EMAll.cpp@ 2121

Last change on this file since 2121 was 2064, checked in by vboxsync, 18 years ago
Accept ring 3 rdtsc for emulation.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 62.1 KB

Line
1	/* $Id: EMAll.cpp 2064 2007-04-13 08:45:06Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_EM
27	#include <VBox/em.h>
28	#include <VBox/mm.h>
29	#include <VBox/selm.h>
30	#include <VBox/patm.h>
31	#include <VBox/csam.h>
32	#include <VBox/pgm.h>
33	#include <VBox/iom.h>
34	#include <VBox/stam.h>
35	#include "EMInternal.h"
36	#include <VBox/vm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39
40	#include <VBox/param.h>
41	#include <VBox/err.h>
42	#include <VBox/dis.h>
43	#include <VBox/disopcode.h>
44	#include <VBox/log.h>
45	#include <iprt/assert.h>
46	#include <iprt/asm.h>
47	#include <iprt/string.h>
48
49	/*******************************************************************************
50	* Structures and Typedefs *
51	*******************************************************************************/
52	typedef EMDECL(uint32_t) PFN_EMULATE_PARAM2_UINT32(uint32_t *pu32Param1, uint32_t val2);
53	typedef EMDECL(uint32_t) PFN_EMULATE_PARAM2(uint32_t *pu32Param1, size_t val2);
54	typedef EMDECL(uint32_t) PFN_EMULATE_PARAM3(uint32_t *pu32Param1, uint32_t val2, size_t val3);
55
56	/*******************************************************************************
57	* Internal Functions *
58	*******************************************************************************/
59
60	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
61
62	/**
63	* Get the current execution manager status.
64	*
65	* @returns Current status.
66	*/
67	EMDECL(EMSTATE) EMGetState(PVM pVM)
68	{
69	return pVM->em.s.enmState;
70	}
71
72
73	#ifndef IN_GC
74	/**
75	* Read callback for disassembly function; supports reading bytes that cross a page boundary
76	*
77	* @returns VBox status code.
78	* @param pSrc GC source pointer
79	* @param pDest HC destination pointer
80	* @param size Number of bytes to read
81	* @param dwUserdata Callback specific user data (pCpu)
82	*
83	*/
84	DECLCALLBACK(int32_t) EMReadBytes(RTHCUINTPTR pSrc, uint8_t *pDest, uint32_t size, RTHCUINTPTR dwUserdata)
85	{
86	DISCPUSTATE pCpu = (DISCPUSTATE )dwUserdata;
87	PVM pVM = (PVM)pCpu->dwUserData[0];
88	#ifdef IN_RING0
89	int rc = PGMPhysReadGCPtr(pVM, pDest, pSrc, size);
90	AssertRC(rc);
91	#else
92	if (!PATMIsPatchGCAddr(pVM, pSrc))
93	{
94	int rc = PGMPhysReadGCPtr(pVM, pDest, pSrc, size);
95	AssertRC(rc);
96	}
97	else
98	{
99	for (uint32_t i = 0; i < size; i++)
100	{
101	uint8_t opcode;
102	if (VBOX_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
103	{
104	*(pDest+i) = opcode;
105	}
106	}
107	}
108	#endif /* IN_RING0 */
109	return VINF_SUCCESS;
110	}
111
112	inline int emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
113	{
114	return DISCoreOneEx(InstrGC, pCpu->mode, EMReadBytes, pVM, pCpu, pOpsize);
115	}
116
117	#else
118
119	inline int emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
120	{
121	return DISCoreOne(pCpu, InstrGC, pOpsize);
122	}
123
124	#endif
125
126
127	/**
128	* Disassembles one instruction.
129	*
130	* @param pVM The VM handle.
131	* @param pCtxCore The context core (used for both the mode and instruction).
132	* @param pCpu Where to return the parsed instruction info.
133	* @param pcbInstr Where to return the instruction size. (optional)
134	*/
135	EMDECL(int) EMInterpretDisasOne(PVM pVM, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
136	{
137	RTGCPTR GCPtrInstr;
138	int rc = SELMValidateAndConvertCSAddr(pVM, pCtxCore->eflags, pCtxCore->ss, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid, (RTGCPTR)pCtxCore->eip, &GCPtrInstr);
139	if (VBOX_FAILURE(rc))
140	{
141	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Vrc !!\n",
142	pCtxCore->cs, pCtxCore->eip, pCtxCore->ss & X86_SEL_RPL, rc));
143	return rc;
144	}
145	return EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pCpu, pcbInstr);
146	}
147
148
149	/**
150	* Disassembles one instruction.
151	*
152	* This is used by internally by the interpreter and by trap/access handlers.
153	*
154	* @param pVM The VM handle.
155	* @param GCPtrInstr The flat address of the instruction.
156	* @param pCtxCore The context core (used to determin the cpu mode).
157	* @param pCpu Where to return the parsed instruction info.
158	* @param pcbInstr Where to return the instruction size. (optional)
159	*/
160	EMDECL(int) EMInterpretDisasOneEx(PVM pVM, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
161	{
162	int rc = DISCoreOneEx(GCPtrInstr, SELMIsSelector32Bit(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid) ? CPUMODE_32BIT : CPUMODE_16BIT,
163	#ifdef IN_GC
164	NULL, NULL,
165	#else
166	EMReadBytes, pVM,
167	#endif
168	pCpu, pcbInstr);
169	if (VBOX_SUCCESS(rc))
170	return VINF_SUCCESS;
171	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%VGv rc=%Vrc\n", GCPtrInstr, rc));
172	return VERR_INTERNAL_ERROR;
173	}
174
175
176	/**
177	* Interprets the current instruction.
178	*
179	* @returns VBox status code.
180	* @retval VINF_* Scheduling instructions.
181	* @retval VERR_EM_INTERPRETER Something we can't cope with.
182	* @retval VERR_* Fatal errors.
183	*
184	* @param pVM The VM handle.
185	* @param pRegFrame The register frame.
186	* Updates the EIP if an instruction was executed successfully.
187	* @param pvFault The fault address (CR2).
188	* @param pcbSize Size of the write (if applicable).
189	*
190	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
191	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
192	* to worry about e.g. invalid modrm combinations (!)
193	*/
194	EMDECL(int) EMInterpretInstruction(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
195	{
196	/*
197	* Only allow 32-bit code.
198	*/
199	if (SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
200	{
201	RTGCPTR pbCode;
202	int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &pbCode);
203	if (VBOX_SUCCESS(rc))
204	{
205	uint32_t cbOp;
206	DISCPUSTATE Cpu;
207	Cpu.mode = CPUMODE_32BIT;
208	rc = emDisCoreOne(pVM, &Cpu, (RTGCUINTPTR)pbCode, &cbOp);
209	if (VBOX_SUCCESS(rc))
210	{
211	Assert(cbOp == Cpu.opsize);
212	rc = EMInterpretInstructionCPU(pVM, &Cpu, pRegFrame, pvFault, pcbSize);
213	if (VBOX_SUCCESS(rc))
214	{
215	pRegFrame->eip += cbOp; /* Move on to the next instruction. */
216	}
217	return rc;
218	}
219	}
220	}
221	return VERR_EM_INTERPRETER;
222	}
223
224	/**
225	* Interprets the current instruction using the supplied DISCPUSTATE structure.
226	*
227	* EIP is NOT updated!
228	*
229	* @returns VBox status code.
230	* @retval VINF_* Scheduling instructions. When these are returned, it
231	* starts to get a bit tricky to know whether code was
232	* executed or not... We'll address this when it becomes a problem.
233	* @retval VERR_EM_INTERPRETER Something we can't cope with.
234	* @retval VERR_* Fatal errors.
235	*
236	* @param pVM The VM handle.
237	* @param pCpu The disassembler cpu state for the instruction to be interpreted.
238	* @param pRegFrame The register frame. EIP is NOT changed!
239	* @param pvFault The fault address (CR2).
240	* @param pcbSize Size of the write (if applicable).
241	*
242	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
243	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
244	* to worry about e.g. invalid modrm combinations (!)
245	*
246	* @todo At this time we do NOT check if the instruction overwrites vital information.
247	* Make sure this can't happen!! (will add some assertions/checks later)
248	*/
249	EMDECL(int) EMInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
250	{
251	STAM_PROFILE_START(&CTXMID(pVM->em.s.CTXSUFF(pStats)->Stat,Emulate), a);
252	int rc = emInterpretInstructionCPU(pVM, pCpu, pRegFrame, pvFault, pcbSize);
253	STAM_PROFILE_STOP(&CTXMID(pVM->em.s.CTXSUFF(pStats)->Stat,Emulate), a);
254	if (VBOX_SUCCESS(rc))
255	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,InterpretSucceeded));
256	else
257	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,InterpretFailed));
258	return rc;
259	}
260
261
262	/**
263	* Interpret a port I/O instruction.
264	*
265	* @returns VBox status code suitable for scheduling.
266	* @param pVM The VM handle.
267	* @param pCtxCore The context core. This will be updated on successful return.
268	* @param pCpu The instruction to interpret.
269	* @param cbOp The size of the instruction.
270	* @remark This may raise exceptions.
271	*/
272	EMDECL(int) EMInterpretPortIO(PVM pVM, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, uint32_t cbOp)
273	{
274	/*
275	* Hand it on to IOM.
276	*/
277	#ifdef IN_GC
278	int rc = IOMGCIOPortHandler(pVM, pCtxCore, pCpu);
279	if (rc == VINF_SUCCESS)
280	pCtxCore->eip += cbOp;
281	return rc;
282	#else
283	AssertReleaseMsgFailed(("not implemented\n"));
284	return VERR_NOT_IMPLEMENTED;
285	#endif
286	}
287
288
289	inline int emRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
290	{
291	#ifdef IN_GC
292	return MMGCRamRead(pVM, pDest, GCSrc, cb);
293	#else
294	int rc;
295	RTGCPHYS GCPhys;
296	RTGCUINTPTR offset;
297
298	offset = GCSrc & PAGE_OFFSET_MASK;
299
300	rc = PGMPhysGCPtr2GCPhys(pVM, GCSrc, &GCPhys);
301	AssertRCReturn(rc, rc);
302	PGMPhysRead(pVM, GCPhys + offset, pDest, cb);
303	return VINF_SUCCESS;
304	#endif
305	}
306
307	inline int emRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
308	{
309	#ifdef IN_GC
310	return MMGCRamWrite(pVM, GCDest, pSrc, cb);
311	#else
312	int rc;
313	RTGCPHYS GCPhys;
314	RTGCUINTPTR offset;
315
316	offset = GCDest & PAGE_OFFSET_MASK;
317	rc = PGMPhysGCPtr2GCPhys(pVM, GCDest, &GCPhys);
318	AssertRCReturn(rc, rc);
319	PGMPhysWrite(pVM, GCPhys + offset, pSrc, cb);
320	return VINF_SUCCESS;
321	#endif
322	}
323
324	/* Convert sel:addr to a flat GC address */
325	static RTGCPTR emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, POP_PARAMETER pParam, RTGCPTR pvAddr)
326	{
327	int prefix_seg, rc;
328	RTSEL sel;
329	CPUMSELREGHID *pSelHidReg;
330
331	prefix_seg = DISDetectSegReg(pCpu, pParam);
332	rc = DISFetchRegSegEx(pRegFrame, prefix_seg, &sel, &pSelHidReg);
333	if (RT_UNLIKELY(VBOX_FAILURE(rc)))
334	return pvAddr;
335
336	return SELMToFlat(pVM, pRegFrame->eflags, sel, pSelHidReg, pvAddr);
337	}
338
339	/**
340	* XCHG instruction emulation.
341	*/
342	static int emInterpretXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
343	{
344	OP_PARAMVAL param1, param2;
345
346	/* Source to make DISQueryParamVal read the register value - ugly hack */
347	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
348	if(VBOX_FAILURE(rc))
349	return VERR_EM_INTERPRETER;
350
351	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
352	if(VBOX_FAILURE(rc))
353	return VERR_EM_INTERPRETER;
354
355	#ifdef IN_GC
356	if (TRPMHasTrap(pVM))
357	{
358	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
359	{
360	#endif
361	RTGCPTR pParam1 = 0, pParam2 = 0;
362	uint32_t valpar1, valpar2;
363
364	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
365	switch(param1.type)
366	{
367	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
368	valpar1 = param1.val.val32;
369	break;
370
371	case PARMTYPE_ADDRESS:
372	pParam1 = (RTGCPTR)param1.val.val32;
373	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
374	#ifdef IN_GC
375	/* Safety check (in theory it could cross a page boundary and fault there though) */
376	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
377	#endif
378	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
379	if (VBOX_FAILURE(rc))
380	{
381	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
382	return VERR_EM_INTERPRETER;
383	}
384	break;
385
386	default:
387	AssertFailed();
388	return VERR_EM_INTERPRETER;
389	}
390
391	switch(param2.type)
392	{
393	case PARMTYPE_ADDRESS:
394	pParam2 = (RTGCPTR)param2.val.val32;
395	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pParam2);
396	#ifdef IN_GC
397	/* Safety check (in theory it could cross a page boundary and fault there though) */
398	AssertReturn(pParam2 == pvFault, VERR_EM_INTERPRETER);
399	#endif
400	rc = emRamRead(pVM, &valpar2, pParam2, param2.size);
401	if (VBOX_FAILURE(rc))
402	{
403	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
404	}
405	break;
406
407	case PARMTYPE_IMMEDIATE:
408	valpar2 = param2.val.val32;
409	break;
410
411	default:
412	AssertFailed();
413	return VERR_EM_INTERPRETER;
414	}
415
416	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
417	if (pParam1 == 0)
418	{
419	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
420	switch(param1.size)
421	{
422	case 1: //special case for AH etc
423	rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen8, (uint8_t)valpar2); break;
424	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen32, (uint16_t)valpar2); break;
425	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen32, valpar2); break;
426	default: AssertFailedReturn(VERR_EM_INTERPRETER);
427	}
428	if (VBOX_FAILURE(rc))
429	return VERR_EM_INTERPRETER;
430	}
431	else
432	{
433	rc = emRamWrite(pVM, pParam1, &valpar2, param1.size);
434	if (VBOX_FAILURE(rc))
435	{
436	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
437	return VERR_EM_INTERPRETER;
438	}
439	}
440
441	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
442	if (pParam2 == 0)
443	{
444	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
445	switch(param2.size)
446	{
447	case 1: //special case for AH etc
448	rc = DISWriteReg8(pRegFrame, pCpu->param2.base.reg_gen8, (uint8_t)valpar1); break;
449	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param2.base.reg_gen32, (uint16_t)valpar1); break;
450	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param2.base.reg_gen32, valpar1); break;
451	default: AssertFailedReturn(VERR_EM_INTERPRETER);
452	}
453	if (VBOX_FAILURE(rc))
454	return VERR_EM_INTERPRETER;
455	}
456	else
457	{
458	rc = emRamWrite(pVM, pParam2, &valpar1, param2.size);
459	if (VBOX_FAILURE(rc))
460	{
461	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
462	return VERR_EM_INTERPRETER;
463	}
464	}
465
466	*pcbSize = param2.size;
467	return VINF_SUCCESS;
468	#ifdef IN_GC
469	}
470	}
471	#endif
472	return VERR_EM_INTERPRETER;
473	}
474
475	/**
476	* INC and DEC emulation.
477	*/
478	static int emInterpretIncDec(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
479	PFN_EMULATE_PARAM2 pfnEmulate)
480	{
481	OP_PARAMVAL param1;
482
483	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
484	if(VBOX_FAILURE(rc))
485	return VERR_EM_INTERPRETER;
486
487	#ifdef IN_GC
488	if (TRPMHasTrap(pVM))
489	{
490	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
491	{
492	#endif
493	RTGCPTR pParam1 = 0;
494	uint32_t valpar1;
495
496	if (param1.type == PARMTYPE_ADDRESS)
497	{
498	pParam1 = (RTGCPTR)param1.val.val32;
499	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
500	#ifdef IN_GC
501	/* Safety check (in theory it could cross a page boundary and fault there though) */
502	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
503	#endif
504	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
505	if (VBOX_FAILURE(rc))
506	{
507	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
508	return VERR_EM_INTERPRETER;
509	}
510	}
511	else
512	{
513	AssertFailed();
514	return VERR_EM_INTERPRETER;
515	}
516
517	uint32_t eflags;
518
519	eflags = pfnEmulate(&valpar1, param1.size);
520
521	/* Write result back */
522	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
523	if (VBOX_FAILURE(rc))
524	{
525	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
526	return VERR_EM_INTERPRETER;
527	}
528
529	/* Update guest's eflags and finish. */
530	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
531	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
532
533	/* All done! */
534	*pcbSize = param1.size;
535	return VINF_SUCCESS;
536	#ifdef IN_GC
537	}
538	}
539	#endif
540	return VERR_EM_INTERPRETER;
541	}
542
543	/**
544	* POP Emulation.
545	*/
546	static int emInterpretPop(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
547	{
548	OP_PARAMVAL param1;
549	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
550	if(VBOX_FAILURE(rc))
551	return VERR_EM_INTERPRETER;
552
553	#ifdef IN_GC
554	if (TRPMHasTrap(pVM))
555	{
556	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
557	{
558	#endif
559	RTGCPTR pParam1 = 0;
560	uint32_t valpar1;
561	RTGCPTR pStackVal;
562
563	/* Read stack value first */
564	if (SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == false)
565	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
566
567	/* Convert address; don't bother checking limits etc, as we only read here */
568	pStackVal = SELMToFlat(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid, (RTGCPTR)pRegFrame->esp);
569	if (pStackVal == 0)
570	return VERR_EM_INTERPRETER;
571
572	rc = emRamRead(pVM, &valpar1, pStackVal, param1.size);
573	if (VBOX_FAILURE(rc))
574	{
575	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
576	return VERR_EM_INTERPRETER;
577	}
578
579	if (param1.type == PARMTYPE_ADDRESS)
580	{
581	pParam1 = (RTGCPTR)param1.val.val32;
582
583	/* pop [esp+xx] uses esp after the actual pop! */
584	AssertCompile(USE_REG_ESP == USE_REG_SP);
585	if ( (pCpu->param1.flags & USE_BASE)
586	&& (pCpu->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
587	&& pCpu->param1.base.reg_gen32 == USE_REG_ESP
588	)
589	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
590
591	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
592
593	#ifdef IN_GC
594	/* Safety check (in theory it could cross a page boundary and fault there though) */
595	AssertMsgReturn(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, ("%VGv != %VGv ss:esp=%04X:%VGv\n", pParam1, pvFault, pRegFrame->ss, pRegFrame->esp), VERR_EM_INTERPRETER);
596	#endif
597	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
598	if (VBOX_FAILURE(rc))
599	{
600	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
601	return VERR_EM_INTERPRETER;
602	}
603
604	/* Update ESP as the last step */
605	pRegFrame->esp += param1.size;
606	}
607	else
608	{
609	#ifndef DEBUG_bird // annoying assertion.
610	AssertFailed();
611	#endif
612	return VERR_EM_INTERPRETER;
613	}
614
615	/* All done! */
616	*pcbSize = param1.size;
617	return VINF_SUCCESS;
618	#ifdef IN_GC
619	}
620	}
621	#endif
622	return VERR_EM_INTERPRETER;
623	}
624
625
626	/**
627	* XOR/OR/AND Emulation.
628	*/
629	static int emInterpretOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
630	PFN_EMULATE_PARAM3 pfnEmulate)
631	{
632	OP_PARAMVAL param1, param2;
633	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
634	if(VBOX_FAILURE(rc))
635	return VERR_EM_INTERPRETER;
636
637	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
638	if(VBOX_FAILURE(rc))
639	return VERR_EM_INTERPRETER;
640
641	#ifdef DEBUG
642	char *pszInstr;
643
644	if (pCpu->pCurInstr->opcode == OP_XOR)
645	pszInstr = "Xor";
646	else
647	if (pCpu->pCurInstr->opcode == OP_OR)
648	pszInstr = "Or";
649	else
650	if (pCpu->pCurInstr->opcode == OP_AND)
651	pszInstr = "And";
652	#endif
653
654	#ifdef IN_GC
655	if (TRPMHasTrap(pVM))
656	{
657	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
658	{
659	#endif
660	RTGCPTR pParam1;
661	uint32_t valpar1, valpar2;
662
663	if (pCpu->param1.size != pCpu->param2.size)
664	{
665	if (pCpu->param1.size < pCpu->param2.size)
666	{
667	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", pszInstr, pRegFrame->eip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
668	return VERR_EM_INTERPRETER;
669	}
670	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
671	pCpu->param2.size = pCpu->param1.size;
672	param2.size = param1.size;
673	}
674
675	/* The destination is always a virtual address */
676	if (param1.type == PARMTYPE_ADDRESS)
677	{
678	pParam1 = (RTGCPTR)param1.val.val32;
679	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
680
681	#ifdef IN_GC
682	/* Safety check (in theory it could cross a page boundary and fault there though) */
683	AssertMsgReturn(pParam1 == pvFault, ("eip=%VGv, pParam1=%VGv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
684	#endif
685	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
686	if (VBOX_FAILURE(rc))
687	{
688	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
689	return VERR_EM_INTERPRETER;
690	}
691	}
692	else
693	{
694	AssertFailed();
695	return VERR_EM_INTERPRETER;
696	}
697
698	/* Register or immediate data */
699	switch(param2.type)
700	{
701	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
702	valpar2 = param2.val.val32;
703	break;
704
705	default:
706	AssertFailed();
707	return VERR_EM_INTERPRETER;
708	}
709
710	/* Data read, emulate instruction. */
711	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
712
713	/* Update guest's eflags and finish. */
714	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
715	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
716
717	/* And write it back */
718	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
719	if (VBOX_SUCCESS(rc))
720	{
721	/* All done! */
722	*pcbSize = param2.size;
723	return VINF_SUCCESS;
724	}
725	#ifdef IN_GC
726	}
727	}
728	#endif
729	return VERR_EM_INTERPRETER;
730	}
731
732
733	/**
734	* ADD, ADC & SUB Emulation.
735	*/
736	static int emInterpretAddSub(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
737	PFN_EMULATE_PARAM3 pfnEmulate)
738	{
739	OP_PARAMVAL param1, param2;
740	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
741	if(VBOX_FAILURE(rc))
742	return VERR_EM_INTERPRETER;
743
744	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
745	if(VBOX_FAILURE(rc))
746	return VERR_EM_INTERPRETER;
747
748	#ifdef DEBUG
749	char *pszInstr;
750
751	if (pCpu->pCurInstr->opcode == OP_SUB)
752	pszInstr = "Sub";
753	else
754	if (pCpu->pCurInstr->opcode == OP_ADD)
755	pszInstr = "Add";
756	else
757	if (pCpu->pCurInstr->opcode == OP_ADC)
758	pszInstr = "Adc";
759	#endif
760
761	#ifdef IN_GC
762	if (TRPMHasTrap(pVM))
763	{
764	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
765	{
766	#endif
767	RTGCPTR pParam1;
768	uint32_t valpar1, valpar2;
769
770	if (pCpu->param1.size != pCpu->param2.size)
771	{
772	if (pCpu->param1.size < pCpu->param2.size)
773	{
774	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", pszInstr, pRegFrame->eip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
775	return VERR_EM_INTERPRETER;
776	}
777	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
778	pCpu->param2.size = pCpu->param1.size;
779	param2.size = param1.size;
780	}
781
782	/* The destination is always a virtual address */
783	if (param1.type == PARMTYPE_ADDRESS)
784	{
785	pParam1 = (RTGCPTR)param1.val.val32;
786	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
787
788	#ifdef IN_GC
789	/* Safety check (in theory it could cross a page boundary and fault there though) */
790	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
791	#endif
792	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
793	if (VBOX_FAILURE(rc))
794	{
795	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
796	return VERR_EM_INTERPRETER;
797	}
798	}
799	else
800	{
801	#ifndef DEBUG_bird
802	AssertFailed();
803	#endif
804	return VERR_EM_INTERPRETER;
805	}
806
807	/* Register or immediate data */
808	switch(param2.type)
809	{
810	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
811	valpar2 = param2.val.val32;
812	break;
813
814	default:
815	AssertFailed();
816	return VERR_EM_INTERPRETER;
817	}
818
819	/* Data read, emulate instruction. */
820	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
821
822	/* Update guest's eflags and finish. */
823	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
824	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
825
826	/* And write it back */
827	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
828	if (VBOX_SUCCESS(rc))
829	{
830	/* All done! */
831	*pcbSize = param2.size;
832	return VINF_SUCCESS;
833	}
834	#ifdef IN_GC
835	}
836	}
837	#endif
838	return VERR_EM_INTERPRETER;
839	}
840
841	/**
842	* ADC Emulation.
843	*/
844	static int emInterpretAdc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
845	{
846	if (pRegFrame->eflags.Bits.u1CF)
847	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
848	else
849	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
850	}
851
852	/**
853	* BTR/C/S Emulation.
854	*/
855	static int emInterpretBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
856	PFN_EMULATE_PARAM2_UINT32 pfnEmulate)
857	{
858	OP_PARAMVAL param1, param2;
859	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
860	if(VBOX_FAILURE(rc))
861	return VERR_EM_INTERPRETER;
862
863	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
864	if(VBOX_FAILURE(rc))
865	return VERR_EM_INTERPRETER;
866
867	#ifdef DEBUG
868	char *pszInstr;
869
870	if (pCpu->pCurInstr->opcode == OP_BTR)
871	pszInstr = "Btr";
872	else
873	if (pCpu->pCurInstr->opcode == OP_BTS)
874	pszInstr = "Bts";
875	else
876	if (pCpu->pCurInstr->opcode == OP_BTC)
877	pszInstr = "Btc";
878	#endif
879
880	#ifdef IN_GC
881	if (TRPMHasTrap(pVM))
882	{
883	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
884	{
885	#endif
886	RTGCPTR pParam1;
887	uint32_t valpar1 = 0, valpar2;
888	uint32_t eflags;
889
890	/* The destination is always a virtual address */
891	if (param1.type != PARMTYPE_ADDRESS)
892	return VERR_EM_INTERPRETER;
893
894	pParam1 = (RTGCPTR)param1.val.val32;
895	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
896
897	/* Register or immediate data */
898	switch(param2.type)
899	{
900	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
901	valpar2 = param2.val.val32;
902	break;
903
904	default:
905	AssertFailed();
906	return VERR_EM_INTERPRETER;
907	}
908
909	Log2(("emInterpret%s: pvFault=%VGv pParam1=%VGv val2=%x\n", pszInstr, pvFault, pParam1, valpar2));
910	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
911	#ifdef IN_GC
912	/* Safety check. */
913	AssertMsgReturn((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, ("pParam1=%VGv pvFault=%VGv\n", pParam1, pvFault), VERR_EM_INTERPRETER);
914	#endif
915	rc = emRamRead(pVM, &valpar1, pParam1, 1);
916	if (VBOX_FAILURE(rc))
917	{
918	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
919	return VERR_EM_INTERPRETER;
920	}
921
922	Log2(("emInterpretBtx: val=%x\n", valpar1));
923	/* Data read, emulate bit test instruction. */
924	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
925
926	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
927
928	/* Update guest's eflags and finish. */
929	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
930	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
931
932	/* And write it back */
933	rc = emRamWrite(pVM, pParam1, &valpar1, 1);
934	if (VBOX_SUCCESS(rc))
935	{
936	/* All done! */
937	*pcbSize = 1;
938	return VINF_SUCCESS;
939	}
940	#ifdef IN_GC
941	}
942	}
943	#endif
944	return VERR_EM_INTERPRETER;
945	}
946
947	/**
948	* MOV emulation.
949	*/
950	static int emInterpretMov(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
951	{
952	OP_PARAMVAL param1, param2;
953	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
954	if(VBOX_FAILURE(rc))
955	return VERR_EM_INTERPRETER;
956
957	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
958	if(VBOX_FAILURE(rc))
959	return VERR_EM_INTERPRETER;
960
961	#ifdef IN_GC
962	if (TRPMHasTrap(pVM))
963	{
964	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
965	{
966	#else
967	/** @todo Make this the default and don't rely on TRPM information. */
968	if (param1.type == PARMTYPE_ADDRESS)
969	{
970	#endif
971	RTGCPTR pDest;
972	uint32_t val32;
973
974	switch(param1.type)
975	{
976	case PARMTYPE_IMMEDIATE:
977	if(!(param1.flags & PARAM_VAL32))
978	return VERR_EM_INTERPRETER;
979	/* fallthru */
980
981	case PARMTYPE_ADDRESS:
982	pDest = (RTGCPTR)param1.val.val32;
983	pDest = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pDest);
984	break;
985
986	default:
987	AssertFailed();
988	return VERR_EM_INTERPRETER;
989	}
990
991	switch(param2.type)
992	{
993	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
994	val32 = param2.val.val32;
995	break;
996
997	default:
998	Log(("emInterpretMov: unexpected type=%d eip=%VGv\n", param2.type, pRegFrame->eip));
999	return VERR_EM_INTERPRETER;
1000	}
1001	LogFlow(("EMInterpretInstruction at %08x: OP_MOV %08X <- %08X (%d) &val32=%08x\n", pRegFrame->eip, pDest, val32, param2.size, &val32));
1002
1003	Assert(param2.size <= 4 && param2.size > 0);
1004
1005	#ifdef IN_GC
1006	/* Safety check (in theory it could cross a page boundary and fault there though) */
1007	AssertMsgReturn(pDest == pvFault, ("eip=%VGv pDest=%VGv pvFault=%VGv\n", pRegFrame->eip, pDest, pvFault), VERR_EM_INTERPRETER);
1008	#endif
1009	rc = emRamWrite(pVM, pDest, &val32, param2.size);
1010	if (VBOX_FAILURE(rc))
1011	return VERR_EM_INTERPRETER;
1012
1013	*pcbSize = param2.size;
1014	}
1015	else
1016	{ /* read fault */
1017	RTGCPTR pSrc;
1018	uint32_t val32;
1019
1020	/* Source */
1021	switch(param2.type)
1022	{
1023	case PARMTYPE_IMMEDIATE:
1024	if(!(param2.flags & PARAM_VAL32))
1025	return VERR_EM_INTERPRETER;
1026	/* fallthru */
1027
1028	case PARMTYPE_ADDRESS:
1029	pSrc = (RTGCPTR)param2.val.val32;
1030	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pSrc);
1031	break;
1032
1033	default:
1034	return VERR_EM_INTERPRETER;
1035	}
1036
1037	Assert(param1.size <= 4 && param1.size > 0);
1038	#ifdef IN_GC
1039	/* Safety check (in theory it could cross a page boundary and fault there though) */
1040	AssertReturn(pSrc == pvFault, VERR_EM_INTERPRETER);
1041	#endif
1042	rc = emRamRead(pVM, &val32, pSrc, param1.size);
1043	if (VBOX_FAILURE(rc))
1044	return VERR_EM_INTERPRETER;
1045
1046	/* Destination */
1047	switch(param1.type)
1048	{
1049	case PARMTYPE_REGISTER:
1050	switch(param1.size)
1051	{
1052	case 1: rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen8, (uint8_t)val32); break;
1053	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen16, (uint16_t)val32); break;
1054	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen32, val32); break;
1055	default:
1056	return VERR_EM_INTERPRETER;
1057	}
1058	if (VBOX_FAILURE(rc))
1059	return rc;
1060	break;
1061
1062	default:
1063	return VERR_EM_INTERPRETER;
1064	}
1065	LogFlow(("EMInterpretInstruction: OP_MOV %08X -> %08X (%d)\n", pSrc, val32, param1.size));
1066	}
1067	return VINF_SUCCESS;
1068	#ifdef IN_GC
1069	}
1070	#endif
1071	return VERR_EM_INTERPRETER;
1072	}
1073
1074	#ifdef IN_GC
1075	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1076	{
1077	OP_PARAMVAL param1, param2;
1078
1079	/* Source to make DISQueryParamVal read the register value - ugly hack */
1080	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1081	if(VBOX_FAILURE(rc))
1082	return VERR_EM_INTERPRETER;
1083
1084	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1085	if(VBOX_FAILURE(rc))
1086	return VERR_EM_INTERPRETER;
1087
1088	if (TRPMHasTrap(pVM))
1089	{
1090	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1091	{
1092	RTGCPTR pParam1;
1093	uint32_t valpar, eflags;
1094	#ifdef VBOX_STRICT
1095	uint32_t valpar1;
1096	#endif
1097
1098	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1099	switch(param1.type)
1100	{
1101	case PARMTYPE_ADDRESS:
1102	pParam1 = (RTGCPTR)param1.val.val32;
1103	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
1104
1105	/* Safety check (in theory it could cross a page boundary and fault there though) */
1106	AssertMsgReturn(pParam1 == pvFault, ("eip=%VGv pParam1=%VGv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
1107
1108	#ifdef VBOX_STRICT
1109	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
1110	if (VBOX_FAILURE(rc))
1111	return VERR_EM_INTERPRETER;
1112	#endif
1113	break;
1114
1115	default:
1116	return VERR_EM_INTERPRETER;
1117	}
1118
1119	switch(param2.type)
1120	{
1121	case PARMTYPE_IMMEDIATE: /* register actually */
1122	valpar = param2.val.val32;
1123	break;
1124
1125	default:
1126	return VERR_EM_INTERPRETER;
1127	}
1128
1129	#ifdef VBOX_STRICT
1130	LogFlow(("CmpXchg %VGv=%08x eax=%08x %08x\n", pParam1, valpar1, pRegFrame->eax, valpar));
1131	#endif
1132	if (pCpu->prefix & PREFIX_LOCK)
1133	eflags = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size);
1134	else
1135	eflags = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size);
1136
1137	#ifdef VBOX_STRICT
1138	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
1139	LogFlow(("CmpXchg %VGv=%08x eax=%08x %08x ZF=%d\n", pParam1, valpar1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1140	#endif
1141	/* Update guest's eflags and finish. */
1142	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1143	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1144
1145	*pcbSize = param2.size;
1146	return VINF_SUCCESS;
1147	}
1148	}
1149	return VERR_EM_INTERPRETER;
1150	}
1151	#endif
1152
1153	/**
1154	* Interpret IRET (currently only to V86 code)
1155	*
1156	* @returns VBox status code.
1157	* @param pVM The VM handle.
1158	* @param pRegFrame The register frame.
1159	*
1160	*/
1161	EMDECL(int) EMInterpretIret(PVM pVM, PCPUMCTXCORE pRegFrame)
1162	{
1163	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1164	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1165	int rc;
1166
1167	rc = emRamRead(pVM, &eip, (RTGCPTR)pIretStack , 4);
1168	rc \|= emRamRead(pVM, &cs, (RTGCPTR)(pIretStack + 4), 4);
1169	rc \|= emRamRead(pVM, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1170	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1171	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1172
1173	rc \|= emRamRead(pVM, &esp, (RTGCPTR)(pIretStack + 12), 4);
1174	rc \|= emRamRead(pVM, &ss, (RTGCPTR)(pIretStack + 16), 4);
1175	rc \|= emRamRead(pVM, &es, (RTGCPTR)(pIretStack + 20), 4);
1176	rc \|= emRamRead(pVM, &ds, (RTGCPTR)(pIretStack + 24), 4);
1177	rc \|= emRamRead(pVM, &fs, (RTGCPTR)(pIretStack + 28), 4);
1178	rc \|= emRamRead(pVM, &gs, (RTGCPTR)(pIretStack + 32), 4);
1179	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1180
1181	pRegFrame->eip = eip & 0xffff;
1182	pRegFrame->cs = cs;
1183
1184	/* Mask away all reserved bits */
1185	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1186	eflags &= uMask;
1187
1188	#ifndef IN_RING0
1189	CPUMRawSetEFlags(pVM, pRegFrame, eflags);
1190	#endif
1191	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1192
1193	pRegFrame->esp = esp;
1194	pRegFrame->ss = ss;
1195	pRegFrame->ds = ds;
1196	pRegFrame->es = es;
1197	pRegFrame->fs = fs;
1198	pRegFrame->gs = gs;
1199
1200	return VINF_SUCCESS;
1201	}
1202
1203
1204	/**
1205	* IRET Emulation.
1206	*/
1207	static int emInterpretIret(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1208	{
1209	/* only allow direct calls to EMInterpretIret for now */
1210	return VERR_EM_INTERPRETER;
1211	}
1212
1213	/**
1214	* INVLPG Emulation.
1215	*/
1216
1217	/**
1218	* Interpret INVLPG
1219	*
1220	* @returns VBox status code.
1221	* @param pVM The VM handle.
1222	* @param pRegFrame The register frame.
1223	* @param pAddrGC Operand address
1224	*
1225	*/
1226	EMDECL(int) EMInterpretInvlpg(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1227	{
1228	int rc;
1229
1230	/** @todo is addr always a flat linear address or ds based
1231	* (in absence of segment override prefixes)????
1232	*/
1233	#ifdef IN_GC
1234	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1235	LogFlow(("GC: EMULATE: invlpg %08X\n", pAddrGC));
1236	rc = PGMGCInvalidatePage(pVM, pAddrGC);
1237	#else
1238	rc = PGMInvalidatePage(pVM, pAddrGC);
1239	#endif
1240	if (VBOX_SUCCESS(rc))
1241	return VINF_SUCCESS;
1242	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1243	return VERR_EM_INTERPRETER;
1244	}
1245
1246	static int emInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1247	{
1248	OP_PARAMVAL param1;
1249	RTGCPTR addr;
1250
1251	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1252	if(VBOX_FAILURE(rc))
1253	return VERR_EM_INTERPRETER;
1254
1255	switch(param1.type)
1256	{
1257	case PARMTYPE_IMMEDIATE:
1258	case PARMTYPE_ADDRESS:
1259	if(!(param1.flags & PARAM_VAL32))
1260	return VERR_EM_INTERPRETER;
1261	addr = (RTGCPTR)param1.val.val32;
1262	break;
1263
1264	default:
1265	return VERR_EM_INTERPRETER;
1266	}
1267
1268	/** @todo is addr always a flat linear address or ds based
1269	* (in absence of segment override prefixes)????
1270	*/
1271	#ifdef IN_GC
1272	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1273	LogFlow(("GC: EMULATE: invlpg %08X\n", addr));
1274	rc = PGMGCInvalidatePage(pVM, addr);
1275	#else
1276	rc = PGMInvalidatePage(pVM, addr);
1277	#endif
1278	if (VBOX_SUCCESS(rc))
1279	return VINF_SUCCESS;
1280	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1281	return VERR_EM_INTERPRETER;
1282	}
1283
1284	/**
1285	* CPUID Emulation.
1286	*/
1287
1288	/**
1289	* Interpret CPUID given the parameters in the CPU context
1290	*
1291	* @returns VBox status code.
1292	* @param pVM The VM handle.
1293	* @param pRegFrame The register frame.
1294	*
1295	*/
1296	EMDECL(int) EMInterpretCpuId(PVM pVM, PCPUMCTXCORE pRegFrame)
1297	{
1298	CPUMGetGuestCpuId(pVM, pRegFrame->eax, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1299	return VINF_SUCCESS;
1300	}
1301
1302	static int emInterpretCpuId(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1303	{
1304	uint32_t iLeaf = pRegFrame->eax; NOREF(iLeaf);
1305
1306	int rc = EMInterpretCpuId(pVM, pRegFrame);
1307	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1308	return rc;
1309	}
1310
1311	/**
1312	* MOV CRx Emulation.
1313	*/
1314
1315	/**
1316	* Interpret CRx read
1317	*
1318	* @returns VBox status code.
1319	* @param pVM The VM handle.
1320	* @param pRegFrame The register frame.
1321	* @param DestRegGen General purpose register index (USE_REG_E**))
1322	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1323	*
1324	*/
1325	EMDECL(int) EMInterpretCRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1326	{
1327	uint32_t val32;
1328
1329	int rc = CPUMGetGuestCRx(pVM, SrcRegCrx, &val32);
1330	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1331	rc = DISWriteReg32(pRegFrame, DestRegGen, val32);
1332	if(VBOX_SUCCESS(rc))
1333	{
1334	LogFlow(("MOV_CR: gen32=%d CR=%d val=%08x\n", DestRegGen, SrcRegCrx, val32));
1335	return VINF_SUCCESS;
1336	}
1337	return VERR_EM_INTERPRETER;
1338	}
1339
1340
1341	/**
1342	* Interpret LMSW
1343	*
1344	* @returns VBox status code.
1345	* @param pVM The VM handle.
1346	* @param u16Data LMSW source data.
1347	*
1348	*/
1349	EMDECL(int) EMInterpretLMSW(PVM pVM, uint16_t u16Data)
1350	{
1351	uint32_t OldCr0 = CPUMGetGuestCR0(pVM);
1352
1353	/* don't use this path to go into protected mode! */
1354	Assert(OldCr0 & X86_CR0_PE);
1355	if (!(OldCr0 & X86_CR0_PE))
1356	return VERR_EM_INTERPRETER;
1357
1358	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1359	uint32_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1360	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1361
1362	#ifdef IN_GC
1363	/* Need to change the hyper CR0? Doing it the lazy way then. */
1364	if ( (OldCr0 & (X86_CR0_TS \| X86_CR0_EM \| X86_CR0_MP \| X86_CR0_AM \| X86_CR0_WP))
1365	!= (NewCr0 & (X86_CR0_TS \| X86_CR0_EM \| X86_CR0_MP \| X86_CR0_AM \| X86_CR0_WP)))
1366	{
1367	Log(("EMInterpretLMSW: CR0: %#x->%#x => R3\n", OldCr0, NewCr0));
1368	VM_FF_SET(pVM, VM_FF_TO_R3);
1369	}
1370	#endif
1371
1372	return CPUMSetGuestCR0(pVM, NewCr0);
1373	}
1374
1375
1376	/**
1377	* Interpret CLTS
1378	*
1379	* @returns VBox status code.
1380	* @param pVM The VM handle.
1381	*
1382	*/
1383	EMDECL(int) EMInterpretCLTS(PVM pVM)
1384	{
1385	uint32_t Cr0 = CPUMGetGuestCR0(pVM);
1386	if (!(Cr0 & X86_CR0_TS))
1387	return VINF_SUCCESS;
1388
1389	#ifdef IN_GC
1390	/* Need to change the hyper CR0? Doing it the lazy way then. */
1391	Log(("EMInterpretCLTS: CR0: %#x->%#x => R3\n", Cr0, Cr0 & ~X86_CR0_TS));
1392	VM_FF_SET(pVM, VM_FF_TO_R3);
1393	#endif
1394	return CPUMSetGuestCR0(pVM, Cr0 & ~X86_CR0_TS);
1395	}
1396
1397
1398	/**
1399	* Interpret CRx write
1400	*
1401	* @returns VBox status code.
1402	* @param pVM The VM handle.
1403	* @param pRegFrame The register frame.
1404	* @param DestRegCRx CRx register index (USE_REG_CR*)
1405	* @param SrcRegGen General purpose register index (USE_REG_E**))
1406	*
1407	*/
1408	EMDECL(int) EMInterpretCRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
1409	{
1410	uint32_t val32;
1411	uint32_t oldval;
1412	/** @todo Clean up this mess. */
1413
1414	int rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1415	if (VBOX_SUCCESS(rc))
1416	{
1417	switch (DestRegCrx)
1418	{
1419	case USE_REG_CR0:
1420	oldval = CPUMGetGuestCR0(pVM);
1421	#ifndef IN_RING3
1422	/* CR0.WP changes require a reschedule run in ring 3. */
1423	if ((val32 & X86_CR0_WP) != (oldval & X86_CR0_WP))
1424	return VERR_EM_INTERPRETER;
1425	#endif
1426	rc = CPUMSetGuestCR0(pVM, val32); AssertRC(rc); /** @todo CPUSetGuestCR0 stuff should be void, this is silly. */
1427	val32 = CPUMGetGuestCR0(pVM);
1428	if ( (oldval & (X86_CR0_PG\|X86_CR0_WP\|X86_CR0_PE))
1429	!= (val32 & (X86_CR0_PG\|X86_CR0_WP\|X86_CR0_PE)))
1430	{
1431	/* global flush */
1432	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
1433	AssertRCReturn(rc, rc);
1434	}
1435	# ifdef IN_GC
1436	/* Feeling extremely lazy. */
1437	if ( (oldval & (X86_CR0_TS\|X86_CR0_EM\|X86_CR0_MP\|X86_CR0_AM))
1438	!= (val32 & (X86_CR0_TS\|X86_CR0_EM\|X86_CR0_MP\|X86_CR0_AM)))
1439	{
1440	Log(("emInterpretMovCRx: CR0: %#x->%#x => R3\n", oldval, val32));
1441	VM_FF_SET(pVM, VM_FF_TO_R3);
1442	}
1443	# endif
1444	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), 0);
1445
1446	case USE_REG_CR2:
1447	rc = CPUMSetGuestCR2(pVM, val32); AssertRC(rc);
1448	return VINF_SUCCESS;
1449
1450	case USE_REG_CR3:
1451	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
1452	rc = CPUMSetGuestCR3(pVM, val32); AssertRC(rc);
1453	if (CPUMGetGuestCR0(pVM) & X86_CR0_PG)
1454	{
1455	/* flush */
1456	rc = PGMFlushTLB(pVM, val32, !(CPUMGetGuestCR4(pVM) & X86_CR4_PGE));
1457	AssertRCReturn(rc, rc);
1458	}
1459	return VINF_SUCCESS;
1460
1461	case USE_REG_CR4:
1462	oldval = CPUMGetGuestCR4(pVM);
1463	#ifndef IN_RING3
1464	/** @todo is flipping of the X86_CR4_PAE bit handled correctly here? */
1465	#endif
1466	rc = CPUMSetGuestCR4(pVM, val32); AssertRC(rc);
1467	val32 = CPUMGetGuestCR4(pVM);
1468	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
1469	!= (val32 & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
1470	{
1471	/* global flush */
1472	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
1473	AssertRCReturn(rc, rc);
1474	}
1475	# ifndef IN_RING3 /** @todo check this out IN_RING0! */
1476	/* Feeling extremely lazy. */
1477	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
1478	!= (val32 & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
1479	{
1480	Log(("emInterpretMovCRx: CR4: %#x->%#x => R3\n", oldval, val32));
1481	VM_FF_SET(pVM, VM_FF_TO_R3);
1482	}
1483	# endif
1484	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), 0);
1485
1486	default:
1487	AssertFailed();
1488	case USE_REG_CR1: /* illegal op */
1489	break;
1490	}
1491	}
1492	return VERR_EM_INTERPRETER;
1493	}
1494
1495	static int emInterpretMovCRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1496	{
1497	if (pCpu->param1.flags == USE_REG_GEN32 && pCpu->param2.flags == USE_REG_CR)
1498	return EMInterpretCRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen32, pCpu->param2.base.reg_ctrl);
1499	if (pCpu->param1.flags == USE_REG_CR && pCpu->param2.flags == USE_REG_GEN32)
1500	return EMInterpretCRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_ctrl, pCpu->param2.base.reg_gen32);
1501	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
1502	return VERR_EM_INTERPRETER;
1503	}
1504
1505	/**
1506	* MOV DRx
1507	*/
1508
1509	/**
1510	* Interpret DRx write
1511	*
1512	* @returns VBox status code.
1513	* @param pVM The VM handle.
1514	* @param pRegFrame The register frame.
1515	* @param DestRegDRx DRx register index (USE_REG_DR*)
1516	* @param SrcRegGen General purpose register index (USE_REG_E**))
1517	*
1518	*/
1519	EMDECL(int) EMInterpretDRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
1520	{
1521	uint32_t val32;
1522
1523	int rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1524	if (VBOX_SUCCESS(rc))
1525	{
1526	rc = CPUMSetGuestDRx(pVM, DestRegDrx, val32);
1527	if (VBOX_SUCCESS(rc))
1528	return rc;
1529	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
1530	}
1531	return VERR_EM_INTERPRETER;
1532	}
1533
1534	/**
1535	* Interpret DRx read
1536	*
1537	* @returns VBox status code.
1538	* @param pVM The VM handle.
1539	* @param pRegFrame The register frame.
1540	* @param DestRegGen General purpose register index (USE_REG_E**))
1541	* @param SrcRegDRx DRx register index (USE_REG_DR*)
1542	*
1543	*/
1544	EMDECL(int) EMInterpretDRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
1545	{
1546	uint32_t val32;
1547
1548	int rc = CPUMGetGuestDRx(pVM, SrcRegDrx, &val32);
1549	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
1550	rc = DISWriteReg32(pRegFrame, DestRegGen, val32);
1551	if (VBOX_SUCCESS(rc))
1552	return VINF_SUCCESS;
1553	return VERR_EM_INTERPRETER;
1554	}
1555
1556	static int emInterpretMovDRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1557	{
1558	int rc = VERR_EM_INTERPRETER;
1559
1560	if(pCpu->param1.flags == USE_REG_GEN32 && pCpu->param2.flags == USE_REG_DBG)
1561	{
1562	rc = EMInterpretDRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen32, pCpu->param2.base.reg_dbg);
1563	}
1564	else
1565	if(pCpu->param1.flags == USE_REG_DBG && pCpu->param2.flags == USE_REG_GEN32)
1566	{
1567	rc = EMInterpretDRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_dbg, pCpu->param2.base.reg_gen32);
1568	}
1569	else
1570	AssertMsgFailed(("Unexpected debug register move\n"));
1571	return rc;
1572	}
1573
1574	/**
1575	* LLDT Emulation.
1576	*/
1577	static int emInterpretLLdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1578	{
1579	OP_PARAMVAL param1;
1580	RTSEL sel;
1581
1582	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1583	if(VBOX_FAILURE(rc))
1584	return VERR_EM_INTERPRETER;
1585
1586	switch(param1.type)
1587	{
1588	case PARMTYPE_ADDRESS:
1589	return VERR_EM_INTERPRETER; //feeling lazy right now
1590
1591	case PARMTYPE_IMMEDIATE:
1592	if(!(param1.flags & PARAM_VAL16))
1593	return VERR_EM_INTERPRETER;
1594	sel = (RTSEL)param1.val.val16;
1595	break;
1596
1597	default:
1598	return VERR_EM_INTERPRETER;
1599	}
1600
1601	if (sel == 0)
1602	{
1603	if (CPUMGetHyperLDTR(pVM) == 0)
1604	{
1605	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
1606	return VINF_SUCCESS;
1607	}
1608	}
1609	//still feeling lazy
1610	return VERR_EM_INTERPRETER;
1611	}
1612
1613	#ifdef IN_GC
1614	/**
1615	* STI Emulation.
1616	*
1617	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
1618	*/
1619	static int emInterpretSti(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1620	{
1621	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
1622
1623	if(!pGCState)
1624	{
1625	Assert(pGCState);
1626	return VERR_EM_INTERPRETER;
1627	}
1628	pGCState->uVMFlags \|= X86_EFL_IF;
1629
1630	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
1631	Assert(pvFault == SELMToFlat(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip));
1632
1633	pVM->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pCpu->opsize;
1634	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
1635
1636	return VINF_SUCCESS;
1637	}
1638	#endif /* IN_GC */
1639
1640
1641	/**
1642	* HLT Emulation.
1643	*/
1644	static int emInterpretHlt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1645	{
1646	return VINF_EM_HALT;
1647	}
1648
1649
1650	/**
1651	* RDTSC Emulation.
1652	*/
1653	static int emInterpretRdtsc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1654	{
1655	unsigned uCR4 = CPUMGetGuestCR4(pVM);
1656
1657	if (uCR4 & X86_CR4_TSD)
1658	return VERR_EM_INTERPRETER; /* genuine #GP */
1659
1660	uint64_t uTicks = TMCpuTickGet(pVM);
1661
1662	pRegFrame->eax = uTicks;
1663	pRegFrame->edx = (uTicks >> 32ULL);
1664
1665	return VINF_SUCCESS;
1666	}
1667
1668	/**
1669	* MONITOR Emulation.
1670	*/
1671	static int emInterpretMonitor(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1672	{
1673	uint32_t u32Dummy, u32ExtFeatures, cpl;
1674
1675	if (pRegFrame->ecx != 0)
1676	return VERR_EM_INTERPRETER; /* illegal value. */
1677
1678	/* Get the current privilege level. */
1679	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1680	if (cpl != 0)
1681	return VERR_EM_INTERPRETER; /* supervisor only */
1682
1683	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1684	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1685	return VERR_EM_INTERPRETER; /* not supported */
1686
1687	return VINF_SUCCESS;
1688	}
1689
1690
1691	/**
1692	* MWAIT Emulation.
1693	*/
1694	static int emInterpretMWait(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1695	{
1696	uint32_t u32Dummy, u32ExtFeatures, cpl;
1697
1698	if (pRegFrame->ecx != 0)
1699	return VERR_EM_INTERPRETER; /* illegal value. */
1700
1701	/* Get the current privilege level. */
1702	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1703	if (cpl != 0)
1704	return VERR_EM_INTERPRETER; /* supervisor only */
1705
1706	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1707	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1708	return VERR_EM_INTERPRETER; /* not supported */
1709
1710	/** @todo not completely correct */
1711	return VINF_EM_HALT;
1712	}
1713
1714
1715	/**
1716	* Internal worker.
1717	* @copydoc EMInterpretInstructionCPU
1718	*/
1719	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1720	{
1721	Assert(pcbSize);
1722	*pcbSize = 0;
1723
1724	/*
1725	* Only supervisor guest code!!
1726	* And no complicated prefixes.
1727	*/
1728	/* Get the current privilege level. */
1729	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1730	if ( cpl != 0
1731	&& pCpu->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
1732	{
1733	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
1734	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedUserMode));
1735	return VERR_EM_INTERPRETER;
1736	}
1737
1738	#ifdef IN_GC
1739	if ( (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP))
1740	\|\| ( (pCpu->prefix & PREFIX_LOCK)
1741	&& (pCpu->pCurInstr->opcode != OP_CMPXCHG)
1742	)
1743	)
1744	#else
1745	if (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP \| PREFIX_LOCK))
1746	#endif
1747	{
1748	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
1749	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedPrefix));
1750	return VERR_EM_INTERPRETER;
1751	}
1752
1753	int rc;
1754	switch (pCpu->pCurInstr->opcode)
1755	{
1756	#define INTERPRET_CASE_EX_PARAM3(opcode,Instr,InstrFn, pfnEmulate) \
1757	case opcode:\
1758	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
1759	if (VBOX_SUCCESS(rc)) \
1760	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
1761	else \
1762	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
1763	return rc
1764	#define INTERPRET_CASE_EX_PARAM2(opcode,Instr,InstrFn, pfnEmulate) \
1765	case opcode:\
1766	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
1767	if (VBOX_SUCCESS(rc)) \
1768	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
1769	else \
1770	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
1771	return rc
1772	#define INTERPRET_CASE(opcode,Instr) \
1773	case opcode:\
1774	rc = emInterpret##Instr(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
1775	if (VBOX_SUCCESS(rc)) \
1776	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
1777	else \
1778	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
1779	return rc
1780	#define INTERPRET_STAT_CASE(opcode,Instr) \
1781	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
1782
1783	INTERPRET_CASE(OP_XCHG,Xchg);
1784	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec,IncDec,EMEmulateDec);
1785	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc,IncDec,EMEmulateInc);
1786	INTERPRET_CASE(OP_POP,Pop);
1787	INTERPRET_CASE_EX_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr);
1788	INTERPRET_CASE_EX_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor);
1789	INTERPRET_CASE_EX_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd);
1790	INTERPRET_CASE(OP_MOV,Mov);
1791	INTERPRET_CASE(OP_INVLPG,InvlPg);
1792	INTERPRET_CASE(OP_CPUID,CpuId);
1793	INTERPRET_CASE(OP_MOV_CR,MovCRx);
1794	INTERPRET_CASE(OP_MOV_DR,MovDRx);
1795	INTERPRET_CASE(OP_LLDT,LLdt);
1796	INTERPRET_CASE(OP_MONITOR, Monitor);
1797	INTERPRET_CASE(OP_MWAIT, MWait);
1798	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
1799	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
1800	INTERPRET_CASE(OP_ADC,Adc);
1801	INTERPRET_CASE_EX_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr);
1802	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
1803	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
1804	INTERPRET_CASE(OP_RDTSC,Rdtsc);
1805	#ifdef IN_GC
1806	INTERPRET_CASE(OP_STI,Sti);
1807	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
1808	#endif
1809	INTERPRET_CASE(OP_HLT,Hlt);
1810	INTERPRET_CASE(OP_IRET,Iret);
1811	#ifdef VBOX_WITH_STATISTICS
1812	#ifndef IN_GC
1813	INTERPRET_STAT_CASE(OP_CMPXCHG,CmpXchg);
1814	#endif
1815	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
1816	INTERPRET_STAT_CASE(OP_STOSWD,StosWD);
1817	INTERPRET_STAT_CASE(OP_WBINVD,WbInvd);
1818	#endif
1819	default:
1820	Log3(("emInterpretInstructionCPU: opcode=%d\n", pCpu->pCurInstr->opcode));
1821	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedMisc));
1822	return VERR_EM_INTERPRETER;
1823	#undef INTERPRET_CASE_EX_PARAM2
1824	#undef INTERPRET_STAT_CASE
1825	#undef INTERPRET_CASE_EX
1826	#undef INTERPRET_CASE
1827	}
1828	AssertFailed();
1829	return VERR_INTERNAL_ERROR;
1830	}
1831
1832
1833	/**
1834	* Sets the PC for which interrupts should be inhibited.
1835	*
1836	* @param pVM The VM handle.
1837	* @param PC The PC.
1838	*/
1839	EMDECL(void) EMSetInhibitInterruptsPC(PVM pVM, RTGCUINTPTR PC)
1840	{
1841	pVM->em.s.GCPtrInhibitInterrupts = PC;
1842	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
1843	}
1844
1845
1846	/**
1847	* Gets the PC for which interrupts should be inhibited.
1848	*
1849	* There are a few instructions which inhibits or delays interrupts
1850	* for the instruction following them. These instructions are:
1851	* - STI
1852	* - MOV SS, r/m16
1853	* - POP SS
1854	*
1855	* @returns The PC for which interrupts should be inhibited.
1856	* @param pVM VM handle.
1857	*
1858	*/
1859	EMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVM pVM)
1860	{
1861	return pVM->em.s.GCPtrInhibitInterrupts;
1862	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 2121

Download in other formats: