443	/*
4444	* Fetch the limit and base address.
4445	*/
4446	uint16_t cbLimit;
4447	RTGCPTR GCPtrBase;
4448	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4449	if (rcStrict == VINF_SUCCESS)
4450	{
4451	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
4452	\|\| X86_IS_CANONICAL(GCPtrBase))
4453	{
4454	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4455	rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
4456	else
4457	{
4458	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4459	pCtx->gdtr.cbGdt = cbLimit;
4460	pCtx->gdtr.pGdt = GCPtrBase;
4461	}
4462	if (rcStrict == VINF_SUCCESS)
4463	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4464	}
4465	else
4466	{
4467	Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4468	return iemRaiseGeneralProtectionFault0(pIemCpu);
4469	}
4470	}
4471	return rcStrict;
4472	}
4473
4474
4475	/**
4476	* Implements sgdt.
4477	*
4478	* @param iEffSeg The segment where to store the gdtr content.
4479	* @param GCPtrEffDst The address where to store the gdtr content.
4480	*/
4481	IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4482	{
4483	/*
4484	* Join paths with sidt.
4485	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4486	* you really must know.
4487	*/
4488	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4489	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4490	if (rcStrict == VINF_SUCCESS)
4491	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4492	return rcStrict;
4493	}
4494
4495
4496	/**
4497	* Implements lidt.
4498	*
4499	* @param iEffSeg The segment of the new idtr contents
4500	* @param GCPtrEffSrc The address of the new idtr contents.
4501	* @param enmEffOpSize The effective operand size.
4502	*/
4503	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4504	{
4505	if (pIemCpu->uCpl != 0)
4506	return iemRaiseGeneralProtectionFault0(pIemCpu);
4507	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4508
4509	/*
4510	* Fetch the limit and base address.
4511	*/
4512	uint16_t cbLimit;
4513	RTGCPTR GCPtrBase;
4514	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4515	if (rcStrict == VINF_SUCCESS)
4516	{
4517	if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
4518	\|\| X86_IS_CANONICAL(GCPtrBase))
4519	{
4520	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4521	CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
4522	else
4523	{
4524	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4525	pCtx->idtr.cbIdt = cbLimit;
4526	pCtx->idtr.pIdt = GCPtrBase;
4527	}
4528	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4529	}
4530	else
4531	{
4532	Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4533	return iemRaiseGeneralProtectionFault0(pIemCpu);
4534	}
4535	}
4536	return rcStrict;
4537	}
4538
4539
4540	/**
4541	* Implements sidt.
4542	*
4543	* @param iEffSeg The segment where to store the idtr content.
4544	* @param GCPtrEffDst The address where to store the idtr content.
4545	*/
4546	IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4547	{
4548	/*
4549	* Join paths with sgdt.
4550	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4551	* you really must know.
4552	*/
4553	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4554	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4555	if (rcStrict == VINF_SUCCESS)
4556	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4557	return rcStrict;
4558	}
4559
4560
4561	/**
4562	* Implements lldt.
4563	*
4564	* @param uNewLdt The new LDT selector value.
4565	*/
4566	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4567	{
4568	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4569
4570	/*
4571	* Check preconditions.
4572	*/
4573	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4574	{
4575	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4576	return iemRaiseUndefinedOpcode(pIemCpu);
4577	}
4578	if (pIemCpu->uCpl != 0)
4579	{
4580	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
4581	return iemRaiseGeneralProtectionFault0(pIemCpu);
4582	}
4583	if (uNewLdt & X86_SEL_LDT)
4584	{
4585	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4586	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
4587	}
4588
4589	/*
4590	* Now, loading a NULL selector is easy.
4591	*/
4592	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4593	{
4594	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4595	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4596	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
4597	else
4598	pCtx->ldtr.Sel = uNewLdt;
4599	pCtx->ldtr.ValidSel = uNewLdt;
4600	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4601	if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4602	{
4603	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4604	pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4605	}
4606	else if (IEM_IS_GUEST_CPU_AMD(pIemCpu))
4607	{
4608	/* AMD-V seems to leave the base and limit alone. */
4609	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4610	}
4611	else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4612	{
4613	/* VT-x (Intel 3960x) seems to be doing the following. */
4614	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE \| X86DESCATTR_G \| X86DESCATTR_D;
4615	pCtx->ldtr.u64Base = 0;
4616	pCtx->ldtr.u32Limit = UINT32_MAX;
4617	}
4618
4619	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4620	return VINF_SUCCESS;
4621	}
4622
4623	/*
4624	* Read the descriptor.
4625	*/
4626	IEMSELDESC Desc;
4627	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4628	if (rcStrict != VINF_SUCCESS)
4629	return rcStrict;
4630
4631	/* Check GPs first. */
4632	if (Desc.Legacy.Gen.u1DescType)
4633	{
4634	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4635	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4636	}
4637	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4638	{
4639	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4640	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4641	}
4642	uint64_t u64Base;
4643	if (!IEM_IS_LONG_MODE(pIemCpu))
4644	u64Base = X86DESC_BASE(&Desc.Legacy);
4645	else
4646	{
4647	if (Desc.Long.Gen.u5Zeros)
4648	{
4649	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4650	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4651	}
4652
4653	u64Base = X86DESC64_BASE(&Desc.Long);
4654	if (!IEM_IS_CANONICAL(u64Base))
4655	{
4656	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4657	return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4658	}
4659	}
4660
4661	/* NP */
4662	if (!Desc.Legacy.Gen.u1Present)
4663	{
4664	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4665	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
4666	}
4667
4668	/*
4669	* It checks out alright, update the registers.
4670	*/
4671	/** @todo check if the actual value is loaded or if the RPL is dropped */
4672	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4673	CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
4674	else
4675	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4676	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4677	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4678	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4679	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4680	pCtx->ldtr.u64Base = u64Base;
4681
4682	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4683	return VINF_SUCCESS;
4684	}
4685
4686
4687	/**
4688	* Implements lldt.
4689	*
4690	* @param uNewLdt The new LDT selector value.
4691	*/
4692	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4693	{
4694	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4695
4696	/*
4697	* Check preconditions.
4698	*/
4699	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4700	{
4701	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4702	return iemRaiseUndefinedOpcode(pIemCpu);
4703	}
4704	if (pIemCpu->uCpl != 0)
4705	{
4706	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
4707	return iemRaiseGeneralProtectionFault0(pIemCpu);
4708	}
4709	if (uNewTr & X86_SEL_LDT)
4710	{
4711	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4712	return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
4713	}
4714	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4715	{
4716	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4717	return iemRaiseGeneralProtectionFault0(pIemCpu);
4718	}
4719
4720	/*
4721	* Read the descriptor.
4722	*/
4723	IEMSELDESC Desc;
4724	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4725	if (rcStrict != VINF_SUCCESS)
4726	return rcStrict;
4727
4728	/* Check GPs first. */
4729	if (Desc.Legacy.Gen.u1DescType)
4730	{
4731	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4732	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4733	}
4734	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4735	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4736	\|\| IEM_IS_LONG_MODE(pIemCpu)) )
4737	{
4738	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4739	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4740	}
4741	uint64_t u64Base;
4742	if (!IEM_IS_LONG_MODE(pIemCpu))
4743	u64Base = X86DESC_BASE(&Desc.Legacy);
4744	else
4745	{
4746	if (Desc.Long.Gen.u5Zeros)
4747	{
4748	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4749	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4750	}
4751
4752	u64Base = X86DESC64_BASE(&Desc.Long);
4753	if (!IEM_IS_CANONICAL(u64Base))
4754	{
4755	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4756	return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4757	}
4758	}
4759
4760	/* NP */
4761	if (!Desc.Legacy.Gen.u1Present)
4762	{
4763	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4764	return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
4765	}
4766
4767	/*
4768	* Set it busy.
4769	* Note! Intel says this should lock down the whole descriptor, but we'll
4770	* restrict our selves to 32-bit for now due to lack of inline
4771	* assembly and such.
4772	*/
4773	void *pvDesc;
4774	rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4775	if (rcStrict != VINF_SUCCESS)
4776	return rcStrict;
4777	switch ((uintptr_t)pvDesc & 3)
4778	{
4779	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4780	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4781	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4782	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4783	}
4784	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
4785	if (rcStrict != VINF_SUCCESS)
4786	return rcStrict;
4787	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4788
4789	/*
4790	* It checks out alright, update the registers.
4791	*/
4792	/** @todo check if the actual value is loaded or if the RPL is dropped */
4793	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4794	CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
4795	else
4796	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4797	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4798	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4799	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4800	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4801	pCtx->tr.u64Base = u64Base;
4802
4803	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4804	return VINF_SUCCESS;
4805	}
4806
4807
4808	/**
4809	* Implements mov GReg,CRx.
4810	*
4811	* @param iGReg The general register to store the CRx value in.
4812	* @param iCrReg The CRx register to read (valid).
4813	*/
4814	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4815	{
4816	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4817	if (pIemCpu->uCpl != 0)
4818	return iemRaiseGeneralProtectionFault0(pIemCpu);
4819	Assert(!pCtx->eflags.Bits.u1VM);
4820
4821	/* read it */
4822	uint64_t crX;
4823	switch (iCrReg)
4824	{
4825	case 0:
4826	crX = pCtx->cr0;
4827	if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
4828	crX \|= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4829	break;
4830	case 2: crX = pCtx->cr2; break;
4831	case 3: crX = pCtx->cr3; break;
4832	case 4: crX = pCtx->cr4; break;
4833	case 8:
4834	{
4835	uint8_t uTpr;
4836	int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
4837	if (RT_SUCCESS(rc))
4838	crX = uTpr >> 4;
4839	else
4840	crX = 0;
4841	break;
4842	}
4843	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4844	}
4845
4846	/* store it */
4847	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4848	(uint64_t )iemGRegRef(pIemCpu, iGReg) = crX;
4849	else
4850	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
4851
4852	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4853	return VINF_SUCCESS;
4854	}
4855
4856
4857	/**
4858	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4859	*
4860	* @param iCrReg The CRx register to write (valid).
4861	* @param uNewCrX The new value.
4862	*/
4863	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4864	{
4865	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4866	PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4867	VBOXSTRICTRC rcStrict;
4868	int rc;
4869
4870	/*
4871	* Try store it.
4872	* Unfortunately, CPUM only does a tiny bit of the work.
4873	*/
4874	switch (iCrReg)
4875	{
4876	case 0:
4877	{
4878	/*
4879	* Perform checks.
4880	*/
4881	uint64_t const uOldCrX = pCtx->cr0;
4882	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
4883	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
4884	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
4885
4886	/* ET is hardcoded on 486 and later. */
4887	if (IEM_GET_TARGET_CPU(pIemCpu) > IEMTARGETCPU_486)
4888	uNewCrX \|= X86_CR0_ET;
4889	/* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
4890	else if (IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_486)
4891	{
4892	uNewCrX &= fValid;
4893	uNewCrX \|= X86_CR0_ET;
4894	}
4895	else
4896	uNewCrX &= X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS \| X86_CR0_PG \| X86_CR0_ET;
4897
4898	/* Check for reserved bits. */
4899	if (uNewCrX & ~(uint64_t)fValid)
4900	{
4901	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4902	return iemRaiseGeneralProtectionFault0(pIemCpu);
4903	}
4904
4905	/* Check for invalid combinations. */
4906	if ( (uNewCrX & X86_CR0_PG)
4907	&& !(uNewCrX & X86_CR0_PE) )
4908	{
4909	Log(("Trying to set CR0.PG without CR0.PE\n"));
4910	return iemRaiseGeneralProtectionFault0(pIemCpu);
4911	}
4912
4913	if ( !(uNewCrX & X86_CR0_CD)
4914	&& (uNewCrX & X86_CR0_NW) )
4915	{
4916	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4917	return iemRaiseGeneralProtectionFault0(pIemCpu);
4918	}
4919
4920	/* Long mode consistency checks. */
4921	if ( (uNewCrX & X86_CR0_PG)
4922	&& !(uOldCrX & X86_CR0_PG)
4923	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4924	{
4925	if (!(pCtx->cr4 & X86_CR4_PAE))
4926	{
4927	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4928	return iemRaiseGeneralProtectionFault0(pIemCpu);
4929	}
4930	if (pCtx->cs.Attr.n.u1Long)
4931	{
4932	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4933	return iemRaiseGeneralProtectionFault0(pIemCpu);
4934	}
4935	}
4936
4937	/** @todo check reserved PDPTR bits as AMD states. */
4938
4939	/*
4940	* Change CR0.
4941	*/
4942	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4943	CPUMSetGuestCR0(pVCpu, uNewCrX);
4944	else
4945	pCtx->cr0 = uNewCrX;
4946	Assert(pCtx->cr0 == uNewCrX);
4947
4948	/*
4949	* Change EFER.LMA if entering or leaving long mode.
4950	*/
4951	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4952	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4953	{
4954	uint64_t NewEFER = pCtx->msrEFER;
4955	if (uNewCrX & X86_CR0_PG)
4956	NewEFER \|= MSR_K6_EFER_LMA;
4957	else
4958	NewEFER &= ~MSR_K6_EFER_LMA;
4959
4960	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4961	CPUMSetGuestEFER(pVCpu, NewEFER);
4962	else
4963	pCtx->msrEFER = NewEFER;
4964	Assert(pCtx->msrEFER == NewEFER);
4965	}
4966
4967	/*
4968	* Inform PGM.
4969	*/
4970	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4971	{
4972	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
4973	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
4974	{
4975	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4976	AssertRCReturn(rc, rc);
4977	/* ignore informational status codes */
4978	}
4979	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4980	}
4981	else
4982	rcStrict = VINF_SUCCESS;
4983
4984	#ifdef IN_RC
4985	/* Return to ring-3 for rescheduling if WP or AM changes. */
4986	if ( rcStrict == VINF_SUCCESS
4987	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
4988	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
4989	rcStrict = VINF_EM_RESCHEDULE;
4990	#endif
4991	break;
4992	}
4993
4994	/*
4995	* CR2 can be changed without any restrictions.
4996	*/
4997	case 2:
4998	pCtx->cr2 = uNewCrX;
4999	rcStrict = VINF_SUCCESS;
5000	break;
5001
5002	/*
5003	* CR3 is relatively simple, although AMD and Intel have different
5004	* accounts of how setting reserved bits are handled. We take intel's
5005	* word for the lower bits and AMD's for the high bits (63:52). The
5006	* lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5007	* on this.
5008	*/
5009	/** @todo Testcase: Setting reserved bits in CR3, especially before
5010	* enabling paging. */
5011	case 3:
5012	{
5013	/* check / mask the value. */
5014	if (uNewCrX & UINT64_C(0xfff0000000000000))
5015	{
5016	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5017	return iemRaiseGeneralProtectionFault0(pIemCpu);
5018	}
5019
5020	uint64_t fValid;
5021	if ( (pCtx->cr4 & X86_CR4_PAE)
5022	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
5023	fValid = UINT64_C(0x000fffffffffffff);
5024	else
5025	fValid = UINT64_C(0xffffffff);
5026	if (uNewCrX & ~fValid)
5027	{
5028	Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5029	uNewCrX, uNewCrX & ~fValid));
5030	uNewCrX &= fValid;
5031	}
5032
5033	/** @todo If we're in PAE mode we should check the PDPTRs for
5034	* invalid bits. */
5035
5036	/* Make the change. */
5037	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5038	{
5039	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5040	AssertRCSuccessReturn(rc, rc);
5041	}
5042	else
5043	pCtx->cr3 = uNewCrX;
5044
5045	/* Inform PGM. */
5046	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5047	{
5048	if (pCtx->cr0 & X86_CR0_PG)
5049	{
5050	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5051	AssertRCReturn(rc, rc);
5052	/* ignore informational status codes */
5053	}
5054	}
5055	rcStrict = VINF_SUCCESS;
5056	break;
5057	}
5058
5059	/*
5060	* CR4 is a bit more tedious as there are bits which cannot be cleared
5061	* under some circumstances and such.
5062	*/
5063	case 4:
5064	{
5065	uint64_t const uOldCrX = pCtx->cr4;
5066
5067	/** @todo Shouldn't this look at the guest CPUID bits to determine
5068	* valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5069	* should #GP(0). */
5070	/* reserved bits */
5071	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
5072	\| X86_CR4_TSD \| X86_CR4_DE
5073	\| X86_CR4_PSE \| X86_CR4_PAE
5074	\| X86_CR4_MCE \| X86_CR4_PGE
5075	\| X86_CR4_PCE \| X86_CR4_OSFXSR
5076	\| X86_CR4_OSXMMEEXCPT;
5077	//if (xxx)
5078	// fValid \|= X86_CR4_VMXE;
5079	if (IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fXSaveRstor)
5080	fValid \|= X86_CR4_OSXSAVE;
5081	if (uNewCrX & ~(uint64_t)fValid)
5082	{
5083	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5084	return iemRaiseGeneralProtectionFault0(pIemCpu);
5085	}
5086
5087	/* long mode checks. */
5088	if ( (uOldCrX & X86_CR4_PAE)
5089	&& !(uNewCrX & X86_CR4_PAE)
5090	&& CPUMIsGuestInLongModeEx(pCtx) )
5091	{
5092	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5093	return iemRaiseGeneralProtectionFault0(pIemCpu);
5094	}
5095
5096
5097	/*
5098	* Change it.
5099	*/
5100	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5101	{
5102	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5103	AssertRCSuccessReturn(rc, rc);
5104	}
5105	else
5106	pCtx->cr4 = uNewCrX;
5107	Assert(pCtx->cr4 == uNewCrX);
5108
5109	/*
5110	* Notify SELM and PGM.
5111	*/
5112	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5113	{
5114	/* SELM - VME may change things wrt to the TSS shadowing. */
5115	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5116	{
5117	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5118	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5119	#ifdef VBOX_WITH_RAW_MODE
5120	if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
5121	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5122	#endif
5123	}
5124
5125	/* PGM - flushing and mode. */
5126	if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_PGE))
5127	{
5128	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5129	AssertRCReturn(rc, rc);
5130	/* ignore informational status codes */
5131	}
5132	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5133	}
5134	else
5135	rcStrict = VINF_SUCCESS;
5136	break;
5137	}
5138
5139	/*
5140	* CR8 maps to the APIC TPR.
5141	*/
5142	case 8:
5143	if (uNewCrX & ~(uint64_t)0xf)
5144	{
5145	Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5146	return iemRaiseGeneralProtectionFault0(pIemCpu);
5147	}
5148
5149	if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
5150	PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
5151	rcStrict = VINF_SUCCESS;
5152	break;
5153
5154	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5155	}
5156
5157	/*
5158	* Advance the RIP on success.
5159	*/
5160	if (RT_SUCCESS(rcStrict))
5161	{
5162	if (rcStrict != VINF_SUCCESS)
5163	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5164	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5165	}
5166
5167	return rcStrict;
5168	}
5169
5170
5171	/**
5172	* Implements mov CRx,GReg.
5173	*
5174	* @param iCrReg The CRx register to write (valid).
5175	* @param iGReg The general register to load the DRx value from.
5176	*/
5177	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5178	{
5179	if (pIemCpu->uCpl != 0)
5180	return iemRaiseGeneralProtectionFault0(pIemCpu);
5181	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5182
5183	/*
5184	* Read the new value from the source register and call common worker.
5185	*/
5186	uint64_t uNewCrX;
5187	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5188	uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
5189	else
5190	uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
5191	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5192	}
5193
5194
5195	/**
5196	* Implements 'LMSW r/m16'
5197	*
5198	* @param u16NewMsw The new value.
5199	*/
5200	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5201	{
5202	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5203
5204	if (pIemCpu->uCpl != 0)
5205	return iemRaiseGeneralProtectionFault0(pIemCpu);
5206	Assert(!pCtx->eflags.Bits.u1VM);
5207
5208	/*
5209	* Compose the new CR0 value and call common worker.
5210	*/
5211	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
5212	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
5213	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
5214	}
5215
5216
5217	/**
5218	* Implements 'CLTS'.
5219	*/
5220	IEM_CIMPL_DEF_0(iemCImpl_clts)
5221	{
5222	if (pIemCpu->uCpl != 0)
5223	return iemRaiseGeneralProtectionFault0(pIemCpu);
5224
5225	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5226	uint64_t uNewCr0 = pCtx->cr0;
5227	uNewCr0 &= ~X86_CR0_TS;
5228	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
5229	}
5230
5231
5232	/**
5233	* Implements mov GReg,DRx.
5234	*
5235	* @param iGReg The general register to store the DRx value in.
5236	* @param iDrReg The DRx register to read (0-7).
5237	*/
5238	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5239	{
5240	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5241
5242	/*
5243	* Check preconditions.
5244	*/
5245
5246	/* Raise GPs. */
5247	if (pIemCpu->uCpl != 0)
5248	return iemRaiseGeneralProtectionFault0(pIemCpu);
5249	Assert(!pCtx->eflags.Bits.u1VM);
5250
5251	if ( (iDrReg == 4 \|\| iDrReg == 5)
5252	&& (pCtx->cr4 & X86_CR4_DE) )
5253	{
5254	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5255	return iemRaiseGeneralProtectionFault0(pIemCpu);
5256	}
5257
5258	/* Raise #DB if general access detect is enabled. */
5259	if (pCtx->dr[7] & X86_DR7_GD)
5260	{
5261	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5262	return iemRaiseDebugException(pIemCpu);
5263	}
5264
5265	/*
5266	* Read the debug register and store it in the specified general register.
5267	*/
5268	uint64_t drX;
5269	switch (iDrReg)
5270	{
5271	case 0: drX = pCtx->dr[0]; break;
5272	case 1: drX = pCtx->dr[1]; break;
5273	case 2: drX = pCtx->dr[2]; break;
5274	case 3: drX = pCtx->dr[3]; break;
5275	case 6:
5276	case 4:
5277	drX = pCtx->dr[6];
5278	drX \|= X86_DR6_RA1_MASK;
5279	drX &= ~X86_DR6_RAZ_MASK;
5280	break;
5281	case 7:
5282	case 5:
5283	drX = pCtx->dr[7];
5284	drX \|=X86_DR7_RA1_MASK;
5285	drX &= ~X86_DR7_RAZ_MASK;
5286	break;
5287	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5288	}
5289
5290	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5291	(uint64_t )iemGRegRef(pIemCpu, iGReg) = drX;
5292	else
5293	(uint64_t )iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
5294
5295	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5296	return VINF_SUCCESS;
5297	}
5298
5299
5300	/**
5301	* Implements mov DRx,GReg.
5302	*
5303	* @param iDrReg The DRx register to write (valid).
5304	* @param iGReg The general register to load the DRx value from.
5305	*/
5306	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5307	{
5308	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5309
5310	/*
5311	* Check preconditions.
5312	*/
5313	if (pIemCpu->uCpl != 0)
5314	return iemRaiseGeneralProtectionFault0(pIemCpu);
5315	Assert(!pCtx->eflags.Bits.u1VM);
5316
5317	if (iDrReg == 4 \|\| iDrReg == 5)
5318	{
5319	if (pCtx->cr4 & X86_CR4_DE)
5320	{
5321	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5322	return iemRaiseGeneralProtectionFault0(pIemCpu);
5323	}
5324	iDrReg += 2;
5325	}
5326
5327	/* Raise #DB if general access detect is enabled. */
5328	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5329	* \#GP? */
5330	if (pCtx->dr[7] & X86_DR7_GD)
5331	{
5332	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5333	return iemRaiseDebugException(pIemCpu);
5334	}
5335
5336	/*
5337	* Read the new value from the source register.
5338	*/
5339	uint64_t uNewDrX;
5340	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5341	uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
5342	else
5343	uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
5344
5345	/*
5346	* Adjust it.
5347	*/
5348	switch (iDrReg)
5349	{
5350	case 0:
5351	case 1:
5352	case 2:
5353	case 3:
5354	/* nothing to adjust */
5355	break;
5356
5357	case 6:
5358	if (uNewDrX & X86_DR6_MBZ_MASK)
5359	{
5360	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5361	return iemRaiseGeneralProtectionFault0(pIemCpu);
5362	}
5363	uNewDrX \|= X86_DR6_RA1_MASK;
5364	uNewDrX &= ~X86_DR6_RAZ_MASK;
5365	break;
5366
5367	case 7:
5368	if (uNewDrX & X86_DR7_MBZ_MASK)
5369	{
5370	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5371	return iemRaiseGeneralProtectionFault0(pIemCpu);
5372	}
5373	uNewDrX \|= X86_DR7_RA1_MASK;
5374	uNewDrX &= ~X86_DR7_RAZ_MASK;
5375	break;
5376
5377	IEM_NOT_REACHED_DEFAULT_CASE_RET();
5378	}
5379
5380	/*
5381	* Do the actual setting.
5382	*/
5383	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5384	{
5385	int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
5386	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5387	}
5388	else
5389	pCtx->dr[iDrReg] = uNewDrX;
5390
5391	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5392	return VINF_SUCCESS;
5393	}
5394
5395
5396	/**
5397	* Implements 'INVLPG m'.
5398	*
5399	* @param GCPtrPage The effective address of the page to invalidate.
5400	* @remarks Updates the RIP.
5401	*/
5402	IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5403	{
5404	/* ring-0 only. */
5405	if (pIemCpu->uCpl != 0)
5406	return iemRaiseGeneralProtectionFault0(pIemCpu);
5407	Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5408
5409	int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
5410	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5411
5412	if (rc == VINF_SUCCESS)
5413	return VINF_SUCCESS;
5414	if (rc == VINF_PGM_SYNC_CR3)
5415	return iemSetPassUpStatus(pIemCpu, rc);
5416
5417	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5418	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5419	return rc;
5420	}
5421
5422
5423	/**
5424	* Implements RDTSC.
5425	*/
5426	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5427	{
5428	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5429
5430	/*
5431	* Check preconditions.
5432	*/
5433	if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fTsc)
5434	return iemRaiseUndefinedOpcode(pIemCpu);
5435
5436	if ( (pCtx->cr4 & X86_CR4_TSD)
5437	&& pIemCpu->uCpl != 0)
5438	{
5439	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
5440	return iemRaiseGeneralProtectionFault0(pIemCpu);
5441	}
5442
5443	/*
5444	* Do the job.
5445	*/
5446	uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
5447	pCtx->rax = (uint32_t)uTicks;
5448	pCtx->rdx = uTicks >> 32;
5449	#ifdef IEM_VERIFICATION_MODE_FULL
5450	pIemCpu->fIgnoreRaxRdx = true;
5451	#endif
5452
5453	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5454	return VINF_SUCCESS;
5455	}
5456
5457
5458	/**
5459	* Implements RDMSR.
5460	*/
5461	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5462	{
5463	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5464
5465	/*
5466	* Check preconditions.
5467	*/
5468	if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
5469	return iemRaiseUndefinedOpcode(pIemCpu);
5470	if (pIemCpu->uCpl != 0)
5471	return iemRaiseGeneralProtectionFault0(pIemCpu);
5472
5473	/*
5474	* Do the job.
5475	*/
5476	RTUINT64U uValue;
5477	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
5478	if (rcStrict == VINF_SUCCESS)
5479	{
5480	pCtx->rax = uValue.s.Lo;
5481	pCtx->rdx = uValue.s.Hi;
5482
5483	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5484	return VINF_SUCCESS;
5485	}
5486
5487	#ifndef IN_RING3
5488	/* Deferred to ring-3. */
5489	if (rcStrict == VINF_CPUM_R3_MSR_READ)
5490	{
5491	Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5492	return rcStrict;
5493	}
5494	#else /* IN_RING3 */
5495	/* Often a unimplemented MSR or MSR bit, so worth logging. */
5496	static uint32_t s_cTimes = 0;
5497	if (s_cTimes++ < 10)
5498	LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5499	else
5500	#endif
5501	Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5502	AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5503	return iemRaiseGeneralProtectionFault0(pIemCpu);
5504	}
5505
5506
5507	/**
5508	* Implements WRMSR.
5509	*/
5510	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5511	{
5512	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5513
5514	/*
5515	* Check preconditions.
5516	*/
5517	if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
5518	return iemRaiseUndefinedOpcode(pIemCpu);
5519	if (pIemCpu->uCpl != 0)
5520	return iemRaiseGeneralProtectionFault0(pIemCpu);
5521
5522	/*
5523	* Do the job.
5524	*/
5525	RTUINT64U uValue;
5526	uValue.s.Lo = pCtx->eax;
5527	uValue.s.Hi = pCtx->edx;
5528
5529	VBOXSTRICTRC rcStrict;
5530	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5531	rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
5532	else
5533	{
5534	#ifdef IN_RING3
5535	CPUMCTX CtxTmp = *pCtx;
5536	rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
5537	PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
5538	pCtx = pCtx2;
5539	*pCtx2 = CtxTmp;
5540	#else
5541	AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5542	#endif
5543	}
5544	if (rcStrict == VINF_SUCCESS)
5545	{
5546	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5547	return VINF_SUCCESS;
5548	}
5549
5550	#ifndef IN_RING3
5551	/* Deferred to ring-3. */
5552	if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5553	{
5554	Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5555	return rcStrict;
5556	}
5557	#else /* IN_RING3 */
5558	/* Often a unimplemented MSR or MSR bit, so worth logging. */
5559	static uint32_t s_cTimes = 0;
5560	if (s_cTimes++ < 10)
5561	LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5562	else
5563	#endif
5564	Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5565	AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5566	return iemRaiseGeneralProtectionFault0(pIemCpu);
5567	}
5568
5569
5570	/**
5571	* Implements 'IN eAX, port'.
5572	*
5573	* @param u16Port The source port.
5574	* @param cbReg The register size.
5575	*/
5576	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5577	{
5578	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5579
5580	/*
5581	* CPL check
5582	*/
5583	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
5584	if (rcStrict != VINF_SUCCESS)
5585	return rcStrict;
5586
5587	/*
5588	* Perform the I/O.
5589	*/
5590	uint32_t u32Value;
5591	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5592	rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
5593	else
5594	rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
5595	if (IOM_SUCCESS(rcStrict))
5596	{
5597	switch (cbReg)
5598	{
5599	case 1: pCtx->al = (uint8_t)u32Value; break;
5600	case 2: pCtx->ax = (uint16_t)u32Value; break;
5601	case 4: pCtx->rax = u32Value; break;
5602	default: AssertFailedReturn(VERR_IEM_IPE_3);
5603	}
5604	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5605	pIemCpu->cPotentialExits++;
5606	if (rcStrict != VINF_SUCCESS)
5607	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5608	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5609
5610	/*
5611	* Check for I/O breakpoints.
5612	*/
5613	uint32_t const uDr7 = pCtx->dr[7];
5614	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5615	&& X86_DR7_ANY_RW_IO(uDr7)
5616	&& (pCtx->cr4 & X86_CR4_DE))
5617	\|\| DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
5618	{
5619	rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
5620	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5621	rcStrict = iemRaiseDebugException(pIemCpu);
5622	}
5623	}
5624
5625	return rcStrict;
5626	}
5627
5628
5629	/**
5630	* Implements 'IN eAX, DX'.
5631	*
5632	* @param cbReg The register size.
5633	*/
5634	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5635	{
5636	return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
5637	}
5638
5639
5640	/**
5641	* Implements 'OUT port, eAX'.
5642	*
5643	* @param u16Port The destination port.
5644	* @param cbReg The register size.
5645	*/
5646	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5647	{
5648	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5649
5650	/*
5651	* CPL check
5652	*/
5653	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
5654	if (rcStrict != VINF_SUCCESS)
5655	return rcStrict;
5656
5657	/*
5658	* Perform the I/O.
5659	*/
5660	uint32_t u32Value;
5661	switch (cbReg)
5662	{
5663	case 1: u32Value = pCtx->al; break;
5664	case 2: u32Value = pCtx->ax; break;
5665	case 4: u32Value = pCtx->eax; break;
5666	default: AssertFailedReturn(VERR_IEM_IPE_4);
5667	}
5668	if (!IEM_VERIFICATION_ENABLED(pIemCpu))
5669	rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
5670	else
5671	rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
5672	if (IOM_SUCCESS(rcStrict))
5673	{
5674	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5675	pIemCpu->cPotentialExits++;
5676	if (rcStrict != VINF_SUCCESS)
5677	rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
5678	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5679
5680	/*
5681	* Check for I/O breakpoints.
5682	*/
5683	uint32_t const uDr7 = pCtx->dr[7];
5684	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5685	&& X86_DR7_ANY_RW_IO(uDr7)
5686	&& (pCtx->cr4 & X86_CR4_DE))
5687	\|\| DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
5688	{
5689	rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
5690	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5691	rcStrict = iemRaiseDebugException(pIemCpu);
5692	}
5693	}
5694	return rcStrict;
5695	}
5696
5697
5698	/**
5699	* Implements 'OUT DX, eAX'.
5700	*
5701	* @param cbReg The register size.
5702	*/
5703	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5704	{
5705	return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
5706	}
5707
5708
5709	/**
5710	* Implements 'CLI'.
5711	*/
5712	IEM_CIMPL_DEF_0(iemCImpl_cli)
5713	{
5714	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5715	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
5716	uint32_t const fEflOld = fEfl;
5717	if (pCtx->cr0 & X86_CR0_PE)
5718	{
5719	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5720	if (!(fEfl & X86_EFL_VM))
5721	{
5722	if (pIemCpu->uCpl <= uIopl)
5723	fEfl &= ~X86_EFL_IF;
5724	else if ( pIemCpu->uCpl == 3
5725	&& (pCtx->cr4 & X86_CR4_PVI) )
5726	fEfl &= ~X86_EFL_VIF;
5727	else
5728	return iemRaiseGeneralProtectionFault0(pIemCpu);
5729	}
5730	/* V8086 */
5731	else if (uIopl == 3)
5732	fEfl &= ~X86_EFL_IF;
5733	else if ( uIopl < 3
5734	&& (pCtx->cr4 & X86_CR4_VME) )
5735	fEfl &= ~X86_EFL_VIF;
5736	else
5737	return iemRaiseGeneralProtectionFault0(pIemCpu);
5738	}
5739	/* real mode */
5740	else
5741	fEfl &= ~X86_EFL_IF;
5742
5743	/* Commit. */
5744	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
5745	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5746	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5747	return VINF_SUCCESS;
5748	}
5749
5750
5751	/**
5752	* Implements 'STI'.
5753	*/
5754	IEM_CIMPL_DEF_0(iemCImpl_sti)
5755	{
5756	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5757	uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
5758	uint32_t const fEflOld = fEfl;
5759
5760	if (pCtx->cr0 & X86_CR0_PE)
5761	{
5762	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5763	if (!(fEfl & X86_EFL_VM))
5764	{
5765	if (pIemCpu->uCpl <= uIopl)
5766	fEfl \|= X86_EFL_IF;
5767	else if ( pIemCpu->uCpl == 3
5768	&& (pCtx->cr4 & X86_CR4_PVI)
5769	&& !(fEfl & X86_EFL_VIP) )
5770	fEfl \|= X86_EFL_VIF;
5771	else
5772	return iemRaiseGeneralProtectionFault0(pIemCpu);
5773	}
5774	/* V8086 */
5775	else if (uIopl == 3)
5776	fEfl \|= X86_EFL_IF;
5777	else if ( uIopl < 3
5778	&& (pCtx->cr4 & X86_CR4_VME)
5779	&& !(fEfl & X86_EFL_VIP) )
5780	fEfl \|= X86_EFL_VIF;
5781	else
5782	return iemRaiseGeneralProtectionFault0(pIemCpu);
5783	}
5784	/* real mode */
5785	else
5786	fEfl \|= X86_EFL_IF;
5787
5788	/* Commit. */
5789	IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
5790	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5791	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
5792	EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
5793	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5794	return VINF_SUCCESS;
5795	}
5796
5797
5798	/**
5799	* Implements 'HLT'.
5800	*/
5801	IEM_CIMPL_DEF_0(iemCImpl_hlt)
5802	{
5803	if (pIemCpu->uCpl != 0)
5804	return iemRaiseGeneralProtectionFault0(pIemCpu);
5805	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5806	return VINF_EM_HALT;
5807	}
5808
5809
5810	/**
5811	* Implements 'MONITOR'.
5812	*/
5813	IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5814	{
5815	/*
5816	* Permission checks.
5817	*/
5818	if (pIemCpu->uCpl != 0)
5819	{
5820	Log2(("monitor: CPL != 0\n"));
5821	return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5822	}
5823	if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
5824	{
5825	Log2(("monitor: Not in CPUID\n"));
5826	return iemRaiseUndefinedOpcode(pIemCpu);
5827	}
5828
5829	/*
5830	* Gather the operands and validate them.
5831	*/
5832	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5833	RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5834	uint32_t uEcx = pCtx->ecx;
5835	uint32_t uEdx = pCtx->edx;
5836	/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5837	* \#GP first. */
5838	if (uEcx != 0)
5839	{
5840	Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
5841	return iemRaiseGeneralProtectionFault0(pIemCpu);
5842	}
5843
5844	VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
5845	if (rcStrict != VINF_SUCCESS)
5846	return rcStrict;
5847
5848	RTGCPHYS GCPhysMem;
5849	rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, &GCPhysMem);
5850	if (rcStrict != VINF_SUCCESS)
5851	return rcStrict;
5852
5853	/*
5854	* Call EM to prepare the monitor/wait.
5855	*/
5856	rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
5857	Assert(rcStrict == VINF_SUCCESS);
5858
5859	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5860	return rcStrict;
5861	}
5862
5863
5864	/**
5865	* Implements 'MWAIT'.
5866	*/
5867	IEM_CIMPL_DEF_0(iemCImpl_mwait)
5868	{
5869	/*
5870	* Permission checks.
5871	*/
5872	if (pIemCpu->uCpl != 0)
5873	{
5874	Log2(("mwait: CPL != 0\n"));
5875	/** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
5876	* EFLAGS.VM then.) */
5877	return iemRaiseUndefinedOpcode(pIemCpu);
5878	}
5879	if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
5880	{
5881	Log2(("mwait: Not in CPUID\n"));
5882	return iemRaiseUndefinedOpcode(pIemCpu);
5883	}
5884
5885	/*
5886	* Gather the operands and validate them.
5887	*/
5888	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5889	uint32_t uEax = pCtx->eax;
5890	uint32_t uEcx = pCtx->ecx;
5891	if (uEcx != 0)
5892	{
5893	/* Only supported extension is break on IRQ when IF=0. */
5894	if (uEcx > 1)
5895	{
5896	Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5897	return iemRaiseGeneralProtectionFault0(pIemCpu);
5898	}
5899	uint32_t fMWaitFeatures = 0;
5900	uint32_t uIgnore = 0;
5901	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5902	if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5903	!= (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5904	{
5905	Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5906	return iemRaiseGeneralProtectionFault0(pIemCpu);
5907	}
5908	}
5909
5910	/*
5911	* Call EM to prepare the monitor/wait.
5912	*/
5913	VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
5914
5915	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5916	return rcStrict;
5917	}
5918
5919
5920	/**
5921	* Implements 'SWAPGS'.
5922	*/
5923	IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5924	{
5925	Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5926
5927	/*
5928	* Permission checks.
5929	*/
5930	if (pIemCpu->uCpl != 0)
5931	{
5932	Log2(("swapgs: CPL != 0\n"));
5933	return iemRaiseUndefinedOpcode(pIemCpu);
5934	}
5935
5936	/*
5937	* Do the job.
5938	*/
5939	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5940	uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5941	pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5942	pCtx->gs.u64Base = uOtherGsBase;
5943
5944	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5945	return VINF_SUCCESS;
5946	}
5947
5948
5949	/**
5950	* Implements 'CPUID'.
5951	*/
5952	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5953	{
5954	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5955
5956	CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5957	pCtx->rax &= UINT32_C(0xffffffff);
5958	pCtx->rbx &= UINT32_C(0xffffffff);
5959	pCtx->rcx &= UINT32_C(0xffffffff);
5960	pCtx->rdx &= UINT32_C(0xffffffff);
5961
5962	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5963	return VINF_SUCCESS;
5964	}
5965
5966
5967	/**
5968	* Implements 'AAD'.
5969	*
5970	* @param bImm The immediate operand.
5971	*/
5972	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5973	{
5974	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5975
5976	uint16_t const ax = pCtx->ax;
5977	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5978	pCtx->ax = al;
5979	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5980	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
5981	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
5982
5983	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5984	return VINF_SUCCESS;
5985	}
5986
5987
5988	/**
5989	* Implements 'AAM'.
5990	*
5991	* @param bImm The immediate operand. Cannot be 0.
5992	*/
5993	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5994	{
5995	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5996	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5997
5998	uint16_t const ax = pCtx->ax;
5999	uint8_t const al = (uint8_t)ax % bImm;
6000	uint8_t const ah = (uint8_t)ax / bImm;
6001	pCtx->ax = (ah << 8) + al;
6002	iemHlpUpdateArithEFlagsU8(pIemCpu, al,
6003	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
6004	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
6005
6006	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6007	return VINF_SUCCESS;
6008	}
6009
6010
6011	/**
6012	* Implements 'DAA'.
6013	*/
6014	IEM_CIMPL_DEF_0(iemCImpl_daa)
6015	{
6016	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6017
6018	uint8_t const al = pCtx->al;
6019	bool const fCarry = pCtx->eflags.Bits.u1CF;
6020
6021	if ( pCtx->eflags.Bits.u1AF
6022	\|\| (al & 0xf) >= 10)
6023	{
6024	pCtx->al = al + 6;
6025	pCtx->eflags.Bits.u1AF = 1;
6026	}
6027	else
6028	pCtx->eflags.Bits.u1AF = 0;
6029
6030	if (al >= 0x9a \|\| fCarry)
6031	{
6032	pCtx->al += 0x60;
6033	pCtx->eflags.Bits.u1CF = 1;
6034	}
6035	else
6036	pCtx->eflags.Bits.u1CF = 0;
6037
6038	iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF, X86_EFL_OF);
6039	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6040	return VINF_SUCCESS;
6041	}
6042
6043
6044	/**
6045	* Implements 'DAS'.
6046	*/
6047	IEM_CIMPL_DEF_0(iemCImpl_das)
6048	{
6049	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6050
6051	uint8_t const uInputAL = pCtx->al;
6052	bool const fCarry = pCtx->eflags.Bits.u1CF;
6053
6054	if ( pCtx->eflags.Bits.u1AF
6055	\|\| (uInputAL & 0xf) >= 10)
6056	{
6057	pCtx->eflags.Bits.u1AF = 1;
6058	if (uInputAL < 6)
6059	pCtx->eflags.Bits.u1CF = 1;
6060	pCtx->al = uInputAL - 6;
6061	}
6062	else
6063	{
6064	pCtx->eflags.Bits.u1AF = 0;
6065	pCtx->eflags.Bits.u1CF = 0;
6066	}
6067
6068	if (uInputAL >= 0x9a \|\| fCarry)
6069	{
6070	pCtx->al -= 0x60;
6071	pCtx->eflags.Bits.u1CF = 1;
6072	}
6073
6074	iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF, X86_EFL_OF);
6075	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6076	return VINF_SUCCESS;
6077	}
6078
6079
6080
6081
6082	/*
6083	* Instantiate the various string operation combinations.
6084	*/
6085	#define OP_SIZE 8
6086	#define ADDR_SIZE 16
6087	#include "IEMAllCImplStrInstr.cpp.h"
6088	#define OP_SIZE 8
6089	#define ADDR_SIZE 32
6090	#include "IEMAllCImplStrInstr.cpp.h"
6091	#define OP_SIZE 8
6092	#define ADDR_SIZE 64
6093	#include "IEMAllCImplStrInstr.cpp.h"
6094
6095	#define OP_SIZE 16
6096	#define ADDR_SIZE 16
6097	#include "IEMAllCImplStrInstr.cpp.h"
6098	#define OP_SIZE 16
6099	#define ADDR_SIZE 32
6100	#include "IEMAllCImplStrInstr.cpp.h"
6101	#define OP_SIZE 16
6102	#define ADDR_SIZE 64
6103	#include "IEMAllCImplStrInstr.cpp.h"
6104
6105	#define OP_SIZE 32
6106	#define ADDR_SIZE 16
6107	#include "IEMAllCImplStrInstr.cpp.h"
6108	#define OP_SIZE 32
6109	#define ADDR_SIZE 32
6110	#include "IEMAllCImplStrInstr.cpp.h"
6111	#define OP_SIZE 32
6112	#define ADDR_SIZE 64
6113	#include "IEMAllCImplStrInstr.cpp.h"
6114
6115	#define OP_SIZE 64
6116	#define ADDR_SIZE 32
6117	#include "IEMAllCImplStrInstr.cpp.h"
6118	#define OP_SIZE 64
6119	#define ADDR_SIZE 64
6120	#include "IEMAllCImplStrInstr.cpp.h"
6121
6122
6123	/**
6124	* Implements 'XGETBV'.
6125	*/
6126	IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6127	{
6128	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6129	if (pCtx->cr4 & X86_CR4_OSXSAVE)
6130	{
6131	uint32_t uEcx = pCtx->ecx;
6132	switch (uEcx)
6133	{
6134	case 0:
6135	break;
6136
6137	case 1: /** @todo Implement XCR1 support. */
6138	default:
6139	Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6140	return iemRaiseGeneralProtectionFault0(pIemCpu);
6141
6142	}
6143	pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6144	pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6145
6146	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6147	return VINF_SUCCESS;
6148	}
6149	Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6150	return iemRaiseUndefinedOpcode(pIemCpu);
6151	}
6152
6153
6154	/**
6155	* Implements 'XSETBV'.
6156	*/
6157	IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6158	{
6159	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6160	if (pCtx->cr4 & X86_CR4_OSXSAVE)
6161	{
6162	if (pIemCpu->uCpl == 0)
6163	{
6164	uint32_t uEcx = pCtx->ecx;
6165	uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6166	switch (uEcx)
6167	{
6168	case 0:
6169	{
6170	int rc = CPUMSetGuestXcr0(IEMCPU_TO_VMCPU(pIemCpu), uNewValue);
6171	if (rc == VINF_SUCCESS)
6172	break;
6173	Assert(rc == VERR_CPUM_RAISE_GP_0);
6174	Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6175	return iemRaiseGeneralProtectionFault0(pIemCpu);
6176	}
6177
6178	case 1: /** @todo Implement XCR1 support. */
6179	default:
6180	Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6181	return iemRaiseGeneralProtectionFault0(pIemCpu);
6182
6183	}
6184
6185	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6186	return VINF_SUCCESS;
6187	}
6188
6189	Log(("xsetbv cpl=%u -> GP(0)\n", pIemCpu->uCpl));
6190	return iemRaiseGeneralProtectionFault0(pIemCpu);
6191	}
6192	Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6193	return iemRaiseUndefinedOpcode(pIemCpu);
6194	}
6195
6196
6197
6198	/**
6199	* Implements 'FINIT' and 'FNINIT'.
6200	*
6201	* @param fCheckXcpts Whether to check for umasked pending exceptions or
6202	* not.
6203	*/
6204	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6205	{
6206	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6207
6208	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
6209	return iemRaiseDeviceNotAvailable(pIemCpu);
6210
6211	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6212	if (fCheckXcpts && TODO )
6213	return iemRaiseMathFault(pIemCpu);
6214	*/
6215
6216	PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6217	pXState->x87.FCW = 0x37f;
6218	pXState->x87.FSW = 0;
6219	pXState->x87.FTW = 0x00; /* 0 - empty. */
6220	pXState->x87.FPUDP = 0;
6221	pXState->x87.DS = 0; //??
6222	pXState->x87.Rsrvd2= 0;
6223	pXState->x87.FPUIP = 0;
6224	pXState->x87.CS = 0; //??
6225	pXState->x87.Rsrvd1= 0;
6226	pXState->x87.FOP = 0;
6227
6228	iemHlpUsedFpu(pIemCpu);
6229	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6230	return VINF_SUCCESS;
6231	}
6232
6233
6234	/**
6235	* Implements 'FXSAVE'.
6236	*
6237	* @param iEffSeg The effective segment.
6238	* @param GCPtrEff The address of the image.
6239	* @param enmEffOpSize The operand size (only REX.W really matters).
6240	*/
6241	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6242	{
6243	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6244
6245	/*
6246	* Raise exceptions.
6247	*/
6248	if (pCtx->cr0 & X86_CR0_EM)
6249	return iemRaiseUndefinedOpcode(pIemCpu);
6250	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
6251	return iemRaiseDeviceNotAvailable(pIemCpu);
6252	if (GCPtrEff & 15)
6253	{
6254	/** @todo CPU/VM detection possible! \#AC might not be signal for
6255	* all/any misalignment sizes, intel says its an implementation detail. */
6256	if ( (pCtx->cr0 & X86_CR0_AM)
6257	&& pCtx->eflags.Bits.u1AC
6258	&& pIemCpu->uCpl == 3)
6259	return iemRaiseAlignmentCheckException(pIemCpu);
6260	return iemRaiseGeneralProtectionFault0(pIemCpu);
6261	}
6262
6263	/*
6264	* Access the memory.
6265	*/
6266	void *pvMem512;
6267	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6268	if (rcStrict != VINF_SUCCESS)
6269	return rcStrict;
6270	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6271	PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6272
6273	/*
6274	* Store the registers.
6275	*/
6276	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6277	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6278
6279	/* common for all formats */
6280	pDst->FCW = pSrc->FCW;
6281	pDst->FSW = pSrc->FSW;
6282	pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6283	pDst->FOP = pSrc->FOP;
6284	pDst->MXCSR = pSrc->MXCSR;
6285	pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6286	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6287	{
6288	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6289	* them for now... */
6290	pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6291	pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6292	pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6293	pDst->aRegs[i].au32[3] = 0;
6294	}
6295
6296	/* FPU IP, CS, DP and DS. */
6297	pDst->FPUIP = pSrc->FPUIP;
6298	pDst->CS = pSrc->CS;
6299	pDst->FPUDP = pSrc->FPUDP;
6300	pDst->DS = pSrc->DS;
6301	if (enmEffOpSize == IEMMODE_64BIT)
6302	{
6303	/* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6304	pDst->Rsrvd1 = pSrc->Rsrvd1;
6305	pDst->Rsrvd2 = pSrc->Rsrvd2;
6306	pDst->au32RsrvdForSoftware[0] = 0;
6307	}
6308	else
6309	{
6310	pDst->Rsrvd1 = 0;
6311	pDst->Rsrvd2 = 0;
6312	pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6313	}
6314
6315	/* XMM registers. */
6316	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6317	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
6318	\|\| pIemCpu->uCpl != 0)
6319	{
6320	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6321	for (uint32_t i = 0; i < cXmmRegs; i++)
6322	pDst->aXMM[i] = pSrc->aXMM[i];
6323	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6324	* right? */
6325	}
6326
6327	/*
6328	* Commit the memory.
6329	*/
6330	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6331	if (rcStrict != VINF_SUCCESS)
6332	return rcStrict;
6333
6334	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6335	return VINF_SUCCESS;
6336	}
6337
6338
6339	/**
6340	* Implements 'FXRSTOR'.
6341	*
6342	* @param GCPtrEff The address of the image.
6343	* @param enmEffOpSize The operand size (only REX.W really matters).
6344	*/
6345	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6346	{
6347	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6348
6349	/*
6350	* Raise exceptions.
6351	*/
6352	if (pCtx->cr0 & X86_CR0_EM)
6353	return iemRaiseUndefinedOpcode(pIemCpu);
6354	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
6355	return iemRaiseDeviceNotAvailable(pIemCpu);
6356	if (GCPtrEff & 15)
6357	{
6358	/** @todo CPU/VM detection possible! \#AC might not be signal for
6359	* all/any misalignment sizes, intel says its an implementation detail. */
6360	if ( (pCtx->cr0 & X86_CR0_AM)
6361	&& pCtx->eflags.Bits.u1AC
6362	&& pIemCpu->uCpl == 3)
6363	return iemRaiseAlignmentCheckException(pIemCpu);
6364	return iemRaiseGeneralProtectionFault0(pIemCpu);
6365	}
6366
6367	/*
6368	* Access the memory.
6369	*/
6370	void *pvMem512;
6371	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6372	if (rcStrict != VINF_SUCCESS)
6373	return rcStrict;
6374	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6375	PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6376
6377	/*
6378	* Check the state for stuff which will #GP(0).
6379	*/
6380	uint32_t const fMXCSR = pSrc->MXCSR;
6381	uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6382	if (fMXCSR & ~fMXCSR_MASK)
6383	{
6384	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6385	return iemRaiseGeneralProtectionFault0(pIemCpu);
6386	}
6387
6388	/*
6389	* Load the registers.
6390	*/
6391	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6392	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6393
6394	/* common for all formats */
6395	pDst->FCW = pSrc->FCW;
6396	pDst->FSW = pSrc->FSW;
6397	pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6398	pDst->FOP = pSrc->FOP;
6399	pDst->MXCSR = fMXCSR;
6400	/* (MXCSR_MASK is read-only) */
6401	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6402	{
6403	pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6404	pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6405	pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6406	pDst->aRegs[i].au32[3] = 0;
6407	}
6408
6409	/* FPU IP, CS, DP and DS. */
6410	if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
6411	{
6412	pDst->FPUIP = pSrc->FPUIP;
6413	pDst->CS = pSrc->CS;
6414	pDst->Rsrvd1 = pSrc->Rsrvd1;
6415	pDst->FPUDP = pSrc->FPUDP;
6416	pDst->DS = pSrc->DS;
6417	pDst->Rsrvd2 = pSrc->Rsrvd2;
6418	}
6419	else
6420	{
6421	pDst->FPUIP = pSrc->FPUIP;
6422	pDst->CS = pSrc->CS;
6423	pDst->Rsrvd1 = 0;
6424	pDst->FPUDP = pSrc->FPUDP;
6425	pDst->DS = pSrc->DS;
6426	pDst->Rsrvd2 = 0;
6427	}
6428
6429	/* XMM registers. */
6430	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6431	\|\| pIemCpu->enmCpuMode != IEMMODE_64BIT
6432	\|\| pIemCpu->uCpl != 0)
6433	{
6434	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6435	for (uint32_t i = 0; i < cXmmRegs; i++)
6436	pDst->aXMM[i] = pSrc->aXMM[i];
6437	}
6438
6439	/*
6440	* Commit the memory.
6441	*/
6442	rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
6443	if (rcStrict != VINF_SUCCESS)
6444	return rcStrict;
6445
6446	iemHlpUsedFpu(pIemCpu);
6447	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6448	return VINF_SUCCESS;
6449	}
6450
6451
6452	/**
6453	* Commmon routine for fnstenv and fnsave.
6454	*
6455	* @param uPtr Where to store the state.
6456	* @param pCtx The CPU context.
6457	*/
6458	static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6459	{
6460	PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6461	if (enmEffOpSize == IEMMODE_16BIT)
6462	{
6463	uPtr.pu16[0] = pSrcX87->FCW;
6464	uPtr.pu16[1] = pSrcX87->FSW;
6465	uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6466	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6467	{
6468	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
6469	* protected mode or long mode and we save it in real mode? And vice
6470	* versa? And with 32-bit operand size? I think CPU is storing the
6471	* effective address ((CS << 4) + IP) in the offset register and not
6472	* doing any address calculations here. */
6473	uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6474	uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) \| pSrcX87->FOP;
6475	uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6476	uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6477	}
6478	else
6479	{
6480	uPtr.pu16[3] = pSrcX87->FPUIP;
6481	uPtr.pu16[4] = pSrcX87->CS;
6482	uPtr.pu16[5] = pSrcX87->FPUDP;
6483	uPtr.pu16[6] = pSrcX87->DS;
6484	}
6485	}
6486	else
6487	{
6488	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6489	uPtr.pu16[0*2] = pSrcX87->FCW;
6490	uPtr.pu16[02+1] = 0xffff; / (0xffff observed on intel skylake.) */
6491	uPtr.pu16[1*2] = pSrcX87->FSW;
6492	uPtr.pu16[1*2+1] = 0xffff;
6493	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6494	uPtr.pu16[2*2+1] = 0xffff;
6495	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6496	{
6497	uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6498	uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) \| pSrcX87->FOP;
6499	uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6500	uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6501	}
6502	else
6503	{
6504	uPtr.pu32[3] = pSrcX87->FPUIP;
6505	uPtr.pu16[4*2] = pSrcX87->CS;
6506	uPtr.pu16[4*2+1] = pSrcX87->FOP;
6507	uPtr.pu32[5] = pSrcX87->FPUDP;
6508	uPtr.pu16[6*2] = pSrcX87->DS;
6509	uPtr.pu16[6*2+1] = 0xffff;
6510	}
6511	}
6512	}
6513
6514
6515	/**
6516	* Commmon routine for fldenv and frstor
6517	*
6518	* @param uPtr Where to store the state.
6519	* @param pCtx The CPU context.
6520	*/
6521	static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6522	{
6523	PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6524	if (enmEffOpSize == IEMMODE_16BIT)
6525	{
6526	pDstX87->FCW = uPtr.pu16[0];
6527	pDstX87->FSW = uPtr.pu16[1];
6528	pDstX87->FTW = uPtr.pu16[2];
6529	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6530	{
6531	pDstX87->FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6532	pDstX87->FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6533	pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6534	pDstX87->CS = 0;
6535	pDstX87->Rsrvd1= 0;
6536	pDstX87->DS = 0;
6537	pDstX87->Rsrvd2= 0;
6538	}
6539	else
6540	{
6541	pDstX87->FPUIP = uPtr.pu16[3];
6542	pDstX87->CS = uPtr.pu16[4];
6543	pDstX87->Rsrvd1= 0;
6544	pDstX87->FPUDP = uPtr.pu16[5];
6545	pDstX87->DS = uPtr.pu16[6];
6546	pDstX87->Rsrvd2= 0;
6547	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6548	}
6549	}
6550	else
6551	{
6552	pDstX87->FCW = uPtr.pu16[0*2];
6553	pDstX87->FSW = uPtr.pu16[1*2];
6554	pDstX87->FTW = uPtr.pu16[2*2];
6555	if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
6556	{
6557	pDstX87->FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6558	pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6559	pDstX87->FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6560	pDstX87->CS = 0;
6561	pDstX87->Rsrvd1= 0;
6562	pDstX87->DS = 0;
6563	pDstX87->Rsrvd2= 0;
6564	}
6565	else
6566	{
6567	pDstX87->FPUIP = uPtr.pu32[3];
6568	pDstX87->CS = uPtr.pu16[4*2];
6569	pDstX87->Rsrvd1= 0;
6570	pDstX87->FOP = uPtr.pu16[4*2+1];
6571	pDstX87->FPUDP = uPtr.pu32[5];
6572	pDstX87->DS = uPtr.pu16[6*2];
6573	pDstX87->Rsrvd2= 0;
6574	}
6575	}
6576
6577	/* Make adjustments. */
6578	pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6579	pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6580	iemFpuRecalcExceptionStatus(pDstX87);
6581	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
6582	* exceptions are pending after loading the saved state? */
6583	}
6584
6585
6586	/**
6587	* Implements 'FNSTENV'.
6588	*
6589	* @param enmEffOpSize The operand size (only REX.W really matters).
6590	* @param iEffSeg The effective segment register for @a GCPtrEff.
6591	* @param GCPtrEffDst The address of the image.
6592	*/
6593	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6594	{
6595	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6596	RTPTRUNION uPtr;
6597	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6598	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6599	if (rcStrict != VINF_SUCCESS)
6600	return rcStrict;
6601
6602	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6603
6604	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6605	if (rcStrict != VINF_SUCCESS)
6606	return rcStrict;
6607
6608	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6609	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6610	return VINF_SUCCESS;
6611	}
6612
6613
6614	/**
6615	* Implements 'FNSAVE'.
6616	*
6617	* @param GCPtrEffDst The address of the image.
6618	* @param enmEffOpSize The operand size.
6619	*/
6620	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6621	{
6622	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6623	RTPTRUNION uPtr;
6624	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6625	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6626	if (rcStrict != VINF_SUCCESS)
6627	return rcStrict;
6628
6629	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6630	iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6631	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6632	for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6633	{
6634	paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6635	paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6636	paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6637	}
6638
6639	rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6640	if (rcStrict != VINF_SUCCESS)
6641	return rcStrict;
6642
6643	/*
6644	* Re-initialize the FPU context.
6645	*/
6646	pFpuCtx->FCW = 0x37f;
6647	pFpuCtx->FSW = 0;
6648	pFpuCtx->FTW = 0x00; /* 0 - empty */
6649	pFpuCtx->FPUDP = 0;
6650	pFpuCtx->DS = 0;
6651	pFpuCtx->Rsrvd2= 0;
6652	pFpuCtx->FPUIP = 0;
6653	pFpuCtx->CS = 0;
6654	pFpuCtx->Rsrvd1= 0;
6655	pFpuCtx->FOP = 0;
6656
6657	iemHlpUsedFpu(pIemCpu);
6658	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6659	return VINF_SUCCESS;
6660	}
6661
6662
6663
6664	/**
6665	* Implements 'FLDENV'.
6666	*
6667	* @param enmEffOpSize The operand size (only REX.W really matters).
6668	* @param iEffSeg The effective segment register for @a GCPtrEff.
6669	* @param GCPtrEffSrc The address of the image.
6670	*/
6671	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6672	{
6673	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6674	RTCPTRUNION uPtr;
6675	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6676	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6677	if (rcStrict != VINF_SUCCESS)
6678	return rcStrict;
6679
6680	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6681
6682	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6683	if (rcStrict != VINF_SUCCESS)
6684	return rcStrict;
6685
6686	iemHlpUsedFpu(pIemCpu);
6687	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6688	return VINF_SUCCESS;
6689	}
6690
6691
6692	/**
6693	* Implements 'FRSTOR'.
6694	*
6695	* @param GCPtrEffSrc The address of the image.
6696	* @param enmEffOpSize The operand size.
6697	*/
6698	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6699	{
6700	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6701	RTCPTRUNION uPtr;
6702	VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6703	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6704	if (rcStrict != VINF_SUCCESS)
6705	return rcStrict;
6706
6707	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6708	iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
6709	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6710	for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6711	{
6712	pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6713	pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6714	pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6715	pFpuCtx->aRegs[i].au32[3] = 0;
6716	}
6717
6718	rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6719	if (rcStrict != VINF_SUCCESS)
6720	return rcStrict;
6721
6722	iemHlpUsedFpu(pIemCpu);
6723	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6724	return VINF_SUCCESS;
6725	}
6726
6727
6728	/**
6729	* Implements 'FLDCW'.
6730	*
6731	* @param u16Fcw The new FCW.
6732	*/
6733	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6734	{
6735	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6736
6737	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6738	/** @todo Testcase: Try see what happens when trying to set undefined bits
6739	* (other than 6 and 7). Currently ignoring them. */
6740	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
6741	* according to FSW. (This is was is currently implemented.) */
6742	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6743	pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6744	iemFpuRecalcExceptionStatus(pFpuCtx);
6745
6746	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6747	iemHlpUsedFpu(pIemCpu);
6748	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6749	return VINF_SUCCESS;
6750	}
6751
6752
6753
6754	/**
6755	* Implements the underflow case of fxch.
6756	*
6757	* @param iStReg The other stack register.
6758	*/
6759	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6760	{
6761	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6762
6763	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6764	unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6765	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6766	Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) \|\| !(RT_BIT(iReg2) & pFpuCtx->FTW));
6767
6768	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
6769	* registers are read as QNaN and then exchanged. This could be
6770	* wrong... */
6771	if (pFpuCtx->FCW & X86_FCW_IM)
6772	{
6773	if (RT_BIT(iReg1) & pFpuCtx->FTW)
6774	{
6775	if (RT_BIT(iReg2) & pFpuCtx->FTW)
6776	iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6777	else
6778	pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6779	iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6780	}
6781	else
6782	{
6783	pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6784	iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6785	}
6786	pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6787	pFpuCtx->FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
6788	}
6789	else
6790	{
6791	/* raise underflow exception, don't change anything. */
6792	pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
6793	pFpuCtx->FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
6794	}
6795
6796	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
6797	iemHlpUsedFpu(pIemCpu);
6798	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6799	return VINF_SUCCESS;
6800	}
6801
6802
6803	/**
6804	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6805	*
6806	* @param cToAdd 1 or 7.
6807	*/
6808	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6809	{
6810	PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
6811	Assert(iStReg < 8);
6812
6813	/*
6814	* Raise exceptions.
6815	*/
6816	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
6817	return iemRaiseDeviceNotAvailable(pIemCpu);
6818
6819	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6820	uint16_t u16Fsw = pFpuCtx->FSW;
6821	if (u16Fsw & X86_FSW_ES)
6822	return iemRaiseMathFault(pIemCpu);
6823
6824	/*
6825	* Check if any of the register accesses causes #SF + #IA.
6826	*/
6827	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
6828	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6829	if ((pFpuCtx->FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
6830	{
6831	uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
6832	NOREF(u32Eflags);
6833
6834	pFpuCtx->FSW &= ~X86_FSW_C1;
6835	pFpuCtx->FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
6836	if ( !(u16Fsw & X86_FSW_IE)
6837	\|\| (pFpuCtx->FCW & X86_FCW_IM) )
6838	{
6839	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6840	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6841	}
6842	}
6843	else if (pFpuCtx->FCW & X86_FCW_IM)
6844	{
6845	/* Masked underflow. */
6846	pFpuCtx->FSW &= ~X86_FSW_C1;
6847	pFpuCtx->FSW \|= X86_FSW_IE \| X86_FSW_SF;
6848	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6849	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
6850	}
6851	else
6852	{
6853	/* Raise underflow - don't touch EFLAGS or TOP. */
6854	pFpuCtx->FSW &= ~X86_FSW_C1;
6855	pFpuCtx->FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
6856	fPop = false;
6857	}
6858
6859	/*
6860	* Pop if necessary.
6861	*/
6862	if (fPop)
6863	{
6864	pFpuCtx->FTW &= ~RT_BIT(iReg1);
6865	pFpuCtx->FSW &= X86_FSW_TOP_MASK;
6866	pFpuCtx->FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
6867	}
6868
6869	iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
6870	iemHlpUsedFpu(pIemCpu);
6871	iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
6872	return VINF_SUCCESS;
6873	}
6874
6875	/** @} */
6876

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 61632

Download in other formats: