EMAll.cpp@ 13152

Last change on this file since 13152 was 13146, checked in by vboxsync, 16 years ago
#1865: Renamed PGMPhysReadGCPhys -> PGMPhysSimpleReadGCPhys, PGMPhysWriteGCPhys -> PGMPhysSimpleWriteGCPhys, PGMPhysReadGCPtrSafe -> PGMPhysReadGCPtr and PGMPhysWriteGCPtrSafe -> PGMPhysWriteGCPtr. This puts PGMPhysRead/Write and PGMPhysRead/WriteGCPtr in the same group.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 96.9 KB

Line
1	/* $Id: EMAll.cpp 13146 2008-10-09 22:58:12Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_EM
26	#include <VBox/em.h>
27	#include <VBox/mm.h>
28	#include <VBox/selm.h>
29	#include <VBox/patm.h>
30	#include <VBox/csam.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/stam.h>
34	#include "EMInternal.h"
35	#include <VBox/vm.h>
36	#include <VBox/vmm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Defined Constants And Macros *
53	*******************************************************************************/
54	/** @def EM_ASSERT_FAULT_RETURN
55	* Safety check.
56	*
57	* Could in theory it misfire on a cross page boundary access...
58	*
59	* Currently disabled because the CSAM (+ PATM) patch monitoring occationally
60	* turns up an alias page instead of the original faulting one and annoying the
61	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
62	*/
63	#if 0
64	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
65	#else
66	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
67	#endif
68
69
70	/*******************************************************************************
71	* Internal Functions *
72	*******************************************************************************/
73	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
74
75
76
77	/**
78	* Get the current execution manager status.
79	*
80	* @returns Current status.
81	*/
82	VMMDECL(EMSTATE) EMGetState(PVM pVM)
83	{
84	return pVM->em.s.enmState;
85	}
86
87
88	/**
89	* Flushes the REM translation blocks the next time we execute code there.
90	*
91	* @param pVM The VM handle.
92	*
93	* @todo This doesn't belong here, it should go in REMAll.cpp!
94	*/
95	VMMDECL(void) EMFlushREMTBs(PVM pVM)
96	{
97	Log(("EMFlushREMTBs\n"));
98	pVM->em.s.fREMFlushTBs = true;
99	}
100
101	#ifndef IN_GC
102
103	/**
104	* Read callback for disassembly function; supports reading bytes that cross a page boundary
105	*
106	* @returns VBox status code.
107	* @param pSrc GC source pointer
108	* @param pDest HC destination pointer
109	* @param cb Number of bytes to read
110	* @param dwUserdata Callback specific user data (pCpu)
111	*
112	*/
113	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
114	{
115	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
116	PVM pVM = (PVM)pCpu->apvUserData[0];
117	# ifdef IN_RING0
118	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
119	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%VGv cb=%x\n", pSrc, cb));
120	# else /* IN_RING3 */
121	if (!PATMIsPatchGCAddr(pVM, pSrc))
122	{
123	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
124	AssertRC(rc);
125	}
126	else
127	{
128	for (uint32_t i = 0; i < cb; i++)
129	{
130	uint8_t opcode;
131	if (VBOX_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
132	{
133	*(pDest+i) = opcode;
134	}
135	}
136	}
137	# endif /* IN_RING3 */
138	return VINF_SUCCESS;
139	}
140
141	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
142	{
143	return DISCoreOneEx(InstrGC, pCpu->mode, EMReadBytes, pVM, pCpu, pOpsize);
144	}
145
146	#else /* IN_GC */
147
148	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
149	{
150	return DISCoreOne(pCpu, InstrGC, pOpsize);
151	}
152
153	#endif /* IN_GC */
154
155
156	/**
157	* Disassembles one instruction.
158	*
159	* @param pVM The VM handle.
160	* @param pCtxCore The context core (used for both the mode and instruction).
161	* @param pCpu Where to return the parsed instruction info.
162	* @param pcbInstr Where to return the instruction size. (optional)
163	*/
164	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
165	{
166	RTGCPTR GCPtrInstr;
167	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
168	if (VBOX_FAILURE(rc))
169	{
170	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%VGv (cpl=%d) - rc=%Vrc !!\n",
171	pCtxCore->cs, pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
172	return rc;
173	}
174	return EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pCpu, pcbInstr);
175	}
176
177
178	/**
179	* Disassembles one instruction.
180	*
181	* This is used by internally by the interpreter and by trap/access handlers.
182	*
183	* @param pVM The VM handle.
184	* @param GCPtrInstr The flat address of the instruction.
185	* @param pCtxCore The context core (used to determin the cpu mode).
186	* @param pCpu Where to return the parsed instruction info.
187	* @param pcbInstr Where to return the instruction size. (optional)
188	*/
189	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
190	{
191	int rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
192	#ifdef IN_GC
193	NULL, NULL,
194	#else
195	EMReadBytes, pVM,
196	#endif
197	pCpu, pcbInstr);
198	if (VBOX_SUCCESS(rc))
199	return VINF_SUCCESS;
200	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%VGv rc=%Vrc\n", GCPtrInstr, rc));
201	return VERR_INTERNAL_ERROR;
202	}
203
204
205	/**
206	* Interprets the current instruction.
207	*
208	* @returns VBox status code.
209	* @retval VINF_* Scheduling instructions.
210	* @retval VERR_EM_INTERPRETER Something we can't cope with.
211	* @retval VERR_* Fatal errors.
212	*
213	* @param pVM The VM handle.
214	* @param pRegFrame The register frame.
215	* Updates the EIP if an instruction was executed successfully.
216	* @param pvFault The fault address (CR2).
217	* @param pcbSize Size of the write (if applicable).
218	*
219	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
220	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
221	* to worry about e.g. invalid modrm combinations (!)
222	*/
223	VMMDECL(int) EMInterpretInstruction(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
224	{
225	RTGCPTR pbCode;
226
227	LogFlow(("EMInterpretInstruction %VGv fault %VGv\n", pRegFrame->rip, pvFault));
228	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
229	if (VBOX_SUCCESS(rc))
230	{
231	uint32_t cbOp;
232	DISCPUSTATE Cpu;
233	Cpu.mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
234	rc = emDisCoreOne(pVM, &Cpu, (RTGCUINTPTR)pbCode, &cbOp);
235	if (VBOX_SUCCESS(rc))
236	{
237	Assert(cbOp == Cpu.opsize);
238	rc = EMInterpretInstructionCPU(pVM, &Cpu, pRegFrame, pvFault, pcbSize);
239	if (VBOX_SUCCESS(rc))
240	{
241	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
242	}
243	return rc;
244	}
245	}
246	return VERR_EM_INTERPRETER;
247	}
248
249
250	/**
251	* Interprets the current instruction using the supplied DISCPUSTATE structure.
252	*
253	* EIP is NOT updated!
254	*
255	* @returns VBox status code.
256	* @retval VINF_* Scheduling instructions. When these are returned, it
257	* starts to get a bit tricky to know whether code was
258	* executed or not... We'll address this when it becomes a problem.
259	* @retval VERR_EM_INTERPRETER Something we can't cope with.
260	* @retval VERR_* Fatal errors.
261	*
262	* @param pVM The VM handle.
263	* @param pCpu The disassembler cpu state for the instruction to be interpreted.
264	* @param pRegFrame The register frame. EIP is NOT changed!
265	* @param pvFault The fault address (CR2).
266	* @param pcbSize Size of the write (if applicable).
267	*
268	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
269	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
270	* to worry about e.g. invalid modrm combinations (!)
271	*
272	* @todo At this time we do NOT check if the instruction overwrites vital information.
273	* Make sure this can't happen!! (will add some assertions/checks later)
274	*/
275	VMMDECL(int) EMInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
276	{
277	STAM_PROFILE_START(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
278	int rc = emInterpretInstructionCPU(pVM, pCpu, pRegFrame, pvFault, pcbSize);
279	STAM_PROFILE_STOP(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
280	if (VBOX_SUCCESS(rc))
281	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
282	else
283	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
284	return rc;
285	}
286
287
288	/**
289	* Interpret a port I/O instruction.
290	*
291	* @returns VBox status code suitable for scheduling.
292	* @param pVM The VM handle.
293	* @param pCtxCore The context core. This will be updated on successful return.
294	* @param pCpu The instruction to interpret.
295	* @param cbOp The size of the instruction.
296	* @remark This may raise exceptions.
297	*/
298	VMMDECL(int) EMInterpretPortIO(PVM pVM, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, uint32_t cbOp)
299	{
300	/*
301	* Hand it on to IOM.
302	*/
303	#ifdef IN_GC
304	int rc = IOMGCIOPortHandler(pVM, pCtxCore, pCpu);
305	if (IOM_SUCCESS(rc))
306	pCtxCore->rip += cbOp;
307	return rc;
308	#else
309	AssertReleaseMsgFailed(("not implemented\n"));
310	return VERR_NOT_IMPLEMENTED;
311	#endif
312	}
313
314
315	DECLINLINE(int) emRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
316	{
317	#ifdef IN_GC
318	int rc = MMGCRamRead(pVM, pDest, (void *)GCSrc, cb);
319	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
320	return rc;
321	/*
322	* The page pool cache may end up here in some cases because it
323	* flushed one of the shadow mappings used by the trapping
324	* instruction and it either flushed the TLB or the CPU reused it.
325	*/
326	RTGCPHYS GCPhys;
327	rc = PGMPhysGCPtr2GCPhys(pVM, GCSrc, &GCPhys);
328	AssertRCReturn(rc, rc);
329	PGMPhysRead(pVM, GCPhys, pDest, cb);
330	return VINF_SUCCESS;
331	#else
332	return PGMPhysReadGCPtr(pVM, pDest, GCSrc, cb);
333	#endif
334	}
335
336
337	DECLINLINE(int) emRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
338	{
339	#ifdef IN_GC
340	int rc = MMGCRamWrite(pVM, (void *)GCDest, pSrc, cb);
341	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
342	return rc;
343	/*
344	* The page pool cache may end up here in some cases because it
345	* flushed one of the shadow mappings used by the trapping
346	* instruction and it either flushed the TLB or the CPU reused it.
347	* We want to play safe here, verifying that we've got write
348	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
349	*/
350	uint64_t fFlags;
351	RTGCPHYS GCPhys;
352	rc = PGMGstGetPage(pVM, GCDest, &fFlags, &GCPhys);
353	if (RT_FAILURE(rc))
354	return rc;
355	if ( !(fFlags & X86_PTE_RW)
356	&& (CPUMGetGuestCR0(pVM) & X86_CR0_WP))
357	return VERR_ACCESS_DENIED;
358
359	PGMPhysWrite(pVM, GCPhys + ((RTGCUINTPTR)GCDest & PAGE_OFFSET_MASK), pSrc, cb);
360	return VINF_SUCCESS;
361
362	#else
363	return PGMPhysWriteGCPtr(pVM, GCDest, pSrc, cb);
364	#endif
365	}
366
367
368	/* Convert sel:addr to a flat GC address */
369	static RTGCPTR emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, POP_PARAMETER pParam, RTGCPTR pvAddr)
370	{
371	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pCpu, pParam);
372	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
373	}
374
375
376	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
377	/**
378	* Get the mnemonic for the disassembled instruction.
379	*
380	* GC/R0 doesn't include the strings in the DIS tables because
381	* of limited space.
382	*/
383	static const char *emGetMnemonic(PDISCPUSTATE pCpu)
384	{
385	switch (pCpu->pCurInstr->opcode)
386	{
387	case OP_XCHG: return "Xchg";
388	case OP_DEC: return "Dec";
389	case OP_INC: return "Inc";
390	case OP_POP: return "Pop";
391	case OP_OR: return "Or";
392	case OP_AND: return "And";
393	case OP_MOV: return "Mov";
394	case OP_INVLPG: return "InvlPg";
395	case OP_CPUID: return "CpuId";
396	case OP_MOV_CR: return "MovCRx";
397	case OP_MOV_DR: return "MovDRx";
398	case OP_LLDT: return "LLdt";
399	case OP_LGDT: return "LGdt";
400	case OP_LIDT: return "LGdt";
401	case OP_CLTS: return "Clts";
402	case OP_MONITOR: return "Monitor";
403	case OP_MWAIT: return "MWait";
404	case OP_RDMSR: return "Rdmsr";
405	case OP_WRMSR: return "Wrmsr";
406	case OP_ADD: return "Add";
407	case OP_ADC: return "Adc";
408	case OP_SUB: return "Sub";
409	case OP_SBB: return "Sbb";
410	case OP_RDTSC: return "Rdtsc";
411	case OP_STI: return "Sti";
412	case OP_XADD: return "XAdd";
413	case OP_HLT: return "Hlt";
414	case OP_IRET: return "Iret";
415	case OP_MOVNTPS: return "MovNTPS";
416	case OP_STOSWD: return "StosWD";
417	case OP_WBINVD: return "WbInvd";
418	case OP_XOR: return "Xor";
419	case OP_BTR: return "Btr";
420	case OP_BTS: return "Bts";
421	case OP_BTC: return "Btc";
422	case OP_CMPXCHG: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
423	case OP_CMPXCHG8B: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
424
425	default:
426	Log(("Unknown opcode %d\n", pCpu->pCurInstr->opcode));
427	return "???";
428	}
429	}
430	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
431
432
433	/**
434	* XCHG instruction emulation.
435	*/
436	static int emInterpretXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
437	{
438	OP_PARAMVAL param1, param2;
439
440	/* Source to make DISQueryParamVal read the register value - ugly hack */
441	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
442	if(VBOX_FAILURE(rc))
443	return VERR_EM_INTERPRETER;
444
445	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
446	if(VBOX_FAILURE(rc))
447	return VERR_EM_INTERPRETER;
448
449	#ifdef IN_GC
450	if (TRPMHasTrap(pVM))
451	{
452	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
453	{
454	#endif
455	RTGCPTR pParam1 = 0, pParam2 = 0;
456	uint64_t valpar1, valpar2;
457
458	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
459	switch(param1.type)
460	{
461	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
462	valpar1 = param1.val.val64;
463	break;
464
465	case PARMTYPE_ADDRESS:
466	pParam1 = (RTGCPTR)param1.val.val64;
467	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
468	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
469	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
470	if (VBOX_FAILURE(rc))
471	{
472	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
473	return VERR_EM_INTERPRETER;
474	}
475	break;
476
477	default:
478	AssertFailed();
479	return VERR_EM_INTERPRETER;
480	}
481
482	switch(param2.type)
483	{
484	case PARMTYPE_ADDRESS:
485	pParam2 = (RTGCPTR)param2.val.val64;
486	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pParam2);
487	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
488	rc = emRamRead(pVM, &valpar2, pParam2, param2.size);
489	if (VBOX_FAILURE(rc))
490	{
491	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
492	}
493	break;
494
495	case PARMTYPE_IMMEDIATE:
496	valpar2 = param2.val.val64;
497	break;
498
499	default:
500	AssertFailed();
501	return VERR_EM_INTERPRETER;
502	}
503
504	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
505	if (pParam1 == 0)
506	{
507	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
508	switch(param1.size)
509	{
510	case 1: //special case for AH etc
511	rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t )valpar2); break;
512	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)valpar2); break;
513	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)valpar2); break;
514	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, valpar2); break;
515	default: AssertFailedReturn(VERR_EM_INTERPRETER);
516	}
517	if (VBOX_FAILURE(rc))
518	return VERR_EM_INTERPRETER;
519	}
520	else
521	{
522	rc = emRamWrite(pVM, pParam1, &valpar2, param1.size);
523	if (VBOX_FAILURE(rc))
524	{
525	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
526	return VERR_EM_INTERPRETER;
527	}
528	}
529
530	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
531	if (pParam2 == 0)
532	{
533	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
534	switch(param2.size)
535	{
536	case 1: //special case for AH etc
537	rc = DISWriteReg8(pRegFrame, pCpu->param2.base.reg_gen, (uint8_t )valpar1); break;
538	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param2.base.reg_gen, (uint16_t)valpar1); break;
539	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param2.base.reg_gen, (uint32_t)valpar1); break;
540	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param2.base.reg_gen, valpar1); break;
541	default: AssertFailedReturn(VERR_EM_INTERPRETER);
542	}
543	if (VBOX_FAILURE(rc))
544	return VERR_EM_INTERPRETER;
545	}
546	else
547	{
548	rc = emRamWrite(pVM, pParam2, &valpar1, param2.size);
549	if (VBOX_FAILURE(rc))
550	{
551	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
552	return VERR_EM_INTERPRETER;
553	}
554	}
555
556	*pcbSize = param2.size;
557	return VINF_SUCCESS;
558	#ifdef IN_GC
559	}
560	}
561	#endif
562	return VERR_EM_INTERPRETER;
563	}
564
565
566	/**
567	* INC and DEC emulation.
568	*/
569	static int emInterpretIncDec(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
570	PFNEMULATEPARAM2 pfnEmulate)
571	{
572	OP_PARAMVAL param1;
573
574	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
575	if(VBOX_FAILURE(rc))
576	return VERR_EM_INTERPRETER;
577
578	#ifdef IN_GC
579	if (TRPMHasTrap(pVM))
580	{
581	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
582	{
583	#endif
584	RTGCPTR pParam1 = 0;
585	uint64_t valpar1;
586
587	if (param1.type == PARMTYPE_ADDRESS)
588	{
589	pParam1 = (RTGCPTR)param1.val.val64;
590	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
591	#ifdef IN_GC
592	/* Safety check (in theory it could cross a page boundary and fault there though) */
593	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
594	#endif
595	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
596	if (VBOX_FAILURE(rc))
597	{
598	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
599	return VERR_EM_INTERPRETER;
600	}
601	}
602	else
603	{
604	AssertFailed();
605	return VERR_EM_INTERPRETER;
606	}
607
608	uint32_t eflags;
609
610	eflags = pfnEmulate(&valpar1, param1.size);
611
612	/* Write result back */
613	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
614	if (VBOX_FAILURE(rc))
615	{
616	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
617	return VERR_EM_INTERPRETER;
618	}
619
620	/* Update guest's eflags and finish. */
621	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
622	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
623
624	/* All done! */
625	*pcbSize = param1.size;
626	return VINF_SUCCESS;
627	#ifdef IN_GC
628	}
629	}
630	#endif
631	return VERR_EM_INTERPRETER;
632	}
633
634
635	/**
636	* POP Emulation.
637	*/
638	static int emInterpretPop(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
639	{
640	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
641	OP_PARAMVAL param1;
642	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
643	if(VBOX_FAILURE(rc))
644	return VERR_EM_INTERPRETER;
645
646	#ifdef IN_GC
647	if (TRPMHasTrap(pVM))
648	{
649	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
650	{
651	#endif
652	RTGCPTR pParam1 = 0;
653	uint32_t valpar1;
654	RTGCPTR pStackVal;
655
656	/* Read stack value first */
657	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
658	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
659
660	/* Convert address; don't bother checking limits etc, as we only read here */
661	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
662	if (pStackVal == 0)
663	return VERR_EM_INTERPRETER;
664
665	rc = emRamRead(pVM, &valpar1, pStackVal, param1.size);
666	if (VBOX_FAILURE(rc))
667	{
668	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
669	return VERR_EM_INTERPRETER;
670	}
671
672	if (param1.type == PARMTYPE_ADDRESS)
673	{
674	pParam1 = (RTGCPTR)param1.val.val64;
675
676	/* pop [esp+xx] uses esp after the actual pop! */
677	AssertCompile(USE_REG_ESP == USE_REG_SP);
678	if ( (pCpu->param1.flags & USE_BASE)
679	&& (pCpu->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
680	&& pCpu->param1.base.reg_gen == USE_REG_ESP
681	)
682	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
683
684	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
685	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
686	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
687	if (VBOX_FAILURE(rc))
688	{
689	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
690	return VERR_EM_INTERPRETER;
691	}
692
693	/* Update ESP as the last step */
694	pRegFrame->esp += param1.size;
695	}
696	else
697	{
698	#ifndef DEBUG_bird // annoying assertion.
699	AssertFailed();
700	#endif
701	return VERR_EM_INTERPRETER;
702	}
703
704	/* All done! */
705	*pcbSize = param1.size;
706	return VINF_SUCCESS;
707	#ifdef IN_GC
708	}
709	}
710	#endif
711	return VERR_EM_INTERPRETER;
712	}
713
714
715	/**
716	* XOR/OR/AND Emulation.
717	*/
718	static int emInterpretOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
719	PFNEMULATEPARAM3 pfnEmulate)
720	{
721	OP_PARAMVAL param1, param2;
722	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
723	if(VBOX_FAILURE(rc))
724	return VERR_EM_INTERPRETER;
725
726	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
727	if(VBOX_FAILURE(rc))
728	return VERR_EM_INTERPRETER;
729
730	#ifdef IN_GC
731	if (TRPMHasTrap(pVM))
732	{
733	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
734	{
735	#endif
736	RTGCPTR pParam1;
737	uint64_t valpar1, valpar2;
738
739	if (pCpu->param1.size != pCpu->param2.size)
740	{
741	if (pCpu->param1.size < pCpu->param2.size)
742	{
743	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
744	return VERR_EM_INTERPRETER;
745	}
746	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
747	pCpu->param2.size = pCpu->param1.size;
748	param2.size = param1.size;
749	}
750
751	/* The destination is always a virtual address */
752	if (param1.type == PARMTYPE_ADDRESS)
753	{
754	pParam1 = (RTGCPTR)param1.val.val64;
755	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
756	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
757	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
758	if (VBOX_FAILURE(rc))
759	{
760	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
761	return VERR_EM_INTERPRETER;
762	}
763	}
764	else
765	{
766	AssertFailed();
767	return VERR_EM_INTERPRETER;
768	}
769
770	/* Register or immediate data */
771	switch(param2.type)
772	{
773	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
774	valpar2 = param2.val.val64;
775	break;
776
777	default:
778	AssertFailed();
779	return VERR_EM_INTERPRETER;
780	}
781
782	LogFlow(("emInterpretOrXorAnd %s %VGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pCpu), pParam1, valpar1, valpar2, param2.size, param1.size));
783
784	/* Data read, emulate instruction. */
785	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
786
787	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pCpu), valpar1));
788
789	/* Update guest's eflags and finish. */
790	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
791	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
792
793	/* And write it back */
794	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
795	if (VBOX_SUCCESS(rc))
796	{
797	/* All done! */
798	*pcbSize = param2.size;
799	return VINF_SUCCESS;
800	}
801	#ifdef IN_GC
802	}
803	}
804	#endif
805	return VERR_EM_INTERPRETER;
806	}
807
808
809	/**
810	* LOCK XOR/OR/AND Emulation.
811	*/
812	static int emInterpretLockOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
813	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
814	{
815	void *pvParam1;
816
817	OP_PARAMVAL param1, param2;
818	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
819	if(VBOX_FAILURE(rc))
820	return VERR_EM_INTERPRETER;
821
822	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
823	if(VBOX_FAILURE(rc))
824	return VERR_EM_INTERPRETER;
825
826	if (pCpu->param1.size != pCpu->param2.size)
827	{
828	AssertMsgReturn(pCpu->param1.size >= pCpu->param2.size, /* should never happen! */
829	("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size),
830	VERR_EM_INTERPRETER);
831
832	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
833	pCpu->param2.size = pCpu->param1.size;
834	param2.size = param1.size;
835	}
836
837	/* The destination is always a virtual address */
838	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
839
840	RTGCPTR GCPtrPar1 = param1.val.val64;
841	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
842	#ifdef IN_GC
843	pvParam1 = (void *)GCPtrPar1;
844	#else
845	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
846	if (VBOX_FAILURE(rc))
847	{
848	AssertRC(rc);
849	return VERR_EM_INTERPRETER;
850	}
851	#endif
852
853	#ifdef IN_GC
854	/* Safety check (in theory it could cross a page boundary and fault there though) */
855	Assert( TRPMHasTrap(pVM)
856	&& (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW));
857	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
858	#endif
859
860	/* Register and immediate data == PARMTYPE_IMMEDIATE */
861	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
862	RTGCUINTREG ValPar2 = param2.val.val64;
863
864	/* Try emulate it with a one-shot #PF handler in place. */
865	Log2(("%s %VGv imm%d=%RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
866
867	RTGCUINTREG32 eflags = 0;
868	#ifdef IN_GC
869	MMGCRamRegisterTrapHandler(pVM);
870	#endif
871	rc = pfnEmulate(pvParam1, ValPar2, pCpu->param2.size, &eflags);
872	#ifdef IN_GC
873	MMGCRamDeregisterTrapHandler(pVM);
874	#endif
875	if (RT_FAILURE(rc))
876	{
877	Log(("%s %VGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
878	return VERR_EM_INTERPRETER;
879	}
880
881	/* Update guest's eflags and finish. */
882	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
883	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
884
885	*pcbSize = param2.size;
886	return VINF_SUCCESS;
887	}
888
889
890	/**
891	* ADD, ADC & SUB Emulation.
892	*/
893	static int emInterpretAddSub(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
894	PFNEMULATEPARAM3 pfnEmulate)
895	{
896	OP_PARAMVAL param1, param2;
897	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
898	if(VBOX_FAILURE(rc))
899	return VERR_EM_INTERPRETER;
900
901	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
902	if(VBOX_FAILURE(rc))
903	return VERR_EM_INTERPRETER;
904
905	#ifdef IN_GC
906	if (TRPMHasTrap(pVM))
907	{
908	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
909	{
910	#endif
911	RTGCPTR pParam1;
912	uint64_t valpar1, valpar2;
913
914	if (pCpu->param1.size != pCpu->param2.size)
915	{
916	if (pCpu->param1.size < pCpu->param2.size)
917	{
918	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
919	return VERR_EM_INTERPRETER;
920	}
921	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
922	pCpu->param2.size = pCpu->param1.size;
923	param2.size = param1.size;
924	}
925
926	/* The destination is always a virtual address */
927	if (param1.type == PARMTYPE_ADDRESS)
928	{
929	pParam1 = (RTGCPTR)param1.val.val64;
930	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
931	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
932	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
933	if (VBOX_FAILURE(rc))
934	{
935	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
936	return VERR_EM_INTERPRETER;
937	}
938	}
939	else
940	{
941	#ifndef DEBUG_bird
942	AssertFailed();
943	#endif
944	return VERR_EM_INTERPRETER;
945	}
946
947	/* Register or immediate data */
948	switch(param2.type)
949	{
950	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
951	valpar2 = param2.val.val64;
952	break;
953
954	default:
955	AssertFailed();
956	return VERR_EM_INTERPRETER;
957	}
958
959	/* Data read, emulate instruction. */
960	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
961
962	/* Update guest's eflags and finish. */
963	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
964	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
965
966	/* And write it back */
967	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
968	if (VBOX_SUCCESS(rc))
969	{
970	/* All done! */
971	*pcbSize = param2.size;
972	return VINF_SUCCESS;
973	}
974	#ifdef IN_GC
975	}
976	}
977	#endif
978	return VERR_EM_INTERPRETER;
979	}
980
981
982	/**
983	* ADC Emulation.
984	*/
985	static int emInterpretAdc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
986	{
987	if (pRegFrame->eflags.Bits.u1CF)
988	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
989	else
990	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
991	}
992
993
994	/**
995	* BTR/C/S Emulation.
996	*/
997	static int emInterpretBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
998	PFNEMULATEPARAM2UINT32 pfnEmulate)
999	{
1000	OP_PARAMVAL param1, param2;
1001	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1002	if(VBOX_FAILURE(rc))
1003	return VERR_EM_INTERPRETER;
1004
1005	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1006	if(VBOX_FAILURE(rc))
1007	return VERR_EM_INTERPRETER;
1008
1009	#ifdef IN_GC
1010	if (TRPMHasTrap(pVM))
1011	{
1012	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1013	{
1014	#endif
1015	RTGCPTR pParam1;
1016	uint64_t valpar1 = 0, valpar2;
1017	uint32_t eflags;
1018
1019	/* The destination is always a virtual address */
1020	if (param1.type != PARMTYPE_ADDRESS)
1021	return VERR_EM_INTERPRETER;
1022
1023	pParam1 = (RTGCPTR)param1.val.val64;
1024	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
1025
1026	/* Register or immediate data */
1027	switch(param2.type)
1028	{
1029	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1030	valpar2 = param2.val.val64;
1031	break;
1032
1033	default:
1034	AssertFailed();
1035	return VERR_EM_INTERPRETER;
1036	}
1037
1038	Log2(("emInterpret%s: pvFault=%VGv pParam1=%VGv val2=%x\n", emGetMnemonic(pCpu), pvFault, pParam1, valpar2));
1039	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1040	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1041	rc = emRamRead(pVM, &valpar1, pParam1, 1);
1042	if (VBOX_FAILURE(rc))
1043	{
1044	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
1045	return VERR_EM_INTERPRETER;
1046	}
1047
1048	Log2(("emInterpretBtx: val=%x\n", valpar1));
1049	/* Data read, emulate bit test instruction. */
1050	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1051
1052	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1053
1054	/* Update guest's eflags and finish. */
1055	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1056	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1057
1058	/* And write it back */
1059	rc = emRamWrite(pVM, pParam1, &valpar1, 1);
1060	if (VBOX_SUCCESS(rc))
1061	{
1062	/* All done! */
1063	*pcbSize = 1;
1064	return VINF_SUCCESS;
1065	}
1066	#ifdef IN_GC
1067	}
1068	}
1069	#endif
1070	return VERR_EM_INTERPRETER;
1071	}
1072
1073
1074	/**
1075	* LOCK BTR/C/S Emulation.
1076	*/
1077	static int emInterpretLockBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1078	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1079	{
1080	void *pvParam1;
1081
1082	OP_PARAMVAL param1, param2;
1083	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1084	if(VBOX_FAILURE(rc))
1085	return VERR_EM_INTERPRETER;
1086
1087	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1088	if(VBOX_FAILURE(rc))
1089	return VERR_EM_INTERPRETER;
1090
1091	/* The destination is always a virtual address */
1092	if (param1.type != PARMTYPE_ADDRESS)
1093	return VERR_EM_INTERPRETER;
1094
1095	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1096	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1097	uint64_t ValPar2 = param2.val.val64;
1098
1099	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1100	RTGCPTR GCPtrPar1 = param1.val.val64;
1101	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1102	ValPar2 &= 7;
1103
1104	#ifdef IN_GC
1105	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1106	pvParam1 = (void *)GCPtrPar1;
1107	#else
1108	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1109	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
1110	if (VBOX_FAILURE(rc))
1111	{
1112	AssertRC(rc);
1113	return VERR_EM_INTERPRETER;
1114	}
1115	#endif
1116
1117	Log2(("emInterpretLockBitTest %s: pvFault=%VGv GCPtrPar1=%VGv imm=%RX64\n", emGetMnemonic(pCpu), pvFault, GCPtrPar1, ValPar2));
1118
1119	#ifdef IN_GC
1120	Assert(TRPMHasTrap(pVM));
1121	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1122	#endif
1123
1124	/* Try emulate it with a one-shot #PF handler in place. */
1125	RTGCUINTREG32 eflags = 0;
1126	#ifdef IN_GC
1127	MMGCRamRegisterTrapHandler(pVM);
1128	#endif
1129	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1130	#ifdef IN_GC
1131	MMGCRamDeregisterTrapHandler(pVM);
1132	#endif
1133	if (RT_FAILURE(rc))
1134	{
1135	Log(("emInterpretLockBitTest %s: %VGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1136	emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
1137	return VERR_EM_INTERPRETER;
1138	}
1139
1140	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%VGv imm=%VX64 CF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1141
1142	/* Update guest's eflags and finish. */
1143	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1144	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1145
1146	*pcbSize = 1;
1147	return VINF_SUCCESS;
1148	}
1149
1150
1151	/**
1152	* MOV emulation.
1153	*/
1154	static int emInterpretMov(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1155	{
1156	OP_PARAMVAL param1, param2;
1157	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1158	if(VBOX_FAILURE(rc))
1159	return VERR_EM_INTERPRETER;
1160
1161	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1162	if(VBOX_FAILURE(rc))
1163	return VERR_EM_INTERPRETER;
1164
1165	#ifdef IN_GC
1166	if (TRPMHasTrap(pVM))
1167	{
1168	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1169	{
1170	#else
1171	/** @todo Make this the default and don't rely on TRPM information. */
1172	if (param1.type == PARMTYPE_ADDRESS)
1173	{
1174	#endif
1175	RTGCPTR pDest;
1176	uint64_t val64;
1177
1178	switch(param1.type)
1179	{
1180	case PARMTYPE_IMMEDIATE:
1181	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1182	return VERR_EM_INTERPRETER;
1183	/* fallthru */
1184
1185	case PARMTYPE_ADDRESS:
1186	pDest = (RTGCPTR)param1.val.val64;
1187	pDest = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pDest);
1188	break;
1189
1190	default:
1191	AssertFailed();
1192	return VERR_EM_INTERPRETER;
1193	}
1194
1195	switch(param2.type)
1196	{
1197	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1198	val64 = param2.val.val64;
1199	break;
1200
1201	default:
1202	Log(("emInterpretMov: unexpected type=%d eip=%VGv\n", param2.type, pRegFrame->rip));
1203	return VERR_EM_INTERPRETER;
1204	}
1205	#ifdef LOG_ENABLED
1206	if (pCpu->mode == CPUMODE_64BIT)
1207	LogFlow(("EMInterpretInstruction at %VGv: OP_MOV %VGv <- %RX64 (%d) &val32=%VHv\n", pRegFrame->rip, pDest, val64, param2.size, &val64));
1208	else
1209	LogFlow(("EMInterpretInstruction at %VGv: OP_MOV %VGv <- %08X (%d) &val32=%VHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1210	#endif
1211
1212	Assert(param2.size <= 8 && param2.size > 0);
1213	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1214	rc = emRamWrite(pVM, pDest, &val64, param2.size);
1215	if (VBOX_FAILURE(rc))
1216	return VERR_EM_INTERPRETER;
1217
1218	*pcbSize = param2.size;
1219	}
1220	else
1221	{ /* read fault */
1222	RTGCPTR pSrc;
1223	uint64_t val64;
1224
1225	/* Source */
1226	switch(param2.type)
1227	{
1228	case PARMTYPE_IMMEDIATE:
1229	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1230	return VERR_EM_INTERPRETER;
1231	/* fallthru */
1232
1233	case PARMTYPE_ADDRESS:
1234	pSrc = (RTGCPTR)param2.val.val64;
1235	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pSrc);
1236	break;
1237
1238	default:
1239	return VERR_EM_INTERPRETER;
1240	}
1241
1242	Assert(param1.size <= 8 && param1.size > 0);
1243	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1244	rc = emRamRead(pVM, &val64, pSrc, param1.size);
1245	if (VBOX_FAILURE(rc))
1246	return VERR_EM_INTERPRETER;
1247
1248	/* Destination */
1249	switch(param1.type)
1250	{
1251	case PARMTYPE_REGISTER:
1252	switch(param1.size)
1253	{
1254	case 1: rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t) val64); break;
1255	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)val64); break;
1256	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)val64); break;
1257	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, val64); break;
1258	default:
1259	return VERR_EM_INTERPRETER;
1260	}
1261	if (VBOX_FAILURE(rc))
1262	return rc;
1263	break;
1264
1265	default:
1266	return VERR_EM_INTERPRETER;
1267	}
1268	#ifdef LOG_ENABLED
1269	if (pCpu->mode == CPUMODE_64BIT)
1270	LogFlow(("EMInterpretInstruction: OP_MOV %VGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1271	else
1272	LogFlow(("EMInterpretInstruction: OP_MOV %VGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1273	#endif
1274	}
1275	return VINF_SUCCESS;
1276	#ifdef IN_GC
1277	}
1278	#endif
1279	return VERR_EM_INTERPRETER;
1280	}
1281
1282
1283	#ifndef IN_GC
1284	/*
1285	* [REP] STOSWD emulation
1286	*
1287	*/
1288	static int emInterpretStosWD(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1289	{
1290	int rc;
1291	RTGCPTR GCDest, GCOffset;
1292	uint32_t cbSize;
1293	uint64_t cTransfers;
1294	int offIncrement;
1295
1296	/* Don't support any but these three prefix bytes. */
1297	if ((pCpu->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1298	return VERR_EM_INTERPRETER;
1299
1300	switch (pCpu->addrmode)
1301	{
1302	case CPUMODE_16BIT:
1303	GCOffset = pRegFrame->di;
1304	cTransfers = pRegFrame->cx;
1305	break;
1306	case CPUMODE_32BIT:
1307	GCOffset = pRegFrame->edi;
1308	cTransfers = pRegFrame->ecx;
1309	break;
1310	case CPUMODE_64BIT:
1311	GCOffset = pRegFrame->rdi;
1312	cTransfers = pRegFrame->rcx;
1313	break;
1314	default:
1315	AssertFailed();
1316	return VERR_EM_INTERPRETER;
1317	}
1318
1319	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1320	switch (pCpu->opmode)
1321	{
1322	case CPUMODE_16BIT:
1323	cbSize = 2;
1324	break;
1325	case CPUMODE_32BIT:
1326	cbSize = 4;
1327	break;
1328	case CPUMODE_64BIT:
1329	cbSize = 8;
1330	break;
1331	default:
1332	AssertFailed();
1333	return VERR_EM_INTERPRETER;
1334	}
1335
1336	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1337
1338	if (!(pCpu->prefix & PREFIX_REP))
1339	{
1340	LogFlow(("emInterpretStosWD dest=%04X:%VGv (%VGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1341
1342	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1343	if (VBOX_FAILURE(rc))
1344	return VERR_EM_INTERPRETER;
1345	Assert(rc == VINF_SUCCESS);
1346
1347	/* Update (e/r)di. */
1348	switch (pCpu->addrmode)
1349	{
1350	case CPUMODE_16BIT:
1351	pRegFrame->di += offIncrement;
1352	break;
1353	case CPUMODE_32BIT:
1354	pRegFrame->edi += offIncrement;
1355	break;
1356	case CPUMODE_64BIT:
1357	pRegFrame->rdi += offIncrement;
1358	break;
1359	default:
1360	AssertFailed();
1361	return VERR_EM_INTERPRETER;
1362	}
1363
1364	}
1365	else
1366	{
1367	if (!cTransfers)
1368	return VINF_SUCCESS;
1369
1370	LogFlow(("emInterpretStosWD dest=%04X:%VGv (%VGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1371
1372	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1373	rc = PGMVerifyAccess(pVM, GCDest - (offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize), cTransfers * cbSize, X86_PTE_RW \| X86_PTE_US);
1374	if (rc != VINF_SUCCESS)
1375	{
1376	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1377	return VERR_EM_INTERPRETER;
1378	}
1379
1380	/* REP case */
1381	while (cTransfers)
1382	{
1383	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1384	if (VBOX_FAILURE(rc))
1385	{
1386	rc = VERR_EM_INTERPRETER;
1387	break;
1388	}
1389
1390	Assert(rc == VINF_SUCCESS);
1391	GCOffset += offIncrement;
1392	GCDest += offIncrement;
1393	cTransfers--;
1394	}
1395
1396	/* Update the registers. */
1397	switch (pCpu->addrmode)
1398	{
1399	case CPUMODE_16BIT:
1400	pRegFrame->di = GCOffset;
1401	pRegFrame->cx = cTransfers;
1402	break;
1403	case CPUMODE_32BIT:
1404	pRegFrame->edi = GCOffset;
1405	pRegFrame->ecx = cTransfers;
1406	break;
1407	case CPUMODE_64BIT:
1408	pRegFrame->rdi = GCOffset;
1409	pRegFrame->rcx = cTransfers;
1410	break;
1411	default:
1412	AssertFailed();
1413	return VERR_EM_INTERPRETER;
1414	}
1415	}
1416
1417	*pcbSize = cbSize;
1418	return rc;
1419	}
1420	#endif
1421
1422
1423	/**
1424	* [LOCK] CMPXCHG emulation.
1425	*/
1426	#ifndef IN_GC
1427	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1428	{
1429	OP_PARAMVAL param1, param2;
1430
1431	/* Source to make DISQueryParamVal read the register value - ugly hack */
1432	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1433	if(VBOX_FAILURE(rc))
1434	return VERR_EM_INTERPRETER;
1435
1436	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1437	if(VBOX_FAILURE(rc))
1438	return VERR_EM_INTERPRETER;
1439
1440	RTGCPTR GCPtrPar1;
1441	void *pvParam1;
1442	uint64_t valpar, eflags;
1443
1444	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1445	switch(param1.type)
1446	{
1447	case PARMTYPE_ADDRESS:
1448	GCPtrPar1 = param1.val.val64;
1449	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1450
1451	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
1452	if (VBOX_FAILURE(rc))
1453	{
1454	AssertRC(rc);
1455	return VERR_EM_INTERPRETER;
1456	}
1457	break;
1458
1459	default:
1460	return VERR_EM_INTERPRETER;
1461	}
1462
1463	switch(param2.type)
1464	{
1465	case PARMTYPE_IMMEDIATE: /* register actually */
1466	valpar = param2.val.val64;
1467	break;
1468
1469	default:
1470	return VERR_EM_INTERPRETER;
1471	}
1472
1473	LogFlow(("%s %VGv rax=%RX64 %RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar));
1474
1475	if (pCpu->prefix & PREFIX_LOCK)
1476	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1477	else
1478	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1479
1480	LogFlow(("%s %VGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1481
1482	/* Update guest's eflags and finish. */
1483	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1484	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1485
1486	*pcbSize = param2.size;
1487	return VINF_SUCCESS;
1488	}
1489
1490	#else /* IN_GC */
1491	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1492	{
1493	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1494	OP_PARAMVAL param1, param2;
1495
1496	/* Source to make DISQueryParamVal read the register value - ugly hack */
1497	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1498	if(VBOX_FAILURE(rc))
1499	return VERR_EM_INTERPRETER;
1500
1501	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1502	if(VBOX_FAILURE(rc))
1503	return VERR_EM_INTERPRETER;
1504
1505	if (TRPMHasTrap(pVM))
1506	{
1507	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1508	{
1509	RTRCPTR pParam1;
1510	uint32_t valpar, eflags;
1511
1512	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1513	switch(param1.type)
1514	{
1515	case PARMTYPE_ADDRESS:
1516	pParam1 = (RTRCPTR)param1.val.val64;
1517	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1518	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1519	break;
1520
1521	default:
1522	return VERR_EM_INTERPRETER;
1523	}
1524
1525	switch(param2.type)
1526	{
1527	case PARMTYPE_IMMEDIATE: /* register actually */
1528	valpar = param2.val.val32;
1529	break;
1530
1531	default:
1532	return VERR_EM_INTERPRETER;
1533	}
1534
1535	LogFlow(("%s %VRv eax=%08x %08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1536
1537	MMGCRamRegisterTrapHandler(pVM);
1538	if (pCpu->prefix & PREFIX_LOCK)
1539	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1540	else
1541	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1542	MMGCRamDeregisterTrapHandler(pVM);
1543
1544	if (VBOX_FAILURE(rc))
1545	{
1546	Log(("%s %VGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1547	return VERR_EM_INTERPRETER;
1548	}
1549
1550	LogFlow(("%s %VRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1551
1552	/* Update guest's eflags and finish. */
1553	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1554	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1555
1556	*pcbSize = param2.size;
1557	return VINF_SUCCESS;
1558	}
1559	}
1560	return VERR_EM_INTERPRETER;
1561	}
1562
1563	/*
1564	* [LOCK] CMPXCHG8B emulation.
1565	*/
1566	static int emInterpretCmpXchg8b(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1567	{
1568	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1569	OP_PARAMVAL param1;
1570
1571	/* Source to make DISQueryParamVal read the register value - ugly hack */
1572	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1573	if(VBOX_FAILURE(rc))
1574	return VERR_EM_INTERPRETER;
1575
1576	if (TRPMHasTrap(pVM))
1577	{
1578	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1579	{
1580	RTRCPTR pParam1;
1581	uint32_t eflags;
1582
1583	AssertReturn(pCpu->param1.size == 8, VERR_EM_INTERPRETER);
1584	switch(param1.type)
1585	{
1586	case PARMTYPE_ADDRESS:
1587	pParam1 = (RTRCPTR)param1.val.val64;
1588	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1589	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1590	break;
1591
1592	default:
1593	return VERR_EM_INTERPRETER;
1594	}
1595
1596	LogFlow(("%s %VRv=%08x eax=%08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1597
1598	MMGCRamRegisterTrapHandler(pVM);
1599	if (pCpu->prefix & PREFIX_LOCK)
1600	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1601	else
1602	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1603	MMGCRamDeregisterTrapHandler(pVM);
1604
1605	if (VBOX_FAILURE(rc))
1606	{
1607	Log(("%s %VGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1608	return VERR_EM_INTERPRETER;
1609	}
1610
1611	LogFlow(("%s %VGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1612
1613	/* Update guest's eflags and finish; note that only ZF is affected. */
1614	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1615	\| (eflags & (X86_EFL_ZF));
1616
1617	*pcbSize = 8;
1618	return VINF_SUCCESS;
1619	}
1620	}
1621	return VERR_EM_INTERPRETER;
1622	}
1623	#endif /* IN_GC */
1624
1625
1626	/**
1627	* [LOCK] XADD emulation.
1628	*/
1629	#ifdef IN_GC
1630	static int emInterpretXAdd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1631	{
1632	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1633	OP_PARAMVAL param1;
1634	uint32_t *pParamReg2;
1635	size_t cbSizeParamReg2;
1636
1637	/* Source to make DISQueryParamVal read the register value - ugly hack */
1638	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1639	if(VBOX_FAILURE(rc))
1640	return VERR_EM_INTERPRETER;
1641
1642	rc = DISQueryParamRegPtr(pRegFrame, pCpu, &pCpu->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1643	Assert(cbSizeParamReg2 <= 4);
1644	if(VBOX_FAILURE(rc))
1645	return VERR_EM_INTERPRETER;
1646
1647	if (TRPMHasTrap(pVM))
1648	{
1649	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1650	{
1651	RTRCPTR pParam1;
1652	uint32_t eflags;
1653
1654	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1655	switch(param1.type)
1656	{
1657	case PARMTYPE_ADDRESS:
1658	pParam1 = (RTRCPTR)param1.val.val64;
1659	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1660	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1661	break;
1662
1663	default:
1664	return VERR_EM_INTERPRETER;
1665	}
1666
1667	LogFlow(("XAdd %VRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1668
1669	MMGCRamRegisterTrapHandler(pVM);
1670	if (pCpu->prefix & PREFIX_LOCK)
1671	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1672	else
1673	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1674	MMGCRamDeregisterTrapHandler(pVM);
1675
1676	if (VBOX_FAILURE(rc))
1677	{
1678	Log(("XAdd %VGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1679	return VERR_EM_INTERPRETER;
1680	}
1681
1682	LogFlow(("XAdd %VGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1683
1684	/* Update guest's eflags and finish. */
1685	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1686	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1687
1688	*pcbSize = cbSizeParamReg2;
1689	return VINF_SUCCESS;
1690	}
1691	}
1692	return VERR_EM_INTERPRETER;
1693	}
1694	#endif /* IN_GC */
1695
1696
1697	#ifdef IN_GC
1698	/**
1699	* Interpret IRET (currently only to V86 code)
1700	*
1701	* @returns VBox status code.
1702	* @param pVM The VM handle.
1703	* @param pRegFrame The register frame.
1704	*
1705	*/
1706	VMMDECL(int) EMInterpretIret(PVM pVM, PCPUMCTXCORE pRegFrame)
1707	{
1708	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1709	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1710	int rc;
1711
1712	Assert(!CPUMIsGuestIn64BitCode(pVM, pRegFrame));
1713
1714	rc = emRamRead(pVM, &eip, (RTGCPTR)pIretStack , 4);
1715	rc \|= emRamRead(pVM, &cs, (RTGCPTR)(pIretStack + 4), 4);
1716	rc \|= emRamRead(pVM, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1717	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1718	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1719
1720	rc \|= emRamRead(pVM, &esp, (RTGCPTR)(pIretStack + 12), 4);
1721	rc \|= emRamRead(pVM, &ss, (RTGCPTR)(pIretStack + 16), 4);
1722	rc \|= emRamRead(pVM, &es, (RTGCPTR)(pIretStack + 20), 4);
1723	rc \|= emRamRead(pVM, &ds, (RTGCPTR)(pIretStack + 24), 4);
1724	rc \|= emRamRead(pVM, &fs, (RTGCPTR)(pIretStack + 28), 4);
1725	rc \|= emRamRead(pVM, &gs, (RTGCPTR)(pIretStack + 32), 4);
1726	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1727
1728	pRegFrame->eip = eip & 0xffff;
1729	pRegFrame->cs = cs;
1730
1731	/* Mask away all reserved bits */
1732	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1733	eflags &= uMask;
1734
1735	#ifndef IN_RING0
1736	CPUMRawSetEFlags(pVM, pRegFrame, eflags);
1737	#endif
1738	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1739
1740	pRegFrame->esp = esp;
1741	pRegFrame->ss = ss;
1742	pRegFrame->ds = ds;
1743	pRegFrame->es = es;
1744	pRegFrame->fs = fs;
1745	pRegFrame->gs = gs;
1746
1747	return VINF_SUCCESS;
1748	}
1749	#endif /* IN_GC */
1750
1751
1752	/**
1753	* IRET Emulation.
1754	*/
1755	static int emInterpretIret(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1756	{
1757	/* only allow direct calls to EMInterpretIret for now */
1758	return VERR_EM_INTERPRETER;
1759	}
1760
1761
1762	/**
1763	* Interpret INVLPG
1764	*
1765	* @returns VBox status code.
1766	* @param pVM The VM handle.
1767	* @param pRegFrame The register frame.
1768	* @param pAddrGC Operand address
1769	*
1770	*/
1771	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1772	{
1773	int rc;
1774
1775	/** @todo is addr always a flat linear address or ds based
1776	* (in absence of segment override prefixes)????
1777	*/
1778	#ifdef IN_GC
1779	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1780	LogFlow(("GC: EMULATE: invlpg %08X\n", pAddrGC));
1781	rc = PGMGCInvalidatePage(pVM, pAddrGC);
1782	#else
1783	rc = PGMInvalidatePage(pVM, pAddrGC);
1784	#endif
1785	if (VBOX_SUCCESS(rc))
1786	return VINF_SUCCESS;
1787	Log(("PGMInvalidatePage %VGv returned %VGv (%d)\n", pAddrGC, rc, rc));
1788	Assert(rc == VERR_REM_FLUSHED_PAGES_OVERFLOW);
1789	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1790	return VERR_EM_INTERPRETER;
1791	}
1792
1793
1794	/**
1795	* INVLPG Emulation.
1796	*/
1797	static int emInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1798	{
1799	OP_PARAMVAL param1;
1800	RTGCPTR addr;
1801
1802	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1803	if(VBOX_FAILURE(rc))
1804	return VERR_EM_INTERPRETER;
1805
1806	switch(param1.type)
1807	{
1808	case PARMTYPE_IMMEDIATE:
1809	case PARMTYPE_ADDRESS:
1810	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1811	return VERR_EM_INTERPRETER;
1812	addr = (RTGCPTR)param1.val.val64;
1813	break;
1814
1815	default:
1816	return VERR_EM_INTERPRETER;
1817	}
1818
1819	/** @todo is addr always a flat linear address or ds based
1820	* (in absence of segment override prefixes)????
1821	*/
1822	#ifdef IN_GC
1823	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1824	LogFlow(("GC: EMULATE: invlpg %08X\n", addr));
1825	rc = PGMGCInvalidatePage(pVM, addr);
1826	#else
1827	rc = PGMInvalidatePage(pVM, addr);
1828	#endif
1829	if (VBOX_SUCCESS(rc))
1830	return VINF_SUCCESS;
1831	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1832	return VERR_EM_INTERPRETER;
1833	}
1834
1835
1836	/**
1837	* Interpret CPUID given the parameters in the CPU context
1838	*
1839	* @returns VBox status code.
1840	* @param pVM The VM handle.
1841	* @param pRegFrame The register frame.
1842	*
1843	*/
1844	VMMDECL(int) EMInterpretCpuId(PVM pVM, PCPUMCTXCORE pRegFrame)
1845	{
1846	uint32_t iLeaf = pRegFrame->eax; NOREF(iLeaf);
1847
1848	/* Note: operates the same in 64 and non-64 bits mode. */
1849	CPUMGetGuestCpuId(pVM, pRegFrame->eax, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1850	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1851	return VINF_SUCCESS;
1852	}
1853
1854
1855	/**
1856	* CPUID Emulation.
1857	*/
1858	static int emInterpretCpuId(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1859	{
1860	int rc = EMInterpretCpuId(pVM, pRegFrame);
1861	return rc;
1862	}
1863
1864
1865	/**
1866	* Interpret CRx read
1867	*
1868	* @returns VBox status code.
1869	* @param pVM The VM handle.
1870	* @param pRegFrame The register frame.
1871	* @param DestRegGen General purpose register index (USE_REG_E**))
1872	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1873	*
1874	*/
1875	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1876	{
1877	int rc;
1878	uint64_t val64;
1879
1880	if (SrcRegCrx == USE_REG_CR8)
1881	{
1882	val64 = 0;
1883	rc = PDMApicGetTPR(pVM, (uint8_t *)&val64, NULL);
1884	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
1885	}
1886	else
1887	{
1888	rc = CPUMGetGuestCRx(pVM, SrcRegCrx, &val64);
1889	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1890	}
1891
1892	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
1893	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1894	else
1895	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1896
1897	if(VBOX_SUCCESS(rc))
1898	{
1899	LogFlow(("MOV_CR: gen32=%d CR=%d val=%VX64\n", DestRegGen, SrcRegCrx, val64));
1900	return VINF_SUCCESS;
1901	}
1902	return VERR_EM_INTERPRETER;
1903	}
1904
1905
1906	/**
1907	* Interpret LMSW
1908	*
1909	* @returns VBox status code.
1910	* @param pVM The VM handle.
1911	* @param u16Data LMSW source data.
1912	*
1913	*/
1914	VMMDECL(int) EMInterpretLMSW(PVM pVM, uint16_t u16Data)
1915	{
1916	uint64_t OldCr0 = CPUMGetGuestCR0(pVM);
1917
1918	/* don't use this path to go into protected mode! */
1919	Assert(OldCr0 & X86_CR0_PE);
1920	if (!(OldCr0 & X86_CR0_PE))
1921	return VERR_EM_INTERPRETER;
1922
1923	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1924	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1925	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1926
1927	return CPUMSetGuestCR0(pVM, NewCr0);
1928	}
1929
1930
1931	/**
1932	* Interpret CLTS
1933	*
1934	* @returns VBox status code.
1935	* @param pVM The VM handle.
1936	*
1937	*/
1938	VMMDECL(int) EMInterpretCLTS(PVM pVM)
1939	{
1940	uint64_t cr0 = CPUMGetGuestCR0(pVM);
1941	if (!(cr0 & X86_CR0_TS))
1942	return VINF_SUCCESS;
1943	return CPUMSetGuestCR0(pVM, cr0 & ~X86_CR0_TS);
1944	}
1945
1946	/**
1947	* CLTS Emulation.
1948	*/
1949	static int emInterpretClts(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1950	{
1951	return EMInterpretCLTS(pVM);
1952	}
1953
1954
1955	/**
1956	* Interpret CRx write
1957	*
1958	* @returns VBox status code.
1959	* @param pVM The VM handle.
1960	* @param pRegFrame The register frame.
1961	* @param DestRegCRx CRx register index (USE_REG_CR*)
1962	* @param SrcRegGen General purpose register index (USE_REG_E**))
1963	*
1964	*/
1965	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
1966	{
1967	uint64_t val;
1968	uint64_t oldval;
1969	uint64_t msrEFER;
1970	int rc;
1971
1972	/** @todo Clean up this mess. */
1973	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
1974	{
1975	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
1976	}
1977	else
1978	{
1979	uint32_t val32;
1980	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1981	val = val32;
1982	}
1983
1984	if (VBOX_SUCCESS(rc))
1985	{
1986	LogFlow(("EMInterpretCRxWrite at %VGv CR%d <- %VX64\n", pRegFrame->rip, DestRegCrx, val));
1987	switch (DestRegCrx)
1988	{
1989	case USE_REG_CR0:
1990	oldval = CPUMGetGuestCR0(pVM);
1991	#ifdef IN_GC
1992	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
1993	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
1994	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
1995	return VERR_EM_INTERPRETER;
1996	#endif
1997	CPUMSetGuestCR0(pVM, val);
1998	val = CPUMGetGuestCR0(pVM);
1999	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2000	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2001	{
2002	/* global flush */
2003	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2004	AssertRCReturn(rc, rc);
2005	}
2006
2007	/* Deal with long mode enabling/disabling. */
2008	msrEFER = CPUMGetGuestEFER(pVM);
2009	if (msrEFER & MSR_K6_EFER_LME)
2010	{
2011	if ( !(oldval & X86_CR0_PG)
2012	&& (val & X86_CR0_PG))
2013	{
2014	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2015	if (pRegFrame->csHid.Attr.n.u1Long)
2016	{
2017	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2018	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2019	}
2020
2021	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2022	if (!(CPUMGetGuestCR4(pVM) & X86_CR4_PAE))
2023	{
2024	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2025	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2026	}
2027	msrEFER \|= MSR_K6_EFER_LMA;
2028	}
2029	else
2030	if ( (oldval & X86_CR0_PG)
2031	&& !(val & X86_CR0_PG))
2032	{
2033	msrEFER &= ~MSR_K6_EFER_LMA;
2034	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2035	}
2036	CPUMSetGuestEFER(pVM, msrEFER);
2037	}
2038	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2039
2040	case USE_REG_CR2:
2041	rc = CPUMSetGuestCR2(pVM, val); AssertRC(rc);
2042	return VINF_SUCCESS;
2043
2044	case USE_REG_CR3:
2045	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2046	rc = CPUMSetGuestCR3(pVM, val); AssertRC(rc);
2047	if (CPUMGetGuestCR0(pVM) & X86_CR0_PG)
2048	{
2049	/* flush */
2050	rc = PGMFlushTLB(pVM, val, !(CPUMGetGuestCR4(pVM) & X86_CR4_PGE));
2051	AssertRCReturn(rc, rc);
2052	}
2053	return VINF_SUCCESS;
2054
2055	case USE_REG_CR4:
2056	oldval = CPUMGetGuestCR4(pVM);
2057	rc = CPUMSetGuestCR4(pVM, val); AssertRC(rc);
2058	val = CPUMGetGuestCR4(pVM);
2059
2060	msrEFER = CPUMGetGuestEFER(pVM);
2061	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2062	if ( (msrEFER & MSR_K6_EFER_LMA)
2063	&& (oldval & X86_CR4_PAE)
2064	&& !(val & X86_CR4_PAE))
2065	{
2066	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2067	}
2068
2069	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2070	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2071	{
2072	/* global flush */
2073	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2074	AssertRCReturn(rc, rc);
2075	}
2076	# ifdef IN_GC
2077	/* Feeling extremely lazy. */
2078	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2079	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2080	{
2081	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2082	VM_FF_SET(pVM, VM_FF_TO_R3);
2083	}
2084	# endif
2085	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2086
2087	case USE_REG_CR8:
2088	return PDMApicSetTPR(pVM, val);
2089
2090	default:
2091	AssertFailed();
2092	case USE_REG_CR1: /* illegal op */
2093	break;
2094	}
2095	}
2096	return VERR_EM_INTERPRETER;
2097	}
2098
2099
2100	/**
2101	* MOV CRx
2102	*/
2103	static int emInterpretMovCRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2104	{
2105	if ((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_CR)
2106	return EMInterpretCRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_ctrl);
2107
2108	if (pCpu->param1.flags == USE_REG_CR && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2109	return EMInterpretCRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_ctrl, pCpu->param2.base.reg_gen);
2110
2111	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2112	return VERR_EM_INTERPRETER;
2113	}
2114
2115
2116	/**
2117	* Interpret DRx write
2118	*
2119	* @returns VBox status code.
2120	* @param pVM The VM handle.
2121	* @param pRegFrame The register frame.
2122	* @param DestRegDRx DRx register index (USE_REG_DR*)
2123	* @param SrcRegGen General purpose register index (USE_REG_E**))
2124	*
2125	*/
2126	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2127	{
2128	uint64_t val;
2129	int rc;
2130
2131	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2132	{
2133	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2134	}
2135	else
2136	{
2137	uint32_t val32;
2138	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2139	val = val32;
2140	}
2141
2142	if (RT_SUCCESS(rc))
2143	{
2144	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2145	rc = CPUMSetGuestDRx(pVM, DestRegDrx, val);
2146	if (RT_SUCCESS(rc))
2147	return rc;
2148	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2149	}
2150	return VERR_EM_INTERPRETER;
2151	}
2152
2153
2154	/**
2155	* Interpret DRx read
2156	*
2157	* @returns VBox status code.
2158	* @param pVM The VM handle.
2159	* @param pRegFrame The register frame.
2160	* @param DestRegGen General purpose register index (USE_REG_E**))
2161	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2162	*
2163	*/
2164	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2165	{
2166	uint64_t val64;
2167
2168	int rc = CPUMGetGuestDRx(pVM, SrcRegDrx, &val64);
2169	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2170	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2171	{
2172	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2173	}
2174	else
2175	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2176
2177	if (VBOX_SUCCESS(rc))
2178	return VINF_SUCCESS;
2179
2180	return VERR_EM_INTERPRETER;
2181	}
2182
2183
2184	/**
2185	* MOV DRx
2186	*/
2187	static int emInterpretMovDRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2188	{
2189	int rc = VERR_EM_INTERPRETER;
2190
2191	if((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_DBG)
2192	{
2193	rc = EMInterpretDRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_dbg);
2194	}
2195	else
2196	if(pCpu->param1.flags == USE_REG_DBG && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2197	{
2198	rc = EMInterpretDRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_dbg, pCpu->param2.base.reg_gen);
2199	}
2200	else
2201	AssertMsgFailed(("Unexpected debug register move\n"));
2202
2203	return rc;
2204	}
2205
2206
2207	/**
2208	* LLDT Emulation.
2209	*/
2210	static int emInterpretLLdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2211	{
2212	OP_PARAMVAL param1;
2213	RTSEL sel;
2214
2215	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2216	if(VBOX_FAILURE(rc))
2217	return VERR_EM_INTERPRETER;
2218
2219	switch(param1.type)
2220	{
2221	case PARMTYPE_ADDRESS:
2222	return VERR_EM_INTERPRETER; //feeling lazy right now
2223
2224	case PARMTYPE_IMMEDIATE:
2225	if(!(param1.flags & PARAM_VAL16))
2226	return VERR_EM_INTERPRETER;
2227	sel = (RTSEL)param1.val.val16;
2228	break;
2229
2230	default:
2231	return VERR_EM_INTERPRETER;
2232	}
2233
2234	if (sel == 0)
2235	{
2236	if (CPUMGetHyperLDTR(pVM) == 0)
2237	{
2238	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2239	return VINF_SUCCESS;
2240	}
2241	}
2242	//still feeling lazy
2243	return VERR_EM_INTERPRETER;
2244	}
2245
2246	#ifdef IN_RING0
2247	/**
2248	* LIDT/LGDT Emulation.
2249	*/
2250	static int emInterpretLIGdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2251	{
2252	OP_PARAMVAL param1;
2253	RTGCPTR pParam1;
2254	X86XDTR32 dtr32;
2255
2256	Log(("Emulate %s at %VGv\n", emGetMnemonic(pCpu), pRegFrame->rip));
2257
2258	/* Only for the VT-x real-mode emulation case. */
2259	if (!CPUMIsGuestInRealMode(pVM))
2260	return VERR_EM_INTERPRETER;
2261
2262	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2263	if(VBOX_FAILURE(rc))
2264	return VERR_EM_INTERPRETER;
2265
2266	switch(param1.type)
2267	{
2268	case PARMTYPE_ADDRESS:
2269	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, param1.val.val16);
2270	break;
2271
2272	default:
2273	return VERR_EM_INTERPRETER;
2274	}
2275
2276	rc = emRamRead(pVM, &dtr32, pParam1, sizeof(dtr32));
2277	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2278
2279	if (!(pCpu->prefix & PREFIX_OPSIZE))
2280	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2281
2282	if (pCpu->pCurInstr->opcode == OP_LIDT)
2283	CPUMSetGuestIDTR(pVM, dtr32.uAddr, dtr32.cb);
2284	else
2285	CPUMSetGuestGDTR(pVM, dtr32.uAddr, dtr32.cb);
2286
2287	return VINF_SUCCESS;
2288	}
2289	#endif
2290
2291
2292	#ifdef IN_GC
2293	/**
2294	* STI Emulation.
2295	*
2296	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2297	*/
2298	static int emInterpretSti(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2299	{
2300	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2301
2302	if(!pGCState)
2303	{
2304	Assert(pGCState);
2305	return VERR_EM_INTERPRETER;
2306	}
2307	pGCState->uVMFlags \|= X86_EFL_IF;
2308
2309	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2310	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2311
2312	pVM->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pCpu->opsize;
2313	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2314
2315	return VINF_SUCCESS;
2316	}
2317	#endif /* IN_GC */
2318
2319
2320	/**
2321	* HLT Emulation.
2322	*/
2323	static int emInterpretHlt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2324	{
2325	return VINF_EM_HALT;
2326	}
2327
2328
2329	/**
2330	* Interpret RDTSC
2331	*
2332	* @returns VBox status code.
2333	* @param pVM The VM handle.
2334	* @param pRegFrame The register frame.
2335	*
2336	*/
2337	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PCPUMCTXCORE pRegFrame)
2338	{
2339	unsigned uCR4 = CPUMGetGuestCR4(pVM);
2340
2341	if (uCR4 & X86_CR4_TSD)
2342	return VERR_EM_INTERPRETER; /* genuine #GP */
2343
2344	uint64_t uTicks = TMCpuTickGet(pVM);
2345
2346	/* Same behaviour in 32 & 64 bits mode */
2347	pRegFrame->eax = uTicks;
2348	pRegFrame->edx = (uTicks >> 32ULL);
2349
2350	return VINF_SUCCESS;
2351	}
2352
2353
2354	/**
2355	* RDTSC Emulation.
2356	*/
2357	static int emInterpretRdtsc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2358	{
2359	return EMInterpretRdtsc(pVM, pRegFrame);
2360	}
2361
2362
2363	/**
2364	* MONITOR Emulation.
2365	*/
2366	static int emInterpretMonitor(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2367	{
2368	uint32_t u32Dummy, u32ExtFeatures, cpl;
2369
2370	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2371	if (pRegFrame->ecx != 0)
2372	return VERR_EM_INTERPRETER; /* illegal value. */
2373
2374	/* Get the current privilege level. */
2375	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2376	if (cpl != 0)
2377	return VERR_EM_INTERPRETER; /* supervisor only */
2378
2379	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2380	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2381	return VERR_EM_INTERPRETER; /* not supported */
2382
2383	return VINF_SUCCESS;
2384	}
2385
2386
2387	/**
2388	* MWAIT Emulation.
2389	*/
2390	static int emInterpretMWait(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2391	{
2392	uint32_t u32Dummy, u32ExtFeatures, cpl;
2393
2394	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2395	if (pRegFrame->ecx != 0)
2396	return VERR_EM_INTERPRETER; /* illegal value. */
2397
2398	/* Get the current privilege level. */
2399	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2400	if (cpl != 0)
2401	return VERR_EM_INTERPRETER; /* supervisor only */
2402
2403	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2404	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2405	return VERR_EM_INTERPRETER; /* not supported */
2406
2407	/** @todo not completely correct */
2408	return VINF_EM_HALT;
2409	}
2410
2411
2412	#ifdef LOG_ENABLED
2413	static const char *emMSRtoString(uint32_t uMsr)
2414	{
2415	switch (uMsr)
2416	{
2417	case MSR_IA32_APICBASE:
2418	return "MSR_IA32_APICBASE";
2419	case MSR_IA32_CR_PAT:
2420	return "MSR_IA32_CR_PAT";
2421	case MSR_IA32_SYSENTER_CS:
2422	return "MSR_IA32_SYSENTER_CS";
2423	case MSR_IA32_SYSENTER_EIP:
2424	return "MSR_IA32_SYSENTER_EIP";
2425	case MSR_IA32_SYSENTER_ESP:
2426	return "MSR_IA32_SYSENTER_ESP";
2427	case MSR_K6_EFER:
2428	return "MSR_K6_EFER";
2429	case MSR_K8_SF_MASK:
2430	return "MSR_K8_SF_MASK";
2431	case MSR_K6_STAR:
2432	return "MSR_K6_STAR";
2433	case MSR_K8_LSTAR:
2434	return "MSR_K8_LSTAR";
2435	case MSR_K8_CSTAR:
2436	return "MSR_K8_CSTAR";
2437	case MSR_K8_FS_BASE:
2438	return "MSR_K8_FS_BASE";
2439	case MSR_K8_GS_BASE:
2440	return "MSR_K8_GS_BASE";
2441	case MSR_K8_KERNEL_GS_BASE:
2442	return "MSR_K8_KERNEL_GS_BASE";
2443	case MSR_IA32_BIOS_SIGN_ID:
2444	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2445	case MSR_IA32_PLATFORM_ID:
2446	return "Unsupported MSR_IA32_PLATFORM_ID";
2447	case MSR_IA32_BIOS_UPDT_TRIG:
2448	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2449	case MSR_IA32_TSC:
2450	return "Unsupported MSR_IA32_TSC";
2451	case MSR_IA32_MTRR_CAP:
2452	return "Unsupported MSR_IA32_MTRR_CAP";
2453	case MSR_IA32_MCP_CAP:
2454	return "Unsupported MSR_IA32_MCP_CAP";
2455	case MSR_IA32_MCP_STATUS:
2456	return "Unsupported MSR_IA32_MCP_STATUS";
2457	case MSR_IA32_MCP_CTRL:
2458	return "Unsupported MSR_IA32_MCP_CTRL";
2459	case MSR_IA32_MTRR_DEF_TYPE:
2460	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2461	case MSR_K7_EVNTSEL0:
2462	return "Unsupported MSR_K7_EVNTSEL0";
2463	case MSR_K7_EVNTSEL1:
2464	return "Unsupported MSR_K7_EVNTSEL1";
2465	case MSR_K7_EVNTSEL2:
2466	return "Unsupported MSR_K7_EVNTSEL2";
2467	case MSR_K7_EVNTSEL3:
2468	return "Unsupported MSR_K7_EVNTSEL3";
2469	case MSR_IA32_MC0_CTL:
2470	return "Unsupported MSR_IA32_MC0_CTL";
2471	case MSR_IA32_MC0_STATUS:
2472	return "Unsupported MSR_IA32_MC0_STATUS";
2473	}
2474	return "Unknown MSR";
2475	}
2476	#endif /* LOG_ENABLED */
2477
2478
2479	/**
2480	* Interpret RDMSR
2481	*
2482	* @returns VBox status code.
2483	* @param pVM The VM handle.
2484	* @param pRegFrame The register frame.
2485	*
2486	*/
2487	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2488	{
2489	uint32_t u32Dummy, u32Features, cpl;
2490	uint64_t val;
2491	CPUMCTX *pCtx;
2492	int rc;
2493
2494	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2495	* That version clears the high dwords of both RDX & RAX */
2496	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2497	AssertRC(rc);
2498
2499	/* Get the current privilege level. */
2500	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2501	if (cpl != 0)
2502	return VERR_EM_INTERPRETER; /* supervisor only */
2503
2504	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2505	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2506	return VERR_EM_INTERPRETER; /* not supported */
2507
2508	switch (pRegFrame->ecx)
2509	{
2510	case MSR_IA32_APICBASE:
2511	rc = PDMApicGetBase(pVM, &val);
2512	AssertRC(rc);
2513	break;
2514
2515	case MSR_IA32_CR_PAT:
2516	val = pCtx->msrPAT;
2517	break;
2518
2519	case MSR_IA32_SYSENTER_CS:
2520	val = pCtx->SysEnter.cs;
2521	break;
2522
2523	case MSR_IA32_SYSENTER_EIP:
2524	val = pCtx->SysEnter.eip;
2525	break;
2526
2527	case MSR_IA32_SYSENTER_ESP:
2528	val = pCtx->SysEnter.esp;
2529	break;
2530
2531	case MSR_K6_EFER:
2532	val = pCtx->msrEFER;
2533	break;
2534
2535	case MSR_K8_SF_MASK:
2536	val = pCtx->msrSFMASK;
2537	break;
2538
2539	case MSR_K6_STAR:
2540	val = pCtx->msrSTAR;
2541	break;
2542
2543	case MSR_K8_LSTAR:
2544	val = pCtx->msrLSTAR;
2545	break;
2546
2547	case MSR_K8_CSTAR:
2548	val = pCtx->msrCSTAR;
2549	break;
2550
2551	case MSR_K8_FS_BASE:
2552	val = pCtx->fsHid.u64Base;
2553	break;
2554
2555	case MSR_K8_GS_BASE:
2556	val = pCtx->gsHid.u64Base;
2557	break;
2558
2559	case MSR_K8_KERNEL_GS_BASE:
2560	val = pCtx->msrKERNELGSBASE;
2561	break;
2562
2563	#if 0 /def IN_RING0 /
2564	case MSR_IA32_PLATFORM_ID:
2565	case MSR_IA32_BIOS_SIGN_ID:
2566	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2567	{
2568	/* Available since the P6 family. VT-x implies that this feature is present. */
2569	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2570	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2571	else
2572	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2573	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2574	break;
2575	}
2576	/* no break */
2577	#endif
2578	default:
2579	/* In X2APIC specification this range is reserved for APIC control. */
2580	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2581	rc = PDMApicReadMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, &val);
2582	else
2583	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2584	val = 0;
2585	break;
2586	}
2587	Log(("EMInterpretRdmsr %s (%x) -> val=%VX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2588	if (rc == VINF_SUCCESS)
2589	{
2590	pRegFrame->eax = (uint32_t) val;
2591	pRegFrame->edx = (uint32_t) (val >> 32ULL);
2592	}
2593	return rc;
2594	}
2595
2596
2597	/**
2598	* RDMSR Emulation.
2599	*/
2600	static int emInterpretRdmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2601	{
2602	/* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2603	Assert(!(pCpu->prefix & PREFIX_REX));
2604	return EMInterpretRdmsr(pVM, pRegFrame);
2605	}
2606
2607
2608	/**
2609	* Interpret WRMSR
2610	*
2611	* @returns VBox status code.
2612	* @param pVM The VM handle.
2613	* @param pRegFrame The register frame.
2614	*/
2615	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2616	{
2617	uint32_t u32Dummy, u32Features, cpl;
2618	uint64_t val;
2619	CPUMCTX *pCtx;
2620	int rc;
2621
2622	/* Note: works the same in 32 and 64 bits modes. */
2623	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2624	AssertRC(rc);
2625
2626	/* Get the current privilege level. */
2627	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2628	if (cpl != 0)
2629	return VERR_EM_INTERPRETER; /* supervisor only */
2630
2631	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2632	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2633	return VERR_EM_INTERPRETER; /* not supported */
2634
2635	val = (uint64_t)pRegFrame->eax \| ((uint64_t)pRegFrame->edx << 32ULL);
2636	Log(("EMInterpretWrmsr %s (%x) val=%VX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2637	switch (pRegFrame->ecx)
2638	{
2639	case MSR_IA32_APICBASE:
2640	rc = PDMApicSetBase(pVM, val);
2641	AssertRC(rc);
2642	break;
2643
2644	case MSR_IA32_CR_PAT:
2645	pCtx->msrPAT = val;
2646	break;
2647
2648	case MSR_IA32_SYSENTER_CS:
2649	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
2650	break;
2651
2652	case MSR_IA32_SYSENTER_EIP:
2653	pCtx->SysEnter.eip = val;
2654	break;
2655
2656	case MSR_IA32_SYSENTER_ESP:
2657	pCtx->SysEnter.esp = val;
2658	break;
2659
2660	case MSR_K6_EFER:
2661	{
2662	uint64_t uMask = 0;
2663	uint64_t oldval = pCtx->msrEFER;
2664
2665	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
2666	CPUMGetGuestCpuId(pVM, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2667	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
2668	uMask \|= MSR_K6_EFER_NXE;
2669	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
2670	uMask \|= MSR_K6_EFER_LME;
2671	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
2672	uMask \|= MSR_K6_EFER_SCE;
2673	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
2674	uMask \|= MSR_K6_EFER_FFXSR;
2675
2676	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2677	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
2678	&& (pCtx->cr0 & X86_CR0_PG))
2679	{
2680	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
2681	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2682	}
2683
2684	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
2685	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
2686	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
2687
2688	/* AMD64 Achitecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
2689	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
2690	HWACCMFlushTLB(pVM);
2691
2692	break;
2693	}
2694
2695	case MSR_K8_SF_MASK:
2696	pCtx->msrSFMASK = val;
2697	break;
2698
2699	case MSR_K6_STAR:
2700	pCtx->msrSTAR = val;
2701	break;
2702
2703	case MSR_K8_LSTAR:
2704	pCtx->msrLSTAR = val;
2705	break;
2706
2707	case MSR_K8_CSTAR:
2708	pCtx->msrCSTAR = val;
2709	break;
2710
2711	case MSR_K8_FS_BASE:
2712	pCtx->fsHid.u64Base = val;
2713	break;
2714
2715	case MSR_K8_GS_BASE:
2716	pCtx->gsHid.u64Base = val;
2717	break;
2718
2719	case MSR_K8_KERNEL_GS_BASE:
2720	pCtx->msrKERNELGSBASE = val;
2721	break;
2722
2723	default:
2724	/* In X2APIC specification this range is reserved for APIC control. */
2725	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2726	return PDMApicWriteMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, val);
2727
2728	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2729	break;
2730	}
2731	return VINF_SUCCESS;
2732	}
2733
2734
2735	/**
2736	* WRMSR Emulation.
2737	*/
2738	static int emInterpretWrmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2739	{
2740	return EMInterpretWrmsr(pVM, pRegFrame);
2741	}
2742
2743
2744	/**
2745	* Internal worker.
2746	* @copydoc EMInterpretInstructionCPU
2747	*/
2748	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2749	{
2750	Assert(pcbSize);
2751	*pcbSize = 0;
2752
2753	/*
2754	* Only supervisor guest code!!
2755	* And no complicated prefixes.
2756	*/
2757	/* Get the current privilege level. */
2758	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2759	if ( cpl != 0
2760	&& pCpu->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
2761	{
2762	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
2763	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
2764	return VERR_EM_INTERPRETER;
2765	}
2766
2767	#ifdef IN_GC
2768	if ( (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP))
2769	\|\| ( (pCpu->prefix & PREFIX_LOCK)
2770	&& pCpu->pCurInstr->opcode != OP_CMPXCHG
2771	&& pCpu->pCurInstr->opcode != OP_CMPXCHG8B
2772	&& pCpu->pCurInstr->opcode != OP_XADD
2773	&& pCpu->pCurInstr->opcode != OP_OR
2774	&& pCpu->pCurInstr->opcode != OP_BTR
2775	)
2776	)
2777	#else
2778	if ( (pCpu->prefix & PREFIX_REPNE)
2779	\|\| ( (pCpu->prefix & PREFIX_REP)
2780	&& pCpu->pCurInstr->opcode != OP_STOSWD
2781	)
2782	\|\| ( (pCpu->prefix & PREFIX_LOCK)
2783	&& pCpu->pCurInstr->opcode != OP_OR
2784	&& pCpu->pCurInstr->opcode != OP_BTR
2785	)
2786	)
2787	#endif
2788	{
2789	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
2790	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
2791	return VERR_EM_INTERPRETER;
2792	}
2793
2794	int rc;
2795	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
2796	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pCpu)));
2797	#endif
2798	switch (pCpu->pCurInstr->opcode)
2799	{
2800	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2801	case opcode:\
2802	if (pCpu->prefix & PREFIX_LOCK) \
2803	rc = emInterpretLock##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
2804	else \
2805	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2806	if (VBOX_SUCCESS(rc)) \
2807	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2808	else \
2809	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2810	return rc
2811	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
2812	case opcode:\
2813	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2814	if (VBOX_SUCCESS(rc)) \
2815	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2816	else \
2817	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2818	return rc
2819
2820	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
2821	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
2822	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2823	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
2824
2825	#define INTERPRET_CASE(opcode, Instr) \
2826	case opcode:\
2827	rc = emInterpret##Instr(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
2828	if (VBOX_SUCCESS(rc)) \
2829	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2830	else \
2831	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2832	return rc
2833
2834	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
2835	case opcode:\
2836	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
2837	if (VBOX_SUCCESS(rc)) \
2838	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2839	else \
2840	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2841	return rc
2842
2843	#define INTERPRET_STAT_CASE(opcode, Instr) \
2844	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
2845
2846	INTERPRET_CASE(OP_XCHG,Xchg);
2847	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
2848	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
2849	INTERPRET_CASE(OP_POP,Pop);
2850	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
2851	INTERPRET_CASE_EX_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor);
2852	INTERPRET_CASE_EX_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd);
2853	INTERPRET_CASE(OP_MOV,Mov);
2854	#ifndef IN_GC
2855	INTERPRET_CASE(OP_STOSWD,StosWD);
2856	#endif
2857	INTERPRET_CASE(OP_INVLPG,InvlPg);
2858	INTERPRET_CASE(OP_CPUID,CpuId);
2859	INTERPRET_CASE(OP_MOV_CR,MovCRx);
2860	INTERPRET_CASE(OP_MOV_DR,MovDRx);
2861	INTERPRET_CASE(OP_LLDT,LLdt);
2862	#ifdef IN_RING0
2863	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
2864	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
2865	#endif
2866	INTERPRET_CASE(OP_CLTS,Clts);
2867	INTERPRET_CASE(OP_MONITOR, Monitor);
2868	INTERPRET_CASE(OP_MWAIT, MWait);
2869	INTERPRET_CASE(OP_RDMSR, Rdmsr);
2870	INTERPRET_CASE(OP_WRMSR, Wrmsr);
2871	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
2872	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
2873	INTERPRET_CASE(OP_ADC,Adc);
2874	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
2875	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
2876	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
2877	INTERPRET_CASE(OP_RDTSC,Rdtsc);
2878	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
2879	#ifdef IN_GC
2880	INTERPRET_CASE(OP_STI,Sti);
2881	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
2882	INTERPRET_CASE(OP_XADD, XAdd);
2883	#endif
2884	INTERPRET_CASE(OP_HLT,Hlt);
2885	INTERPRET_CASE(OP_IRET,Iret);
2886	#ifdef VBOX_WITH_STATISTICS
2887	#ifndef IN_GC
2888	INTERPRET_STAT_CASE(OP_CMPXCHG8B, CmpXchg8b);
2889	INTERPRET_STAT_CASE(OP_XADD, XAdd);
2890	#endif
2891	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
2892	INTERPRET_STAT_CASE(OP_WBINVD,WbInvd);
2893	#endif
2894	default:
2895	Log3(("emInterpretInstructionCPU: opcode=%d\n", pCpu->pCurInstr->opcode));
2896	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
2897	return VERR_EM_INTERPRETER;
2898	#undef INTERPRET_CASE_EX_PARAM2
2899	#undef INTERPRET_STAT_CASE
2900	#undef INTERPRET_CASE_EX
2901	#undef INTERPRET_CASE
2902	}
2903	AssertFailed();
2904	return VERR_INTERNAL_ERROR;
2905	}
2906
2907
2908	/**
2909	* Sets the PC for which interrupts should be inhibited.
2910	*
2911	* @param pVM The VM handle.
2912	* @param PC The PC.
2913	*/
2914	VMMDECL(void) EMSetInhibitInterruptsPC(PVM pVM, RTGCUINTPTR PC)
2915	{
2916	pVM->em.s.GCPtrInhibitInterrupts = PC;
2917	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2918	}
2919
2920
2921	/**
2922	* Gets the PC for which interrupts should be inhibited.
2923	*
2924	* There are a few instructions which inhibits or delays interrupts
2925	* for the instruction following them. These instructions are:
2926	* - STI
2927	* - MOV SS, r/m16
2928	* - POP SS
2929	*
2930	* @returns The PC for which interrupts should be inhibited.
2931	* @param pVM VM handle.
2932	*
2933	*/
2934	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVM pVM)
2935	{
2936	return pVM->em.s.GCPtrInhibitInterrupts;
2937	}
2938

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 13152

Download in other formats: