EMAll.cpp@ 17787

Last change on this file since 17787 was 17695, checked in by vboxsync, 16 years ago
Minor emulation changes for VT-x.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 108.0 KB

Line
1	/* $Id: EMAll.cpp 17695 2009-03-11 13:48:09Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_EM
26	#include <VBox/em.h>
27	#include <VBox/mm.h>
28	#include <VBox/selm.h>
29	#include <VBox/patm.h>
30	#include <VBox/csam.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/stam.h>
34	#include "EMInternal.h"
35	#include <VBox/vm.h>
36	#include <VBox/vmm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Defined Constants And Macros *
53	*******************************************************************************/
54	/** @def EM_ASSERT_FAULT_RETURN
55	* Safety check.
56	*
57	* Could in theory misfire on a cross page boundary access...
58	*
59	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
60	* turns up an alias page instead of the original faulting one and annoying the
61	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
62	*/
63	#if 0
64	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
65	#else
66	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
67	#endif
68
69
70	/*******************************************************************************
71	* Internal Functions *
72	*******************************************************************************/
73	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
74
75
76
77	/**
78	* Get the current execution manager status.
79	*
80	* @returns Current status.
81	*/
82	VMMDECL(EMSTATE) EMGetState(PVM pVM)
83	{
84	return pVM->em.s.enmState;
85	}
86
87	#ifndef IN_RC
88
89	/**
90	* Read callback for disassembly function; supports reading bytes that cross a page boundary
91	*
92	* @returns VBox status code.
93	* @param pSrc GC source pointer
94	* @param pDest HC destination pointer
95	* @param cb Number of bytes to read
96	* @param dwUserdata Callback specific user data (pCpu)
97	*
98	*/
99	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
100	{
101	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
102	PVM pVM = (PVM)pCpu->apvUserData[0];
103	# ifdef IN_RING0
104	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
105	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%RGv cb=%x\n", pSrc, cb));
106	# else /* IN_RING3 */
107	if (!PATMIsPatchGCAddr(pVM, pSrc))
108	{
109	int rc = PGMPhysSimpleReadGCPtr(pVM, pDest, pSrc, cb);
110	AssertRC(rc);
111	}
112	else
113	{
114	for (uint32_t i = 0; i < cb; i++)
115	{
116	uint8_t opcode;
117	if (RT_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
118	{
119	*(pDest+i) = opcode;
120	}
121	}
122	}
123	# endif /* IN_RING3 */
124	return VINF_SUCCESS;
125	}
126
127	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
128	{
129	return DISCoreOneEx(InstrGC, pCpu->mode, EMReadBytes, pVM, pCpu, pOpsize);
130	}
131
132	#else /* IN_RC */
133
134	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
135	{
136	return DISCoreOne(pCpu, InstrGC, pOpsize);
137	}
138
139	#endif /* IN_RC */
140
141
142	/**
143	* Disassembles one instruction.
144	*
145	* @param pVM The VM handle.
146	* @param pCtxCore The context core (used for both the mode and instruction).
147	* @param pCpu Where to return the parsed instruction info.
148	* @param pcbInstr Where to return the instruction size. (optional)
149	*/
150	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
151	{
152	RTGCPTR GCPtrInstr;
153	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
154	if (RT_FAILURE(rc))
155	{
156	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
157	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
158	return rc;
159	}
160	return EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pCpu, pcbInstr);
161	}
162
163
164	/**
165	* Disassembles one instruction.
166	*
167	* This is used by internally by the interpreter and by trap/access handlers.
168	*
169	* @param pVM The VM handle.
170	* @param GCPtrInstr The flat address of the instruction.
171	* @param pCtxCore The context core (used to determine the cpu mode).
172	* @param pCpu Where to return the parsed instruction info.
173	* @param pcbInstr Where to return the instruction size. (optional)
174	*/
175	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
176	{
177	int rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
178	#ifdef IN_RC
179	NULL, NULL,
180	#else
181	EMReadBytes, pVM,
182	#endif
183	pCpu, pcbInstr);
184	if (RT_SUCCESS(rc))
185	return VINF_SUCCESS;
186	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
187	return VERR_INTERNAL_ERROR;
188	}
189
190
191	/**
192	* Interprets the current instruction.
193	*
194	* @returns VBox status code.
195	* @retval VINF_* Scheduling instructions.
196	* @retval VERR_EM_INTERPRETER Something we can't cope with.
197	* @retval VERR_* Fatal errors.
198	*
199	* @param pVM The VM handle.
200	* @param pRegFrame The register frame.
201	* Updates the EIP if an instruction was executed successfully.
202	* @param pvFault The fault address (CR2).
203	* @param pcbSize Size of the write (if applicable).
204	*
205	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
206	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
207	* to worry about e.g. invalid modrm combinations (!)
208	*/
209	VMMDECL(int) EMInterpretInstruction(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
210	{
211	RTGCPTR pbCode;
212
213	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
214	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
215	if (RT_SUCCESS(rc))
216	{
217	uint32_t cbOp;
218	DISCPUSTATE Cpu;
219	Cpu.mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
220	rc = emDisCoreOne(pVM, &Cpu, (RTGCUINTPTR)pbCode, &cbOp);
221	if (RT_SUCCESS(rc))
222	{
223	Assert(cbOp == Cpu.opsize);
224	rc = EMInterpretInstructionCPU(pVM, &Cpu, pRegFrame, pvFault, pcbSize);
225	if (RT_SUCCESS(rc))
226	{
227	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
228	}
229	return rc;
230	}
231	}
232	return VERR_EM_INTERPRETER;
233	}
234
235
236	/**
237	* Interprets the current instruction using the supplied DISCPUSTATE structure.
238	*
239	* EIP is NOT updated!
240	*
241	* @returns VBox status code.
242	* @retval VINF_* Scheduling instructions. When these are returned, it
243	* starts to get a bit tricky to know whether code was
244	* executed or not... We'll address this when it becomes a problem.
245	* @retval VERR_EM_INTERPRETER Something we can't cope with.
246	* @retval VERR_* Fatal errors.
247	*
248	* @param pVM The VM handle.
249	* @param pCpu The disassembler cpu state for the instruction to be interpreted.
250	* @param pRegFrame The register frame. EIP is NOT changed!
251	* @param pvFault The fault address (CR2).
252	* @param pcbSize Size of the write (if applicable).
253	*
254	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
255	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
256	* to worry about e.g. invalid modrm combinations (!)
257	*
258	* @todo At this time we do NOT check if the instruction overwrites vital information.
259	* Make sure this can't happen!! (will add some assertions/checks later)
260	*/
261	VMMDECL(int) EMInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
262	{
263	STAM_PROFILE_START(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
264	int rc = emInterpretInstructionCPU(pVM, pCpu, pRegFrame, pvFault, pcbSize);
265	STAM_PROFILE_STOP(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
266	if (RT_SUCCESS(rc))
267	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
268	else
269	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
270	return rc;
271	}
272
273
274	/**
275	* Interpret a port I/O instruction.
276	*
277	* @returns VBox status code suitable for scheduling.
278	* @param pVM The VM handle.
279	* @param pCtxCore The context core. This will be updated on successful return.
280	* @param pCpu The instruction to interpret.
281	* @param cbOp The size of the instruction.
282	* @remark This may raise exceptions.
283	*/
284	VMMDECL(int) EMInterpretPortIO(PVM pVM, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, uint32_t cbOp)
285	{
286	/*
287	* Hand it on to IOM.
288	*/
289	#ifdef IN_RC
290	int rc = IOMGCIOPortHandler(pVM, pCtxCore, pCpu);
291	if (IOM_SUCCESS(rc))
292	pCtxCore->rip += cbOp;
293	return rc;
294	#else
295	AssertReleaseMsgFailed(("not implemented\n"));
296	return VERR_NOT_IMPLEMENTED;
297	#endif
298	}
299
300
301	DECLINLINE(int) emRamRead(PVM pVM, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
302	{
303	#ifdef IN_RC
304	int rc = MMGCRamRead(pVM, pvDst, (void *)GCPtrSrc, cb);
305	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
306	return rc;
307	/*
308	* The page pool cache may end up here in some cases because it
309	* flushed one of the shadow mappings used by the trapping
310	* instruction and it either flushed the TLB or the CPU reused it.
311	*/
312	#endif
313	#ifdef VBOX_WITH_NEW_PHYS_CODE
314	return PGMPhysInterpretedReadNoHandlers(pVM, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
315	#else
316	NOREF(pCtxCore);
317	# ifdef IN_RC
318	RTGCPHYS GCPhys;
319	rc = PGMPhysGCPtr2GCPhys(pVM, GCPtrSrc, &GCPhys);
320	AssertRCReturn(rc, rc);
321	PGMPhysRead(pVM, GCPhys, pvDst, cb);
322	return VINF_SUCCESS;
323	# else
324	return PGMPhysReadGCPtr(pVM, pvDst, GCPtrSrc, cb);
325	# endif
326	#endif
327	}
328
329
330	DECLINLINE(int) emRamWrite(PVM pVM, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
331	{
332	#ifdef IN_RC
333	int rc = MMGCRamWrite(pVM, (void )(uintptr_t)GCPtrDst, (void )pvSrc, cb);
334	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
335	return rc;
336	/*
337	* The page pool cache may end up here in some cases because it
338	* flushed one of the shadow mappings used by the trapping
339	* instruction and it either flushed the TLB or the CPU reused it.
340	* We want to play safe here, verifying that we've got write
341	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
342	*/
343	#endif
344	#ifdef VBOX_WITH_NEW_PHYS_CODE
345	return PGMPhysInterpretedWriteNoHandlers(pVM, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
346	#else
347	NOREF(pCtxCore);
348	# ifdef IN_RC
349	uint64_t fFlags;
350	RTGCPHYS GCPhys;
351	rc = PGMGstGetPage(pVM, GCPtrDst, &fFlags, &GCPhys);
352	if (RT_FAILURE(rc))
353	return rc;
354	if ( !(fFlags & X86_PTE_RW)
355	&& (CPUMGetGuestCR0(pVM) & X86_CR0_WP))
356	return VERR_ACCESS_DENIED;
357
358	PGMPhysWrite(pVM, GCPhys + ((RTGCUINTPTR)GCPtrDst & PAGE_OFFSET_MASK), pvSrc, cb);
359	return VINF_SUCCESS;
360	# else
361	return PGMPhysWriteGCPtr(pVM, GCPtrDst, pvSrc, cb);
362	# endif
363	#endif
364	}
365
366
367	/** Convert sel:addr to a flat GC address. */
368	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, POP_PARAMETER pParam, RTGCPTR pvAddr)
369	{
370	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pCpu, pParam);
371	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
372	}
373
374
375	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
376	/**
377	* Get the mnemonic for the disassembled instruction.
378	*
379	* GC/R0 doesn't include the strings in the DIS tables because
380	* of limited space.
381	*/
382	static const char *emGetMnemonic(PDISCPUSTATE pCpu)
383	{
384	switch (pCpu->pCurInstr->opcode)
385	{
386	case OP_XCHG: return "Xchg";
387	case OP_DEC: return "Dec";
388	case OP_INC: return "Inc";
389	case OP_POP: return "Pop";
390	case OP_OR: return "Or";
391	case OP_AND: return "And";
392	case OP_MOV: return "Mov";
393	case OP_INVLPG: return "InvlPg";
394	case OP_CPUID: return "CpuId";
395	case OP_MOV_CR: return "MovCRx";
396	case OP_MOV_DR: return "MovDRx";
397	case OP_LLDT: return "LLdt";
398	case OP_LGDT: return "LGdt";
399	case OP_LIDT: return "LGdt";
400	case OP_CLTS: return "Clts";
401	case OP_MONITOR: return "Monitor";
402	case OP_MWAIT: return "MWait";
403	case OP_RDMSR: return "Rdmsr";
404	case OP_WRMSR: return "Wrmsr";
405	case OP_ADD: return "Add";
406	case OP_ADC: return "Adc";
407	case OP_SUB: return "Sub";
408	case OP_SBB: return "Sbb";
409	case OP_RDTSC: return "Rdtsc";
410	case OP_STI: return "Sti";
411	case OP_CLI: return "Cli";
412	case OP_XADD: return "XAdd";
413	case OP_HLT: return "Hlt";
414	case OP_IRET: return "Iret";
415	case OP_MOVNTPS: return "MovNTPS";
416	case OP_STOSWD: return "StosWD";
417	case OP_WBINVD: return "WbInvd";
418	case OP_XOR: return "Xor";
419	case OP_BTR: return "Btr";
420	case OP_BTS: return "Bts";
421	case OP_BTC: return "Btc";
422	case OP_LMSW: return "Lmsw";
423	case OP_SMSW: return "Smsw";
424	case OP_CMPXCHG: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
425	case OP_CMPXCHG8B: return pCpu->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
426
427	default:
428	Log(("Unknown opcode %d\n", pCpu->pCurInstr->opcode));
429	return "???";
430	}
431	}
432	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
433
434
435	/**
436	* XCHG instruction emulation.
437	*/
438	static int emInterpretXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
439	{
440	OP_PARAMVAL param1, param2;
441
442	/* Source to make DISQueryParamVal read the register value - ugly hack */
443	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
444	if(RT_FAILURE(rc))
445	return VERR_EM_INTERPRETER;
446
447	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
448	if(RT_FAILURE(rc))
449	return VERR_EM_INTERPRETER;
450
451	#ifdef IN_RC
452	if (TRPMHasTrap(pVM))
453	{
454	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
455	{
456	#endif
457	RTGCPTR pParam1 = 0, pParam2 = 0;
458	uint64_t valpar1, valpar2;
459
460	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
461	switch(param1.type)
462	{
463	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
464	valpar1 = param1.val.val64;
465	break;
466
467	case PARMTYPE_ADDRESS:
468	pParam1 = (RTGCPTR)param1.val.val64;
469	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
470	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
471	rc = emRamRead(pVM, pRegFrame, &valpar1, pParam1, param1.size);
472	if (RT_FAILURE(rc))
473	{
474	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
475	return VERR_EM_INTERPRETER;
476	}
477	break;
478
479	default:
480	AssertFailed();
481	return VERR_EM_INTERPRETER;
482	}
483
484	switch(param2.type)
485	{
486	case PARMTYPE_ADDRESS:
487	pParam2 = (RTGCPTR)param2.val.val64;
488	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pParam2);
489	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
490	rc = emRamRead(pVM, pRegFrame, &valpar2, pParam2, param2.size);
491	if (RT_FAILURE(rc))
492	{
493	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
494	}
495	break;
496
497	case PARMTYPE_IMMEDIATE:
498	valpar2 = param2.val.val64;
499	break;
500
501	default:
502	AssertFailed();
503	return VERR_EM_INTERPRETER;
504	}
505
506	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
507	if (pParam1 == 0)
508	{
509	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
510	switch(param1.size)
511	{
512	case 1: //special case for AH etc
513	rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t )valpar2); break;
514	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)valpar2); break;
515	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)valpar2); break;
516	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, valpar2); break;
517	default: AssertFailedReturn(VERR_EM_INTERPRETER);
518	}
519	if (RT_FAILURE(rc))
520	return VERR_EM_INTERPRETER;
521	}
522	else
523	{
524	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar2, param1.size);
525	if (RT_FAILURE(rc))
526	{
527	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
528	return VERR_EM_INTERPRETER;
529	}
530	}
531
532	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
533	if (pParam2 == 0)
534	{
535	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
536	switch(param2.size)
537	{
538	case 1: //special case for AH etc
539	rc = DISWriteReg8(pRegFrame, pCpu->param2.base.reg_gen, (uint8_t )valpar1); break;
540	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param2.base.reg_gen, (uint16_t)valpar1); break;
541	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param2.base.reg_gen, (uint32_t)valpar1); break;
542	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param2.base.reg_gen, valpar1); break;
543	default: AssertFailedReturn(VERR_EM_INTERPRETER);
544	}
545	if (RT_FAILURE(rc))
546	return VERR_EM_INTERPRETER;
547	}
548	else
549	{
550	rc = emRamWrite(pVM, pRegFrame, pParam2, &valpar1, param2.size);
551	if (RT_FAILURE(rc))
552	{
553	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
554	return VERR_EM_INTERPRETER;
555	}
556	}
557
558	*pcbSize = param2.size;
559	return VINF_SUCCESS;
560	#ifdef IN_RC
561	}
562	}
563	#endif
564	return VERR_EM_INTERPRETER;
565	}
566
567
568	/**
569	* INC and DEC emulation.
570	*/
571	static int emInterpretIncDec(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
572	PFNEMULATEPARAM2 pfnEmulate)
573	{
574	OP_PARAMVAL param1;
575
576	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
577	if(RT_FAILURE(rc))
578	return VERR_EM_INTERPRETER;
579
580	#ifdef IN_RC
581	if (TRPMHasTrap(pVM))
582	{
583	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
584	{
585	#endif
586	RTGCPTR pParam1 = 0;
587	uint64_t valpar1;
588
589	if (param1.type == PARMTYPE_ADDRESS)
590	{
591	pParam1 = (RTGCPTR)param1.val.val64;
592	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
593	#ifdef IN_RC
594	/* Safety check (in theory it could cross a page boundary and fault there though) */
595	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
596	#endif
597	rc = emRamRead(pVM, pRegFrame, &valpar1, pParam1, param1.size);
598	if (RT_FAILURE(rc))
599	{
600	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
601	return VERR_EM_INTERPRETER;
602	}
603	}
604	else
605	{
606	AssertFailed();
607	return VERR_EM_INTERPRETER;
608	}
609
610	uint32_t eflags;
611
612	eflags = pfnEmulate(&valpar1, param1.size);
613
614	/* Write result back */
615	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar1, param1.size);
616	if (RT_FAILURE(rc))
617	{
618	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
619	return VERR_EM_INTERPRETER;
620	}
621
622	/* Update guest's eflags and finish. */
623	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
624	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
625
626	/* All done! */
627	*pcbSize = param1.size;
628	return VINF_SUCCESS;
629	#ifdef IN_RC
630	}
631	}
632	#endif
633	return VERR_EM_INTERPRETER;
634	}
635
636
637	/**
638	* POP Emulation.
639	*/
640	static int emInterpretPop(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
641	{
642	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
643	OP_PARAMVAL param1;
644	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
645	if(RT_FAILURE(rc))
646	return VERR_EM_INTERPRETER;
647
648	#ifdef IN_RC
649	if (TRPMHasTrap(pVM))
650	{
651	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
652	{
653	#endif
654	RTGCPTR pParam1 = 0;
655	uint32_t valpar1;
656	RTGCPTR pStackVal;
657
658	/* Read stack value first */
659	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
660	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
661
662	/* Convert address; don't bother checking limits etc, as we only read here */
663	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
664	if (pStackVal == 0)
665	return VERR_EM_INTERPRETER;
666
667	rc = emRamRead(pVM, pRegFrame, &valpar1, pStackVal, param1.size);
668	if (RT_FAILURE(rc))
669	{
670	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
671	return VERR_EM_INTERPRETER;
672	}
673
674	if (param1.type == PARMTYPE_ADDRESS)
675	{
676	pParam1 = (RTGCPTR)param1.val.val64;
677
678	/* pop [esp+xx] uses esp after the actual pop! */
679	AssertCompile(USE_REG_ESP == USE_REG_SP);
680	if ( (pCpu->param1.flags & USE_BASE)
681	&& (pCpu->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
682	&& pCpu->param1.base.reg_gen == USE_REG_ESP
683	)
684	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
685
686	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
687	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
688	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar1, param1.size);
689	if (RT_FAILURE(rc))
690	{
691	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
692	return VERR_EM_INTERPRETER;
693	}
694
695	/* Update ESP as the last step */
696	pRegFrame->esp += param1.size;
697	}
698	else
699	{
700	#ifndef DEBUG_bird // annoying assertion.
701	AssertFailed();
702	#endif
703	return VERR_EM_INTERPRETER;
704	}
705
706	/* All done! */
707	*pcbSize = param1.size;
708	return VINF_SUCCESS;
709	#ifdef IN_RC
710	}
711	}
712	#endif
713	return VERR_EM_INTERPRETER;
714	}
715
716
717	/**
718	* XOR/OR/AND Emulation.
719	*/
720	static int emInterpretOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
721	PFNEMULATEPARAM3 pfnEmulate)
722	{
723	OP_PARAMVAL param1, param2;
724
725	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
726	if(RT_FAILURE(rc))
727	return VERR_EM_INTERPRETER;
728
729	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
730	if(RT_FAILURE(rc))
731	return VERR_EM_INTERPRETER;
732
733	#ifdef IN_RC
734	if (TRPMHasTrap(pVM))
735	{
736	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
737	{
738	#endif
739	RTGCPTR pParam1;
740	uint64_t valpar1, valpar2;
741
742	if (pCpu->param1.size != pCpu->param2.size)
743	{
744	if (pCpu->param1.size < pCpu->param2.size)
745	{
746	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), (RTGCPTR)pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
747	return VERR_EM_INTERPRETER;
748	}
749	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
750	pCpu->param2.size = pCpu->param1.size;
751	param2.size = param1.size;
752	}
753
754	/* The destination is always a virtual address */
755	if (param1.type == PARMTYPE_ADDRESS)
756	{
757	pParam1 = (RTGCPTR)param1.val.val64;
758	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
759	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
760	rc = emRamRead(pVM, pRegFrame, &valpar1, pParam1, param1.size);
761	if (RT_FAILURE(rc))
762	{
763	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
764	return VERR_EM_INTERPRETER;
765	}
766	}
767	else
768	{
769	AssertFailed();
770	return VERR_EM_INTERPRETER;
771	}
772
773	/* Register or immediate data */
774	switch(param2.type)
775	{
776	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
777	valpar2 = param2.val.val64;
778	break;
779
780	default:
781	AssertFailed();
782	return VERR_EM_INTERPRETER;
783	}
784
785	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pCpu), pParam1, valpar1, valpar2, param2.size, param1.size));
786
787	/* Data read, emulate instruction. */
788	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
789
790	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pCpu), valpar1));
791
792	/* Update guest's eflags and finish. */
793	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
794	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
795
796	/* And write it back */
797	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar1, param1.size);
798	if (RT_SUCCESS(rc))
799	{
800	/* All done! */
801	*pcbSize = param2.size;
802	return VINF_SUCCESS;
803	}
804	#ifdef IN_RC
805	}
806	}
807	#endif
808	return VERR_EM_INTERPRETER;
809	}
810
811
812	/**
813	* LOCK XOR/OR/AND Emulation.
814	*/
815	static int emInterpretLockOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
816	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
817	{
818	void *pvParam1;
819	OP_PARAMVAL param1, param2;
820
821	#if HC_ARCH_BITS == 32
822	Assert(pCpu->param1.size <= 4);
823	#endif
824
825	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
826	if(RT_FAILURE(rc))
827	return VERR_EM_INTERPRETER;
828
829	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
830	if(RT_FAILURE(rc))
831	return VERR_EM_INTERPRETER;
832
833	if (pCpu->param1.size != pCpu->param2.size)
834	{
835	AssertMsgReturn(pCpu->param1.size >= pCpu->param2.size, /* should never happen! */
836	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), (RTGCPTR)pRegFrame->rip, pCpu->param1.size, pCpu->param2.size),
837	VERR_EM_INTERPRETER);
838
839	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
840	pCpu->param2.size = pCpu->param1.size;
841	param2.size = param1.size;
842	}
843
844	#ifdef IN_RC
845	/* Safety check (in theory it could cross a page boundary and fault there though) */
846	Assert( TRPMHasTrap(pVM)
847	&& (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW));
848	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
849	#endif
850
851	/* Register and immediate data == PARMTYPE_IMMEDIATE */
852	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
853	RTGCUINTREG ValPar2 = param2.val.val64;
854
855	/* The destination is always a virtual address */
856	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
857
858	RTGCPTR GCPtrPar1 = param1.val.val64;
859	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
860	#ifdef IN_RC
861	pvParam1 = (void *)GCPtrPar1;
862	#else
863	PGMPAGEMAPLOCK Lock;
864	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrPar1, &pvParam1, &Lock);
865	AssertRCReturn(rc, VERR_EM_INTERPRETER);
866	#endif
867
868	/* Try emulate it with a one-shot #PF handler in place. (RC) */
869	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
870
871	RTGCUINTREG32 eflags = 0;
872	#ifdef IN_RC
873	MMGCRamRegisterTrapHandler(pVM);
874	#endif
875	rc = pfnEmulate(pvParam1, ValPar2, pCpu->param2.size, &eflags);
876	#ifdef IN_RC
877	MMGCRamDeregisterTrapHandler(pVM);
878	#else
879	PGMPhysReleasePageMappingLock(pVM, &Lock);
880	#endif
881	if (RT_FAILURE(rc))
882	{
883	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
884	return VERR_EM_INTERPRETER;
885	}
886
887	/* Update guest's eflags and finish. */
888	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
889	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
890
891	*pcbSize = param2.size;
892	return VINF_SUCCESS;
893	}
894
895
896	/**
897	* ADD, ADC & SUB Emulation.
898	*/
899	static int emInterpretAddSub(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
900	PFNEMULATEPARAM3 pfnEmulate)
901	{
902	OP_PARAMVAL param1, param2;
903	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
904	if(RT_FAILURE(rc))
905	return VERR_EM_INTERPRETER;
906
907	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
908	if(RT_FAILURE(rc))
909	return VERR_EM_INTERPRETER;
910
911	#ifdef IN_RC
912	if (TRPMHasTrap(pVM))
913	{
914	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
915	{
916	#endif
917	RTGCPTR pParam1;
918	uint64_t valpar1, valpar2;
919
920	if (pCpu->param1.size != pCpu->param2.size)
921	{
922	if (pCpu->param1.size < pCpu->param2.size)
923	{
924	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), (RTGCPTR)pRegFrame->rip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
925	return VERR_EM_INTERPRETER;
926	}
927	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
928	pCpu->param2.size = pCpu->param1.size;
929	param2.size = param1.size;
930	}
931
932	/* The destination is always a virtual address */
933	if (param1.type == PARMTYPE_ADDRESS)
934	{
935	pParam1 = (RTGCPTR)param1.val.val64;
936	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
937	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
938	rc = emRamRead(pVM, pRegFrame, &valpar1, pParam1, param1.size);
939	if (RT_FAILURE(rc))
940	{
941	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
942	return VERR_EM_INTERPRETER;
943	}
944	}
945	else
946	{
947	#ifndef DEBUG_bird
948	AssertFailed();
949	#endif
950	return VERR_EM_INTERPRETER;
951	}
952
953	/* Register or immediate data */
954	switch(param2.type)
955	{
956	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
957	valpar2 = param2.val.val64;
958	break;
959
960	default:
961	AssertFailed();
962	return VERR_EM_INTERPRETER;
963	}
964
965	/* Data read, emulate instruction. */
966	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
967
968	/* Update guest's eflags and finish. */
969	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
970	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
971
972	/* And write it back */
973	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar1, param1.size);
974	if (RT_SUCCESS(rc))
975	{
976	/* All done! */
977	*pcbSize = param2.size;
978	return VINF_SUCCESS;
979	}
980	#ifdef IN_RC
981	}
982	}
983	#endif
984	return VERR_EM_INTERPRETER;
985	}
986
987
988	/**
989	* ADC Emulation.
990	*/
991	static int emInterpretAdc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
992	{
993	if (pRegFrame->eflags.Bits.u1CF)
994	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
995	else
996	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
997	}
998
999
1000	/**
1001	* BTR/C/S Emulation.
1002	*/
1003	static int emInterpretBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1004	PFNEMULATEPARAM2UINT32 pfnEmulate)
1005	{
1006	OP_PARAMVAL param1, param2;
1007	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1008	if(RT_FAILURE(rc))
1009	return VERR_EM_INTERPRETER;
1010
1011	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1012	if(RT_FAILURE(rc))
1013	return VERR_EM_INTERPRETER;
1014
1015	#ifdef IN_RC
1016	if (TRPMHasTrap(pVM))
1017	{
1018	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1019	{
1020	#endif
1021	RTGCPTR pParam1;
1022	uint64_t valpar1 = 0, valpar2;
1023	uint32_t eflags;
1024
1025	/* The destination is always a virtual address */
1026	if (param1.type != PARMTYPE_ADDRESS)
1027	return VERR_EM_INTERPRETER;
1028
1029	pParam1 = (RTGCPTR)param1.val.val64;
1030	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
1031
1032	/* Register or immediate data */
1033	switch(param2.type)
1034	{
1035	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1036	valpar2 = param2.val.val64;
1037	break;
1038
1039	default:
1040	AssertFailed();
1041	return VERR_EM_INTERPRETER;
1042	}
1043
1044	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pCpu), pvFault, pParam1, valpar2));
1045	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1046	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1047	rc = emRamRead(pVM, pRegFrame, &valpar1, pParam1, 1);
1048	if (RT_FAILURE(rc))
1049	{
1050	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1051	return VERR_EM_INTERPRETER;
1052	}
1053
1054	Log2(("emInterpretBtx: val=%x\n", valpar1));
1055	/* Data read, emulate bit test instruction. */
1056	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1057
1058	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1059
1060	/* Update guest's eflags and finish. */
1061	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1062	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1063
1064	/* And write it back */
1065	rc = emRamWrite(pVM, pRegFrame, pParam1, &valpar1, 1);
1066	if (RT_SUCCESS(rc))
1067	{
1068	/* All done! */
1069	*pcbSize = 1;
1070	return VINF_SUCCESS;
1071	}
1072	#ifdef IN_RC
1073	}
1074	}
1075	#endif
1076	return VERR_EM_INTERPRETER;
1077	}
1078
1079
1080	/**
1081	* LOCK BTR/C/S Emulation.
1082	*/
1083	static int emInterpretLockBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1084	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1085	{
1086	void *pvParam1;
1087
1088	OP_PARAMVAL param1, param2;
1089	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1090	if(RT_FAILURE(rc))
1091	return VERR_EM_INTERPRETER;
1092
1093	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1094	if(RT_FAILURE(rc))
1095	return VERR_EM_INTERPRETER;
1096
1097	/* The destination is always a virtual address */
1098	if (param1.type != PARMTYPE_ADDRESS)
1099	return VERR_EM_INTERPRETER;
1100
1101	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1102	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1103	uint64_t ValPar2 = param2.val.val64;
1104
1105	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1106	RTGCPTR GCPtrPar1 = param1.val.val64;
1107	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1108	ValPar2 &= 7;
1109
1110	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1111	#ifdef IN_RC
1112	Assert(TRPMHasTrap(pVM));
1113	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1114	#endif
1115
1116	#ifdef IN_RC
1117	pvParam1 = (void *)GCPtrPar1;
1118	#else
1119	PGMPAGEMAPLOCK Lock;
1120	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrPar1, &pvParam1, &Lock);
1121	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1122	#endif
1123
1124	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pCpu), pvFault, GCPtrPar1, ValPar2));
1125
1126	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1127	RTGCUINTREG32 eflags = 0;
1128	#ifdef IN_RC
1129	MMGCRamRegisterTrapHandler(pVM);
1130	#endif
1131	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1132	#ifdef IN_RC
1133	MMGCRamDeregisterTrapHandler(pVM);
1134	#else
1135	PGMPhysReleasePageMappingLock(pVM, &Lock);
1136	#endif
1137	if (RT_FAILURE(rc))
1138	{
1139	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1140	emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
1141	return VERR_EM_INTERPRETER;
1142	}
1143
1144	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1145
1146	/* Update guest's eflags and finish. */
1147	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1148	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1149
1150	*pcbSize = 1;
1151	return VINF_SUCCESS;
1152	}
1153
1154
1155	/**
1156	* MOV emulation.
1157	*/
1158	static int emInterpretMov(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1159	{
1160	OP_PARAMVAL param1, param2;
1161	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1162	if(RT_FAILURE(rc))
1163	return VERR_EM_INTERPRETER;
1164
1165	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1166	if(RT_FAILURE(rc))
1167	return VERR_EM_INTERPRETER;
1168
1169	#ifdef IN_RC
1170	if (TRPMHasTrap(pVM))
1171	{
1172	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1173	{
1174	#else
1175	/** @todo Make this the default and don't rely on TRPM information. */
1176	if (param1.type == PARMTYPE_ADDRESS)
1177	{
1178	#endif
1179	RTGCPTR pDest;
1180	uint64_t val64;
1181
1182	switch(param1.type)
1183	{
1184	case PARMTYPE_IMMEDIATE:
1185	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1186	return VERR_EM_INTERPRETER;
1187	/* fallthru */
1188
1189	case PARMTYPE_ADDRESS:
1190	pDest = (RTGCPTR)param1.val.val64;
1191	pDest = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pDest);
1192	break;
1193
1194	default:
1195	AssertFailed();
1196	return VERR_EM_INTERPRETER;
1197	}
1198
1199	switch(param2.type)
1200	{
1201	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1202	val64 = param2.val.val64;
1203	break;
1204
1205	default:
1206	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1207	return VERR_EM_INTERPRETER;
1208	}
1209	#ifdef LOG_ENABLED
1210	if (pCpu->mode == CPUMODE_64BIT)
1211	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1212	else
1213	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1214	#endif
1215
1216	Assert(param2.size <= 8 && param2.size > 0);
1217	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1218	rc = emRamWrite(pVM, pRegFrame, pDest, &val64, param2.size);
1219	if (RT_FAILURE(rc))
1220	return VERR_EM_INTERPRETER;
1221
1222	*pcbSize = param2.size;
1223	}
1224	else
1225	{ /* read fault */
1226	RTGCPTR pSrc;
1227	uint64_t val64;
1228
1229	/* Source */
1230	switch(param2.type)
1231	{
1232	case PARMTYPE_IMMEDIATE:
1233	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1234	return VERR_EM_INTERPRETER;
1235	/* fallthru */
1236
1237	case PARMTYPE_ADDRESS:
1238	pSrc = (RTGCPTR)param2.val.val64;
1239	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pSrc);
1240	break;
1241
1242	default:
1243	return VERR_EM_INTERPRETER;
1244	}
1245
1246	Assert(param1.size <= 8 && param1.size > 0);
1247	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1248	rc = emRamRead(pVM, pRegFrame, &val64, pSrc, param1.size);
1249	if (RT_FAILURE(rc))
1250	return VERR_EM_INTERPRETER;
1251
1252	/* Destination */
1253	switch(param1.type)
1254	{
1255	case PARMTYPE_REGISTER:
1256	switch(param1.size)
1257	{
1258	case 1: rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t) val64); break;
1259	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)val64); break;
1260	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, (uint32_t)val64); break;
1261	case 8: rc = DISWriteReg64(pRegFrame, pCpu->param1.base.reg_gen, val64); break;
1262	default:
1263	return VERR_EM_INTERPRETER;
1264	}
1265	if (RT_FAILURE(rc))
1266	return rc;
1267	break;
1268
1269	default:
1270	return VERR_EM_INTERPRETER;
1271	}
1272	#ifdef LOG_ENABLED
1273	if (pCpu->mode == CPUMODE_64BIT)
1274	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1275	else
1276	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1277	#endif
1278	}
1279	return VINF_SUCCESS;
1280	#ifdef IN_RC
1281	}
1282	#endif
1283	return VERR_EM_INTERPRETER;
1284	}
1285
1286
1287	#ifndef IN_RC
1288	/**
1289	* [REP] STOSWD emulation
1290	*/
1291	static int emInterpretStosWD(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1292	{
1293	int rc;
1294	RTGCPTR GCDest, GCOffset;
1295	uint32_t cbSize;
1296	uint64_t cTransfers;
1297	int offIncrement;
1298
1299	/* Don't support any but these three prefix bytes. */
1300	if ((pCpu->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1301	return VERR_EM_INTERPRETER;
1302
1303	switch (pCpu->addrmode)
1304	{
1305	case CPUMODE_16BIT:
1306	GCOffset = pRegFrame->di;
1307	cTransfers = pRegFrame->cx;
1308	break;
1309	case CPUMODE_32BIT:
1310	GCOffset = pRegFrame->edi;
1311	cTransfers = pRegFrame->ecx;
1312	break;
1313	case CPUMODE_64BIT:
1314	GCOffset = pRegFrame->rdi;
1315	cTransfers = pRegFrame->rcx;
1316	break;
1317	default:
1318	AssertFailed();
1319	return VERR_EM_INTERPRETER;
1320	}
1321
1322	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1323	switch (pCpu->opmode)
1324	{
1325	case CPUMODE_16BIT:
1326	cbSize = 2;
1327	break;
1328	case CPUMODE_32BIT:
1329	cbSize = 4;
1330	break;
1331	case CPUMODE_64BIT:
1332	cbSize = 8;
1333	break;
1334	default:
1335	AssertFailed();
1336	return VERR_EM_INTERPRETER;
1337	}
1338
1339	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1340
1341	if (!(pCpu->prefix & PREFIX_REP))
1342	{
1343	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1344
1345	#ifdef VBOX_WITH_NEW_PHYS_CODE
1346	rc = emRamWrite(pVM, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1347	#else
1348	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1349	#endif
1350	if (RT_FAILURE(rc))
1351	return VERR_EM_INTERPRETER;
1352	Assert(rc == VINF_SUCCESS);
1353
1354	/* Update (e/r)di. */
1355	switch (pCpu->addrmode)
1356	{
1357	case CPUMODE_16BIT:
1358	pRegFrame->di += offIncrement;
1359	break;
1360	case CPUMODE_32BIT:
1361	pRegFrame->edi += offIncrement;
1362	break;
1363	case CPUMODE_64BIT:
1364	pRegFrame->rdi += offIncrement;
1365	break;
1366	default:
1367	AssertFailed();
1368	return VERR_EM_INTERPRETER;
1369	}
1370
1371	}
1372	else
1373	{
1374	if (!cTransfers)
1375	return VINF_SUCCESS;
1376
1377	/*
1378	* Do not try emulate cross page stuff here because we don't know what might
1379	* be waiting for us on the subsequent pages. The caller has only asked us to
1380	* ignore access handlers fro the current page.
1381	* This also fends off big stores which would quickly kill PGMR0DynMap.
1382	*/
1383	if ( cbSize > PAGE_SIZE
1384	\|\| cTransfers > PAGE_SIZE
1385	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1386	{
1387	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1388	GCDest, cbSize, offIncrement, cTransfers));
1389	return VERR_EM_INTERPRETER;
1390	}
1391
1392	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1393	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1394	rc = PGMVerifyAccess(pVM, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1395	cTransfers * cbSize,
1396	X86_PTE_RW \| (CPUMGetGuestCPL(pVM, pRegFrame) == 3 ? X86_PTE_US : 0));
1397	if (rc != VINF_SUCCESS)
1398	{
1399	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1400	return VERR_EM_INTERPRETER;
1401	}
1402
1403	/* REP case */
1404	while (cTransfers)
1405	{
1406	#ifdef VBOX_WITH_NEW_PHYS_CODE
1407	rc = emRamWrite(pVM, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1408	#else
1409	rc = PGMPhysWriteGCPtr(pVM, GCDest, &pRegFrame->rax, cbSize);
1410	#endif
1411	if (RT_FAILURE(rc))
1412	{
1413	rc = VERR_EM_INTERPRETER;
1414	break;
1415	}
1416
1417	Assert(rc == VINF_SUCCESS);
1418	GCOffset += offIncrement;
1419	GCDest += offIncrement;
1420	cTransfers--;
1421	}
1422
1423	/* Update the registers. */
1424	switch (pCpu->addrmode)
1425	{
1426	case CPUMODE_16BIT:
1427	pRegFrame->di = GCOffset;
1428	pRegFrame->cx = cTransfers;
1429	break;
1430	case CPUMODE_32BIT:
1431	pRegFrame->edi = GCOffset;
1432	pRegFrame->ecx = cTransfers;
1433	break;
1434	case CPUMODE_64BIT:
1435	pRegFrame->rdi = GCOffset;
1436	pRegFrame->rcx = cTransfers;
1437	break;
1438	default:
1439	AssertFailed();
1440	return VERR_EM_INTERPRETER;
1441	}
1442	}
1443
1444	*pcbSize = cbSize;
1445	return rc;
1446	}
1447	#endif /* !IN_RC */
1448
1449	#ifndef IN_RC
1450
1451	/**
1452	* [LOCK] CMPXCHG emulation.
1453	*/
1454	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1455	{
1456	OP_PARAMVAL param1, param2;
1457
1458	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1459	Assert(pCpu->param1.size <= 4);
1460	#endif
1461
1462	/* Source to make DISQueryParamVal read the register value - ugly hack */
1463	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1464	if(RT_FAILURE(rc))
1465	return VERR_EM_INTERPRETER;
1466
1467	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1468	if(RT_FAILURE(rc))
1469	return VERR_EM_INTERPRETER;
1470
1471	uint64_t valpar;
1472	switch(param2.type)
1473	{
1474	case PARMTYPE_IMMEDIATE: /* register actually */
1475	valpar = param2.val.val64;
1476	break;
1477
1478	default:
1479	return VERR_EM_INTERPRETER;
1480	}
1481
1482	PGMPAGEMAPLOCK Lock;
1483	RTGCPTR GCPtrPar1;
1484	void *pvParam1;
1485	uint64_t eflags;
1486
1487	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1488	switch(param1.type)
1489	{
1490	case PARMTYPE_ADDRESS:
1491	GCPtrPar1 = param1.val.val64;
1492	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1493
1494	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrPar1, &pvParam1, &Lock);
1495	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1496	break;
1497
1498	default:
1499	return VERR_EM_INTERPRETER;
1500	}
1501
1502	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar));
1503
1504	if (pCpu->prefix & PREFIX_LOCK)
1505	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1506	else
1507	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pCpu->param2.size);
1508
1509	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1510
1511	/* Update guest's eflags and finish. */
1512	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1513	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1514
1515	*pcbSize = param2.size;
1516	PGMPhysReleasePageMappingLock(pVM, &Lock);
1517	return VINF_SUCCESS;
1518	}
1519
1520
1521	/**
1522	* [LOCK] CMPXCHG8B emulation.
1523	*/
1524	static int emInterpretCmpXchg8b(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1525	{
1526	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1527	OP_PARAMVAL param1;
1528
1529	/* Source to make DISQueryParamVal read the register value - ugly hack */
1530	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1531	if(RT_FAILURE(rc))
1532	return VERR_EM_INTERPRETER;
1533
1534	RTGCPTR GCPtrPar1;
1535	void *pvParam1;
1536	uint64_t eflags;
1537	PGMPAGEMAPLOCK Lock;
1538
1539	AssertReturn(pCpu->param1.size == 8, VERR_EM_INTERPRETER);
1540	switch(param1.type)
1541	{
1542	case PARMTYPE_ADDRESS:
1543	GCPtrPar1 = param1.val.val64;
1544	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1545
1546	rc = PGMPhysGCPtr2CCPtr(pVM, GCPtrPar1, &pvParam1, &Lock);
1547	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1548	break;
1549
1550	default:
1551	return VERR_EM_INTERPRETER;
1552	}
1553
1554	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pCpu), pvParam1, pRegFrame->eax));
1555
1556	if (pCpu->prefix & PREFIX_LOCK)
1557	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1558	else
1559	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1560
1561	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pCpu), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1562
1563	/* Update guest's eflags and finish; note that only ZF is affected. */
1564	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1565	\| (eflags & (X86_EFL_ZF));
1566
1567	*pcbSize = 8;
1568	PGMPhysReleasePageMappingLock(pVM, &Lock);
1569	return VINF_SUCCESS;
1570	}
1571
1572	#else /* IN_RC */
1573
1574	/**
1575	* [LOCK] CMPXCHG emulation.
1576	*/
1577	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1578	{
1579	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1580	OP_PARAMVAL param1, param2;
1581
1582	/* Source to make DISQueryParamVal read the register value - ugly hack */
1583	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1584	if(RT_FAILURE(rc))
1585	return VERR_EM_INTERPRETER;
1586
1587	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1588	if(RT_FAILURE(rc))
1589	return VERR_EM_INTERPRETER;
1590
1591	if (TRPMHasTrap(pVM))
1592	{
1593	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1594	{
1595	RTRCPTR pParam1;
1596	uint32_t valpar, eflags;
1597
1598	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1599	switch(param1.type)
1600	{
1601	case PARMTYPE_ADDRESS:
1602	pParam1 = (RTRCPTR)param1.val.val64;
1603	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1604	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1605	break;
1606
1607	default:
1608	return VERR_EM_INTERPRETER;
1609	}
1610
1611	switch(param2.type)
1612	{
1613	case PARMTYPE_IMMEDIATE: /* register actually */
1614	valpar = param2.val.val32;
1615	break;
1616
1617	default:
1618	return VERR_EM_INTERPRETER;
1619	}
1620
1621	LogFlow(("%s %RRv eax=%08x %08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1622
1623	MMGCRamRegisterTrapHandler(pVM);
1624	if (pCpu->prefix & PREFIX_LOCK)
1625	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1626	else
1627	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1628	MMGCRamDeregisterTrapHandler(pVM);
1629
1630	if (RT_FAILURE(rc))
1631	{
1632	Log(("%s %RGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar));
1633	return VERR_EM_INTERPRETER;
1634	}
1635
1636	LogFlow(("%s %RRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1637
1638	/* Update guest's eflags and finish. */
1639	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1640	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1641
1642	*pcbSize = param2.size;
1643	return VINF_SUCCESS;
1644	}
1645	}
1646	return VERR_EM_INTERPRETER;
1647	}
1648
1649
1650	/**
1651	* [LOCK] CMPXCHG8B emulation.
1652	*/
1653	static int emInterpretCmpXchg8b(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1654	{
1655	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1656	OP_PARAMVAL param1;
1657
1658	/* Source to make DISQueryParamVal read the register value - ugly hack */
1659	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1660	if(RT_FAILURE(rc))
1661	return VERR_EM_INTERPRETER;
1662
1663	if (TRPMHasTrap(pVM))
1664	{
1665	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1666	{
1667	RTRCPTR pParam1;
1668	uint32_t eflags;
1669
1670	AssertReturn(pCpu->param1.size == 8, VERR_EM_INTERPRETER);
1671	switch(param1.type)
1672	{
1673	case PARMTYPE_ADDRESS:
1674	pParam1 = (RTRCPTR)param1.val.val64;
1675	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1676	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1677	break;
1678
1679	default:
1680	return VERR_EM_INTERPRETER;
1681	}
1682
1683	LogFlow(("%s %RRv=%08x eax=%08x\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1684
1685	MMGCRamRegisterTrapHandler(pVM);
1686	if (pCpu->prefix & PREFIX_LOCK)
1687	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1688	else
1689	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1690	MMGCRamDeregisterTrapHandler(pVM);
1691
1692	if (RT_FAILURE(rc))
1693	{
1694	Log(("%s %RGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax));
1695	return VERR_EM_INTERPRETER;
1696	}
1697
1698	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pCpu), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1699
1700	/* Update guest's eflags and finish; note that only ZF is affected. */
1701	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1702	\| (eflags & (X86_EFL_ZF));
1703
1704	*pcbSize = 8;
1705	return VINF_SUCCESS;
1706	}
1707	}
1708	return VERR_EM_INTERPRETER;
1709	}
1710
1711	#endif /* IN_RC */
1712
1713	#ifdef IN_RC
1714	/**
1715	* [LOCK] XADD emulation.
1716	*/
1717	static int emInterpretXAdd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1718	{
1719	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
1720	OP_PARAMVAL param1;
1721	uint32_t *pParamReg2;
1722	size_t cbSizeParamReg2;
1723
1724	/* Source to make DISQueryParamVal read the register value - ugly hack */
1725	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1726	if(RT_FAILURE(rc))
1727	return VERR_EM_INTERPRETER;
1728
1729	rc = DISQueryParamRegPtr(pRegFrame, pCpu, &pCpu->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1730	Assert(cbSizeParamReg2 <= 4);
1731	if(RT_FAILURE(rc))
1732	return VERR_EM_INTERPRETER;
1733
1734	if (TRPMHasTrap(pVM))
1735	{
1736	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1737	{
1738	RTRCPTR pParam1;
1739	uint32_t eflags;
1740
1741	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1742	switch(param1.type)
1743	{
1744	case PARMTYPE_ADDRESS:
1745	pParam1 = (RTRCPTR)param1.val.val64;
1746	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1747	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1748	break;
1749
1750	default:
1751	return VERR_EM_INTERPRETER;
1752	}
1753
1754	LogFlow(("XAdd %RRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1755
1756	MMGCRamRegisterTrapHandler(pVM);
1757	if (pCpu->prefix & PREFIX_LOCK)
1758	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1759	else
1760	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1761	MMGCRamDeregisterTrapHandler(pVM);
1762
1763	if (RT_FAILURE(rc))
1764	{
1765	Log(("XAdd %RGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1766	return VERR_EM_INTERPRETER;
1767	}
1768
1769	LogFlow(("XAdd %RGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1770
1771	/* Update guest's eflags and finish. */
1772	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1773	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1774
1775	*pcbSize = cbSizeParamReg2;
1776	return VINF_SUCCESS;
1777	}
1778	}
1779	return VERR_EM_INTERPRETER;
1780	}
1781	#endif /* IN_RC */
1782
1783
1784	#ifdef IN_RC
1785	/**
1786	* Interpret IRET (currently only to V86 code)
1787	*
1788	* @returns VBox status code.
1789	* @param pVM The VM handle.
1790	* @param pRegFrame The register frame.
1791	*
1792	*/
1793	VMMDECL(int) EMInterpretIret(PVM pVM, PCPUMCTXCORE pRegFrame)
1794	{
1795	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1796	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1797	int rc;
1798
1799	Assert(!CPUMIsGuestIn64BitCode(pVM, pRegFrame));
1800
1801	rc = emRamRead(pVM, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1802	rc \|= emRamRead(pVM, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1803	rc \|= emRamRead(pVM, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1804	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1805	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1806
1807	rc \|= emRamRead(pVM, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1808	rc \|= emRamRead(pVM, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1809	rc \|= emRamRead(pVM, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1810	rc \|= emRamRead(pVM, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1811	rc \|= emRamRead(pVM, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1812	rc \|= emRamRead(pVM, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1813	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1814
1815	pRegFrame->eip = eip & 0xffff;
1816	pRegFrame->cs = cs;
1817
1818	/* Mask away all reserved bits */
1819	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1820	eflags &= uMask;
1821
1822	#ifndef IN_RING0
1823	CPUMRawSetEFlags(pVM, pRegFrame, eflags);
1824	#endif
1825	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1826
1827	pRegFrame->esp = esp;
1828	pRegFrame->ss = ss;
1829	pRegFrame->ds = ds;
1830	pRegFrame->es = es;
1831	pRegFrame->fs = fs;
1832	pRegFrame->gs = gs;
1833
1834	return VINF_SUCCESS;
1835	}
1836	#endif /* IN_RC */
1837
1838
1839	/**
1840	* IRET Emulation.
1841	*/
1842	static int emInterpretIret(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1843	{
1844	/* only allow direct calls to EMInterpretIret for now */
1845	return VERR_EM_INTERPRETER;
1846	}
1847
1848	/**
1849	* WBINVD Emulation.
1850	*/
1851	static int emInterpretWbInvd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1852	{
1853	/* Nothing to do. */
1854	return VINF_SUCCESS;
1855	}
1856
1857
1858	/**
1859	* Interpret INVLPG
1860	*
1861	* @returns VBox status code.
1862	* @param pVM The VM handle.
1863	* @param pRegFrame The register frame.
1864	* @param pAddrGC Operand address
1865	*
1866	*/
1867	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1868	{
1869	int rc;
1870
1871	/** @todo is addr always a flat linear address or ds based
1872	* (in absence of segment override prefixes)????
1873	*/
1874	#ifdef IN_RC
1875	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1876	#endif
1877	rc = PGMInvalidatePage(pVM, pAddrGC);
1878	if ( rc == VINF_SUCCESS
1879	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1880	return VINF_SUCCESS;
1881	AssertMsgReturn( rc == VERR_REM_FLUSHED_PAGES_OVERFLOW
1882	\|\| rc == VINF_EM_RAW_EMULATE_INSTR,
1883	("%Rrc addr=%RGv\n", rc, pAddrGC),
1884	VERR_EM_INTERPRETER);
1885	return rc;
1886	}
1887
1888
1889	/**
1890	* INVLPG Emulation.
1891	*/
1892	static int emInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1893	{
1894	OP_PARAMVAL param1;
1895	RTGCPTR addr;
1896
1897	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1898	if(RT_FAILURE(rc))
1899	return VERR_EM_INTERPRETER;
1900
1901	switch(param1.type)
1902	{
1903	case PARMTYPE_IMMEDIATE:
1904	case PARMTYPE_ADDRESS:
1905	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1906	return VERR_EM_INTERPRETER;
1907	addr = (RTGCPTR)param1.val.val64;
1908	break;
1909
1910	default:
1911	return VERR_EM_INTERPRETER;
1912	}
1913
1914	/** @todo is addr always a flat linear address or ds based
1915	* (in absence of segment override prefixes)????
1916	*/
1917	#ifdef IN_RC
1918	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1919	#endif
1920	rc = PGMInvalidatePage(pVM, addr);
1921	if ( rc == VINF_SUCCESS
1922	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1923	return VINF_SUCCESS;
1924	AssertMsgReturn( rc == VERR_REM_FLUSHED_PAGES_OVERFLOW
1925	\|\| rc == VINF_EM_RAW_EMULATE_INSTR,
1926	("%Rrc addr=%RGv\n", rc, addr),
1927	VERR_EM_INTERPRETER);
1928	return rc;
1929	}
1930
1931
1932	/**
1933	* Interpret CPUID given the parameters in the CPU context
1934	*
1935	* @returns VBox status code.
1936	* @param pVM The VM handle.
1937	* @param pRegFrame The register frame.
1938	*
1939	*/
1940	VMMDECL(int) EMInterpretCpuId(PVM pVM, PCPUMCTXCORE pRegFrame)
1941	{
1942	uint32_t iLeaf = pRegFrame->eax;
1943
1944	/* cpuid clears the high dwords of the affected 64 bits registers. */
1945	pRegFrame->rax = 0;
1946	pRegFrame->rbx = 0;
1947	pRegFrame->rcx = 0;
1948	pRegFrame->rdx = 0;
1949
1950	/* Note: operates the same in 64 and non-64 bits mode. */
1951	CPUMGetGuestCpuId(pVM, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1952	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1953	return VINF_SUCCESS;
1954	}
1955
1956
1957	/**
1958	* CPUID Emulation.
1959	*/
1960	static int emInterpretCpuId(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1961	{
1962	int rc = EMInterpretCpuId(pVM, pRegFrame);
1963	return rc;
1964	}
1965
1966
1967	/**
1968	* Interpret CRx read
1969	*
1970	* @returns VBox status code.
1971	* @param pVM The VM handle.
1972	* @param pRegFrame The register frame.
1973	* @param DestRegGen General purpose register index (USE_REG_E**))
1974	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1975	*
1976	*/
1977	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1978	{
1979	int rc;
1980	uint64_t val64;
1981
1982	if (SrcRegCrx == USE_REG_CR8)
1983	{
1984	val64 = 0;
1985	rc = PDMApicGetTPR(pVM, (uint8_t *)&val64, NULL);
1986	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
1987	}
1988	else
1989	{
1990	rc = CPUMGetGuestCRx(pVM, SrcRegCrx, &val64);
1991	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1992	}
1993
1994	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
1995	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1996	else
1997	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1998
1999	if(RT_SUCCESS(rc))
2000	{
2001	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2002	return VINF_SUCCESS;
2003	}
2004	return VERR_EM_INTERPRETER;
2005	}
2006
2007
2008
2009	/**
2010	* Interpret CLTS
2011	*
2012	* @returns VBox status code.
2013	* @param pVM The VM handle.
2014	*
2015	*/
2016	VMMDECL(int) EMInterpretCLTS(PVM pVM)
2017	{
2018	uint64_t cr0 = CPUMGetGuestCR0(pVM);
2019	if (!(cr0 & X86_CR0_TS))
2020	return VINF_SUCCESS;
2021	return CPUMSetGuestCR0(pVM, cr0 & ~X86_CR0_TS);
2022	}
2023
2024	/**
2025	* CLTS Emulation.
2026	*/
2027	static int emInterpretClts(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2028	{
2029	return EMInterpretCLTS(pVM);
2030	}
2031
2032
2033	/**
2034	* Update CRx
2035	*
2036	* @returns VBox status code.
2037	* @param pVM The VM handle.
2038	* @param pRegFrame The register frame.
2039	* @param DestRegCRx CRx register index (USE_REG_CR*)
2040	* @param val New CRx value
2041	*
2042	*/
2043	static int emUpdateCRx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2044	{
2045	uint64_t oldval;
2046	uint64_t msrEFER;
2047	int rc, rc2;
2048
2049	/** @todo Clean up this mess. */
2050	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2051	switch (DestRegCrx)
2052	{
2053	case USE_REG_CR0:
2054	oldval = CPUMGetGuestCR0(pVM);
2055	#ifdef IN_RC
2056	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2057	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2058	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2059	return VERR_EM_INTERPRETER;
2060	#endif
2061	rc = VINF_SUCCESS;
2062	CPUMSetGuestCR0(pVM, val);
2063	val = CPUMGetGuestCR0(pVM);
2064	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2065	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2066	{
2067	/* global flush */
2068	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2069	AssertRCReturn(rc, rc);
2070	}
2071
2072	/* Deal with long mode enabling/disabling. */
2073	msrEFER = CPUMGetGuestEFER(pVM);
2074	if (msrEFER & MSR_K6_EFER_LME)
2075	{
2076	if ( !(oldval & X86_CR0_PG)
2077	&& (val & X86_CR0_PG))
2078	{
2079	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2080	if (pRegFrame->csHid.Attr.n.u1Long)
2081	{
2082	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2083	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2084	}
2085
2086	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2087	if (!(CPUMGetGuestCR4(pVM) & X86_CR4_PAE))
2088	{
2089	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2090	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2091	}
2092	msrEFER \|= MSR_K6_EFER_LMA;
2093	}
2094	else
2095	if ( (oldval & X86_CR0_PG)
2096	&& !(val & X86_CR0_PG))
2097	{
2098	msrEFER &= ~MSR_K6_EFER_LMA;
2099	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2100	}
2101	CPUMSetGuestEFER(pVM, msrEFER);
2102	}
2103	rc2 = PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2104	return rc2 == VINF_SUCCESS ? rc : rc2;
2105
2106	case USE_REG_CR2:
2107	rc = CPUMSetGuestCR2(pVM, val); AssertRC(rc);
2108	return VINF_SUCCESS;
2109
2110	case USE_REG_CR3:
2111	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2112	rc = CPUMSetGuestCR3(pVM, val); AssertRC(rc);
2113	if (CPUMGetGuestCR0(pVM) & X86_CR0_PG)
2114	{
2115	/* flush */
2116	rc = PGMFlushTLB(pVM, val, !(CPUMGetGuestCR4(pVM) & X86_CR4_PGE));
2117	AssertRCReturn(rc, rc);
2118	}
2119	return rc;
2120
2121	case USE_REG_CR4:
2122	oldval = CPUMGetGuestCR4(pVM);
2123	rc = CPUMSetGuestCR4(pVM, val); AssertRC(rc);
2124	val = CPUMGetGuestCR4(pVM);
2125
2126	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2127	msrEFER = CPUMGetGuestEFER(pVM);
2128	if ( (msrEFER & MSR_K6_EFER_LMA)
2129	&& (oldval & X86_CR4_PAE)
2130	&& !(val & X86_CR4_PAE))
2131	{
2132	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2133	}
2134
2135	rc = VINF_SUCCESS;
2136	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2137	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2138	{
2139	/* global flush */
2140	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
2141	AssertRCReturn(rc, rc);
2142	}
2143
2144	/* Feeling extremely lazy. */
2145	# ifdef IN_RC
2146	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2147	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2148	{
2149	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2150	VM_FF_SET(pVM, VM_FF_TO_R3);
2151	}
2152	# endif
2153	if ((val ^ oldval) & X86_CR4_VME)
2154	VM_FF_SET(pVM, VM_FF_SELM_SYNC_TSS);
2155
2156	rc2 = PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
2157	return rc2 == VINF_SUCCESS ? rc : rc2;
2158
2159	case USE_REG_CR8:
2160	return PDMApicSetTPR(pVM, val);
2161
2162	default:
2163	AssertFailed();
2164	case USE_REG_CR1: /* illegal op */
2165	break;
2166	}
2167	return VERR_EM_INTERPRETER;
2168	}
2169
2170	/**
2171	* Interpret CRx write
2172	*
2173	* @returns VBox status code.
2174	* @param pVM The VM handle.
2175	* @param pRegFrame The register frame.
2176	* @param DestRegCRx CRx register index (USE_REG_CR*)
2177	* @param SrcRegGen General purpose register index (USE_REG_E**))
2178	*
2179	*/
2180	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2181	{
2182	uint64_t val;
2183	int rc;
2184
2185	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2186	{
2187	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2188	}
2189	else
2190	{
2191	uint32_t val32;
2192	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2193	val = val32;
2194	}
2195
2196	if (RT_SUCCESS(rc))
2197	return emUpdateCRx(pVM, pRegFrame, DestRegCrx, val);
2198
2199	return VERR_EM_INTERPRETER;
2200	}
2201
2202	/**
2203	* Interpret LMSW
2204	*
2205	* @returns VBox status code.
2206	* @param pVM The VM handle.
2207	* @param pRegFrame The register frame.
2208	* @param u16Data LMSW source data.
2209	*
2210	*/
2211	VMMDECL(int) EMInterpretLMSW(PVM pVM, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2212	{
2213	uint64_t OldCr0 = CPUMGetGuestCR0(pVM);
2214
2215	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2216	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2217	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2218
2219	return emUpdateCRx(pVM, pRegFrame, USE_REG_CR0, NewCr0);
2220	}
2221
2222	/**
2223	* LMSW Emulation.
2224	*/
2225	static int emInterpretLmsw(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2226	{
2227	OP_PARAMVAL param1;
2228	uint32_t val;
2229
2230	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2231	if(RT_FAILURE(rc))
2232	return VERR_EM_INTERPRETER;
2233
2234	switch(param1.type)
2235	{
2236	case PARMTYPE_IMMEDIATE:
2237	case PARMTYPE_ADDRESS:
2238	if(!(param1.flags & PARAM_VAL16))
2239	return VERR_EM_INTERPRETER;
2240	val = param1.val.val32;
2241	break;
2242
2243	default:
2244	return VERR_EM_INTERPRETER;
2245	}
2246
2247	LogFlow(("emInterpretLmsw %x\n", val));
2248	return EMInterpretLMSW(pVM, pRegFrame, val);
2249	}
2250
2251	#ifdef EM_EMULATE_SMSW
2252	/**
2253	* SMSW Emulation.
2254	*/
2255	static int emInterpretSmsw(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2256	{
2257	OP_PARAMVAL param1;
2258	uint64_t cr0 = CPUMGetGuestCR0(pVM);
2259
2260	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2261	if(RT_FAILURE(rc))
2262	return VERR_EM_INTERPRETER;
2263
2264	switch(param1.type)
2265	{
2266	case PARMTYPE_IMMEDIATE:
2267	if(param1.size != sizeof(uint16_t))
2268	return VERR_EM_INTERPRETER;
2269	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pCpu->param1.base.reg_gen, cr0));
2270	rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, cr0);
2271	break;
2272
2273	case PARMTYPE_ADDRESS:
2274	{
2275	RTGCPTR pParam1;
2276
2277	/* Actually forced to 16 bits regardless of the operand size. */
2278	if(param1.size != sizeof(uint16_t))
2279	return VERR_EM_INTERPRETER;
2280
2281	pParam1 = (RTGCPTR)param1.val.val64;
2282	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
2283	LogFlow(("emInterpretSmsw %VGv <- cr0 (%x)\n", pParam1, cr0));
2284
2285	rc = emRamWrite(pVM, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2286	if (RT_FAILURE(rc))
2287	{
2288	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2289	return VERR_EM_INTERPRETER;
2290	}
2291	break;
2292	}
2293
2294	default:
2295	return VERR_EM_INTERPRETER;
2296	}
2297
2298	LogFlow(("emInterpretSmsw %x\n", cr0));
2299	return rc;
2300	}
2301	#endif
2302
2303	/**
2304	* MOV CRx
2305	*/
2306	static int emInterpretMovCRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2307	{
2308	if ((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_CR)
2309	return EMInterpretCRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_ctrl);
2310
2311	if (pCpu->param1.flags == USE_REG_CR && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2312	return EMInterpretCRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_ctrl, pCpu->param2.base.reg_gen);
2313
2314	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2315	return VERR_EM_INTERPRETER;
2316	}
2317
2318
2319	/**
2320	* Interpret DRx write
2321	*
2322	* @returns VBox status code.
2323	* @param pVM The VM handle.
2324	* @param pRegFrame The register frame.
2325	* @param DestRegDRx DRx register index (USE_REG_DR*)
2326	* @param SrcRegGen General purpose register index (USE_REG_E**))
2327	*
2328	*/
2329	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2330	{
2331	uint64_t val;
2332	int rc;
2333
2334	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2335	{
2336	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2337	}
2338	else
2339	{
2340	uint32_t val32;
2341	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2342	val = val32;
2343	}
2344
2345	if (RT_SUCCESS(rc))
2346	{
2347	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2348	rc = CPUMSetGuestDRx(pVM, DestRegDrx, val);
2349	if (RT_SUCCESS(rc))
2350	return rc;
2351	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2352	}
2353	return VERR_EM_INTERPRETER;
2354	}
2355
2356
2357	/**
2358	* Interpret DRx read
2359	*
2360	* @returns VBox status code.
2361	* @param pVM The VM handle.
2362	* @param pRegFrame The register frame.
2363	* @param DestRegGen General purpose register index (USE_REG_E**))
2364	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2365	*
2366	*/
2367	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2368	{
2369	uint64_t val64;
2370
2371	int rc = CPUMGetGuestDRx(pVM, SrcRegDrx, &val64);
2372	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2373	if (CPUMIsGuestIn64BitCode(pVM, pRegFrame))
2374	{
2375	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2376	}
2377	else
2378	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2379
2380	if (RT_SUCCESS(rc))
2381	return VINF_SUCCESS;
2382
2383	return VERR_EM_INTERPRETER;
2384	}
2385
2386
2387	/**
2388	* MOV DRx
2389	*/
2390	static int emInterpretMovDRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2391	{
2392	int rc = VERR_EM_INTERPRETER;
2393
2394	if((pCpu->param1.flags == USE_REG_GEN32 \|\| pCpu->param1.flags == USE_REG_GEN64) && pCpu->param2.flags == USE_REG_DBG)
2395	{
2396	rc = EMInterpretDRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_dbg);
2397	}
2398	else
2399	if(pCpu->param1.flags == USE_REG_DBG && (pCpu->param2.flags == USE_REG_GEN32 \|\| pCpu->param2.flags == USE_REG_GEN64))
2400	{
2401	rc = EMInterpretDRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_dbg, pCpu->param2.base.reg_gen);
2402	}
2403	else
2404	AssertMsgFailed(("Unexpected debug register move\n"));
2405
2406	return rc;
2407	}
2408
2409
2410	/**
2411	* LLDT Emulation.
2412	*/
2413	static int emInterpretLLdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2414	{
2415	OP_PARAMVAL param1;
2416	RTSEL sel;
2417
2418	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2419	if(RT_FAILURE(rc))
2420	return VERR_EM_INTERPRETER;
2421
2422	switch(param1.type)
2423	{
2424	case PARMTYPE_ADDRESS:
2425	return VERR_EM_INTERPRETER; //feeling lazy right now
2426
2427	case PARMTYPE_IMMEDIATE:
2428	if(!(param1.flags & PARAM_VAL16))
2429	return VERR_EM_INTERPRETER;
2430	sel = (RTSEL)param1.val.val16;
2431	break;
2432
2433	default:
2434	return VERR_EM_INTERPRETER;
2435	}
2436
2437	#ifdef IN_RING0
2438	/* Only for the VT-x real-mode emulation case. */
2439	AssertReturn(CPUMIsGuestInRealMode(pVM), VERR_EM_INTERPRETER);
2440	CPUMSetGuestLDTR(pVM, sel);
2441	return VINF_SUCCESS;
2442	#else
2443	if (sel == 0)
2444	{
2445	if (CPUMGetHyperLDTR(pVM) == 0)
2446	{
2447	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2448	return VINF_SUCCESS;
2449	}
2450	}
2451	//still feeling lazy
2452	return VERR_EM_INTERPRETER;
2453	#endif
2454	}
2455
2456	#ifdef IN_RING0
2457	/**
2458	* LIDT/LGDT Emulation.
2459	*/
2460	static int emInterpretLIGdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2461	{
2462	OP_PARAMVAL param1;
2463	RTGCPTR pParam1;
2464	X86XDTR32 dtr32;
2465
2466	Log(("Emulate %s at %RGv\n", emGetMnemonic(pCpu), (RTGCPTR)pRegFrame->rip));
2467
2468	/* Only for the VT-x real-mode emulation case. */
2469	AssertReturn(CPUMIsGuestInRealMode(pVM), VERR_EM_INTERPRETER);
2470
2471	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2472	if(RT_FAILURE(rc))
2473	return VERR_EM_INTERPRETER;
2474
2475	switch(param1.type)
2476	{
2477	case PARMTYPE_ADDRESS:
2478	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, param1.val.val16);
2479	break;
2480
2481	default:
2482	return VERR_EM_INTERPRETER;
2483	}
2484
2485	rc = emRamRead(pVM, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2486	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2487
2488	if (!(pCpu->prefix & PREFIX_OPSIZE))
2489	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2490
2491	if (pCpu->pCurInstr->opcode == OP_LIDT)
2492	CPUMSetGuestIDTR(pVM, dtr32.uAddr, dtr32.cb);
2493	else
2494	CPUMSetGuestGDTR(pVM, dtr32.uAddr, dtr32.cb);
2495
2496	return VINF_SUCCESS;
2497	}
2498	#endif
2499
2500
2501	#ifdef IN_RC
2502	/**
2503	* STI Emulation.
2504	*
2505	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2506	*/
2507	static int emInterpretSti(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2508	{
2509	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2510
2511	if(!pGCState)
2512	{
2513	Assert(pGCState);
2514	return VERR_EM_INTERPRETER;
2515	}
2516	pGCState->uVMFlags \|= X86_EFL_IF;
2517
2518	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2519	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2520
2521	pVM->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pCpu->opsize;
2522	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2523
2524	return VINF_SUCCESS;
2525	}
2526	#endif /* IN_RC */
2527
2528
2529	/**
2530	* HLT Emulation.
2531	*/
2532	static int emInterpretHlt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2533	{
2534	return VINF_EM_HALT;
2535	}
2536
2537
2538	/**
2539	* Interpret RDTSC
2540	*
2541	* @returns VBox status code.
2542	* @param pVM The VM handle.
2543	* @param pRegFrame The register frame.
2544	*
2545	*/
2546	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PCPUMCTXCORE pRegFrame)
2547	{
2548	unsigned uCR4 = CPUMGetGuestCR4(pVM);
2549
2550	if (uCR4 & X86_CR4_TSD)
2551	return VERR_EM_INTERPRETER; /* genuine #GP */
2552
2553	uint64_t uTicks = TMCpuTickGet(pVM);
2554
2555	/* Same behaviour in 32 & 64 bits mode */
2556	pRegFrame->rax = (uint32_t)uTicks;
2557	pRegFrame->rdx = (uTicks >> 32ULL);
2558
2559	return VINF_SUCCESS;
2560	}
2561
2562	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PCPUMCTX pCtx)
2563	{
2564	unsigned uCR4 = CPUMGetGuestCR4(pVM);
2565
2566	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2567	{
2568	AssertFailed();
2569	return VERR_EM_INTERPRETER; /* genuine #UD */
2570	}
2571
2572	if (uCR4 & X86_CR4_TSD)
2573	return VERR_EM_INTERPRETER; /* genuine #GP */
2574
2575	uint64_t uTicks = TMCpuTickGet(pVM);
2576
2577	/* Same behaviour in 32 & 64 bits mode */
2578	pCtx->rax = (uint32_t)uTicks;
2579	pCtx->rdx = (uTicks >> 32ULL);
2580	/* Low dword of the TSC_AUX msr only. */
2581	pCtx->rcx = (uint32_t)CPUMGetGuestMsr(pVM, MSR_K8_TSC_AUX);
2582
2583	return VINF_SUCCESS;
2584	}
2585
2586	/**
2587	* RDTSC Emulation.
2588	*/
2589	static int emInterpretRdtsc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2590	{
2591	return EMInterpretRdtsc(pVM, pRegFrame);
2592	}
2593
2594
2595	/**
2596	* MONITOR Emulation.
2597	*/
2598	static int emInterpretMonitor(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2599	{
2600	uint32_t u32Dummy, u32ExtFeatures, cpl;
2601
2602	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2603	if (pRegFrame->ecx != 0)
2604	return VERR_EM_INTERPRETER; /* illegal value. */
2605
2606	/* Get the current privilege level. */
2607	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2608	if (cpl != 0)
2609	return VERR_EM_INTERPRETER; /* supervisor only */
2610
2611	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2612	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2613	return VERR_EM_INTERPRETER; /* not supported */
2614
2615	return VINF_SUCCESS;
2616	}
2617
2618
2619	/**
2620	* MWAIT Emulation.
2621	*/
2622	static int emInterpretMWait(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2623	{
2624	uint32_t u32Dummy, u32ExtFeatures, cpl;
2625
2626	Assert(pCpu->mode != CPUMODE_64BIT); /** @todo check */
2627	if (pRegFrame->ecx != 0)
2628	return VERR_EM_INTERPRETER; /* illegal value. */
2629
2630	/* Get the current privilege level. */
2631	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2632	if (cpl != 0)
2633	return VERR_EM_INTERPRETER; /* supervisor only */
2634
2635	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2636	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2637	return VERR_EM_INTERPRETER; /* not supported */
2638
2639	/** @todo not completely correct */
2640	return VINF_EM_HALT;
2641	}
2642
2643
2644	#ifdef LOG_ENABLED
2645	static const char *emMSRtoString(uint32_t uMsr)
2646	{
2647	switch (uMsr)
2648	{
2649	case MSR_IA32_APICBASE:
2650	return "MSR_IA32_APICBASE";
2651	case MSR_IA32_CR_PAT:
2652	return "MSR_IA32_CR_PAT";
2653	case MSR_IA32_SYSENTER_CS:
2654	return "MSR_IA32_SYSENTER_CS";
2655	case MSR_IA32_SYSENTER_EIP:
2656	return "MSR_IA32_SYSENTER_EIP";
2657	case MSR_IA32_SYSENTER_ESP:
2658	return "MSR_IA32_SYSENTER_ESP";
2659	case MSR_K6_EFER:
2660	return "MSR_K6_EFER";
2661	case MSR_K8_SF_MASK:
2662	return "MSR_K8_SF_MASK";
2663	case MSR_K6_STAR:
2664	return "MSR_K6_STAR";
2665	case MSR_K8_LSTAR:
2666	return "MSR_K8_LSTAR";
2667	case MSR_K8_CSTAR:
2668	return "MSR_K8_CSTAR";
2669	case MSR_K8_FS_BASE:
2670	return "MSR_K8_FS_BASE";
2671	case MSR_K8_GS_BASE:
2672	return "MSR_K8_GS_BASE";
2673	case MSR_K8_KERNEL_GS_BASE:
2674	return "MSR_K8_KERNEL_GS_BASE";
2675	case MSR_K8_TSC_AUX:
2676	return "MSR_K8_TSC_AUX";
2677	case MSR_IA32_BIOS_SIGN_ID:
2678	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2679	case MSR_IA32_PLATFORM_ID:
2680	return "Unsupported MSR_IA32_PLATFORM_ID";
2681	case MSR_IA32_BIOS_UPDT_TRIG:
2682	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2683	case MSR_IA32_TSC:
2684	return "Unsupported MSR_IA32_TSC";
2685	case MSR_IA32_MTRR_CAP:
2686	return "Unsupported MSR_IA32_MTRR_CAP";
2687	case MSR_IA32_MCP_CAP:
2688	return "Unsupported MSR_IA32_MCP_CAP";
2689	case MSR_IA32_MCP_STATUS:
2690	return "Unsupported MSR_IA32_MCP_STATUS";
2691	case MSR_IA32_MCP_CTRL:
2692	return "Unsupported MSR_IA32_MCP_CTRL";
2693	case MSR_IA32_MTRR_DEF_TYPE:
2694	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2695	case MSR_K7_EVNTSEL0:
2696	return "Unsupported MSR_K7_EVNTSEL0";
2697	case MSR_K7_EVNTSEL1:
2698	return "Unsupported MSR_K7_EVNTSEL1";
2699	case MSR_K7_EVNTSEL2:
2700	return "Unsupported MSR_K7_EVNTSEL2";
2701	case MSR_K7_EVNTSEL3:
2702	return "Unsupported MSR_K7_EVNTSEL3";
2703	case MSR_IA32_MC0_CTL:
2704	return "Unsupported MSR_IA32_MC0_CTL";
2705	case MSR_IA32_MC0_STATUS:
2706	return "Unsupported MSR_IA32_MC0_STATUS";
2707	}
2708	return "Unknown MSR";
2709	}
2710	#endif /* LOG_ENABLED */
2711
2712
2713	/**
2714	* Interpret RDMSR
2715	*
2716	* @returns VBox status code.
2717	* @param pVM The VM handle.
2718	* @param pRegFrame The register frame.
2719	*
2720	*/
2721	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2722	{
2723	uint32_t u32Dummy, u32Features, cpl;
2724	uint64_t val;
2725	CPUMCTX *pCtx;
2726	int rc = VINF_SUCCESS;
2727
2728	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2729	* That version clears the high dwords of both RDX & RAX */
2730	pCtx = CPUMQueryGuestCtxPtr(pVM);
2731
2732	/* Get the current privilege level. */
2733	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2734	if (cpl != 0)
2735	return VERR_EM_INTERPRETER; /* supervisor only */
2736
2737	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2738	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2739	return VERR_EM_INTERPRETER; /* not supported */
2740
2741	switch (pRegFrame->ecx)
2742	{
2743	case MSR_IA32_APICBASE:
2744	rc = PDMApicGetBase(pVM, &val);
2745	AssertRC(rc);
2746	break;
2747
2748	case MSR_IA32_CR_PAT:
2749	val = pCtx->msrPAT;
2750	break;
2751
2752	case MSR_IA32_SYSENTER_CS:
2753	val = pCtx->SysEnter.cs;
2754	break;
2755
2756	case MSR_IA32_SYSENTER_EIP:
2757	val = pCtx->SysEnter.eip;
2758	break;
2759
2760	case MSR_IA32_SYSENTER_ESP:
2761	val = pCtx->SysEnter.esp;
2762	break;
2763
2764	case MSR_K6_EFER:
2765	val = pCtx->msrEFER;
2766	break;
2767
2768	case MSR_K8_SF_MASK:
2769	val = pCtx->msrSFMASK;
2770	break;
2771
2772	case MSR_K6_STAR:
2773	val = pCtx->msrSTAR;
2774	break;
2775
2776	case MSR_K8_LSTAR:
2777	val = pCtx->msrLSTAR;
2778	break;
2779
2780	case MSR_K8_CSTAR:
2781	val = pCtx->msrCSTAR;
2782	break;
2783
2784	case MSR_K8_FS_BASE:
2785	val = pCtx->fsHid.u64Base;
2786	break;
2787
2788	case MSR_K8_GS_BASE:
2789	val = pCtx->gsHid.u64Base;
2790	break;
2791
2792	case MSR_K8_KERNEL_GS_BASE:
2793	val = pCtx->msrKERNELGSBASE;
2794	break;
2795
2796	case MSR_K8_TSC_AUX:
2797	val = CPUMGetGuestMsr(pVM, MSR_K8_TSC_AUX);
2798	break;
2799
2800	#if 0 /def IN_RING0 /
2801	case MSR_IA32_PLATFORM_ID:
2802	case MSR_IA32_BIOS_SIGN_ID:
2803	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2804	{
2805	/* Available since the P6 family. VT-x implies that this feature is present. */
2806	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2807	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2808	else
2809	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2810	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2811	break;
2812	}
2813	/* no break */
2814	#endif
2815	default:
2816	/* In X2APIC specification this range is reserved for APIC control. */
2817	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2818	rc = PDMApicReadMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, &val);
2819	else
2820	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2821	val = 0;
2822	break;
2823	}
2824	LogFlow(("EMInterpretRdmsr %s (%x) -> val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2825	if (rc == VINF_SUCCESS)
2826	{
2827	pRegFrame->rax = (uint32_t) val;
2828	pRegFrame->rdx = (uint32_t) (val >> 32ULL);
2829	}
2830	return rc;
2831	}
2832
2833
2834	/**
2835	* RDMSR Emulation.
2836	*/
2837	static int emInterpretRdmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2838	{
2839	/* Note: the Intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2840	Assert(!(pCpu->prefix & PREFIX_REX));
2841	return EMInterpretRdmsr(pVM, pRegFrame);
2842	}
2843
2844
2845	/**
2846	* Interpret WRMSR
2847	*
2848	* @returns VBox status code.
2849	* @param pVM The VM handle.
2850	* @param pRegFrame The register frame.
2851	*/
2852	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2853	{
2854	uint32_t u32Dummy, u32Features, cpl;
2855	uint64_t val;
2856	CPUMCTX *pCtx;
2857
2858	/* Note: works the same in 32 and 64 bits modes. */
2859	pCtx = CPUMQueryGuestCtxPtr(pVM);
2860
2861	/* Get the current privilege level. */
2862	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2863	if (cpl != 0)
2864	return VERR_EM_INTERPRETER; /* supervisor only */
2865
2866	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2867	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2868	return VERR_EM_INTERPRETER; /* not supported */
2869
2870	val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
2871	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2872	switch (pRegFrame->ecx)
2873	{
2874	case MSR_IA32_APICBASE:
2875	{
2876	int rc = PDMApicSetBase(pVM, val);
2877	AssertRC(rc);
2878	break;
2879	}
2880
2881	case MSR_IA32_CR_PAT:
2882	pCtx->msrPAT = val;
2883	break;
2884
2885	case MSR_IA32_SYSENTER_CS:
2886	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
2887	break;
2888
2889	case MSR_IA32_SYSENTER_EIP:
2890	pCtx->SysEnter.eip = val;
2891	break;
2892
2893	case MSR_IA32_SYSENTER_ESP:
2894	pCtx->SysEnter.esp = val;
2895	break;
2896
2897	case MSR_K6_EFER:
2898	{
2899	uint64_t uMask = 0;
2900	uint64_t oldval = pCtx->msrEFER;
2901
2902	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
2903	CPUMGetGuestCpuId(pVM, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2904	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
2905	uMask \|= MSR_K6_EFER_NXE;
2906	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
2907	uMask \|= MSR_K6_EFER_LME;
2908	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
2909	uMask \|= MSR_K6_EFER_SCE;
2910	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
2911	uMask \|= MSR_K6_EFER_FFXSR;
2912
2913	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2914	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
2915	&& (pCtx->cr0 & X86_CR0_PG))
2916	{
2917	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
2918	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2919	}
2920
2921	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
2922	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
2923	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
2924
2925	/* AMD64 Architecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
2926	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
2927	HWACCMFlushTLB(pVM);
2928
2929	break;
2930	}
2931
2932	case MSR_K8_SF_MASK:
2933	pCtx->msrSFMASK = val;
2934	break;
2935
2936	case MSR_K6_STAR:
2937	pCtx->msrSTAR = val;
2938	break;
2939
2940	case MSR_K8_LSTAR:
2941	pCtx->msrLSTAR = val;
2942	break;
2943
2944	case MSR_K8_CSTAR:
2945	pCtx->msrCSTAR = val;
2946	break;
2947
2948	case MSR_K8_FS_BASE:
2949	pCtx->fsHid.u64Base = val;
2950	break;
2951
2952	case MSR_K8_GS_BASE:
2953	pCtx->gsHid.u64Base = val;
2954	break;
2955
2956	case MSR_K8_KERNEL_GS_BASE:
2957	pCtx->msrKERNELGSBASE = val;
2958	break;
2959
2960	case MSR_K8_TSC_AUX:
2961	CPUMSetGuestMsr(pVM, MSR_K8_TSC_AUX, val);
2962	break;
2963
2964	default:
2965	/* In X2APIC specification this range is reserved for APIC control. */
2966	if ((pRegFrame->ecx >= MSR_IA32_APIC_START) && (pRegFrame->ecx < MSR_IA32_APIC_END))
2967	return PDMApicWriteMSR(pVM, VMMGetCpuId(pVM), pRegFrame->ecx, val);
2968
2969	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2970	break;
2971	}
2972	return VINF_SUCCESS;
2973	}
2974
2975
2976	/**
2977	* WRMSR Emulation.
2978	*/
2979	static int emInterpretWrmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2980	{
2981	return EMInterpretWrmsr(pVM, pRegFrame);
2982	}
2983
2984
2985	/**
2986	* Internal worker.
2987	* @copydoc EMInterpretInstructionCPU
2988	*/
2989	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2990	{
2991	Assert(pcbSize);
2992	*pcbSize = 0;
2993
2994	/*
2995	* Only supervisor guest code!!
2996	* And no complicated prefixes.
2997	*/
2998	/* Get the current privilege level. */
2999	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
3000	if ( cpl != 0
3001	&& pCpu->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3002	{
3003	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3004	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3005	return VERR_EM_INTERPRETER;
3006	}
3007
3008	#ifdef IN_RC
3009	if ( (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP))
3010	\|\| ( (pCpu->prefix & PREFIX_LOCK)
3011	&& pCpu->pCurInstr->opcode != OP_CMPXCHG
3012	&& pCpu->pCurInstr->opcode != OP_CMPXCHG8B
3013	&& pCpu->pCurInstr->opcode != OP_XADD
3014	&& pCpu->pCurInstr->opcode != OP_OR
3015	&& pCpu->pCurInstr->opcode != OP_BTR
3016	)
3017	)
3018	#else
3019	if ( (pCpu->prefix & PREFIX_REPNE)
3020	\|\| ( (pCpu->prefix & PREFIX_REP)
3021	&& pCpu->pCurInstr->opcode != OP_STOSWD
3022	)
3023	\|\| ( (pCpu->prefix & PREFIX_LOCK)
3024	&& pCpu->pCurInstr->opcode != OP_OR
3025	&& pCpu->pCurInstr->opcode != OP_BTR
3026	&& pCpu->pCurInstr->opcode != OP_CMPXCHG
3027	&& pCpu->pCurInstr->opcode != OP_CMPXCHG8B
3028	)
3029	)
3030	#endif
3031	{
3032	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3033	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3034	return VERR_EM_INTERPRETER;
3035	}
3036
3037	#if HC_ARCH_BITS == 32
3038	/*
3039	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3040	* Whitelisted instructions are safe.
3041	*/
3042	if ( pCpu->param1.size > 4
3043	&& CPUMIsGuestIn64BitCode(pVM, pRegFrame))
3044	{
3045	uint32_t uOpCode = pCpu->pCurInstr->opcode;
3046	if ( uOpCode != OP_STOSWD
3047	&& uOpCode != OP_MOV
3048	&& uOpCode != OP_CMPXCHG8B
3049	&& uOpCode != OP_XCHG
3050	&& uOpCode != OP_BTS
3051	&& uOpCode != OP_BTR
3052	&& uOpCode != OP_BTC
3053	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3054	&& uOpCode != OP_CMPXCHG /* solaris */
3055	&& uOpCode != OP_AND /* windows */
3056	&& uOpCode != OP_OR /* windows */
3057	&& uOpCode != OP_XOR /* because we can */
3058	&& uOpCode != OP_ADD /* windows (dripple) */
3059	&& uOpCode != OP_ADC /* because we can */
3060	&& uOpCode != OP_SUB /* because we can */
3061	/** @todo OP_BTS or is that a different kind of failure? */
3062	# endif
3063	)
3064	{
3065	# ifdef VBOX_WITH_STATISTICS
3066	switch (pCpu->pCurInstr->opcode)
3067	{
3068	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3069	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3070	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3071	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3072	INTERPRET_FAILED_CASE(OP_INC,Inc);
3073	INTERPRET_FAILED_CASE(OP_POP,Pop);
3074	INTERPRET_FAILED_CASE(OP_OR, Or);
3075	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3076	INTERPRET_FAILED_CASE(OP_AND,And);
3077	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3078	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3079	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3080	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3081	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3082	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3083	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3084	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3085	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3086	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3087	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3088	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3089	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3090	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3091	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3092	INTERPRET_FAILED_CASE(OP_ADD,Add);
3093	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3094	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3095	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3096	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3097	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3098	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3099	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3100	INTERPRET_FAILED_CASE(OP_STI, Sti);
3101	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3102	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3103	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3104	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3105	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3106	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3107	# undef INTERPRET_FAILED_CASE
3108	default:
3109	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3110	break;
3111	}
3112	# endif /* VBOX_WITH_STATISTICS */
3113	return VERR_EM_INTERPRETER;
3114	}
3115	}
3116	#endif
3117
3118	int rc;
3119	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3120	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pCpu)));
3121	#endif
3122	switch (pCpu->pCurInstr->opcode)
3123	{
3124	/*
3125	* Macros for generating the right case statements.
3126	*/
3127	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3128	case opcode:\
3129	if (pCpu->prefix & PREFIX_LOCK) \
3130	rc = emInterpretLock##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3131	else \
3132	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3133	if (RT_SUCCESS(rc)) \
3134	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3135	else \
3136	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3137	return rc
3138	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3139	case opcode:\
3140	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3141	if (RT_SUCCESS(rc)) \
3142	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3143	else \
3144	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3145	return rc
3146
3147	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3148	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3149	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3150	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3151
3152	#define INTERPRET_CASE(opcode, Instr) \
3153	case opcode:\
3154	rc = emInterpret##Instr(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
3155	if (RT_SUCCESS(rc)) \
3156	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3157	else \
3158	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3159	return rc
3160
3161	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3162	case opcode:\
3163	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
3164	if (RT_SUCCESS(rc)) \
3165	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3166	else \
3167	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3168	return rc
3169
3170	#define INTERPRET_STAT_CASE(opcode, Instr) \
3171	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3172
3173	/*
3174	* The actual case statements.
3175	*/
3176	INTERPRET_CASE(OP_XCHG,Xchg);
3177	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3178	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3179	INTERPRET_CASE(OP_POP,Pop);
3180	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3181	INTERPRET_CASE_EX_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor);
3182	INTERPRET_CASE_EX_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd);
3183	INTERPRET_CASE(OP_MOV,Mov);
3184	#ifndef IN_RC
3185	INTERPRET_CASE(OP_STOSWD,StosWD);
3186	#endif
3187	INTERPRET_CASE(OP_INVLPG,InvlPg);
3188	INTERPRET_CASE(OP_CPUID,CpuId);
3189	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3190	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3191	#ifdef IN_RING0
3192	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3193	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3194	#endif
3195	INTERPRET_CASE(OP_LLDT,LLdt);
3196	INTERPRET_CASE(OP_LMSW,Lmsw);
3197	#ifdef EM_EMULATE_SMSW
3198	INTERPRET_CASE(OP_SMSW,Smsw);
3199	#endif
3200	INTERPRET_CASE(OP_CLTS,Clts);
3201	INTERPRET_CASE(OP_MONITOR, Monitor);
3202	INTERPRET_CASE(OP_MWAIT, MWait);
3203	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3204	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3205	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3206	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3207	INTERPRET_CASE(OP_ADC,Adc);
3208	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3209	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3210	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3211	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3212	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3213	#ifdef IN_RC
3214	INTERPRET_CASE(OP_STI,Sti);
3215	INTERPRET_CASE(OP_XADD, XAdd);
3216	#endif
3217	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3218	INTERPRET_CASE(OP_HLT,Hlt);
3219	INTERPRET_CASE(OP_IRET,Iret);
3220	INTERPRET_CASE(OP_WBINVD,WbInvd);
3221	#ifdef VBOX_WITH_STATISTICS
3222	# ifndef IN_RC
3223	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3224	# endif
3225	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3226	#endif
3227
3228	default:
3229	Log3(("emInterpretInstructionCPU: opcode=%d\n", pCpu->pCurInstr->opcode));
3230	STAM_COUNTER_INC(&pVM->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3231	return VERR_EM_INTERPRETER;
3232
3233	#undef INTERPRET_CASE_EX_PARAM2
3234	#undef INTERPRET_STAT_CASE
3235	#undef INTERPRET_CASE_EX
3236	#undef INTERPRET_CASE
3237	} /* switch (opcode) */
3238	AssertFailed();
3239	return VERR_INTERNAL_ERROR;
3240	}
3241
3242
3243	/**
3244	* Sets the PC for which interrupts should be inhibited.
3245	*
3246	* @param pVM The VM handle.
3247	* @param PC The PC.
3248	*/
3249	VMMDECL(void) EMSetInhibitInterruptsPC(PVM pVM, RTGCUINTPTR PC)
3250	{
3251	pVM->em.s.GCPtrInhibitInterrupts = PC;
3252	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
3253	}
3254
3255
3256	/**
3257	* Gets the PC for which interrupts should be inhibited.
3258	*
3259	* There are a few instructions which inhibits or delays interrupts
3260	* for the instruction following them. These instructions are:
3261	* - STI
3262	* - MOV SS, r/m16
3263	* - POP SS
3264	*
3265	* @returns The PC for which interrupts should be inhibited.
3266	* @param pVM VM handle.
3267	*
3268	*/
3269	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVM pVM)
3270	{
3271	return pVM->em.s.GCPtrInhibitInterrupts;
3272	}
3273

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 17787

Download in other formats: