IEMAllCImpl.cpp.h@ 62015

Last change on this file since 62015 was 62015, checked in by vboxsync, 9 years ago
IEM: Switched from using IEMCPU directly to using with via VMCPU. This saves 4-5 KB in 64-bit mode (~1.2%), but the 32-bit code is larger (suspecting because we lost a few some 8-bit displacements).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 237.6 KB

Line
1	/* $Id: IEMAllCImpl.cpp.h 62015 2016-07-04 19:58:28Z vboxsync $ */
2	/** @file
3	* IEM - Instruction Implementation in C/C++ (code include).
4	*/
5
6	/*
7	* Copyright (C) 2011-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.215389.xyz. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/** @name Misc Helpers
19	* @{
20	*/
21
22
23	/**
24	* Worker function for iemHlpCheckPortIOPermission, don't call directly.
25	*
26	* @returns Strict VBox status code.
27	*
28	* @param pVCpu The cross context virtual CPU structure of the calling thread.
29	* @param pCtx The register context.
30	* @param u16Port The port number.
31	* @param cbOperand The operand size.
32	*/
33	static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34	{
35	/* The TSS bits we're interested in are the same on 386 and AMD64. */
36	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37	AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38	AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39	AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41	/*
42	* Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43	*/
44	Assert(!pCtx->tr.Attr.n.u1DescType);
45	if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46	&& pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47	{
48	Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49	u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50	return iemRaiseGeneralProtectionFault0(pVCpu);
51	}
52
53	/*
54	* Read the bitmap offset (may #PF).
55	*/
56	uint16_t offBitmap;
57	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
58	pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59	if (rcStrict != VINF_SUCCESS)
60	{
61	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62	return rcStrict;
63	}
64
65	/*
66	* The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67	* describes the CPU actually reading two bytes regardless of whether the
68	* bit range crosses a byte boundrary. Thus the + 1 in the test below.
69	*/
70	uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71	/** @todo check if real CPUs ensures that offBitmap has a minimum value of
72	* for instance sizeof(X86TSS32). */
73	if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74	{
75	Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76	offFirstBit, pCtx->tr.u32Limit));
77	return iemRaiseGeneralProtectionFault0(pVCpu);
78	}
79
80	/*
81	* Read the necessary bits.
82	*/
83	/** @todo Test the assertion in the intel manual that the CPU reads two
84	* bytes. The question is how this works wrt to #PF and #GP on the
85	* 2nd byte when it's not required. */
86	uint16_t bmBytes = UINT16_MAX;
87	rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88	if (rcStrict != VINF_SUCCESS)
89	{
90	Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91	return rcStrict;
92	}
93
94	/*
95	* Perform the check.
96	*/
97	uint16_t fPortMask = (1 << cbOperand) - 1;
98	bmBytes >>= (u16Port & 7);
99	if (bmBytes & fPortMask)
100	{
101	Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102	u16Port, cbOperand, bmBytes, fPortMask));
103	return iemRaiseGeneralProtectionFault0(pVCpu);
104	}
105
106	return VINF_SUCCESS;
107	}
108
109
110	/**
111	* Checks if we are allowed to access the given I/O port, raising the
112	* appropriate exceptions if we aren't (or if the I/O bitmap is not
113	* accessible).
114	*
115	* @returns Strict VBox status code.
116	*
117	* @param pVCpu The cross context virtual CPU structure of the calling thread.
118	* @param pCtx The register context.
119	* @param u16Port The port number.
120	* @param cbOperand The operand size.
121	*/
122	DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123	{
124	X86EFLAGS Efl;
125	Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
126	if ( (pCtx->cr0 & X86_CR0_PE)
127	&& ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
128	\|\| Efl.Bits.u1VM) )
129	return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
130	return VINF_SUCCESS;
131	}
132
133
134	#if 0
135	/**
136	* Calculates the parity bit.
137	*
138	* @returns true if the bit is set, false if not.
139	* @param u8Result The least significant byte of the result.
140	*/
141	static bool iemHlpCalcParityFlag(uint8_t u8Result)
142	{
143	/*
144	* Parity is set if the number of bits in the least significant byte of
145	* the result is even.
146	*/
147	uint8_t cBits;
148	cBits = u8Result & 1; /* 0 */
149	u8Result >>= 1;
150	cBits += u8Result & 1;
151	u8Result >>= 1;
152	cBits += u8Result & 1;
153	u8Result >>= 1;
154	cBits += u8Result & 1;
155	u8Result >>= 1;
156	cBits += u8Result & 1; /* 4 */
157	u8Result >>= 1;
158	cBits += u8Result & 1;
159	u8Result >>= 1;
160	cBits += u8Result & 1;
161	u8Result >>= 1;
162	cBits += u8Result & 1;
163	return !(cBits & 1);
164	}
165	#endif /* not used */
166
167
168	/**
169	* Updates the specified flags according to a 8-bit result.
170	*
171	* @param pVCpu The cross context virtual CPU structure of the calling thread.
172	* @param u8Result The result to set the flags according to.
173	* @param fToUpdate The flags to update.
174	* @param fUndefined The flags that are specified as undefined.
175	*/
176	static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177	{
178	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
179
180	uint32_t fEFlags = pCtx->eflags.u;
181	iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182	pCtx->eflags.u &= ~(fToUpdate \| fUndefined);
183	pCtx->eflags.u \|= (fToUpdate \| fUndefined) & fEFlags;
184	#ifdef IEM_VERIFICATION_MODE_FULL
185	pVCpu->iem.s.fUndefinedEFlags \|= fUndefined;
186	#endif
187	}
188
189
190	/**
191	* Helper used by iret.
192	*
193	* @param uCpl The new CPL.
194	* @param pSReg Pointer to the segment register.
195	*/
196	static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
197	{
198	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
199	if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
200	CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
201	#else
202	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
203	#endif
204
205	if ( uCpl > pSReg->Attr.n.u2Dpl
206	&& pSReg->Attr.n.u1DescType /* code or data, not system */
207	&& (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
208	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) /* not conforming code */
209	iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
210	}
211
212
213	/**
214	* Indicates that we have modified the FPU state.
215	*
216	* @param pVCpu The cross context virtual CPU structure of the calling thread.
217	*/
218	DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
219	{
220	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
221	}
222
223	/** @} */
224
225	/** @name C Implementations
226	* @{
227	*/
228
229	/**
230	* Implements a 16-bit popa.
231	*/
232	IEM_CIMPL_DEF_0(iemCImpl_popa_16)
233	{
234	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
235	RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
236	RTGCPTR GCPtrLast = GCPtrStart + 15;
237	VBOXSTRICTRC rcStrict;
238
239	/*
240	* The docs are a bit hard to comprehend here, but it looks like we wrap
241	* around in real mode as long as none of the individual "popa" crosses the
242	* end of the stack segment. In protected mode we check the whole access
243	* in one go. For efficiency, only do the word-by-word thing if we're in
244	* danger of wrapping around.
245	*/
246	/** @todo do popa boundary / wrap-around checks. */
247	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
248	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
249	{
250	/* word-by-word */
251	RTUINT64U TmpRsp;
252	TmpRsp.u = pCtx->rsp;
253	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
254	if (rcStrict == VINF_SUCCESS)
255	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
256	if (rcStrict == VINF_SUCCESS)
257	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
258	if (rcStrict == VINF_SUCCESS)
259	{
260	iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
261	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
262	}
263	if (rcStrict == VINF_SUCCESS)
264	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
265	if (rcStrict == VINF_SUCCESS)
266	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
267	if (rcStrict == VINF_SUCCESS)
268	rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
269	if (rcStrict == VINF_SUCCESS)
270	{
271	pCtx->rsp = TmpRsp.u;
272	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
273	}
274	}
275	else
276	{
277	uint16_t const *pa16Mem = NULL;
278	rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
279	if (rcStrict == VINF_SUCCESS)
280	{
281	pCtx->di = pa16Mem[7 - X86_GREG_xDI];
282	pCtx->si = pa16Mem[7 - X86_GREG_xSI];
283	pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
284	/* skip sp */
285	pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
286	pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
287	pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
288	pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
289	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
290	if (rcStrict == VINF_SUCCESS)
291	{
292	iemRegAddToRsp(pVCpu, pCtx, 16);
293	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
294	}
295	}
296	}
297	return rcStrict;
298	}
299
300
301	/**
302	* Implements a 32-bit popa.
303	*/
304	IEM_CIMPL_DEF_0(iemCImpl_popa_32)
305	{
306	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
307	RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
308	RTGCPTR GCPtrLast = GCPtrStart + 31;
309	VBOXSTRICTRC rcStrict;
310
311	/*
312	* The docs are a bit hard to comprehend here, but it looks like we wrap
313	* around in real mode as long as none of the individual "popa" crosses the
314	* end of the stack segment. In protected mode we check the whole access
315	* in one go. For efficiency, only do the word-by-word thing if we're in
316	* danger of wrapping around.
317	*/
318	/** @todo do popa boundary / wrap-around checks. */
319	if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
320	&& (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
321	{
322	/* word-by-word */
323	RTUINT64U TmpRsp;
324	TmpRsp.u = pCtx->rsp;
325	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
326	if (rcStrict == VINF_SUCCESS)
327	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
328	if (rcStrict == VINF_SUCCESS)
329	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
330	if (rcStrict == VINF_SUCCESS)
331	{
332	iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
333	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
334	}
335	if (rcStrict == VINF_SUCCESS)
336	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
337	if (rcStrict == VINF_SUCCESS)
338	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
339	if (rcStrict == VINF_SUCCESS)
340	rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
341	if (rcStrict == VINF_SUCCESS)
342	{
343	#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
344	pCtx->rdi &= UINT32_MAX;
345	pCtx->rsi &= UINT32_MAX;
346	pCtx->rbp &= UINT32_MAX;
347	pCtx->rbx &= UINT32_MAX;
348	pCtx->rdx &= UINT32_MAX;
349	pCtx->rcx &= UINT32_MAX;
350	pCtx->rax &= UINT32_MAX;
351	#endif
352	pCtx->rsp = TmpRsp.u;
353	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
354	}
355	}
356	else
357	{
358	uint32_t const *pa32Mem;
359	rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
360	if (rcStrict == VINF_SUCCESS)
361	{
362	pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
363	pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
364	pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
365	/* skip esp */
366	pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
367	pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
368	pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
369	pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
370	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
371	if (rcStrict == VINF_SUCCESS)
372	{
373	iemRegAddToRsp(pVCpu, pCtx, 32);
374	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
375	}
376	}
377	}
378	return rcStrict;
379	}
380
381
382	/**
383	* Implements a 16-bit pusha.
384	*/
385	IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
386	{
387	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
388	RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
389	RTGCPTR GCPtrBottom = GCPtrTop - 15;
390	VBOXSTRICTRC rcStrict;
391
392	/*
393	* The docs are a bit hard to comprehend here, but it looks like we wrap
394	* around in real mode as long as none of the individual "pushd" crosses the
395	* end of the stack segment. In protected mode we check the whole access
396	* in one go. For efficiency, only do the word-by-word thing if we're in
397	* danger of wrapping around.
398	*/
399	/** @todo do pusha boundary / wrap-around checks. */
400	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
401	&& IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
402	{
403	/* word-by-word */
404	RTUINT64U TmpRsp;
405	TmpRsp.u = pCtx->rsp;
406	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
407	if (rcStrict == VINF_SUCCESS)
408	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
409	if (rcStrict == VINF_SUCCESS)
410	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
411	if (rcStrict == VINF_SUCCESS)
412	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
413	if (rcStrict == VINF_SUCCESS)
414	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
415	if (rcStrict == VINF_SUCCESS)
416	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
417	if (rcStrict == VINF_SUCCESS)
418	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
419	if (rcStrict == VINF_SUCCESS)
420	rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
421	if (rcStrict == VINF_SUCCESS)
422	{
423	pCtx->rsp = TmpRsp.u;
424	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
425	}
426	}
427	else
428	{
429	GCPtrBottom--;
430	uint16_t *pa16Mem = NULL;
431	rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
432	if (rcStrict == VINF_SUCCESS)
433	{
434	pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
435	pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
436	pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
437	pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
438	pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
439	pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
440	pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
441	pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
442	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
443	if (rcStrict == VINF_SUCCESS)
444	{
445	iemRegSubFromRsp(pVCpu, pCtx, 16);
446	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
447	}
448	}
449	}
450	return rcStrict;
451	}
452
453
454	/**
455	* Implements a 32-bit pusha.
456	*/
457	IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
458	{
459	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
460	RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
461	RTGCPTR GCPtrBottom = GCPtrTop - 31;
462	VBOXSTRICTRC rcStrict;
463
464	/*
465	* The docs are a bit hard to comprehend here, but it looks like we wrap
466	* around in real mode as long as none of the individual "pusha" crosses the
467	* end of the stack segment. In protected mode we check the whole access
468	* in one go. For efficiency, only do the word-by-word thing if we're in
469	* danger of wrapping around.
470	*/
471	/** @todo do pusha boundary / wrap-around checks. */
472	if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
473	&& IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
474	{
475	/* word-by-word */
476	RTUINT64U TmpRsp;
477	TmpRsp.u = pCtx->rsp;
478	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
479	if (rcStrict == VINF_SUCCESS)
480	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
481	if (rcStrict == VINF_SUCCESS)
482	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
483	if (rcStrict == VINF_SUCCESS)
484	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
485	if (rcStrict == VINF_SUCCESS)
486	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
487	if (rcStrict == VINF_SUCCESS)
488	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
489	if (rcStrict == VINF_SUCCESS)
490	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
491	if (rcStrict == VINF_SUCCESS)
492	rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
493	if (rcStrict == VINF_SUCCESS)
494	{
495	pCtx->rsp = TmpRsp.u;
496	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
497	}
498	}
499	else
500	{
501	GCPtrBottom--;
502	uint32_t *pa32Mem;
503	rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
504	if (rcStrict == VINF_SUCCESS)
505	{
506	pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
507	pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
508	pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
509	pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
510	pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
511	pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
512	pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
513	pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
514	rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
515	if (rcStrict == VINF_SUCCESS)
516	{
517	iemRegSubFromRsp(pVCpu, pCtx, 32);
518	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
519	}
520	}
521	}
522	return rcStrict;
523	}
524
525
526	/**
527	* Implements pushf.
528	*
529	*
530	* @param enmEffOpSize The effective operand size.
531	*/
532	IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
533	{
534	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
535
536	/*
537	* If we're in V8086 mode some care is required (which is why we're in
538	* doing this in a C implementation).
539	*/
540	uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
541	if ( (fEfl & X86_EFL_VM)
542	&& X86_EFL_GET_IOPL(fEfl) != 3 )
543	{
544	Assert(pCtx->cr0 & X86_CR0_PE);
545	if ( enmEffOpSize != IEMMODE_16BIT
546	\|\| !(pCtx->cr4 & X86_CR4_VME))
547	return iemRaiseGeneralProtectionFault0(pVCpu);
548	fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
549	fEfl \|= (fEfl & X86_EFL_VIF) >> (19 - 9);
550	return iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
551	}
552
553	/*
554	* Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
555	*/
556	fEfl &= ~(X86_EFL_RF \| X86_EFL_VM);
557
558	VBOXSTRICTRC rcStrict;
559	switch (enmEffOpSize)
560	{
561	case IEMMODE_16BIT:
562	AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
563	if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
564	fEfl \|= UINT16_C(0xf000);
565	rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
566	break;
567	case IEMMODE_32BIT:
568	rcStrict = iemMemStackPushU32(pVCpu, fEfl);
569	break;
570	case IEMMODE_64BIT:
571	rcStrict = iemMemStackPushU64(pVCpu, fEfl);
572	break;
573	IEM_NOT_REACHED_DEFAULT_CASE_RET();
574	}
575	if (rcStrict != VINF_SUCCESS)
576	return rcStrict;
577
578	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
579	return VINF_SUCCESS;
580	}
581
582
583	/**
584	* Implements popf.
585	*
586	* @param enmEffOpSize The effective operand size.
587	*/
588	IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
589	{
590	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
591	uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
592	VBOXSTRICTRC rcStrict;
593	uint32_t fEflNew;
594
595	/*
596	* V8086 is special as usual.
597	*/
598	if (fEflOld & X86_EFL_VM)
599	{
600	/*
601	* Almost anything goes if IOPL is 3.
602	*/
603	if (X86_EFL_GET_IOPL(fEflOld) == 3)
604	{
605	switch (enmEffOpSize)
606	{
607	case IEMMODE_16BIT:
608	{
609	uint16_t u16Value;
610	rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
611	if (rcStrict != VINF_SUCCESS)
612	return rcStrict;
613	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
614	break;
615	}
616	case IEMMODE_32BIT:
617	rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
618	if (rcStrict != VINF_SUCCESS)
619	return rcStrict;
620	break;
621	IEM_NOT_REACHED_DEFAULT_CASE_RET();
622	}
623
624	const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
625	? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
626	fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
627	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
628	}
629	/*
630	* Interrupt flag virtualization with CR4.VME=1.
631	*/
632	else if ( enmEffOpSize == IEMMODE_16BIT
633	&& (pCtx->cr4 & X86_CR4_VME) )
634	{
635	uint16_t u16Value;
636	RTUINT64U TmpRsp;
637	TmpRsp.u = pCtx->rsp;
638	rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
639	if (rcStrict != VINF_SUCCESS)
640	return rcStrict;
641
642	/** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
643	* or before? */
644	if ( ( (u16Value & X86_EFL_IF)
645	&& (fEflOld & X86_EFL_VIP))
646	\|\| (u16Value & X86_EFL_TF) )
647	return iemRaiseGeneralProtectionFault0(pVCpu);
648
649	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
650	fEflNew \|= (fEflNew & X86_EFL_IF) << (19 - 9);
651	fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF);
652	fEflNew \|= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
653
654	pCtx->rsp = TmpRsp.u;
655	}
656	else
657	return iemRaiseGeneralProtectionFault0(pVCpu);
658
659	}
660	/*
661	* Not in V8086 mode.
662	*/
663	else
664	{
665	/* Pop the flags. */
666	switch (enmEffOpSize)
667	{
668	case IEMMODE_16BIT:
669	{
670	uint16_t u16Value;
671	rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
672	if (rcStrict != VINF_SUCCESS)
673	return rcStrict;
674	fEflNew = u16Value \| (fEflOld & UINT32_C(0xffff0000));
675
676	/*
677	* Ancient CPU adjustments:
678	* - 8086, 80186, V20/30:
679	* Fixed bits 15:12 bits are not kept correctly internally, mostly for
680	* practical reasons (masking below). We add them when pushing flags.
681	* - 80286:
682	* The NT and IOPL flags cannot be popped from real mode and are
683	* therefore always zero (since a 286 can never exit from PM and
684	* their initial value is zero). This changed on a 386 and can
685	* therefore be used to detect 286 or 386 CPU in real mode.
686	*/
687	if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
688	&& !(pCtx->cr0 & X86_CR0_PE) )
689	fEflNew &= ~(X86_EFL_NT \| X86_EFL_IOPL);
690	break;
691	}
692	case IEMMODE_32BIT:
693	rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
694	if (rcStrict != VINF_SUCCESS)
695	return rcStrict;
696	break;
697	case IEMMODE_64BIT:
698	{
699	uint64_t u64Value;
700	rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
701	if (rcStrict != VINF_SUCCESS)
702	return rcStrict;
703	fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
704	break;
705	}
706	IEM_NOT_REACHED_DEFAULT_CASE_RET();
707	}
708
709	/* Merge them with the current flags. */
710	const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
711	? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
712	if ( (fEflNew & (X86_EFL_IOPL \| X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL \| X86_EFL_IF))
713	\|\| pVCpu->iem.s.uCpl == 0)
714	{
715	fEflNew &= fPopfBits;
716	fEflNew \|= ~fPopfBits & fEflOld;
717	}
718	else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
719	{
720	fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
721	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
722	}
723	else
724	{
725	fEflNew &= fPopfBits & ~(X86_EFL_IOPL \| X86_EFL_IF);
726	fEflNew \|= ~(fPopfBits & ~(X86_EFL_IOPL \| X86_EFL_IF)) & fEflOld;
727	}
728	}
729
730	/*
731	* Commit the flags.
732	*/
733	Assert(fEflNew & RT_BIT_32(1));
734	IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
735	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
736
737	return VINF_SUCCESS;
738	}
739
740
741	/**
742	* Implements an indirect call.
743	*
744	* @param uNewPC The new program counter (RIP) value (loaded from the
745	* operand).
746	* @param enmEffOpSize The effective operand size.
747	*/
748	IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
749	{
750	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
751	uint16_t uOldPC = pCtx->ip + cbInstr;
752	if (uNewPC > pCtx->cs.u32Limit)
753	return iemRaiseGeneralProtectionFault0(pVCpu);
754
755	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
756	if (rcStrict != VINF_SUCCESS)
757	return rcStrict;
758
759	pCtx->rip = uNewPC;
760	pCtx->eflags.Bits.u1RF = 0;
761
762	/* Flush the prefetch buffer. */
763	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
764	return VINF_SUCCESS;
765	}
766
767
768	/**
769	* Implements a 16-bit relative call.
770	*
771	* @param offDisp The displacment offset.
772	*/
773	IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
774	{
775	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
776	uint16_t uOldPC = pCtx->ip + cbInstr;
777	uint16_t uNewPC = uOldPC + offDisp;
778	if (uNewPC > pCtx->cs.u32Limit)
779	return iemRaiseGeneralProtectionFault0(pVCpu);
780
781	VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
782	if (rcStrict != VINF_SUCCESS)
783	return rcStrict;
784
785	pCtx->rip = uNewPC;
786	pCtx->eflags.Bits.u1RF = 0;
787
788	/* Flush the prefetch buffer. */
789	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
790	return VINF_SUCCESS;
791	}
792
793
794	/**
795	* Implements a 32-bit indirect call.
796	*
797	* @param uNewPC The new program counter (RIP) value (loaded from the
798	* operand).
799	* @param enmEffOpSize The effective operand size.
800	*/
801	IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
802	{
803	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
804	uint32_t uOldPC = pCtx->eip + cbInstr;
805	if (uNewPC > pCtx->cs.u32Limit)
806	return iemRaiseGeneralProtectionFault0(pVCpu);
807
808	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
809	if (rcStrict != VINF_SUCCESS)
810	return rcStrict;
811
812	#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
813	/*
814	* CASM hook for recording interesting indirect calls.
815	*/
816	if ( !pCtx->eflags.Bits.u1IF
817	&& (pCtx->cr0 & X86_CR0_PG)
818	&& !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
819	&& pVCpu->iem.s.uCpl == 0)
820	{
821	EMSTATE enmState = EMGetState(pVCpu);
822	if ( enmState == EMSTATE_IEM_THEN_REM
823	\|\| enmState == EMSTATE_IEM
824	\|\| enmState == EMSTATE_REM)
825	CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
826	}
827	#endif
828
829	pCtx->rip = uNewPC;
830	pCtx->eflags.Bits.u1RF = 0;
831
832	/* Flush the prefetch buffer. */
833	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
834	return VINF_SUCCESS;
835	}
836
837
838	/**
839	* Implements a 32-bit relative call.
840	*
841	* @param offDisp The displacment offset.
842	*/
843	IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
844	{
845	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
846	uint32_t uOldPC = pCtx->eip + cbInstr;
847	uint32_t uNewPC = uOldPC + offDisp;
848	if (uNewPC > pCtx->cs.u32Limit)
849	return iemRaiseGeneralProtectionFault0(pVCpu);
850
851	VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
852	if (rcStrict != VINF_SUCCESS)
853	return rcStrict;
854
855	pCtx->rip = uNewPC;
856	pCtx->eflags.Bits.u1RF = 0;
857
858	/* Flush the prefetch buffer. */
859	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
860	return VINF_SUCCESS;
861	}
862
863
864	/**
865	* Implements a 64-bit indirect call.
866	*
867	* @param uNewPC The new program counter (RIP) value (loaded from the
868	* operand).
869	* @param enmEffOpSize The effective operand size.
870	*/
871	IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
872	{
873	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
874	uint64_t uOldPC = pCtx->rip + cbInstr;
875	if (!IEM_IS_CANONICAL(uNewPC))
876	return iemRaiseGeneralProtectionFault0(pVCpu);
877
878	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
879	if (rcStrict != VINF_SUCCESS)
880	return rcStrict;
881
882	pCtx->rip = uNewPC;
883	pCtx->eflags.Bits.u1RF = 0;
884
885	/* Flush the prefetch buffer. */
886	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
887	return VINF_SUCCESS;
888	}
889
890
891	/**
892	* Implements a 64-bit relative call.
893	*
894	* @param offDisp The displacment offset.
895	*/
896	IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
897	{
898	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
899	uint64_t uOldPC = pCtx->rip + cbInstr;
900	uint64_t uNewPC = uOldPC + offDisp;
901	if (!IEM_IS_CANONICAL(uNewPC))
902	return iemRaiseNotCanonical(pVCpu);
903
904	VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
905	if (rcStrict != VINF_SUCCESS)
906	return rcStrict;
907
908	pCtx->rip = uNewPC;
909	pCtx->eflags.Bits.u1RF = 0;
910
911	/* Flush the prefetch buffer. */
912	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
913
914	return VINF_SUCCESS;
915	}
916
917
918	/**
919	* Implements far jumps and calls thru task segments (TSS).
920	*
921	* @param uSel The selector.
922	* @param enmBranch The kind of branching we're performing.
923	* @param enmEffOpSize The effective operand size.
924	* @param pDesc The descriptor corresponding to @a uSel. The type is
925	* task gate.
926	*/
927	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
928	{
929	#ifndef IEM_IMPLEMENTS_TASKSWITCH
930	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
931	#else
932	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
933	Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
934	\|\| pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
935
936	if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
937	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
938	{
939	Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
940	pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
941	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
942	}
943
944	/** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
945	* far calls (see iemCImpl_callf). Most likely in both cases it should be
946	* checked here, need testcases. */
947	if (!pDesc->Legacy.Gen.u1Present)
948	{
949	Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
950	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
951	}
952
953	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
954	uint32_t uNextEip = pCtx->eip + cbInstr;
955	return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
956	uNextEip, 0 /* fFlags /, 0 / uErr /, 0 / uCr2 */, uSel, pDesc);
957	#endif
958	}
959
960
961	/**
962	* Implements far jumps and calls thru task gates.
963	*
964	* @param uSel The selector.
965	* @param enmBranch The kind of branching we're performing.
966	* @param enmEffOpSize The effective operand size.
967	* @param pDesc The descriptor corresponding to @a uSel. The type is
968	* task gate.
969	*/
970	IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
971	{
972	#ifndef IEM_IMPLEMENTS_TASKSWITCH
973	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
974	#else
975	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
976
977	if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
978	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
979	{
980	Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
981	pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
982	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
983	}
984
985	/** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
986	* far calls (see iemCImpl_callf). Most likely in both cases it should be
987	* checked here, need testcases. */
988	if (!pDesc->Legacy.Gen.u1Present)
989	{
990	Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
991	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
992	}
993
994	/*
995	* Fetch the new TSS descriptor from the GDT.
996	*/
997	RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
998	if (uSelTss & X86_SEL_LDT)
999	{
1000	Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1001	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1002	}
1003
1004	IEMSELDESC TssDesc;
1005	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1006	if (rcStrict != VINF_SUCCESS)
1007	return rcStrict;
1008
1009	if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1010	{
1011	Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1012	TssDesc.Legacy.Gate.u4Type));
1013	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1014	}
1015
1016	if (!TssDesc.Legacy.Gate.u1Present)
1017	{
1018	Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1019	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1020	}
1021
1022	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
1023	uint32_t uNextEip = pCtx->eip + cbInstr;
1024	return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1025	uNextEip, 0 /* fFlags /, 0 / uErr /, 0 / uCr2 */, uSelTss, &TssDesc);
1026	#endif
1027	}
1028
1029
1030	/**
1031	* Implements far jumps and calls thru call gates.
1032	*
1033	* @param uSel The selector.
1034	* @param enmBranch The kind of branching we're performing.
1035	* @param enmEffOpSize The effective operand size.
1036	* @param pDesc The descriptor corresponding to @a uSel. The type is
1037	* call gate.
1038	*/
1039	IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1040	{
1041	#define IEM_IMPLEMENTS_CALLGATE
1042	#ifndef IEM_IMPLEMENTS_CALLGATE
1043	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1044	#else
1045	/* NB: Far jumps can only do intra-privilege transfers. Far calls support
1046	* inter-privilege calls and are much more complex.
1047	*
1048	* NB: 64-bit call gate has the same type as a 32-bit call gate! If
1049	* EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1050	* must be 16-bit or 32-bit.
1051	*/
1052	/** @todo: effective operand size is probably irrelevant here, only the
1053	* call gate bitness matters??
1054	*/
1055	VBOXSTRICTRC rcStrict;
1056	RTPTRUNION uPtrRet;
1057	uint64_t uNewRsp;
1058	uint64_t uNewRip;
1059	uint64_t u64Base;
1060	uint32_t cbLimit;
1061	RTSEL uNewCS;
1062	IEMSELDESC DescCS;
1063	PCPUMCTX pCtx;
1064
1065	AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1066	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
1067	Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1068	\|\| pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1069
1070	/* Determine the new instruction pointer from the gate descriptor. */
1071	uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1072	\| ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1073	\| ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1074
1075	/* Perform DPL checks on the gate descriptor. */
1076	if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1077	\|\| pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1078	{
1079	Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1080	pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1081	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1082	}
1083
1084	/** @todo does this catch NULL selectors, too? */
1085	if (!pDesc->Legacy.Gen.u1Present)
1086	{
1087	Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1088	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1089	}
1090
1091	/*
1092	* Fetch the target CS descriptor from the GDT or LDT.
1093	*/
1094	uNewCS = pDesc->Legacy.Gate.u16Sel;
1095	rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1096	if (rcStrict != VINF_SUCCESS)
1097	return rcStrict;
1098
1099	/* Target CS must be a code selector. */
1100	if ( !DescCS.Legacy.Gen.u1DescType
1101	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1102	{
1103	Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1104	uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1105	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1106	}
1107
1108	/* Privilege checks on target CS. */
1109	if (enmBranch == IEMBRANCH_JUMP)
1110	{
1111	if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1112	{
1113	if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1114	{
1115	Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1116	uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1117	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1118	}
1119	}
1120	else
1121	{
1122	if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1123	{
1124	Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1125	uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1126	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1127	}
1128	}
1129	}
1130	else
1131	{
1132	Assert(enmBranch == IEMBRANCH_CALL);
1133	if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1134	{
1135	Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1136	uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1137	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1138	}
1139	}
1140
1141	/* Additional long mode checks. */
1142	if (IEM_IS_LONG_MODE(pVCpu))
1143	{
1144	if (!DescCS.Legacy.Gen.u1Long)
1145	{
1146	Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1147	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1148	}
1149
1150	/* L vs D. */
1151	if ( DescCS.Legacy.Gen.u1Long
1152	&& DescCS.Legacy.Gen.u1DefBig)
1153	{
1154	Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1155	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1156	}
1157	}
1158
1159	if (!DescCS.Legacy.Gate.u1Present)
1160	{
1161	Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1162	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1163	}
1164
1165	pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
1166
1167	if (enmBranch == IEMBRANCH_JUMP)
1168	{
1169	/** @todo: This is very similar to regular far jumps; merge! */
1170	/* Jumps are fairly simple... */
1171
1172	/* Chop the high bits off if 16-bit gate (Intel says so). */
1173	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1174	uNewRip = (uint16_t)uNewRip;
1175
1176	/* Limit check for non-long segments. */
1177	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1178	if (DescCS.Legacy.Gen.u1Long)
1179	u64Base = 0;
1180	else
1181	{
1182	if (uNewRip > cbLimit)
1183	{
1184	Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1185	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1186	}
1187	u64Base = X86DESC_BASE(&DescCS.Legacy);
1188	}
1189
1190	/* Canonical address check. */
1191	if (!IEM_IS_CANONICAL(uNewRip))
1192	{
1193	Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1194	return iemRaiseNotCanonical(pVCpu);
1195	}
1196
1197	/*
1198	* Ok, everything checked out fine. Now set the accessed bit before
1199	* committing the result into CS, CSHID and RIP.
1200	*/
1201	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1202	{
1203	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1204	if (rcStrict != VINF_SUCCESS)
1205	return rcStrict;
1206	/** @todo check what VT-x and AMD-V does. */
1207	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1208	}
1209
1210	/* commit */
1211	pCtx->rip = uNewRip;
1212	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1213	pCtx->cs.Sel \|= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1214	pCtx->cs.ValidSel = pCtx->cs.Sel;
1215	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1216	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1217	pCtx->cs.u32Limit = cbLimit;
1218	pCtx->cs.u64Base = u64Base;
1219	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1220	}
1221	else
1222	{
1223	Assert(enmBranch == IEMBRANCH_CALL);
1224	/* Calls are much more complicated. */
1225
1226	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1227	{
1228	uint16_t offNewStack; /* Offset of new stack in TSS. */
1229	uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1230	uint8_t uNewCSDpl;
1231	uint8_t cbWords;
1232	RTSEL uNewSS;
1233	RTSEL uOldSS;
1234	uint64_t uOldRsp;
1235	IEMSELDESC DescSS;
1236	RTPTRUNION uPtrTSS;
1237	RTGCPTR GCPtrTSS;
1238	RTPTRUNION uPtrParmWds;
1239	RTGCPTR GCPtrParmWds;
1240
1241	/* More privilege. This is the fun part. */
1242	Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1243
1244	/*
1245	* Determine new SS:rSP from the TSS.
1246	*/
1247	Assert(!pCtx->tr.Attr.n.u1DescType);
1248
1249	/* Figure out where the new stack pointer is stored in the TSS. */
1250	uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1251	if (!IEM_IS_LONG_MODE(pVCpu))
1252	{
1253	if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1254	{
1255	offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1256	cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1257	}
1258	else
1259	{
1260	Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1261	offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1262	cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1263	}
1264	}
1265	else
1266	{
1267	Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1268	offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1269	cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1270	}
1271
1272	/* Check against TSS limit. */
1273	if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1274	{
1275	Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1276	return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1277	}
1278
1279	GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1280	rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1281	if (rcStrict != VINF_SUCCESS)
1282	{
1283	Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1284	return rcStrict;
1285	}
1286
1287	if (!IEM_IS_LONG_MODE(pVCpu))
1288	{
1289	if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1290	{
1291	uNewRsp = uPtrTSS.pu32[0];
1292	uNewSS = uPtrTSS.pu16[2];
1293	}
1294	else
1295	{
1296	Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1297	uNewRsp = uPtrTSS.pu16[0];
1298	uNewSS = uPtrTSS.pu16[1];
1299	}
1300	}
1301	else
1302	{
1303	Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1304	/* SS will be a NULL selector, but that's valid. */
1305	uNewRsp = uPtrTSS.pu64[0];
1306	uNewSS = uNewCSDpl;
1307	}
1308
1309	/* Done with the TSS now. */
1310	rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1311	if (rcStrict != VINF_SUCCESS)
1312	{
1313	Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1314	return rcStrict;
1315	}
1316
1317	/* Only used outside of long mode. */
1318	cbWords = pDesc->Legacy.Gate.u4ParmCount;
1319
1320	/* If EFER.LMA is 0, there's extra work to do. */
1321	if (!IEM_IS_LONG_MODE(pVCpu))
1322	{
1323	if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1324	{
1325	Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1326	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1327	}
1328
1329	/* Grab the new SS descriptor. */
1330	rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1331	if (rcStrict != VINF_SUCCESS)
1332	return rcStrict;
1333
1334	/* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1335	if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1336	\|\| (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1337	{
1338	Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1339	uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1340	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1341	}
1342
1343	/* Ensure new SS is a writable data segment. */
1344	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1345	{
1346	Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1347	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1348	}
1349
1350	if (!DescSS.Legacy.Gen.u1Present)
1351	{
1352	Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1353	return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1354	}
1355	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1356	cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1357	else
1358	cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1359	}
1360	else
1361	{
1362	/* Just grab the new (NULL) SS descriptor. */
1363	rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1364	if (rcStrict != VINF_SUCCESS)
1365	return rcStrict;
1366
1367	cbNewStack = sizeof(uint64_t) * 4;
1368	}
1369
1370	/** @todo: According to Intel, new stack is checked for enough space first,
1371	* then switched. According to AMD, the stack is switched first and
1372	* then pushes might fault!
1373	*/
1374
1375	/** @todo: According to AMD, CS is loaded first, then SS.
1376	* According to Intel, it's the other way around!?
1377	*/
1378
1379	/** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1380
1381	/* Set the accessed bit before committing new SS. */
1382	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1383	{
1384	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1385	if (rcStrict != VINF_SUCCESS)
1386	return rcStrict;
1387	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1388	}
1389
1390	/* Remember the old SS:rSP and their linear address. */
1391	uOldSS = pCtx->ss.Sel;
1392	uOldRsp = pCtx->rsp;
1393
1394	GCPtrParmWds = pCtx->ss.u64Base + pCtx->rsp;
1395
1396	/* Commit new SS:rSP. */
1397	pCtx->ss.Sel = uNewSS;
1398	pCtx->ss.ValidSel = uNewSS;
1399	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1400	pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1401	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1402	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1403	pCtx->rsp = uNewRsp;
1404	pVCpu->iem.s.uCpl = uNewCSDpl;
1405	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1406	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1407
1408	/* Check new stack - may #SS(NewSS). */
1409	rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1410	&uPtrRet.pv, &uNewRsp);
1411	if (rcStrict != VINF_SUCCESS)
1412	{
1413	Log(("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1414	return rcStrict;
1415	}
1416
1417	if (!IEM_IS_LONG_MODE(pVCpu))
1418	{
1419	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1420	{
1421	/* Push the old CS:rIP. */
1422	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1423	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1424
1425	/* Map the relevant chunk of the old stack. */
1426	rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1427	if (rcStrict != VINF_SUCCESS)
1428	{
1429	Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1430	return rcStrict;
1431	}
1432
1433	/* Copy the parameter (d)words. */
1434	for (int i = 0; i < cbWords; ++i)
1435	uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1436
1437	/* Unmap the old stack. */
1438	rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1439	if (rcStrict != VINF_SUCCESS)
1440	{
1441	Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1442	return rcStrict;
1443	}
1444
1445	/* Push the old SS:rSP. */
1446	uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1447	uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1448	}
1449	else
1450	{
1451	Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1452
1453	/* Push the old CS:rIP. */
1454	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1455	uPtrRet.pu16[1] = pCtx->cs.Sel;
1456
1457	/* Map the relevant chunk of the old stack. */
1458	rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1459	if (rcStrict != VINF_SUCCESS)
1460	{
1461	Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1462	return rcStrict;
1463	}
1464
1465	/* Copy the parameter words. */
1466	for (int i = 0; i < cbWords; ++i)
1467	uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1468
1469	/* Unmap the old stack. */
1470	rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1471	if (rcStrict != VINF_SUCCESS)
1472	{
1473	Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1474	return rcStrict;
1475	}
1476
1477	/* Push the old SS:rSP. */
1478	uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1479	uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1480	}
1481	}
1482	else
1483	{
1484	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1485
1486	/* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1487	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1488	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1489	uPtrRet.pu64[2] = uOldRsp;
1490	uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1491	}
1492
1493	rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1494	if (rcStrict != VINF_SUCCESS)
1495	{
1496	Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1497	return rcStrict;
1498	}
1499
1500	/* Chop the high bits off if 16-bit gate (Intel says so). */
1501	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1502	uNewRip = (uint16_t)uNewRip;
1503
1504	/* Limit / canonical check. */
1505	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1506	if (!IEM_IS_LONG_MODE(pVCpu))
1507	{
1508	if (uNewRip > cbLimit)
1509	{
1510	Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1511	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1512	}
1513	u64Base = X86DESC_BASE(&DescCS.Legacy);
1514	}
1515	else
1516	{
1517	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1518	if (!IEM_IS_CANONICAL(uNewRip))
1519	{
1520	Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1521	return iemRaiseNotCanonical(pVCpu);
1522	}
1523	u64Base = 0;
1524	}
1525
1526	/*
1527	* Now set the accessed bit before
1528	* writing the return address to the stack and committing the result into
1529	* CS, CSHID and RIP.
1530	*/
1531	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1532	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1533	{
1534	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1535	if (rcStrict != VINF_SUCCESS)
1536	return rcStrict;
1537	/** @todo check what VT-x and AMD-V does. */
1538	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1539	}
1540
1541	/* Commit new CS:rIP. */
1542	pCtx->rip = uNewRip;
1543	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1544	pCtx->cs.Sel \|= pVCpu->iem.s.uCpl;
1545	pCtx->cs.ValidSel = pCtx->cs.Sel;
1546	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1547	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1548	pCtx->cs.u32Limit = cbLimit;
1549	pCtx->cs.u64Base = u64Base;
1550	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1551	}
1552	else
1553	{
1554	/* Same privilege. */
1555	/** @todo: This is very similar to regular far calls; merge! */
1556
1557	/* Check stack first - may #SS(0). */
1558	/** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1559	* 16-bit code cause a two or four byte CS to be pushed? */
1560	rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1561	IEM_IS_LONG_MODE(pVCpu) ? 8+8
1562	: pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1563	&uPtrRet.pv, &uNewRsp);
1564	if (rcStrict != VINF_SUCCESS)
1565	return rcStrict;
1566
1567	/* Chop the high bits off if 16-bit gate (Intel says so). */
1568	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1569	uNewRip = (uint16_t)uNewRip;
1570
1571	/* Limit / canonical check. */
1572	cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1573	if (!IEM_IS_LONG_MODE(pVCpu))
1574	{
1575	if (uNewRip > cbLimit)
1576	{
1577	Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1578	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1579	}
1580	u64Base = X86DESC_BASE(&DescCS.Legacy);
1581	}
1582	else
1583	{
1584	if (!IEM_IS_CANONICAL(uNewRip))
1585	{
1586	Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1587	return iemRaiseNotCanonical(pVCpu);
1588	}
1589	u64Base = 0;
1590	}
1591
1592	/*
1593	* Now set the accessed bit before
1594	* writing the return address to the stack and committing the result into
1595	* CS, CSHID and RIP.
1596	*/
1597	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1598	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1599	{
1600	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1601	if (rcStrict != VINF_SUCCESS)
1602	return rcStrict;
1603	/** @todo check what VT-x and AMD-V does. */
1604	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1605	}
1606
1607	/* stack */
1608	if (!IEM_IS_LONG_MODE(pVCpu))
1609	{
1610	if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1611	{
1612	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1613	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1614	}
1615	else
1616	{
1617	Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1618	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1619	uPtrRet.pu16[1] = pCtx->cs.Sel;
1620	}
1621	}
1622	else
1623	{
1624	Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1625	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1626	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1627	}
1628
1629	rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1630	if (rcStrict != VINF_SUCCESS)
1631	return rcStrict;
1632
1633	/* commit */
1634	pCtx->rip = uNewRip;
1635	pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1636	pCtx->cs.Sel \|= pVCpu->iem.s.uCpl;
1637	pCtx->cs.ValidSel = pCtx->cs.Sel;
1638	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1639	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1640	pCtx->cs.u32Limit = cbLimit;
1641	pCtx->cs.u64Base = u64Base;
1642	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1643	}
1644	}
1645	pCtx->eflags.Bits.u1RF = 0;
1646
1647	/* Flush the prefetch buffer. */
1648	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1649	return VINF_SUCCESS;
1650	#endif
1651	}
1652
1653
1654	/**
1655	* Implements far jumps and calls thru system selectors.
1656	*
1657	* @param uSel The selector.
1658	* @param enmBranch The kind of branching we're performing.
1659	* @param enmEffOpSize The effective operand size.
1660	* @param pDesc The descriptor corresponding to @a uSel.
1661	*/
1662	IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1663	{
1664	Assert(enmBranch == IEMBRANCH_JUMP \|\| enmBranch == IEMBRANCH_CALL);
1665	Assert((uSel & X86_SEL_MASK_OFF_RPL));
1666
1667	if (IEM_IS_LONG_MODE(pVCpu))
1668	switch (pDesc->Legacy.Gen.u4Type)
1669	{
1670	case AMD64_SEL_TYPE_SYS_CALL_GATE:
1671	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1672
1673	default:
1674	case AMD64_SEL_TYPE_SYS_LDT:
1675	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1676	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1677	case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1678	case AMD64_SEL_TYPE_SYS_INT_GATE:
1679	Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1680	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1681	}
1682
1683	switch (pDesc->Legacy.Gen.u4Type)
1684	{
1685	case X86_SEL_TYPE_SYS_286_CALL_GATE:
1686	case X86_SEL_TYPE_SYS_386_CALL_GATE:
1687	return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1688
1689	case X86_SEL_TYPE_SYS_TASK_GATE:
1690	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1691
1692	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1693	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1694	return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1695
1696	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1697	Log(("branch %04x -> busy 286 TSS\n", uSel));
1698	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1699
1700	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1701	Log(("branch %04x -> busy 386 TSS\n", uSel));
1702	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1703
1704	default:
1705	case X86_SEL_TYPE_SYS_LDT:
1706	case X86_SEL_TYPE_SYS_286_INT_GATE:
1707	case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1708	case X86_SEL_TYPE_SYS_386_INT_GATE:
1709	case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1710	Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1711	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1712	}
1713	}
1714
1715
1716	/**
1717	* Implements far jumps.
1718	*
1719	* @param uSel The selector.
1720	* @param offSeg The segment offset.
1721	* @param enmEffOpSize The effective operand size.
1722	*/
1723	IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1724	{
1725	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
1726	NOREF(cbInstr);
1727	Assert(offSeg <= UINT32_MAX);
1728
1729	/*
1730	* Real mode and V8086 mode are easy. The only snag seems to be that
1731	* CS.limit doesn't change and the limit check is done against the current
1732	* limit.
1733	*/
1734	if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1735	&& IEM_IS_REAL_OR_V86_MODE(pVCpu))
1736	{
1737	if (offSeg > pCtx->cs.u32Limit)
1738	{
1739	Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1740	return iemRaiseGeneralProtectionFault0(pVCpu);
1741	}
1742
1743	if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1744	pCtx->rip = offSeg;
1745	else
1746	pCtx->rip = offSeg & UINT16_MAX;
1747	pCtx->cs.Sel = uSel;
1748	pCtx->cs.ValidSel = uSel;
1749	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1750	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1751	pCtx->eflags.Bits.u1RF = 0;
1752	return VINF_SUCCESS;
1753	}
1754
1755	/*
1756	* Protected mode. Need to parse the specified descriptor...
1757	*/
1758	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1759	{
1760	Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1761	return iemRaiseGeneralProtectionFault0(pVCpu);
1762	}
1763
1764	/* Fetch the descriptor. */
1765	IEMSELDESC Desc;
1766	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1767	if (rcStrict != VINF_SUCCESS)
1768	return rcStrict;
1769
1770	/* Is it there? */
1771	if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1772	{
1773	Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1774	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1775	}
1776
1777	/*
1778	* Deal with it according to its type. We do the standard code selectors
1779	* here and dispatch the system selectors to worker functions.
1780	*/
1781	if (!Desc.Legacy.Gen.u1DescType)
1782	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1783
1784	/* Only code segments. */
1785	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1786	{
1787	Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1788	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1789	}
1790
1791	/* L vs D. */
1792	if ( Desc.Legacy.Gen.u1Long
1793	&& Desc.Legacy.Gen.u1DefBig
1794	&& IEM_IS_LONG_MODE(pVCpu))
1795	{
1796	Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1797	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1798	}
1799
1800	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1801	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1802	{
1803	if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1804	{
1805	Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1806	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1807	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1808	}
1809	}
1810	else
1811	{
1812	if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1813	{
1814	Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1815	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1816	}
1817	if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1818	{
1819	Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1820	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1821	}
1822	}
1823
1824	/* Chop the high bits if 16-bit (Intel says so). */
1825	if (enmEffOpSize == IEMMODE_16BIT)
1826	offSeg &= UINT16_MAX;
1827
1828	/* Limit check. (Should alternatively check for non-canonical addresses
1829	here, but that is ruled out by offSeg being 32-bit, right?) */
1830	uint64_t u64Base;
1831	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1832	if (Desc.Legacy.Gen.u1Long)
1833	u64Base = 0;
1834	else
1835	{
1836	if (offSeg > cbLimit)
1837	{
1838	Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1839	/** @todo: Intel says this is #GP(0)! */
1840	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1841	}
1842	u64Base = X86DESC_BASE(&Desc.Legacy);
1843	}
1844
1845	/*
1846	* Ok, everything checked out fine. Now set the accessed bit before
1847	* committing the result into CS, CSHID and RIP.
1848	*/
1849	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1850	{
1851	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1852	if (rcStrict != VINF_SUCCESS)
1853	return rcStrict;
1854	/** @todo check what VT-x and AMD-V does. */
1855	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
1856	}
1857
1858	/* commit */
1859	pCtx->rip = offSeg;
1860	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1861	pCtx->cs.Sel \|= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1862	pCtx->cs.ValidSel = pCtx->cs.Sel;
1863	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1864	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1865	pCtx->cs.u32Limit = cbLimit;
1866	pCtx->cs.u64Base = u64Base;
1867	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1868	pCtx->eflags.Bits.u1RF = 0;
1869	/** @todo check if the hidden bits are loaded correctly for 64-bit
1870	* mode. */
1871
1872	/* Flush the prefetch buffer. */
1873	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1874
1875	return VINF_SUCCESS;
1876	}
1877
1878
1879	/**
1880	* Implements far calls.
1881	*
1882	* This very similar to iemCImpl_FarJmp.
1883	*
1884	* @param uSel The selector.
1885	* @param offSeg The segment offset.
1886	* @param enmEffOpSize The operand size (in case we need it).
1887	*/
1888	IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1889	{
1890	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
1891	VBOXSTRICTRC rcStrict;
1892	uint64_t uNewRsp;
1893	RTPTRUNION uPtrRet;
1894
1895	/*
1896	* Real mode and V8086 mode are easy. The only snag seems to be that
1897	* CS.limit doesn't change and the limit check is done against the current
1898	* limit.
1899	*/
1900	if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1901	&& IEM_IS_REAL_OR_V86_MODE(pVCpu))
1902	{
1903	Assert(enmEffOpSize == IEMMODE_16BIT \|\| enmEffOpSize == IEMMODE_32BIT);
1904
1905	/* Check stack first - may #SS(0). */
1906	rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1907	&uPtrRet.pv, &uNewRsp);
1908	if (rcStrict != VINF_SUCCESS)
1909	return rcStrict;
1910
1911	/* Check the target address range. */
1912	if (offSeg > UINT32_MAX)
1913	return iemRaiseGeneralProtectionFault0(pVCpu);
1914
1915	/* Everything is fine, push the return address. */
1916	if (enmEffOpSize == IEMMODE_16BIT)
1917	{
1918	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1919	uPtrRet.pu16[1] = pCtx->cs.Sel;
1920	}
1921	else
1922	{
1923	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1924	uPtrRet.pu16[3] = pCtx->cs.Sel;
1925	}
1926	rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1927	if (rcStrict != VINF_SUCCESS)
1928	return rcStrict;
1929
1930	/* Branch. */
1931	pCtx->rip = offSeg;
1932	pCtx->cs.Sel = uSel;
1933	pCtx->cs.ValidSel = uSel;
1934	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1935	pCtx->cs.u64Base = (uint32_t)uSel << 4;
1936	pCtx->eflags.Bits.u1RF = 0;
1937	return VINF_SUCCESS;
1938	}
1939
1940	/*
1941	* Protected mode. Need to parse the specified descriptor...
1942	*/
1943	if (!(uSel & X86_SEL_MASK_OFF_RPL))
1944	{
1945	Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1946	return iemRaiseGeneralProtectionFault0(pVCpu);
1947	}
1948
1949	/* Fetch the descriptor. */
1950	IEMSELDESC Desc;
1951	rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1952	if (rcStrict != VINF_SUCCESS)
1953	return rcStrict;
1954
1955	/*
1956	* Deal with it according to its type. We do the standard code selectors
1957	* here and dispatch the system selectors to worker functions.
1958	*/
1959	if (!Desc.Legacy.Gen.u1DescType)
1960	return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1961
1962	/* Only code segments. */
1963	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1964	{
1965	Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1966	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1967	}
1968
1969	/* L vs D. */
1970	if ( Desc.Legacy.Gen.u1Long
1971	&& Desc.Legacy.Gen.u1DefBig
1972	&& IEM_IS_LONG_MODE(pVCpu))
1973	{
1974	Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1975	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1976	}
1977
1978	/* DPL/RPL/CPL check, where conforming segments makes a difference. */
1979	if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1980	{
1981	if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1982	{
1983	Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1984	uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1985	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1986	}
1987	}
1988	else
1989	{
1990	if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1991	{
1992	Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1993	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1994	}
1995	if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1996	{
1997	Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1998	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1999	}
2000	}
2001
2002	/* Is it there? */
2003	if (!Desc.Legacy.Gen.u1Present)
2004	{
2005	Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2006	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2007	}
2008
2009	/* Check stack first - may #SS(0). */
2010	/** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2011	* 16-bit code cause a two or four byte CS to be pushed? */
2012	rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2013	enmEffOpSize == IEMMODE_64BIT ? 8+8
2014	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2015	&uPtrRet.pv, &uNewRsp);
2016	if (rcStrict != VINF_SUCCESS)
2017	return rcStrict;
2018
2019	/* Chop the high bits if 16-bit (Intel says so). */
2020	if (enmEffOpSize == IEMMODE_16BIT)
2021	offSeg &= UINT16_MAX;
2022
2023	/* Limit / canonical check. */
2024	uint64_t u64Base;
2025	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2026	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2027	{
2028	if (!IEM_IS_CANONICAL(offSeg))
2029	{
2030	Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2031	return iemRaiseNotCanonical(pVCpu);
2032	}
2033	u64Base = 0;
2034	}
2035	else
2036	{
2037	if (offSeg > cbLimit)
2038	{
2039	Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2040	/** @todo: Intel says this is #GP(0)! */
2041	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2042	}
2043	u64Base = X86DESC_BASE(&Desc.Legacy);
2044	}
2045
2046	/*
2047	* Now set the accessed bit before
2048	* writing the return address to the stack and committing the result into
2049	* CS, CSHID and RIP.
2050	*/
2051	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2052	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2053	{
2054	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2055	if (rcStrict != VINF_SUCCESS)
2056	return rcStrict;
2057	/** @todo check what VT-x and AMD-V does. */
2058	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2059	}
2060
2061	/* stack */
2062	if (enmEffOpSize == IEMMODE_16BIT)
2063	{
2064	uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2065	uPtrRet.pu16[1] = pCtx->cs.Sel;
2066	}
2067	else if (enmEffOpSize == IEMMODE_32BIT)
2068	{
2069	uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2070	uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2071	}
2072	else
2073	{
2074	uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2075	uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2076	}
2077	rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2078	if (rcStrict != VINF_SUCCESS)
2079	return rcStrict;
2080
2081	/* commit */
2082	pCtx->rip = offSeg;
2083	pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2084	pCtx->cs.Sel \|= pVCpu->iem.s.uCpl;
2085	pCtx->cs.ValidSel = pCtx->cs.Sel;
2086	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2087	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2088	pCtx->cs.u32Limit = cbLimit;
2089	pCtx->cs.u64Base = u64Base;
2090	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2091	pCtx->eflags.Bits.u1RF = 0;
2092	/** @todo check if the hidden bits are loaded correctly for 64-bit
2093	* mode. */
2094
2095	/* Flush the prefetch buffer. */
2096	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2097
2098	return VINF_SUCCESS;
2099	}
2100
2101
2102	/**
2103	* Implements retf.
2104	*
2105	* @param enmEffOpSize The effective operand size.
2106	* @param cbPop The amount of arguments to pop from the stack
2107	* (bytes).
2108	*/
2109	IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2110	{
2111	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2112	VBOXSTRICTRC rcStrict;
2113	RTCPTRUNION uPtrFrame;
2114	uint64_t uNewRsp;
2115	uint64_t uNewRip;
2116	uint16_t uNewCs;
2117	NOREF(cbInstr);
2118
2119	/*
2120	* Read the stack values first.
2121	*/
2122	uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2123	: enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2124	rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2125	if (rcStrict != VINF_SUCCESS)
2126	return rcStrict;
2127	if (enmEffOpSize == IEMMODE_16BIT)
2128	{
2129	uNewRip = uPtrFrame.pu16[0];
2130	uNewCs = uPtrFrame.pu16[1];
2131	}
2132	else if (enmEffOpSize == IEMMODE_32BIT)
2133	{
2134	uNewRip = uPtrFrame.pu32[0];
2135	uNewCs = uPtrFrame.pu16[2];
2136	}
2137	else
2138	{
2139	uNewRip = uPtrFrame.pu64[0];
2140	uNewCs = uPtrFrame.pu16[4];
2141	}
2142
2143	/*
2144	* Real mode and V8086 mode are easy.
2145	*/
2146	if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2147	&& IEM_IS_REAL_OR_V86_MODE(pVCpu))
2148	{
2149	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2150	/** @todo check how this is supposed to work if sp=0xfffe. */
2151
2152	/* Check the limit of the new EIP. */
2153	/** @todo Intel pseudo code only does the limit check for 16-bit
2154	* operands, AMD does not make any distinction. What is right? */
2155	if (uNewRip > pCtx->cs.u32Limit)
2156	return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2157
2158	/* commit the operation. */
2159	rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2160	if (rcStrict != VINF_SUCCESS)
2161	return rcStrict;
2162	pCtx->rip = uNewRip;
2163	pCtx->cs.Sel = uNewCs;
2164	pCtx->cs.ValidSel = uNewCs;
2165	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2166	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2167	pCtx->eflags.Bits.u1RF = 0;
2168	/** @todo do we load attribs and limit as well? */
2169	if (cbPop)
2170	iemRegAddToRsp(pVCpu, pCtx, cbPop);
2171	return VINF_SUCCESS;
2172	}
2173
2174	/*
2175	* Protected mode is complicated, of course.
2176	*/
2177	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2178	{
2179	Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2180	return iemRaiseGeneralProtectionFault0(pVCpu);
2181	}
2182
2183	/* Fetch the descriptor. */
2184	IEMSELDESC DescCs;
2185	rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2186	if (rcStrict != VINF_SUCCESS)
2187	return rcStrict;
2188
2189	/* Can only return to a code selector. */
2190	if ( !DescCs.Legacy.Gen.u1DescType
2191	\|\| !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2192	{
2193	Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2194	uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2195	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2196	}
2197
2198	/* L vs D. */
2199	if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2200	&& DescCs.Legacy.Gen.u1DefBig
2201	&& IEM_IS_LONG_MODE(pVCpu))
2202	{
2203	Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2204	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2205	}
2206
2207	/* DPL/RPL/CPL checks. */
2208	if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2209	{
2210	Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2211	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2212	}
2213
2214	if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2215	{
2216	if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2217	{
2218	Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2219	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2220	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2221	}
2222	}
2223	else
2224	{
2225	if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2226	{
2227	Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2228	uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2229	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2230	}
2231	}
2232
2233	/* Is it there? */
2234	if (!DescCs.Legacy.Gen.u1Present)
2235	{
2236	Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2237	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2238	}
2239
2240	/*
2241	* Return to outer privilege? (We'll typically have entered via a call gate.)
2242	*/
2243	if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2244	{
2245	/* Read the outer stack pointer stored after the parameters. */
2246	RTCPTRUNION uPtrStack;
2247	rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
2248	if (rcStrict != VINF_SUCCESS)
2249	return rcStrict;
2250
2251	uPtrStack.pu8 += cbPop; /* Skip the parameters. */
2252
2253	uint16_t uNewOuterSs;
2254	uint64_t uNewOuterRsp;
2255	if (enmEffOpSize == IEMMODE_16BIT)
2256	{
2257	uNewOuterRsp = uPtrStack.pu16[0];
2258	uNewOuterSs = uPtrStack.pu16[1];
2259	}
2260	else if (enmEffOpSize == IEMMODE_32BIT)
2261	{
2262	uNewOuterRsp = uPtrStack.pu32[0];
2263	uNewOuterSs = uPtrStack.pu16[2];
2264	}
2265	else
2266	{
2267	uNewOuterRsp = uPtrStack.pu64[0];
2268	uNewOuterSs = uPtrStack.pu16[4];
2269	}
2270
2271	/* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2272	and read the selector. */
2273	IEMSELDESC DescSs;
2274	if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2275	{
2276	if ( !DescCs.Legacy.Gen.u1Long
2277	\|\| (uNewOuterSs & X86_SEL_RPL) == 3)
2278	{
2279	Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2280	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2281	return iemRaiseGeneralProtectionFault0(pVCpu);
2282	}
2283	/** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2284	iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2285	}
2286	else
2287	{
2288	/* Fetch the descriptor for the new stack segment. */
2289	rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2290	if (rcStrict != VINF_SUCCESS)
2291	return rcStrict;
2292	}
2293
2294	/* Check that RPL of stack and code selectors match. */
2295	if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2296	{
2297	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2298	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2299	}
2300
2301	/* Must be a writable data segment. */
2302	if ( !DescSs.Legacy.Gen.u1DescType
2303	\|\| (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2304	\|\| !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2305	{
2306	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2307	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2308	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2309	}
2310
2311	/* L vs D. (Not mentioned by intel.) */
2312	if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2313	&& DescSs.Legacy.Gen.u1DefBig
2314	&& IEM_IS_LONG_MODE(pVCpu))
2315	{
2316	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2317	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2318	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2319	}
2320
2321	/* DPL/RPL/CPL checks. */
2322	if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2323	{
2324	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2325	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2326	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2327	}
2328
2329	/* Is it there? */
2330	if (!DescSs.Legacy.Gen.u1Present)
2331	{
2332	Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2333	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2334	}
2335
2336	/* Calc SS limit.*/
2337	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2338
2339	/* Is RIP canonical or within CS.limit? */
2340	uint64_t u64Base;
2341	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2342
2343	/** @todo Testcase: Is this correct? */
2344	if ( DescCs.Legacy.Gen.u1Long
2345	&& IEM_IS_LONG_MODE(pVCpu) )
2346	{
2347	if (!IEM_IS_CANONICAL(uNewRip))
2348	{
2349	Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2350	return iemRaiseNotCanonical(pVCpu);
2351	}
2352	u64Base = 0;
2353	}
2354	else
2355	{
2356	if (uNewRip > cbLimitCs)
2357	{
2358	Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2359	uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2360	/** @todo: Intel says this is #GP(0)! */
2361	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2362	}
2363	u64Base = X86DESC_BASE(&DescCs.Legacy);
2364	}
2365
2366	/*
2367	* Now set the accessed bit before
2368	* writing the return address to the stack and committing the result into
2369	* CS, CSHID and RIP.
2370	*/
2371	/** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2372	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2373	{
2374	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2375	if (rcStrict != VINF_SUCCESS)
2376	return rcStrict;
2377	/** @todo check what VT-x and AMD-V does. */
2378	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2379	}
2380	/** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2381	if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2382	{
2383	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2384	if (rcStrict != VINF_SUCCESS)
2385	return rcStrict;
2386	/** @todo check what VT-x and AMD-V does. */
2387	DescSs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2388	}
2389
2390	/* commit */
2391	rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2392	if (rcStrict != VINF_SUCCESS)
2393	return rcStrict;
2394	if (enmEffOpSize == IEMMODE_16BIT)
2395	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2396	else
2397	pCtx->rip = uNewRip;
2398	pCtx->cs.Sel = uNewCs;
2399	pCtx->cs.ValidSel = uNewCs;
2400	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2401	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2402	pCtx->cs.u32Limit = cbLimitCs;
2403	pCtx->cs.u64Base = u64Base;
2404	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2405	pCtx->rsp = uNewOuterRsp;
2406	pCtx->ss.Sel = uNewOuterSs;
2407	pCtx->ss.ValidSel = uNewOuterSs;
2408	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2409	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2410	pCtx->ss.u32Limit = cbLimitSs;
2411	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2412	pCtx->ss.u64Base = 0;
2413	else
2414	pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2415
2416	pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2417	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2418	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2419	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2420	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2421
2422	/** @todo check if the hidden bits are loaded correctly for 64-bit
2423	* mode. */
2424
2425	if (cbPop)
2426	iemRegAddToRsp(pVCpu, pCtx, cbPop);
2427	pCtx->eflags.Bits.u1RF = 0;
2428
2429	/* Done! */
2430	}
2431	/*
2432	* Return to the same privilege level
2433	*/
2434	else
2435	{
2436	/* Limit / canonical check. */
2437	uint64_t u64Base;
2438	uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2439
2440	/** @todo Testcase: Is this correct? */
2441	if ( DescCs.Legacy.Gen.u1Long
2442	&& IEM_IS_LONG_MODE(pVCpu) )
2443	{
2444	if (!IEM_IS_CANONICAL(uNewRip))
2445	{
2446	Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2447	return iemRaiseNotCanonical(pVCpu);
2448	}
2449	u64Base = 0;
2450	}
2451	else
2452	{
2453	if (uNewRip > cbLimitCs)
2454	{
2455	Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2456	/** @todo: Intel says this is #GP(0)! */
2457	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2458	}
2459	u64Base = X86DESC_BASE(&DescCs.Legacy);
2460	}
2461
2462	/*
2463	* Now set the accessed bit before
2464	* writing the return address to the stack and committing the result into
2465	* CS, CSHID and RIP.
2466	*/
2467	/** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2468	if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2469	{
2470	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2471	if (rcStrict != VINF_SUCCESS)
2472	return rcStrict;
2473	/** @todo check what VT-x and AMD-V does. */
2474	DescCs.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
2475	}
2476
2477	/* commit */
2478	rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
2479	if (rcStrict != VINF_SUCCESS)
2480	return rcStrict;
2481	if (enmEffOpSize == IEMMODE_16BIT)
2482	pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2483	else
2484	pCtx->rip = uNewRip;
2485	pCtx->cs.Sel = uNewCs;
2486	pCtx->cs.ValidSel = uNewCs;
2487	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2488	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2489	pCtx->cs.u32Limit = cbLimitCs;
2490	pCtx->cs.u64Base = u64Base;
2491	/** @todo check if the hidden bits are loaded correctly for 64-bit
2492	* mode. */
2493	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2494	if (cbPop)
2495	iemRegAddToRsp(pVCpu, pCtx, cbPop);
2496	pCtx->eflags.Bits.u1RF = 0;
2497	}
2498
2499	/* Flush the prefetch buffer. */
2500	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2501	return VINF_SUCCESS;
2502	}
2503
2504
2505	/**
2506	* Implements retn.
2507	*
2508	* We're doing this in C because of the \#GP that might be raised if the popped
2509	* program counter is out of bounds.
2510	*
2511	* @param enmEffOpSize The effective operand size.
2512	* @param cbPop The amount of arguments to pop from the stack
2513	* (bytes).
2514	*/
2515	IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2516	{
2517	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2518	NOREF(cbInstr);
2519
2520	/* Fetch the RSP from the stack. */
2521	VBOXSTRICTRC rcStrict;
2522	RTUINT64U NewRip;
2523	RTUINT64U NewRsp;
2524	NewRsp.u = pCtx->rsp;
2525	switch (enmEffOpSize)
2526	{
2527	case IEMMODE_16BIT:
2528	NewRip.u = 0;
2529	rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2530	break;
2531	case IEMMODE_32BIT:
2532	NewRip.u = 0;
2533	rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2534	break;
2535	case IEMMODE_64BIT:
2536	rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2537	break;
2538	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2539	}
2540	if (rcStrict != VINF_SUCCESS)
2541	return rcStrict;
2542
2543	/* Check the new RSP before loading it. */
2544	/** @todo Should test this as the intel+amd pseudo code doesn't mention half
2545	* of it. The canonical test is performed here and for call. */
2546	if (enmEffOpSize != IEMMODE_64BIT)
2547	{
2548	if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2549	{
2550	Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2551	return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2552	}
2553	}
2554	else
2555	{
2556	if (!IEM_IS_CANONICAL(NewRip.u))
2557	{
2558	Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2559	return iemRaiseNotCanonical(pVCpu);
2560	}
2561	}
2562
2563	/* Apply cbPop */
2564	if (cbPop)
2565	iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2566
2567	/* Commit it. */
2568	pCtx->rip = NewRip.u;
2569	pCtx->rsp = NewRsp.u;
2570	pCtx->eflags.Bits.u1RF = 0;
2571
2572	/* Flush the prefetch buffer. */
2573	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2574
2575	return VINF_SUCCESS;
2576	}
2577
2578
2579	/**
2580	* Implements enter.
2581	*
2582	* We're doing this in C because the instruction is insane, even for the
2583	* u8NestingLevel=0 case dealing with the stack is tedious.
2584	*
2585	* @param enmEffOpSize The effective operand size.
2586	*/
2587	IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2588	{
2589	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2590
2591	/* Push RBP, saving the old value in TmpRbp. */
2592	RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2593	RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2594	RTUINT64U NewRbp;
2595	VBOXSTRICTRC rcStrict;
2596	if (enmEffOpSize == IEMMODE_64BIT)
2597	{
2598	rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2599	NewRbp = NewRsp;
2600	}
2601	else if (enmEffOpSize == IEMMODE_32BIT)
2602	{
2603	rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2604	NewRbp = NewRsp;
2605	}
2606	else
2607	{
2608	rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2609	NewRbp = TmpRbp;
2610	NewRbp.Words.w0 = NewRsp.Words.w0;
2611	}
2612	if (rcStrict != VINF_SUCCESS)
2613	return rcStrict;
2614
2615	/* Copy the parameters (aka nesting levels by Intel). */
2616	cParameters &= 0x1f;
2617	if (cParameters > 0)
2618	{
2619	switch (enmEffOpSize)
2620	{
2621	case IEMMODE_16BIT:
2622	if (pCtx->ss.Attr.n.u1DefBig)
2623	TmpRbp.DWords.dw0 -= 2;
2624	else
2625	TmpRbp.Words.w0 -= 2;
2626	do
2627	{
2628	uint16_t u16Tmp;
2629	rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2630	if (rcStrict != VINF_SUCCESS)
2631	break;
2632	rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2633	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2634	break;
2635
2636	case IEMMODE_32BIT:
2637	if (pCtx->ss.Attr.n.u1DefBig)
2638	TmpRbp.DWords.dw0 -= 4;
2639	else
2640	TmpRbp.Words.w0 -= 4;
2641	do
2642	{
2643	uint32_t u32Tmp;
2644	rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2645	if (rcStrict != VINF_SUCCESS)
2646	break;
2647	rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2648	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2649	break;
2650
2651	case IEMMODE_64BIT:
2652	TmpRbp.u -= 8;
2653	do
2654	{
2655	uint64_t u64Tmp;
2656	rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2657	if (rcStrict != VINF_SUCCESS)
2658	break;
2659	rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2660	} while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2661	break;
2662
2663	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2664	}
2665	if (rcStrict != VINF_SUCCESS)
2666	return VINF_SUCCESS;
2667
2668	/* Push the new RBP */
2669	if (enmEffOpSize == IEMMODE_64BIT)
2670	rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2671	else if (enmEffOpSize == IEMMODE_32BIT)
2672	rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2673	else
2674	rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2675	if (rcStrict != VINF_SUCCESS)
2676	return rcStrict;
2677
2678	}
2679
2680	/* Recalc RSP. */
2681	iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2682
2683	/** @todo Should probe write access at the new RSP according to AMD. */
2684
2685	/* Commit it. */
2686	pCtx->rbp = NewRbp.u;
2687	pCtx->rsp = NewRsp.u;
2688	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2689
2690	return VINF_SUCCESS;
2691	}
2692
2693
2694
2695	/**
2696	* Implements leave.
2697	*
2698	* We're doing this in C because messing with the stack registers is annoying
2699	* since they depends on SS attributes.
2700	*
2701	* @param enmEffOpSize The effective operand size.
2702	*/
2703	IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2704	{
2705	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2706
2707	/* Calculate the intermediate RSP from RBP and the stack attributes. */
2708	RTUINT64U NewRsp;
2709	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2710	NewRsp.u = pCtx->rbp;
2711	else if (pCtx->ss.Attr.n.u1DefBig)
2712	NewRsp.u = pCtx->ebp;
2713	else
2714	{
2715	/** @todo Check that LEAVE actually preserve the high EBP bits. */
2716	NewRsp.u = pCtx->rsp;
2717	NewRsp.Words.w0 = pCtx->bp;
2718	}
2719
2720	/* Pop RBP according to the operand size. */
2721	VBOXSTRICTRC rcStrict;
2722	RTUINT64U NewRbp;
2723	switch (enmEffOpSize)
2724	{
2725	case IEMMODE_16BIT:
2726	NewRbp.u = pCtx->rbp;
2727	rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2728	break;
2729	case IEMMODE_32BIT:
2730	NewRbp.u = 0;
2731	rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2732	break;
2733	case IEMMODE_64BIT:
2734	rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2735	break;
2736	IEM_NOT_REACHED_DEFAULT_CASE_RET();
2737	}
2738	if (rcStrict != VINF_SUCCESS)
2739	return rcStrict;
2740
2741
2742	/* Commit it. */
2743	pCtx->rbp = NewRbp.u;
2744	pCtx->rsp = NewRsp.u;
2745	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2746
2747	return VINF_SUCCESS;
2748	}
2749
2750
2751	/**
2752	* Implements int3 and int XX.
2753	*
2754	* @param u8Int The interrupt vector number.
2755	* @param fIsBpInstr Is it the breakpoint instruction.
2756	*/
2757	IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2758	{
2759	Assert(pVCpu->iem.s.cXcptRecursions == 0);
2760	return iemRaiseXcptOrInt(pVCpu,
2761	cbInstr,
2762	u8Int,
2763	(fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) \| IEM_XCPT_FLAGS_T_SOFT_INT,
2764	0,
2765	0);
2766	}
2767
2768
2769	/**
2770	* Implements iret for real mode and V8086 mode.
2771	*
2772	* @param enmEffOpSize The effective operand size.
2773	*/
2774	IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2775	{
2776	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2777	X86EFLAGS Efl;
2778	Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2779	NOREF(cbInstr);
2780
2781	/*
2782	* iret throws an exception if VME isn't enabled.
2783	*/
2784	if ( Efl.Bits.u1VM
2785	&& Efl.Bits.u2IOPL != 3
2786	&& !(pCtx->cr4 & X86_CR4_VME))
2787	return iemRaiseGeneralProtectionFault0(pVCpu);
2788
2789	/*
2790	* Do the stack bits, but don't commit RSP before everything checks
2791	* out right.
2792	*/
2793	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
2794	VBOXSTRICTRC rcStrict;
2795	RTCPTRUNION uFrame;
2796	uint16_t uNewCs;
2797	uint32_t uNewEip;
2798	uint32_t uNewFlags;
2799	uint64_t uNewRsp;
2800	if (enmEffOpSize == IEMMODE_32BIT)
2801	{
2802	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2803	if (rcStrict != VINF_SUCCESS)
2804	return rcStrict;
2805	uNewEip = uFrame.pu32[0];
2806	if (uNewEip > UINT16_MAX)
2807	return iemRaiseGeneralProtectionFault0(pVCpu);
2808
2809	uNewCs = (uint16_t)uFrame.pu32[1];
2810	uNewFlags = uFrame.pu32[2];
2811	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2812	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT
2813	\| X86_EFL_RF /\| X86_EFL_VM/ \| X86_EFL_AC /\|X86_EFL_VIF/ /\|X86_EFL_VIP/
2814	\| X86_EFL_ID;
2815	if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2816	uNewFlags &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
2817	uNewFlags \|= Efl.u & (X86_EFL_VM \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_1);
2818	}
2819	else
2820	{
2821	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2822	if (rcStrict != VINF_SUCCESS)
2823	return rcStrict;
2824	uNewEip = uFrame.pu16[0];
2825	uNewCs = uFrame.pu16[1];
2826	uNewFlags = uFrame.pu16[2];
2827	uNewFlags &= X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
2828	\| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT;
2829	uNewFlags \|= Efl.u & ((UINT32_C(0xffff0000) \| X86_EFL_1) & ~X86_EFL_RF);
2830	/** @todo The intel pseudo code does not indicate what happens to
2831	* reserved flags. We just ignore them. */
2832	/* Ancient CPU adjustments: See iemCImpl_popf. */
2833	if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2834	uNewFlags &= ~(X86_EFL_NT \| X86_EFL_IOPL);
2835	}
2836	/** @todo Check how this is supposed to work if sp=0xfffe. */
2837	Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2838	uNewCs, uNewEip, uNewFlags, uNewRsp));
2839
2840	/*
2841	* Check the limit of the new EIP.
2842	*/
2843	/** @todo Only the AMD pseudo code check the limit here, what's
2844	* right? */
2845	if (uNewEip > pCtx->cs.u32Limit)
2846	return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2847
2848	/*
2849	* V8086 checks and flag adjustments
2850	*/
2851	if (Efl.Bits.u1VM)
2852	{
2853	if (Efl.Bits.u2IOPL == 3)
2854	{
2855	/* Preserve IOPL and clear RF. */
2856	uNewFlags &= ~(X86_EFL_IOPL \| X86_EFL_RF);
2857	uNewFlags \|= Efl.u & (X86_EFL_IOPL);
2858	}
2859	else if ( enmEffOpSize == IEMMODE_16BIT
2860	&& ( !(uNewFlags & X86_EFL_IF)
2861	\|\| !Efl.Bits.u1VIP )
2862	&& !(uNewFlags & X86_EFL_TF) )
2863	{
2864	/* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2865	uNewFlags &= ~X86_EFL_VIF;
2866	uNewFlags \|= (uNewFlags & X86_EFL_IF) << (19 - 9);
2867	uNewFlags &= ~(X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_RF);
2868	uNewFlags \|= Efl.u & (X86_EFL_IF \| X86_EFL_IOPL);
2869	}
2870	else
2871	return iemRaiseGeneralProtectionFault0(pVCpu);
2872	Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2873	}
2874
2875	/*
2876	* Commit the operation.
2877	*/
2878	rcStrict = iemMemStackPopCommitSpecial(pVCpu, uFrame.pv, uNewRsp);
2879	if (rcStrict != VINF_SUCCESS)
2880	return rcStrict;
2881	#ifdef DBGFTRACE_ENABLED
2882	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2883	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2884	#endif
2885
2886	pCtx->rip = uNewEip;
2887	pCtx->cs.Sel = uNewCs;
2888	pCtx->cs.ValidSel = uNewCs;
2889	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2890	pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2891	/** @todo do we load attribs and limit as well? */
2892	Assert(uNewFlags & X86_EFL_1);
2893	IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2894
2895	/* Flush the prefetch buffer. */
2896	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2897
2898	return VINF_SUCCESS;
2899	}
2900
2901
2902	/**
2903	* Loads a segment register when entering V8086 mode.
2904	*
2905	* @param pSReg The segment register.
2906	* @param uSeg The segment to load.
2907	*/
2908	static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2909	{
2910	pSReg->Sel = uSeg;
2911	pSReg->ValidSel = uSeg;
2912	pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2913	pSReg->u64Base = (uint32_t)uSeg << 4;
2914	pSReg->u32Limit = 0xffff;
2915	pSReg->Attr.u = X86_SEL_TYPE_RW_ACC \| RT_BIT(4) /!sys/ \| RT_BIT(7) /P/ \| (3 /DPL/ << 5); /* VT-x wants 0xf3 */
2916	/** @todo Testcase: Check if VT-x really needs this and what it does itself when
2917	* IRET'ing to V8086. */
2918	}
2919
2920
2921	/**
2922	* Implements iret for protected mode returning to V8086 mode.
2923	*
2924	* @param pCtx Pointer to the CPU context.
2925	* @param uNewEip The new EIP.
2926	* @param uNewCs The new CS.
2927	* @param uNewFlags The new EFLAGS.
2928	* @param uNewRsp The RSP after the initial IRET frame.
2929	*
2930	* @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2931	*/
2932	IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2933	uint32_t, uNewFlags, uint64_t, uNewRsp)
2934	{
2935	/*
2936	* Pop the V8086 specific frame bits off the stack.
2937	*/
2938	VBOXSTRICTRC rcStrict;
2939	RTCPTRUNION uFrame;
2940	rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
2941	if (rcStrict != VINF_SUCCESS)
2942	return rcStrict;
2943	uint32_t uNewEsp = uFrame.pu32[0];
2944	uint16_t uNewSs = uFrame.pu32[1];
2945	uint16_t uNewEs = uFrame.pu32[2];
2946	uint16_t uNewDs = uFrame.pu32[3];
2947	uint16_t uNewFs = uFrame.pu32[4];
2948	uint16_t uNewGs = uFrame.pu32[5];
2949	rcStrict = iemMemCommitAndUnmap(pVCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
2950	if (rcStrict != VINF_SUCCESS)
2951	return rcStrict;
2952
2953	/*
2954	* Commit the operation.
2955	*/
2956	uNewFlags &= X86_EFL_LIVE_MASK;
2957	uNewFlags \|= X86_EFL_RA1_MASK;
2958	#ifdef DBGFTRACE_ENABLED
2959	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2960	pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2961	#endif
2962
2963	IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2964	iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2965	iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2966	iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2967	iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2968	iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2969	iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2970	pCtx->rip = (uint16_t)uNewEip;
2971	pCtx->rsp = uNewEsp; /** @todo check this out! */
2972	pVCpu->iem.s.uCpl = 3;
2973
2974	/* Flush the prefetch buffer. */
2975	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2976
2977	return VINF_SUCCESS;
2978	}
2979
2980
2981	/**
2982	* Implements iret for protected mode returning via a nested task.
2983	*
2984	* @param enmEffOpSize The effective operand size.
2985	*/
2986	IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2987	{
2988	Log7(("iemCImpl_iret_prot_NestedTask:\n"));
2989	#ifndef IEM_IMPLEMENTS_TASKSWITCH
2990	IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2991	#else
2992	/*
2993	* Read the segment selector in the link-field of the current TSS.
2994	*/
2995	RTSEL uSelRet;
2996	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
2997	VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
2998	if (rcStrict != VINF_SUCCESS)
2999	return rcStrict;
3000
3001	/*
3002	* Fetch the returning task's TSS descriptor from the GDT.
3003	*/
3004	if (uSelRet & X86_SEL_LDT)
3005	{
3006	Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3007	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3008	}
3009
3010	IEMSELDESC TssDesc;
3011	rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3012	if (rcStrict != VINF_SUCCESS)
3013	return rcStrict;
3014
3015	if (TssDesc.Legacy.Gate.u1DescType)
3016	{
3017	Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3018	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3019	}
3020
3021	if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3022	&& TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3023	{
3024	Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3025	return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3026	}
3027
3028	if (!TssDesc.Legacy.Gate.u1Present)
3029	{
3030	Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3031	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3032	}
3033
3034	uint32_t uNextEip = pCtx->eip + cbInstr;
3035	return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags /, 0 / uErr */,
3036	0 /* uCr2 */, uSelRet, &TssDesc);
3037	#endif
3038	}
3039
3040
3041	/**
3042	* Implements iret for protected mode
3043	*
3044	* @param enmEffOpSize The effective operand size.
3045	*/
3046	IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3047	{
3048	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
3049	NOREF(cbInstr);
3050	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
3051
3052	/*
3053	* Nested task return.
3054	*/
3055	if (pCtx->eflags.Bits.u1NT)
3056	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3057
3058	/*
3059	* Normal return.
3060	*
3061	* Do the stack bits, but don't commit RSP before everything checks
3062	* out right.
3063	*/
3064	Assert(enmEffOpSize == IEMMODE_32BIT \|\| enmEffOpSize == IEMMODE_16BIT);
3065	VBOXSTRICTRC rcStrict;
3066	RTCPTRUNION uFrame;
3067	uint16_t uNewCs;
3068	uint32_t uNewEip;
3069	uint32_t uNewFlags;
3070	uint64_t uNewRsp;
3071	if (enmEffOpSize == IEMMODE_32BIT)
3072	{
3073	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3074	if (rcStrict != VINF_SUCCESS)
3075	return rcStrict;
3076	uNewEip = uFrame.pu32[0];
3077	uNewCs = (uint16_t)uFrame.pu32[1];
3078	uNewFlags = uFrame.pu32[2];
3079	}
3080	else
3081	{
3082	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3083	if (rcStrict != VINF_SUCCESS)
3084	return rcStrict;
3085	uNewEip = uFrame.pu16[0];
3086	uNewCs = uFrame.pu16[1];
3087	uNewFlags = uFrame.pu16[2];
3088	}
3089	rcStrict = iemMemCommitAndUnmap(pVCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
3090	if (rcStrict != VINF_SUCCESS)
3091	return rcStrict;
3092	Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3093
3094	/*
3095	* We're hopefully not returning to V8086 mode...
3096	*/
3097	if ( (uNewFlags & X86_EFL_VM)
3098	&& pVCpu->iem.s.uCpl == 0)
3099	{
3100	Assert(enmEffOpSize == IEMMODE_32BIT);
3101	return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3102	}
3103
3104	/*
3105	* Protected mode.
3106	*/
3107	/* Read the CS descriptor. */
3108	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3109	{
3110	Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3111	return iemRaiseGeneralProtectionFault0(pVCpu);
3112	}
3113
3114	IEMSELDESC DescCS;
3115	rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3116	if (rcStrict != VINF_SUCCESS)
3117	{
3118	Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3119	return rcStrict;
3120	}
3121
3122	/* Must be a code descriptor. */
3123	if (!DescCS.Legacy.Gen.u1DescType)
3124	{
3125	Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3126	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3127	}
3128	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3129	{
3130	Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3131	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3132	}
3133
3134	#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3135	/* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3136	PVM pVM = pVCpu->CTX_SUFF(pVM);
3137	if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3138	{
3139	if ((uNewCs & X86_SEL_RPL) == 1)
3140	{
3141	if ( pVCpu->iem.s.uCpl == 0
3142	&& ( !EMIsRawRing1Enabled(pVM)
3143	\|\| pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3144	{
3145	Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3146	uNewCs &= X86_SEL_MASK_OFF_RPL;
3147	}
3148	# ifdef LOG_ENABLED
3149	else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3150	Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3151	# endif
3152	}
3153	else if ( (uNewCs & X86_SEL_RPL) == 2
3154	&& EMIsRawRing1Enabled(pVM)
3155	&& pVCpu->iem.s.uCpl <= 1)
3156	{
3157	Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) \| 1));
3158	uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) \| 2;
3159	}
3160	}
3161	#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3162
3163
3164	/* Privilege checks. */
3165	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3166	{
3167	if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3168	{
3169	Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3170	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3171	}
3172	}
3173	else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3174	{
3175	Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3176	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3177	}
3178	if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3179	{
3180	Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3181	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3182	}
3183
3184	/* Present? */
3185	if (!DescCS.Legacy.Gen.u1Present)
3186	{
3187	Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3188	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3189	}
3190
3191	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3192
3193	/*
3194	* Return to outer level?
3195	*/
3196	if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3197	{
3198	uint16_t uNewSS;
3199	uint32_t uNewESP;
3200	if (enmEffOpSize == IEMMODE_32BIT)
3201	{
3202	rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3203	if (rcStrict != VINF_SUCCESS)
3204	return rcStrict;
3205	/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3206	* 16-bit or 32-bit are being loaded into SP depends on the D/B
3207	* bit of the popped SS selector it turns out. */
3208	uNewESP = uFrame.pu32[0];
3209	uNewSS = (uint16_t)uFrame.pu32[1];
3210	}
3211	else
3212	{
3213	rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3214	if (rcStrict != VINF_SUCCESS)
3215	return rcStrict;
3216	uNewESP = uFrame.pu16[0];
3217	uNewSS = uFrame.pu16[1];
3218	}
3219	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3220	if (rcStrict != VINF_SUCCESS)
3221	return rcStrict;
3222	Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3223
3224	/* Read the SS descriptor. */
3225	if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3226	{
3227	Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3228	return iemRaiseGeneralProtectionFault0(pVCpu);
3229	}
3230
3231	IEMSELDESC DescSS;
3232	rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3233	if (rcStrict != VINF_SUCCESS)
3234	{
3235	Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3236	uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3237	return rcStrict;
3238	}
3239
3240	/* Privilege checks. */
3241	if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3242	{
3243	Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3244	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3245	}
3246	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3247	{
3248	Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3249	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3250	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3251	}
3252
3253	/* Must be a writeable data segment descriptor. */
3254	if (!DescSS.Legacy.Gen.u1DescType)
3255	{
3256	Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3257	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3258	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3259	}
3260	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3261	{
3262	Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3263	uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3264	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3265	}
3266
3267	/* Present? */
3268	if (!DescSS.Legacy.Gen.u1Present)
3269	{
3270	Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3271	return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3272	}
3273
3274	uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3275
3276	/* Check EIP. */
3277	if (uNewEip > cbLimitCS)
3278	{
3279	Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3280	uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3281	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3282	return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3283	}
3284
3285	/*
3286	* Commit the changes, marking CS and SS accessed first since
3287	* that may fail.
3288	*/
3289	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3290	{
3291	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3292	if (rcStrict != VINF_SUCCESS)
3293	return rcStrict;
3294	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3295	}
3296	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3297	{
3298	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3299	if (rcStrict != VINF_SUCCESS)
3300	return rcStrict;
3301	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3302	}
3303
3304	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3305	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3306	if (enmEffOpSize != IEMMODE_16BIT)
3307	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3308	if (pVCpu->iem.s.uCpl == 0)
3309	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
3310	else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3311	fEFlagsMask \|= X86_EFL_IF;
3312	if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3313	fEFlagsMask &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
3314	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3315	fEFlagsNew &= ~fEFlagsMask;
3316	fEFlagsNew \|= uNewFlags & fEFlagsMask;
3317	#ifdef DBGFTRACE_ENABLED
3318	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3319	pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3320	uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3321	#endif
3322
3323	IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3324	pCtx->rip = uNewEip;
3325	pCtx->cs.Sel = uNewCs;
3326	pCtx->cs.ValidSel = uNewCs;
3327	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3328	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3329	pCtx->cs.u32Limit = cbLimitCS;
3330	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3331	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3332	if (!pCtx->ss.Attr.n.u1DefBig)
3333	pCtx->sp = (uint16_t)uNewESP;
3334	else
3335	pCtx->rsp = uNewESP;
3336	pCtx->ss.Sel = uNewSS;
3337	pCtx->ss.ValidSel = uNewSS;
3338	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3339	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3340	pCtx->ss.u32Limit = cbLimitSs;
3341	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3342
3343	pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3344	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3345	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3346	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3347	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3348
3349	/* Done! */
3350
3351	}
3352	/*
3353	* Return to the same level.
3354	*/
3355	else
3356	{
3357	/* Check EIP. */
3358	if (uNewEip > cbLimitCS)
3359	{
3360	Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3361	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3362	return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3363	}
3364
3365	/*
3366	* Commit the changes, marking CS first since it may fail.
3367	*/
3368	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3369	{
3370	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3371	if (rcStrict != VINF_SUCCESS)
3372	return rcStrict;
3373	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3374	}
3375
3376	X86EFLAGS NewEfl;
3377	NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3378	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3379	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3380	if (enmEffOpSize != IEMMODE_16BIT)
3381	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3382	if (pVCpu->iem.s.uCpl == 0)
3383	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is 0 */
3384	else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3385	fEFlagsMask \|= X86_EFL_IF;
3386	if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3387	fEFlagsMask &= ~(X86_EFL_AC \| X86_EFL_ID \| X86_EFL_VIF \| X86_EFL_VIP);
3388	NewEfl.u &= ~fEFlagsMask;
3389	NewEfl.u \|= fEFlagsMask & uNewFlags;
3390	#ifdef DBGFTRACE_ENABLED
3391	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3392	pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3393	uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3394	#endif
3395
3396	IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3397	pCtx->rip = uNewEip;
3398	pCtx->cs.Sel = uNewCs;
3399	pCtx->cs.ValidSel = uNewCs;
3400	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3401	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3402	pCtx->cs.u32Limit = cbLimitCS;
3403	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3404	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3405	pCtx->rsp = uNewRsp;
3406	/* Done! */
3407	}
3408
3409	/* Flush the prefetch buffer. */
3410	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3411
3412	return VINF_SUCCESS;
3413	}
3414
3415
3416	/**
3417	* Implements iret for long mode
3418	*
3419	* @param enmEffOpSize The effective operand size.
3420	*/
3421	IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3422	{
3423	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
3424	NOREF(cbInstr);
3425
3426	/*
3427	* Nested task return is not supported in long mode.
3428	*/
3429	if (pCtx->eflags.Bits.u1NT)
3430	{
3431	Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3432	return iemRaiseGeneralProtectionFault0(pVCpu);
3433	}
3434
3435	/*
3436	* Normal return.
3437	*
3438	* Do the stack bits, but don't commit RSP before everything checks
3439	* out right.
3440	*/
3441	VBOXSTRICTRC rcStrict;
3442	RTCPTRUNION uFrame;
3443	uint64_t uNewRip;
3444	uint16_t uNewCs;
3445	uint16_t uNewSs;
3446	uint32_t uNewFlags;
3447	uint64_t uNewRsp;
3448	if (enmEffOpSize == IEMMODE_64BIT)
3449	{
3450	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3451	if (rcStrict != VINF_SUCCESS)
3452	return rcStrict;
3453	uNewRip = uFrame.pu64[0];
3454	uNewCs = (uint16_t)uFrame.pu64[1];
3455	uNewFlags = (uint32_t)uFrame.pu64[2];
3456	uNewRsp = uFrame.pu64[3];
3457	uNewSs = (uint16_t)uFrame.pu64[4];
3458	}
3459	else if (enmEffOpSize == IEMMODE_32BIT)
3460	{
3461	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3462	if (rcStrict != VINF_SUCCESS)
3463	return rcStrict;
3464	uNewRip = uFrame.pu32[0];
3465	uNewCs = (uint16_t)uFrame.pu32[1];
3466	uNewFlags = uFrame.pu32[2];
3467	uNewRsp = uFrame.pu32[3];
3468	uNewSs = (uint16_t)uFrame.pu32[4];
3469	}
3470	else
3471	{
3472	Assert(enmEffOpSize == IEMMODE_16BIT);
3473	rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3474	if (rcStrict != VINF_SUCCESS)
3475	return rcStrict;
3476	uNewRip = uFrame.pu16[0];
3477	uNewCs = uFrame.pu16[1];
3478	uNewFlags = uFrame.pu16[2];
3479	uNewRsp = uFrame.pu16[3];
3480	uNewSs = uFrame.pu16[4];
3481	}
3482	rcStrict = iemMemCommitAndUnmap(pVCpu, (void )uFrame.pv, IEM_ACCESS_STACK_R); / don't use iemMemStackPopCommitSpecial here. */
3483	if (rcStrict != VINF_SUCCESS)
3484	return rcStrict;
3485	Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3486
3487	/*
3488	* Check stuff.
3489	*/
3490	/* Read the CS descriptor. */
3491	if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3492	{
3493	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3494	return iemRaiseGeneralProtectionFault0(pVCpu);
3495	}
3496
3497	IEMSELDESC DescCS;
3498	rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3499	if (rcStrict != VINF_SUCCESS)
3500	{
3501	Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3502	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3503	return rcStrict;
3504	}
3505
3506	/* Must be a code descriptor. */
3507	if ( !DescCS.Legacy.Gen.u1DescType
3508	\|\| !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3509	{
3510	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3511	uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3512	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3513	}
3514
3515	/* Privilege checks. */
3516	uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3517	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3518	{
3519	if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3520	{
3521	Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3522	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3523	}
3524	}
3525	else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3526	{
3527	Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3528	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3529	}
3530	if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3531	{
3532	Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3533	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3534	}
3535
3536	/* Present? */
3537	if (!DescCS.Legacy.Gen.u1Present)
3538	{
3539	Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3540	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3541	}
3542
3543	uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3544
3545	/* Read the SS descriptor. */
3546	IEMSELDESC DescSS;
3547	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3548	{
3549	if ( !DescCS.Legacy.Gen.u1Long
3550	\|\| DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3551	\|\| uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3552	{
3553	Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3554	return iemRaiseGeneralProtectionFault0(pVCpu);
3555	}
3556	DescSS.Legacy.u = 0;
3557	}
3558	else
3559	{
3560	rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3561	if (rcStrict != VINF_SUCCESS)
3562	{
3563	Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3564	uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3565	return rcStrict;
3566	}
3567	}
3568
3569	/* Privilege checks. */
3570	if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3571	{
3572	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3573	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3574	}
3575
3576	uint32_t cbLimitSs;
3577	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3578	cbLimitSs = UINT32_MAX;
3579	else
3580	{
3581	if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3582	{
3583	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3584	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3585	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3586	}
3587
3588	/* Must be a writeable data segment descriptor. */
3589	if (!DescSS.Legacy.Gen.u1DescType)
3590	{
3591	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3592	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3593	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3594	}
3595	if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3596	{
3597	Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3598	uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3599	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3600	}
3601
3602	/* Present? */
3603	if (!DescSS.Legacy.Gen.u1Present)
3604	{
3605	Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3606	return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3607	}
3608	cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3609	}
3610
3611	/* Check EIP. */
3612	if (DescCS.Legacy.Gen.u1Long)
3613	{
3614	if (!IEM_IS_CANONICAL(uNewRip))
3615	{
3616	Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3617	uNewCs, uNewRip, uNewSs, uNewRsp));
3618	return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3619	}
3620	}
3621	else
3622	{
3623	if (uNewRip > cbLimitCS)
3624	{
3625	Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3626	uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3627	/** @todo: Which is it, #GP(0) or #GP(sel)? */
3628	return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3629	}
3630	}
3631
3632	/*
3633	* Commit the changes, marking CS and SS accessed first since
3634	* that may fail.
3635	*/
3636	/** @todo where exactly are these actually marked accessed by a real CPU? */
3637	if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3638	{
3639	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3640	if (rcStrict != VINF_SUCCESS)
3641	return rcStrict;
3642	DescCS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3643	}
3644	if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3645	{
3646	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3647	if (rcStrict != VINF_SUCCESS)
3648	return rcStrict;
3649	DescSS.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
3650	}
3651
3652	uint32_t fEFlagsMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF
3653	\| X86_EFL_TF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_NT;
3654	if (enmEffOpSize != IEMMODE_16BIT)
3655	fEFlagsMask \|= X86_EFL_RF \| X86_EFL_AC \| X86_EFL_ID;
3656	if (pVCpu->iem.s.uCpl == 0)
3657	fEFlagsMask \|= X86_EFL_IF \| X86_EFL_IOPL \| X86_EFL_VIF \| X86_EFL_VIP; /* VM is ignored */
3658	else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3659	fEFlagsMask \|= X86_EFL_IF;
3660	uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3661	fEFlagsNew &= ~fEFlagsMask;
3662	fEFlagsNew \|= uNewFlags & fEFlagsMask;
3663	#ifdef DBGFTRACE_ENABLED
3664	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3665	pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3666	#endif
3667
3668	IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3669	pCtx->rip = uNewRip;
3670	pCtx->cs.Sel = uNewCs;
3671	pCtx->cs.ValidSel = uNewCs;
3672	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3673	pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3674	pCtx->cs.u32Limit = cbLimitCS;
3675	pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3676	pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3677	if (pCtx->cs.Attr.n.u1Long \|\| pCtx->cs.Attr.n.u1DefBig)
3678	pCtx->rsp = uNewRsp;
3679	else
3680	pCtx->sp = (uint16_t)uNewRsp;
3681	pCtx->ss.Sel = uNewSs;
3682	pCtx->ss.ValidSel = uNewSs;
3683	if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3684	{
3685	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3686	pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE \| (uNewCpl << X86DESCATTR_DPL_SHIFT);
3687	pCtx->ss.u32Limit = UINT32_MAX;
3688	pCtx->ss.u64Base = 0;
3689	Log2(("iretq new SS: NULL\n"));
3690	}
3691	else
3692	{
3693	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3694	pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3695	pCtx->ss.u32Limit = cbLimitSs;
3696	pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3697	Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3698	}
3699
3700	if (pVCpu->iem.s.uCpl != uNewCpl)
3701	{
3702	pVCpu->iem.s.uCpl = uNewCpl;
3703	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3704	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3705	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3706	iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3707	}
3708
3709	/* Flush the prefetch buffer. */
3710	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3711
3712	return VINF_SUCCESS;
3713	}
3714
3715
3716	/**
3717	* Implements iret.
3718	*
3719	* @param enmEffOpSize The effective operand size.
3720	*/
3721	IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3722	{
3723	/*
3724	* First, clear NMI blocking, if any, before causing any exceptions.
3725	*/
3726	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3727
3728	/*
3729	* Call a mode specific worker.
3730	*/
3731	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3732	return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3733	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3734	return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3735	return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3736	}
3737
3738
3739	/**
3740	* Implements SYSCALL (AMD and Intel64).
3741	*
3742	* @param enmEffOpSize The effective operand size.
3743	*/
3744	IEM_CIMPL_DEF_0(iemCImpl_syscall)
3745	{
3746	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
3747
3748	/*
3749	* Check preconditions.
3750	*
3751	* Note that CPUs described in the documentation may load a few odd values
3752	* into CS and SS than we allow here. This has yet to be checked on real
3753	* hardware.
3754	*/
3755	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3756	{
3757	Log(("syscall: Not enabled in EFER -> #UD\n"));
3758	return iemRaiseUndefinedOpcode(pVCpu);
3759	}
3760	if (!(pCtx->cr0 & X86_CR0_PE))
3761	{
3762	Log(("syscall: Protected mode is required -> #GP(0)\n"));
3763	return iemRaiseGeneralProtectionFault0(pVCpu);
3764	}
3765	if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3766	{
3767	Log(("syscall: Only available in long mode on intel -> #UD\n"));
3768	return iemRaiseUndefinedOpcode(pVCpu);
3769	}
3770
3771	/** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3772	/** @todo what about LDT selectors? Shouldn't matter, really. */
3773	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3774	uint16_t uNewSs = uNewCs + 8;
3775	if (uNewCs == 0 \|\| uNewSs == 0)
3776	{
3777	Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3778	return iemRaiseGeneralProtectionFault0(pVCpu);
3779	}
3780
3781	/* Long mode and legacy mode differs. */
3782	if (CPUMIsGuestInLongModeEx(pCtx))
3783	{
3784	uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3785
3786	/* This test isn't in the docs, but I'm not trusting the guys writing
3787	the MSRs to have validated the values as canonical like they should. */
3788	if (!IEM_IS_CANONICAL(uNewRip))
3789	{
3790	Log(("syscall: Only available in long mode on intel -> #UD\n"));
3791	return iemRaiseUndefinedOpcode(pVCpu);
3792	}
3793
3794	/*
3795	* Commit it.
3796	*/
3797	Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3798	pCtx->rcx = pCtx->rip + cbInstr;
3799	pCtx->rip = uNewRip;
3800
3801	pCtx->rflags.u &= ~X86_EFL_RF;
3802	pCtx->r11 = pCtx->rflags.u;
3803	pCtx->rflags.u &= ~pCtx->msrSFMASK;
3804	pCtx->rflags.u \|= X86_EFL_1;
3805
3806	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
3807	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
3808	}
3809	else
3810	{
3811	/*
3812	* Commit it.
3813	*/
3814	Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3815	pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3816	pCtx->rcx = pCtx->eip + cbInstr;
3817	pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3818	pCtx->rflags.u &= ~(X86_EFL_VM \| X86_EFL_IF \| X86_EFL_RF);
3819
3820	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC;
3821	pCtx->ss.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_RW_ACC;
3822	}
3823	pCtx->cs.Sel = uNewCs;
3824	pCtx->cs.ValidSel = uNewCs;
3825	pCtx->cs.u64Base = 0;
3826	pCtx->cs.u32Limit = UINT32_MAX;
3827	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3828
3829	pCtx->ss.Sel = uNewSs;
3830	pCtx->ss.ValidSel = uNewSs;
3831	pCtx->ss.u64Base = 0;
3832	pCtx->ss.u32Limit = UINT32_MAX;
3833	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3834
3835	/* Flush the prefetch buffer. */
3836	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3837
3838	return VINF_SUCCESS;
3839	}
3840
3841
3842	/**
3843	* Implements SYSRET (AMD and Intel64).
3844	*/
3845	IEM_CIMPL_DEF_0(iemCImpl_sysret)
3846
3847	{
3848	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
3849
3850	/*
3851	* Check preconditions.
3852	*
3853	* Note that CPUs described in the documentation may load a few odd values
3854	* into CS and SS than we allow here. This has yet to be checked on real
3855	* hardware.
3856	*/
3857	if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3858	{
3859	Log(("sysret: Not enabled in EFER -> #UD\n"));
3860	return iemRaiseUndefinedOpcode(pVCpu);
3861	}
3862	if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3863	{
3864	Log(("sysret: Only available in long mode on intel -> #UD\n"));
3865	return iemRaiseUndefinedOpcode(pVCpu);
3866	}
3867	if (!(pCtx->cr0 & X86_CR0_PE))
3868	{
3869	Log(("sysret: Protected mode is required -> #GP(0)\n"));
3870	return iemRaiseGeneralProtectionFault0(pVCpu);
3871	}
3872	if (pVCpu->iem.s.uCpl != 0)
3873	{
3874	Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3875	return iemRaiseGeneralProtectionFault0(pVCpu);
3876	}
3877
3878	/** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3879	uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3880	uint16_t uNewSs = uNewCs + 8;
3881	if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3882	uNewCs += 16;
3883	if (uNewCs == 0 \|\| uNewSs == 0)
3884	{
3885	Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3886	return iemRaiseGeneralProtectionFault0(pVCpu);
3887	}
3888
3889	/*
3890	* Commit it.
3891	*/
3892	if (CPUMIsGuestInLongModeEx(pCtx))
3893	{
3894	if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3895	{
3896	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3897	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3898	/* Note! We disregard intel manual regarding the RCX cananonical
3899	check, ask intel+xen why AMD doesn't do it. */
3900	pCtx->rip = pCtx->rcx;
3901	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_L \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3902	\| (3 << X86DESCATTR_DPL_SHIFT);
3903	}
3904	else
3905	{
3906	Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3907	pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3908	pCtx->rip = pCtx->ecx;
3909	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3910	\| (3 << X86DESCATTR_DPL_SHIFT);
3911	}
3912	/** @todo testcase: See what kind of flags we can make SYSRET restore and
3913	* what it really ignores. RF and VM are hinted at being zero, by AMD. */
3914	pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS \| X86_EFL_VIF \| X86_EFL_VIP);
3915	pCtx->rflags.u \|= X86_EFL_1;
3916	}
3917	else
3918	{
3919	Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3920	pCtx->rip = pCtx->rcx;
3921	pCtx->rflags.u \|= X86_EFL_IF;
3922	pCtx->cs.Attr.u = X86DESCATTR_P \| X86DESCATTR_G \| X86DESCATTR_D \| X86DESCATTR_DT \| X86_SEL_TYPE_ER_ACC
3923	\| (3 << X86DESCATTR_DPL_SHIFT);
3924	}
3925	pCtx->cs.Sel = uNewCs \| 3;
3926	pCtx->cs.ValidSel = uNewCs \| 3;
3927	pCtx->cs.u64Base = 0;
3928	pCtx->cs.u32Limit = UINT32_MAX;
3929	pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3930
3931	pCtx->ss.Sel = uNewSs \| 3;
3932	pCtx->ss.ValidSel = uNewSs \| 3;
3933	pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3934	/* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3935	pCtx->ss.Attr.u \|= (3 << X86DESCATTR_DPL_SHIFT);
3936	/** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3937	* on sysret. */
3938
3939	/* Flush the prefetch buffer. */
3940	pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3941
3942	return VINF_SUCCESS;
3943	}
3944
3945
3946	/**
3947	* Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3948	*
3949	* @param iSegReg The segment register number (valid).
3950	* @param uSel The new selector value.
3951	*/
3952	IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3953	{
3954	/PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);/
3955	uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
3956	PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3957
3958	Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3959
3960	/*
3961	* Real mode and V8086 mode are easy.
3962	*/
3963	if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
3964	&& IEM_IS_REAL_OR_V86_MODE(pVCpu))
3965	{
3966	*pSel = uSel;
3967	pHid->u64Base = (uint32_t)uSel << 4;
3968	pHid->ValidSel = uSel;
3969	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3970	#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3971	/** @todo Does the CPU actually load limits and attributes in the
3972	* real/V8086 mode segment load case? It doesn't for CS in far
3973	* jumps... Affects unreal mode. */
3974	pHid->u32Limit = 0xffff;
3975	pHid->Attr.u = 0;
3976	pHid->Attr.n.u1Present = 1;
3977	pHid->Attr.n.u1DescType = 1;
3978	pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3979	? X86_SEL_TYPE_RW
3980	: X86_SEL_TYPE_READ \| X86_SEL_TYPE_CODE;
3981	#endif
3982	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
3983	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
3984	return VINF_SUCCESS;
3985	}
3986
3987	/*
3988	* Protected mode.
3989	*
3990	* Check if it's a null segment selector value first, that's OK for DS, ES,
3991	* FS and GS. If not null, then we have to load and parse the descriptor.
3992	*/
3993	if (!(uSel & X86_SEL_MASK_OFF_RPL))
3994	{
3995	Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3996	if (iSegReg == X86_SREG_SS)
3997	{
3998	/* In 64-bit kernel mode, the stack can be 0 because of the way
3999	interrupts are dispatched. AMD seems to have a slighly more
4000	relaxed relationship to SS.RPL than intel does. */
4001	/** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4002	if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4003	\|\| pVCpu->iem.s.uCpl > 2
4004	\|\| ( uSel != pVCpu->iem.s.uCpl
4005	&& !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4006	{
4007	Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4008	return iemRaiseGeneralProtectionFault0(pVCpu);
4009	}
4010	}
4011
4012	pSel = uSel; / Not RPL, remember :-) */
4013	iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4014	if (iSegReg == X86_SREG_SS)
4015	pHid->Attr.u \|= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4016
4017	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4018	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4019
4020	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4021	return VINF_SUCCESS;
4022	}
4023
4024	/* Fetch the descriptor. */
4025	IEMSELDESC Desc;
4026	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4027	if (rcStrict != VINF_SUCCESS)
4028	return rcStrict;
4029
4030	/* Check GPs first. */
4031	if (!Desc.Legacy.Gen.u1DescType)
4032	{
4033	Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4034	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4035	}
4036	if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4037	{
4038	if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4039	\|\| !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4040	{
4041	Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4042	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4043	}
4044	if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4045	{
4046	Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4047	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4048	}
4049	if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4050	{
4051	Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4052	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4053	}
4054	}
4055	else
4056	{
4057	if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4058	{
4059	Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4060	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4061	}
4062	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4063	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4064	{
4065	#if 0 /* this is what intel says. */
4066	if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4067	&& pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4068	{
4069	Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4070	iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4071	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4072	}
4073	#else /* this is what makes more sense. */
4074	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4075	{
4076	Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4077	iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4078	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4079	}
4080	if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4081	{
4082	Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4083	iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4084	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4085	}
4086	#endif
4087	}
4088	}
4089
4090	/* Is it there? */
4091	if (!Desc.Legacy.Gen.u1Present)
4092	{
4093	Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4094	return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4095	}
4096
4097	/* The base and limit. */
4098	uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4099	uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4100
4101	/*
4102	* Ok, everything checked out fine. Now set the accessed bit before
4103	* committing the result into the registers.
4104	*/
4105	if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4106	{
4107	rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4108	if (rcStrict != VINF_SUCCESS)
4109	return rcStrict;
4110	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_ACCESSED;
4111	}
4112
4113	/* commit */
4114	*pSel = uSel;
4115	pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4116	pHid->u32Limit = cbLimit;
4117	pHid->u64Base = u64Base;
4118	pHid->ValidSel = uSel;
4119	pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4120
4121	/** @todo check if the hidden bits are loaded correctly for 64-bit
4122	* mode. */
4123	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4124
4125	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4126	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4127	return VINF_SUCCESS;
4128	}
4129
4130
4131	/**
4132	* Implements 'mov SReg, r/m'.
4133	*
4134	* @param iSegReg The segment register number (valid).
4135	* @param uSel The new selector value.
4136	*/
4137	IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4138	{
4139	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4140	if (rcStrict == VINF_SUCCESS)
4141	{
4142	if (iSegReg == X86_SREG_SS)
4143	{
4144	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4145	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4146	}
4147	}
4148	return rcStrict;
4149	}
4150
4151
4152	/**
4153	* Implements 'pop SReg'.
4154	*
4155	* @param iSegReg The segment register number (valid).
4156	* @param enmEffOpSize The efficient operand size (valid).
4157	*/
4158	IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4159	{
4160	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4161	VBOXSTRICTRC rcStrict;
4162
4163	/*
4164	* Read the selector off the stack and join paths with mov ss, reg.
4165	*/
4166	RTUINT64U TmpRsp;
4167	TmpRsp.u = pCtx->rsp;
4168	switch (enmEffOpSize)
4169	{
4170	case IEMMODE_16BIT:
4171	{
4172	uint16_t uSel;
4173	rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4174	if (rcStrict == VINF_SUCCESS)
4175	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4176	break;
4177	}
4178
4179	case IEMMODE_32BIT:
4180	{
4181	uint32_t u32Value;
4182	rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4183	if (rcStrict == VINF_SUCCESS)
4184	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4185	break;
4186	}
4187
4188	case IEMMODE_64BIT:
4189	{
4190	uint64_t u64Value;
4191	rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4192	if (rcStrict == VINF_SUCCESS)
4193	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4194	break;
4195	}
4196	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4197	}
4198
4199	/*
4200	* Commit the stack on success.
4201	*/
4202	if (rcStrict == VINF_SUCCESS)
4203	{
4204	pCtx->rsp = TmpRsp.u;
4205	if (iSegReg == X86_SREG_SS)
4206	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4207	}
4208	return rcStrict;
4209	}
4210
4211
4212	/**
4213	* Implements lgs, lfs, les, lds & lss.
4214	*/
4215	IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4216	uint16_t, uSel,
4217	uint64_t, offSeg,
4218	uint8_t, iSegReg,
4219	uint8_t, iGReg,
4220	IEMMODE, enmEffOpSize)
4221	{
4222	/PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);/
4223	VBOXSTRICTRC rcStrict;
4224
4225	/*
4226	* Use iemCImpl_LoadSReg to do the tricky segment register loading.
4227	*/
4228	/** @todo verify and test that mov, pop and lXs works the segment
4229	* register loading in the exact same way. */
4230	rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4231	if (rcStrict == VINF_SUCCESS)
4232	{
4233	switch (enmEffOpSize)
4234	{
4235	case IEMMODE_16BIT:
4236	(uint16_t )iemGRegRef(pVCpu, iGReg) = offSeg;
4237	break;
4238	case IEMMODE_32BIT:
4239	(uint64_t )iemGRegRef(pVCpu, iGReg) = offSeg;
4240	break;
4241	case IEMMODE_64BIT:
4242	(uint64_t )iemGRegRef(pVCpu, iGReg) = offSeg;
4243	break;
4244	IEM_NOT_REACHED_DEFAULT_CASE_RET();
4245	}
4246	}
4247
4248	return rcStrict;
4249	}
4250
4251
4252	/**
4253	* Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4254	*
4255	* @retval VINF_SUCCESS on success.
4256	* @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4257	* @retval iemMemFetchSysU64 return value.
4258	*
4259	* @param pVCpu The cross context virtual CPU structure of the calling thread.
4260	* @param uSel The selector value.
4261	* @param fAllowSysDesc Whether system descriptors are OK or not.
4262	* @param pDesc Where to return the descriptor on success.
4263	*/
4264	static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4265	{
4266	pDesc->Long.au64[0] = 0;
4267	pDesc->Long.au64[1] = 0;
4268
4269	if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4270	return VINF_IEM_SELECTOR_NOT_OK;
4271
4272	/* Within the table limits? */
4273	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4274	RTGCPTR GCPtrBase;
4275	if (uSel & X86_SEL_LDT)
4276	{
4277	if ( !pCtx->ldtr.Attr.n.u1Present
4278	\|\| (uSel \| X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4279	return VINF_IEM_SELECTOR_NOT_OK;
4280	GCPtrBase = pCtx->ldtr.u64Base;
4281	}
4282	else
4283	{
4284	if ((uSel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4285	return VINF_IEM_SELECTOR_NOT_OK;
4286	GCPtrBase = pCtx->gdtr.pGdt;
4287	}
4288
4289	/* Fetch the descriptor. */
4290	VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4291	if (rcStrict != VINF_SUCCESS)
4292	return rcStrict;
4293	if (!pDesc->Legacy.Gen.u1DescType)
4294	{
4295	if (!fAllowSysDesc)
4296	return VINF_IEM_SELECTOR_NOT_OK;
4297	if (CPUMIsGuestInLongModeEx(pCtx))
4298	{
4299	rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4300	if (rcStrict != VINF_SUCCESS)
4301	return rcStrict;
4302	}
4303
4304	}
4305
4306	return VINF_SUCCESS;
4307	}
4308
4309
4310	/**
4311	* Implements verr (fWrite = false) and verw (fWrite = true).
4312	*/
4313	IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4314	{
4315	Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4316
4317	/** @todo figure whether the accessed bit is set or not. */
4318
4319	bool fAccessible = true;
4320	IEMSELDESC Desc;
4321	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /fAllowSysDesc/, &Desc);
4322	if (rcStrict == VINF_SUCCESS)
4323	{
4324	/* Check the descriptor, order doesn't matter much here. */
4325	if ( !Desc.Legacy.Gen.u1DescType
4326	\|\| !Desc.Legacy.Gen.u1Present)
4327	fAccessible = false;
4328	else
4329	{
4330	if ( fWrite
4331	? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4332	: (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4333	fAccessible = false;
4334
4335	/** @todo testcase for the conforming behavior. */
4336	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4337	!= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF))
4338	{
4339	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4340	fAccessible = false;
4341	else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4342	fAccessible = false;
4343	}
4344	}
4345
4346	}
4347	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4348	fAccessible = false;
4349	else
4350	return rcStrict;
4351
4352	/* commit */
4353	pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
4354
4355	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4356	return VINF_SUCCESS;
4357	}
4358
4359
4360	/**
4361	* Implements LAR and LSL with 64-bit operand size.
4362	*
4363	* @returns VINF_SUCCESS.
4364	* @param pu16Dst Pointer to the destination register.
4365	* @param uSel The selector to load details for.
4366	* @param pEFlags Pointer to the eflags register.
4367	* @param fIsLar true = LAR, false = LSL.
4368	*/
4369	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t , pu64Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
4370	{
4371	Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4372
4373	/** @todo figure whether the accessed bit is set or not. */
4374
4375	bool fDescOk = true;
4376	IEMSELDESC Desc;
4377	VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /fAllowSysDesc/, &Desc);
4378	if (rcStrict == VINF_SUCCESS)
4379	{
4380	/*
4381	* Check the descriptor type.
4382	*/
4383	if (!Desc.Legacy.Gen.u1DescType)
4384	{
4385	if (CPUMIsGuestInLongModeEx(pVCpu->iem.s.CTX_SUFF(pCtx)))
4386	{
4387	if (Desc.Long.Gen.u5Zeros)
4388	fDescOk = false;
4389	else
4390	switch (Desc.Long.Gen.u4Type)
4391	{
4392	/** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4393	case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4394	case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4395	case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4396	break;
4397	case AMD64_SEL_TYPE_SYS_CALL_GATE:
4398	fDescOk = fIsLar;
4399	break;
4400	default:
4401	fDescOk = false;
4402	break;
4403	}
4404	}
4405	else
4406	{
4407	switch (Desc.Long.Gen.u4Type)
4408	{
4409	case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4410	case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4411	case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4412	case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4413	case X86_SEL_TYPE_SYS_LDT:
4414	break;
4415	case X86_SEL_TYPE_SYS_286_CALL_GATE:
4416	case X86_SEL_TYPE_SYS_TASK_GATE:
4417	case X86_SEL_TYPE_SYS_386_CALL_GATE:
4418	fDescOk = fIsLar;
4419	break;
4420	default:
4421	fDescOk = false;
4422	break;
4423	}
4424	}
4425	}
4426	if (fDescOk)
4427	{
4428	/*
4429	* Check the RPL/DPL/CPL interaction..
4430	*/
4431	/** @todo testcase for the conforming behavior. */
4432	if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF)
4433	\|\| !Desc.Legacy.Gen.u1DescType)
4434	{
4435	if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4436	fDescOk = false;
4437	else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4438	fDescOk = false;
4439	}
4440	}
4441
4442	if (fDescOk)
4443	{
4444	/*
4445	* All fine, start committing the result.
4446	*/
4447	if (fIsLar)
4448	*pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4449	else
4450	*pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4451	}
4452
4453	}
4454	else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4455	fDescOk = false;
4456	else
4457	return rcStrict;
4458
4459	/* commit flags value and advance rip. */
4460	pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
4461	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4462
4463	return VINF_SUCCESS;
4464	}
4465
4466
4467	/**
4468	* Implements LAR and LSL with 16-bit operand size.
4469	*
4470	* @returns VINF_SUCCESS.
4471	* @param pu16Dst Pointer to the destination register.
4472	* @param u16Sel The selector to load details for.
4473	* @param pEFlags Pointer to the eflags register.
4474	* @param fIsLar true = LAR, false = LSL.
4475	*/
4476	IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t , pu16Dst, uint16_t, uSel, uint32_t , pEFlags, bool, fIsLar)
4477	{
4478	uint64_t u64TmpDst = *pu16Dst;
4479	IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
4480	*pu16Dst = (uint16_t)u64TmpDst;
4481	return VINF_SUCCESS;
4482	}
4483
4484
4485	/**
4486	* Implements lgdt.
4487	*
4488	* @param iEffSeg The segment of the new gdtr contents
4489	* @param GCPtrEffSrc The address of the new gdtr contents.
4490	* @param enmEffOpSize The effective operand size.
4491	*/
4492	IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4493	{
4494	if (pVCpu->iem.s.uCpl != 0)
4495	return iemRaiseGeneralProtectionFault0(pVCpu);
4496	Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4497
4498	/*
4499	* Fetch the limit and base address.
4500	*/
4501	uint16_t cbLimit;
4502	RTGCPTR GCPtrBase;
4503	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4504	if (rcStrict == VINF_SUCCESS)
4505	{
4506	if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4507	\|\| X86_IS_CANONICAL(GCPtrBase))
4508	{
4509	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4510	rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4511	else
4512	{
4513	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4514	pCtx->gdtr.cbGdt = cbLimit;
4515	pCtx->gdtr.pGdt = GCPtrBase;
4516	}
4517	if (rcStrict == VINF_SUCCESS)
4518	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4519	}
4520	else
4521	{
4522	Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4523	return iemRaiseGeneralProtectionFault0(pVCpu);
4524	}
4525	}
4526	return rcStrict;
4527	}
4528
4529
4530	/**
4531	* Implements sgdt.
4532	*
4533	* @param iEffSeg The segment where to store the gdtr content.
4534	* @param GCPtrEffDst The address where to store the gdtr content.
4535	*/
4536	IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4537	{
4538	/*
4539	* Join paths with sidt.
4540	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4541	* you really must know.
4542	*/
4543	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4544	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4545	if (rcStrict == VINF_SUCCESS)
4546	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4547	return rcStrict;
4548	}
4549
4550
4551	/**
4552	* Implements lidt.
4553	*
4554	* @param iEffSeg The segment of the new idtr contents
4555	* @param GCPtrEffSrc The address of the new idtr contents.
4556	* @param enmEffOpSize The effective operand size.
4557	*/
4558	IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4559	{
4560	if (pVCpu->iem.s.uCpl != 0)
4561	return iemRaiseGeneralProtectionFault0(pVCpu);
4562	Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4563
4564	/*
4565	* Fetch the limit and base address.
4566	*/
4567	uint16_t cbLimit;
4568	RTGCPTR GCPtrBase;
4569	VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4570	if (rcStrict == VINF_SUCCESS)
4571	{
4572	if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4573	\|\| X86_IS_CANONICAL(GCPtrBase))
4574	{
4575	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4576	CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4577	else
4578	{
4579	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4580	pCtx->idtr.cbIdt = cbLimit;
4581	pCtx->idtr.pIdt = GCPtrBase;
4582	}
4583	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4584	}
4585	else
4586	{
4587	Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4588	return iemRaiseGeneralProtectionFault0(pVCpu);
4589	}
4590	}
4591	return rcStrict;
4592	}
4593
4594
4595	/**
4596	* Implements sidt.
4597	*
4598	* @param iEffSeg The segment where to store the idtr content.
4599	* @param GCPtrEffDst The address where to store the idtr content.
4600	*/
4601	IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4602	{
4603	/*
4604	* Join paths with sgdt.
4605	* Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4606	* you really must know.
4607	*/
4608	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4609	VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4610	if (rcStrict == VINF_SUCCESS)
4611	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4612	return rcStrict;
4613	}
4614
4615
4616	/**
4617	* Implements lldt.
4618	*
4619	* @param uNewLdt The new LDT selector value.
4620	*/
4621	IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4622	{
4623	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4624
4625	/*
4626	* Check preconditions.
4627	*/
4628	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4629	{
4630	Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4631	return iemRaiseUndefinedOpcode(pVCpu);
4632	}
4633	if (pVCpu->iem.s.uCpl != 0)
4634	{
4635	Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4636	return iemRaiseGeneralProtectionFault0(pVCpu);
4637	}
4638	if (uNewLdt & X86_SEL_LDT)
4639	{
4640	Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4641	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4642	}
4643
4644	/*
4645	* Now, loading a NULL selector is easy.
4646	*/
4647	if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4648	{
4649	Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4650	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4651	CPUMSetGuestLDTR(pVCpu, uNewLdt);
4652	else
4653	pCtx->ldtr.Sel = uNewLdt;
4654	pCtx->ldtr.ValidSel = uNewLdt;
4655	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4656	if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4657	{
4658	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4659	pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4660	}
4661	else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4662	{
4663	/* AMD-V seems to leave the base and limit alone. */
4664	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4665	}
4666	else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4667	{
4668	/* VT-x (Intel 3960x) seems to be doing the following. */
4669	pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE \| X86DESCATTR_G \| X86DESCATTR_D;
4670	pCtx->ldtr.u64Base = 0;
4671	pCtx->ldtr.u32Limit = UINT32_MAX;
4672	}
4673
4674	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4675	return VINF_SUCCESS;
4676	}
4677
4678	/*
4679	* Read the descriptor.
4680	*/
4681	IEMSELDESC Desc;
4682	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4683	if (rcStrict != VINF_SUCCESS)
4684	return rcStrict;
4685
4686	/* Check GPs first. */
4687	if (Desc.Legacy.Gen.u1DescType)
4688	{
4689	Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4690	return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4691	}
4692	if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4693	{
4694	Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4695	return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4696	}
4697	uint64_t u64Base;
4698	if (!IEM_IS_LONG_MODE(pVCpu))
4699	u64Base = X86DESC_BASE(&Desc.Legacy);
4700	else
4701	{
4702	if (Desc.Long.Gen.u5Zeros)
4703	{
4704	Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4705	return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4706	}
4707
4708	u64Base = X86DESC64_BASE(&Desc.Long);
4709	if (!IEM_IS_CANONICAL(u64Base))
4710	{
4711	Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4712	return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4713	}
4714	}
4715
4716	/* NP */
4717	if (!Desc.Legacy.Gen.u1Present)
4718	{
4719	Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4720	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4721	}
4722
4723	/*
4724	* It checks out alright, update the registers.
4725	*/
4726	/** @todo check if the actual value is loaded or if the RPL is dropped */
4727	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4728	CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4729	else
4730	pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4731	pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4732	pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4733	pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4734	pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4735	pCtx->ldtr.u64Base = u64Base;
4736
4737	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4738	return VINF_SUCCESS;
4739	}
4740
4741
4742	/**
4743	* Implements lldt.
4744	*
4745	* @param uNewLdt The new LDT selector value.
4746	*/
4747	IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4748	{
4749	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4750
4751	/*
4752	* Check preconditions.
4753	*/
4754	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4755	{
4756	Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4757	return iemRaiseUndefinedOpcode(pVCpu);
4758	}
4759	if (pVCpu->iem.s.uCpl != 0)
4760	{
4761	Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4762	return iemRaiseGeneralProtectionFault0(pVCpu);
4763	}
4764	if (uNewTr & X86_SEL_LDT)
4765	{
4766	Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4767	return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4768	}
4769	if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4770	{
4771	Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4772	return iemRaiseGeneralProtectionFault0(pVCpu);
4773	}
4774
4775	/*
4776	* Read the descriptor.
4777	*/
4778	IEMSELDESC Desc;
4779	VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4780	if (rcStrict != VINF_SUCCESS)
4781	return rcStrict;
4782
4783	/* Check GPs first. */
4784	if (Desc.Legacy.Gen.u1DescType)
4785	{
4786	Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4787	return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4788	}
4789	if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4790	&& ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4791	\|\| IEM_IS_LONG_MODE(pVCpu)) )
4792	{
4793	Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4794	return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4795	}
4796	uint64_t u64Base;
4797	if (!IEM_IS_LONG_MODE(pVCpu))
4798	u64Base = X86DESC_BASE(&Desc.Legacy);
4799	else
4800	{
4801	if (Desc.Long.Gen.u5Zeros)
4802	{
4803	Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4804	return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4805	}
4806
4807	u64Base = X86DESC64_BASE(&Desc.Long);
4808	if (!IEM_IS_CANONICAL(u64Base))
4809	{
4810	Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4811	return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4812	}
4813	}
4814
4815	/* NP */
4816	if (!Desc.Legacy.Gen.u1Present)
4817	{
4818	Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4819	return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
4820	}
4821
4822	/*
4823	* Set it busy.
4824	* Note! Intel says this should lock down the whole descriptor, but we'll
4825	* restrict our selves to 32-bit for now due to lack of inline
4826	* assembly and such.
4827	*/
4828	void *pvDesc;
4829	rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4830	if (rcStrict != VINF_SUCCESS)
4831	return rcStrict;
4832	switch ((uintptr_t)pvDesc & 3)
4833	{
4834	case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4835	case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4836	case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4837	case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4838	}
4839	rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
4840	if (rcStrict != VINF_SUCCESS)
4841	return rcStrict;
4842	Desc.Legacy.Gen.u4Type \|= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4843
4844	/*
4845	* It checks out alright, update the registers.
4846	*/
4847	/** @todo check if the actual value is loaded or if the RPL is dropped */
4848	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4849	CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4850	else
4851	pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4852	pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4853	pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4854	pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4855	pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4856	pCtx->tr.u64Base = u64Base;
4857
4858	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4859	return VINF_SUCCESS;
4860	}
4861
4862
4863	/**
4864	* Implements mov GReg,CRx.
4865	*
4866	* @param iGReg The general register to store the CRx value in.
4867	* @param iCrReg The CRx register to read (valid).
4868	*/
4869	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4870	{
4871	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4872	if (pVCpu->iem.s.uCpl != 0)
4873	return iemRaiseGeneralProtectionFault0(pVCpu);
4874	Assert(!pCtx->eflags.Bits.u1VM);
4875
4876	/* read it */
4877	uint64_t crX;
4878	switch (iCrReg)
4879	{
4880	case 0:
4881	crX = pCtx->cr0;
4882	if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
4883	crX \|= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4884	break;
4885	case 2: crX = pCtx->cr2; break;
4886	case 3: crX = pCtx->cr3; break;
4887	case 4: crX = pCtx->cr4; break;
4888	case 8:
4889	{
4890	uint8_t uTpr;
4891	int rc = PDMApicGetTPR(pVCpu, &uTpr, NULL, NULL);
4892	if (RT_SUCCESS(rc))
4893	crX = uTpr >> 4;
4894	else
4895	crX = 0;
4896	break;
4897	}
4898	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4899	}
4900
4901	/* store it */
4902	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
4903	(uint64_t )iemGRegRef(pVCpu, iGReg) = crX;
4904	else
4905	(uint64_t )iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
4906
4907	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4908	return VINF_SUCCESS;
4909	}
4910
4911
4912	/**
4913	* Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4914	*
4915	* @param iCrReg The CRx register to write (valid).
4916	* @param uNewCrX The new value.
4917	*/
4918	IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4919	{
4920	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
4921	VBOXSTRICTRC rcStrict;
4922	int rc;
4923
4924	/*
4925	* Try store it.
4926	* Unfortunately, CPUM only does a tiny bit of the work.
4927	*/
4928	switch (iCrReg)
4929	{
4930	case 0:
4931	{
4932	/*
4933	* Perform checks.
4934	*/
4935	uint64_t const uOldCrX = pCtx->cr0;
4936	uint32_t const fValid = X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS
4937	\| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_WP \| X86_CR0_AM
4938	\| X86_CR0_NW \| X86_CR0_CD \| X86_CR0_PG;
4939
4940	/* ET is hardcoded on 486 and later. */
4941	if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
4942	uNewCrX \|= X86_CR0_ET;
4943	/* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
4944	else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
4945	{
4946	uNewCrX &= fValid;
4947	uNewCrX \|= X86_CR0_ET;
4948	}
4949	else
4950	uNewCrX &= X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS \| X86_CR0_PG \| X86_CR0_ET;
4951
4952	/* Check for reserved bits. */
4953	if (uNewCrX & ~(uint64_t)fValid)
4954	{
4955	Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4956	return iemRaiseGeneralProtectionFault0(pVCpu);
4957	}
4958
4959	/* Check for invalid combinations. */
4960	if ( (uNewCrX & X86_CR0_PG)
4961	&& !(uNewCrX & X86_CR0_PE) )
4962	{
4963	Log(("Trying to set CR0.PG without CR0.PE\n"));
4964	return iemRaiseGeneralProtectionFault0(pVCpu);
4965	}
4966
4967	if ( !(uNewCrX & X86_CR0_CD)
4968	&& (uNewCrX & X86_CR0_NW) )
4969	{
4970	Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4971	return iemRaiseGeneralProtectionFault0(pVCpu);
4972	}
4973
4974	/* Long mode consistency checks. */
4975	if ( (uNewCrX & X86_CR0_PG)
4976	&& !(uOldCrX & X86_CR0_PG)
4977	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
4978	{
4979	if (!(pCtx->cr4 & X86_CR4_PAE))
4980	{
4981	Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4982	return iemRaiseGeneralProtectionFault0(pVCpu);
4983	}
4984	if (pCtx->cs.Attr.n.u1Long)
4985	{
4986	Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4987	return iemRaiseGeneralProtectionFault0(pVCpu);
4988	}
4989	}
4990
4991	/** @todo check reserved PDPTR bits as AMD states. */
4992
4993	/*
4994	* Change CR0.
4995	*/
4996	if (!IEM_VERIFICATION_ENABLED(pVCpu))
4997	CPUMSetGuestCR0(pVCpu, uNewCrX);
4998	else
4999	pCtx->cr0 = uNewCrX;
5000	Assert(pCtx->cr0 == uNewCrX);
5001
5002	/*
5003	* Change EFER.LMA if entering or leaving long mode.
5004	*/
5005	if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5006	&& (pCtx->msrEFER & MSR_K6_EFER_LME) )
5007	{
5008	uint64_t NewEFER = pCtx->msrEFER;
5009	if (uNewCrX & X86_CR0_PG)
5010	NewEFER \|= MSR_K6_EFER_LMA;
5011	else
5012	NewEFER &= ~MSR_K6_EFER_LMA;
5013
5014	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5015	CPUMSetGuestEFER(pVCpu, NewEFER);
5016	else
5017	pCtx->msrEFER = NewEFER;
5018	Assert(pCtx->msrEFER == NewEFER);
5019	}
5020
5021	/*
5022	* Inform PGM.
5023	*/
5024	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5025	{
5026	if ( (uNewCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
5027	!= (uOldCrX & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)) )
5028	{
5029	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5030	AssertRCReturn(rc, rc);
5031	/* ignore informational status codes */
5032	}
5033	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5034	}
5035	else
5036	rcStrict = VINF_SUCCESS;
5037
5038	#ifdef IN_RC
5039	/* Return to ring-3 for rescheduling if WP or AM changes. */
5040	if ( rcStrict == VINF_SUCCESS
5041	&& ( (uNewCrX & (X86_CR0_WP \| X86_CR0_AM))
5042	!= (uOldCrX & (X86_CR0_WP \| X86_CR0_AM))) )
5043	rcStrict = VINF_EM_RESCHEDULE;
5044	#endif
5045	break;
5046	}
5047
5048	/*
5049	* CR2 can be changed without any restrictions.
5050	*/
5051	case 2:
5052	pCtx->cr2 = uNewCrX;
5053	rcStrict = VINF_SUCCESS;
5054	break;
5055
5056	/*
5057	* CR3 is relatively simple, although AMD and Intel have different
5058	* accounts of how setting reserved bits are handled. We take intel's
5059	* word for the lower bits and AMD's for the high bits (63:52). The
5060	* lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5061	* on this.
5062	*/
5063	/** @todo Testcase: Setting reserved bits in CR3, especially before
5064	* enabling paging. */
5065	case 3:
5066	{
5067	/* check / mask the value. */
5068	if (uNewCrX & UINT64_C(0xfff0000000000000))
5069	{
5070	Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5071	return iemRaiseGeneralProtectionFault0(pVCpu);
5072	}
5073
5074	uint64_t fValid;
5075	if ( (pCtx->cr4 & X86_CR4_PAE)
5076	&& (pCtx->msrEFER & MSR_K6_EFER_LME))
5077	fValid = UINT64_C(0x000fffffffffffff);
5078	else
5079	fValid = UINT64_C(0xffffffff);
5080	if (uNewCrX & ~fValid)
5081	{
5082	Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5083	uNewCrX, uNewCrX & ~fValid));
5084	uNewCrX &= fValid;
5085	}
5086
5087	/** @todo If we're in PAE mode we should check the PDPTRs for
5088	* invalid bits. */
5089
5090	/* Make the change. */
5091	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5092	{
5093	rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5094	AssertRCSuccessReturn(rc, rc);
5095	}
5096	else
5097	pCtx->cr3 = uNewCrX;
5098
5099	/* Inform PGM. */
5100	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5101	{
5102	if (pCtx->cr0 & X86_CR0_PG)
5103	{
5104	rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5105	AssertRCReturn(rc, rc);
5106	/* ignore informational status codes */
5107	}
5108	}
5109	rcStrict = VINF_SUCCESS;
5110	break;
5111	}
5112
5113	/*
5114	* CR4 is a bit more tedious as there are bits which cannot be cleared
5115	* under some circumstances and such.
5116	*/
5117	case 4:
5118	{
5119	uint64_t const uOldCrX = pCtx->cr4;
5120
5121	/** @todo Shouldn't this look at the guest CPUID bits to determine
5122	* valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5123	* should #GP(0). */
5124	/* reserved bits */
5125	uint32_t fValid = X86_CR4_VME \| X86_CR4_PVI
5126	\| X86_CR4_TSD \| X86_CR4_DE
5127	\| X86_CR4_PSE \| X86_CR4_PAE
5128	\| X86_CR4_MCE \| X86_CR4_PGE
5129	\| X86_CR4_PCE \| X86_CR4_OSFXSR
5130	\| X86_CR4_OSXMMEEXCPT;
5131	//if (xxx)
5132	// fValid \|= X86_CR4_VMXE;
5133	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5134	fValid \|= X86_CR4_OSXSAVE;
5135	if (uNewCrX & ~(uint64_t)fValid)
5136	{
5137	Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5138	return iemRaiseGeneralProtectionFault0(pVCpu);
5139	}
5140
5141	/* long mode checks. */
5142	if ( (uOldCrX & X86_CR4_PAE)
5143	&& !(uNewCrX & X86_CR4_PAE)
5144	&& CPUMIsGuestInLongModeEx(pCtx) )
5145	{
5146	Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5147	return iemRaiseGeneralProtectionFault0(pVCpu);
5148	}
5149
5150
5151	/*
5152	* Change it.
5153	*/
5154	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5155	{
5156	rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5157	AssertRCSuccessReturn(rc, rc);
5158	}
5159	else
5160	pCtx->cr4 = uNewCrX;
5161	Assert(pCtx->cr4 == uNewCrX);
5162
5163	/*
5164	* Notify SELM and PGM.
5165	*/
5166	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5167	{
5168	/* SELM - VME may change things wrt to the TSS shadowing. */
5169	if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5170	{
5171	Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5172	RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5173	#ifdef VBOX_WITH_RAW_MODE
5174	if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
5175	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5176	#endif
5177	}
5178
5179	/* PGM - flushing and mode. */
5180	if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE \| X86_CR4_PAE \| X86_CR4_PGE))
5181	{
5182	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5183	AssertRCReturn(rc, rc);
5184	/* ignore informational status codes */
5185	}
5186	rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5187	}
5188	else
5189	rcStrict = VINF_SUCCESS;
5190	break;
5191	}
5192
5193	/*
5194	* CR8 maps to the APIC TPR.
5195	*/
5196	case 8:
5197	if (uNewCrX & ~(uint64_t)0xf)
5198	{
5199	Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5200	return iemRaiseGeneralProtectionFault0(pVCpu);
5201	}
5202
5203	if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5204	PDMApicSetTPR(pVCpu, (uint8_t)uNewCrX << 4);
5205	rcStrict = VINF_SUCCESS;
5206	break;
5207
5208	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5209	}
5210
5211	/*
5212	* Advance the RIP on success.
5213	*/
5214	if (RT_SUCCESS(rcStrict))
5215	{
5216	if (rcStrict != VINF_SUCCESS)
5217	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5218	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5219	}
5220
5221	return rcStrict;
5222	}
5223
5224
5225	/**
5226	* Implements mov CRx,GReg.
5227	*
5228	* @param iCrReg The CRx register to write (valid).
5229	* @param iGReg The general register to load the DRx value from.
5230	*/
5231	IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5232	{
5233	if (pVCpu->iem.s.uCpl != 0)
5234	return iemRaiseGeneralProtectionFault0(pVCpu);
5235	Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5236
5237	/*
5238	* Read the new value from the source register and call common worker.
5239	*/
5240	uint64_t uNewCrX;
5241	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5242	uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5243	else
5244	uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5245	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5246	}
5247
5248
5249	/**
5250	* Implements 'LMSW r/m16'
5251	*
5252	* @param u16NewMsw The new value.
5253	*/
5254	IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5255	{
5256	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5257
5258	if (pVCpu->iem.s.uCpl != 0)
5259	return iemRaiseGeneralProtectionFault0(pVCpu);
5260	Assert(!pCtx->eflags.Bits.u1VM);
5261
5262	/*
5263	* Compose the new CR0 value and call common worker.
5264	*/
5265	uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
5266	uNewCr0 \|= u16NewMsw & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
5267	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
5268	}
5269
5270
5271	/**
5272	* Implements 'CLTS'.
5273	*/
5274	IEM_CIMPL_DEF_0(iemCImpl_clts)
5275	{
5276	if (pVCpu->iem.s.uCpl != 0)
5277	return iemRaiseGeneralProtectionFault0(pVCpu);
5278
5279	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5280	uint64_t uNewCr0 = pCtx->cr0;
5281	uNewCr0 &= ~X86_CR0_TS;
5282	return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /cr/ 0, uNewCr0);
5283	}
5284
5285
5286	/**
5287	* Implements mov GReg,DRx.
5288	*
5289	* @param iGReg The general register to store the DRx value in.
5290	* @param iDrReg The DRx register to read (0-7).
5291	*/
5292	IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5293	{
5294	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5295
5296	/*
5297	* Check preconditions.
5298	*/
5299
5300	/* Raise GPs. */
5301	if (pVCpu->iem.s.uCpl != 0)
5302	return iemRaiseGeneralProtectionFault0(pVCpu);
5303	Assert(!pCtx->eflags.Bits.u1VM);
5304
5305	if ( (iDrReg == 4 \|\| iDrReg == 5)
5306	&& (pCtx->cr4 & X86_CR4_DE) )
5307	{
5308	Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5309	return iemRaiseGeneralProtectionFault0(pVCpu);
5310	}
5311
5312	/* Raise #DB if general access detect is enabled. */
5313	if (pCtx->dr[7] & X86_DR7_GD)
5314	{
5315	Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5316	return iemRaiseDebugException(pVCpu);
5317	}
5318
5319	/*
5320	* Read the debug register and store it in the specified general register.
5321	*/
5322	uint64_t drX;
5323	switch (iDrReg)
5324	{
5325	case 0: drX = pCtx->dr[0]; break;
5326	case 1: drX = pCtx->dr[1]; break;
5327	case 2: drX = pCtx->dr[2]; break;
5328	case 3: drX = pCtx->dr[3]; break;
5329	case 6:
5330	case 4:
5331	drX = pCtx->dr[6];
5332	drX \|= X86_DR6_RA1_MASK;
5333	drX &= ~X86_DR6_RAZ_MASK;
5334	break;
5335	case 7:
5336	case 5:
5337	drX = pCtx->dr[7];
5338	drX \|=X86_DR7_RA1_MASK;
5339	drX &= ~X86_DR7_RAZ_MASK;
5340	break;
5341	IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5342	}
5343
5344	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5345	(uint64_t )iemGRegRef(pVCpu, iGReg) = drX;
5346	else
5347	(uint64_t )iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5348
5349	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5350	return VINF_SUCCESS;
5351	}
5352
5353
5354	/**
5355	* Implements mov DRx,GReg.
5356	*
5357	* @param iDrReg The DRx register to write (valid).
5358	* @param iGReg The general register to load the DRx value from.
5359	*/
5360	IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5361	{
5362	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5363
5364	/*
5365	* Check preconditions.
5366	*/
5367	if (pVCpu->iem.s.uCpl != 0)
5368	return iemRaiseGeneralProtectionFault0(pVCpu);
5369	Assert(!pCtx->eflags.Bits.u1VM);
5370
5371	if (iDrReg == 4 \|\| iDrReg == 5)
5372	{
5373	if (pCtx->cr4 & X86_CR4_DE)
5374	{
5375	Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5376	return iemRaiseGeneralProtectionFault0(pVCpu);
5377	}
5378	iDrReg += 2;
5379	}
5380
5381	/* Raise #DB if general access detect is enabled. */
5382	/** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5383	* \#GP? */
5384	if (pCtx->dr[7] & X86_DR7_GD)
5385	{
5386	Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5387	return iemRaiseDebugException(pVCpu);
5388	}
5389
5390	/*
5391	* Read the new value from the source register.
5392	*/
5393	uint64_t uNewDrX;
5394	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5395	uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5396	else
5397	uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5398
5399	/*
5400	* Adjust it.
5401	*/
5402	switch (iDrReg)
5403	{
5404	case 0:
5405	case 1:
5406	case 2:
5407	case 3:
5408	/* nothing to adjust */
5409	break;
5410
5411	case 6:
5412	if (uNewDrX & X86_DR6_MBZ_MASK)
5413	{
5414	Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5415	return iemRaiseGeneralProtectionFault0(pVCpu);
5416	}
5417	uNewDrX \|= X86_DR6_RA1_MASK;
5418	uNewDrX &= ~X86_DR6_RAZ_MASK;
5419	break;
5420
5421	case 7:
5422	if (uNewDrX & X86_DR7_MBZ_MASK)
5423	{
5424	Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5425	return iemRaiseGeneralProtectionFault0(pVCpu);
5426	}
5427	uNewDrX \|= X86_DR7_RA1_MASK;
5428	uNewDrX &= ~X86_DR7_RAZ_MASK;
5429	break;
5430
5431	IEM_NOT_REACHED_DEFAULT_CASE_RET();
5432	}
5433
5434	/*
5435	* Do the actual setting.
5436	*/
5437	if (!IEM_VERIFICATION_ENABLED(pVCpu))
5438	{
5439	int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5440	AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5441	}
5442	else
5443	pCtx->dr[iDrReg] = uNewDrX;
5444
5445	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5446	return VINF_SUCCESS;
5447	}
5448
5449
5450	/**
5451	* Implements 'INVLPG m'.
5452	*
5453	* @param GCPtrPage The effective address of the page to invalidate.
5454	* @remarks Updates the RIP.
5455	*/
5456	IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5457	{
5458	/* ring-0 only. */
5459	if (pVCpu->iem.s.uCpl != 0)
5460	return iemRaiseGeneralProtectionFault0(pVCpu);
5461	Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
5462
5463	int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5464	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5465
5466	if (rc == VINF_SUCCESS)
5467	return VINF_SUCCESS;
5468	if (rc == VINF_PGM_SYNC_CR3)
5469	return iemSetPassUpStatus(pVCpu, rc);
5470
5471	AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR \|\| RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5472	Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5473	return rc;
5474	}
5475
5476
5477	/**
5478	* Implements RDTSC.
5479	*/
5480	IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5481	{
5482	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5483
5484	/*
5485	* Check preconditions.
5486	*/
5487	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5488	return iemRaiseUndefinedOpcode(pVCpu);
5489
5490	if ( (pCtx->cr4 & X86_CR4_TSD)
5491	&& pVCpu->iem.s.uCpl != 0)
5492	{
5493	Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5494	return iemRaiseGeneralProtectionFault0(pVCpu);
5495	}
5496
5497	/*
5498	* Do the job.
5499	*/
5500	uint64_t uTicks = TMCpuTickGet(pVCpu);
5501	pCtx->rax = (uint32_t)uTicks;
5502	pCtx->rdx = uTicks >> 32;
5503	#ifdef IEM_VERIFICATION_MODE_FULL
5504	pVCpu->iem.s.fIgnoreRaxRdx = true;
5505	#endif
5506
5507	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5508	return VINF_SUCCESS;
5509	}
5510
5511
5512	/**
5513	* Implements RDMSR.
5514	*/
5515	IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5516	{
5517	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5518
5519	/*
5520	* Check preconditions.
5521	*/
5522	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5523	return iemRaiseUndefinedOpcode(pVCpu);
5524	if (pVCpu->iem.s.uCpl != 0)
5525	return iemRaiseGeneralProtectionFault0(pVCpu);
5526
5527	/*
5528	* Do the job.
5529	*/
5530	RTUINT64U uValue;
5531	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
5532	if (rcStrict == VINF_SUCCESS)
5533	{
5534	pCtx->rax = uValue.s.Lo;
5535	pCtx->rdx = uValue.s.Hi;
5536
5537	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5538	return VINF_SUCCESS;
5539	}
5540
5541	#ifndef IN_RING3
5542	/* Deferred to ring-3. */
5543	if (rcStrict == VINF_CPUM_R3_MSR_READ)
5544	{
5545	Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5546	return rcStrict;
5547	}
5548	#else /* IN_RING3 */
5549	/* Often a unimplemented MSR or MSR bit, so worth logging. */
5550	static uint32_t s_cTimes = 0;
5551	if (s_cTimes++ < 10)
5552	LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5553	else
5554	#endif
5555	Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5556	AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5557	return iemRaiseGeneralProtectionFault0(pVCpu);
5558	}
5559
5560
5561	/**
5562	* Implements WRMSR.
5563	*/
5564	IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5565	{
5566	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5567
5568	/*
5569	* Check preconditions.
5570	*/
5571	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5572	return iemRaiseUndefinedOpcode(pVCpu);
5573	if (pVCpu->iem.s.uCpl != 0)
5574	return iemRaiseGeneralProtectionFault0(pVCpu);
5575
5576	/*
5577	* Do the job.
5578	*/
5579	RTUINT64U uValue;
5580	uValue.s.Lo = pCtx->eax;
5581	uValue.s.Hi = pCtx->edx;
5582
5583	VBOXSTRICTRC rcStrict;
5584	if (!IEM_VERIFICATION_ENABLED(pVCpu))
5585	rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5586	else
5587	{
5588	#ifdef IN_RING3
5589	CPUMCTX CtxTmp = *pCtx;
5590	rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5591	PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
5592	pCtx = pCtx2;
5593	*pCtx2 = CtxTmp;
5594	#else
5595	AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5596	#endif
5597	}
5598	if (rcStrict == VINF_SUCCESS)
5599	{
5600	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5601	return VINF_SUCCESS;
5602	}
5603
5604	#ifndef IN_RING3
5605	/* Deferred to ring-3. */
5606	if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5607	{
5608	Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5609	return rcStrict;
5610	}
5611	#else /* IN_RING3 */
5612	/* Often a unimplemented MSR or MSR bit, so worth logging. */
5613	static uint32_t s_cTimes = 0;
5614	if (s_cTimes++ < 10)
5615	LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5616	else
5617	#endif
5618	Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5619	AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5620	return iemRaiseGeneralProtectionFault0(pVCpu);
5621	}
5622
5623
5624	/**
5625	* Implements 'IN eAX, port'.
5626	*
5627	* @param u16Port The source port.
5628	* @param cbReg The register size.
5629	*/
5630	IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5631	{
5632	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5633
5634	/*
5635	* CPL check
5636	*/
5637	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5638	if (rcStrict != VINF_SUCCESS)
5639	return rcStrict;
5640
5641	/*
5642	* Perform the I/O.
5643	*/
5644	uint32_t u32Value;
5645	if (!IEM_VERIFICATION_ENABLED(pVCpu))
5646	rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
5647	else
5648	rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
5649	if (IOM_SUCCESS(rcStrict))
5650	{
5651	switch (cbReg)
5652	{
5653	case 1: pCtx->al = (uint8_t)u32Value; break;
5654	case 2: pCtx->ax = (uint16_t)u32Value; break;
5655	case 4: pCtx->rax = u32Value; break;
5656	default: AssertFailedReturn(VERR_IEM_IPE_3);
5657	}
5658	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5659	pVCpu->iem.s.cPotentialExits++;
5660	if (rcStrict != VINF_SUCCESS)
5661	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5662	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5663
5664	/*
5665	* Check for I/O breakpoints.
5666	*/
5667	uint32_t const uDr7 = pCtx->dr[7];
5668	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5669	&& X86_DR7_ANY_RW_IO(uDr7)
5670	&& (pCtx->cr4 & X86_CR4_DE))
5671	\|\| DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5672	{
5673	rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5674	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5675	rcStrict = iemRaiseDebugException(pVCpu);
5676	}
5677	}
5678
5679	return rcStrict;
5680	}
5681
5682
5683	/**
5684	* Implements 'IN eAX, DX'.
5685	*
5686	* @param cbReg The register size.
5687	*/
5688	IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5689	{
5690	return IEM_CIMPL_CALL_2(iemCImpl_in, pVCpu->iem.s.CTX_SUFF(pCtx)->dx, cbReg);
5691	}
5692
5693
5694	/**
5695	* Implements 'OUT port, eAX'.
5696	*
5697	* @param u16Port The destination port.
5698	* @param cbReg The register size.
5699	*/
5700	IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5701	{
5702	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5703
5704	/*
5705	* CPL check
5706	*/
5707	VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5708	if (rcStrict != VINF_SUCCESS)
5709	return rcStrict;
5710
5711	/*
5712	* Perform the I/O.
5713	*/
5714	uint32_t u32Value;
5715	switch (cbReg)
5716	{
5717	case 1: u32Value = pCtx->al; break;
5718	case 2: u32Value = pCtx->ax; break;
5719	case 4: u32Value = pCtx->eax; break;
5720	default: AssertFailedReturn(VERR_IEM_IPE_4);
5721	}
5722	if (!IEM_VERIFICATION_ENABLED(pVCpu))
5723	rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
5724	else
5725	rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
5726	if (IOM_SUCCESS(rcStrict))
5727	{
5728	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5729	pVCpu->iem.s.cPotentialExits++;
5730	if (rcStrict != VINF_SUCCESS)
5731	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5732	Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5733
5734	/*
5735	* Check for I/O breakpoints.
5736	*/
5737	uint32_t const uDr7 = pCtx->dr[7];
5738	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5739	&& X86_DR7_ANY_RW_IO(uDr7)
5740	&& (pCtx->cr4 & X86_CR4_DE))
5741	\|\| DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5742	{
5743	rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5744	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5745	rcStrict = iemRaiseDebugException(pVCpu);
5746	}
5747	}
5748	return rcStrict;
5749	}
5750
5751
5752	/**
5753	* Implements 'OUT DX, eAX'.
5754	*
5755	* @param cbReg The register size.
5756	*/
5757	IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5758	{
5759	return IEM_CIMPL_CALL_2(iemCImpl_out, pVCpu->iem.s.CTX_SUFF(pCtx)->dx, cbReg);
5760	}
5761
5762
5763	/**
5764	* Implements 'CLI'.
5765	*/
5766	IEM_CIMPL_DEF_0(iemCImpl_cli)
5767	{
5768	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5769	uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5770	uint32_t const fEflOld = fEfl;
5771	if (pCtx->cr0 & X86_CR0_PE)
5772	{
5773	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5774	if (!(fEfl & X86_EFL_VM))
5775	{
5776	if (pVCpu->iem.s.uCpl <= uIopl)
5777	fEfl &= ~X86_EFL_IF;
5778	else if ( pVCpu->iem.s.uCpl == 3
5779	&& (pCtx->cr4 & X86_CR4_PVI) )
5780	fEfl &= ~X86_EFL_VIF;
5781	else
5782	return iemRaiseGeneralProtectionFault0(pVCpu);
5783	}
5784	/* V8086 */
5785	else if (uIopl == 3)
5786	fEfl &= ~X86_EFL_IF;
5787	else if ( uIopl < 3
5788	&& (pCtx->cr4 & X86_CR4_VME) )
5789	fEfl &= ~X86_EFL_VIF;
5790	else
5791	return iemRaiseGeneralProtectionFault0(pVCpu);
5792	}
5793	/* real mode */
5794	else
5795	fEfl &= ~X86_EFL_IF;
5796
5797	/* Commit. */
5798	IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5799	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5800	Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5801	return VINF_SUCCESS;
5802	}
5803
5804
5805	/**
5806	* Implements 'STI'.
5807	*/
5808	IEM_CIMPL_DEF_0(iemCImpl_sti)
5809	{
5810	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5811	uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5812	uint32_t const fEflOld = fEfl;
5813
5814	if (pCtx->cr0 & X86_CR0_PE)
5815	{
5816	uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5817	if (!(fEfl & X86_EFL_VM))
5818	{
5819	if (pVCpu->iem.s.uCpl <= uIopl)
5820	fEfl \|= X86_EFL_IF;
5821	else if ( pVCpu->iem.s.uCpl == 3
5822	&& (pCtx->cr4 & X86_CR4_PVI)
5823	&& !(fEfl & X86_EFL_VIP) )
5824	fEfl \|= X86_EFL_VIF;
5825	else
5826	return iemRaiseGeneralProtectionFault0(pVCpu);
5827	}
5828	/* V8086 */
5829	else if (uIopl == 3)
5830	fEfl \|= X86_EFL_IF;
5831	else if ( uIopl < 3
5832	&& (pCtx->cr4 & X86_CR4_VME)
5833	&& !(fEfl & X86_EFL_VIP) )
5834	fEfl \|= X86_EFL_VIF;
5835	else
5836	return iemRaiseGeneralProtectionFault0(pVCpu);
5837	}
5838	/* real mode */
5839	else
5840	fEfl \|= X86_EFL_IF;
5841
5842	/* Commit. */
5843	IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5844	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5845	if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) \|\| IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
5846	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
5847	Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5848	return VINF_SUCCESS;
5849	}
5850
5851
5852	/**
5853	* Implements 'HLT'.
5854	*/
5855	IEM_CIMPL_DEF_0(iemCImpl_hlt)
5856	{
5857	if (pVCpu->iem.s.uCpl != 0)
5858	return iemRaiseGeneralProtectionFault0(pVCpu);
5859	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5860	return VINF_EM_HALT;
5861	}
5862
5863
5864	/**
5865	* Implements 'MONITOR'.
5866	*/
5867	IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5868	{
5869	/*
5870	* Permission checks.
5871	*/
5872	if (pVCpu->iem.s.uCpl != 0)
5873	{
5874	Log2(("monitor: CPL != 0\n"));
5875	return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5876	}
5877	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5878	{
5879	Log2(("monitor: Not in CPUID\n"));
5880	return iemRaiseUndefinedOpcode(pVCpu);
5881	}
5882
5883	/*
5884	* Gather the operands and validate them.
5885	*/
5886	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5887	RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5888	uint32_t uEcx = pCtx->ecx;
5889	uint32_t uEdx = pCtx->edx;
5890	/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5891	* \#GP first. */
5892	if (uEcx != 0)
5893	{
5894	Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
5895	return iemRaiseGeneralProtectionFault0(pVCpu);
5896	}
5897
5898	VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
5899	if (rcStrict != VINF_SUCCESS)
5900	return rcStrict;
5901
5902	RTGCPHYS GCPhysMem;
5903	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ \| IEM_ACCESS_WHAT_DATA, &GCPhysMem);
5904	if (rcStrict != VINF_SUCCESS)
5905	return rcStrict;
5906
5907	/*
5908	* Call EM to prepare the monitor/wait.
5909	*/
5910	rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
5911	Assert(rcStrict == VINF_SUCCESS);
5912
5913	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5914	return rcStrict;
5915	}
5916
5917
5918	/**
5919	* Implements 'MWAIT'.
5920	*/
5921	IEM_CIMPL_DEF_0(iemCImpl_mwait)
5922	{
5923	/*
5924	* Permission checks.
5925	*/
5926	if (pVCpu->iem.s.uCpl != 0)
5927	{
5928	Log2(("mwait: CPL != 0\n"));
5929	/** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
5930	* EFLAGS.VM then.) */
5931	return iemRaiseUndefinedOpcode(pVCpu);
5932	}
5933	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5934	{
5935	Log2(("mwait: Not in CPUID\n"));
5936	return iemRaiseUndefinedOpcode(pVCpu);
5937	}
5938
5939	/*
5940	* Gather the operands and validate them.
5941	*/
5942	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5943	uint32_t uEax = pCtx->eax;
5944	uint32_t uEcx = pCtx->ecx;
5945	if (uEcx != 0)
5946	{
5947	/* Only supported extension is break on IRQ when IF=0. */
5948	if (uEcx > 1)
5949	{
5950	Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5951	return iemRaiseGeneralProtectionFault0(pVCpu);
5952	}
5953	uint32_t fMWaitFeatures = 0;
5954	uint32_t uIgnore = 0;
5955	CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5956	if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5957	!= (X86_CPUID_MWAIT_ECX_EXT \| X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5958	{
5959	Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5960	return iemRaiseGeneralProtectionFault0(pVCpu);
5961	}
5962	}
5963
5964	/*
5965	* Call EM to prepare the monitor/wait.
5966	*/
5967	VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
5968
5969	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5970	return rcStrict;
5971	}
5972
5973
5974	/**
5975	* Implements 'SWAPGS'.
5976	*/
5977	IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5978	{
5979	Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5980
5981	/*
5982	* Permission checks.
5983	*/
5984	if (pVCpu->iem.s.uCpl != 0)
5985	{
5986	Log2(("swapgs: CPL != 0\n"));
5987	return iemRaiseUndefinedOpcode(pVCpu);
5988	}
5989
5990	/*
5991	* Do the job.
5992	*/
5993	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
5994	uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5995	pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5996	pCtx->gs.u64Base = uOtherGsBase;
5997
5998	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5999	return VINF_SUCCESS;
6000	}
6001
6002
6003	/**
6004	* Implements 'CPUID'.
6005	*/
6006	IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6007	{
6008	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6009
6010	CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6011	pCtx->rax &= UINT32_C(0xffffffff);
6012	pCtx->rbx &= UINT32_C(0xffffffff);
6013	pCtx->rcx &= UINT32_C(0xffffffff);
6014	pCtx->rdx &= UINT32_C(0xffffffff);
6015
6016	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6017	return VINF_SUCCESS;
6018	}
6019
6020
6021	/**
6022	* Implements 'AAD'.
6023	*
6024	* @param bImm The immediate operand.
6025	*/
6026	IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6027	{
6028	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6029
6030	uint16_t const ax = pCtx->ax;
6031	uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6032	pCtx->ax = al;
6033	iemHlpUpdateArithEFlagsU8(pVCpu, al,
6034	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
6035	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
6036
6037	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6038	return VINF_SUCCESS;
6039	}
6040
6041
6042	/**
6043	* Implements 'AAM'.
6044	*
6045	* @param bImm The immediate operand. Cannot be 0.
6046	*/
6047	IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6048	{
6049	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6050	Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6051
6052	uint16_t const ax = pCtx->ax;
6053	uint8_t const al = (uint8_t)ax % bImm;
6054	uint8_t const ah = (uint8_t)ax / bImm;
6055	pCtx->ax = (ah << 8) + al;
6056	iemHlpUpdateArithEFlagsU8(pVCpu, al,
6057	X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF,
6058	X86_EFL_OF \| X86_EFL_AF \| X86_EFL_CF);
6059
6060	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6061	return VINF_SUCCESS;
6062	}
6063
6064
6065	/**
6066	* Implements 'DAA'.
6067	*/
6068	IEM_CIMPL_DEF_0(iemCImpl_daa)
6069	{
6070	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6071
6072	uint8_t const al = pCtx->al;
6073	bool const fCarry = pCtx->eflags.Bits.u1CF;
6074
6075	if ( pCtx->eflags.Bits.u1AF
6076	\|\| (al & 0xf) >= 10)
6077	{
6078	pCtx->al = al + 6;
6079	pCtx->eflags.Bits.u1AF = 1;
6080	}
6081	else
6082	pCtx->eflags.Bits.u1AF = 0;
6083
6084	if (al >= 0x9a \|\| fCarry)
6085	{
6086	pCtx->al += 0x60;
6087	pCtx->eflags.Bits.u1CF = 1;
6088	}
6089	else
6090	pCtx->eflags.Bits.u1CF = 0;
6091
6092	iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF, X86_EFL_OF);
6093	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6094	return VINF_SUCCESS;
6095	}
6096
6097
6098	/**
6099	* Implements 'DAS'.
6100	*/
6101	IEM_CIMPL_DEF_0(iemCImpl_das)
6102	{
6103	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6104
6105	uint8_t const uInputAL = pCtx->al;
6106	bool const fCarry = pCtx->eflags.Bits.u1CF;
6107
6108	if ( pCtx->eflags.Bits.u1AF
6109	\|\| (uInputAL & 0xf) >= 10)
6110	{
6111	pCtx->eflags.Bits.u1AF = 1;
6112	if (uInputAL < 6)
6113	pCtx->eflags.Bits.u1CF = 1;
6114	pCtx->al = uInputAL - 6;
6115	}
6116	else
6117	{
6118	pCtx->eflags.Bits.u1AF = 0;
6119	pCtx->eflags.Bits.u1CF = 0;
6120	}
6121
6122	if (uInputAL >= 0x9a \|\| fCarry)
6123	{
6124	pCtx->al -= 0x60;
6125	pCtx->eflags.Bits.u1CF = 1;
6126	}
6127
6128	iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF \| X86_EFL_ZF \| X86_EFL_PF, X86_EFL_OF);
6129	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6130	return VINF_SUCCESS;
6131	}
6132
6133
6134
6135
6136	/*
6137	* Instantiate the various string operation combinations.
6138	*/
6139	#define OP_SIZE 8
6140	#define ADDR_SIZE 16
6141	#include "IEMAllCImplStrInstr.cpp.h"
6142	#define OP_SIZE 8
6143	#define ADDR_SIZE 32
6144	#include "IEMAllCImplStrInstr.cpp.h"
6145	#define OP_SIZE 8
6146	#define ADDR_SIZE 64
6147	#include "IEMAllCImplStrInstr.cpp.h"
6148
6149	#define OP_SIZE 16
6150	#define ADDR_SIZE 16
6151	#include "IEMAllCImplStrInstr.cpp.h"
6152	#define OP_SIZE 16
6153	#define ADDR_SIZE 32
6154	#include "IEMAllCImplStrInstr.cpp.h"
6155	#define OP_SIZE 16
6156	#define ADDR_SIZE 64
6157	#include "IEMAllCImplStrInstr.cpp.h"
6158
6159	#define OP_SIZE 32
6160	#define ADDR_SIZE 16
6161	#include "IEMAllCImplStrInstr.cpp.h"
6162	#define OP_SIZE 32
6163	#define ADDR_SIZE 32
6164	#include "IEMAllCImplStrInstr.cpp.h"
6165	#define OP_SIZE 32
6166	#define ADDR_SIZE 64
6167	#include "IEMAllCImplStrInstr.cpp.h"
6168
6169	#define OP_SIZE 64
6170	#define ADDR_SIZE 32
6171	#include "IEMAllCImplStrInstr.cpp.h"
6172	#define OP_SIZE 64
6173	#define ADDR_SIZE 64
6174	#include "IEMAllCImplStrInstr.cpp.h"
6175
6176
6177	/**
6178	* Implements 'XGETBV'.
6179	*/
6180	IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6181	{
6182	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6183	if (pCtx->cr4 & X86_CR4_OSXSAVE)
6184	{
6185	uint32_t uEcx = pCtx->ecx;
6186	switch (uEcx)
6187	{
6188	case 0:
6189	break;
6190
6191	case 1: /** @todo Implement XCR1 support. */
6192	default:
6193	Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6194	return iemRaiseGeneralProtectionFault0(pVCpu);
6195
6196	}
6197	pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6198	pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6199
6200	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6201	return VINF_SUCCESS;
6202	}
6203	Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6204	return iemRaiseUndefinedOpcode(pVCpu);
6205	}
6206
6207
6208	/**
6209	* Implements 'XSETBV'.
6210	*/
6211	IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6212	{
6213	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6214	if (pCtx->cr4 & X86_CR4_OSXSAVE)
6215	{
6216	if (pVCpu->iem.s.uCpl == 0)
6217	{
6218	uint32_t uEcx = pCtx->ecx;
6219	uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6220	switch (uEcx)
6221	{
6222	case 0:
6223	{
6224	int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
6225	if (rc == VINF_SUCCESS)
6226	break;
6227	Assert(rc == VERR_CPUM_RAISE_GP_0);
6228	Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6229	return iemRaiseGeneralProtectionFault0(pVCpu);
6230	}
6231
6232	case 1: /** @todo Implement XCR1 support. */
6233	default:
6234	Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6235	return iemRaiseGeneralProtectionFault0(pVCpu);
6236
6237	}
6238
6239	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6240	return VINF_SUCCESS;
6241	}
6242
6243	Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
6244	return iemRaiseGeneralProtectionFault0(pVCpu);
6245	}
6246	Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6247	return iemRaiseUndefinedOpcode(pVCpu);
6248	}
6249
6250
6251
6252	/**
6253	* Implements 'FINIT' and 'FNINIT'.
6254	*
6255	* @param fCheckXcpts Whether to check for umasked pending exceptions or
6256	* not.
6257	*/
6258	IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6259	{
6260	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6261
6262	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
6263	return iemRaiseDeviceNotAvailable(pVCpu);
6264
6265	NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6266	if (fCheckXcpts && TODO )
6267	return iemRaiseMathFault(pVCpu);
6268	*/
6269
6270	PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6271	pXState->x87.FCW = 0x37f;
6272	pXState->x87.FSW = 0;
6273	pXState->x87.FTW = 0x00; /* 0 - empty. */
6274	pXState->x87.FPUDP = 0;
6275	pXState->x87.DS = 0; //??
6276	pXState->x87.Rsrvd2= 0;
6277	pXState->x87.FPUIP = 0;
6278	pXState->x87.CS = 0; //??
6279	pXState->x87.Rsrvd1= 0;
6280	pXState->x87.FOP = 0;
6281
6282	iemHlpUsedFpu(pVCpu);
6283	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6284	return VINF_SUCCESS;
6285	}
6286
6287
6288	/**
6289	* Implements 'FXSAVE'.
6290	*
6291	* @param iEffSeg The effective segment.
6292	* @param GCPtrEff The address of the image.
6293	* @param enmEffOpSize The operand size (only REX.W really matters).
6294	*/
6295	IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6296	{
6297	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6298
6299	/*
6300	* Raise exceptions.
6301	*/
6302	if (pCtx->cr0 & X86_CR0_EM)
6303	return iemRaiseUndefinedOpcode(pVCpu);
6304	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
6305	return iemRaiseDeviceNotAvailable(pVCpu);
6306	if (GCPtrEff & 15)
6307	{
6308	/** @todo CPU/VM detection possible! \#AC might not be signal for
6309	* all/any misalignment sizes, intel says its an implementation detail. */
6310	if ( (pCtx->cr0 & X86_CR0_AM)
6311	&& pCtx->eflags.Bits.u1AC
6312	&& pVCpu->iem.s.uCpl == 3)
6313	return iemRaiseAlignmentCheckException(pVCpu);
6314	return iemRaiseGeneralProtectionFault0(pVCpu);
6315	}
6316
6317	/*
6318	* Access the memory.
6319	*/
6320	void *pvMem512;
6321	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6322	if (rcStrict != VINF_SUCCESS)
6323	return rcStrict;
6324	PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6325	PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6326
6327	/*
6328	* Store the registers.
6329	*/
6330	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6331	* implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6332
6333	/* common for all formats */
6334	pDst->FCW = pSrc->FCW;
6335	pDst->FSW = pSrc->FSW;
6336	pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6337	pDst->FOP = pSrc->FOP;
6338	pDst->MXCSR = pSrc->MXCSR;
6339	pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6340	for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6341	{
6342	/** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6343	* them for now... */
6344	pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6345	pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6346	pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6347	pDst->aRegs[i].au32[3] = 0;
6348	}
6349
6350	/* FPU IP, CS, DP and DS. */
6351	pDst->FPUIP = pSrc->FPUIP;
6352	pDst->CS = pSrc->CS;
6353	pDst->FPUDP = pSrc->FPUDP;
6354	pDst->DS = pSrc->DS;
6355	if (enmEffOpSize == IEMMODE_64BIT)
6356	{
6357	/* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6358	pDst->Rsrvd1 = pSrc->Rsrvd1;
6359	pDst->Rsrvd2 = pSrc->Rsrvd2;
6360	pDst->au32RsrvdForSoftware[0] = 0;
6361	}
6362	else
6363	{
6364	pDst->Rsrvd1 = 0;
6365	pDst->Rsrvd2 = 0;
6366	pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6367	}
6368
6369	/* XMM registers. */
6370	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6371	\|\| pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6372	\|\| pVCpu->iem.s.uCpl != 0)
6373	{
6374	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6375	for (uint32_t i = 0; i < cXmmRegs; i++)
6376	pDst->aXMM[i] = pSrc->aXMM[i];
6377	/** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6378	* right? */
6379	}
6380
6381	/*
6382	* Commit the memory.
6383	*/
6384	rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6385	if (rcStrict != VINF_SUCCESS)
6386	return rcStrict;
6387
6388	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6389	return VINF_SUCCESS;
6390	}
6391
6392
6393	/**
6394	* Implements 'FXRSTOR'.
6395	*
6396	* @param GCPtrEff The address of the image.
6397	* @param enmEffOpSize The operand size (only REX.W really matters).
6398	*/
6399	IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6400	{
6401	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6402
6403	/*
6404	* Raise exceptions.
6405	*/
6406	if (pCtx->cr0 & X86_CR0_EM)
6407	return iemRaiseUndefinedOpcode(pVCpu);
6408	if (pCtx->cr0 & (X86_CR0_TS \| X86_CR0_EM))
6409	return iemRaiseDeviceNotAvailable(pVCpu);
6410	if (GCPtrEff & 15)
6411	{
6412	/** @todo CPU/VM detection possible! \#AC might not be signal for
6413	* all/any misalignment sizes, intel says its an implementation detail. */
6414	if ( (pCtx->cr0 & X86_CR0_AM)
6415	&& pCtx->eflags.Bits.u1AC
6416	&& pVCpu->iem.s.uCpl == 3)
6417	return iemRaiseAlignmentCheckException(pVCpu);
6418	return iemRaiseGeneralProtectionFault0(pVCpu);
6419	}
6420
6421	/*
6422	* Access the memory.
6423	*/
6424	void *pvMem512;
6425	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6426	if (rcStrict != VINF_SUCCESS)
6427	return rcStrict;
6428	PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6429	PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6430
6431	/*
6432	* Check the state for stuff which will #GP(0).
6433	*/
6434	uint32_t const fMXCSR = pSrc->MXCSR;
6435	uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6436	if (fMXCSR & ~fMXCSR_MASK)
6437	{
6438	Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6439	return iemRaiseGeneralProtectionFault0(pVCpu);
6440	}
6441
6442	/*
6443	* Load the registers.
6444	*/
6445	/** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6446	* implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6447
6448	/* common for all formats */
6449	pDst->FCW = pSrc->FCW;
6450	pDst->FSW = pSrc->FSW;
6451	pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6452	pDst->FOP = pSrc->FOP;
6453	pDst->MXCSR = fMXCSR;
6454	/* (MXCSR_MASK is read-only) */
6455	for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6456	{
6457	pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6458	pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6459	pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6460	pDst->aRegs[i].au32[3] = 0;
6461	}
6462
6463	/* FPU IP, CS, DP and DS. */
6464	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6465	{
6466	pDst->FPUIP = pSrc->FPUIP;
6467	pDst->CS = pSrc->CS;
6468	pDst->Rsrvd1 = pSrc->Rsrvd1;
6469	pDst->FPUDP = pSrc->FPUDP;
6470	pDst->DS = pSrc->DS;
6471	pDst->Rsrvd2 = pSrc->Rsrvd2;
6472	}
6473	else
6474	{
6475	pDst->FPUIP = pSrc->FPUIP;
6476	pDst->CS = pSrc->CS;
6477	pDst->Rsrvd1 = 0;
6478	pDst->FPUDP = pSrc->FPUDP;
6479	pDst->DS = pSrc->DS;
6480	pDst->Rsrvd2 = 0;
6481	}
6482
6483	/* XMM registers. */
6484	if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6485	\|\| pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6486	\|\| pVCpu->iem.s.uCpl != 0)
6487	{
6488	uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6489	for (uint32_t i = 0; i < cXmmRegs; i++)
6490	pDst->aXMM[i] = pSrc->aXMM[i];
6491	}
6492
6493	/*
6494	* Commit the memory.
6495	*/
6496	rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
6497	if (rcStrict != VINF_SUCCESS)
6498	return rcStrict;
6499
6500	iemHlpUsedFpu(pVCpu);
6501	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6502	return VINF_SUCCESS;
6503	}
6504
6505
6506	/**
6507	* Commmon routine for fnstenv and fnsave.
6508	*
6509	* @param uPtr Where to store the state.
6510	* @param pCtx The CPU context.
6511	*/
6512	static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6513	{
6514	PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6515	if (enmEffOpSize == IEMMODE_16BIT)
6516	{
6517	uPtr.pu16[0] = pSrcX87->FCW;
6518	uPtr.pu16[1] = pSrcX87->FSW;
6519	uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6520	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6521	{
6522	/** @todo Testcase: How does this work when the FPUIP/CS was saved in
6523	* protected mode or long mode and we save it in real mode? And vice
6524	* versa? And with 32-bit operand size? I think CPU is storing the
6525	* effective address ((CS << 4) + IP) in the offset register and not
6526	* doing any address calculations here. */
6527	uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6528	uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) \| pSrcX87->FOP;
6529	uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6530	uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6531	}
6532	else
6533	{
6534	uPtr.pu16[3] = pSrcX87->FPUIP;
6535	uPtr.pu16[4] = pSrcX87->CS;
6536	uPtr.pu16[5] = pSrcX87->FPUDP;
6537	uPtr.pu16[6] = pSrcX87->DS;
6538	}
6539	}
6540	else
6541	{
6542	/** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6543	uPtr.pu16[0*2] = pSrcX87->FCW;
6544	uPtr.pu16[02+1] = 0xffff; / (0xffff observed on intel skylake.) */
6545	uPtr.pu16[1*2] = pSrcX87->FSW;
6546	uPtr.pu16[1*2+1] = 0xffff;
6547	uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6548	uPtr.pu16[2*2+1] = 0xffff;
6549	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6550	{
6551	uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6552	uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) \| pSrcX87->FOP;
6553	uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6554	uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6555	}
6556	else
6557	{
6558	uPtr.pu32[3] = pSrcX87->FPUIP;
6559	uPtr.pu16[4*2] = pSrcX87->CS;
6560	uPtr.pu16[4*2+1] = pSrcX87->FOP;
6561	uPtr.pu32[5] = pSrcX87->FPUDP;
6562	uPtr.pu16[6*2] = pSrcX87->DS;
6563	uPtr.pu16[6*2+1] = 0xffff;
6564	}
6565	}
6566	}
6567
6568
6569	/**
6570	* Commmon routine for fldenv and frstor
6571	*
6572	* @param uPtr Where to store the state.
6573	* @param pCtx The CPU context.
6574	*/
6575	static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6576	{
6577	PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6578	if (enmEffOpSize == IEMMODE_16BIT)
6579	{
6580	pDstX87->FCW = uPtr.pu16[0];
6581	pDstX87->FSW = uPtr.pu16[1];
6582	pDstX87->FTW = uPtr.pu16[2];
6583	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6584	{
6585	pDstX87->FPUIP = uPtr.pu16[3] \| ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6586	pDstX87->FPUDP = uPtr.pu16[5] \| ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6587	pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6588	pDstX87->CS = 0;
6589	pDstX87->Rsrvd1= 0;
6590	pDstX87->DS = 0;
6591	pDstX87->Rsrvd2= 0;
6592	}
6593	else
6594	{
6595	pDstX87->FPUIP = uPtr.pu16[3];
6596	pDstX87->CS = uPtr.pu16[4];
6597	pDstX87->Rsrvd1= 0;
6598	pDstX87->FPUDP = uPtr.pu16[5];
6599	pDstX87->DS = uPtr.pu16[6];
6600	pDstX87->Rsrvd2= 0;
6601	/** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6602	}
6603	}
6604	else
6605	{
6606	pDstX87->FCW = uPtr.pu16[0*2];
6607	pDstX87->FSW = uPtr.pu16[1*2];
6608	pDstX87->FTW = uPtr.pu16[2*2];
6609	if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6610	{
6611	pDstX87->FPUIP = uPtr.pu16[3*2] \| ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6612	pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6613	pDstX87->FPUDP = uPtr.pu16[5*2] \| ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6614	pDstX87->CS = 0;
6615	pDstX87->Rsrvd1= 0;
6616	pDstX87->DS = 0;
6617	pDstX87->Rsrvd2= 0;
6618	}
6619	else
6620	{
6621	pDstX87->FPUIP = uPtr.pu32[3];
6622	pDstX87->CS = uPtr.pu16[4*2];
6623	pDstX87->Rsrvd1= 0;
6624	pDstX87->FOP = uPtr.pu16[4*2+1];
6625	pDstX87->FPUDP = uPtr.pu32[5];
6626	pDstX87->DS = uPtr.pu16[6*2];
6627	pDstX87->Rsrvd2= 0;
6628	}
6629	}
6630
6631	/* Make adjustments. */
6632	pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6633	pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6634	iemFpuRecalcExceptionStatus(pDstX87);
6635	/** @todo Testcase: Check if ES and/or B are automatically cleared if no
6636	* exceptions are pending after loading the saved state? */
6637	}
6638
6639
6640	/**
6641	* Implements 'FNSTENV'.
6642	*
6643	* @param enmEffOpSize The operand size (only REX.W really matters).
6644	* @param iEffSeg The effective segment register for @a GCPtrEff.
6645	* @param GCPtrEffDst The address of the image.
6646	*/
6647	IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6648	{
6649	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6650	RTPTRUNION uPtr;
6651	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6652	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6653	if (rcStrict != VINF_SUCCESS)
6654	return rcStrict;
6655
6656	iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6657
6658	rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6659	if (rcStrict != VINF_SUCCESS)
6660	return rcStrict;
6661
6662	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6663	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6664	return VINF_SUCCESS;
6665	}
6666
6667
6668	/**
6669	* Implements 'FNSAVE'.
6670	*
6671	* @param GCPtrEffDst The address of the image.
6672	* @param enmEffOpSize The operand size.
6673	*/
6674	IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6675	{
6676	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6677	RTPTRUNION uPtr;
6678	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6679	iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6680	if (rcStrict != VINF_SUCCESS)
6681	return rcStrict;
6682
6683	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6684	iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6685	PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6686	for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6687	{
6688	paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6689	paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6690	paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6691	}
6692
6693	rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W \| IEM_ACCESS_PARTIAL_WRITE);
6694	if (rcStrict != VINF_SUCCESS)
6695	return rcStrict;
6696
6697	/*
6698	* Re-initialize the FPU context.
6699	*/
6700	pFpuCtx->FCW = 0x37f;
6701	pFpuCtx->FSW = 0;
6702	pFpuCtx->FTW = 0x00; /* 0 - empty */
6703	pFpuCtx->FPUDP = 0;
6704	pFpuCtx->DS = 0;
6705	pFpuCtx->Rsrvd2= 0;
6706	pFpuCtx->FPUIP = 0;
6707	pFpuCtx->CS = 0;
6708	pFpuCtx->Rsrvd1= 0;
6709	pFpuCtx->FOP = 0;
6710
6711	iemHlpUsedFpu(pVCpu);
6712	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6713	return VINF_SUCCESS;
6714	}
6715
6716
6717
6718	/**
6719	* Implements 'FLDENV'.
6720	*
6721	* @param enmEffOpSize The operand size (only REX.W really matters).
6722	* @param iEffSeg The effective segment register for @a GCPtrEff.
6723	* @param GCPtrEffSrc The address of the image.
6724	*/
6725	IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6726	{
6727	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6728	RTCPTRUNION uPtr;
6729	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6730	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6731	if (rcStrict != VINF_SUCCESS)
6732	return rcStrict;
6733
6734	iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6735
6736	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6737	if (rcStrict != VINF_SUCCESS)
6738	return rcStrict;
6739
6740	iemHlpUsedFpu(pVCpu);
6741	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6742	return VINF_SUCCESS;
6743	}
6744
6745
6746	/**
6747	* Implements 'FRSTOR'.
6748	*
6749	* @param GCPtrEffSrc The address of the image.
6750	* @param enmEffOpSize The operand size.
6751	*/
6752	IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6753	{
6754	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6755	RTCPTRUNION uPtr;
6756	VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6757	iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6758	if (rcStrict != VINF_SUCCESS)
6759	return rcStrict;
6760
6761	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6762	iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6763	PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6764	for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6765	{
6766	pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6767	pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6768	pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6769	pFpuCtx->aRegs[i].au32[3] = 0;
6770	}
6771
6772	rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6773	if (rcStrict != VINF_SUCCESS)
6774	return rcStrict;
6775
6776	iemHlpUsedFpu(pVCpu);
6777	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6778	return VINF_SUCCESS;
6779	}
6780
6781
6782	/**
6783	* Implements 'FLDCW'.
6784	*
6785	* @param u16Fcw The new FCW.
6786	*/
6787	IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6788	{
6789	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6790
6791	/** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6792	/** @todo Testcase: Try see what happens when trying to set undefined bits
6793	* (other than 6 and 7). Currently ignoring them. */
6794	/** @todo Testcase: Test that it raises and loweres the FPU exception bits
6795	* according to FSW. (This is was is currently implemented.) */
6796	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6797	pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6798	iemFpuRecalcExceptionStatus(pFpuCtx);
6799
6800	/* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6801	iemHlpUsedFpu(pVCpu);
6802	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6803	return VINF_SUCCESS;
6804	}
6805
6806
6807
6808	/**
6809	* Implements the underflow case of fxch.
6810	*
6811	* @param iStReg The other stack register.
6812	*/
6813	IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6814	{
6815	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6816
6817	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6818	unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6819	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6820	Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) \|\| !(RT_BIT(iReg2) & pFpuCtx->FTW));
6821
6822	/** @todo Testcase: fxch underflow. Making assumptions that underflowed
6823	* registers are read as QNaN and then exchanged. This could be
6824	* wrong... */
6825	if (pFpuCtx->FCW & X86_FCW_IM)
6826	{
6827	if (RT_BIT(iReg1) & pFpuCtx->FTW)
6828	{
6829	if (RT_BIT(iReg2) & pFpuCtx->FTW)
6830	iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6831	else
6832	pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6833	iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6834	}
6835	else
6836	{
6837	pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6838	iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6839	}
6840	pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6841	pFpuCtx->FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF;
6842	}
6843	else
6844	{
6845	/* raise underflow exception, don't change anything. */
6846	pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK \| X86_FSW_XCPT_MASK);
6847	pFpuCtx->FSW \|= X86_FSW_C1 \| X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
6848	}
6849
6850	iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6851	iemHlpUsedFpu(pVCpu);
6852	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6853	return VINF_SUCCESS;
6854	}
6855
6856
6857	/**
6858	* Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6859	*
6860	* @param cToAdd 1 or 7.
6861	*/
6862	IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6863	{
6864	PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6865	Assert(iStReg < 8);
6866
6867	/*
6868	* Raise exceptions.
6869	*/
6870	if (pCtx->cr0 & (X86_CR0_EM \| X86_CR0_TS))
6871	return iemRaiseDeviceNotAvailable(pVCpu);
6872
6873	PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6874	uint16_t u16Fsw = pFpuCtx->FSW;
6875	if (u16Fsw & X86_FSW_ES)
6876	return iemRaiseMathFault(pVCpu);
6877
6878	/*
6879	* Check if any of the register accesses causes #SF + #IA.
6880	*/
6881	unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
6882	unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6883	if ((pFpuCtx->FTW & (RT_BIT(iReg1) \| RT_BIT(iReg2))) == (RT_BIT(iReg1) \| RT_BIT(iReg2)))
6884	{
6885	uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
6886	NOREF(u32Eflags);
6887
6888	pFpuCtx->FSW &= ~X86_FSW_C1;
6889	pFpuCtx->FSW \|= u16Fsw & ~X86_FSW_TOP_MASK;
6890	if ( !(u16Fsw & X86_FSW_IE)
6891	\|\| (pFpuCtx->FCW & X86_FCW_IM) )
6892	{
6893	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6894	pCtx->eflags.u \|= pCtx->eflags.u & (X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6895	}
6896	}
6897	else if (pFpuCtx->FCW & X86_FCW_IM)
6898	{
6899	/* Masked underflow. */
6900	pFpuCtx->FSW &= ~X86_FSW_C1;
6901	pFpuCtx->FSW \|= X86_FSW_IE \| X86_FSW_SF;
6902	pCtx->eflags.u &= ~(X86_EFL_OF \| X86_EFL_SF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF);
6903	pCtx->eflags.u \|= X86_EFL_ZF \| X86_EFL_PF \| X86_EFL_CF;
6904	}
6905	else
6906	{
6907	/* Raise underflow - don't touch EFLAGS or TOP. */
6908	pFpuCtx->FSW &= ~X86_FSW_C1;
6909	pFpuCtx->FSW \|= X86_FSW_IE \| X86_FSW_SF \| X86_FSW_ES \| X86_FSW_B;
6910	fPop = false;
6911	}
6912
6913	/*
6914	* Pop if necessary.
6915	*/
6916	if (fPop)
6917	{
6918	pFpuCtx->FTW &= ~RT_BIT(iReg1);
6919	pFpuCtx->FSW &= X86_FSW_TOP_MASK;
6920	pFpuCtx->FSW \|= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
6921	}
6922
6923	iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6924	iemHlpUsedFpu(pVCpu);
6925	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6926	return VINF_SUCCESS;
6927	}
6928
6929	/** @} */
6930

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 62015

Download in other formats: