EMAll.cpp@ 24764

Last change on this file since 24764 was 24764, checked in by vboxsync, 15 years ago
Handle missing page inconsistency with guest smp (instruction emulation)
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 115.5 KB

Line
1	/* $Id: EMAll.cpp 24764 2009-11-18 16:30:12Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22	/*******************************************************************************
23	* Header Files *
24	*******************************************************************************/
25	#define LOG_GROUP LOG_GROUP_EM
26	#include <VBox/em.h>
27	#include <VBox/mm.h>
28	#include <VBox/selm.h>
29	#include <VBox/patm.h>
30	#include <VBox/csam.h>
31	#include <VBox/pgm.h>
32	#include <VBox/iom.h>
33	#include <VBox/stam.h>
34	#include "EMInternal.h"
35	#include <VBox/vm.h>
36	#include <VBox/vmm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Defined Constants And Macros *
53	*******************************************************************************/
54	/** @def EM_ASSERT_FAULT_RETURN
55	* Safety check.
56	*
57	* Could in theory misfire on a cross page boundary access...
58	*
59	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
60	* turns up an alias page instead of the original faulting one and annoying the
61	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
62	*/
63	#if 0
64	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
65	#else
66	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
67	#endif
68
69	/* Used to pass information during instruction disassembly. */
70	typedef struct
71	{
72	PVM pVM;
73	PVMCPU pVCpu;
74	RTGCPTR GCPtr;
75	uint8_t aOpcode[8];
76	} EMDISSTATE, *PEMDISSTATE;
77
78	/*******************************************************************************
79	* Internal Functions *
80	*******************************************************************************/
81	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
82
83
84
85	/**
86	* Get the current execution manager status.
87	*
88	* @returns Current status.
89	* @param pVCpu The VMCPU to operate on.
90	*/
91	VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
92	{
93	return pVCpu->em.s.enmState;
94	}
95
96	/**
97	* Sets the current execution manager status. (use only when you know what you're doing!)
98	*
99	* @param pVCpu The VMCPU to operate on.
100	*/
101	VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
102	{
103	/* Only allowed combination: */
104	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
105	pVCpu->em.s.enmState = enmNewState;
106	}
107
108
109	#ifndef IN_RC
110
111	/**
112	* Read callback for disassembly function; supports reading bytes that cross a page boundary
113	*
114	* @returns VBox status code.
115	* @param pSrc GC source pointer
116	* @param pDest HC destination pointer
117	* @param cb Number of bytes to read
118	* @param dwUserdata Callback specific user data (pDis)
119	*
120	*/
121	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
122	{
123	PDISCPUSTATE pDis = (PDISCPUSTATE)pvUserdata;
124	PEMDISSTATE pState = (PEMDISSTATE)pDis->apvUserData[0];
125	PVM pVM = pState->pVM;
126	PVMCPU pVCpu = pState->pVCpu;
127
128	# ifdef IN_RING0
129	int rc;
130
131	if ( pState->GCPtr
132	&& pSrc + cb <= pState->GCPtr + sizeof(pState->aOpcode))
133	{
134	unsigned offset = pSrc - pState->GCPtr;
135
136	Assert(pSrc >= pState->GCPtr);
137
138	for (unsigned i=0; i<cb; i++)
139	{
140	pDest[i] = pState->aOpcode[offset + i];
141	}
142	return VINF_SUCCESS;
143	}
144
145	rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
146	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%RGv cb=%x rc=%d\n", pSrc, cb, rc));
147	# else /* IN_RING3 */
148	if (!PATMIsPatchGCAddr(pVM, pSrc))
149	{
150	int rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
151	AssertRC(rc);
152	}
153	else
154	{
155	for (unsigned i = 0; i < cb; i++)
156	{
157	uint8_t opcode;
158	if (RT_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
159	*(pDest+i) = opcode;
160
161	}
162	}
163	# endif /* IN_RING3 */
164	return VINF_SUCCESS;
165	}
166
167	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
168	{
169	EMDISSTATE State;
170
171	State.pVM = pVM;
172	State.pVCpu = pVCpu;
173	int rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, InstrGC, sizeof(State.aOpcode));
174	if (RT_SUCCESS(rc))
175	{
176	State.GCPtr = InstrGC;
177	}
178	else
179	{
180	if (PAGE_ADDRESS(InstrGC) == PAGE_ADDRESS(InstrGC + sizeof(State.aOpcode) - 1))
181	{
182	if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
183	HWACCMInvalidatePage(pVCpu, InstrGC);
184
185	Log(("emDisCoreOne: read failed with %d\n", rc));
186	return rc;
187	}
188	State.GCPtr = NIL_RTGCPTR;
189	}
190	return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
191	}
192
193	#else /* IN_RC */
194
195	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
196	{
197	NOREF(pVCpu);
198	NOREF(pVM);
199	return DISCoreOne(pDis, InstrGC, pOpsize);
200	}
201
202	#endif /* IN_RC */
203
204
205	/**
206	* Disassembles one instruction.
207	*
208	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
209	* details.
210	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
211	*
212	* @param pVM The VM handle.
213	* @param pVCpu The VMCPU handle.
214	* @param pCtxCore The context core (used for both the mode and instruction).
215	* @param pDis Where to return the parsed instruction info.
216	* @param pcbInstr Where to return the instruction size. (optional)
217	*/
218	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
219	{
220	RTGCPTR GCPtrInstr;
221	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
222	if (RT_FAILURE(rc))
223	{
224	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
225	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
226	return rc;
227	}
228	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
229	}
230
231
232	/**
233	* Disassembles one instruction.
234	*
235	* This is used by internally by the interpreter and by trap/access handlers.
236	*
237	* @returns VBox status code.
238	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
239	*
240	* @param pVM The VM handle.
241	* @param pVCpu The VMCPU handle.
242	* @param GCPtrInstr The flat address of the instruction.
243	* @param pCtxCore The context core (used to determine the cpu mode).
244	* @param pDis Where to return the parsed instruction info.
245	* @param pcbInstr Where to return the instruction size. (optional)
246	*/
247	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
248	{
249	int rc;
250
251	#ifndef IN_RC
252	EMDISSTATE State;
253
254	State.pVM = pVM;
255	State.pVCpu = pVCpu;
256
257	rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, GCPtrInstr, sizeof(State.aOpcode));
258	if (RT_SUCCESS(rc))
259	{
260	State.GCPtr = GCPtrInstr;
261	}
262	else
263	{
264	if (PAGE_ADDRESS(GCPtrInstr) == PAGE_ADDRESS(GCPtrInstr + sizeof(State.aOpcode) - 1))
265	{
266	if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
267	HWACCMInvalidatePage(pVCpu, GCPtrInstr);
268
269	Log(("EMInterpretDisasOneEx: read failed with %d\n", rc));
270	return rc;
271	}
272	State.GCPtr = NIL_RTGCPTR;
273	}
274	#endif
275
276	rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
277	#ifdef IN_RC
278	NULL, NULL,
279	#else
280	EMReadBytes, &State,
281	#endif
282	pDis, pcbInstr);
283	if (RT_SUCCESS(rc))
284	return VINF_SUCCESS;
285	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
286	return VERR_INTERNAL_ERROR;
287	}
288
289
290	/**
291	* Interprets the current instruction.
292	*
293	* @returns VBox status code.
294	* @retval VINF_* Scheduling instructions.
295	* @retval VERR_EM_INTERPRETER Something we can't cope with.
296	* @retval VERR_* Fatal errors.
297	*
298	* @param pVM The VM handle.
299	* @param pVCpu The VMCPU handle.
300	* @param pRegFrame The register frame.
301	* Updates the EIP if an instruction was executed successfully.
302	* @param pvFault The fault address (CR2).
303	* @param pcbSize Size of the write (if applicable).
304	*
305	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
306	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
307	* to worry about e.g. invalid modrm combinations (!)
308	*/
309	VMMDECL(int) EMInterpretInstruction(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
310	{
311	RTGCPTR pbCode;
312
313	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
314	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
315	if (RT_SUCCESS(rc))
316	{
317	uint32_t cbOp;
318	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
319	pDis->mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
320	rc = emDisCoreOne(pVM, pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
321	if (RT_SUCCESS(rc))
322	{
323	Assert(cbOp == pDis->opsize);
324	rc = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
325	if (RT_SUCCESS(rc))
326	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
327
328	return rc;
329	}
330	}
331	return VERR_EM_INTERPRETER;
332	}
333
334
335	/**
336	* Interprets the current instruction using the supplied DISCPUSTATE structure.
337	*
338	* EIP is NOT updated!
339	*
340	* @returns VBox status code.
341	* @retval VINF_* Scheduling instructions. When these are returned, it
342	* starts to get a bit tricky to know whether code was
343	* executed or not... We'll address this when it becomes a problem.
344	* @retval VERR_EM_INTERPRETER Something we can't cope with.
345	* @retval VERR_* Fatal errors.
346	*
347	* @param pVM The VM handle.
348	* @param pVCpu The VMCPU handle.
349	* @param pDis The disassembler cpu state for the instruction to be
350	* interpreted.
351	* @param pRegFrame The register frame. EIP is NOT changed!
352	* @param pvFault The fault address (CR2).
353	* @param pcbSize Size of the write (if applicable).
354	*
355	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
356	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
357	* to worry about e.g. invalid modrm combinations (!)
358	*
359	* @todo At this time we do NOT check if the instruction overwrites vital information.
360	* Make sure this can't happen!! (will add some assertions/checks later)
361	*/
362	VMMDECL(int) EMInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
363	{
364	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
365	int rc = emInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
366	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
367	if (RT_SUCCESS(rc))
368	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
369	else
370	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
371	return rc;
372	}
373
374
375	/**
376	* Interpret a port I/O instruction.
377	*
378	* @returns VBox status code suitable for scheduling.
379	* @param pVM The VM handle.
380	* @param pVCpu The VMCPU handle.
381	* @param pCtxCore The context core. This will be updated on successful return.
382	* @param pDis The instruction to interpret.
383	* @param cbOp The size of the instruction.
384	* @remark This may raise exceptions.
385	*/
386	VMMDECL(VBOXSTRICTRC) EMInterpretPortIO(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, uint32_t cbOp)
387	{
388	/*
389	* Hand it on to IOM.
390	*/
391	#ifdef IN_RC
392	VBOXSTRICTRC rcStrict = IOMGCIOPortHandler(pVM, pCtxCore, pDis);
393	if (IOM_SUCCESS(rcStrict))
394	pCtxCore->rip += cbOp;
395	return rcStrict;
396	#else
397	AssertReleaseMsgFailed(("not implemented\n"));
398	return VERR_NOT_IMPLEMENTED;
399	#endif
400	}
401
402
403	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
404	{
405	#ifdef IN_RC
406	int rc = MMGCRamRead(pVM, pvDst, (void *)GCPtrSrc, cb);
407	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
408	return rc;
409	/*
410	* The page pool cache may end up here in some cases because it
411	* flushed one of the shadow mappings used by the trapping
412	* instruction and it either flushed the TLB or the CPU reused it.
413	*/
414	#endif
415	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
416	}
417
418
419	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
420	{
421	#ifdef IN_RC
422	int rc = MMGCRamWrite(pVM, (void )(uintptr_t)GCPtrDst, (void )pvSrc, cb);
423	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
424	return rc;
425	/*
426	* The page pool cache may end up here in some cases because it
427	* flushed one of the shadow mappings used by the trapping
428	* instruction and it either flushed the TLB or the CPU reused it.
429	* We want to play safe here, verifying that we've got write
430	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
431	*/
432	#endif
433	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
434	}
435
436
437	/** Convert sel:addr to a flat GC address. */
438	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, POP_PARAMETER pParam, RTGCPTR pvAddr)
439	{
440	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
441	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
442	}
443
444
445	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
446	/**
447	* Get the mnemonic for the disassembled instruction.
448	*
449	* GC/R0 doesn't include the strings in the DIS tables because
450	* of limited space.
451	*/
452	static const char *emGetMnemonic(PDISCPUSTATE pDis)
453	{
454	switch (pDis->pCurInstr->opcode)
455	{
456	case OP_XCHG: return "Xchg";
457	case OP_DEC: return "Dec";
458	case OP_INC: return "Inc";
459	case OP_POP: return "Pop";
460	case OP_OR: return "Or";
461	case OP_AND: return "And";
462	case OP_MOV: return "Mov";
463	case OP_INVLPG: return "InvlPg";
464	case OP_CPUID: return "CpuId";
465	case OP_MOV_CR: return "MovCRx";
466	case OP_MOV_DR: return "MovDRx";
467	case OP_LLDT: return "LLdt";
468	case OP_LGDT: return "LGdt";
469	case OP_LIDT: return "LGdt";
470	case OP_CLTS: return "Clts";
471	case OP_MONITOR: return "Monitor";
472	case OP_MWAIT: return "MWait";
473	case OP_RDMSR: return "Rdmsr";
474	case OP_WRMSR: return "Wrmsr";
475	case OP_ADD: return "Add";
476	case OP_ADC: return "Adc";
477	case OP_SUB: return "Sub";
478	case OP_SBB: return "Sbb";
479	case OP_RDTSC: return "Rdtsc";
480	case OP_STI: return "Sti";
481	case OP_CLI: return "Cli";
482	case OP_XADD: return "XAdd";
483	case OP_HLT: return "Hlt";
484	case OP_IRET: return "Iret";
485	case OP_MOVNTPS: return "MovNTPS";
486	case OP_STOSWD: return "StosWD";
487	case OP_WBINVD: return "WbInvd";
488	case OP_XOR: return "Xor";
489	case OP_BTR: return "Btr";
490	case OP_BTS: return "Bts";
491	case OP_BTC: return "Btc";
492	case OP_LMSW: return "Lmsw";
493	case OP_SMSW: return "Smsw";
494	case OP_CMPXCHG: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
495	case OP_CMPXCHG8B: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
496
497	default:
498	Log(("Unknown opcode %d\n", pDis->pCurInstr->opcode));
499	return "???";
500	}
501	}
502	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
503
504
505	/**
506	* XCHG instruction emulation.
507	*/
508	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
509	{
510	OP_PARAMVAL param1, param2;
511
512	/* Source to make DISQueryParamVal read the register value - ugly hack */
513	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
514	if(RT_FAILURE(rc))
515	return VERR_EM_INTERPRETER;
516
517	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
518	if(RT_FAILURE(rc))
519	return VERR_EM_INTERPRETER;
520
521	#ifdef IN_RC
522	if (TRPMHasTrap(pVCpu))
523	{
524	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
525	{
526	#endif
527	RTGCPTR pParam1 = 0, pParam2 = 0;
528	uint64_t valpar1, valpar2;
529
530	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
531	switch(param1.type)
532	{
533	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
534	valpar1 = param1.val.val64;
535	break;
536
537	case PARMTYPE_ADDRESS:
538	pParam1 = (RTGCPTR)param1.val.val64;
539	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
540	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
541	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
542	if (RT_FAILURE(rc))
543	{
544	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
545	return VERR_EM_INTERPRETER;
546	}
547	break;
548
549	default:
550	AssertFailed();
551	return VERR_EM_INTERPRETER;
552	}
553
554	switch(param2.type)
555	{
556	case PARMTYPE_ADDRESS:
557	pParam2 = (RTGCPTR)param2.val.val64;
558	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pParam2);
559	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
560	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
561	if (RT_FAILURE(rc))
562	{
563	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
564	}
565	break;
566
567	case PARMTYPE_IMMEDIATE:
568	valpar2 = param2.val.val64;
569	break;
570
571	default:
572	AssertFailed();
573	return VERR_EM_INTERPRETER;
574	}
575
576	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
577	if (pParam1 == 0)
578	{
579	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
580	switch(param1.size)
581	{
582	case 1: //special case for AH etc
583	rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t )valpar2); break;
584	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)valpar2); break;
585	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)valpar2); break;
586	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, valpar2); break;
587	default: AssertFailedReturn(VERR_EM_INTERPRETER);
588	}
589	if (RT_FAILURE(rc))
590	return VERR_EM_INTERPRETER;
591	}
592	else
593	{
594	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
595	if (RT_FAILURE(rc))
596	{
597	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
598	return VERR_EM_INTERPRETER;
599	}
600	}
601
602	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
603	if (pParam2 == 0)
604	{
605	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
606	switch(param2.size)
607	{
608	case 1: //special case for AH etc
609	rc = DISWriteReg8(pRegFrame, pDis->param2.base.reg_gen, (uint8_t )valpar1); break;
610	case 2: rc = DISWriteReg16(pRegFrame, pDis->param2.base.reg_gen, (uint16_t)valpar1); break;
611	case 4: rc = DISWriteReg32(pRegFrame, pDis->param2.base.reg_gen, (uint32_t)valpar1); break;
612	case 8: rc = DISWriteReg64(pRegFrame, pDis->param2.base.reg_gen, valpar1); break;
613	default: AssertFailedReturn(VERR_EM_INTERPRETER);
614	}
615	if (RT_FAILURE(rc))
616	return VERR_EM_INTERPRETER;
617	}
618	else
619	{
620	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
621	if (RT_FAILURE(rc))
622	{
623	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
624	return VERR_EM_INTERPRETER;
625	}
626	}
627
628	*pcbSize = param2.size;
629	return VINF_SUCCESS;
630	#ifdef IN_RC
631	}
632	}
633	#endif
634	return VERR_EM_INTERPRETER;
635	}
636
637
638	/**
639	* INC and DEC emulation.
640	*/
641	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
642	PFNEMULATEPARAM2 pfnEmulate)
643	{
644	OP_PARAMVAL param1;
645
646	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
647	if(RT_FAILURE(rc))
648	return VERR_EM_INTERPRETER;
649
650	#ifdef IN_RC
651	if (TRPMHasTrap(pVCpu))
652	{
653	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
654	{
655	#endif
656	RTGCPTR pParam1 = 0;
657	uint64_t valpar1;
658
659	if (param1.type == PARMTYPE_ADDRESS)
660	{
661	pParam1 = (RTGCPTR)param1.val.val64;
662	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
663	#ifdef IN_RC
664	/* Safety check (in theory it could cross a page boundary and fault there though) */
665	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
666	#endif
667	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
668	if (RT_FAILURE(rc))
669	{
670	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
671	return VERR_EM_INTERPRETER;
672	}
673	}
674	else
675	{
676	AssertFailed();
677	return VERR_EM_INTERPRETER;
678	}
679
680	uint32_t eflags;
681
682	eflags = pfnEmulate(&valpar1, param1.size);
683
684	/* Write result back */
685	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
686	if (RT_FAILURE(rc))
687	{
688	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
689	return VERR_EM_INTERPRETER;
690	}
691
692	/* Update guest's eflags and finish. */
693	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
694	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
695
696	/* All done! */
697	*pcbSize = param1.size;
698	return VINF_SUCCESS;
699	#ifdef IN_RC
700	}
701	}
702	#endif
703	return VERR_EM_INTERPRETER;
704	}
705
706
707	/**
708	* POP Emulation.
709	*/
710	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
711	{
712	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
713	OP_PARAMVAL param1;
714	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
715	if(RT_FAILURE(rc))
716	return VERR_EM_INTERPRETER;
717
718	#ifdef IN_RC
719	if (TRPMHasTrap(pVCpu))
720	{
721	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
722	{
723	#endif
724	RTGCPTR pParam1 = 0;
725	uint32_t valpar1;
726	RTGCPTR pStackVal;
727
728	/* Read stack value first */
729	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
730	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
731
732	/* Convert address; don't bother checking limits etc, as we only read here */
733	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
734	if (pStackVal == 0)
735	return VERR_EM_INTERPRETER;
736
737	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
738	if (RT_FAILURE(rc))
739	{
740	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
741	return VERR_EM_INTERPRETER;
742	}
743
744	if (param1.type == PARMTYPE_ADDRESS)
745	{
746	pParam1 = (RTGCPTR)param1.val.val64;
747
748	/* pop [esp+xx] uses esp after the actual pop! */
749	AssertCompile(USE_REG_ESP == USE_REG_SP);
750	if ( (pDis->param1.flags & USE_BASE)
751	&& (pDis->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
752	&& pDis->param1.base.reg_gen == USE_REG_ESP
753	)
754	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
755
756	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
757	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
758	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
759	if (RT_FAILURE(rc))
760	{
761	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
762	return VERR_EM_INTERPRETER;
763	}
764
765	/* Update ESP as the last step */
766	pRegFrame->esp += param1.size;
767	}
768	else
769	{
770	#ifndef DEBUG_bird // annoying assertion.
771	AssertFailed();
772	#endif
773	return VERR_EM_INTERPRETER;
774	}
775
776	/* All done! */
777	*pcbSize = param1.size;
778	return VINF_SUCCESS;
779	#ifdef IN_RC
780	}
781	}
782	#endif
783	return VERR_EM_INTERPRETER;
784	}
785
786
787	/**
788	* XOR/OR/AND Emulation.
789	*/
790	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
791	PFNEMULATEPARAM3 pfnEmulate)
792	{
793	OP_PARAMVAL param1, param2;
794
795	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
796	if(RT_FAILURE(rc))
797	return VERR_EM_INTERPRETER;
798
799	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
800	if(RT_FAILURE(rc))
801	return VERR_EM_INTERPRETER;
802
803	#ifdef IN_RC
804	if (TRPMHasTrap(pVCpu))
805	{
806	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
807	{
808	#endif
809	RTGCPTR pParam1;
810	uint64_t valpar1, valpar2;
811
812	if (pDis->param1.size != pDis->param2.size)
813	{
814	if (pDis->param1.size < pDis->param2.size)
815	{
816	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
817	return VERR_EM_INTERPRETER;
818	}
819	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
820	pDis->param2.size = pDis->param1.size;
821	param2.size = param1.size;
822	}
823
824	/* The destination is always a virtual address */
825	if (param1.type == PARMTYPE_ADDRESS)
826	{
827	pParam1 = (RTGCPTR)param1.val.val64;
828	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
829	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
830	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
831	if (RT_FAILURE(rc))
832	{
833	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
834	return VERR_EM_INTERPRETER;
835	}
836	}
837	else
838	{
839	AssertFailed();
840	return VERR_EM_INTERPRETER;
841	}
842
843	/* Register or immediate data */
844	switch(param2.type)
845	{
846	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
847	valpar2 = param2.val.val64;
848	break;
849
850	default:
851	AssertFailed();
852	return VERR_EM_INTERPRETER;
853	}
854
855	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
856
857	/* Data read, emulate instruction. */
858	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
859
860	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
861
862	/* Update guest's eflags and finish. */
863	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
864	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
865
866	/* And write it back */
867	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
868	if (RT_SUCCESS(rc))
869	{
870	/* All done! */
871	*pcbSize = param2.size;
872	return VINF_SUCCESS;
873	}
874	#ifdef IN_RC
875	}
876	}
877	#endif
878	return VERR_EM_INTERPRETER;
879	}
880
881
882	/**
883	* LOCK XOR/OR/AND Emulation.
884	*/
885	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
886	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
887	{
888	void *pvParam1;
889	OP_PARAMVAL param1, param2;
890
891	#if HC_ARCH_BITS == 32
892	Assert(pDis->param1.size <= 4);
893	#endif
894
895	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
896	if(RT_FAILURE(rc))
897	return VERR_EM_INTERPRETER;
898
899	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
900	if(RT_FAILURE(rc))
901	return VERR_EM_INTERPRETER;
902
903	if (pDis->param1.size != pDis->param2.size)
904	{
905	AssertMsgReturn(pDis->param1.size >= pDis->param2.size, /* should never happen! */
906	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size),
907	VERR_EM_INTERPRETER);
908
909	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
910	pDis->param2.size = pDis->param1.size;
911	param2.size = param1.size;
912	}
913
914	#ifdef IN_RC
915	/* Safety check (in theory it could cross a page boundary and fault there though) */
916	Assert( TRPMHasTrap(pVCpu)
917	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
918	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
919	#endif
920
921	/* Register and immediate data == PARMTYPE_IMMEDIATE */
922	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
923	RTGCUINTREG ValPar2 = param2.val.val64;
924
925	/* The destination is always a virtual address */
926	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
927
928	RTGCPTR GCPtrPar1 = param1.val.val64;
929	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
930	#ifdef IN_RC
931	pvParam1 = (void *)GCPtrPar1;
932	#else
933	PGMPAGEMAPLOCK Lock;
934	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
935	AssertRCReturn(rc, VERR_EM_INTERPRETER);
936	#endif
937
938	/* Try emulate it with a one-shot #PF handler in place. (RC) */
939	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
940
941	RTGCUINTREG32 eflags = 0;
942	#ifdef IN_RC
943	MMGCRamRegisterTrapHandler(pVM);
944	#endif
945	rc = pfnEmulate(pvParam1, ValPar2, pDis->param2.size, &eflags);
946	#ifdef IN_RC
947	MMGCRamDeregisterTrapHandler(pVM);
948	#else
949	PGMPhysReleasePageMappingLock(pVM, &Lock);
950	#endif
951	if (RT_FAILURE(rc))
952	{
953	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
954	return VERR_EM_INTERPRETER;
955	}
956
957	/* Update guest's eflags and finish. */
958	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
959	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
960
961	*pcbSize = param2.size;
962	return VINF_SUCCESS;
963	}
964
965
966	/**
967	* ADD, ADC & SUB Emulation.
968	*/
969	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
970	PFNEMULATEPARAM3 pfnEmulate)
971	{
972	OP_PARAMVAL param1, param2;
973	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
974	if(RT_FAILURE(rc))
975	return VERR_EM_INTERPRETER;
976
977	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
978	if(RT_FAILURE(rc))
979	return VERR_EM_INTERPRETER;
980
981	#ifdef IN_RC
982	if (TRPMHasTrap(pVCpu))
983	{
984	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
985	{
986	#endif
987	RTGCPTR pParam1;
988	uint64_t valpar1, valpar2;
989
990	if (pDis->param1.size != pDis->param2.size)
991	{
992	if (pDis->param1.size < pDis->param2.size)
993	{
994	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
995	return VERR_EM_INTERPRETER;
996	}
997	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
998	pDis->param2.size = pDis->param1.size;
999	param2.size = param1.size;
1000	}
1001
1002	/* The destination is always a virtual address */
1003	if (param1.type == PARMTYPE_ADDRESS)
1004	{
1005	pParam1 = (RTGCPTR)param1.val.val64;
1006	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1007	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1008	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1009	if (RT_FAILURE(rc))
1010	{
1011	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1012	return VERR_EM_INTERPRETER;
1013	}
1014	}
1015	else
1016	{
1017	#ifndef DEBUG_bird
1018	AssertFailed();
1019	#endif
1020	return VERR_EM_INTERPRETER;
1021	}
1022
1023	/* Register or immediate data */
1024	switch(param2.type)
1025	{
1026	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1027	valpar2 = param2.val.val64;
1028	break;
1029
1030	default:
1031	AssertFailed();
1032	return VERR_EM_INTERPRETER;
1033	}
1034
1035	/* Data read, emulate instruction. */
1036	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1037
1038	/* Update guest's eflags and finish. */
1039	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1040	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1041
1042	/* And write it back */
1043	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1044	if (RT_SUCCESS(rc))
1045	{
1046	/* All done! */
1047	*pcbSize = param2.size;
1048	return VINF_SUCCESS;
1049	}
1050	#ifdef IN_RC
1051	}
1052	}
1053	#endif
1054	return VERR_EM_INTERPRETER;
1055	}
1056
1057
1058	/**
1059	* ADC Emulation.
1060	*/
1061	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1062	{
1063	if (pRegFrame->eflags.Bits.u1CF)
1064	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1065	else
1066	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1067	}
1068
1069
1070	/**
1071	* BTR/C/S Emulation.
1072	*/
1073	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1074	PFNEMULATEPARAM2UINT32 pfnEmulate)
1075	{
1076	OP_PARAMVAL param1, param2;
1077	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1078	if(RT_FAILURE(rc))
1079	return VERR_EM_INTERPRETER;
1080
1081	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1082	if(RT_FAILURE(rc))
1083	return VERR_EM_INTERPRETER;
1084
1085	#ifdef IN_RC
1086	if (TRPMHasTrap(pVCpu))
1087	{
1088	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1089	{
1090	#endif
1091	RTGCPTR pParam1;
1092	uint64_t valpar1 = 0, valpar2;
1093	uint32_t eflags;
1094
1095	/* The destination is always a virtual address */
1096	if (param1.type != PARMTYPE_ADDRESS)
1097	return VERR_EM_INTERPRETER;
1098
1099	pParam1 = (RTGCPTR)param1.val.val64;
1100	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1101
1102	/* Register or immediate data */
1103	switch(param2.type)
1104	{
1105	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1106	valpar2 = param2.val.val64;
1107	break;
1108
1109	default:
1110	AssertFailed();
1111	return VERR_EM_INTERPRETER;
1112	}
1113
1114	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1115	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1116	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1117	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1118	if (RT_FAILURE(rc))
1119	{
1120	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1121	return VERR_EM_INTERPRETER;
1122	}
1123
1124	Log2(("emInterpretBtx: val=%x\n", valpar1));
1125	/* Data read, emulate bit test instruction. */
1126	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1127
1128	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1129
1130	/* Update guest's eflags and finish. */
1131	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1132	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1133
1134	/* And write it back */
1135	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1136	if (RT_SUCCESS(rc))
1137	{
1138	/* All done! */
1139	*pcbSize = 1;
1140	return VINF_SUCCESS;
1141	}
1142	#ifdef IN_RC
1143	}
1144	}
1145	#endif
1146	return VERR_EM_INTERPRETER;
1147	}
1148
1149
1150	/**
1151	* LOCK BTR/C/S Emulation.
1152	*/
1153	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1154	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1155	{
1156	void *pvParam1;
1157
1158	OP_PARAMVAL param1, param2;
1159	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1160	if(RT_FAILURE(rc))
1161	return VERR_EM_INTERPRETER;
1162
1163	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1164	if(RT_FAILURE(rc))
1165	return VERR_EM_INTERPRETER;
1166
1167	/* The destination is always a virtual address */
1168	if (param1.type != PARMTYPE_ADDRESS)
1169	return VERR_EM_INTERPRETER;
1170
1171	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1172	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1173	uint64_t ValPar2 = param2.val.val64;
1174
1175	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1176	RTGCPTR GCPtrPar1 = param1.val.val64;
1177	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1178	ValPar2 &= 7;
1179
1180	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1181	#ifdef IN_RC
1182	Assert(TRPMHasTrap(pVCpu));
1183	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1184	#endif
1185
1186	#ifdef IN_RC
1187	pvParam1 = (void *)GCPtrPar1;
1188	#else
1189	PGMPAGEMAPLOCK Lock;
1190	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1191	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1192	#endif
1193
1194	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1195
1196	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1197	RTGCUINTREG32 eflags = 0;
1198	#ifdef IN_RC
1199	MMGCRamRegisterTrapHandler(pVM);
1200	#endif
1201	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1202	#ifdef IN_RC
1203	MMGCRamDeregisterTrapHandler(pVM);
1204	#else
1205	PGMPhysReleasePageMappingLock(pVM, &Lock);
1206	#endif
1207	if (RT_FAILURE(rc))
1208	{
1209	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1210	emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
1211	return VERR_EM_INTERPRETER;
1212	}
1213
1214	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1215
1216	/* Update guest's eflags and finish. */
1217	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1218	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1219
1220	*pcbSize = 1;
1221	return VINF_SUCCESS;
1222	}
1223
1224
1225	/**
1226	* MOV emulation.
1227	*/
1228	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1229	{
1230	OP_PARAMVAL param1, param2;
1231	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1232	if(RT_FAILURE(rc))
1233	return VERR_EM_INTERPRETER;
1234
1235	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1236	if(RT_FAILURE(rc))
1237	return VERR_EM_INTERPRETER;
1238
1239	#ifdef IN_RC
1240	if (TRPMHasTrap(pVCpu))
1241	{
1242	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1243	{
1244	#else
1245	/** @todo Make this the default and don't rely on TRPM information. */
1246	if (param1.type == PARMTYPE_ADDRESS)
1247	{
1248	#endif
1249	RTGCPTR pDest;
1250	uint64_t val64;
1251
1252	switch(param1.type)
1253	{
1254	case PARMTYPE_IMMEDIATE:
1255	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1256	return VERR_EM_INTERPRETER;
1257	/* fallthru */
1258
1259	case PARMTYPE_ADDRESS:
1260	pDest = (RTGCPTR)param1.val.val64;
1261	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pDest);
1262	break;
1263
1264	default:
1265	AssertFailed();
1266	return VERR_EM_INTERPRETER;
1267	}
1268
1269	switch(param2.type)
1270	{
1271	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1272	val64 = param2.val.val64;
1273	break;
1274
1275	default:
1276	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1277	return VERR_EM_INTERPRETER;
1278	}
1279	#ifdef LOG_ENABLED
1280	if (pDis->mode == CPUMODE_64BIT)
1281	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1282	else
1283	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1284	#endif
1285
1286	Assert(param2.size <= 8 && param2.size > 0);
1287	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1288	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1289	if (RT_FAILURE(rc))
1290	return VERR_EM_INTERPRETER;
1291
1292	*pcbSize = param2.size;
1293	}
1294	else
1295	{ /* read fault */
1296	RTGCPTR pSrc;
1297	uint64_t val64;
1298
1299	/* Source */
1300	switch(param2.type)
1301	{
1302	case PARMTYPE_IMMEDIATE:
1303	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1304	return VERR_EM_INTERPRETER;
1305	/* fallthru */
1306
1307	case PARMTYPE_ADDRESS:
1308	pSrc = (RTGCPTR)param2.val.val64;
1309	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pSrc);
1310	break;
1311
1312	default:
1313	return VERR_EM_INTERPRETER;
1314	}
1315
1316	Assert(param1.size <= 8 && param1.size > 0);
1317	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1318	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1319	if (RT_FAILURE(rc))
1320	return VERR_EM_INTERPRETER;
1321
1322	/* Destination */
1323	switch(param1.type)
1324	{
1325	case PARMTYPE_REGISTER:
1326	switch(param1.size)
1327	{
1328	case 1: rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t) val64); break;
1329	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)val64); break;
1330	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)val64); break;
1331	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, val64); break;
1332	default:
1333	return VERR_EM_INTERPRETER;
1334	}
1335	if (RT_FAILURE(rc))
1336	return rc;
1337	break;
1338
1339	default:
1340	return VERR_EM_INTERPRETER;
1341	}
1342	#ifdef LOG_ENABLED
1343	if (pDis->mode == CPUMODE_64BIT)
1344	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1345	else
1346	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1347	#endif
1348	}
1349	return VINF_SUCCESS;
1350	#ifdef IN_RC
1351	}
1352	#endif
1353	return VERR_EM_INTERPRETER;
1354	}
1355
1356
1357	#ifndef IN_RC
1358	/**
1359	* [REP] STOSWD emulation
1360	*/
1361	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1362	{
1363	int rc;
1364	RTGCPTR GCDest, GCOffset;
1365	uint32_t cbSize;
1366	uint64_t cTransfers;
1367	int offIncrement;
1368
1369	/* Don't support any but these three prefix bytes. */
1370	if ((pDis->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1371	return VERR_EM_INTERPRETER;
1372
1373	switch (pDis->addrmode)
1374	{
1375	case CPUMODE_16BIT:
1376	GCOffset = pRegFrame->di;
1377	cTransfers = pRegFrame->cx;
1378	break;
1379	case CPUMODE_32BIT:
1380	GCOffset = pRegFrame->edi;
1381	cTransfers = pRegFrame->ecx;
1382	break;
1383	case CPUMODE_64BIT:
1384	GCOffset = pRegFrame->rdi;
1385	cTransfers = pRegFrame->rcx;
1386	break;
1387	default:
1388	AssertFailed();
1389	return VERR_EM_INTERPRETER;
1390	}
1391
1392	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1393	switch (pDis->opmode)
1394	{
1395	case CPUMODE_16BIT:
1396	cbSize = 2;
1397	break;
1398	case CPUMODE_32BIT:
1399	cbSize = 4;
1400	break;
1401	case CPUMODE_64BIT:
1402	cbSize = 8;
1403	break;
1404	default:
1405	AssertFailed();
1406	return VERR_EM_INTERPRETER;
1407	}
1408
1409	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1410
1411	if (!(pDis->prefix & PREFIX_REP))
1412	{
1413	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1414
1415	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1416	if (RT_FAILURE(rc))
1417	return VERR_EM_INTERPRETER;
1418	Assert(rc == VINF_SUCCESS);
1419
1420	/* Update (e/r)di. */
1421	switch (pDis->addrmode)
1422	{
1423	case CPUMODE_16BIT:
1424	pRegFrame->di += offIncrement;
1425	break;
1426	case CPUMODE_32BIT:
1427	pRegFrame->edi += offIncrement;
1428	break;
1429	case CPUMODE_64BIT:
1430	pRegFrame->rdi += offIncrement;
1431	break;
1432	default:
1433	AssertFailed();
1434	return VERR_EM_INTERPRETER;
1435	}
1436
1437	}
1438	else
1439	{
1440	if (!cTransfers)
1441	return VINF_SUCCESS;
1442
1443	/*
1444	* Do not try emulate cross page stuff here because we don't know what might
1445	* be waiting for us on the subsequent pages. The caller has only asked us to
1446	* ignore access handlers fro the current page.
1447	* This also fends off big stores which would quickly kill PGMR0DynMap.
1448	*/
1449	if ( cbSize > PAGE_SIZE
1450	\|\| cTransfers > PAGE_SIZE
1451	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1452	{
1453	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1454	GCDest, cbSize, offIncrement, cTransfers));
1455	return VERR_EM_INTERPRETER;
1456	}
1457
1458	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1459	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1460	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1461	cTransfers * cbSize,
1462	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1463	if (rc != VINF_SUCCESS)
1464	{
1465	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1466	return VERR_EM_INTERPRETER;
1467	}
1468
1469	/* REP case */
1470	while (cTransfers)
1471	{
1472	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1473	if (RT_FAILURE(rc))
1474	{
1475	rc = VERR_EM_INTERPRETER;
1476	break;
1477	}
1478
1479	Assert(rc == VINF_SUCCESS);
1480	GCOffset += offIncrement;
1481	GCDest += offIncrement;
1482	cTransfers--;
1483	}
1484
1485	/* Update the registers. */
1486	switch (pDis->addrmode)
1487	{
1488	case CPUMODE_16BIT:
1489	pRegFrame->di = GCOffset;
1490	pRegFrame->cx = cTransfers;
1491	break;
1492	case CPUMODE_32BIT:
1493	pRegFrame->edi = GCOffset;
1494	pRegFrame->ecx = cTransfers;
1495	break;
1496	case CPUMODE_64BIT:
1497	pRegFrame->rdi = GCOffset;
1498	pRegFrame->rcx = cTransfers;
1499	break;
1500	default:
1501	AssertFailed();
1502	return VERR_EM_INTERPRETER;
1503	}
1504	}
1505
1506	*pcbSize = cbSize;
1507	return rc;
1508	}
1509	#endif /* !IN_RC */
1510
1511	#ifndef IN_RC
1512
1513	/**
1514	* [LOCK] CMPXCHG emulation.
1515	*/
1516	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1517	{
1518	OP_PARAMVAL param1, param2;
1519
1520	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1521	Assert(pDis->param1.size <= 4);
1522	#endif
1523
1524	/* Source to make DISQueryParamVal read the register value - ugly hack */
1525	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1526	if(RT_FAILURE(rc))
1527	return VERR_EM_INTERPRETER;
1528
1529	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1530	if(RT_FAILURE(rc))
1531	return VERR_EM_INTERPRETER;
1532
1533	uint64_t valpar;
1534	switch(param2.type)
1535	{
1536	case PARMTYPE_IMMEDIATE: /* register actually */
1537	valpar = param2.val.val64;
1538	break;
1539
1540	default:
1541	return VERR_EM_INTERPRETER;
1542	}
1543
1544	PGMPAGEMAPLOCK Lock;
1545	RTGCPTR GCPtrPar1;
1546	void *pvParam1;
1547	uint64_t eflags;
1548
1549	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1550	switch(param1.type)
1551	{
1552	case PARMTYPE_ADDRESS:
1553	GCPtrPar1 = param1.val.val64;
1554	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1555
1556	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1557	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1558	break;
1559
1560	default:
1561	return VERR_EM_INTERPRETER;
1562	}
1563
1564	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1565
1566	if (pDis->prefix & PREFIX_LOCK)
1567	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1568	else
1569	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1570
1571	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1572
1573	/* Update guest's eflags and finish. */
1574	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1575	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1576
1577	*pcbSize = param2.size;
1578	PGMPhysReleasePageMappingLock(pVM, &Lock);
1579	return VINF_SUCCESS;
1580	}
1581
1582
1583	/**
1584	* [LOCK] CMPXCHG8B emulation.
1585	*/
1586	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1587	{
1588	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1589	OP_PARAMVAL param1;
1590
1591	/* Source to make DISQueryParamVal read the register value - ugly hack */
1592	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1593	if(RT_FAILURE(rc))
1594	return VERR_EM_INTERPRETER;
1595
1596	RTGCPTR GCPtrPar1;
1597	void *pvParam1;
1598	uint64_t eflags;
1599	PGMPAGEMAPLOCK Lock;
1600
1601	AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1602	switch(param1.type)
1603	{
1604	case PARMTYPE_ADDRESS:
1605	GCPtrPar1 = param1.val.val64;
1606	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1607
1608	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1609	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1610	break;
1611
1612	default:
1613	return VERR_EM_INTERPRETER;
1614	}
1615
1616	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1617
1618	if (pDis->prefix & PREFIX_LOCK)
1619	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1620	else
1621	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1622
1623	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1624
1625	/* Update guest's eflags and finish; note that only ZF is affected. */
1626	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1627	\| (eflags & (X86_EFL_ZF));
1628
1629	*pcbSize = 8;
1630	PGMPhysReleasePageMappingLock(pVM, &Lock);
1631	return VINF_SUCCESS;
1632	}
1633
1634	#else /* IN_RC */
1635
1636	/**
1637	* [LOCK] CMPXCHG emulation.
1638	*/
1639	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1640	{
1641	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1642	OP_PARAMVAL param1, param2;
1643
1644	/* Source to make DISQueryParamVal read the register value - ugly hack */
1645	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1646	if(RT_FAILURE(rc))
1647	return VERR_EM_INTERPRETER;
1648
1649	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1650	if(RT_FAILURE(rc))
1651	return VERR_EM_INTERPRETER;
1652
1653	if (TRPMHasTrap(pVCpu))
1654	{
1655	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1656	{
1657	RTRCPTR pParam1;
1658	uint32_t valpar, eflags;
1659
1660	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1661	switch(param1.type)
1662	{
1663	case PARMTYPE_ADDRESS:
1664	pParam1 = (RTRCPTR)param1.val.val64;
1665	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1666	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1667	break;
1668
1669	default:
1670	return VERR_EM_INTERPRETER;
1671	}
1672
1673	switch(param2.type)
1674	{
1675	case PARMTYPE_IMMEDIATE: /* register actually */
1676	valpar = param2.val.val32;
1677	break;
1678
1679	default:
1680	return VERR_EM_INTERPRETER;
1681	}
1682
1683	LogFlow(("%s %RRv eax=%08x %08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1684
1685	MMGCRamRegisterTrapHandler(pVM);
1686	if (pDis->prefix & PREFIX_LOCK)
1687	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1688	else
1689	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1690	MMGCRamDeregisterTrapHandler(pVM);
1691
1692	if (RT_FAILURE(rc))
1693	{
1694	Log(("%s %RGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1695	return VERR_EM_INTERPRETER;
1696	}
1697
1698	LogFlow(("%s %RRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1699
1700	/* Update guest's eflags and finish. */
1701	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1702	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1703
1704	*pcbSize = param2.size;
1705	return VINF_SUCCESS;
1706	}
1707	}
1708	return VERR_EM_INTERPRETER;
1709	}
1710
1711
1712	/**
1713	* [LOCK] CMPXCHG8B emulation.
1714	*/
1715	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1716	{
1717	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1718	OP_PARAMVAL param1;
1719
1720	/* Source to make DISQueryParamVal read the register value - ugly hack */
1721	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1722	if(RT_FAILURE(rc))
1723	return VERR_EM_INTERPRETER;
1724
1725	if (TRPMHasTrap(pVCpu))
1726	{
1727	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1728	{
1729	RTRCPTR pParam1;
1730	uint32_t eflags;
1731
1732	AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1733	switch(param1.type)
1734	{
1735	case PARMTYPE_ADDRESS:
1736	pParam1 = (RTRCPTR)param1.val.val64;
1737	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1738	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1739	break;
1740
1741	default:
1742	return VERR_EM_INTERPRETER;
1743	}
1744
1745	LogFlow(("%s %RRv=%08x eax=%08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1746
1747	MMGCRamRegisterTrapHandler(pVM);
1748	if (pDis->prefix & PREFIX_LOCK)
1749	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1750	else
1751	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1752	MMGCRamDeregisterTrapHandler(pVM);
1753
1754	if (RT_FAILURE(rc))
1755	{
1756	Log(("%s %RGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1757	return VERR_EM_INTERPRETER;
1758	}
1759
1760	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1761
1762	/* Update guest's eflags and finish; note that only ZF is affected. */
1763	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1764	\| (eflags & (X86_EFL_ZF));
1765
1766	*pcbSize = 8;
1767	return VINF_SUCCESS;
1768	}
1769	}
1770	return VERR_EM_INTERPRETER;
1771	}
1772
1773	#endif /* IN_RC */
1774
1775	#ifdef IN_RC
1776	/**
1777	* [LOCK] XADD emulation.
1778	*/
1779	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1780	{
1781	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1782	OP_PARAMVAL param1;
1783	uint32_t *pParamReg2;
1784	size_t cbSizeParamReg2;
1785
1786	/* Source to make DISQueryParamVal read the register value - ugly hack */
1787	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1788	if(RT_FAILURE(rc))
1789	return VERR_EM_INTERPRETER;
1790
1791	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1792	Assert(cbSizeParamReg2 <= 4);
1793	if(RT_FAILURE(rc))
1794	return VERR_EM_INTERPRETER;
1795
1796	if (TRPMHasTrap(pVCpu))
1797	{
1798	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1799	{
1800	RTRCPTR pParam1;
1801	uint32_t eflags;
1802
1803	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1804	switch(param1.type)
1805	{
1806	case PARMTYPE_ADDRESS:
1807	pParam1 = (RTRCPTR)param1.val.val64;
1808	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1809	EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1810	break;
1811
1812	default:
1813	return VERR_EM_INTERPRETER;
1814	}
1815
1816	LogFlow(("XAdd %RRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1817
1818	MMGCRamRegisterTrapHandler(pVM);
1819	if (pDis->prefix & PREFIX_LOCK)
1820	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1821	else
1822	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1823	MMGCRamDeregisterTrapHandler(pVM);
1824
1825	if (RT_FAILURE(rc))
1826	{
1827	Log(("XAdd %RGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1828	return VERR_EM_INTERPRETER;
1829	}
1830
1831	LogFlow(("XAdd %RGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1832
1833	/* Update guest's eflags and finish. */
1834	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1835	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1836
1837	*pcbSize = cbSizeParamReg2;
1838	return VINF_SUCCESS;
1839	}
1840	}
1841	return VERR_EM_INTERPRETER;
1842	}
1843	#endif /* IN_RC */
1844
1845
1846	#ifdef IN_RC
1847	/**
1848	* Interpret IRET (currently only to V86 code)
1849	*
1850	* @returns VBox status code.
1851	* @param pVM The VM handle.
1852	* @param pVCpu The VMCPU handle.
1853	* @param pRegFrame The register frame.
1854	*
1855	*/
1856	VMMDECL(int) EMInterpretIret(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1857	{
1858	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1859	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1860	int rc;
1861
1862	Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
1863
1864	rc = emRamRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1865	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1866	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1867	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1868	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1869
1870	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1871	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1872	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1873	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1874	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1875	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1876	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1877
1878	pRegFrame->eip = eip & 0xffff;
1879	pRegFrame->cs = cs;
1880
1881	/* Mask away all reserved bits */
1882	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1883	eflags &= uMask;
1884
1885	#ifndef IN_RING0
1886	CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
1887	#endif
1888	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1889
1890	pRegFrame->esp = esp;
1891	pRegFrame->ss = ss;
1892	pRegFrame->ds = ds;
1893	pRegFrame->es = es;
1894	pRegFrame->fs = fs;
1895	pRegFrame->gs = gs;
1896
1897	return VINF_SUCCESS;
1898	}
1899	#endif /* IN_RC */
1900
1901
1902	/**
1903	* IRET Emulation.
1904	*/
1905	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1906	{
1907	/* only allow direct calls to EMInterpretIret for now */
1908	return VERR_EM_INTERPRETER;
1909	}
1910
1911	/**
1912	* WBINVD Emulation.
1913	*/
1914	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1915	{
1916	/* Nothing to do. */
1917	return VINF_SUCCESS;
1918	}
1919
1920
1921	/**
1922	* Interpret INVLPG
1923	*
1924	* @returns VBox status code.
1925	* @param pVM The VM handle.
1926	* @param pVCpu The VMCPU handle.
1927	* @param pRegFrame The register frame.
1928	* @param pAddrGC Operand address
1929	*
1930	*/
1931	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1932	{
1933	int rc;
1934
1935	/** @todo is addr always a flat linear address or ds based
1936	* (in absence of segment override prefixes)????
1937	*/
1938	#ifdef IN_RC
1939	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1940	#endif
1941	rc = PGMInvalidatePage(pVCpu, pAddrGC);
1942	if ( rc == VINF_SUCCESS
1943	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1944	return VINF_SUCCESS;
1945	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1946	("%Rrc addr=%RGv\n", rc, pAddrGC),
1947	VERR_EM_INTERPRETER);
1948	return rc;
1949	}
1950
1951
1952	/**
1953	* INVLPG Emulation.
1954	*/
1955	static int emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1956	{
1957	OP_PARAMVAL param1;
1958	RTGCPTR addr;
1959
1960	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1961	if(RT_FAILURE(rc))
1962	return VERR_EM_INTERPRETER;
1963
1964	switch(param1.type)
1965	{
1966	case PARMTYPE_IMMEDIATE:
1967	case PARMTYPE_ADDRESS:
1968	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1969	return VERR_EM_INTERPRETER;
1970	addr = (RTGCPTR)param1.val.val64;
1971	break;
1972
1973	default:
1974	return VERR_EM_INTERPRETER;
1975	}
1976
1977	/** @todo is addr always a flat linear address or ds based
1978	* (in absence of segment override prefixes)????
1979	*/
1980	#ifdef IN_RC
1981	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1982	#endif
1983	rc = PGMInvalidatePage(pVCpu, addr);
1984	if ( rc == VINF_SUCCESS
1985	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1986	return VINF_SUCCESS;
1987	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1988	("%Rrc addr=%RGv\n", rc, addr),
1989	VERR_EM_INTERPRETER);
1990	return rc;
1991	}
1992
1993
1994	/**
1995	* Interpret CPUID given the parameters in the CPU context
1996	*
1997	* @returns VBox status code.
1998	* @param pVM The VM handle.
1999	* @param pVCpu The VMCPU handle.
2000	* @param pRegFrame The register frame.
2001	*
2002	*/
2003	VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2004	{
2005	uint32_t iLeaf = pRegFrame->eax;
2006
2007	/* cpuid clears the high dwords of the affected 64 bits registers. */
2008	pRegFrame->rax = 0;
2009	pRegFrame->rbx = 0;
2010	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
2011	pRegFrame->rdx = 0;
2012
2013	/* Note: operates the same in 64 and non-64 bits mode. */
2014	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
2015	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
2016	return VINF_SUCCESS;
2017	}
2018
2019
2020	/**
2021	* CPUID Emulation.
2022	*/
2023	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2024	{
2025	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
2026	return rc;
2027	}
2028
2029
2030	/**
2031	* Interpret CRx read
2032	*
2033	* @returns VBox status code.
2034	* @param pVM The VM handle.
2035	* @param pVCpu The VMCPU handle.
2036	* @param pRegFrame The register frame.
2037	* @param DestRegGen General purpose register index (USE_REG_E**))
2038	* @param SrcRegCRx CRx register index (USE_REG_CR*)
2039	*
2040	*/
2041	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
2042	{
2043	int rc;
2044	uint64_t val64;
2045
2046	if (SrcRegCrx == USE_REG_CR8)
2047	{
2048	val64 = 0;
2049	rc = PDMApicGetTPR(pVCpu, (uint8_t *)&val64, NULL);
2050	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
2051	val64 >>= 4; /* bits 7-4 contain the task priority that go in cr8, bits 3-0*/
2052	}
2053	else
2054	{
2055	rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
2056	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
2057	}
2058
2059	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2060	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2061	else
2062	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
2063
2064	if(RT_SUCCESS(rc))
2065	{
2066	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2067	return VINF_SUCCESS;
2068	}
2069	return VERR_EM_INTERPRETER;
2070	}
2071
2072
2073
2074	/**
2075	* Interpret CLTS
2076	*
2077	* @returns VBox status code.
2078	* @param pVM The VM handle.
2079	* @param pVCpu The VMCPU handle.
2080	*
2081	*/
2082	VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
2083	{
2084	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2085	if (!(cr0 & X86_CR0_TS))
2086	return VINF_SUCCESS;
2087	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
2088	}
2089
2090	/**
2091	* CLTS Emulation.
2092	*/
2093	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2094	{
2095	return EMInterpretCLTS(pVM, pVCpu);
2096	}
2097
2098
2099	/**
2100	* Update CRx
2101	*
2102	* @returns VBox status code.
2103	* @param pVM The VM handle.
2104	* @param pVCpu The VMCPU handle.
2105	* @param pRegFrame The register frame.
2106	* @param DestRegCRx CRx register index (USE_REG_CR*)
2107	* @param val New CRx value
2108	*
2109	*/
2110	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2111	{
2112	uint64_t oldval;
2113	uint64_t msrEFER;
2114	int rc, rc2;
2115
2116	/** @todo Clean up this mess. */
2117	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2118	switch (DestRegCrx)
2119	{
2120	case USE_REG_CR0:
2121	oldval = CPUMGetGuestCR0(pVCpu);
2122	#ifdef IN_RC
2123	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2124	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2125	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2126	return VERR_EM_INTERPRETER;
2127	#endif
2128	rc = VINF_SUCCESS;
2129	CPUMSetGuestCR0(pVCpu, val);
2130	val = CPUMGetGuestCR0(pVCpu);
2131	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2132	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2133	{
2134	/* global flush */
2135	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2136	AssertRCReturn(rc, rc);
2137	}
2138
2139	/* Deal with long mode enabling/disabling. */
2140	msrEFER = CPUMGetGuestEFER(pVCpu);
2141	if (msrEFER & MSR_K6_EFER_LME)
2142	{
2143	if ( !(oldval & X86_CR0_PG)
2144	&& (val & X86_CR0_PG))
2145	{
2146	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2147	if (pRegFrame->csHid.Attr.n.u1Long)
2148	{
2149	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2150	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2151	}
2152
2153	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2154	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
2155	{
2156	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2157	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2158	}
2159	msrEFER \|= MSR_K6_EFER_LMA;
2160	}
2161	else
2162	if ( (oldval & X86_CR0_PG)
2163	&& !(val & X86_CR0_PG))
2164	{
2165	msrEFER &= ~MSR_K6_EFER_LMA;
2166	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2167	}
2168	CPUMSetGuestEFER(pVCpu, msrEFER);
2169	}
2170	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2171	return rc2 == VINF_SUCCESS ? rc : rc2;
2172
2173	case USE_REG_CR2:
2174	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2175	return VINF_SUCCESS;
2176
2177	case USE_REG_CR3:
2178	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2179	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2180	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2181	{
2182	/* flush */
2183	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2184	AssertRCReturn(rc, rc);
2185	}
2186	return rc;
2187
2188	case USE_REG_CR4:
2189	oldval = CPUMGetGuestCR4(pVCpu);
2190	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2191	val = CPUMGetGuestCR4(pVCpu);
2192
2193	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2194	msrEFER = CPUMGetGuestEFER(pVCpu);
2195	if ( (msrEFER & MSR_K6_EFER_LMA)
2196	&& (oldval & X86_CR4_PAE)
2197	&& !(val & X86_CR4_PAE))
2198	{
2199	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2200	}
2201
2202	rc = VINF_SUCCESS;
2203	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2204	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2205	{
2206	/* global flush */
2207	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2208	AssertRCReturn(rc, rc);
2209	}
2210
2211	/* Feeling extremely lazy. */
2212	# ifdef IN_RC
2213	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2214	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2215	{
2216	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2217	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2218	}
2219	# endif
2220	if ((val ^ oldval) & X86_CR4_VME)
2221	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2222
2223	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2224	return rc2 == VINF_SUCCESS ? rc : rc2;
2225
2226	case USE_REG_CR8:
2227	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2228
2229	default:
2230	AssertFailed();
2231	case USE_REG_CR1: /* illegal op */
2232	break;
2233	}
2234	return VERR_EM_INTERPRETER;
2235	}
2236
2237	/**
2238	* Interpret CRx write
2239	*
2240	* @returns VBox status code.
2241	* @param pVM The VM handle.
2242	* @param pVCpu The VMCPU handle.
2243	* @param pRegFrame The register frame.
2244	* @param DestRegCRx CRx register index (USE_REG_CR*)
2245	* @param SrcRegGen General purpose register index (USE_REG_E**))
2246	*
2247	*/
2248	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2249	{
2250	uint64_t val;
2251	int rc;
2252
2253	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2254	{
2255	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2256	}
2257	else
2258	{
2259	uint32_t val32;
2260	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2261	val = val32;
2262	}
2263
2264	if (RT_SUCCESS(rc))
2265	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2266
2267	return VERR_EM_INTERPRETER;
2268	}
2269
2270	/**
2271	* Interpret LMSW
2272	*
2273	* @returns VBox status code.
2274	* @param pVM The VM handle.
2275	* @param pVCpu The VMCPU handle.
2276	* @param pRegFrame The register frame.
2277	* @param u16Data LMSW source data.
2278	*
2279	*/
2280	VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2281	{
2282	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2283
2284	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2285	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2286	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2287
2288	return emUpdateCRx(pVM, pVCpu, pRegFrame, USE_REG_CR0, NewCr0);
2289	}
2290
2291	/**
2292	* LMSW Emulation.
2293	*/
2294	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2295	{
2296	OP_PARAMVAL param1;
2297	uint32_t val;
2298
2299	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2300	if(RT_FAILURE(rc))
2301	return VERR_EM_INTERPRETER;
2302
2303	switch(param1.type)
2304	{
2305	case PARMTYPE_IMMEDIATE:
2306	case PARMTYPE_ADDRESS:
2307	if(!(param1.flags & PARAM_VAL16))
2308	return VERR_EM_INTERPRETER;
2309	val = param1.val.val32;
2310	break;
2311
2312	default:
2313	return VERR_EM_INTERPRETER;
2314	}
2315
2316	LogFlow(("emInterpretLmsw %x\n", val));
2317	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2318	}
2319
2320	#ifdef EM_EMULATE_SMSW
2321	/**
2322	* SMSW Emulation.
2323	*/
2324	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2325	{
2326	OP_PARAMVAL param1;
2327	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2328
2329	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2330	if(RT_FAILURE(rc))
2331	return VERR_EM_INTERPRETER;
2332
2333	switch(param1.type)
2334	{
2335	case PARMTYPE_IMMEDIATE:
2336	if(param1.size != sizeof(uint16_t))
2337	return VERR_EM_INTERPRETER;
2338	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->param1.base.reg_gen, cr0));
2339	rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, cr0);
2340	break;
2341
2342	case PARMTYPE_ADDRESS:
2343	{
2344	RTGCPTR pParam1;
2345
2346	/* Actually forced to 16 bits regardless of the operand size. */
2347	if(param1.size != sizeof(uint16_t))
2348	return VERR_EM_INTERPRETER;
2349
2350	pParam1 = (RTGCPTR)param1.val.val64;
2351	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
2352	LogFlow(("emInterpretSmsw %VGv <- cr0 (%x)\n", pParam1, cr0));
2353
2354	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2355	if (RT_FAILURE(rc))
2356	{
2357	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2358	return VERR_EM_INTERPRETER;
2359	}
2360	break;
2361	}
2362
2363	default:
2364	return VERR_EM_INTERPRETER;
2365	}
2366
2367	LogFlow(("emInterpretSmsw %x\n", cr0));
2368	return rc;
2369	}
2370	#endif
2371
2372	/**
2373	* MOV CRx
2374	*/
2375	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2376	{
2377	if ((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_CR)
2378	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_ctrl);
2379
2380	if (pDis->param1.flags == USE_REG_CR && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2381	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_ctrl, pDis->param2.base.reg_gen);
2382
2383	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2384	return VERR_EM_INTERPRETER;
2385	}
2386
2387
2388	/**
2389	* Interpret DRx write
2390	*
2391	* @returns VBox status code.
2392	* @param pVM The VM handle.
2393	* @param pVCpu The VMCPU handle.
2394	* @param pRegFrame The register frame.
2395	* @param DestRegDRx DRx register index (USE_REG_DR*)
2396	* @param SrcRegGen General purpose register index (USE_REG_E**))
2397	*
2398	*/
2399	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2400	{
2401	uint64_t val;
2402	int rc;
2403
2404	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2405	{
2406	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2407	}
2408	else
2409	{
2410	uint32_t val32;
2411	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2412	val = val32;
2413	}
2414
2415	if (RT_SUCCESS(rc))
2416	{
2417	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2418	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2419	if (RT_SUCCESS(rc))
2420	return rc;
2421	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2422	}
2423	return VERR_EM_INTERPRETER;
2424	}
2425
2426
2427	/**
2428	* Interpret DRx read
2429	*
2430	* @returns VBox status code.
2431	* @param pVM The VM handle.
2432	* @param pVCpu The VMCPU handle.
2433	* @param pRegFrame The register frame.
2434	* @param DestRegGen General purpose register index (USE_REG_E**))
2435	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2436	*
2437	*/
2438	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2439	{
2440	uint64_t val64;
2441
2442	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2443	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2444	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2445	{
2446	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2447	}
2448	else
2449	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2450
2451	if (RT_SUCCESS(rc))
2452	return VINF_SUCCESS;
2453
2454	return VERR_EM_INTERPRETER;
2455	}
2456
2457
2458	/**
2459	* MOV DRx
2460	*/
2461	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2462	{
2463	int rc = VERR_EM_INTERPRETER;
2464
2465	if((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_DBG)
2466	{
2467	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_dbg);
2468	}
2469	else
2470	if(pDis->param1.flags == USE_REG_DBG && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2471	{
2472	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_dbg, pDis->param2.base.reg_gen);
2473	}
2474	else
2475	AssertMsgFailed(("Unexpected debug register move\n"));
2476
2477	return rc;
2478	}
2479
2480
2481	/**
2482	* LLDT Emulation.
2483	*/
2484	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2485	{
2486	OP_PARAMVAL param1;
2487	RTSEL sel;
2488
2489	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2490	if(RT_FAILURE(rc))
2491	return VERR_EM_INTERPRETER;
2492
2493	switch(param1.type)
2494	{
2495	case PARMTYPE_ADDRESS:
2496	return VERR_EM_INTERPRETER; //feeling lazy right now
2497
2498	case PARMTYPE_IMMEDIATE:
2499	if(!(param1.flags & PARAM_VAL16))
2500	return VERR_EM_INTERPRETER;
2501	sel = (RTSEL)param1.val.val16;
2502	break;
2503
2504	default:
2505	return VERR_EM_INTERPRETER;
2506	}
2507
2508	#ifdef IN_RING0
2509	/* Only for the VT-x real-mode emulation case. */
2510	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2511	CPUMSetGuestLDTR(pVCpu, sel);
2512	return VINF_SUCCESS;
2513	#else
2514	if (sel == 0)
2515	{
2516	if (CPUMGetHyperLDTR(pVCpu) == 0)
2517	{
2518	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2519	return VINF_SUCCESS;
2520	}
2521	}
2522	//still feeling lazy
2523	return VERR_EM_INTERPRETER;
2524	#endif
2525	}
2526
2527	#ifdef IN_RING0
2528	/**
2529	* LIDT/LGDT Emulation.
2530	*/
2531	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2532	{
2533	OP_PARAMVAL param1;
2534	RTGCPTR pParam1;
2535	X86XDTR32 dtr32;
2536
2537	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2538
2539	/* Only for the VT-x real-mode emulation case. */
2540	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2541
2542	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2543	if(RT_FAILURE(rc))
2544	return VERR_EM_INTERPRETER;
2545
2546	switch(param1.type)
2547	{
2548	case PARMTYPE_ADDRESS:
2549	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, param1.val.val16);
2550	break;
2551
2552	default:
2553	return VERR_EM_INTERPRETER;
2554	}
2555
2556	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2557	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2558
2559	if (!(pDis->prefix & PREFIX_OPSIZE))
2560	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2561
2562	if (pDis->pCurInstr->opcode == OP_LIDT)
2563	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2564	else
2565	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2566
2567	return VINF_SUCCESS;
2568	}
2569	#endif
2570
2571
2572	#ifdef IN_RC
2573	/**
2574	* STI Emulation.
2575	*
2576	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2577	*/
2578	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2579	{
2580	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2581
2582	if(!pGCState)
2583	{
2584	Assert(pGCState);
2585	return VERR_EM_INTERPRETER;
2586	}
2587	pGCState->uVMFlags \|= X86_EFL_IF;
2588
2589	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2590	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2591
2592	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->opsize;
2593	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2594
2595	return VINF_SUCCESS;
2596	}
2597	#endif /* IN_RC */
2598
2599
2600	/**
2601	* HLT Emulation.
2602	*/
2603	static int emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2604	{
2605	return VINF_EM_HALT;
2606	}
2607
2608
2609	/**
2610	* Interpret RDTSC
2611	*
2612	* @returns VBox status code.
2613	* @param pVM The VM handle.
2614	* @param pVCpu The VMCPU handle.
2615	* @param pRegFrame The register frame.
2616	*
2617	*/
2618	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2619	{
2620	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2621
2622	if (uCR4 & X86_CR4_TSD)
2623	return VERR_EM_INTERPRETER; /* genuine #GP */
2624
2625	uint64_t uTicks = TMCpuTickGet(pVCpu);
2626
2627	/* Same behaviour in 32 & 64 bits mode */
2628	pRegFrame->rax = (uint32_t)uTicks;
2629	pRegFrame->rdx = (uTicks >> 32ULL);
2630
2631	return VINF_SUCCESS;
2632	}
2633
2634	/**
2635	* Interpret RDTSCP
2636	*
2637	* @returns VBox status code.
2638	* @param pVM The VM handle.
2639	* @param pVCpu The VMCPU handle.
2640	* @param pCtx The CPU context.
2641	*
2642	*/
2643	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2644	{
2645	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2646
2647	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2648	{
2649	AssertFailed();
2650	return VERR_EM_INTERPRETER; /* genuine #UD */
2651	}
2652
2653	if (uCR4 & X86_CR4_TSD)
2654	return VERR_EM_INTERPRETER; /* genuine #GP */
2655
2656	uint64_t uTicks = TMCpuTickGet(pVCpu);
2657
2658	/* Same behaviour in 32 & 64 bits mode */
2659	pCtx->rax = (uint32_t)uTicks;
2660	pCtx->rdx = (uTicks >> 32ULL);
2661	/* Low dword of the TSC_AUX msr only. */
2662	pCtx->rcx = (uint32_t)CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2663
2664	return VINF_SUCCESS;
2665	}
2666
2667	/**
2668	* RDTSC Emulation.
2669	*/
2670	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2671	{
2672	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2673	}
2674
2675	/**
2676	* Interpret RDPMC
2677	*
2678	* @returns VBox status code.
2679	* @param pVM The VM handle.
2680	* @param pVCpu The VMCPU handle.
2681	* @param pRegFrame The register frame.
2682	*
2683	*/
2684	VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2685	{
2686	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2687
2688	/* If X86_CR4_PCE is not set, then CPL must be zero. */
2689	if ( !(uCR4 & X86_CR4_PCE)
2690	&& CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2691	{
2692	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2693	return VERR_EM_INTERPRETER; /* genuine #GP */
2694	}
2695
2696	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2697	pRegFrame->rax = 0;
2698	pRegFrame->rdx = 0;
2699	/* @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2700	return VINF_SUCCESS;
2701	}
2702
2703	/**
2704	* RDPMC Emulation
2705	*/
2706	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2707	{
2708	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2709	}
2710
2711	/**
2712	* MONITOR Emulation.
2713	*/
2714	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2715	{
2716	uint32_t u32Dummy, u32ExtFeatures, cpl;
2717
2718	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
2719	if (pRegFrame->ecx != 0)
2720	return VERR_EM_INTERPRETER; /* illegal value. */
2721
2722	/* Get the current privilege level. */
2723	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2724	if (cpl != 0)
2725	return VERR_EM_INTERPRETER; /* supervisor only */
2726
2727	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2728	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2729	return VERR_EM_INTERPRETER; /* not supported */
2730
2731	return VINF_SUCCESS;
2732	}
2733
2734
2735	/**
2736	* MWAIT Emulation.
2737	*/
2738	VMMDECL(int) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2739	{
2740	uint32_t u32Dummy, u32ExtFeatures, cpl;
2741
2742	/* @todo bit 1 is supposed to tell the cpu to wake us up on interrupts even if IF is cleared.
2743	* Not sure which models. Intel docs say ecx and eax must be zero for Pentium 4 CPUs
2744	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
2745	*/
2746	if (pRegFrame->ecx != 0)
2747	return VERR_EM_INTERPRETER; /* illegal value. */
2748
2749	/* Get the current privilege level. */
2750	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2751	if (cpl != 0)
2752	return VERR_EM_INTERPRETER; /* supervisor only */
2753
2754	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2755	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2756	return VERR_EM_INTERPRETER; /* not supported */
2757
2758	/** @todo not completely correct */
2759	return VINF_EM_HALT;
2760	}
2761
2762	static int emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2763	{
2764	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
2765
2766	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2767	}
2768
2769
2770	#ifdef LOG_ENABLED
2771	static const char *emMSRtoString(uint32_t uMsr)
2772	{
2773	switch (uMsr)
2774	{
2775	case MSR_IA32_APICBASE:
2776	return "MSR_IA32_APICBASE";
2777	case MSR_IA32_CR_PAT:
2778	return "MSR_IA32_CR_PAT";
2779	case MSR_IA32_SYSENTER_CS:
2780	return "MSR_IA32_SYSENTER_CS";
2781	case MSR_IA32_SYSENTER_EIP:
2782	return "MSR_IA32_SYSENTER_EIP";
2783	case MSR_IA32_SYSENTER_ESP:
2784	return "MSR_IA32_SYSENTER_ESP";
2785	case MSR_K6_EFER:
2786	return "MSR_K6_EFER";
2787	case MSR_K8_SF_MASK:
2788	return "MSR_K8_SF_MASK";
2789	case MSR_K6_STAR:
2790	return "MSR_K6_STAR";
2791	case MSR_K8_LSTAR:
2792	return "MSR_K8_LSTAR";
2793	case MSR_K8_CSTAR:
2794	return "MSR_K8_CSTAR";
2795	case MSR_K8_FS_BASE:
2796	return "MSR_K8_FS_BASE";
2797	case MSR_K8_GS_BASE:
2798	return "MSR_K8_GS_BASE";
2799	case MSR_K8_KERNEL_GS_BASE:
2800	return "MSR_K8_KERNEL_GS_BASE";
2801	case MSR_K8_TSC_AUX:
2802	return "MSR_K8_TSC_AUX";
2803	case MSR_IA32_BIOS_SIGN_ID:
2804	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2805	case MSR_IA32_PLATFORM_ID:
2806	return "Unsupported MSR_IA32_PLATFORM_ID";
2807	case MSR_IA32_BIOS_UPDT_TRIG:
2808	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2809	case MSR_IA32_TSC:
2810	return "MSR_IA32_TSC";
2811	case MSR_IA32_MTRR_CAP:
2812	return "Unsupported MSR_IA32_MTRR_CAP";
2813	case MSR_IA32_MCP_CAP:
2814	return "Unsupported MSR_IA32_MCP_CAP";
2815	case MSR_IA32_MCP_STATUS:
2816	return "Unsupported MSR_IA32_MCP_STATUS";
2817	case MSR_IA32_MCP_CTRL:
2818	return "Unsupported MSR_IA32_MCP_CTRL";
2819	case MSR_IA32_MTRR_DEF_TYPE:
2820	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2821	case MSR_K7_EVNTSEL0:
2822	return "Unsupported MSR_K7_EVNTSEL0";
2823	case MSR_K7_EVNTSEL1:
2824	return "Unsupported MSR_K7_EVNTSEL1";
2825	case MSR_K7_EVNTSEL2:
2826	return "Unsupported MSR_K7_EVNTSEL2";
2827	case MSR_K7_EVNTSEL3:
2828	return "Unsupported MSR_K7_EVNTSEL3";
2829	case MSR_IA32_MC0_CTL:
2830	return "Unsupported MSR_IA32_MC0_CTL";
2831	case MSR_IA32_MC0_STATUS:
2832	return "Unsupported MSR_IA32_MC0_STATUS";
2833	case MSR_IA32_PERFEVTSEL0:
2834	return "Unsupported MSR_IA32_PERFEVTSEL0";
2835	case MSR_IA32_PERFEVTSEL1:
2836	return "Unsupported MSR_IA32_PERFEVTSEL1";
2837	case MSR_IA32_PERF_STATUS:
2838	return "MSR_IA32_PERF_STATUS";
2839	case MSR_IA32_PERF_CTL:
2840	return "Unsupported MSR_IA32_PERF_CTL";
2841	case MSR_K7_PERFCTR0:
2842	return "Unsupported MSR_K7_PERFCTR0";
2843	case MSR_K7_PERFCTR1:
2844	return "Unsupported MSR_K7_PERFCTR1";
2845	case MSR_K7_PERFCTR2:
2846	return "Unsupported MSR_K7_PERFCTR2";
2847	case MSR_K7_PERFCTR3:
2848	return "Unsupported MSR_K7_PERFCTR3";
2849	}
2850	return "Unknown MSR";
2851	}
2852	#endif /* LOG_ENABLED */
2853
2854
2855	/**
2856	* Interpret RDMSR
2857	*
2858	* @returns VBox status code.
2859	* @param pVM The VM handle.
2860	* @param pVCpu The VMCPU handle.
2861	* @param pRegFrame The register frame.
2862	*
2863	*/
2864	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2865	{
2866	uint32_t u32Dummy, u32Features, cpl;
2867	uint64_t val;
2868	CPUMCTX *pCtx;
2869	int rc = VINF_SUCCESS;
2870
2871	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2872	* That version clears the high dwords of both RDX & RAX */
2873	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2874
2875	/* Get the current privilege level. */
2876	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2877	if (cpl != 0)
2878	return VERR_EM_INTERPRETER; /* supervisor only */
2879
2880	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2881	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2882	return VERR_EM_INTERPRETER; /* not supported */
2883
2884	switch (pRegFrame->ecx)
2885	{
2886	case MSR_IA32_TSC:
2887	val = TMCpuTickGet(pVCpu);
2888	break;
2889
2890	case MSR_IA32_APICBASE:
2891	rc = PDMApicGetBase(pVM, &val);
2892	AssertRC(rc);
2893	break;
2894
2895	case MSR_IA32_CR_PAT:
2896	val = pCtx->msrPAT;
2897	break;
2898
2899	case MSR_IA32_SYSENTER_CS:
2900	val = pCtx->SysEnter.cs;
2901	break;
2902
2903	case MSR_IA32_SYSENTER_EIP:
2904	val = pCtx->SysEnter.eip;
2905	break;
2906
2907	case MSR_IA32_SYSENTER_ESP:
2908	val = pCtx->SysEnter.esp;
2909	break;
2910
2911	case MSR_K6_EFER:
2912	val = pCtx->msrEFER;
2913	break;
2914
2915	case MSR_K8_SF_MASK:
2916	val = pCtx->msrSFMASK;
2917	break;
2918
2919	case MSR_K6_STAR:
2920	val = pCtx->msrSTAR;
2921	break;
2922
2923	case MSR_K8_LSTAR:
2924	val = pCtx->msrLSTAR;
2925	break;
2926
2927	case MSR_K8_CSTAR:
2928	val = pCtx->msrCSTAR;
2929	break;
2930
2931	case MSR_K8_FS_BASE:
2932	val = pCtx->fsHid.u64Base;
2933	break;
2934
2935	case MSR_K8_GS_BASE:
2936	val = pCtx->gsHid.u64Base;
2937	break;
2938
2939	case MSR_K8_KERNEL_GS_BASE:
2940	val = pCtx->msrKERNELGSBASE;
2941	break;
2942
2943	case MSR_K8_TSC_AUX:
2944	val = CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2945	break;
2946
2947	#if 0 /def IN_RING0 /
2948	case MSR_IA32_PLATFORM_ID:
2949	case MSR_IA32_BIOS_SIGN_ID:
2950	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2951	{
2952	/* Available since the P6 family. VT-x implies that this feature is present. */
2953	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2954	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2955	else
2956	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2957	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2958	break;
2959	}
2960	/* no break */
2961	#endif
2962	default:
2963	/* In X2APIC specification this range is reserved for APIC control. */
2964	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
2965	&& pRegFrame->ecx < MSR_IA32_APIC_END)
2966	rc = PDMApicReadMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, &val);
2967	else
2968	/* We should actually trigger a #GP here, but don't as that will cause more trouble. */
2969	val = 0;
2970	break;
2971	}
2972	LogFlow(("EMInterpretRdmsr %s (%x) -> val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2973	if (rc == VINF_SUCCESS)
2974	{
2975	pRegFrame->rax = (uint32_t) val;
2976	pRegFrame->rdx = (uint32_t)(val >> 32);
2977	}
2978	return rc;
2979	}
2980
2981
2982	/**
2983	* RDMSR Emulation.
2984	*/
2985	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2986	{
2987	/* Note: the Intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2988	Assert(!(pDis->prefix & PREFIX_REX));
2989	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
2990	}
2991
2992
2993	/**
2994	* Interpret WRMSR
2995	*
2996	* @returns VBox status code.
2997	* @param pVM The VM handle.
2998	* @param pVCpu The VMCPU handle.
2999	* @param pRegFrame The register frame.
3000	*/
3001	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3002	{
3003	uint32_t u32Dummy, u32Features, cpl;
3004	uint64_t val;
3005	CPUMCTX *pCtx;
3006
3007	/* Note: works the same in 32 and 64 bits modes. */
3008	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
3009
3010	/* Get the current privilege level. */
3011	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3012	if (cpl != 0)
3013	return VERR_EM_INTERPRETER; /* supervisor only */
3014
3015	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
3016	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
3017	return VERR_EM_INTERPRETER; /* not supported */
3018
3019	val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
3020	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
3021	switch (pRegFrame->ecx)
3022	{
3023	case MSR_IA32_TSC:
3024	TMCpuTickSet(pVM, pVCpu, val);
3025	break;
3026
3027	case MSR_IA32_APICBASE:
3028	{
3029	int rc = PDMApicSetBase(pVM, val);
3030	AssertRC(rc);
3031	break;
3032	}
3033
3034	case MSR_IA32_CR_PAT:
3035	pCtx->msrPAT = val;
3036	break;
3037
3038	case MSR_IA32_SYSENTER_CS:
3039	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
3040	break;
3041
3042	case MSR_IA32_SYSENTER_EIP:
3043	pCtx->SysEnter.eip = val;
3044	break;
3045
3046	case MSR_IA32_SYSENTER_ESP:
3047	pCtx->SysEnter.esp = val;
3048	break;
3049
3050	case MSR_K6_EFER:
3051	{
3052	uint64_t uMask = 0;
3053	uint64_t oldval = pCtx->msrEFER;
3054
3055	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
3056	CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
3057	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
3058	uMask \|= MSR_K6_EFER_NXE;
3059	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
3060	uMask \|= MSR_K6_EFER_LME;
3061	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
3062	uMask \|= MSR_K6_EFER_SCE;
3063	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
3064	uMask \|= MSR_K6_EFER_FFXSR;
3065
3066	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
3067	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
3068	&& (pCtx->cr0 & X86_CR0_PG))
3069	{
3070	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
3071	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
3072	}
3073
3074	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
3075	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
3076	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
3077
3078	/* AMD64 Architecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
3079	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
3080	HWACCMFlushTLB(pVCpu);
3081
3082	break;
3083	}
3084
3085	case MSR_K8_SF_MASK:
3086	pCtx->msrSFMASK = val;
3087	break;
3088
3089	case MSR_K6_STAR:
3090	pCtx->msrSTAR = val;
3091	break;
3092
3093	case MSR_K8_LSTAR:
3094	pCtx->msrLSTAR = val;
3095	break;
3096
3097	case MSR_K8_CSTAR:
3098	pCtx->msrCSTAR = val;
3099	break;
3100
3101	case MSR_K8_FS_BASE:
3102	pCtx->fsHid.u64Base = val;
3103	break;
3104
3105	case MSR_K8_GS_BASE:
3106	pCtx->gsHid.u64Base = val;
3107	break;
3108
3109	case MSR_K8_KERNEL_GS_BASE:
3110	pCtx->msrKERNELGSBASE = val;
3111	break;
3112
3113	case MSR_K8_TSC_AUX:
3114	CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, val);
3115	break;
3116
3117	default:
3118	/* In X2APIC specification this range is reserved for APIC control. */
3119	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
3120	&& pRegFrame->ecx < MSR_IA32_APIC_END)
3121	return PDMApicWriteMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, val);
3122
3123	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
3124	break;
3125	}
3126	return VINF_SUCCESS;
3127	}
3128
3129
3130	/**
3131	* WRMSR Emulation.
3132	*/
3133	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3134	{
3135	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3136	}
3137
3138
3139	/**
3140	* Internal worker.
3141	* @copydoc EMInterpretInstructionCPU
3142	*/
3143	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3144	{
3145	Assert(pcbSize);
3146	*pcbSize = 0;
3147
3148	/*
3149	* Only supervisor guest code!!
3150	* And no complicated prefixes.
3151	*/
3152	/* Get the current privilege level. */
3153	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3154	if ( cpl != 0
3155	&& pDis->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3156	{
3157	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3158	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3159	return VERR_EM_INTERPRETER;
3160	}
3161
3162	#ifdef IN_RC
3163	if ( (pDis->prefix & (PREFIX_REPNE \| PREFIX_REP))
3164	\|\| ( (pDis->prefix & PREFIX_LOCK)
3165	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3166	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3167	&& pDis->pCurInstr->opcode != OP_XADD
3168	&& pDis->pCurInstr->opcode != OP_OR
3169	&& pDis->pCurInstr->opcode != OP_AND
3170	&& pDis->pCurInstr->opcode != OP_XOR
3171	&& pDis->pCurInstr->opcode != OP_BTR
3172	)
3173	)
3174	#else
3175	if ( (pDis->prefix & PREFIX_REPNE)
3176	\|\| ( (pDis->prefix & PREFIX_REP)
3177	&& pDis->pCurInstr->opcode != OP_STOSWD
3178	)
3179	\|\| ( (pDis->prefix & PREFIX_LOCK)
3180	&& pDis->pCurInstr->opcode != OP_OR
3181	&& pDis->pCurInstr->opcode != OP_AND
3182	&& pDis->pCurInstr->opcode != OP_XOR
3183	&& pDis->pCurInstr->opcode != OP_BTR
3184	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3185	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3186	)
3187	)
3188	#endif
3189	{
3190	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3191	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3192	return VERR_EM_INTERPRETER;
3193	}
3194
3195	#if HC_ARCH_BITS == 32
3196	/*
3197	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3198	* Whitelisted instructions are safe.
3199	*/
3200	if ( pDis->param1.size > 4
3201	&& CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3202	{
3203	uint32_t uOpCode = pDis->pCurInstr->opcode;
3204	if ( uOpCode != OP_STOSWD
3205	&& uOpCode != OP_MOV
3206	&& uOpCode != OP_CMPXCHG8B
3207	&& uOpCode != OP_XCHG
3208	&& uOpCode != OP_BTS
3209	&& uOpCode != OP_BTR
3210	&& uOpCode != OP_BTC
3211	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3212	&& uOpCode != OP_CMPXCHG /* solaris */
3213	&& uOpCode != OP_AND /* windows */
3214	&& uOpCode != OP_OR /* windows */
3215	&& uOpCode != OP_XOR /* because we can */
3216	&& uOpCode != OP_ADD /* windows (dripple) */
3217	&& uOpCode != OP_ADC /* because we can */
3218	&& uOpCode != OP_SUB /* because we can */
3219	/** @todo OP_BTS or is that a different kind of failure? */
3220	# endif
3221	)
3222	{
3223	# ifdef VBOX_WITH_STATISTICS
3224	switch (pDis->pCurInstr->opcode)
3225	{
3226	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3227	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3228	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3229	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3230	INTERPRET_FAILED_CASE(OP_INC,Inc);
3231	INTERPRET_FAILED_CASE(OP_POP,Pop);
3232	INTERPRET_FAILED_CASE(OP_OR, Or);
3233	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3234	INTERPRET_FAILED_CASE(OP_AND,And);
3235	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3236	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3237	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3238	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3239	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3240	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3241	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3242	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3243	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3244	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3245	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3246	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3247	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3248	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3249	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3250	INTERPRET_FAILED_CASE(OP_ADD,Add);
3251	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3252	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3253	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3254	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3255	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3256	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3257	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3258	INTERPRET_FAILED_CASE(OP_STI, Sti);
3259	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3260	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3261	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3262	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3263	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3264	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3265	# undef INTERPRET_FAILED_CASE
3266	default:
3267	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3268	break;
3269	}
3270	# endif /* VBOX_WITH_STATISTICS */
3271	return VERR_EM_INTERPRETER;
3272	}
3273	}
3274	#endif
3275
3276	int rc;
3277	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3278	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3279	#endif
3280	switch (pDis->pCurInstr->opcode)
3281	{
3282	/*
3283	* Macros for generating the right case statements.
3284	*/
3285	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3286	case opcode:\
3287	if (pDis->prefix & PREFIX_LOCK) \
3288	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3289	else \
3290	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3291	if (RT_SUCCESS(rc)) \
3292	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3293	else \
3294	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3295	return rc
3296	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3297	case opcode:\
3298	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3299	if (RT_SUCCESS(rc)) \
3300	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3301	else \
3302	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3303	return rc
3304
3305	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3306	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3307	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3308	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3309
3310	#define INTERPRET_CASE(opcode, Instr) \
3311	case opcode:\
3312	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3313	if (RT_SUCCESS(rc)) \
3314	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3315	else \
3316	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3317	return rc
3318
3319	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3320	case opcode:\
3321	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3322	if (RT_SUCCESS(rc)) \
3323	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3324	else \
3325	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3326	return rc
3327
3328	#define INTERPRET_STAT_CASE(opcode, Instr) \
3329	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3330
3331	/*
3332	* The actual case statements.
3333	*/
3334	INTERPRET_CASE(OP_XCHG,Xchg);
3335	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3336	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3337	INTERPRET_CASE(OP_POP,Pop);
3338	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3339	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3340	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3341	INTERPRET_CASE(OP_MOV,Mov);
3342	#ifndef IN_RC
3343	INTERPRET_CASE(OP_STOSWD,StosWD);
3344	#endif
3345	INTERPRET_CASE(OP_INVLPG,InvlPg);
3346	INTERPRET_CASE(OP_CPUID,CpuId);
3347	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3348	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3349	#ifdef IN_RING0
3350	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3351	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3352	#endif
3353	INTERPRET_CASE(OP_LLDT,LLdt);
3354	INTERPRET_CASE(OP_LMSW,Lmsw);
3355	#ifdef EM_EMULATE_SMSW
3356	INTERPRET_CASE(OP_SMSW,Smsw);
3357	#endif
3358	INTERPRET_CASE(OP_CLTS,Clts);
3359	INTERPRET_CASE(OP_MONITOR, Monitor);
3360	INTERPRET_CASE(OP_MWAIT, MWait);
3361	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3362	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3363	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3364	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3365	INTERPRET_CASE(OP_ADC,Adc);
3366	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3367	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3368	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3369	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3370	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3371	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3372	#ifdef IN_RC
3373	INTERPRET_CASE(OP_STI,Sti);
3374	INTERPRET_CASE(OP_XADD, XAdd);
3375	#endif
3376	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3377	INTERPRET_CASE(OP_HLT,Hlt);
3378	INTERPRET_CASE(OP_IRET,Iret);
3379	INTERPRET_CASE(OP_WBINVD,WbInvd);
3380	#ifdef VBOX_WITH_STATISTICS
3381	# ifndef IN_RC
3382	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3383	# endif
3384	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3385	#endif
3386
3387	default:
3388	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->opcode));
3389	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3390	return VERR_EM_INTERPRETER;
3391
3392	#undef INTERPRET_CASE_EX_PARAM2
3393	#undef INTERPRET_STAT_CASE
3394	#undef INTERPRET_CASE_EX
3395	#undef INTERPRET_CASE
3396	} /* switch (opcode) */
3397	AssertFailed();
3398	return VERR_INTERNAL_ERROR;
3399	}
3400
3401
3402	/**
3403	* Sets the PC for which interrupts should be inhibited.
3404	*
3405	* @param pVCpu The VMCPU handle.
3406	* @param PC The PC.
3407	*/
3408	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
3409	{
3410	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
3411	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3412	}
3413
3414
3415	/**
3416	* Gets the PC for which interrupts should be inhibited.
3417	*
3418	* There are a few instructions which inhibits or delays interrupts
3419	* for the instruction following them. These instructions are:
3420	* - STI
3421	* - MOV SS, r/m16
3422	* - POP SS
3423	*
3424	* @returns The PC for which interrupts should be inhibited.
3425	* @param pVCpu The VMCPU handle.
3426	*
3427	*/
3428	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
3429	{
3430	return pVCpu->em.s.GCPtrInhibitInterrupts;
3431	}
3432
3433	/**
3434	* Locks REM execution to a single VCpu
3435	*
3436	* @param pVM VM handle.
3437	*/
3438	VMMDECL(void) EMRemLock(PVM pVM)
3439	{
3440	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3441	return; /* early init */
3442
3443	Assert(!PGMIsLockOwner(pVM) && !IOMIsLockOwner(pVM));
3444	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
3445	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
3446	}
3447
3448	/**
3449	* Unlocks REM execution
3450	*
3451	* @param pVM VM handle.
3452	*/
3453	VMMDECL(void) EMRemUnlock(PVM pVM)
3454	{
3455	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3456	return; /* early init */
3457
3458	PDMCritSectLeave(&pVM->em.s.CritSectREM);
3459	}
3460
3461	/**
3462	* Check if this VCPU currently owns the REM lock.
3463	*
3464	* @returns bool owner/not owner
3465	* @param pVM The VM to operate on.
3466	*/
3467	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
3468	{
3469	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
3470	}
3471
3472	/**
3473	* Try to acquire the REM lock.
3474	*
3475	* @returns VBox status code
3476	* @param pVM The VM to operate on.
3477	*/
3478	VMMDECL(int) EMTryEnterRemLock(PVM pVM)
3479	{
3480	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
3481	}
3482

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 24764

Download in other formats: