EMAll.cpp@ 23011

Last change on this file since 23011 was 22493, checked in by vboxsync, 15 years ago
VMM,DevPCI,VBox/types.h: Added a VBOXSTRICTRC type for indicating strict VBox stuatus codes. Some expirmentation with making it a class in strict builds to get some help from the compiler with making sure the return code is treated correctly.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 114.9 KB

Line
1	/* $Id: EMAll.cpp 22493 2009-08-26 22:22:16Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_EM
26	#include <VBox/em.h>
27	#include <VBox/mm.h>
28	#include <VBox/selm.h>
29	#include <VBox/patm.h>
30	#include <VBox/csam.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/stam.h>
34	#include "EMInternal.h"
35	#include <VBox/vm.h>
36	#include <VBox/vmm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Defined Constants And Macros *
53	*******************************************************************************/
54	/** @def EM_ASSERT_FAULT_RETURN
55	* Safety check.
56	*
57	* Could in theory misfire on a cross page boundary access...
58	*
59	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
60	* turns up an alias page instead of the original faulting one and annoying the
61	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
62	*/
63	#if 0
64	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
65	#else
66	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
67	#endif
68
69	/* Used to pass information during instruction disassembly. */
70	typedef struct
71	{
72	PVM pVM;
73	PVMCPU pVCpu;
74	RTGCPTR GCPtr;
75	uint8_t aOpcode[8];
76	} EMDISSTATE, *PEMDISSTATE;
77
78	/*******************************************************************************
79	* Internal Functions *
80	*******************************************************************************/
81	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
82
83
84
85	/**
86	* Get the current execution manager status.
87	*
88	* @returns Current status.
89	* @param pVCpu The VMCPU to operate on.
90	*/
91	VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
92	{
93	return pVCpu->em.s.enmState;
94	}
95
96	/**
97	* Sets the current execution manager status. (use only when you know what you're doing!)
98	*
99	* @param pVCpu The VMCPU to operate on.
100	*/
101	VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
102	{
103	/* Only allowed combination: */
104	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
105	pVCpu->em.s.enmState = enmNewState;
106	}
107
108
109	#ifndef IN_RC
110
111	/**
112	* Read callback for disassembly function; supports reading bytes that cross a page boundary
113	*
114	* @returns VBox status code.
115	* @param pSrc GC source pointer
116	* @param pDest HC destination pointer
117	* @param cb Number of bytes to read
118	* @param dwUserdata Callback specific user data (pDis)
119	*
120	*/
121	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
122	{
123	PDISCPUSTATE pDis = (PDISCPUSTATE)pvUserdata;
124	PEMDISSTATE pState = (PEMDISSTATE)pDis->apvUserData[0];
125	PVM pVM = pState->pVM;
126	PVMCPU pVCpu = pState->pVCpu;
127
128	# ifdef IN_RING0
129	int rc;
130
131	if ( pState->GCPtr
132	&& pSrc + cb <= pState->GCPtr + sizeof(pState->aOpcode))
133	{
134	unsigned offset = pSrc - pState->GCPtr;
135
136	Assert(pSrc >= pState->GCPtr);
137
138	for (unsigned i=0; i<cb; i++)
139	{
140	pDest[i] = pState->aOpcode[offset + i];
141	}
142	return VINF_SUCCESS;
143	}
144
145	rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
146	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%RGv cb=%x rc=%d\n", pSrc, cb, rc));
147	# else /* IN_RING3 */
148	if (!PATMIsPatchGCAddr(pVM, pSrc))
149	{
150	int rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
151	AssertRC(rc);
152	}
153	else
154	{
155	for (unsigned i = 0; i < cb; i++)
156	{
157	uint8_t opcode;
158	if (RT_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
159	*(pDest+i) = opcode;
160
161	}
162	}
163	# endif /* IN_RING3 */
164	return VINF_SUCCESS;
165	}
166
167	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
168	{
169	EMDISSTATE State;
170
171	State.pVM = pVM;
172	State.pVCpu = pVCpu;
173	int rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, InstrGC, sizeof(State.aOpcode));
174	if (RT_SUCCESS(rc))
175	State.GCPtr = InstrGC;
176	else
177	State.GCPtr = NIL_RTGCPTR;
178
179	return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
180	}
181
182	#else /* IN_RC */
183
184	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
185	{
186	NOREF(pVCpu);
187	NOREF(pVM);
188	return DISCoreOne(pDis, InstrGC, pOpsize);
189	}
190
191	#endif /* IN_RC */
192
193
194	/**
195	* Disassembles one instruction.
196	*
197	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
198	* details.
199	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
200	*
201	* @param pVM The VM handle.
202	* @param pVCpu The VMCPU handle.
203	* @param pCtxCore The context core (used for both the mode and instruction).
204	* @param pDis Where to return the parsed instruction info.
205	* @param pcbInstr Where to return the instruction size. (optional)
206	*/
207	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
208	{
209	RTGCPTR GCPtrInstr;
210	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
211	if (RT_FAILURE(rc))
212	{
213	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
214	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
215	return rc;
216	}
217	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
218	}
219
220
221	/**
222	* Disassembles one instruction.
223	*
224	* This is used by internally by the interpreter and by trap/access handlers.
225	*
226	* @returns VBox status code.
227	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
228	*
229	* @param pVM The VM handle.
230	* @param pVCpu The VMCPU handle.
231	* @param GCPtrInstr The flat address of the instruction.
232	* @param pCtxCore The context core (used to determine the cpu mode).
233	* @param pDis Where to return the parsed instruction info.
234	* @param pcbInstr Where to return the instruction size. (optional)
235	*/
236	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
237	{
238	int rc;
239
240	#ifndef IN_RC
241	EMDISSTATE State;
242
243	State.pVM = pVM;
244	State.pVCpu = pVCpu;
245
246	rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, GCPtrInstr, sizeof(State.aOpcode));
247	if (RT_SUCCESS(rc))
248	State.GCPtr = GCPtrInstr;
249	else
250	State.GCPtr = NIL_RTGCPTR;
251	#endif
252
253	rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
254	#ifdef IN_RC
255	NULL, NULL,
256	#else
257	EMReadBytes, &State,
258	#endif
259	pDis, pcbInstr);
260	if (RT_SUCCESS(rc))
261	return VINF_SUCCESS;
262	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
263	return VERR_INTERNAL_ERROR;
264	}
265
266
267	/**
268	* Interprets the current instruction.
269	*
270	* @returns VBox status code.
271	* @retval VINF_* Scheduling instructions.
272	* @retval VERR_EM_INTERPRETER Something we can't cope with.
273	* @retval VERR_* Fatal errors.
274	*
275	* @param pVM The VM handle.
276	* @param pVCpu The VMCPU handle.
277	* @param pRegFrame The register frame.
278	* Updates the EIP if an instruction was executed successfully.
279	* @param pvFault The fault address (CR2).
280	* @param pcbSize Size of the write (if applicable).
281	*
282	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
283	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
284	* to worry about e.g. invalid modrm combinations (!)
285	*/
286	VMMDECL(int) EMInterpretInstruction(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
287	{
288	RTGCPTR pbCode;
289
290	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
291	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
292	if (RT_SUCCESS(rc))
293	{
294	uint32_t cbOp;
295	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
296	pDis->mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
297	rc = emDisCoreOne(pVM, pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
298	if (RT_SUCCESS(rc))
299	{
300	Assert(cbOp == pDis->opsize);
301	rc = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
302	if (RT_SUCCESS(rc))
303	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
304
305	return rc;
306	}
307	}
308	return VERR_EM_INTERPRETER;
309	}
310
311
312	/**
313	* Interprets the current instruction using the supplied DISCPUSTATE structure.
314	*
315	* EIP is NOT updated!
316	*
317	* @returns VBox status code.
318	* @retval VINF_* Scheduling instructions. When these are returned, it
319	* starts to get a bit tricky to know whether code was
320	* executed or not... We'll address this when it becomes a problem.
321	* @retval VERR_EM_INTERPRETER Something we can't cope with.
322	* @retval VERR_* Fatal errors.
323	*
324	* @param pVM The VM handle.
325	* @param pVCpu The VMCPU handle.
326	* @param pDis The disassembler cpu state for the instruction to be
327	* interpreted.
328	* @param pRegFrame The register frame. EIP is NOT changed!
329	* @param pvFault The fault address (CR2).
330	* @param pcbSize Size of the write (if applicable).
331	*
332	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
333	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
334	* to worry about e.g. invalid modrm combinations (!)
335	*
336	* @todo At this time we do NOT check if the instruction overwrites vital information.
337	* Make sure this can't happen!! (will add some assertions/checks later)
338	*/
339	VMMDECL(int) EMInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
340	{
341	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
342	int rc = emInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
343	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
344	if (RT_SUCCESS(rc))
345	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
346	else
347	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
348	return rc;
349	}
350
351
352	/**
353	* Interpret a port I/O instruction.
354	*
355	* @returns VBox status code suitable for scheduling.
356	* @param pVM The VM handle.
357	* @param pVCpu The VMCPU handle.
358	* @param pCtxCore The context core. This will be updated on successful return.
359	* @param pDis The instruction to interpret.
360	* @param cbOp The size of the instruction.
361	* @remark This may raise exceptions.
362	*/
363	VMMDECL(VBOXSTRICTRC) EMInterpretPortIO(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, uint32_t cbOp)
364	{
365	/*
366	* Hand it on to IOM.
367	*/
368	#ifdef IN_RC
369	VBOXSTRICTRC rcStrict = IOMGCIOPortHandler(pVM, pCtxCore, pDis);
370	if (IOM_SUCCESS(rcStrict))
371	pCtxCore->rip += cbOp;
372	return rcStrict;
373	#else
374	AssertReleaseMsgFailed(("not implemented\n"));
375	return VERR_NOT_IMPLEMENTED;
376	#endif
377	}
378
379
380	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
381	{
382	#ifdef IN_RC
383	int rc = MMGCRamRead(pVM, pvDst, (void *)GCPtrSrc, cb);
384	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
385	return rc;
386	/*
387	* The page pool cache may end up here in some cases because it
388	* flushed one of the shadow mappings used by the trapping
389	* instruction and it either flushed the TLB or the CPU reused it.
390	*/
391	#endif
392	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
393	}
394
395
396	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
397	{
398	#ifdef IN_RC
399	int rc = MMGCRamWrite(pVM, (void )(uintptr_t)GCPtrDst, (void )pvSrc, cb);
400	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
401	return rc;
402	/*
403	* The page pool cache may end up here in some cases because it
404	* flushed one of the shadow mappings used by the trapping
405	* instruction and it either flushed the TLB or the CPU reused it.
406	* We want to play safe here, verifying that we've got write
407	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
408	*/
409	#endif
410	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
411	}
412
413
414	/** Convert sel:addr to a flat GC address. */
415	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, POP_PARAMETER pParam, RTGCPTR pvAddr)
416	{
417	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
418	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
419	}
420
421
422	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
423	/**
424	* Get the mnemonic for the disassembled instruction.
425	*
426	* GC/R0 doesn't include the strings in the DIS tables because
427	* of limited space.
428	*/
429	static const char *emGetMnemonic(PDISCPUSTATE pDis)
430	{
431	switch (pDis->pCurInstr->opcode)
432	{
433	case OP_XCHG: return "Xchg";
434	case OP_DEC: return "Dec";
435	case OP_INC: return "Inc";
436	case OP_POP: return "Pop";
437	case OP_OR: return "Or";
438	case OP_AND: return "And";
439	case OP_MOV: return "Mov";
440	case OP_INVLPG: return "InvlPg";
441	case OP_CPUID: return "CpuId";
442	case OP_MOV_CR: return "MovCRx";
443	case OP_MOV_DR: return "MovDRx";
444	case OP_LLDT: return "LLdt";
445	case OP_LGDT: return "LGdt";
446	case OP_LIDT: return "LGdt";
447	case OP_CLTS: return "Clts";
448	case OP_MONITOR: return "Monitor";
449	case OP_MWAIT: return "MWait";
450	case OP_RDMSR: return "Rdmsr";
451	case OP_WRMSR: return "Wrmsr";
452	case OP_ADD: return "Add";
453	case OP_ADC: return "Adc";
454	case OP_SUB: return "Sub";
455	case OP_SBB: return "Sbb";
456	case OP_RDTSC: return "Rdtsc";
457	case OP_STI: return "Sti";
458	case OP_CLI: return "Cli";
459	case OP_XADD: return "XAdd";
460	case OP_HLT: return "Hlt";
461	case OP_IRET: return "Iret";
462	case OP_MOVNTPS: return "MovNTPS";
463	case OP_STOSWD: return "StosWD";
464	case OP_WBINVD: return "WbInvd";
465	case OP_XOR: return "Xor";
466	case OP_BTR: return "Btr";
467	case OP_BTS: return "Bts";
468	case OP_BTC: return "Btc";
469	case OP_LMSW: return "Lmsw";
470	case OP_SMSW: return "Smsw";
471	case OP_CMPXCHG: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
472	case OP_CMPXCHG8B: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
473
474	default:
475	Log(("Unknown opcode %d\n", pDis->pCurInstr->opcode));
476	return "???";
477	}
478	}
479	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
480
481
482	/**
483	* XCHG instruction emulation.
484	*/
485	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
486	{
487	OP_PARAMVAL param1, param2;
488
489	/* Source to make DISQueryParamVal read the register value - ugly hack */
490	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
491	if(RT_FAILURE(rc))
492	return VERR_EM_INTERPRETER;
493
494	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
495	if(RT_FAILURE(rc))
496	return VERR_EM_INTERPRETER;
497
498	#ifdef IN_RC
499	if (TRPMHasTrap(pVCpu))
500	{
501	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
502	{
503	#endif
504	RTGCPTR pParam1 = 0, pParam2 = 0;
505	uint64_t valpar1, valpar2;
506
507	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
508	switch(param1.type)
509	{
510	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
511	valpar1 = param1.val.val64;
512	break;
513
514	case PARMTYPE_ADDRESS:
515	pParam1 = (RTGCPTR)param1.val.val64;
516	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
517	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
518	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
519	if (RT_FAILURE(rc))
520	{
521	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
522	return VERR_EM_INTERPRETER;
523	}
524	break;
525
526	default:
527	AssertFailed();
528	return VERR_EM_INTERPRETER;
529	}
530
531	switch(param2.type)
532	{
533	case PARMTYPE_ADDRESS:
534	pParam2 = (RTGCPTR)param2.val.val64;
535	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pParam2);
536	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
537	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
538	if (RT_FAILURE(rc))
539	{
540	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
541	}
542	break;
543
544	case PARMTYPE_IMMEDIATE:
545	valpar2 = param2.val.val64;
546	break;
547
548	default:
549	AssertFailed();
550	return VERR_EM_INTERPRETER;
551	}
552
553	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
554	if (pParam1 == 0)
555	{
556	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
557	switch(param1.size)
558	{
559	case 1: //special case for AH etc
560	rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t )valpar2); break;
561	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)valpar2); break;
562	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)valpar2); break;
563	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, valpar2); break;
564	default: AssertFailedReturn(VERR_EM_INTERPRETER);
565	}
566	if (RT_FAILURE(rc))
567	return VERR_EM_INTERPRETER;
568	}
569	else
570	{
571	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
572	if (RT_FAILURE(rc))
573	{
574	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
575	return VERR_EM_INTERPRETER;
576	}
577	}
578
579	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
580	if (pParam2 == 0)
581	{
582	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
583	switch(param2.size)
584	{
585	case 1: //special case for AH etc
586	rc = DISWriteReg8(pRegFrame, pDis->param2.base.reg_gen, (uint8_t )valpar1); break;
587	case 2: rc = DISWriteReg16(pRegFrame, pDis->param2.base.reg_gen, (uint16_t)valpar1); break;
588	case 4: rc = DISWriteReg32(pRegFrame, pDis->param2.base.reg_gen, (uint32_t)valpar1); break;
589	case 8: rc = DISWriteReg64(pRegFrame, pDis->param2.base.reg_gen, valpar1); break;
590	default: AssertFailedReturn(VERR_EM_INTERPRETER);
591	}
592	if (RT_FAILURE(rc))
593	return VERR_EM_INTERPRETER;
594	}
595	else
596	{
597	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
598	if (RT_FAILURE(rc))
599	{
600	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
601	return VERR_EM_INTERPRETER;
602	}
603	}
604
605	*pcbSize = param2.size;
606	return VINF_SUCCESS;
607	#ifdef IN_RC
608	}
609	}
610	#endif
611	return VERR_EM_INTERPRETER;
612	}
613
614
615	/**
616	* INC and DEC emulation.
617	*/
618	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
619	PFNEMULATEPARAM2 pfnEmulate)
620	{
621	OP_PARAMVAL param1;
622
623	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
624	if(RT_FAILURE(rc))
625	return VERR_EM_INTERPRETER;
626
627	#ifdef IN_RC
628	if (TRPMHasTrap(pVCpu))
629	{
630	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
631	{
632	#endif
633	RTGCPTR pParam1 = 0;
634	uint64_t valpar1;
635
636	if (param1.type == PARMTYPE_ADDRESS)
637	{
638	pParam1 = (RTGCPTR)param1.val.val64;
639	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
640	#ifdef IN_RC
641	/* Safety check (in theory it could cross a page boundary and fault there though) */
642	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
643	#endif
644	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
645	if (RT_FAILURE(rc))
646	{
647	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
648	return VERR_EM_INTERPRETER;
649	}
650	}
651	else
652	{
653	AssertFailed();
654	return VERR_EM_INTERPRETER;
655	}
656
657	uint32_t eflags;
658
659	eflags = pfnEmulate(&valpar1, param1.size);
660
661	/* Write result back */
662	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
663	if (RT_FAILURE(rc))
664	{
665	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
666	return VERR_EM_INTERPRETER;
667	}
668
669	/* Update guest's eflags and finish. */
670	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
671	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
672
673	/* All done! */
674	*pcbSize = param1.size;
675	return VINF_SUCCESS;
676	#ifdef IN_RC
677	}
678	}
679	#endif
680	return VERR_EM_INTERPRETER;
681	}
682
683
684	/**
685	* POP Emulation.
686	*/
687	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
688	{
689	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
690	OP_PARAMVAL param1;
691	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
692	if(RT_FAILURE(rc))
693	return VERR_EM_INTERPRETER;
694
695	#ifdef IN_RC
696	if (TRPMHasTrap(pVCpu))
697	{
698	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
699	{
700	#endif
701	RTGCPTR pParam1 = 0;
702	uint32_t valpar1;
703	RTGCPTR pStackVal;
704
705	/* Read stack value first */
706	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
707	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
708
709	/* Convert address; don't bother checking limits etc, as we only read here */
710	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
711	if (pStackVal == 0)
712	return VERR_EM_INTERPRETER;
713
714	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
715	if (RT_FAILURE(rc))
716	{
717	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
718	return VERR_EM_INTERPRETER;
719	}
720
721	if (param1.type == PARMTYPE_ADDRESS)
722	{
723	pParam1 = (RTGCPTR)param1.val.val64;
724
725	/* pop [esp+xx] uses esp after the actual pop! */
726	AssertCompile(USE_REG_ESP == USE_REG_SP);
727	if ( (pDis->param1.flags & USE_BASE)
728	&& (pDis->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
729	&& pDis->param1.base.reg_gen == USE_REG_ESP
730	)
731	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
732
733	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
734	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
735	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
736	if (RT_FAILURE(rc))
737	{
738	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
739	return VERR_EM_INTERPRETER;
740	}
741
742	/* Update ESP as the last step */
743	pRegFrame->esp += param1.size;
744	}
745	else
746	{
747	#ifndef DEBUG_bird // annoying assertion.
748	AssertFailed();
749	#endif
750	return VERR_EM_INTERPRETER;
751	}
752
753	/* All done! */
754	*pcbSize = param1.size;
755	return VINF_SUCCESS;
756	#ifdef IN_RC
757	}
758	}
759	#endif
760	return VERR_EM_INTERPRETER;
761	}
762
763
764	/**
765	* XOR/OR/AND Emulation.
766	*/
767	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
768	PFNEMULATEPARAM3 pfnEmulate)
769	{
770	OP_PARAMVAL param1, param2;
771
772	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
773	if(RT_FAILURE(rc))
774	return VERR_EM_INTERPRETER;
775
776	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
777	if(RT_FAILURE(rc))
778	return VERR_EM_INTERPRETER;
779
780	#ifdef IN_RC
781	if (TRPMHasTrap(pVCpu))
782	{
783	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
784	{
785	#endif
786	RTGCPTR pParam1;
787	uint64_t valpar1, valpar2;
788
789	if (pDis->param1.size != pDis->param2.size)
790	{
791	if (pDis->param1.size < pDis->param2.size)
792	{
793	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
794	return VERR_EM_INTERPRETER;
795	}
796	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
797	pDis->param2.size = pDis->param1.size;
798	param2.size = param1.size;
799	}
800
801	/* The destination is always a virtual address */
802	if (param1.type == PARMTYPE_ADDRESS)
803	{
804	pParam1 = (RTGCPTR)param1.val.val64;
805	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
806	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
807	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
808	if (RT_FAILURE(rc))
809	{
810	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
811	return VERR_EM_INTERPRETER;
812	}
813	}
814	else
815	{
816	AssertFailed();
817	return VERR_EM_INTERPRETER;
818	}
819
820	/* Register or immediate data */
821	switch(param2.type)
822	{
823	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
824	valpar2 = param2.val.val64;
825	break;
826
827	default:
828	AssertFailed();
829	return VERR_EM_INTERPRETER;
830	}
831
832	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
833
834	/* Data read, emulate instruction. */
835	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
836
837	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
838
839	/* Update guest's eflags and finish. */
840	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
841	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
842
843	/* And write it back */
844	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
845	if (RT_SUCCESS(rc))
846	{
847	/* All done! */
848	*pcbSize = param2.size;
849	return VINF_SUCCESS;
850	}
851	#ifdef IN_RC
852	}
853	}
854	#endif
855	return VERR_EM_INTERPRETER;
856	}
857
858
859	/**
860	* LOCK XOR/OR/AND Emulation.
861	*/
862	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
863	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
864	{
865	void *pvParam1;
866	OP_PARAMVAL param1, param2;
867
868	#if HC_ARCH_BITS == 32
869	Assert(pDis->param1.size <= 4);
870	#endif
871
872	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
873	if(RT_FAILURE(rc))
874	return VERR_EM_INTERPRETER;
875
876	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
877	if(RT_FAILURE(rc))
878	return VERR_EM_INTERPRETER;
879
880	if (pDis->param1.size != pDis->param2.size)
881	{
882	AssertMsgReturn(pDis->param1.size >= pDis->param2.size, /* should never happen! */
883	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size),
884	VERR_EM_INTERPRETER);
885
886	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
887	pDis->param2.size = pDis->param1.size;
888	param2.size = param1.size;
889	}
890
891	#ifdef IN_RC
892	/* Safety check (in theory it could cross a page boundary and fault there though) */
893	Assert( TRPMHasTrap(pVCpu)
894	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
895	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
896	#endif
897
898	/* Register and immediate data == PARMTYPE_IMMEDIATE */
899	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
900	RTGCUINTREG ValPar2 = param2.val.val64;
901
902	/* The destination is always a virtual address */
903	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
904
905	RTGCPTR GCPtrPar1 = param1.val.val64;
906	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
907	#ifdef IN_RC
908	pvParam1 = (void *)GCPtrPar1;
909	#else
910	PGMPAGEMAPLOCK Lock;
911	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
912	AssertRCReturn(rc, VERR_EM_INTERPRETER);
913	#endif
914
915	/* Try emulate it with a one-shot #PF handler in place. (RC) */
916	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
917
918	RTGCUINTREG32 eflags = 0;
919	#ifdef IN_RC
920	MMGCRamRegisterTrapHandler(pVM);
921	#endif
922	rc = pfnEmulate(pvParam1, ValPar2, pDis->param2.size, &eflags);
923	#ifdef IN_RC
924	MMGCRamDeregisterTrapHandler(pVM);
925	#else
926	PGMPhysReleasePageMappingLock(pVM, &Lock);
927	#endif
928	if (RT_FAILURE(rc))
929	{
930	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
931	return VERR_EM_INTERPRETER;
932	}
933
934	/* Update guest's eflags and finish. */
935	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
936	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
937
938	*pcbSize = param2.size;
939	return VINF_SUCCESS;
940	}
941
942
943	/**
944	* ADD, ADC & SUB Emulation.
945	*/
946	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
947	PFNEMULATEPARAM3 pfnEmulate)
948	{
949	OP_PARAMVAL param1, param2;
950	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
951	if(RT_FAILURE(rc))
952	return VERR_EM_INTERPRETER;
953
954	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
955	if(RT_FAILURE(rc))
956	return VERR_EM_INTERPRETER;
957
958	#ifdef IN_RC
959	if (TRPMHasTrap(pVCpu))
960	{
961	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
962	{
963	#endif
964	RTGCPTR pParam1;
965	uint64_t valpar1, valpar2;
966
967	if (pDis->param1.size != pDis->param2.size)
968	{
969	if (pDis->param1.size < pDis->param2.size)
970	{
971	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
972	return VERR_EM_INTERPRETER;
973	}
974	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
975	pDis->param2.size = pDis->param1.size;
976	param2.size = param1.size;
977	}
978
979	/* The destination is always a virtual address */
980	if (param1.type == PARMTYPE_ADDRESS)
981	{
982	pParam1 = (RTGCPTR)param1.val.val64;
983	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
984	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
985	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
986	if (RT_FAILURE(rc))
987	{
988	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
989	return VERR_EM_INTERPRETER;
990	}
991	}
992	else
993	{
994	#ifndef DEBUG_bird
995	AssertFailed();
996	#endif
997	return VERR_EM_INTERPRETER;
998	}
999
1000	/* Register or immediate data */
1001	switch(param2.type)
1002	{
1003	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1004	valpar2 = param2.val.val64;
1005	break;
1006
1007	default:
1008	AssertFailed();
1009	return VERR_EM_INTERPRETER;
1010	}
1011
1012	/* Data read, emulate instruction. */
1013	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1014
1015	/* Update guest's eflags and finish. */
1016	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1017	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1018
1019	/* And write it back */
1020	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1021	if (RT_SUCCESS(rc))
1022	{
1023	/* All done! */
1024	*pcbSize = param2.size;
1025	return VINF_SUCCESS;
1026	}
1027	#ifdef IN_RC
1028	}
1029	}
1030	#endif
1031	return VERR_EM_INTERPRETER;
1032	}
1033
1034
1035	/**
1036	* ADC Emulation.
1037	*/
1038	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1039	{
1040	if (pRegFrame->eflags.Bits.u1CF)
1041	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1042	else
1043	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1044	}
1045
1046
1047	/**
1048	* BTR/C/S Emulation.
1049	*/
1050	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1051	PFNEMULATEPARAM2UINT32 pfnEmulate)
1052	{
1053	OP_PARAMVAL param1, param2;
1054	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1055	if(RT_FAILURE(rc))
1056	return VERR_EM_INTERPRETER;
1057
1058	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1059	if(RT_FAILURE(rc))
1060	return VERR_EM_INTERPRETER;
1061
1062	#ifdef IN_RC
1063	if (TRPMHasTrap(pVCpu))
1064	{
1065	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1066	{
1067	#endif
1068	RTGCPTR pParam1;
1069	uint64_t valpar1 = 0, valpar2;
1070	uint32_t eflags;
1071
1072	/* The destination is always a virtual address */
1073	if (param1.type != PARMTYPE_ADDRESS)
1074	return VERR_EM_INTERPRETER;
1075
1076	pParam1 = (RTGCPTR)param1.val.val64;
1077	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1078
1079	/* Register or immediate data */
1080	switch(param2.type)
1081	{
1082	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1083	valpar2 = param2.val.val64;
1084	break;
1085
1086	default:
1087	AssertFailed();
1088	return VERR_EM_INTERPRETER;
1089	}
1090
1091	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1092	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1093	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1094	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1095	if (RT_FAILURE(rc))
1096	{
1097	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1098	return VERR_EM_INTERPRETER;
1099	}
1100
1101	Log2(("emInterpretBtx: val=%x\n", valpar1));
1102	/* Data read, emulate bit test instruction. */
1103	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1104
1105	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1106
1107	/* Update guest's eflags and finish. */
1108	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1109	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1110
1111	/* And write it back */
1112	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1113	if (RT_SUCCESS(rc))
1114	{
1115	/* All done! */
1116	*pcbSize = 1;
1117	return VINF_SUCCESS;
1118	}
1119	#ifdef IN_RC
1120	}
1121	}
1122	#endif
1123	return VERR_EM_INTERPRETER;
1124	}
1125
1126
1127	/**
1128	* LOCK BTR/C/S Emulation.
1129	*/
1130	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1131	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1132	{
1133	void *pvParam1;
1134
1135	OP_PARAMVAL param1, param2;
1136	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1137	if(RT_FAILURE(rc))
1138	return VERR_EM_INTERPRETER;
1139
1140	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1141	if(RT_FAILURE(rc))
1142	return VERR_EM_INTERPRETER;
1143
1144	/* The destination is always a virtual address */
1145	if (param1.type != PARMTYPE_ADDRESS)
1146	return VERR_EM_INTERPRETER;
1147
1148	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1149	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1150	uint64_t ValPar2 = param2.val.val64;
1151
1152	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1153	RTGCPTR GCPtrPar1 = param1.val.val64;
1154	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1155	ValPar2 &= 7;
1156
1157	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1158	#ifdef IN_RC
1159	Assert(TRPMHasTrap(pVCpu));
1160	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1161	#endif
1162
1163	#ifdef IN_RC
1164	pvParam1 = (void *)GCPtrPar1;
1165	#else
1166	PGMPAGEMAPLOCK Lock;
1167	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1168	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1169	#endif
1170
1171	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1172
1173	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1174	RTGCUINTREG32 eflags = 0;
1175	#ifdef IN_RC
1176	MMGCRamRegisterTrapHandler(pVM);
1177	#endif
1178	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1179	#ifdef IN_RC
1180	MMGCRamDeregisterTrapHandler(pVM);
1181	#else
1182	PGMPhysReleasePageMappingLock(pVM, &Lock);
1183	#endif
1184	if (RT_FAILURE(rc))
1185	{
1186	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1187	emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
1188	return VERR_EM_INTERPRETER;
1189	}
1190
1191	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1192
1193	/* Update guest's eflags and finish. */
1194	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1195	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1196
1197	*pcbSize = 1;
1198	return VINF_SUCCESS;
1199	}
1200
1201
1202	/**
1203	* MOV emulation.
1204	*/
1205	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1206	{
1207	OP_PARAMVAL param1, param2;
1208	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1209	if(RT_FAILURE(rc))
1210	return VERR_EM_INTERPRETER;
1211
1212	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1213	if(RT_FAILURE(rc))
1214	return VERR_EM_INTERPRETER;
1215
1216	#ifdef IN_RC
1217	if (TRPMHasTrap(pVCpu))
1218	{
1219	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1220	{
1221	#else
1222	/** @todo Make this the default and don't rely on TRPM information. */
1223	if (param1.type == PARMTYPE_ADDRESS)
1224	{
1225	#endif
1226	RTGCPTR pDest;
1227	uint64_t val64;
1228
1229	switch(param1.type)
1230	{
1231	case PARMTYPE_IMMEDIATE:
1232	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1233	return VERR_EM_INTERPRETER;
1234	/* fallthru */
1235
1236	case PARMTYPE_ADDRESS:
1237	pDest = (RTGCPTR)param1.val.val64;
1238	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pDest);
1239	break;
1240
1241	default:
1242	AssertFailed();
1243	return VERR_EM_INTERPRETER;
1244	}
1245
1246	switch(param2.type)
1247	{
1248	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1249	val64 = param2.val.val64;
1250	break;
1251
1252	default:
1253	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1254	return VERR_EM_INTERPRETER;
1255	}
1256	#ifdef LOG_ENABLED
1257	if (pDis->mode == CPUMODE_64BIT)
1258	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1259	else
1260	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1261	#endif
1262
1263	Assert(param2.size <= 8 && param2.size > 0);
1264	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1265	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1266	if (RT_FAILURE(rc))
1267	return VERR_EM_INTERPRETER;
1268
1269	*pcbSize = param2.size;
1270	}
1271	else
1272	{ /* read fault */
1273	RTGCPTR pSrc;
1274	uint64_t val64;
1275
1276	/* Source */
1277	switch(param2.type)
1278	{
1279	case PARMTYPE_IMMEDIATE:
1280	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1281	return VERR_EM_INTERPRETER;
1282	/* fallthru */
1283
1284	case PARMTYPE_ADDRESS:
1285	pSrc = (RTGCPTR)param2.val.val64;
1286	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pSrc);
1287	break;
1288
1289	default:
1290	return VERR_EM_INTERPRETER;
1291	}
1292
1293	Assert(param1.size <= 8 && param1.size > 0);
1294	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1295	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1296	if (RT_FAILURE(rc))
1297	return VERR_EM_INTERPRETER;
1298
1299	/* Destination */
1300	switch(param1.type)
1301	{
1302	case PARMTYPE_REGISTER:
1303	switch(param1.size)
1304	{
1305	case 1: rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t) val64); break;
1306	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)val64); break;
1307	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)val64); break;
1308	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, val64); break;
1309	default:
1310	return VERR_EM_INTERPRETER;
1311	}
1312	if (RT_FAILURE(rc))
1313	return rc;
1314	break;
1315
1316	default:
1317	return VERR_EM_INTERPRETER;
1318	}
1319	#ifdef LOG_ENABLED
1320	if (pDis->mode == CPUMODE_64BIT)
1321	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1322	else
1323	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1324	#endif
1325	}
1326	return VINF_SUCCESS;
1327	#ifdef IN_RC
1328	}
1329	#endif
1330	return VERR_EM_INTERPRETER;
1331	}
1332
1333
1334	#ifndef IN_RC
1335	/**
1336	* [REP] STOSWD emulation
1337	*/
1338	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1339	{
1340	int rc;
1341	RTGCPTR GCDest, GCOffset;
1342	uint32_t cbSize;
1343	uint64_t cTransfers;
1344	int offIncrement;
1345
1346	/* Don't support any but these three prefix bytes. */
1347	if ((pDis->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1348	return VERR_EM_INTERPRETER;
1349
1350	switch (pDis->addrmode)
1351	{
1352	case CPUMODE_16BIT:
1353	GCOffset = pRegFrame->di;
1354	cTransfers = pRegFrame->cx;
1355	break;
1356	case CPUMODE_32BIT:
1357	GCOffset = pRegFrame->edi;
1358	cTransfers = pRegFrame->ecx;
1359	break;
1360	case CPUMODE_64BIT:
1361	GCOffset = pRegFrame->rdi;
1362	cTransfers = pRegFrame->rcx;
1363	break;
1364	default:
1365	AssertFailed();
1366	return VERR_EM_INTERPRETER;
1367	}
1368
1369	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1370	switch (pDis->opmode)
1371	{
1372	case CPUMODE_16BIT:
1373	cbSize = 2;
1374	break;
1375	case CPUMODE_32BIT:
1376	cbSize = 4;
1377	break;
1378	case CPUMODE_64BIT:
1379	cbSize = 8;
1380	break;
1381	default:
1382	AssertFailed();
1383	return VERR_EM_INTERPRETER;
1384	}
1385
1386	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1387
1388	if (!(pDis->prefix & PREFIX_REP))
1389	{
1390	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1391
1392	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1393	if (RT_FAILURE(rc))
1394	return VERR_EM_INTERPRETER;
1395	Assert(rc == VINF_SUCCESS);
1396
1397	/* Update (e/r)di. */
1398	switch (pDis->addrmode)
1399	{
1400	case CPUMODE_16BIT:
1401	pRegFrame->di += offIncrement;
1402	break;
1403	case CPUMODE_32BIT:
1404	pRegFrame->edi += offIncrement;
1405	break;
1406	case CPUMODE_64BIT:
1407	pRegFrame->rdi += offIncrement;
1408	break;
1409	default:
1410	AssertFailed();
1411	return VERR_EM_INTERPRETER;
1412	}
1413
1414	}
1415	else
1416	{
1417	if (!cTransfers)
1418	return VINF_SUCCESS;
1419
1420	/*
1421	* Do not try emulate cross page stuff here because we don't know what might
1422	* be waiting for us on the subsequent pages. The caller has only asked us to
1423	* ignore access handlers fro the current page.
1424	* This also fends off big stores which would quickly kill PGMR0DynMap.
1425	*/
1426	if ( cbSize > PAGE_SIZE
1427	\|\| cTransfers > PAGE_SIZE
1428	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1429	{
1430	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1431	GCDest, cbSize, offIncrement, cTransfers));
1432	return VERR_EM_INTERPRETER;
1433	}
1434
1435	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1436	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1437	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1438	cTransfers * cbSize,
1439	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1440	if (rc != VINF_SUCCESS)
1441	{
1442	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1443	return VERR_EM_INTERPRETER;
1444	}
1445
1446	/* REP case */
1447	while (cTransfers)
1448	{
1449	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1450	if (RT_FAILURE(rc))
1451	{
1452	rc = VERR_EM_INTERPRETER;
1453	break;
1454	}
1455
1456	Assert(rc == VINF_SUCCESS);
1457	GCOffset += offIncrement;
1458	GCDest += offIncrement;
1459	cTransfers--;
1460	}
1461
1462	/* Update the registers. */
1463	switch (pDis->addrmode)
1464	{
1465	case CPUMODE_16BIT:
1466	pRegFrame->di = GCOffset;
1467	pRegFrame->cx = cTransfers;
1468	break;
1469	case CPUMODE_32BIT:
1470	pRegFrame->edi = GCOffset;
1471	pRegFrame->ecx = cTransfers;
1472	break;
1473	case CPUMODE_64BIT:
1474	pRegFrame->rdi = GCOffset;
1475	pRegFrame->rcx = cTransfers;
1476	break;
1477	default:
1478	AssertFailed();
1479	return VERR_EM_INTERPRETER;
1480	}
1481	}
1482
1483	*pcbSize = cbSize;
1484	return rc;
1485	}
1486	#endif /* !IN_RC */
1487
1488	#ifndef IN_RC
1489
1490	/**
1491	* [LOCK] CMPXCHG emulation.
1492	*/
1493	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1494	{
1495	OP_PARAMVAL param1, param2;
1496
1497	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1498	Assert(pDis->param1.size <= 4);
1499	#endif
1500
1501	/* Source to make DISQueryParamVal read the register value - ugly hack */
1502	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1503	if(RT_FAILURE(rc))
1504	return VERR_EM_INTERPRETER;
1505
1506	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1507	if(RT_FAILURE(rc))
1508	return VERR_EM_INTERPRETER;
1509
1510	uint64_t valpar;
1511	switch(param2.type)
1512	{
1513	case PARMTYPE_IMMEDIATE: /* register actually */
1514	valpar = param2.val.val64;
1515	break;
1516
1517	default:
1518	return VERR_EM_INTERPRETER;
1519	}
1520
1521	PGMPAGEMAPLOCK Lock;
1522	RTGCPTR GCPtrPar1;
1523	void *pvParam1;
1524	uint64_t eflags;
1525
1526	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1527	switch(param1.type)
1528	{
1529	case PARMTYPE_ADDRESS:
1530	GCPtrPar1 = param1.val.val64;
1531	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1532
1533	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1534	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1535	break;
1536
1537	default:
1538	return VERR_EM_INTERPRETER;
1539	}
1540
1541	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1542
1543	if (pDis->prefix & PREFIX_LOCK)
1544	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1545	else
1546	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1547
1548	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1549
1550	/* Update guest's eflags and finish. */
1551	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1552	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1553
1554	*pcbSize = param2.size;
1555	PGMPhysReleasePageMappingLock(pVM, &Lock);
1556	return VINF_SUCCESS;
1557	}
1558
1559
1560	/**
1561	* [LOCK] CMPXCHG8B emulation.
1562	*/
1563	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1564	{
1565	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1566	OP_PARAMVAL param1;
1567
1568	/* Source to make DISQueryParamVal read the register value - ugly hack */
1569	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1570	if(RT_FAILURE(rc))
1571	return VERR_EM_INTERPRETER;
1572
1573	RTGCPTR GCPtrPar1;
1574	void *pvParam1;
1575	uint64_t eflags;
1576	PGMPAGEMAPLOCK Lock;
1577
1578	AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1579	switch(param1.type)
1580	{
1581	case PARMTYPE_ADDRESS:
1582	GCPtrPar1 = param1.val.val64;
1583	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1584
1585	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1586	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1587	break;
1588
1589	default:
1590	return VERR_EM_INTERPRETER;
1591	}
1592
1593	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1594
1595	if (pDis->prefix & PREFIX_LOCK)
1596	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1597	else
1598	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1599
1600	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1601
1602	/* Update guest's eflags and finish; note that only ZF is affected. */
1603	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1604	\| (eflags & (X86_EFL_ZF));
1605
1606	*pcbSize = 8;
1607	PGMPhysReleasePageMappingLock(pVM, &Lock);
1608	return VINF_SUCCESS;
1609	}
1610
1611	#else /* IN_RC */
1612
1613	/**
1614	* [LOCK] CMPXCHG emulation.
1615	*/
1616	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1617	{
1618	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1619	OP_PARAMVAL param1, param2;
1620
1621	/* Source to make DISQueryParamVal read the register value - ugly hack */
1622	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1623	if(RT_FAILURE(rc))
1624	return VERR_EM_INTERPRETER;
1625
1626	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1627	if(RT_FAILURE(rc))
1628	return VERR_EM_INTERPRETER;
1629
1630	if (TRPMHasTrap(pVCpu))
1631	{
1632	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1633	{
1634	RTRCPTR pParam1;
1635	uint32_t valpar, eflags;
1636
1637	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1638	switch(param1.type)
1639	{
1640	case PARMTYPE_ADDRESS:
1641	pParam1 = (RTRCPTR)param1.val.val64;
1642	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1643	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1644	break;
1645
1646	default:
1647	return VERR_EM_INTERPRETER;
1648	}
1649
1650	switch(param2.type)
1651	{
1652	case PARMTYPE_IMMEDIATE: /* register actually */
1653	valpar = param2.val.val32;
1654	break;
1655
1656	default:
1657	return VERR_EM_INTERPRETER;
1658	}
1659
1660	LogFlow(("%s %RRv eax=%08x %08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1661
1662	MMGCRamRegisterTrapHandler(pVM);
1663	if (pDis->prefix & PREFIX_LOCK)
1664	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1665	else
1666	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1667	MMGCRamDeregisterTrapHandler(pVM);
1668
1669	if (RT_FAILURE(rc))
1670	{
1671	Log(("%s %RGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1672	return VERR_EM_INTERPRETER;
1673	}
1674
1675	LogFlow(("%s %RRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1676
1677	/* Update guest's eflags and finish. */
1678	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1679	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1680
1681	*pcbSize = param2.size;
1682	return VINF_SUCCESS;
1683	}
1684	}
1685	return VERR_EM_INTERPRETER;
1686	}
1687
1688
1689	/**
1690	* [LOCK] CMPXCHG8B emulation.
1691	*/
1692	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1693	{
1694	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1695	OP_PARAMVAL param1;
1696
1697	/* Source to make DISQueryParamVal read the register value - ugly hack */
1698	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1699	if(RT_FAILURE(rc))
1700	return VERR_EM_INTERPRETER;
1701
1702	if (TRPMHasTrap(pVCpu))
1703	{
1704	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1705	{
1706	RTRCPTR pParam1;
1707	uint32_t eflags;
1708
1709	AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1710	switch(param1.type)
1711	{
1712	case PARMTYPE_ADDRESS:
1713	pParam1 = (RTRCPTR)param1.val.val64;
1714	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1715	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1716	break;
1717
1718	default:
1719	return VERR_EM_INTERPRETER;
1720	}
1721
1722	LogFlow(("%s %RRv=%08x eax=%08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1723
1724	MMGCRamRegisterTrapHandler(pVM);
1725	if (pDis->prefix & PREFIX_LOCK)
1726	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1727	else
1728	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1729	MMGCRamDeregisterTrapHandler(pVM);
1730
1731	if (RT_FAILURE(rc))
1732	{
1733	Log(("%s %RGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1734	return VERR_EM_INTERPRETER;
1735	}
1736
1737	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1738
1739	/* Update guest's eflags and finish; note that only ZF is affected. */
1740	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1741	\| (eflags & (X86_EFL_ZF));
1742
1743	*pcbSize = 8;
1744	return VINF_SUCCESS;
1745	}
1746	}
1747	return VERR_EM_INTERPRETER;
1748	}
1749
1750	#endif /* IN_RC */
1751
1752	#ifdef IN_RC
1753	/**
1754	* [LOCK] XADD emulation.
1755	*/
1756	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1757	{
1758	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1759	OP_PARAMVAL param1;
1760	uint32_t *pParamReg2;
1761	size_t cbSizeParamReg2;
1762
1763	/* Source to make DISQueryParamVal read the register value - ugly hack */
1764	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1765	if(RT_FAILURE(rc))
1766	return VERR_EM_INTERPRETER;
1767
1768	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1769	Assert(cbSizeParamReg2 <= 4);
1770	if(RT_FAILURE(rc))
1771	return VERR_EM_INTERPRETER;
1772
1773	if (TRPMHasTrap(pVCpu))
1774	{
1775	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1776	{
1777	RTRCPTR pParam1;
1778	uint32_t eflags;
1779
1780	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1781	switch(param1.type)
1782	{
1783	case PARMTYPE_ADDRESS:
1784	pParam1 = (RTRCPTR)param1.val.val64;
1785	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1786	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1787	break;
1788
1789	default:
1790	return VERR_EM_INTERPRETER;
1791	}
1792
1793	LogFlow(("XAdd %RRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1794
1795	MMGCRamRegisterTrapHandler(pVM);
1796	if (pDis->prefix & PREFIX_LOCK)
1797	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1798	else
1799	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1800	MMGCRamDeregisterTrapHandler(pVM);
1801
1802	if (RT_FAILURE(rc))
1803	{
1804	Log(("XAdd %RGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1805	return VERR_EM_INTERPRETER;
1806	}
1807
1808	LogFlow(("XAdd %RGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1809
1810	/* Update guest's eflags and finish. */
1811	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1812	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1813
1814	*pcbSize = cbSizeParamReg2;
1815	return VINF_SUCCESS;
1816	}
1817	}
1818	return VERR_EM_INTERPRETER;
1819	}
1820	#endif /* IN_RC */
1821
1822
1823	#ifdef IN_RC
1824	/**
1825	* Interpret IRET (currently only to V86 code)
1826	*
1827	* @returns VBox status code.
1828	* @param pVM The VM handle.
1829	* @param pVCpu The VMCPU handle.
1830	* @param pRegFrame The register frame.
1831	*
1832	*/
1833	VMMDECL(int) EMInterpretIret(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1834	{
1835	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1836	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1837	int rc;
1838
1839	Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
1840
1841	rc = emRamRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1842	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1843	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1844	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1845	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1846
1847	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1848	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1849	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1850	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1851	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1852	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1853	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1854
1855	pRegFrame->eip = eip & 0xffff;
1856	pRegFrame->cs = cs;
1857
1858	/* Mask away all reserved bits */
1859	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1860	eflags &= uMask;
1861
1862	#ifndef IN_RING0
1863	CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
1864	#endif
1865	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1866
1867	pRegFrame->esp = esp;
1868	pRegFrame->ss = ss;
1869	pRegFrame->ds = ds;
1870	pRegFrame->es = es;
1871	pRegFrame->fs = fs;
1872	pRegFrame->gs = gs;
1873
1874	return VINF_SUCCESS;
1875	}
1876	#endif /* IN_RC */
1877
1878
1879	/**
1880	* IRET Emulation.
1881	*/
1882	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1883	{
1884	/* only allow direct calls to EMInterpretIret for now */
1885	return VERR_EM_INTERPRETER;
1886	}
1887
1888	/**
1889	* WBINVD Emulation.
1890	*/
1891	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1892	{
1893	/* Nothing to do. */
1894	return VINF_SUCCESS;
1895	}
1896
1897
1898	/**
1899	* Interpret INVLPG
1900	*
1901	* @returns VBox status code.
1902	* @param pVM The VM handle.
1903	* @param pVCpu The VMCPU handle.
1904	* @param pRegFrame The register frame.
1905	* @param pAddrGC Operand address
1906	*
1907	*/
1908	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1909	{
1910	int rc;
1911
1912	/** @todo is addr always a flat linear address or ds based
1913	* (in absence of segment override prefixes)????
1914	*/
1915	#ifdef IN_RC
1916	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1917	#endif
1918	rc = PGMInvalidatePage(pVCpu, pAddrGC);
1919	if ( rc == VINF_SUCCESS
1920	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1921	return VINF_SUCCESS;
1922	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1923	("%Rrc addr=%RGv\n", rc, pAddrGC),
1924	VERR_EM_INTERPRETER);
1925	return rc;
1926	}
1927
1928
1929	/**
1930	* INVLPG Emulation.
1931	*/
1932	static int emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1933	{
1934	OP_PARAMVAL param1;
1935	RTGCPTR addr;
1936
1937	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1938	if(RT_FAILURE(rc))
1939	return VERR_EM_INTERPRETER;
1940
1941	switch(param1.type)
1942	{
1943	case PARMTYPE_IMMEDIATE:
1944	case PARMTYPE_ADDRESS:
1945	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1946	return VERR_EM_INTERPRETER;
1947	addr = (RTGCPTR)param1.val.val64;
1948	break;
1949
1950	default:
1951	return VERR_EM_INTERPRETER;
1952	}
1953
1954	/** @todo is addr always a flat linear address or ds based
1955	* (in absence of segment override prefixes)????
1956	*/
1957	#ifdef IN_RC
1958	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1959	#endif
1960	rc = PGMInvalidatePage(pVCpu, addr);
1961	if ( rc == VINF_SUCCESS
1962	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1963	return VINF_SUCCESS;
1964	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1965	("%Rrc addr=%RGv\n", rc, addr),
1966	VERR_EM_INTERPRETER);
1967	return rc;
1968	}
1969
1970
1971	/**
1972	* Interpret CPUID given the parameters in the CPU context
1973	*
1974	* @returns VBox status code.
1975	* @param pVM The VM handle.
1976	* @param pVCpu The VMCPU handle.
1977	* @param pRegFrame The register frame.
1978	*
1979	*/
1980	VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1981	{
1982	uint32_t iLeaf = pRegFrame->eax;
1983
1984	/* cpuid clears the high dwords of the affected 64 bits registers. */
1985	pRegFrame->rax = 0;
1986	pRegFrame->rbx = 0;
1987	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
1988	pRegFrame->rdx = 0;
1989
1990	/* Note: operates the same in 64 and non-64 bits mode. */
1991	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1992	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1993	return VINF_SUCCESS;
1994	}
1995
1996
1997	/**
1998	* CPUID Emulation.
1999	*/
2000	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2001	{
2002	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
2003	return rc;
2004	}
2005
2006
2007	/**
2008	* Interpret CRx read
2009	*
2010	* @returns VBox status code.
2011	* @param pVM The VM handle.
2012	* @param pVCpu The VMCPU handle.
2013	* @param pRegFrame The register frame.
2014	* @param DestRegGen General purpose register index (USE_REG_E**))
2015	* @param SrcRegCRx CRx register index (USE_REG_CR*)
2016	*
2017	*/
2018	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
2019	{
2020	int rc;
2021	uint64_t val64;
2022
2023	if (SrcRegCrx == USE_REG_CR8)
2024	{
2025	val64 = 0;
2026	rc = PDMApicGetTPR(pVCpu, (uint8_t *)&val64, NULL);
2027	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
2028	val64 >>= 4; /* bits 7-4 contain the task priority that go in cr8, bits 3-0*/
2029	}
2030	else
2031	{
2032	rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
2033	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
2034	}
2035
2036	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2037	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2038	else
2039	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
2040
2041	if(RT_SUCCESS(rc))
2042	{
2043	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2044	return VINF_SUCCESS;
2045	}
2046	return VERR_EM_INTERPRETER;
2047	}
2048
2049
2050
2051	/**
2052	* Interpret CLTS
2053	*
2054	* @returns VBox status code.
2055	* @param pVM The VM handle.
2056	* @param pVCpu The VMCPU handle.
2057	*
2058	*/
2059	VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
2060	{
2061	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2062	if (!(cr0 & X86_CR0_TS))
2063	return VINF_SUCCESS;
2064	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
2065	}
2066
2067	/**
2068	* CLTS Emulation.
2069	*/
2070	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2071	{
2072	return EMInterpretCLTS(pVM, pVCpu);
2073	}
2074
2075
2076	/**
2077	* Update CRx
2078	*
2079	* @returns VBox status code.
2080	* @param pVM The VM handle.
2081	* @param pVCpu The VMCPU handle.
2082	* @param pRegFrame The register frame.
2083	* @param DestRegCRx CRx register index (USE_REG_CR*)
2084	* @param val New CRx value
2085	*
2086	*/
2087	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2088	{
2089	uint64_t oldval;
2090	uint64_t msrEFER;
2091	int rc, rc2;
2092
2093	/** @todo Clean up this mess. */
2094	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2095	switch (DestRegCrx)
2096	{
2097	case USE_REG_CR0:
2098	oldval = CPUMGetGuestCR0(pVCpu);
2099	#ifdef IN_RC
2100	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2101	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2102	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2103	return VERR_EM_INTERPRETER;
2104	#endif
2105	rc = VINF_SUCCESS;
2106	CPUMSetGuestCR0(pVCpu, val);
2107	val = CPUMGetGuestCR0(pVCpu);
2108	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2109	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2110	{
2111	/* global flush */
2112	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2113	AssertRCReturn(rc, rc);
2114	}
2115
2116	/* Deal with long mode enabling/disabling. */
2117	msrEFER = CPUMGetGuestEFER(pVCpu);
2118	if (msrEFER & MSR_K6_EFER_LME)
2119	{
2120	if ( !(oldval & X86_CR0_PG)
2121	&& (val & X86_CR0_PG))
2122	{
2123	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2124	if (pRegFrame->csHid.Attr.n.u1Long)
2125	{
2126	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2127	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2128	}
2129
2130	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2131	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
2132	{
2133	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2134	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2135	}
2136	msrEFER \|= MSR_K6_EFER_LMA;
2137	}
2138	else
2139	if ( (oldval & X86_CR0_PG)
2140	&& !(val & X86_CR0_PG))
2141	{
2142	msrEFER &= ~MSR_K6_EFER_LMA;
2143	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2144	}
2145	CPUMSetGuestEFER(pVCpu, msrEFER);
2146	}
2147	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2148	return rc2 == VINF_SUCCESS ? rc : rc2;
2149
2150	case USE_REG_CR2:
2151	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2152	return VINF_SUCCESS;
2153
2154	case USE_REG_CR3:
2155	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2156	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2157	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2158	{
2159	/* flush */
2160	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2161	AssertRCReturn(rc, rc);
2162	}
2163	return rc;
2164
2165	case USE_REG_CR4:
2166	oldval = CPUMGetGuestCR4(pVCpu);
2167	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2168	val = CPUMGetGuestCR4(pVCpu);
2169
2170	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2171	msrEFER = CPUMGetGuestEFER(pVCpu);
2172	if ( (msrEFER & MSR_K6_EFER_LMA)
2173	&& (oldval & X86_CR4_PAE)
2174	&& !(val & X86_CR4_PAE))
2175	{
2176	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2177	}
2178
2179	rc = VINF_SUCCESS;
2180	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2181	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2182	{
2183	/* global flush */
2184	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2185	AssertRCReturn(rc, rc);
2186	}
2187
2188	/* Feeling extremely lazy. */
2189	# ifdef IN_RC
2190	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2191	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2192	{
2193	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2194	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2195	}
2196	# endif
2197	if ((val ^ oldval) & X86_CR4_VME)
2198	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2199
2200	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2201	return rc2 == VINF_SUCCESS ? rc : rc2;
2202
2203	case USE_REG_CR8:
2204	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2205
2206	default:
2207	AssertFailed();
2208	case USE_REG_CR1: /* illegal op */
2209	break;
2210	}
2211	return VERR_EM_INTERPRETER;
2212	}
2213
2214	/**
2215	* Interpret CRx write
2216	*
2217	* @returns VBox status code.
2218	* @param pVM The VM handle.
2219	* @param pVCpu The VMCPU handle.
2220	* @param pRegFrame The register frame.
2221	* @param DestRegCRx CRx register index (USE_REG_CR*)
2222	* @param SrcRegGen General purpose register index (USE_REG_E**))
2223	*
2224	*/
2225	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2226	{
2227	uint64_t val;
2228	int rc;
2229
2230	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2231	{
2232	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2233	}
2234	else
2235	{
2236	uint32_t val32;
2237	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2238	val = val32;
2239	}
2240
2241	if (RT_SUCCESS(rc))
2242	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2243
2244	return VERR_EM_INTERPRETER;
2245	}
2246
2247	/**
2248	* Interpret LMSW
2249	*
2250	* @returns VBox status code.
2251	* @param pVM The VM handle.
2252	* @param pVCpu The VMCPU handle.
2253	* @param pRegFrame The register frame.
2254	* @param u16Data LMSW source data.
2255	*
2256	*/
2257	VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2258	{
2259	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2260
2261	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2262	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2263	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2264
2265	return emUpdateCRx(pVM, pVCpu, pRegFrame, USE_REG_CR0, NewCr0);
2266	}
2267
2268	/**
2269	* LMSW Emulation.
2270	*/
2271	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2272	{
2273	OP_PARAMVAL param1;
2274	uint32_t val;
2275
2276	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2277	if(RT_FAILURE(rc))
2278	return VERR_EM_INTERPRETER;
2279
2280	switch(param1.type)
2281	{
2282	case PARMTYPE_IMMEDIATE:
2283	case PARMTYPE_ADDRESS:
2284	if(!(param1.flags & PARAM_VAL16))
2285	return VERR_EM_INTERPRETER;
2286	val = param1.val.val32;
2287	break;
2288
2289	default:
2290	return VERR_EM_INTERPRETER;
2291	}
2292
2293	LogFlow(("emInterpretLmsw %x\n", val));
2294	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2295	}
2296
2297	#ifdef EM_EMULATE_SMSW
2298	/**
2299	* SMSW Emulation.
2300	*/
2301	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2302	{
2303	OP_PARAMVAL param1;
2304	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2305
2306	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2307	if(RT_FAILURE(rc))
2308	return VERR_EM_INTERPRETER;
2309
2310	switch(param1.type)
2311	{
2312	case PARMTYPE_IMMEDIATE:
2313	if(param1.size != sizeof(uint16_t))
2314	return VERR_EM_INTERPRETER;
2315	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->param1.base.reg_gen, cr0));
2316	rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, cr0);
2317	break;
2318
2319	case PARMTYPE_ADDRESS:
2320	{
2321	RTGCPTR pParam1;
2322
2323	/* Actually forced to 16 bits regardless of the operand size. */
2324	if(param1.size != sizeof(uint16_t))
2325	return VERR_EM_INTERPRETER;
2326
2327	pParam1 = (RTGCPTR)param1.val.val64;
2328	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
2329	LogFlow(("emInterpretSmsw %VGv <- cr0 (%x)\n", pParam1, cr0));
2330
2331	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2332	if (RT_FAILURE(rc))
2333	{
2334	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2335	return VERR_EM_INTERPRETER;
2336	}
2337	break;
2338	}
2339
2340	default:
2341	return VERR_EM_INTERPRETER;
2342	}
2343
2344	LogFlow(("emInterpretSmsw %x\n", cr0));
2345	return rc;
2346	}
2347	#endif
2348
2349	/**
2350	* MOV CRx
2351	*/
2352	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2353	{
2354	if ((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_CR)
2355	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_ctrl);
2356
2357	if (pDis->param1.flags == USE_REG_CR && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2358	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_ctrl, pDis->param2.base.reg_gen);
2359
2360	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2361	return VERR_EM_INTERPRETER;
2362	}
2363
2364
2365	/**
2366	* Interpret DRx write
2367	*
2368	* @returns VBox status code.
2369	* @param pVM The VM handle.
2370	* @param pVCpu The VMCPU handle.
2371	* @param pRegFrame The register frame.
2372	* @param DestRegDRx DRx register index (USE_REG_DR*)
2373	* @param SrcRegGen General purpose register index (USE_REG_E**))
2374	*
2375	*/
2376	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2377	{
2378	uint64_t val;
2379	int rc;
2380
2381	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2382	{
2383	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2384	}
2385	else
2386	{
2387	uint32_t val32;
2388	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2389	val = val32;
2390	}
2391
2392	if (RT_SUCCESS(rc))
2393	{
2394	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2395	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2396	if (RT_SUCCESS(rc))
2397	return rc;
2398	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2399	}
2400	return VERR_EM_INTERPRETER;
2401	}
2402
2403
2404	/**
2405	* Interpret DRx read
2406	*
2407	* @returns VBox status code.
2408	* @param pVM The VM handle.
2409	* @param pVCpu The VMCPU handle.
2410	* @param pRegFrame The register frame.
2411	* @param DestRegGen General purpose register index (USE_REG_E**))
2412	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2413	*
2414	*/
2415	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2416	{
2417	uint64_t val64;
2418
2419	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2420	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2421	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2422	{
2423	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2424	}
2425	else
2426	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2427
2428	if (RT_SUCCESS(rc))
2429	return VINF_SUCCESS;
2430
2431	return VERR_EM_INTERPRETER;
2432	}
2433
2434
2435	/**
2436	* MOV DRx
2437	*/
2438	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2439	{
2440	int rc = VERR_EM_INTERPRETER;
2441
2442	if((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_DBG)
2443	{
2444	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_dbg);
2445	}
2446	else
2447	if(pDis->param1.flags == USE_REG_DBG && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2448	{
2449	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_dbg, pDis->param2.base.reg_gen);
2450	}
2451	else
2452	AssertMsgFailed(("Unexpected debug register move\n"));
2453
2454	return rc;
2455	}
2456
2457
2458	/**
2459	* LLDT Emulation.
2460	*/
2461	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2462	{
2463	OP_PARAMVAL param1;
2464	RTSEL sel;
2465
2466	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2467	if(RT_FAILURE(rc))
2468	return VERR_EM_INTERPRETER;
2469
2470	switch(param1.type)
2471	{
2472	case PARMTYPE_ADDRESS:
2473	return VERR_EM_INTERPRETER; //feeling lazy right now
2474
2475	case PARMTYPE_IMMEDIATE:
2476	if(!(param1.flags & PARAM_VAL16))
2477	return VERR_EM_INTERPRETER;
2478	sel = (RTSEL)param1.val.val16;
2479	break;
2480
2481	default:
2482	return VERR_EM_INTERPRETER;
2483	}
2484
2485	#ifdef IN_RING0
2486	/* Only for the VT-x real-mode emulation case. */
2487	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2488	CPUMSetGuestLDTR(pVCpu, sel);
2489	return VINF_SUCCESS;
2490	#else
2491	if (sel == 0)
2492	{
2493	if (CPUMGetHyperLDTR(pVCpu) == 0)
2494	{
2495	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2496	return VINF_SUCCESS;
2497	}
2498	}
2499	//still feeling lazy
2500	return VERR_EM_INTERPRETER;
2501	#endif
2502	}
2503
2504	#ifdef IN_RING0
2505	/**
2506	* LIDT/LGDT Emulation.
2507	*/
2508	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2509	{
2510	OP_PARAMVAL param1;
2511	RTGCPTR pParam1;
2512	X86XDTR32 dtr32;
2513
2514	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2515
2516	/* Only for the VT-x real-mode emulation case. */
2517	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2518
2519	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2520	if(RT_FAILURE(rc))
2521	return VERR_EM_INTERPRETER;
2522
2523	switch(param1.type)
2524	{
2525	case PARMTYPE_ADDRESS:
2526	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, param1.val.val16);
2527	break;
2528
2529	default:
2530	return VERR_EM_INTERPRETER;
2531	}
2532
2533	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2534	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2535
2536	if (!(pDis->prefix & PREFIX_OPSIZE))
2537	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2538
2539	if (pDis->pCurInstr->opcode == OP_LIDT)
2540	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2541	else
2542	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2543
2544	return VINF_SUCCESS;
2545	}
2546	#endif
2547
2548
2549	#ifdef IN_RC
2550	/**
2551	* STI Emulation.
2552	*
2553	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2554	*/
2555	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2556	{
2557	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2558
2559	if(!pGCState)
2560	{
2561	Assert(pGCState);
2562	return VERR_EM_INTERPRETER;
2563	}
2564	pGCState->uVMFlags \|= X86_EFL_IF;
2565
2566	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2567	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2568
2569	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->opsize;
2570	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2571
2572	return VINF_SUCCESS;
2573	}
2574	#endif /* IN_RC */
2575
2576
2577	/**
2578	* HLT Emulation.
2579	*/
2580	static int emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2581	{
2582	return VINF_EM_HALT;
2583	}
2584
2585
2586	/**
2587	* Interpret RDTSC
2588	*
2589	* @returns VBox status code.
2590	* @param pVM The VM handle.
2591	* @param pVCpu The VMCPU handle.
2592	* @param pRegFrame The register frame.
2593	*
2594	*/
2595	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2596	{
2597	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2598
2599	if (uCR4 & X86_CR4_TSD)
2600	return VERR_EM_INTERPRETER; /* genuine #GP */
2601
2602	uint64_t uTicks = TMCpuTickGet(pVCpu);
2603
2604	/* Same behaviour in 32 & 64 bits mode */
2605	pRegFrame->rax = (uint32_t)uTicks;
2606	pRegFrame->rdx = (uTicks >> 32ULL);
2607
2608	return VINF_SUCCESS;
2609	}
2610
2611	/**
2612	* Interpret RDTSCP
2613	*
2614	* @returns VBox status code.
2615	* @param pVM The VM handle.
2616	* @param pVCpu The VMCPU handle.
2617	* @param pCtx The CPU context.
2618	*
2619	*/
2620	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2621	{
2622	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2623
2624	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2625	{
2626	AssertFailed();
2627	return VERR_EM_INTERPRETER; /* genuine #UD */
2628	}
2629
2630	if (uCR4 & X86_CR4_TSD)
2631	return VERR_EM_INTERPRETER; /* genuine #GP */
2632
2633	uint64_t uTicks = TMCpuTickGet(pVCpu);
2634
2635	/* Same behaviour in 32 & 64 bits mode */
2636	pCtx->rax = (uint32_t)uTicks;
2637	pCtx->rdx = (uTicks >> 32ULL);
2638	/* Low dword of the TSC_AUX msr only. */
2639	pCtx->rcx = (uint32_t)CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2640
2641	return VINF_SUCCESS;
2642	}
2643
2644	/**
2645	* RDTSC Emulation.
2646	*/
2647	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2648	{
2649	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2650	}
2651
2652	/**
2653	* Interpret RDPMC
2654	*
2655	* @returns VBox status code.
2656	* @param pVM The VM handle.
2657	* @param pVCpu The VMCPU handle.
2658	* @param pRegFrame The register frame.
2659	*
2660	*/
2661	VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2662	{
2663	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2664
2665	/* If X86_CR4_PCE is not set, then CPL must be zero. */
2666	if ( !(uCR4 & X86_CR4_PCE)
2667	&& CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2668	{
2669	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2670	return VERR_EM_INTERPRETER; /* genuine #GP */
2671	}
2672
2673	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2674	pRegFrame->rax = 0;
2675	pRegFrame->rdx = 0;
2676	/* @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2677	return VINF_SUCCESS;
2678	}
2679
2680	/**
2681	* RDPMC Emulation
2682	*/
2683	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2684	{
2685	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2686	}
2687
2688	/**
2689	* MONITOR Emulation.
2690	*/
2691	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2692	{
2693	uint32_t u32Dummy, u32ExtFeatures, cpl;
2694
2695	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
2696	if (pRegFrame->ecx != 0)
2697	return VERR_EM_INTERPRETER; /* illegal value. */
2698
2699	/* Get the current privilege level. */
2700	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2701	if (cpl != 0)
2702	return VERR_EM_INTERPRETER; /* supervisor only */
2703
2704	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2705	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2706	return VERR_EM_INTERPRETER; /* not supported */
2707
2708	return VINF_SUCCESS;
2709	}
2710
2711
2712	/**
2713	* MWAIT Emulation.
2714	*/
2715	VMMDECL(int) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2716	{
2717	uint32_t u32Dummy, u32ExtFeatures, cpl;
2718
2719	/* @todo bit 1 is supposed to tell the cpu to wake us up on interrupts even if IF is cleared.
2720	* Not sure which models. Intel docs say ecx and eax must be zero for Pentium 4 CPUs
2721	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
2722	*/
2723	if (pRegFrame->ecx != 0)
2724	return VERR_EM_INTERPRETER; /* illegal value. */
2725
2726	/* Get the current privilege level. */
2727	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2728	if (cpl != 0)
2729	return VERR_EM_INTERPRETER; /* supervisor only */
2730
2731	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2732	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2733	return VERR_EM_INTERPRETER; /* not supported */
2734
2735	/** @todo not completely correct */
2736	return VINF_EM_HALT;
2737	}
2738
2739	static int emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2740	{
2741	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
2742
2743	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2744	}
2745
2746
2747	#ifdef LOG_ENABLED
2748	static const char *emMSRtoString(uint32_t uMsr)
2749	{
2750	switch (uMsr)
2751	{
2752	case MSR_IA32_APICBASE:
2753	return "MSR_IA32_APICBASE";
2754	case MSR_IA32_CR_PAT:
2755	return "MSR_IA32_CR_PAT";
2756	case MSR_IA32_SYSENTER_CS:
2757	return "MSR_IA32_SYSENTER_CS";
2758	case MSR_IA32_SYSENTER_EIP:
2759	return "MSR_IA32_SYSENTER_EIP";
2760	case MSR_IA32_SYSENTER_ESP:
2761	return "MSR_IA32_SYSENTER_ESP";
2762	case MSR_K6_EFER:
2763	return "MSR_K6_EFER";
2764	case MSR_K8_SF_MASK:
2765	return "MSR_K8_SF_MASK";
2766	case MSR_K6_STAR:
2767	return "MSR_K6_STAR";
2768	case MSR_K8_LSTAR:
2769	return "MSR_K8_LSTAR";
2770	case MSR_K8_CSTAR:
2771	return "MSR_K8_CSTAR";
2772	case MSR_K8_FS_BASE:
2773	return "MSR_K8_FS_BASE";
2774	case MSR_K8_GS_BASE:
2775	return "MSR_K8_GS_BASE";
2776	case MSR_K8_KERNEL_GS_BASE:
2777	return "MSR_K8_KERNEL_GS_BASE";
2778	case MSR_K8_TSC_AUX:
2779	return "MSR_K8_TSC_AUX";
2780	case MSR_IA32_BIOS_SIGN_ID:
2781	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2782	case MSR_IA32_PLATFORM_ID:
2783	return "Unsupported MSR_IA32_PLATFORM_ID";
2784	case MSR_IA32_BIOS_UPDT_TRIG:
2785	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2786	case MSR_IA32_TSC:
2787	return "MSR_IA32_TSC";
2788	case MSR_IA32_MTRR_CAP:
2789	return "Unsupported MSR_IA32_MTRR_CAP";
2790	case MSR_IA32_MCP_CAP:
2791	return "Unsupported MSR_IA32_MCP_CAP";
2792	case MSR_IA32_MCP_STATUS:
2793	return "Unsupported MSR_IA32_MCP_STATUS";
2794	case MSR_IA32_MCP_CTRL:
2795	return "Unsupported MSR_IA32_MCP_CTRL";
2796	case MSR_IA32_MTRR_DEF_TYPE:
2797	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2798	case MSR_K7_EVNTSEL0:
2799	return "Unsupported MSR_K7_EVNTSEL0";
2800	case MSR_K7_EVNTSEL1:
2801	return "Unsupported MSR_K7_EVNTSEL1";
2802	case MSR_K7_EVNTSEL2:
2803	return "Unsupported MSR_K7_EVNTSEL2";
2804	case MSR_K7_EVNTSEL3:
2805	return "Unsupported MSR_K7_EVNTSEL3";
2806	case MSR_IA32_MC0_CTL:
2807	return "Unsupported MSR_IA32_MC0_CTL";
2808	case MSR_IA32_MC0_STATUS:
2809	return "Unsupported MSR_IA32_MC0_STATUS";
2810	case MSR_IA32_PERFEVTSEL0:
2811	return "Unsupported MSR_IA32_PERFEVTSEL0";
2812	case MSR_IA32_PERFEVTSEL1:
2813	return "Unsupported MSR_IA32_PERFEVTSEL1";
2814	case MSR_IA32_PERF_STATUS:
2815	return "Unsupported MSR_IA32_PERF_STATUS";
2816	case MSR_IA32_PERF_CTL:
2817	return "Unsupported MSR_IA32_PERF_CTL";
2818	case MSR_K7_PERFCTR0:
2819	return "Unsupported MSR_K7_PERFCTR0";
2820	case MSR_K7_PERFCTR1:
2821	return "Unsupported MSR_K7_PERFCTR1";
2822	case MSR_K7_PERFCTR2:
2823	return "Unsupported MSR_K7_PERFCTR2";
2824	case MSR_K7_PERFCTR3:
2825	return "Unsupported MSR_K7_PERFCTR3";
2826	}
2827	return "Unknown MSR";
2828	}
2829	#endif /* LOG_ENABLED */
2830
2831
2832	/**
2833	* Interpret RDMSR
2834	*
2835	* @returns VBox status code.
2836	* @param pVM The VM handle.
2837	* @param pVCpu The VMCPU handle.
2838	* @param pRegFrame The register frame.
2839	*
2840	*/
2841	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2842	{
2843	uint32_t u32Dummy, u32Features, cpl;
2844	uint64_t val;
2845	CPUMCTX *pCtx;
2846	int rc = VINF_SUCCESS;
2847
2848	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2849	* That version clears the high dwords of both RDX & RAX */
2850	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2851
2852	/* Get the current privilege level. */
2853	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2854	if (cpl != 0)
2855	return VERR_EM_INTERPRETER; /* supervisor only */
2856
2857	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2858	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2859	return VERR_EM_INTERPRETER; /* not supported */
2860
2861	switch (pRegFrame->ecx)
2862	{
2863	case MSR_IA32_TSC:
2864	val = TMCpuTickGet(pVCpu);
2865	break;
2866
2867	case MSR_IA32_APICBASE:
2868	rc = PDMApicGetBase(pVM, &val);
2869	AssertRC(rc);
2870	break;
2871
2872	case MSR_IA32_CR_PAT:
2873	val = pCtx->msrPAT;
2874	break;
2875
2876	case MSR_IA32_SYSENTER_CS:
2877	val = pCtx->SysEnter.cs;
2878	break;
2879
2880	case MSR_IA32_SYSENTER_EIP:
2881	val = pCtx->SysEnter.eip;
2882	break;
2883
2884	case MSR_IA32_SYSENTER_ESP:
2885	val = pCtx->SysEnter.esp;
2886	break;
2887
2888	case MSR_K6_EFER:
2889	val = pCtx->msrEFER;
2890	break;
2891
2892	case MSR_K8_SF_MASK:
2893	val = pCtx->msrSFMASK;
2894	break;
2895
2896	case MSR_K6_STAR:
2897	val = pCtx->msrSTAR;
2898	break;
2899
2900	case MSR_K8_LSTAR:
2901	val = pCtx->msrLSTAR;
2902	break;
2903
2904	case MSR_K8_CSTAR:
2905	val = pCtx->msrCSTAR;
2906	break;
2907
2908	case MSR_K8_FS_BASE:
2909	val = pCtx->fsHid.u64Base;
2910	break;
2911
2912	case MSR_K8_GS_BASE:
2913	val = pCtx->gsHid.u64Base;
2914	break;
2915
2916	case MSR_K8_KERNEL_GS_BASE:
2917	val = pCtx->msrKERNELGSBASE;
2918	break;
2919
2920	case MSR_K8_TSC_AUX:
2921	val = CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2922	break;
2923
2924	#if 0 /def IN_RING0 /
2925	case MSR_IA32_PLATFORM_ID:
2926	case MSR_IA32_BIOS_SIGN_ID:
2927	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2928	{
2929	/* Available since the P6 family. VT-x implies that this feature is present. */
2930	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2931	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2932	else
2933	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2934	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2935	break;
2936	}
2937	/* no break */
2938	#endif
2939	default:
2940	/* In X2APIC specification this range is reserved for APIC control. */
2941	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
2942	&& pRegFrame->ecx < MSR_IA32_APIC_END)
2943	rc = PDMApicReadMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, &val);
2944	else
2945	/* We should actually trigger a #GP here, but don't as that will cause more trouble. */
2946	val = 0;
2947	break;
2948	}
2949	LogFlow(("EMInterpretRdmsr %s (%x) -> val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2950	if (rc == VINF_SUCCESS)
2951	{
2952	pRegFrame->rax = (uint32_t) val;
2953	pRegFrame->rdx = (uint32_t)(val >> 32);
2954	}
2955	return rc;
2956	}
2957
2958
2959	/**
2960	* RDMSR Emulation.
2961	*/
2962	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2963	{
2964	/* Note: the Intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2965	Assert(!(pDis->prefix & PREFIX_REX));
2966	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
2967	}
2968
2969
2970	/**
2971	* Interpret WRMSR
2972	*
2973	* @returns VBox status code.
2974	* @param pVM The VM handle.
2975	* @param pVCpu The VMCPU handle.
2976	* @param pRegFrame The register frame.
2977	*/
2978	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2979	{
2980	uint32_t u32Dummy, u32Features, cpl;
2981	uint64_t val;
2982	CPUMCTX *pCtx;
2983
2984	/* Note: works the same in 32 and 64 bits modes. */
2985	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2986
2987	/* Get the current privilege level. */
2988	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2989	if (cpl != 0)
2990	return VERR_EM_INTERPRETER; /* supervisor only */
2991
2992	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2993	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2994	return VERR_EM_INTERPRETER; /* not supported */
2995
2996	val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
2997	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2998	switch (pRegFrame->ecx)
2999	{
3000	case MSR_IA32_TSC:
3001	TMCpuTickSet(pVM, pVCpu, val);
3002	break;
3003
3004	case MSR_IA32_APICBASE:
3005	{
3006	int rc = PDMApicSetBase(pVM, val);
3007	AssertRC(rc);
3008	break;
3009	}
3010
3011	case MSR_IA32_CR_PAT:
3012	pCtx->msrPAT = val;
3013	break;
3014
3015	case MSR_IA32_SYSENTER_CS:
3016	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
3017	break;
3018
3019	case MSR_IA32_SYSENTER_EIP:
3020	pCtx->SysEnter.eip = val;
3021	break;
3022
3023	case MSR_IA32_SYSENTER_ESP:
3024	pCtx->SysEnter.esp = val;
3025	break;
3026
3027	case MSR_K6_EFER:
3028	{
3029	uint64_t uMask = 0;
3030	uint64_t oldval = pCtx->msrEFER;
3031
3032	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
3033	CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
3034	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
3035	uMask \|= MSR_K6_EFER_NXE;
3036	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
3037	uMask \|= MSR_K6_EFER_LME;
3038	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
3039	uMask \|= MSR_K6_EFER_SCE;
3040	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
3041	uMask \|= MSR_K6_EFER_FFXSR;
3042
3043	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
3044	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
3045	&& (pCtx->cr0 & X86_CR0_PG))
3046	{
3047	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
3048	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
3049	}
3050
3051	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
3052	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
3053	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
3054
3055	/* AMD64 Architecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
3056	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
3057	HWACCMFlushTLB(pVCpu);
3058
3059	break;
3060	}
3061
3062	case MSR_K8_SF_MASK:
3063	pCtx->msrSFMASK = val;
3064	break;
3065
3066	case MSR_K6_STAR:
3067	pCtx->msrSTAR = val;
3068	break;
3069
3070	case MSR_K8_LSTAR:
3071	pCtx->msrLSTAR = val;
3072	break;
3073
3074	case MSR_K8_CSTAR:
3075	pCtx->msrCSTAR = val;
3076	break;
3077
3078	case MSR_K8_FS_BASE:
3079	pCtx->fsHid.u64Base = val;
3080	break;
3081
3082	case MSR_K8_GS_BASE:
3083	pCtx->gsHid.u64Base = val;
3084	break;
3085
3086	case MSR_K8_KERNEL_GS_BASE:
3087	pCtx->msrKERNELGSBASE = val;
3088	break;
3089
3090	case MSR_K8_TSC_AUX:
3091	CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, val);
3092	break;
3093
3094	default:
3095	/* In X2APIC specification this range is reserved for APIC control. */
3096	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
3097	&& pRegFrame->ecx < MSR_IA32_APIC_END)
3098	return PDMApicWriteMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, val);
3099
3100	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
3101	break;
3102	}
3103	return VINF_SUCCESS;
3104	}
3105
3106
3107	/**
3108	* WRMSR Emulation.
3109	*/
3110	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3111	{
3112	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3113	}
3114
3115
3116	/**
3117	* Internal worker.
3118	* @copydoc EMInterpretInstructionCPU
3119	*/
3120	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3121	{
3122	Assert(pcbSize);
3123	*pcbSize = 0;
3124
3125	/*
3126	* Only supervisor guest code!!
3127	* And no complicated prefixes.
3128	*/
3129	/* Get the current privilege level. */
3130	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3131	if ( cpl != 0
3132	&& pDis->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3133	{
3134	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3135	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3136	return VERR_EM_INTERPRETER;
3137	}
3138
3139	#ifdef IN_RC
3140	if ( (pDis->prefix & (PREFIX_REPNE \| PREFIX_REP))
3141	\|\| ( (pDis->prefix & PREFIX_LOCK)
3142	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3143	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3144	&& pDis->pCurInstr->opcode != OP_XADD
3145	&& pDis->pCurInstr->opcode != OP_OR
3146	&& pDis->pCurInstr->opcode != OP_AND
3147	&& pDis->pCurInstr->opcode != OP_XOR
3148	&& pDis->pCurInstr->opcode != OP_BTR
3149	)
3150	)
3151	#else
3152	if ( (pDis->prefix & PREFIX_REPNE)
3153	\|\| ( (pDis->prefix & PREFIX_REP)
3154	&& pDis->pCurInstr->opcode != OP_STOSWD
3155	)
3156	\|\| ( (pDis->prefix & PREFIX_LOCK)
3157	&& pDis->pCurInstr->opcode != OP_OR
3158	&& pDis->pCurInstr->opcode != OP_AND
3159	&& pDis->pCurInstr->opcode != OP_XOR
3160	&& pDis->pCurInstr->opcode != OP_BTR
3161	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3162	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3163	)
3164	)
3165	#endif
3166	{
3167	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3168	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3169	return VERR_EM_INTERPRETER;
3170	}
3171
3172	#if HC_ARCH_BITS == 32
3173	/*
3174	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3175	* Whitelisted instructions are safe.
3176	*/
3177	if ( pDis->param1.size > 4
3178	&& CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3179	{
3180	uint32_t uOpCode = pDis->pCurInstr->opcode;
3181	if ( uOpCode != OP_STOSWD
3182	&& uOpCode != OP_MOV
3183	&& uOpCode != OP_CMPXCHG8B
3184	&& uOpCode != OP_XCHG
3185	&& uOpCode != OP_BTS
3186	&& uOpCode != OP_BTR
3187	&& uOpCode != OP_BTC
3188	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3189	&& uOpCode != OP_CMPXCHG /* solaris */
3190	&& uOpCode != OP_AND /* windows */
3191	&& uOpCode != OP_OR /* windows */
3192	&& uOpCode != OP_XOR /* because we can */
3193	&& uOpCode != OP_ADD /* windows (dripple) */
3194	&& uOpCode != OP_ADC /* because we can */
3195	&& uOpCode != OP_SUB /* because we can */
3196	/** @todo OP_BTS or is that a different kind of failure? */
3197	# endif
3198	)
3199	{
3200	# ifdef VBOX_WITH_STATISTICS
3201	switch (pDis->pCurInstr->opcode)
3202	{
3203	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3204	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3205	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3206	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3207	INTERPRET_FAILED_CASE(OP_INC,Inc);
3208	INTERPRET_FAILED_CASE(OP_POP,Pop);
3209	INTERPRET_FAILED_CASE(OP_OR, Or);
3210	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3211	INTERPRET_FAILED_CASE(OP_AND,And);
3212	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3213	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3214	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3215	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3216	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3217	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3218	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3219	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3220	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3221	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3222	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3223	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3224	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3225	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3226	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3227	INTERPRET_FAILED_CASE(OP_ADD,Add);
3228	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3229	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3230	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3231	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3232	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3233	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3234	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3235	INTERPRET_FAILED_CASE(OP_STI, Sti);
3236	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3237	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3238	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3239	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3240	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3241	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3242	# undef INTERPRET_FAILED_CASE
3243	default:
3244	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3245	break;
3246	}
3247	# endif /* VBOX_WITH_STATISTICS */
3248	return VERR_EM_INTERPRETER;
3249	}
3250	}
3251	#endif
3252
3253	int rc;
3254	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3255	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3256	#endif
3257	switch (pDis->pCurInstr->opcode)
3258	{
3259	/*
3260	* Macros for generating the right case statements.
3261	*/
3262	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3263	case opcode:\
3264	if (pDis->prefix & PREFIX_LOCK) \
3265	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3266	else \
3267	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3268	if (RT_SUCCESS(rc)) \
3269	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3270	else \
3271	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3272	return rc
3273	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3274	case opcode:\
3275	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3276	if (RT_SUCCESS(rc)) \
3277	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3278	else \
3279	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3280	return rc
3281
3282	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3283	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3284	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3285	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3286
3287	#define INTERPRET_CASE(opcode, Instr) \
3288	case opcode:\
3289	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3290	if (RT_SUCCESS(rc)) \
3291	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3292	else \
3293	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3294	return rc
3295
3296	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3297	case opcode:\
3298	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3299	if (RT_SUCCESS(rc)) \
3300	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3301	else \
3302	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3303	return rc
3304
3305	#define INTERPRET_STAT_CASE(opcode, Instr) \
3306	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3307
3308	/*
3309	* The actual case statements.
3310	*/
3311	INTERPRET_CASE(OP_XCHG,Xchg);
3312	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3313	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3314	INTERPRET_CASE(OP_POP,Pop);
3315	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3316	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3317	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3318	INTERPRET_CASE(OP_MOV,Mov);
3319	#ifndef IN_RC
3320	INTERPRET_CASE(OP_STOSWD,StosWD);
3321	#endif
3322	INTERPRET_CASE(OP_INVLPG,InvlPg);
3323	INTERPRET_CASE(OP_CPUID,CpuId);
3324	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3325	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3326	#ifdef IN_RING0
3327	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3328	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3329	#endif
3330	INTERPRET_CASE(OP_LLDT,LLdt);
3331	INTERPRET_CASE(OP_LMSW,Lmsw);
3332	#ifdef EM_EMULATE_SMSW
3333	INTERPRET_CASE(OP_SMSW,Smsw);
3334	#endif
3335	INTERPRET_CASE(OP_CLTS,Clts);
3336	INTERPRET_CASE(OP_MONITOR, Monitor);
3337	INTERPRET_CASE(OP_MWAIT, MWait);
3338	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3339	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3340	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3341	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3342	INTERPRET_CASE(OP_ADC,Adc);
3343	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3344	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3345	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3346	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3347	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3348	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3349	#ifdef IN_RC
3350	INTERPRET_CASE(OP_STI,Sti);
3351	INTERPRET_CASE(OP_XADD, XAdd);
3352	#endif
3353	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3354	INTERPRET_CASE(OP_HLT,Hlt);
3355	INTERPRET_CASE(OP_IRET,Iret);
3356	INTERPRET_CASE(OP_WBINVD,WbInvd);
3357	#ifdef VBOX_WITH_STATISTICS
3358	# ifndef IN_RC
3359	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3360	# endif
3361	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3362	#endif
3363
3364	default:
3365	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->opcode));
3366	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3367	return VERR_EM_INTERPRETER;
3368
3369	#undef INTERPRET_CASE_EX_PARAM2
3370	#undef INTERPRET_STAT_CASE
3371	#undef INTERPRET_CASE_EX
3372	#undef INTERPRET_CASE
3373	} /* switch (opcode) */
3374	AssertFailed();
3375	return VERR_INTERNAL_ERROR;
3376	}
3377
3378
3379	/**
3380	* Sets the PC for which interrupts should be inhibited.
3381	*
3382	* @param pVCpu The VMCPU handle.
3383	* @param PC The PC.
3384	*/
3385	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
3386	{
3387	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
3388	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3389	}
3390
3391
3392	/**
3393	* Gets the PC for which interrupts should be inhibited.
3394	*
3395	* There are a few instructions which inhibits or delays interrupts
3396	* for the instruction following them. These instructions are:
3397	* - STI
3398	* - MOV SS, r/m16
3399	* - POP SS
3400	*
3401	* @returns The PC for which interrupts should be inhibited.
3402	* @param pVCpu The VMCPU handle.
3403	*
3404	*/
3405	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
3406	{
3407	return pVCpu->em.s.GCPtrInhibitInterrupts;
3408	}
3409
3410	/**
3411	* Locks REM execution to a single VCpu
3412	*
3413	* @param pVM VM handle.
3414	*/
3415	VMMDECL(void) EMRemLock(PVM pVM)
3416	{
3417	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3418	return; /* early init */
3419
3420	Assert(!PGMIsLockOwner(pVM) && !IOMIsLockOwner(pVM));
3421	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
3422	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
3423	}
3424
3425	/**
3426	* Unlocks REM execution
3427	*
3428	* @param pVM VM handle.
3429	*/
3430	VMMDECL(void) EMRemUnlock(PVM pVM)
3431	{
3432	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3433	return; /* early init */
3434
3435	PDMCritSectLeave(&pVM->em.s.CritSectREM);
3436	}
3437
3438	/**
3439	* Check if this VCPU currently owns the REM lock.
3440	*
3441	* @returns bool owner/not owner
3442	* @param pVM The VM to operate on.
3443	*/
3444	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
3445	{
3446	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
3447	}
3448
3449	/**
3450	* Try to acquire the REM lock.
3451	*
3452	* @returns VBox status code
3453	* @param pVM The VM to operate on.
3454	*/
3455	VMMDECL(int) EMTryEnterRemLock(PVM pVM)
3456	{
3457	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
3458	}
3459

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 23011

Download in other formats: