EMAll.cpp@ 13267

Last change on this file since 13267 was 13267, checked in by vboxsync, 16 years ago
lmsw: corrected exit path
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 97.7 KB

Line
1	/* $Id: EMAll.cpp 13267 2008-10-14 14:46:07Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_EM
26	#include <VBox/em.h>
27	#include <VBox/mm.h>
28	#include <VBox/selm.h>
29	#include <VBox/patm.h>
30	#include <VBox/csam.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/stam.h>
34	#include "EMInternal.h"
35	#include <VBox/vm.h>
36	#include <VBox/vmm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Defined Constants And Macros *
53	*******************************************************************************/
54	/** @def EM_ASSERT_FAULT_RETURN
55	* Safety check.
56	*
57	* Could in theory it misfire on a cross page boundary access...
58	*
59	* Currently disabled because the CSAM (+ PATM) patch monitoring occationally
60	* turns up an alias page instead of the original faulting one and annoying the
61	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
62	*/
63	#if 0
64	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
65	#else
66	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
67	#endif
68
69
70	/*******************************************************************************
71	* Internal Functions *
72	*******************************************************************************/
73	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
74
75
76
77	/**
78	* Get the current execution manager status.
79	*
80	* @returns Current status.
81	*/
82	VMMDECL(EMSTATE) EMGetState(PVM pVM)
83	{
84	return pVM->em.s.enmState;
85	}
86
87
88	/**
89	* Flushes the REM translation blocks the next time we execute code there.
90	*
91	* @param pVM The VM handle.
92	*
93	* @todo This doesn't belong here, it should go in REMAll.cpp!
94	*/
95	VMMDECL(void) EMFlushREMTBs(PVM pVM)
96	{
97	Log(("EMFlushREMTBs\n"));
98	pVM->em.s.fREMFlushTBs = true;
99	}
100
101	#ifndef IN_GC
102
103	/**
104	* Read callback for disassembly function; supports reading bytes that cross a page boundary
105	*
106	* @returns VBox status code.
107	* @param pSrc GC source pointer
108	* @param pDest HC destination pointer
109	* @param cb Number of bytes to read
110	* @param dwUserdata Callback specific user data (pCpu)
111	*
112	*/
113	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
114	{
115	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
116	PVM pVM = (PVM)pCpu->apvUserData[0];
117	# ifdef IN_RING0
118	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
119	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%VGv cb=%x\n", pSrc, cb));
120	# else /* IN_RING3 */
121	if (!PATMIsPatchGCAddr(pVM, pSrc))
122	{
123	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
124	AssertRC(rc);
125	}
126	else
127	{
128	for (uint32_t i = 0; i < cb; i++)
129	{
130	uint8_t opcode;
131	if (VBOX_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
132	{
133	*(pDest+i) = opcode;
134	}
135	}
136	}
137	# endif /* IN_RING3 */
138	return VINF_SUCCESS;
139	}
140
141	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
142	{
143	return DISCoreOneEx(InstrGC, pCpu->mode, EMReadBytes, pVM, pCpu, pOpsize);
144	}
145
146	#else /* IN_GC */
147
148	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
149	{
150	return DISCoreOne(pCpu, InstrGC, pOpsize);
151	}
152
153	#endif /* IN_GC */
154
155
156	/**
157	* Disassembles one instruction.
158	*
159	* @param pVM The VM handle.
160	* @param pCtxCore The context core (used for both the mode and instruction).
161	* @param pCpu Where to return the parsed instruction info.
162	* @param pcbInstr Where to return the instruction size. (optional)
163	*/
164	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
165	{
166	RTGCPTR GCPtrInstr;
167	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
168	if (VBOX_FAILURE(rc))
169	{
170	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%VGv (cpl=%d) - rc=%Vrc !!\n",
171	pCtxCore->cs, pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
172	return rc;
173	}
174	return EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pCpu, pcbInstr);
175	}
176
177
178	/**
179	* Disassembles one instruction.
180	*
181	* This is used by internally by the interpreter and by trap/access handlers.
182	*
183	* @param pVM The VM handle.
184	* @param GCPtrInstr The flat address of the instruction.
185	* @param pCtxCore The context core (used to determin the cpu mode).
186	* @param pCpu Where to return the parsed instruction info.
187	* @param pcbInstr Where to return the instruction size. (optional)
188	*/
189	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
190	{
191	int rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
192	#ifdef IN_GC
193	NULL, NULL,
194	#else
195	EMReadBytes, pVM,
196	#endif
197	pCpu, pcbInstr);
198	if (VBOX_SUCCESS(rc))
199	return VINF_SUCCESS;
200	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%VGv rc=%Vrc\n", GCPtrInstr, rc));
201	return VERR_INTERNAL_ERROR;
202	}
203
204
205	/**
206	* Interprets the current instruction.
207	*
208	* @returns VBox status code.
209	* @retval VINF_* Scheduling instructions.
210	* @retval VERR_EM_INTERPRETER Something we can't cope with.
211	* @retval VERR_* Fatal errors.
212	*
213	* @param pVM The VM handle.
214	* @param pRegFrame The register frame.
215	* Updates the EIP if an instruction was executed successfully.
216	* @param pvFault The fault address (CR2).
217	* @param pcbSize Size of the write (if applicable).
218	*
219	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
220	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
221	* to worry about e.g. invalid modrm combinations (!)
222	*/
223	VMMDECL(int) EMInterpretInstruction(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
224	{
225	RTGCPTR pbCode;
226
227	LogFlow(("EMInterpretInstruction %VGv fault %VGv\n", pRegFrame->rip, pvFault));
228	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
229	if (VBOX_SUCCESS(rc))
230	{
231	uint32_t cbOp;
232	DISCPUSTATE Cpu;
233	Cpu.mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
234	rc = emDisCoreOne(pVM, &Cpu, (RTGCUINTPTR)pbCode, &cbOp);
235	if (VBOX_SUCCESS(rc))
236	{
237	Assert(cbOp == Cpu.opsize);
238	rc = EMInterpretInstructionCPU(pVM, &Cpu, pRegFrame, pvFault, pcbSize);
239	if (VBOX_SUCCESS(rc))
240	{
241	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
242	}
243	return rc;
244	}
245	}
246	return VERR_EM_INTERPRETER;
247	}
248
249
250	/**
251	* Interprets the current instruction using the supplied DISCPUSTATE structure.
252	*
253	* EIP is NOT updated!
254	*
255	* @returns VBox status code.
256	* @retval VINF_* Scheduling instructions. When these are returned, it
257	* starts to get a bit tricky to know whether code was
258	* executed or not... We'll address this when it becomes a problem.
259	* @retval VERR_EM_INTERPRETER Something we can't cope with.
260	* @retval VERR_* Fatal errors.
261	*
262	* @param pVM The VM handle.
263	* @param pCpu The disassembler cpu state for the instruction to be interpreted.
264	* @param pRegFrame The register frame. EIP is NOT changed!
265	* @param pvFault The fault address (CR2).
266	* @param pcbSize Size of the write (if applicable).
267	*
268	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
269	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
270	* to worry about e.g. invalid modrm combinations (!)
271	*
272	* @todo At this time we do NOT check if the instruction overwrites vital information.
273	* Make sure this can't happen!! (will add some assertions/checks later)
274	*/
275	VMMDECL(int) EMInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
276	{
277	STAM_PROFILE_START(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
278	int rc = emInterpretInstructionCPU(pVM, pCpu, pRegFrame, pvFault, pcbSize);
279	STAM_PROFILE_STOP(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
280	if (VBOX_SUCCESS(rc))
281	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
282	else
283	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
284	return rc;
285	}
286
287
288	/**
289	* Interpret a port I/O instruction.
290	*
291	* @returns VBox status code suitable for scheduling.
292	* @param pVM The VM handle.
293	* @param pCtxCore The context core. This will be updated on successful return.
294	* @param pCpu The instruction to interpret.
295	* @param cbOp The size of the instruction.
296	* @remark This may raise exceptions.
297	*/
298	VMMDECL(int) EMInterpretPortIO(PVM pVM, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, uint32_t cbOp)
299	{
300	/*
301	* Hand it on to IOM.
302	*/
303	#ifdef IN_GC
304	int rc = IOMGCIOPortHandler(pVM, pCtxCore, pCpu);
305	if (IOM_SUCCESS(rc))
306	pCtxCore->rip += cbOp;
307	return rc;
308	#else
309	AssertReleaseMsgFailed(("not implemented\n"));
310	return VERR_NOT_IMPLEMENTED;
311	#endif
312	}
313
314
315	DECLINLINE(int) emRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
316	{
317	#ifdef IN_GC
318	int rc = MMGCRamRead(pVM, pDest, (void *)GCSrc, cb);
319	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
320	return rc;
321	/*
322	* The page pool cache may end up here in some cases because it
323	* flushed one of the shadow mappings used by the trapping
324	* instruction and it either flushed the TLB or the CPU reused it.
325	*/
326	RTGCPHYS GCPhys;
327	rc = PGMPhysGCPtr2GCPhys(pVM, GCSrc, &GCPhys);
328	AssertRCReturn(rc, rc);
329	PGMPhysRead(pVM, GCPhys, pDest, cb);
330	return VINF_SUCCESS;
331	#else
332	return PGMPhysReadGCPtr(pVM, pDest, GCSrc, cb);
333	#endif
334	}
335
336
337	DECLINLINE(int) emRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
338	{
339	#ifdef IN_GC
340	int rc = MMGCRamWrite(pVM, (void *)GCDest, pSrc, cb);
341	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
342	return rc;
343	/*
344	* The page pool cache may end up here in some cases because it
345	* flushed one of the shadow mappings used by the trapping
346	* instruction and it either flushed the TLB or the CPU reused it.
347	* We want to play safe here, verifying that we've got write
348	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
349	*/
350	uint64_t fFlags;
351	RTGCPHYS GCPhys;
352	rc = PGMGstGetPage(pVM, GCDest, &fFlags, &GCPhys);
353	if (RT_FAILURE(rc))
354	return rc;
355	if ( !(fFlags & X86_PTE_RW)
356	&& (CPUMGetGuestCR0(pVM) & X86_CR0_WP))
357	return VERR_ACCESS_DENIED;
358
359	PGMPhysWrite(pVM, GCPhys + ((RTGCUINTPTR)GCDest & PAGE_OFFSET_MASK), pSrc, cb);
360	return VINF_SUCCESS;
361
362	#else
363	return PGMPhysWriteGCPtr(pVM, GCDest, pSrc, cb);
364	#endif
365	}
366
367
368	/* Convert sel:addr to a flat GC address */
369	static RTGCPTR emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, POP_PARAMETER pParam, RTGCPTR pvAddr)
370	{
371	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pCpu, pParam);
372	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
373	}
374
375
376	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
377	/**
378	* Get the mnemonic for the disassembled instruction.
379	*
380	* GC/R0 doesn't include the strings in the DIS tables because
381	* of limited space.
382	*/
383	static const char *emGetMnemonic(PDISCPUSTATE pCpu)
384	{
385	switch (pCpu->pCurInstr->opcode)
386	{
387	case OP_XCHG: return "Xchg";
388	case OP_DEC: return "Dec";
389	case OP_INC: return "Inc";
390	case OP_POP: return "Pop";
391	case OP_OR: return "Or";
392	case OP_AND: return "And";
393	case OP_MOV: return "Mov";
394	case OP_INVLPG: return "InvlPg";
395	case OP_CPUID: return "CpuId";
396	case OP_MOV_CR: return "MovCRx";
397	case OP_MOV_DR: return "MovDRx";
398	case OP_LLDT: return "LLdt";
399	case OP_LGDT: return "LGdt";
400	case OP_LIDT: return "LGdt";
401	case OP_CLTS: return "Clts";
402	case OP_MONITOR: return "Monitor";
403	case OP_MWAIT: return "MWait";
404	case OP_RDMSR: return "Rdmsr";
405	case OP_WRMSR: return "Wrmsr";
406	case OP_ADD: return "Add";
407	case OP_ADC: return "Adc";
408	case OP_SUB: return "Sub";
409	case OP_SBB: return "Sbb";
410	case OP_RDTSC: return "Rdtsc";
411	case OP_STI: return "Sti";
412	case OP_XADD: return "XAdd";
413	case OP_HLT: return "Hlt";
414	case OP_IRET: return "Iret";
415	case OP_MOVNTPS: return "MovNTPS";
416	case OP_STOSWD: return "StosWD";
417	case OP_WBINVD: return "WbInvd";
418	case OP_XOR: return "Xor";
419	case OP_BTR: return "Btr";
420	case OP_BTS: return "Bts";
421	case OP_BTC: return "Btc";
422	case OP_LMSW: return "Lmsw";
423	case OP_CMPXCHG: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
424	case OP_CMPXCHG8B: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
425
426	default:
427	Log(("Unknown opcode %d\n", pCpu->pCurInstr->opcode));
428	return "???";
429	}
430	}
431	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
432
433
434	/**
435	* XCHG instruction emulation.
436	*/
437	static int emInterpretXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
438	{
439	OP_PARAMVAL param1, param2;
440
441	/* Source to make DISQueryParamVal read the register value - ugly hack */
442	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
443	if(VBOX_FAILURE(rc))
444	return VERR_EM_INTERPRETER;
445
446	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
447	if(VBOX_FAILURE(rc))
448	return VERR_EM_INTERPRETER;
449
450	#ifdef IN_GC
451	if (TRPMHasTrap(pVM))
452	{
453	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
454	{
455	#endif
456	RTGCPTR pParam1 = 0, pParam2 = 0;
457	uint64_t valpar1, valpar2;
458
459	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
460	switch(param1.type)
461	{
462	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
463	valpar1 = param1.val.val64;
464	break;
465
466	case PARMTYPE_ADDRESS:
467	pParam1 = (RTGCPTR)param1.val.val64;
468	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
469	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
470	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
471	if (VBOX_FAILURE(rc))
472	{
473	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
474	return VERR_EM_INTERPRETER;
475	}
476	break;
477
478	default:
479	AssertFailed();
480	return VERR_EM_INTERPRETER;
481	}
482
483	switch(param2.type)
484	{
485	case PARMTYPE_ADDRESS:
486	pParam2 = (RTGCPTR)param2.val.val64;
487	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pParam2);
488	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
489	rc = emRamRead(pVM, &valpar2, pParam2, param2.size);
490	if (VBOX_FAILURE(rc))
491	{
492	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
493	}
494	break;
495
496	case PARMTYPE_IMMEDIATE:
497	valpar2 = param2.val.val64;
498	break;
499
500	default:
501	AssertFailed();
502	return VERR_EM_INTERPRETER;
503	}
504
505	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
506	if (pParam1 == 0)
507	{
508	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
509	switch(param1.size)
510	{
511	case 1: //special case for AH etc
512	rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t )valpar2); break;
513	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)valpar2); break;
514	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)valpar2); break;
515	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, valpar2); break;
516	default: AssertFailedReturn(VERR_EM_INTERPRETER);
517	}
518	if (VBOX_FAILURE(rc))
519	return VERR_EM_INTERPRETER;
520	}
521	else
522	{
523	rc = emRamWrite(pVM, pParam1, &valpar2, param1.size);
524	if (VBOX_FAILURE(rc))
525	{
526	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
527	return VERR_EM_INTERPRETER;
528	}
529	}
530
531	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
532	if (pParam2 == 0)
533	{
534	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
535	switch(param2.size)
536	{
537	case 1: //special case for AH etc
538	rc = DISWriteReg8(pRegFrame, pCpu->param2.base.reg_gen, (uint8_t )valpar1); break;
539	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param2.base.reg_gen, (uint16_t)valpar1); break;
540	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param2.base.reg_gen, (uint32_t)valpar1); break;
541	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param2.base.reg_gen, valpar1); break;
542	default: AssertFailedReturn(VERR_EM_INTERPRETER);
543	}
544	if (VBOX_FAILURE(rc))
545	return VERR_EM_INTERPRETER;
546	}
547	else
548	{
549	rc = emRamWrite(pVM, pParam2, &valpar1, param2.size);
550	if (VBOX_FAILURE(rc))
551	{
552	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
553	return VERR_EM_INTERPRETER;
554	}
555	}
556
557	*pcbSize = param2.size;
558	return VINF_SUCCESS;
559	#ifdef IN_GC
560	}
561	}
562	#endif
563	return VERR_EM_INTERPRETER;
564	}
565
566
567	/**
568	* INC and DEC emulation.
569	*/
570	static int emInterpretIncDec(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
571	PFNEMULATEPARAM2 pfnEmulate)
572	{
573	OP_PARAMVAL param1;
574
575	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
576	if(VBOX_FAILURE(rc))
577	return VERR_EM_INTERPRETER;
578
579	#ifdef IN_GC
580	if (TRPMHasTrap(pVM))
581	{
582	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
583	{
584	#endif
585	RTGCPTR pParam1 = 0;
586	uint64_t valpar1;
587
588	if (param1.type == PARMTYPE_ADDRESS)
589	{
590	pParam1 = (RTGCPTR)param1.val.val64;
591	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
592	#ifdef IN_GC
593	/* Safety check (in theory it could cross a page boundary and fault there though) */
594	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
595	#endif
596	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
597	if (VBOX_FAILURE(rc))
598	{
599	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
600	return VERR_EM_INTERPRETER;
601	}
602	}
603	else
604	{
605	AssertFailed();
606	return VERR_EM_INTERPRETER;
607	}
608
609	uint32_t eflags;
610
611	eflags = pfnEmulate(&valpar1, param1.size);
612
613	/* Write result back */
614	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
615	if (VBOX_FAILURE(rc))
616	{
617	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
618	return VERR_EM_INTERPRETER;
619	}
620
621	/* Update guest's eflags and finish. */
622	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
623	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
624
625	/* All done! */
626	*pcbSize = param1.size;
627	return VINF_SUCCESS;
628	#ifdef IN_GC
629	}
630	}
631	#endif
632	return VERR_EM_INTERPRETER;
633	}
634
635
636	/**
637	* POP Emulation.
638	*/
639	static int emInterpretPop(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
640	{
641	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
642	OP_PARAMVAL param1;
643	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
644	if(VBOX_FAILURE(rc))
645	return VERR_EM_INTERPRETER;
646
647	#ifdef IN_GC
648	if (TRPMHasTrap(pVM))
649	{
650	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
651	{
652	#endif
653	RTGCPTR pParam1 = 0;
654	uint32_t valpar1;
655	RTGCPTR pStackVal;
656
657	/* Read stack value first */
658	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
659	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
660
661	/* Convert address; don't bother checking limits etc, as we only read here */
662	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
663	if (pStackVal == 0)
664	return VERR_EM_INTERPRETER;
665
666	rc = emRamRead(pVM, &valpar1, pStackVal, param1.size);
667	if (VBOX_FAILURE(rc))
668	{
669	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
670	return VERR_EM_INTERPRETER;
671	}
672
673	if (param1.type == PARMTYPE_ADDRESS)
674	{
675	pParam1 = (RTGCPTR)param1.val.val64;
676
677	/* pop [esp+xx] uses esp after the actual pop! */
678	AssertCompile(USE_REG_ESP == USE_REG_SP);
679	if ( (pCpu->param1.flags & USE_BASE)
680	&& (pCpu->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
681	&& pCpu->param1.base.reg_gen == USE_REG_ESP
682	)
683	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
684
685	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
686	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
687	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
688	if (VBOX_FAILURE(rc))
689	{
690	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
691	return VERR_EM_INTERPRETER;
692	}
693
694	/* Update ESP as the last step */
695	pRegFrame->esp += param1.size;
696	}
697	else
698	{
699	#ifndef DEBUG_bird // annoying assertion.
700	AssertFailed();
701	#endif
702	return VERR_EM_INTERPRETER;
703	}
704
705	/* All done! */
706	*pcbSize = param1.size;
707	return VINF_SUCCESS;
708	#ifdef IN_GC
709	}
710	}
711	#endif
712	return VERR_EM_INTERPRETER;
713	}
714
715
716	/**
717	* XOR/OR/AND Emulation.
718	*/
719	static int emInterpretOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
720	PFNEMULATEPARAM3 pfnEmulate)
721	{
722	OP_PARAMVAL param1, param2;
723	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
724	if(VBOX_FAILURE(rc))
725	return VERR_EM_INTERPRETER;
726
727	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
728	if(VBOX_FAILURE(rc))
729	return VERR_EM_INTERPRETER;
730
731	#ifdef IN_GC
732	if (TRPMHasTrap(pVM))
733	{
734	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
735	{
736	#endif
737	RTGCPTR pParam1;
738	uint64_t valpar1, valpar2;
739
740	if (pCpu->param1.size != pCpu->param2.size)
741	{
742	if (pCpu->param1.size < pCpu->param2.size)
743	{
744	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
745	return VERR_EM_INTERPRETER;
746	}
747	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
748	pCpu->param2.size = pCpu->param1.size;
749	param2.size = param1.size;
750	}
751
752	/* The destination is always a virtual address */
753	if (param1.type == PARMTYPE_ADDRESS)
754	{
755	pParam1 = (RTGCPTR)param1.val.val64;
756	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
757	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
758	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
759	if (VBOX_FAILURE(rc))
760	{
761	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
762	return VERR_EM_INTERPRETER;
763	}
764	}
765	else
766	{
767	AssertFailed();
768	return VERR_EM_INTERPRETER;
769	}
770
771	/* Register or immediate data */
772	switch(param2.type)
773	{
774	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
775	valpar2 = param2.val.val64;
776	break;
777
778	default:
779	AssertFailed();
780	return VERR_EM_INTERPRETER;
781	}
782
783	LogFlow(("emInterpretOrXorAnd %s %VGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pCpu), pParam1, valpar1, valpar2, param2.size, param1.size));
784
785	/* Data read, emulate instruction. */
786	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
787
788	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pCpu), valpar1));
789
790	/* Update guest's eflags and finish. */
791	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
792	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
793
794	/* And write it back */
795	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
796	if (VBOX_SUCCESS(rc))
797	{
798	/* All done! */
799	*pcbSize = param2.size;
800	return VINF_SUCCESS;
801	}
802	#ifdef IN_GC
803	}
804	}
805	#endif
806	return VERR_EM_INTERPRETER;
807	}
808
809
810	/**
811	* LOCK XOR/OR/AND Emulation.
812	*/
813	static int emInterpretLockOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
814	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
815	{
816	void *pvParam1;
817
818	OP_PARAMVAL param1, param2;
819	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
820	if(VBOX_FAILURE(rc))
821	return VERR_EM_INTERPRETER;
822
823	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
824	if(VBOX_FAILURE(rc))
825	return VERR_EM_INTERPRETER;
826
827	if (pCpu->param1.size != pCpu->param2.size)
828	{
829	AssertMsgReturn(pCpu->param1.size >= pCpu->param2.size, /* should never happen! */
830	("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size),
831	VERR_EM_INTERPRETER);
832
833	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
834	pCpu->param2.size = pCpu->param1.size;
835	param2.size = param1.size;
836	}
837
838	/* The destination is always a virtual address */
839	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
840
841	RTGCPTR GCPtrPar1 = param1.val.val64;
842	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
843	#ifdef IN_GC
844	pvParam1 = (void *)GCPtrPar1;
845	#else
846	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
847	if (VBOX_FAILURE(rc))
848	{
849	AssertRC(rc);
850	return VERR_EM_INTERPRETER;
851	}
852	#endif
853
854	#ifdef IN_GC
855	/* Safety check (in theory it could cross a page boundary and fault there though) */
856	Assert( TRPMHasTrap(pVM)
857	&& (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW));
858	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
859	#endif
860
861	/* Register and immediate data == PARMTYPE_IMMEDIATE */
862	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
863	RTGCUINTREG ValPar2 = param2.val.val64;
864
865	/* Try emulate it with a one-shot #PF handler in place. */
866	Log2(("%s %VGv imm%d=%RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
867
868	RTGCUINTREG32 eflags = 0;
869	#ifdef IN_GC
870	MMGCRamRegisterTrapHandler(pVM);
871	#endif
872	rc = pfnEmulate(pvParam1, ValPar2, pCpu->param2.size, &eflags);
873	#ifdef IN_GC
874	MMGCRamDeregisterTrapHandler(pVM);
875	#endif
876	if (RT_FAILURE(rc))
877	{
878	Log(("%s %VGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
879	return VERR_EM_INTERPRETER;
880	}
881
882	/* Update guest's eflags and finish. */
883	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
884	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
885
886	*pcbSize = param2.size;
887	return VINF_SUCCESS;
888	}
889
890
891	/**
892	* ADD, ADC & SUB Emulation.
893	*/
894	static int emInterpretAddSub(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
895	PFNEMULATEPARAM3 pfnEmulate)
896	{
897	OP_PARAMVAL param1, param2;
898	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
899	if(VBOX_FAILURE(rc))
900	return VERR_EM_INTERPRETER;
901
902	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
903	if(VBOX_FAILURE(rc))
904	return VERR_EM_INTERPRETER;
905
906	#ifdef IN_GC
907	if (TRPMHasTrap(pVM))
908	{
909	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
910	{
911	#endif
912	RTGCPTR pParam1;
913	uint64_t valpar1, valpar2;
914
915	if (pCpu->param1.size != pCpu->param2.size)
916	{
917	if (pCpu->param1.size < pCpu->param2.size)
918	{
919	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
920	return VERR_EM_INTERPRETER;
921	}
922	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
923	pCpu->param2.size = pCpu->param1.size;
924	param2.size = param1.size;
925	}
926
927	/* The destination is always a virtual address */
928	if (param1.type == PARMTYPE_ADDRESS)
929	{
930	pParam1 = (RTGCPTR)param1.val.val64;
931	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
932	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
933	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
934	if (VBOX_FAILURE(rc))
935	{
936	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
937	return VERR_EM_INTERPRETER;
938	}
939	}
940	else
941	{
942	#ifndef DEBUG_bird
943	AssertFailed();
944	#endif
945	return VERR_EM_INTERPRETER;
946	}
947
948	/* Register or immediate data */
949	switch(param2.type)
950	{
951	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
952	valpar2 = param2.val.val64;
953	break;
954
955	default:
956	AssertFailed();
957	return VERR_EM_INTERPRETER;
958	}
959
960	/* Data read, emulate instruction. */
961	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
962
963	/* Update guest's eflags and finish. */
964	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
965	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
966
967	/* And write it back */
968	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
969	if (VBOX_SUCCESS(rc))
970	{
971	/* All done! */
972	*pcbSize = param2.size;
973	return VINF_SUCCESS;
974	}
975	#ifdef IN_GC
976	}
977	}
978	#endif
979	return VERR_EM_INTERPRETER;
980	}
981
982
983	/**
984	* ADC Emulation.
985	*/
986	static int emInterpretAdc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
987	{
988	if (pRegFrame->eflags.Bits.u1CF)
989	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
990	else
991	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
992	}
993
994
995	/**
996	* BTR/C/S Emulation.
997	*/
998	static int emInterpretBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
999	PFNEMULATEPARAM2UINT32 pfnEmulate)
1000	{
1001	OP_PARAMVAL param1, param2;
1002	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1003	if(VBOX_FAILURE(rc))
1004	return VERR_EM_INTERPRETER;
1005
1006	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1007	if(VBOX_FAILURE(rc))
1008	return VERR_EM_INTERPRETER;
1009
1010	#ifdef IN_GC
1011	if (TRPMHasTrap(pVM))
1012	{
1013	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1014	{
1015	#endif
1016	RTGCPTR pParam1;
1017	uint64_t valpar1 = 0, valpar2;
1018	uint32_t eflags;
1019
1020	/* The destination is always a virtual address */
1021	if (param1.type != PARMTYPE_ADDRESS)
1022	return VERR_EM_INTERPRETER;
1023
1024	pParam1 = (RTGCPTR)param1.val.val64;
1025	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
1026
1027	/* Register or immediate data */
1028	switch(param2.type)
1029	{
1030	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1031	valpar2 = param2.val.val64;
1032	break;
1033
1034	default:
1035	AssertFailed();
1036	return VERR_EM_INTERPRETER;
1037	}
1038
1039	Log2(("emInterpret%s: pvFault=%VGv pParam1=%VGv val2=%x\n", emGetMnemonic(pCpu), pvFault, pParam1, valpar2));
1040	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1041	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1042	rc = emRamRead(pVM, &valpar1, pParam1, 1);
1043	if (VBOX_FAILURE(rc))
1044	{
1045	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
1046	return VERR_EM_INTERPRETER;
1047	}
1048
1049	Log2(("emInterpretBtx: val=%x\n", valpar1));
1050	/* Data read, emulate bit test instruction. */
1051	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1052
1053	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1054
1055	/* Update guest's eflags and finish. */
1056	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1057	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1058
1059	/* And write it back */
1060	rc = emRamWrite(pVM, pParam1, &valpar1, 1);
1061	if (VBOX_SUCCESS(rc))
1062	{
1063	/* All done! */
1064	*pcbSize = 1;
1065	return VINF_SUCCESS;
1066	}
1067	#ifdef IN_GC
1068	}
1069	}
1070	#endif
1071	return VERR_EM_INTERPRETER;
1072	}
1073
1074
1075	/**
1076	* LOCK BTR/C/S Emulation.
1077	*/
1078	static int emInterpretLockBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1079	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1080	{
1081	void *pvParam1;
1082
1083	OP_PARAMVAL param1, param2;
1084	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1085	if(VBOX_FAILURE(rc))
1086	return VERR_EM_INTERPRETER;
1087
1088	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1089	if(VBOX_FAILURE(rc))
1090	return VERR_EM_INTERPRETER;
1091
1092	/* The destination is always a virtual address */
1093	if (param1.type != PARMTYPE_ADDRESS)
1094	return VERR_EM_INTERPRETER;
1095
1096	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1097	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1098	uint64_t ValPar2 = param2.val.val64;
1099
1100	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1101	RTGCPTR GCPtrPar1 = param1.val.val64;
1102	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1103	ValPar2 &= 7;
1104
1105	#ifdef IN_GC
1106	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1107	pvParam1 = (void *)GCPtrPar1;
1108	#else
1109	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1110	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
1111	if (VBOX_FAILURE(rc))
1112	{
1113	AssertRC(rc);
1114	return VERR_EM_INTERPRETER;
1115	}
1116	#endif
1117
1118	Log2(("emInterpretLockBitTest %s: pvFault=%VGv GCPtrPar1=%VGv imm=%RX64\n", emGetMnemonic(pCpu), pvFault, GCPtrPar1, ValPar2));
1119
1120	#ifdef IN_GC
1121	Assert(TRPMHasTrap(pVM));
1122	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1123	#endif
1124
1125	/* Try emulate it with a one-shot #PF handler in place. */
1126	RTGCUINTREG32 eflags = 0;
1127	#ifdef IN_GC
1128	MMGCRamRegisterTrapHandler(pVM);
1129	#endif
1130	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1131	#ifdef IN_GC
1132	MMGCRamDeregisterTrapHandler(pVM);
1133	#endif
1134	if (RT_FAILURE(rc))
1135	{
1136	Log(("emInterpretLockBitTest %s: %VGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1137	emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
1138	return VERR_EM_INTERPRETER;
1139	}
1140
1141	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%VGv imm=%VX64 CF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1142
1143	/* Update guest's eflags and finish. */
1144	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1145	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1146
1147	*pcbSize = 1;
1148	return VINF_SUCCESS;
1149	}
1150
1151
1152	/**
1153	* MOV emulation.
1154	*/
1155	static int emInterpretMov(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1156	{
1157	OP_PARAMVAL param1, param2;
1158	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1159	if(VBOX_FAILURE(rc))
1160	return VERR_EM_INTERPRETER;
1161
1162	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1163	if(VBOX_FAILURE(rc))
1164	return VERR_EM_INTERPRETER;
1165
1166	#ifdef IN_GC
1167	if (TRPMHasTrap(pVM))
1168	{
1169	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1170	{
1171	#else
1172	/** @todo Make this the default and don't rely on TRPM information. */
1173	if (param1.type == PARMTYPE_ADDRESS)
1174	{
1175	#endif
1176	RTGCPTR pDest;
1177	uint64_t val64;
1178
1179	switch(param1.type)
1180	{
1181	case PARMTYPE_IMMEDIATE:
1182	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1183	return VERR_EM_INTERPRETER;
1184	/* fallthru */
1185
1186	case PARMTYPE_ADDRESS:
1187	pDest = (RTGCPTR)param1.val.val64;
1188	pDest = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pDest);
1189	break;
1190
1191	default:
1192	AssertFailed();
1193	return VERR_EM_INTERPRETER;
1194	}
1195
1196	switch(param2.type)
1197	{
1198	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1199	val64 = param2.val.val64;
1200	break;
1201
1202	default:
1203	Log(("emInterpretMov: unexpected type=%d eip=%VGv\n", param2.type, pRegFrame->rip));
1204	return VERR_EM_INTERPRETER;
1205	}
1206	#ifdef LOG_ENABLED
1207	if (pCpu->mode == CPUMODE_64BIT)
1208	LogFlow(("EMInterpretInstruction at %VGv: OP_MOV %VGv <- %RX64 (%d) &val32=%VHv\n", pRegFrame->rip, pDest, val64, param2.size, &val64));
1209	else
1210	LogFlow(("EMInterpretInstruction at %VGv: OP_MOV %VGv <- %08X (%d) &val32=%VHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1211	#endif
1212
1213	Assert(param2.size <= 8 && param2.size > 0);
1214	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1215	rc = emRamWrite(pVM, pDest, &val64, param2.size);
1216	if (VBOX_FAILURE(rc))
1217	return VERR_EM_INTERPRETER;
1218
1219	*pcbSize = param2.size;
1220	}
1221	else
1222	{ /* read fault */
1223	RTGCPTR pSrc;
1224	uint64_t val64;
1225
1226	/* Source */
1227	switch(param2.type)
1228	{
1229	case PARMTYPE_IMMEDIATE:
1230	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1231	return VERR_EM_INTERPRETER;
1232	/* fallthru */
1233
1234	case PARMTYPE_ADDRESS:
1235	pSrc = (RTGCPTR)param2.val.val64;
1236	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pSrc);
1237	break;
1238
1239	default:
1240	return VERR_EM_INTERPRETER;
1241	}
1242
1243	Assert(param1.size <= 8 && param1.size > 0);
1244	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1245	rc = emRamRead(pVM, &val64, pSrc, param1.size);
1246	if (VBOX_FAILURE(rc))
1247	return VERR_EM_INTERPRETER;
1248
1249	/* Destination */
1250	switch(param1.type)
1251	{
1252	case PARMTYPE_REGISTER:
1253	switch(param1.size)
1254	{
1255	case 1: rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t) val64); break;
1256	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)val64); break;
1257	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)val64); break;
1258	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, val64); break;
1259	default:
1260	return VERR_EM_INTERPRETER;
1261	}
1262	if (VBOX_FAILURE(rc))
1263	return rc;
1264	break;
1265
1266	default:
1267	return VERR_EM_INTERPRETER;
1268	}
1269	#ifdef LOG_ENABLED
1270	if (pCpu->mode == CPUMODE_64BIT)
1271	LogFlow(("EMInterpretInstruction: OP_MOV %VGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1272	else
1273	LogFlow(("EMInterpretInstruction: OP_MOV %VGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1274	#endif
1275	}
1276	return VINF_SUCCESS;
1277	#ifdef IN_GC
1278	}
1279	#endif
1280	return VERR_EM_INTERPRETER;
1281	}
1282
1283
1284	#ifndef IN_GC
1285	/*
1286	* [REP] STOSWD emulation
1287	*
1288	*/
1289	static int emInterpretStosWD(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1290	{
1291	int rc;
1292	RTGCPTR GCDest, GCOffset;
1293	uint32_t cbSize;
1294	uint64_t cTransfers;
1295	int offIncrement;
1296
1297	/* Don't support any but these three prefix bytes. */
1298	if ((pCpu->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1299	return VERR_EM_INTERPRETER;
1300
1301	switch (pCpu->addrmode)
1302	{
1303	case CPUMODE_16BIT:
1304	GCOffset = pRegFrame->di;
1305	cTransfers = pRegFrame->cx;
1306	break;
1307	case CPUMODE_32BIT:
1308	GCOffset = pRegFrame->edi;
1309	cTransfers = pRegFrame->ecx;
1310	break;
1311	case CPUMODE_64BIT:
1312	GCOffset = pRegFrame->rdi;
1313	cTransfers = pRegFrame->rcx;
1314	break;
1315	default:
1316	AssertFailed();
1317	return VERR_EM_INTERPRETER;
1318	}
1319
1320	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1321	switch (pCpu->opmode)
1322	{
1323	case CPUMODE_16BIT:
1324	cbSize = 2;
1325	break;
1326	case CPUMODE_32BIT:
1327	cbSize = 4;
1328	break;
1329	case CPUMODE_64BIT:
1330	cbSize = 8;
1331	break;
1332	default:
1333	AssertFailed();
1334	return VERR_EM_INTERPRETER;
1335	}
1336
1337	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1338
1339	if (!(pCpu->prefix & PREFIX_REP))
1340	{
1341	LogFlow(("emInterpretStosWD dest=%04X:%VGv (%VGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1342
1343	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1344	if (VBOX_FAILURE(rc))
1345	return VERR_EM_INTERPRETER;
1346	Assert(rc == VINF_SUCCESS);
1347
1348	/* Update (e/r)di. */
1349	switch (pCpu->addrmode)
1350	{
1351	case CPUMODE_16BIT:
1352	pRegFrame->di += offIncrement;
1353	break;
1354	case CPUMODE_32BIT:
1355	pRegFrame->edi += offIncrement;
1356	break;
1357	case CPUMODE_64BIT:
1358	pRegFrame->rdi += offIncrement;
1359	break;
1360	default:
1361	AssertFailed();
1362	return VERR_EM_INTERPRETER;
1363	}
1364
1365	}
1366	else
1367	{
1368	if (!cTransfers)
1369	return VINF_SUCCESS;
1370
1371	LogFlow(("emInterpretStosWD dest=%04X:%VGv (%VGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1372
1373	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1374	rc = PGMVerifyAccess(pVM, GCDest - (offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize), cTransfers * cbSize, X86_PTE_RW \| X86_PTE_US);
1375	if (rc != VINF_SUCCESS)
1376	{
1377	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1378	return VERR_EM_INTERPRETER;
1379	}
1380
1381	/* REP case */
1382	while (cTransfers)
1383	{
1384	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1385	if (VBOX_FAILURE(rc))
1386	{
1387	rc = VERR_EM_INTERPRETER;
1388	break;
1389	}
1390
1391	Assert(rc == VINF_SUCCESS);
1392	GCOffset += offIncrement;
1393	GCDest += offIncrement;
1394	cTransfers--;
1395	}
1396
1397	/* Update the registers. */
1398	switch (pCpu->addrmode)
1399	{
1400	case CPUMODE_16BIT:
1401	pRegFrame->di = GCOffset;
1402	pRegFrame->cx = cTransfers;
1403	break;
1404	case CPUMODE_32BIT:
1405	pRegFrame->edi = GCOffset;
1406	pRegFrame->ecx = cTransfers;
1407	break;
1408	case CPUMODE_64BIT:
1409	pRegFrame->rdi = GCOffset;
1410	pRegFrame->rcx = cTransfers;
1411	break;
1412	default:
1413	AssertFailed();
1414	return VERR_EM_INTERPRETER;
1415	}
1416	}
1417
1418	*pcbSize = cbSize;
1419	return rc;
1420	}
1421	#endif
1422
1423
1424	/**
1425	* [LOCK] CMPXCHG emulation.
1426	*/
1427	#ifndef IN_GC
1428	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1429	{
1430	OP_PARAMVAL param1, param2;
1431
1432	/* Source to make DISQueryParamVal read the register value - ugly hack */
1433	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1434	if(VBOX_FAILURE(rc))
1435	return VERR_EM_INTERPRETER;
1436
1437	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1438	if(VBOX_FAILURE(rc))
1439	return VERR_EM_INTERPRETER;
1440
1441	RTGCPTR GCPtrPar1;
1442	void *pvParam1;
1443	uint64_t valpar, eflags;
1444
1445	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1446	switch(param1.type)
1447	{
1448	case PARMTYPE_ADDRESS:
1449	GCPtrPar1 = param1.val.val64;
1450	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1451
1452	rc = PGMPhysGCPtr2HCPtr(pVM, GCPtrPar1, &pvParam1);
1453	if (VBOX_FAILURE(rc))
1454	{
1455	AssertRC(rc);
1456	return VERR_EM_INTERPRETER;
1457	}
1458	break;
1459
1460	default:
1461	return VERR_EM_INTERPRETER;
1462	}
1463
1464	switch(param2.type)
1465	{
1466	case PARMTYPE_IMMEDIATE: /* register actually */
1467	valpar = param2.val.val64;
1468	break;
1469
1470	default:
1471	return VERR_EM_INTERPRETER;
1472	}
1473
1474	LogFlow(("%s %VGv rax=%RX64 %RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar));
1475
1476	if (pCpu->prefix & PREFIX_LOCK)
1477	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1478	else
1479	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1480
1481	LogFlow(("%s %VGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1482
1483	/* Update guest's eflags and finish. */
1484	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1485	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1486
1487	*pcbSize = param2.size;
1488	return VINF_SUCCESS;
1489	}
1490
1491	#else /* IN_GC */
1492	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1493	{
1494	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1495	OP_PARAMVAL param1, param2;
1496
1497	/* Source to make DISQueryParamVal read the register value - ugly hack */
1498	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1499	if(VBOX_FAILURE(rc))
1500	return VERR_EM_INTERPRETER;
1501
1502	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1503	if(VBOX_FAILURE(rc))
1504	return VERR_EM_INTERPRETER;
1505
1506	if (TRPMHasTrap(pVM))
1507	{
1508	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1509	{
1510	RTRCPTR pParam1;
1511	uint32_t valpar, eflags;
1512
1513	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1514	switch(param1.type)
1515	{
1516	case PARMTYPE_ADDRESS:
1517	pParam1 = (RTRCPTR)param1.val.val64;
1518	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1519	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1520	break;
1521
1522	default:
1523	return VERR_EM_INTERPRETER;
1524	}
1525
1526	switch(param2.type)
1527	{
1528	case PARMTYPE_IMMEDIATE: /* register actually */
1529	valpar = param2.val.val32;
1530	break;
1531
1532	default:
1533	return VERR_EM_INTERPRETER;
1534	}
1535
1536	LogFlow(("%s %VRv eax=%08x %08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1537
1538	MMGCRamRegisterTrapHandler(pVM);
1539	if (pCpu->prefix & PREFIX_LOCK)
1540	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1541	else
1542	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1543	MMGCRamDeregisterTrapHandler(pVM);
1544
1545	if (VBOX_FAILURE(rc))
1546	{
1547	Log(("%s %VGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1548	return VERR_EM_INTERPRETER;
1549	}
1550
1551	LogFlow(("%s %VRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1552
1553	/* Update guest's eflags and finish. */
1554	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1555	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1556
1557	*pcbSize = param2.size;
1558	return VINF_SUCCESS;
1559	}
1560	}
1561	return VERR_EM_INTERPRETER;
1562	}
1563
1564	/*
1565	* [LOCK] CMPXCHG8B emulation.
1566	*/
1567	static int emInterpretCmpXchg8b(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1568	{
1569	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1570	OP_PARAMVAL param1;
1571
1572	/* Source to make DISQueryParamVal read the register value - ugly hack */
1573	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1574	if(VBOX_FAILURE(rc))
1575	return VERR_EM_INTERPRETER;
1576
1577	if (TRPMHasTrap(pVM))
1578	{
1579	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1580	{
1581	RTRCPTR pParam1;
1582	uint32_t eflags;
1583
1584	AssertReturn(pCpu->param1.size == 8, VERR_EM_INTERPRETER);
1585	switch(param1.type)
1586	{
1587	case PARMTYPE_ADDRESS:
1588	pParam1 = (RTRCPTR)param1.val.val64;
1589	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1590	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1591	break;
1592
1593	default:
1594	return VERR_EM_INTERPRETER;
1595	}
1596
1597	LogFlow(("%s %VRv=%08x eax=%08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1598
1599	MMGCRamRegisterTrapHandler(pVM);
1600	if (pCpu->prefix & PREFIX_LOCK)
1601	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1602	else
1603	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1604	MMGCRamDeregisterTrapHandler(pVM);
1605
1606	if (VBOX_FAILURE(rc))
1607	{
1608	Log(("%s %VGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1609	return VERR_EM_INTERPRETER;
1610	}
1611
1612	LogFlow(("%s %VGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1613
1614	/* Update guest's eflags and finish; note that only ZF is affected. */
1615	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1616	\| (eflags & (X86_EFL_ZF));
1617
1618	*pcbSize = 8;
1619	return VINF_SUCCESS;
1620	}
1621	}
1622	return VERR_EM_INTERPRETER;
1623	}
1624	#endif /* IN_GC */
1625
1626
1627	/**
1628	* [LOCK] XADD emulation.
1629	*/
1630	#ifdef IN_GC
1631	static int emInterpretXAdd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1632	{
1633	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1634	OP_PARAMVAL param1;
1635	uint32_t *pParamReg2;
1636	size_t cbSizeParamReg2;
1637
1638	/* Source to make DISQueryParamVal read the register value - ugly hack */
1639	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1640	if(VBOX_FAILURE(rc))
1641	return VERR_EM_INTERPRETER;
1642
1643	rc = DISQueryParamRegPtr(pRegFrame, pCpu, &pCpu->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1644	Assert(cbSizeParamReg2 <= 4);
1645	if(VBOX_FAILURE(rc))
1646	return VERR_EM_INTERPRETER;
1647
1648	if (TRPMHasTrap(pVM))
1649	{
1650	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1651	{
1652	RTRCPTR pParam1;
1653	uint32_t eflags;
1654
1655	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1656	switch(param1.type)
1657	{
1658	case PARMTYPE_ADDRESS:
1659	pParam1 = (RTRCPTR)param1.val.val64;
1660	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1661	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1662	break;
1663
1664	default:
1665	return VERR_EM_INTERPRETER;
1666	}
1667
1668	LogFlow(("XAdd %VRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1669
1670	MMGCRamRegisterTrapHandler(pVM);
1671	if (pCpu->prefix & PREFIX_LOCK)
1672	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1673	else
1674	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1675	MMGCRamDeregisterTrapHandler(pVM);
1676
1677	if (VBOX_FAILURE(rc))
1678	{
1679	Log(("XAdd %VGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1680	return VERR_EM_INTERPRETER;
1681	}
1682
1683	LogFlow(("XAdd %VGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1684
1685	/* Update guest's eflags and finish. */
1686	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1687	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1688
1689	*pcbSize = cbSizeParamReg2;
1690	return VINF_SUCCESS;
1691	}
1692	}
1693	return VERR_EM_INTERPRETER;
1694	}
1695	#endif /* IN_GC */
1696
1697
1698	#ifdef IN_GC
1699	/**
1700	* Interpret IRET (currently only to V86 code)
1701	*
1702	* @returns VBox status code.
1703	* @param pVM The VM handle.
1704	* @param pRegFrame The register frame.
1705	*
1706	*/
1707	VMMDECL(int) EMInterpretIret(PVM pVM, PCPUMCTXCORE pRegFrame)
1708	{
1709	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1710	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1711	int rc;
1712
1713	Assert(!CPUMIsGuestIn64BitCode(pVM, pRegFrame));
1714
1715	rc = emRamRead(pVM, &eip, (RTGCPTR)pIretStack , 4);
1716	rc \|= emRamRead(pVM, &cs, (RTGCPTR)(pIretStack + 4), 4);
1717	rc \|= emRamRead(pVM, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1718	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1719	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1720
1721	rc \|= emRamRead(pVM, &esp, (RTGCPTR)(pIretStack + 12), 4);
1722	rc \|= emRamRead(pVM, &ss, (RTGCPTR)(pIretStack + 16), 4);
1723	rc \|= emRamRead(pVM, &es, (RTGCPTR)(pIretStack + 20), 4);
1724	rc \|= emRamRead(pVM, &ds, (RTGCPTR)(pIretStack + 24), 4);
1725	rc \|= emRamRead(pVM, &fs, (RTGCPTR)(pIretStack + 28), 4);
1726	rc \|= emRamRead(pVM, &gs, (RTGCPTR)(pIretStack + 32), 4);
1727	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1728
1729	pRegFrame->eip = eip & 0xffff;
1730	pRegFrame->cs = cs;
1731
1732	/* Mask away all reserved bits */
1733	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1734	eflags &= uMask;
1735
1736	#ifndef IN_RING0
1737	CPUMRawSetEFlags(pVM, pRegFrame, eflags);
1738	#endif
1739	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1740
1741	pRegFrame->esp = esp;
1742	pRegFrame->ss = ss;
1743	pRegFrame->ds = ds;
1744	pRegFrame->es = es;
1745	pRegFrame->fs = fs;
1746	pRegFrame->gs = gs;
1747
1748	return VINF_SUCCESS;
1749	}
1750	#endif /* IN_GC */
1751
1752
1753	/**
1754	* IRET Emulation.
1755	*/
1756	static int emInterpretIret(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1757	{
1758	/* only allow direct calls to EMInterpretIret for now */
1759	return VERR_EM_INTERPRETER;
1760	}
1761
1762	/**
1763	* WBINVD Emulation.
1764	*/
1765	static int emInterpretWbInvd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1766	{
1767	/* Nothing to do. */
1768	return VINF_SUCCESS;
1769	}
1770
1771
1772	/**
1773	* Interpret INVLPG
1774	*
1775	* @returns VBox status code.
1776	* @param pVM The VM handle.
1777	* @param pRegFrame The register frame.
1778	* @param pAddrGC Operand address
1779	*
1780	*/
1781	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1782	{
1783	int rc;
1784
1785	/** @todo is addr always a flat linear address or ds based
1786	* (in absence of segment override prefixes)????
1787	*/
1788	#ifdef IN_GC
1789	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1790	#endif
1791	rc = PGMInvalidatePage(pVM, pAddrGC);
1792	if ( rc == VINF_SUCCESS
1793	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1794	return VINF_SUCCESS;
1795	AssertMsgReturn( rc == VERR_REM_FLUSHED_PAGES_OVERFLOW
1796	\|\| rc == VINF_EM_RAW_EMULATE_INSTR,
1797	("%Rrc addr=%RGv\n", rc, pAddrGC),
1798	VERR_EM_INTERPRETER);
1799	return rc;
1800	}
1801
1802
1803	/**
1804	* INVLPG Emulation.
1805	*/
1806	static int emInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1807	{
1808	OP_PARAMVAL param1;
1809	RTGCPTR addr;
1810
1811	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1812	if(VBOX_FAILURE(rc))
1813	return VERR_EM_INTERPRETER;
1814
1815	switch(param1.type)
1816	{
1817	case PARMTYPE_IMMEDIATE:
1818	case PARMTYPE_ADDRESS:
1819	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1820	return VERR_EM_INTERPRETER;
1821	addr = (RTGCPTR)param1.val.val64;
1822	break;
1823
1824	default:
1825	return VERR_EM_INTERPRETER;
1826	}
1827
1828	/** @todo is addr always a flat linear address or ds based
1829	* (in absence of segment override prefixes)????
1830	*/
1831	#ifdef IN_GC
1832	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1833	#endif
1834	rc = PGMInvalidatePage(pVM, addr);
1835	if ( rc == VINF_SUCCESS
1836	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1837	return VINF_SUCCESS;
1838	AssertMsgReturn( rc == VERR_REM_FLUSHED_PAGES_OVERFLOW
1839	\|\| rc == VINF_EM_RAW_EMULATE_INSTR,
1840	("%Rrc addr=%RGv\n", rc, addr),
1841	VERR_EM_INTERPRETER);
1842	return rc;
1843	}
1844
1845
1846	/**
1847	* Interpret CPUID given the parameters in the CPU context
1848	*
1849	* @returns VBox status code.
1850	* @param pVM The VM handle.
1851	* @param pRegFrame The register frame.
1852	*
1853	*/
1854	VMMDECL(int) EMInterpretCpuId(PVM pVM, PCPUMCTXCORE pRegFrame)
1855	{
1856	uint32_t iLeaf = pRegFrame->eax; NOREF(iLeaf);
1857
1858	/* Note: operates the same in 64 and non-64 bits mode. */
1859	CPUMGetGuestCpuId(pVM, pRegFrame->eax, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1860	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1861	return VINF_SUCCESS;
1862	}
1863
1864
1865	/**
1866	* CPUID Emulation.
1867	*/
1868	static int emInterpretCpuId(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1869	{
1870	int rc = EMInterpretCpuId(pVM, pRegFrame);
1871	return rc;
1872	}
1873
1874
1875	/**
1876	* Interpret CRx read
1877	*
1878	* @returns VBox status code.
1879	* @param pVM The VM handle.
1880	* @param pRegFrame The register frame.
1881	* @param DestRegGen General purpose register index (USE_REG_E**))
1882	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1883	*
1884	*/
1885	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1886	{
1887	int rc;
1888	uint64_t val64;
1889
1890	if (SrcRegCrx == USE_REG_CR8)
1891	{
1892	val64 = 0;
1893	rc = PDMApicGetTPR(pVM, (uint8_t *)&val64, NULL);
1894	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
1895	}
1896	else
1897	{
1898	rc = CPUMGetGuestCRx(pVM, SrcRegCrx, &val64);
1899	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1900	}
1901
1902	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
1903	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1904	else
1905	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1906
1907	if(VBOX_SUCCESS(rc))
1908	{
1909	LogFlow(("MOV_CR: gen32=%d CR=%d val=%VX64\n", DestRegGen, SrcRegCrx, val64));
1910	return VINF_SUCCESS;
1911	}
1912	return VERR_EM_INTERPRETER;
1913	}
1914
1915
1916	/**
1917	* Interpret LMSW
1918	*
1919	* @returns VBox status code.
1920	* @param pVM The VM handle.
1921	* @param u16Data LMSW source data.
1922	*
1923	*/
1924	VMMDECL(int) EMInterpretLMSW(PVM pVM, uint16_t u16Data)
1925	{
1926	uint64_t OldCr0 = CPUMGetGuestCR0(pVM);
1927
1928	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1929	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1930	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1931
1932	/* don't use this path to go into protected mode! */
1933	if ((OldCr0 & X86_CR0_PE) != (NewCr0 & X86_CR0_PE))
1934	return VERR_EM_INTERPRETER;
1935
1936	return CPUMSetGuestCR0(pVM, NewCr0);
1937	}
1938
1939	/**
1940	* LMSW Emulation.
1941	*/
1942	static int emInterpretLmsw(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1943	{
1944	OP_PARAMVAL param1;
1945	uint32_t val;
1946
1947	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1948	if(VBOX_FAILURE(rc))
1949	return VERR_EM_INTERPRETER;
1950
1951	switch(param1.type)
1952	{
1953	case PARMTYPE_IMMEDIATE:
1954	case PARMTYPE_ADDRESS:
1955	if(!(param1.flags & PARAM_VAL16))
1956	return VERR_EM_INTERPRETER;
1957	val = param1.val.val32;
1958	break;
1959
1960	default:
1961	return VERR_EM_INTERPRETER;
1962	}
1963
1964	LogFlow(("emInterpretLmsw %x\n", val));
1965	return EMInterpretLMSW(pVM, val);
1966	}
1967
1968
1969	/**
1970	* Interpret CLTS
1971	*
1972	* @returns VBox status code.
1973	* @param pVM The VM handle.
1974	*
1975	*/
1976	VMMDECL(int) EMInterpretCLTS(PVM pVM)
1977	{
1978	uint64_t cr0 = CPUMGetGuestCR0(pVM);
1979	if (!(cr0 & X86_CR0_TS))
1980	return VINF_SUCCESS;
1981	return CPUMSetGuestCR0(pVM, cr0 & ~X86_CR0_TS);
1982	}
1983
1984	/**
1985	* CLTS Emulation.
1986	*/
1987	static int emInterpretClts(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1988	{
1989	return EMInterpretCLTS(pVM);
1990	}
1991
1992
1993	/**
1994	* Interpret CRx write
1995	*
1996	* @returns VBox status code.
1997	* @param pVM The VM handle.
1998	* @param pRegFrame The register frame.
1999	* @param DestRegCRx CRx register index (USE_REG_CR*)
2000	* @param SrcRegGen General purpose register index (USE_REG_E**))
2001	*
2002	*/
2003	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2004	{
2005	uint64_t val;
2006	uint64_t oldval;
2007	uint64_t msrEFER;
2008	int rc;
2009
2010	/** @todo Clean up this mess. */
2011	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2012	{
2013	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2014	}
2015	else
2016	{
2017	uint32_t val32;
2018	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2019	val = val32;
2020	}
2021
2022	if (VBOX_SUCCESS(rc))
2023	{
2024	LogFlow(("EMInterpretCRxWrite at %VGv CR%d <- %VX64\n", pRegFrame->rip, DestRegCrx, val));
2025	switch (DestRegCrx)
2026	{
2027	case USE_REG_CR0:
2028	oldval = CPUMGetGuestCR0(pVM);
2029	#ifdef IN_GC
2030	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2031	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2032	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2033	return VERR_EM_INTERPRETER;
2034	#endif
2035	CPUMSetGuestCR0(pVM, val);
2036	val = CPUMGetGuestCR0(pVM);
2037	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2038	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2039	{
2040	/* global flush */
2041	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2042	AssertRCReturn(rc, rc);
2043	}
2044
2045	/* Deal with long mode enabling/disabling. */
2046	msrEFER = CPUMGetGuestEFER(pVM);
2047	if (msrEFER & MSR_K6_EFER_LME)
2048	{
2049	if ( !(oldval & X86_CR0_PG)
2050	&& (val & X86_CR0_PG))
2051	{
2052	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2053	if (pRegFrame->csHid.Attr.n.u1Long)
2054	{
2055	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2056	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2057	}
2058
2059	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2060	if (!(CPUMGetGuestCR4(pVM) & X86_CR4_PAE))
2061	{
2062	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2063	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2064	}
2065	msrEFER \|= MSR_K6_EFER_LMA;
2066	}
2067	else
2068	if ( (oldval & X86_CR0_PG)
2069	&& !(val & X86_CR0_PG))
2070	{
2071	msrEFER &= ~MSR_K6_EFER_LMA;
2072	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2073	}
2074	CPUMSetGuestEFER(pVM, msrEFER);
2075	}
2076	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2077
2078	case USE_REG_CR2:
2079	rc = CPUMSetGuestCR2(pVM, val); AssertRC(rc);
2080	return VINF_SUCCESS;
2081
2082	case USE_REG_CR3:
2083	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2084	rc = CPUMSetGuestCR3(pVM, val); AssertRC(rc);
2085	if (CPUMGetGuestCR0(pVM) & X86_CR0_PG)
2086	{
2087	/* flush */
2088	rc = PGMFlushTLB(pVM, val, !(CPUMGetGuestCR4(pVM) & X86_CR4_PGE));
2089	AssertRCReturn(rc, rc);
2090	}
2091	return VINF_SUCCESS;
2092
2093	case USE_REG_CR4:
2094	oldval = CPUMGetGuestCR4(pVM);
2095	rc = CPUMSetGuestCR4(pVM, val); AssertRC(rc);
2096	val = CPUMGetGuestCR4(pVM);
2097
2098	msrEFER = CPUMGetGuestEFER(pVM);
2099	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2100	if ( (msrEFER & MSR_K6_EFER_LMA)
2101	&& (oldval & X86_CR4_PAE)
2102	&& !(val & X86_CR4_PAE))
2103	{
2104	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2105	}
2106
2107	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2108	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2109	{
2110	/* global flush */
2111	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2112	AssertRCReturn(rc, rc);
2113	}
2114	# ifdef IN_GC
2115	/* Feeling extremely lazy. */
2116	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2117	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2118	{
2119	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2120	VM_FF_SET(pVM, VM_FF_TO_R3);
2121	}
2122	# endif
2123	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2124
2125	case USE_REG_CR8:
2126	return PDMApicSetTPR(pVM, val);
2127
2128	default:
2129	AssertFailed();
2130	case USE_REG_CR1: /* illegal op */
2131	break;
2132	}
2133	}
2134	return VERR_EM_INTERPRETER;
2135	}
2136
2137
2138	/**
2139	* MOV CRx
2140	*/
2141	static int emInterpretMovCRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2142	{
2143	if ((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_CR)
2144	return EMInterpretCRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_ctrl);
2145
2146	if (pCpu->param1.flags == USE_REG_CR && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2147	return EMInterpretCRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_ctrl, pCpu->param2.base.reg_gen);
2148
2149	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2150	return VERR_EM_INTERPRETER;
2151	}
2152
2153
2154	/**
2155	* Interpret DRx write
2156	*
2157	* @returns VBox status code.
2158	* @param pVM The VM handle.
2159	* @param pRegFrame The register frame.
2160	* @param DestRegDRx DRx register index (USE_REG_DR*)
2161	* @param SrcRegGen General purpose register index (USE_REG_E**))
2162	*
2163	*/
2164	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2165	{
2166	uint64_t val;
2167	int rc;
2168
2169	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2170	{
2171	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2172	}
2173	else
2174	{
2175	uint32_t val32;
2176	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2177	val = val32;
2178	}
2179
2180	if (RT_SUCCESS(rc))
2181	{
2182	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2183	rc = CPUMSetGuestDRx(pVM, DestRegDrx, val);
2184	if (RT_SUCCESS(rc))
2185	return rc;
2186	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2187	}
2188	return VERR_EM_INTERPRETER;
2189	}
2190
2191
2192	/**
2193	* Interpret DRx read
2194	*
2195	* @returns VBox status code.
2196	* @param pVM The VM handle.
2197	* @param pRegFrame The register frame.
2198	* @param DestRegGen General purpose register index (USE_REG_E**))
2199	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2200	*
2201	*/
2202	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2203	{
2204	uint64_t val64;
2205
2206	int rc = CPUMGetGuestDRx(pVM, SrcRegDrx, &val64);
2207	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2208	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2209	{
2210	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2211	}
2212	else
2213	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2214
2215	if (VBOX_SUCCESS(rc))
2216	return VINF_SUCCESS;
2217
2218	return VERR_EM_INTERPRETER;
2219	}
2220
2221
2222	/**
2223	* MOV DRx
2224	*/
2225	static int emInterpretMovDRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2226	{
2227	int rc = VERR_EM_INTERPRETER;
2228
2229	if((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_DBG)
2230	{
2231	rc = EMInterpretDRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_dbg);
2232	}
2233	else
2234	if(pCpu->param1.flags == USE_REG_DBG && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2235	{
2236	rc = EMInterpretDRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_dbg, pCpu->param2.base.reg_gen);
2237	}
2238	else
2239	AssertMsgFailed(("Unexpected debug register move\n"));
2240
2241	return rc;
2242	}
2243
2244
2245	/**
2246	* LLDT Emulation.
2247	*/
2248	static int emInterpretLLdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2249	{
2250	OP_PARAMVAL param1;
2251	RTSEL sel;
2252
2253	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2254	if(VBOX_FAILURE(rc))
2255	return VERR_EM_INTERPRETER;
2256
2257	switch(param1.type)
2258	{
2259	case PARMTYPE_ADDRESS:
2260	return VERR_EM_INTERPRETER; //feeling lazy right now
2261
2262	case PARMTYPE_IMMEDIATE:
2263	if(!(param1.flags & PARAM_VAL16))
2264	return VERR_EM_INTERPRETER;
2265	sel = (RTSEL)param1.val.val16;
2266	break;
2267
2268	default:
2269	return VERR_EM_INTERPRETER;
2270	}
2271
2272	if (sel == 0)
2273	{
2274	if (CPUMGetHyperLDTR(pVM) == 0)
2275	{
2276	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2277	return VINF_SUCCESS;
2278	}
2279	}
2280	//still feeling lazy
2281	return VERR_EM_INTERPRETER;
2282	}
2283
2284	#ifdef IN_RING0
2285	/**
2286	* LIDT/LGDT Emulation.
2287	*/
2288	static int emInterpretLIGdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2289	{
2290	OP_PARAMVAL param1;
2291	RTGCPTR pParam1;
2292	X86XDTR32 dtr32;
2293
2294	Log(("Emulate %s at %VGv\n", emGetMnemonic(pCpu), pRegFrame->rip));
2295
2296	/* Only for the VT-x real-mode emulation case. */
2297	if (!CPUMIsGuestInRealMode(pVM))
2298	return VERR_EM_INTERPRETER;
2299
2300	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2301	if(VBOX_FAILURE(rc))
2302	return VERR_EM_INTERPRETER;
2303
2304	switch(param1.type)
2305	{
2306	case PARMTYPE_ADDRESS:
2307	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, param1.val.val16);
2308	break;
2309
2310	default:
2311	return VERR_EM_INTERPRETER;
2312	}
2313
2314	rc = emRamRead(pVM, &dtr32, pParam1, sizeof(dtr32));
2315	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2316
2317	if (!(pCpu->prefix & PREFIX_OPSIZE))
2318	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2319
2320	if (pCpu->pCurInstr->opcode == OP_LIDT)
2321	CPUMSetGuestIDTR(pVM, dtr32.uAddr, dtr32.cb);
2322	else
2323	CPUMSetGuestGDTR(pVM, dtr32.uAddr, dtr32.cb);
2324
2325	return VINF_SUCCESS;
2326	}
2327	#endif
2328
2329
2330	#ifdef IN_GC
2331	/**
2332	* STI Emulation.
2333	*
2334	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2335	*/
2336	static int emInterpretSti(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2337	{
2338	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2339
2340	if(!pGCState)
2341	{
2342	Assert(pGCState);
2343	return VERR_EM_INTERPRETER;
2344	}
2345	pGCState->uVMFlags \|= X86_EFL_IF;
2346
2347	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2348	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2349
2350	pVM->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pCpu->opsize;
2351	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2352
2353	return VINF_SUCCESS;
2354	}
2355	#endif /* IN_GC */
2356
2357
2358	/**
2359	* HLT Emulation.
2360	*/
2361	static int emInterpretHlt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2362	{
2363	return VINF_EM_HALT;
2364	}
2365
2366
2367	/**
2368	* Interpret RDTSC
2369	*
2370	* @returns VBox status code.
2371	* @param pVM The VM handle.
2372	* @param pRegFrame The register frame.
2373	*
2374	*/
2375	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PCPUMCTXCORE pRegFrame)
2376	{
2377	unsigned uCR4 = CPUMGetGuestCR4(pVM);
2378
2379	if (uCR4 & X86_CR4_TSD)
2380	return VERR_EM_INTERPRETER; /* genuine #GP */
2381
2382	uint64_t uTicks = TMCpuTickGet(pVM);
2383
2384	/* Same behaviour in 32 & 64 bits mode */
2385	pRegFrame->eax = uTicks;
2386	pRegFrame->edx = (uTicks >> 32ULL);
2387
2388	return VINF_SUCCESS;
2389	}
2390
2391
2392	/**
2393	* RDTSC Emulation.
2394	*/
2395	static int emInterpretRdtsc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2396	{
2397	return EMInterpretRdtsc(pVM, pRegFrame);
2398	}
2399
2400
2401	/**
2402	* MONITOR Emulation.
2403	*/
2404	static int emInterpretMonitor(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2405	{
2406	uint32_t u32Dummy, u32ExtFeatures, cpl;
2407
2408	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2409	if (pRegFrame->ecx != 0)
2410	return VERR_EM_INTERPRETER; /* illegal value. */
2411
2412	/* Get the current privilege level. */
2413	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2414	if (cpl != 0)
2415	return VERR_EM_INTERPRETER; /* supervisor only */
2416
2417	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2418	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2419	return VERR_EM_INTERPRETER; /* not supported */
2420
2421	return VINF_SUCCESS;
2422	}
2423
2424
2425	/**
2426	* MWAIT Emulation.
2427	*/
2428	static int emInterpretMWait(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2429	{
2430	uint32_t u32Dummy, u32ExtFeatures, cpl;
2431
2432	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2433	if (pRegFrame->ecx != 0)
2434	return VERR_EM_INTERPRETER; /* illegal value. */
2435
2436	/* Get the current privilege level. */
2437	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2438	if (cpl != 0)
2439	return VERR_EM_INTERPRETER; /* supervisor only */
2440
2441	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2442	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2443	return VERR_EM_INTERPRETER; /* not supported */
2444
2445	/** @todo not completely correct */
2446	return VINF_EM_HALT;
2447	}
2448
2449
2450	#ifdef LOG_ENABLED
2451	static const char *emMSRtoString(uint32_t uMsr)
2452	{
2453	switch (uMsr)
2454	{
2455	case MSR_IA32_APICBASE:
2456	return "MSR_IA32_APICBASE";
2457	case MSR_IA32_CR_PAT:
2458	return "MSR_IA32_CR_PAT";
2459	case MSR_IA32_SYSENTER_CS:
2460	return "MSR_IA32_SYSENTER_CS";
2461	case MSR_IA32_SYSENTER_EIP:
2462	return "MSR_IA32_SYSENTER_EIP";
2463	case MSR_IA32_SYSENTER_ESP:
2464	return "MSR_IA32_SYSENTER_ESP";
2465	case MSR_K6_EFER:
2466	return "MSR_K6_EFER";
2467	case MSR_K8_SF_MASK:
2468	return "MSR_K8_SF_MASK";
2469	case MSR_K6_STAR:
2470	return "MSR_K6_STAR";
2471	case MSR_K8_LSTAR:
2472	return "MSR_K8_LSTAR";
2473	case MSR_K8_CSTAR:
2474	return "MSR_K8_CSTAR";
2475	case MSR_K8_FS_BASE:
2476	return "MSR_K8_FS_BASE";
2477	case MSR_K8_GS_BASE:
2478	return "MSR_K8_GS_BASE";
2479	case MSR_K8_KERNEL_GS_BASE:
2480	return "MSR_K8_KERNEL_GS_BASE";
2481	case MSR_IA32_BIOS_SIGN_ID:
2482	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2483	case MSR_IA32_PLATFORM_ID:
2484	return "Unsupported MSR_IA32_PLATFORM_ID";
2485	case MSR_IA32_BIOS_UPDT_TRIG:
2486	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2487	case MSR_IA32_TSC:
2488	return "Unsupported MSR_IA32_TSC";
2489	case MSR_IA32_MTRR_CAP:
2490	return "Unsupported MSR_IA32_MTRR_CAP";
2491	case MSR_IA32_MCP_CAP:
2492	return "Unsupported MSR_IA32_MCP_CAP";
2493	case MSR_IA32_MCP_STATUS:
2494	return "Unsupported MSR_IA32_MCP_STATUS";
2495	case MSR_IA32_MCP_CTRL:
2496	return "Unsupported MSR_IA32_MCP_CTRL";
2497	case MSR_IA32_MTRR_DEF_TYPE:
2498	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2499	case MSR_K7_EVNTSEL0:
2500	return "Unsupported MSR_K7_EVNTSEL0";
2501	case MSR_K7_EVNTSEL1:
2502	return "Unsupported MSR_K7_EVNTSEL1";
2503	case MSR_K7_EVNTSEL2:
2504	return "Unsupported MSR_K7_EVNTSEL2";
2505	case MSR_K7_EVNTSEL3:
2506	return "Unsupported MSR_K7_EVNTSEL3";
2507	case MSR_IA32_MC0_CTL:
2508	return "Unsupported MSR_IA32_MC0_CTL";
2509	case MSR_IA32_MC0_STATUS:
2510	return "Unsupported MSR_IA32_MC0_STATUS";
2511	}
2512	return "Unknown MSR";
2513	}
2514	#endif /* LOG_ENABLED */
2515
2516
2517	/**
2518	* Interpret RDMSR
2519	*
2520	* @returns VBox status code.
2521	* @param pVM The VM handle.
2522	* @param pRegFrame The register frame.
2523	*
2524	*/
2525	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2526	{
2527	uint32_t u32Dummy, u32Features, cpl;
2528	uint64_t val;
2529	CPUMCTX *pCtx;
2530	int rc;
2531
2532	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2533	* That version clears the high dwords of both RDX & RAX */
2534	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2535	AssertRC(rc);
2536
2537	/* Get the current privilege level. */
2538	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2539	if (cpl != 0)
2540	return VERR_EM_INTERPRETER; /* supervisor only */
2541
2542	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2543	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2544	return VERR_EM_INTERPRETER; /* not supported */
2545
2546	switch (pRegFrame->ecx)
2547	{
2548	case MSR_IA32_APICBASE:
2549	rc = PDMApicGetBase(pVM, &val);
2550	AssertRC(rc);
2551	break;
2552
2553	case MSR_IA32_CR_PAT:
2554	val = pCtx->msrPAT;
2555	break;
2556
2557	case MSR_IA32_SYSENTER_CS:
2558	val = pCtx->SysEnter.cs;
2559	break;
2560
2561	case MSR_IA32_SYSENTER_EIP:
2562	val = pCtx->SysEnter.eip;
2563	break;
2564
2565	case MSR_IA32_SYSENTER_ESP:
2566	val = pCtx->SysEnter.esp;
2567	break;
2568
2569	case MSR_K6_EFER:
2570	val = pCtx->msrEFER;
2571	break;
2572
2573	case MSR_K8_SF_MASK:
2574	val = pCtx->msrSFMASK;
2575	break;
2576
2577	case MSR_K6_STAR:
2578	val = pCtx->msrSTAR;
2579	break;
2580
2581	case MSR_K8_LSTAR:
2582	val = pCtx->msrLSTAR;
2583	break;
2584
2585	case MSR_K8_CSTAR:
2586	val = pCtx->msrCSTAR;
2587	break;
2588
2589	case MSR_K8_FS_BASE:
2590	val = pCtx->fsHid.u64Base;
2591	break;
2592
2593	case MSR_K8_GS_BASE:
2594	val = pCtx->gsHid.u64Base;
2595	break;
2596
2597	case MSR_K8_KERNEL_GS_BASE:
2598	val = pCtx->msrKERNELGSBASE;
2599	break;
2600
2601	#if 0 /def IN_RING0 /
2602	case MSR_IA32_PLATFORM_ID:
2603	case MSR_IA32_BIOS_SIGN_ID:
2604	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2605	{
2606	/* Available since the P6 family. VT-x implies that this feature is present. */
2607	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2608	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2609	else
2610	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2611	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2612	break;
2613	}
2614	/* no break */
2615	#endif
2616	default:
2617	/* In X2APIC specification this range is reserved for APIC control. */
2618	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2619	rc = PDMApicReadMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, &val);
2620	else
2621	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2622	val = 0;
2623	break;
2624	}
2625	Log(("EMInterpretRdmsr %s (%x) -> val=%VX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2626	if (rc == VINF_SUCCESS)
2627	{
2628	pRegFrame->eax = (uint32_t) val;
2629	pRegFrame->edx = (uint32_t) (val >> 32ULL);
2630	}
2631	return rc;
2632	}
2633
2634
2635	/**
2636	* RDMSR Emulation.
2637	*/
2638	static int emInterpretRdmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2639	{
2640	/* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2641	Assert(!(pCpu->prefix & PREFIX_REX));
2642	return EMInterpretRdmsr(pVM, pRegFrame);
2643	}
2644
2645
2646	/**
2647	* Interpret WRMSR
2648	*
2649	* @returns VBox status code.
2650	* @param pVM The VM handle.
2651	* @param pRegFrame The register frame.
2652	*/
2653	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2654	{
2655	uint32_t u32Dummy, u32Features, cpl;
2656	uint64_t val;
2657	CPUMCTX *pCtx;
2658	int rc;
2659
2660	/* Note: works the same in 32 and 64 bits modes. */
2661	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2662	AssertRC(rc);
2663
2664	/* Get the current privilege level. */
2665	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2666	if (cpl != 0)
2667	return VERR_EM_INTERPRETER; /* supervisor only */
2668
2669	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2670	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2671	return VERR_EM_INTERPRETER; /* not supported */
2672
2673	val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
2674	Log(("EMInterpretWrmsr %s (%x) val=%VX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2675	switch (pRegFrame->ecx)
2676	{
2677	case MSR_IA32_APICBASE:
2678	rc = PDMApicSetBase(pVM, val);
2679	AssertRC(rc);
2680	break;
2681
2682	case MSR_IA32_CR_PAT:
2683	pCtx->msrPAT = val;
2684	break;
2685
2686	case MSR_IA32_SYSENTER_CS:
2687	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
2688	break;
2689
2690	case MSR_IA32_SYSENTER_EIP:
2691	pCtx->SysEnter.eip = val;
2692	break;
2693
2694	case MSR_IA32_SYSENTER_ESP:
2695	pCtx->SysEnter.esp = val;
2696	break;
2697
2698	case MSR_K6_EFER:
2699	{
2700	uint64_t uMask = 0;
2701	uint64_t oldval = pCtx->msrEFER;
2702
2703	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
2704	CPUMGetGuestCpuId(pVM, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2705	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
2706	uMask \|= MSR_K6_EFER_NXE;
2707	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
2708	uMask \|= MSR_K6_EFER_LME;
2709	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
2710	uMask \|= MSR_K6_EFER_SCE;
2711	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
2712	uMask \|= MSR_K6_EFER_FFXSR;
2713
2714	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2715	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
2716	&& (pCtx->cr0 & X86_CR0_PG))
2717	{
2718	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
2719	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2720	}
2721
2722	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
2723	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
2724	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
2725
2726	/* AMD64 Achitecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
2727	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
2728	HWACCMFlushTLB(pVM);
2729
2730	break;
2731	}
2732
2733	case MSR_K8_SF_MASK:
2734	pCtx->msrSFMASK = val;
2735	break;
2736
2737	case MSR_K6_STAR:
2738	pCtx->msrSTAR = val;
2739	break;
2740
2741	case MSR_K8_LSTAR:
2742	pCtx->msrLSTAR = val;
2743	break;
2744
2745	case MSR_K8_CSTAR:
2746	pCtx->msrCSTAR = val;
2747	break;
2748
2749	case MSR_K8_FS_BASE:
2750	pCtx->fsHid.u64Base = val;
2751	break;
2752
2753	case MSR_K8_GS_BASE:
2754	pCtx->gsHid.u64Base = val;
2755	break;
2756
2757	case MSR_K8_KERNEL_GS_BASE:
2758	pCtx->msrKERNELGSBASE = val;
2759	break;
2760
2761	default:
2762	/* In X2APIC specification this range is reserved for APIC control. */
2763	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2764	return PDMApicWriteMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, val);
2765
2766	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2767	break;
2768	}
2769	return VINF_SUCCESS;
2770	}
2771
2772
2773	/**
2774	* WRMSR Emulation.
2775	*/
2776	static int emInterpretWrmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2777	{
2778	return EMInterpretWrmsr(pVM, pRegFrame);
2779	}
2780
2781
2782	/**
2783	* Internal worker.
2784	* @copydoc EMInterpretInstructionCPU
2785	*/
2786	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2787	{
2788	Assert(pcbSize);
2789	*pcbSize = 0;
2790
2791	/*
2792	* Only supervisor guest code!!
2793	* And no complicated prefixes.
2794	*/
2795	/* Get the current privilege level. */
2796	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2797	if ( cpl != 0
2798	&& pCpu->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
2799	{
2800	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
2801	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
2802	return VERR_EM_INTERPRETER;
2803	}
2804
2805	#ifdef IN_GC
2806	if ( (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP))
2807	\|\| ( (pCpu->prefix & PREFIX_LOCK)
2808	&& pCpu->pCurInstr->opcode != OP_CMPXCHG
2809	&& pCpu->pCurInstr->opcode != OP_CMPXCHG8B
2810	&& pCpu->pCurInstr->opcode != OP_XADD
2811	&& pCpu->pCurInstr->opcode != OP_OR
2812	&& pCpu->pCurInstr->opcode != OP_BTR
2813	)
2814	)
2815	#else
2816	if ( (pCpu->prefix & PREFIX_REPNE)
2817	\|\| ( (pCpu->prefix & PREFIX_REP)
2818	&& pCpu->pCurInstr->opcode != OP_STOSWD
2819	)
2820	\|\| ( (pCpu->prefix & PREFIX_LOCK)
2821	&& pCpu->pCurInstr->opcode != OP_OR
2822	&& pCpu->pCurInstr->opcode != OP_BTR
2823	)
2824	)
2825	#endif
2826	{
2827	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
2828	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
2829	return VERR_EM_INTERPRETER;
2830	}
2831
2832	int rc;
2833	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
2834	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pCpu)));
2835	#endif
2836	switch (pCpu->pCurInstr->opcode)
2837	{
2838	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2839	case opcode:\
2840	if (pCpu->prefix & PREFIX_LOCK) \
2841	rc = emInterpretLock##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
2842	else \
2843	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2844	if (VBOX_SUCCESS(rc)) \
2845	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2846	else \
2847	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2848	return rc
2849	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
2850	case opcode:\
2851	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2852	if (VBOX_SUCCESS(rc)) \
2853	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2854	else \
2855	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2856	return rc
2857
2858	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
2859	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
2860	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2861	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
2862
2863	#define INTERPRET_CASE(opcode, Instr) \
2864	case opcode:\
2865	rc = emInterpret##Instr(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
2866	if (VBOX_SUCCESS(rc)) \
2867	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2868	else \
2869	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2870	return rc
2871
2872	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
2873	case opcode:\
2874	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
2875	if (VBOX_SUCCESS(rc)) \
2876	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
2877	else \
2878	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
2879	return rc
2880
2881	#define INTERPRET_STAT_CASE(opcode, Instr) \
2882	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
2883
2884	INTERPRET_CASE(OP_XCHG,Xchg);
2885	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
2886	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
2887	INTERPRET_CASE(OP_POP,Pop);
2888	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
2889	INTERPRET_CASE_EX_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor);
2890	INTERPRET_CASE_EX_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd);
2891	INTERPRET_CASE(OP_MOV,Mov);
2892	#ifndef IN_GC
2893	INTERPRET_CASE(OP_STOSWD,StosWD);
2894	#endif
2895	INTERPRET_CASE(OP_INVLPG,InvlPg);
2896	INTERPRET_CASE(OP_CPUID,CpuId);
2897	INTERPRET_CASE(OP_MOV_CR,MovCRx);
2898	INTERPRET_CASE(OP_MOV_DR,MovDRx);
2899	INTERPRET_CASE(OP_LLDT,LLdt);
2900	#ifdef IN_RING0
2901	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
2902	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
2903	#endif
2904	INTERPRET_CASE(OP_LMSW,Lmsw);
2905	INTERPRET_CASE(OP_CLTS,Clts);
2906	INTERPRET_CASE(OP_MONITOR, Monitor);
2907	INTERPRET_CASE(OP_MWAIT, MWait);
2908	INTERPRET_CASE(OP_RDMSR, Rdmsr);
2909	INTERPRET_CASE(OP_WRMSR, Wrmsr);
2910	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
2911	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
2912	INTERPRET_CASE(OP_ADC,Adc);
2913	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
2914	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
2915	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
2916	INTERPRET_CASE(OP_RDTSC,Rdtsc);
2917	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
2918	#ifdef IN_GC
2919	INTERPRET_CASE(OP_STI,Sti);
2920	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
2921	INTERPRET_CASE(OP_XADD, XAdd);
2922	#endif
2923	INTERPRET_CASE(OP_HLT,Hlt);
2924	INTERPRET_CASE(OP_IRET,Iret);
2925	INTERPRET_CASE(OP_WBINVD,WbInvd);
2926	#ifdef VBOX_WITH_STATISTICS
2927	#ifndef IN_GC
2928	INTERPRET_STAT_CASE(OP_CMPXCHG8B, CmpXchg8b);
2929	INTERPRET_STAT_CASE(OP_XADD, XAdd);
2930	#endif
2931	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
2932	#endif
2933	default:
2934	Log3(("emInterpretInstructionCPU: opcode=%d\n", pCpu->pCurInstr->opcode));
2935	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
2936	return VERR_EM_INTERPRETER;
2937	#undef INTERPRET_CASE_EX_PARAM2
2938	#undef INTERPRET_STAT_CASE
2939	#undef INTERPRET_CASE_EX
2940	#undef INTERPRET_CASE
2941	}
2942	AssertFailed();
2943	return VERR_INTERNAL_ERROR;
2944	}
2945
2946
2947	/**
2948	* Sets the PC for which interrupts should be inhibited.
2949	*
2950	* @param pVM The VM handle.
2951	* @param PC The PC.
2952	*/
2953	VMMDECL(void) EMSetInhibitInterruptsPC(PVM pVM, RTGCUINTPTR PC)
2954	{
2955	pVM->em.s.GCPtrInhibitInterrupts = PC;
2956	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2957	}
2958
2959
2960	/**
2961	* Gets the PC for which interrupts should be inhibited.
2962	*
2963	* There are a few instructions which inhibits or delays interrupts
2964	* for the instruction following them. These instructions are:
2965	* - STI
2966	* - MOV SS, r/m16
2967	* - POP SS
2968	*
2969	* @returns The PC for which interrupts should be inhibited.
2970	* @param pVM VM handle.
2971	*
2972	*/
2973	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVM pVM)
2974	{
2975	return pVM->em.s.GCPtrInhibitInterrupts;
2976	}
2977

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 13267

Download in other formats: