VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 29888

Last change on this file since 29888 was 29287, checked in by vboxsync, 15 years ago

Corrected assertion
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 118.4 KB
Line 
1/* $Id: EMAll.cpp 29287 2010-05-10 07:53:47Z vboxsync $ */
2/** @file
3 * EM - Execution Monitor(/Manager) - All contexts
4 */
5
6/*
7 * Copyright (C) 2006-2007 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/*******************************************************************************
19* Header Files *
20*******************************************************************************/
21#define LOG_GROUP LOG_GROUP_EM
22#include <VBox/em.h>
23#include <VBox/mm.h>
24#include <VBox/selm.h>
25#include <VBox/patm.h>
26#include <VBox/csam.h>
27#include <VBox/pgm.h>
28#include <VBox/iom.h>
29#include <VBox/stam.h>
30#include "EMInternal.h"
31#include <VBox/vm.h>
32#include <VBox/vmm.h>
33#include <VBox/hwaccm.h>
34#include <VBox/tm.h>
35#include <VBox/pdmapi.h>
36
37#include <VBox/param.h>
38#include <VBox/err.h>
39#include <VBox/dis.h>
40#include <VBox/disopcode.h>
41#include <VBox/log.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/string.h>
45
46
47/*******************************************************************************
48* Defined Constants And Macros *
49*******************************************************************************/
50/** @def EM_ASSERT_FAULT_RETURN
51 * Safety check.
52 *
53 * Could in theory misfire on a cross page boundary access...
54 *
55 * Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
56 * turns up an alias page instead of the original faulting one and annoying the
57 * heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
58 */
59#if 0
60# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
61#else
62# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
63#endif
64
65/* Used to pass information during instruction disassembly. */
66typedef struct
67{
68 PVM pVM;
69 PVMCPU pVCpu;
70 RTGCPTR GCPtr;
71 uint8_t aOpcode[8];
72} EMDISSTATE, *PEMDISSTATE;
73
74/*******************************************************************************
75* Internal Functions *
76*******************************************************************************/
77DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize, EMCODETYPE enmCodeType = EMCODETYPE_SUPERVISOR);
78
79
80
81/**
82 * Get the current execution manager status.
83 *
84 * @returns Current status.
85 * @param pVCpu The VMCPU to operate on.
86 */
87VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
88{
89 return pVCpu->em.s.enmState;
90}
91
92/**
93 * Sets the current execution manager status. (use only when you know what you're doing!)
94 *
95 * @param pVCpu The VMCPU to operate on.
96 */
97VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
98{
99 /* Only allowed combination: */
100 Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
101 pVCpu->em.s.enmState = enmNewState;
102}
103
104
105/**
106 * Read callback for disassembly function; supports reading bytes that cross a page boundary
107 *
108 * @returns VBox status code.
109 * @param pSrc GC source pointer
110 * @param pDest HC destination pointer
111 * @param cb Number of bytes to read
112 * @param dwUserdata Callback specific user data (pDis)
113 *
114 */
115DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t *pDest, unsigned cb, void *pvUserdata)
116{
117 PDISCPUSTATE pDis = (PDISCPUSTATE)pvUserdata;
118 PEMDISSTATE pState = (PEMDISSTATE)pDis->apvUserData[0];
119 PVM pVM = pState->pVM;
120 PVMCPU pVCpu = pState->pVCpu;
121
122# ifdef IN_RING0
123 int rc;
124
125 if ( pState->GCPtr
126 && pSrc + cb <= pState->GCPtr + sizeof(pState->aOpcode))
127 {
128 unsigned offset = pSrc - pState->GCPtr;
129
130 Assert(pSrc >= pState->GCPtr);
131
132 for (unsigned i=0; i<cb; i++)
133 {
134 pDest[i] = pState->aOpcode[offset + i];
135 }
136 return VINF_SUCCESS;
137 }
138
139 rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
140 AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%RGv cb=%x rc=%d\n", pSrc, cb, rc));
141# elif defined(IN_RING3)
142 if (!PATMIsPatchGCAddr(pVM, pSrc))
143 {
144 int rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
145 AssertRC(rc);
146 }
147 else
148 memcpy(pDest, PATMR3GCPtrToHCPtr(pVM, pSrc), cb);
149
150# elif defined(IN_RC)
151 if (!PATMIsPatchGCAddr(pVM, pSrc))
152 {
153 int rc = MMGCRamRead(pVM, pDest, (void *)(uintptr_t)pSrc, cb);
154 if (rc == VERR_ACCESS_DENIED)
155 {
156 /* Recently flushed; access the data manually. */
157 rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
158 AssertRC(rc);
159 }
160 }
161 else /* the hypervisor region is always present. */
162 memcpy(pDest, (RTRCPTR)(uintptr_t)pSrc, cb);
163
164# endif /* IN_RING3 */
165 return VINF_SUCCESS;
166}
167
168
169#ifndef IN_RC
170DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
171{
172 EMDISSTATE State;
173
174 State.pVM = pVM;
175 State.pVCpu = pVCpu;
176 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, InstrGC, sizeof(State.aOpcode));
177 if (RT_SUCCESS(rc))
178 {
179 State.GCPtr = InstrGC;
180 }
181 else
182 {
183 if (PAGE_ADDRESS(InstrGC) == PAGE_ADDRESS(InstrGC + sizeof(State.aOpcode) - 1))
184 {
185 if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
186 HWACCMInvalidatePage(pVCpu, InstrGC);
187
188 Log(("emDisCoreOne: read failed with %d\n", rc));
189 return rc;
190 }
191 State.GCPtr = NIL_RTGCPTR;
192 }
193 return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
194}
195
196#else /* IN_RC */
197
198DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
199{
200 EMDISSTATE State;
201
202 State.pVM = pVM;
203 State.pVCpu = pVCpu;
204 State.GCPtr = InstrGC;
205
206 return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
207}
208
209#endif /* IN_RC */
210
211
212/**
213 * Disassembles one instruction.
214 *
215 * @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
216 * details.
217 * @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
218 *
219 * @param pVM The VM handle.
220 * @param pVCpu The VMCPU handle.
221 * @param pCtxCore The context core (used for both the mode and instruction).
222 * @param pDis Where to return the parsed instruction info.
223 * @param pcbInstr Where to return the instruction size. (optional)
224 */
225VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
226{
227 RTGCPTR GCPtrInstr;
228 int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
229 if (RT_FAILURE(rc))
230 {
231 Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
232 pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
233 return rc;
234 }
235 return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
236}
237
238
239/**
240 * Disassembles one instruction.
241 *
242 * This is used by internally by the interpreter and by trap/access handlers.
243 *
244 * @returns VBox status code.
245 * @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
246 *
247 * @param pVM The VM handle.
248 * @param pVCpu The VMCPU handle.
249 * @param GCPtrInstr The flat address of the instruction.
250 * @param pCtxCore The context core (used to determine the cpu mode).
251 * @param pDis Where to return the parsed instruction info.
252 * @param pcbInstr Where to return the instruction size. (optional)
253 */
254VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
255{
256 int rc;
257 EMDISSTATE State;
258
259 State.pVM = pVM;
260 State.pVCpu = pVCpu;
261
262#ifdef IN_RC
263 State.GCPtr = GCPtrInstr;
264#else /* ring 0/3 */
265 rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, GCPtrInstr, sizeof(State.aOpcode));
266 if (RT_SUCCESS(rc))
267 {
268 State.GCPtr = GCPtrInstr;
269 }
270 else
271 {
272 if (PAGE_ADDRESS(GCPtrInstr) == PAGE_ADDRESS(GCPtrInstr + sizeof(State.aOpcode) - 1))
273 {
274 if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
275 HWACCMInvalidatePage(pVCpu, GCPtrInstr);
276
277 Log(("EMInterpretDisasOneEx: read failed with %d\n", rc));
278 return rc;
279 }
280 State.GCPtr = NIL_RTGCPTR;
281 }
282#endif
283
284 rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
285 EMReadBytes, &State,
286 pDis, pcbInstr);
287 if (RT_SUCCESS(rc))
288 return VINF_SUCCESS;
289 AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
290 return VERR_INTERNAL_ERROR;
291}
292
293
294/**
295 * Interprets the current instruction.
296 *
297 * @returns VBox status code.
298 * @retval VINF_* Scheduling instructions.
299 * @retval VERR_EM_INTERPRETER Something we can't cope with.
300 * @retval VERR_* Fatal errors.
301 *
302 * @param pVM The VM handle.
303 * @param pVCpu The VMCPU handle.
304 * @param pRegFrame The register frame.
305 * Updates the EIP if an instruction was executed successfully.
306 * @param pvFault The fault address (CR2).
307 * @param pcbSize Size of the write (if applicable).
308 *
309 * @remark Invalid opcode exceptions have a higher priority than GP (see Intel
310 * Architecture System Developers Manual, Vol 3, 5.5) so we don't need
311 * to worry about e.g. invalid modrm combinations (!)
312 */
313VMMDECL(int) EMInterpretInstruction(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
314{
315 RTGCPTR pbCode;
316
317 LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
318 int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
319 if (RT_SUCCESS(rc))
320 {
321 uint32_t cbOp;
322 PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
323 pDis->mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
324 rc = emDisCoreOne(pVM, pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
325 if (RT_SUCCESS(rc))
326 {
327 Assert(cbOp == pDis->opsize);
328 rc = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
329 if (RT_SUCCESS(rc))
330 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
331
332 return rc;
333 }
334 }
335 return VERR_EM_INTERPRETER;
336}
337
338
339/**
340 * Interprets the current instruction using the supplied DISCPUSTATE structure.
341 *
342 * EIP is *NOT* updated!
343 *
344 * @returns VBox status code.
345 * @retval VINF_* Scheduling instructions. When these are returned, it
346 * starts to get a bit tricky to know whether code was
347 * executed or not... We'll address this when it becomes a problem.
348 * @retval VERR_EM_INTERPRETER Something we can't cope with.
349 * @retval VERR_* Fatal errors.
350 *
351 * @param pVM The VM handle.
352 * @param pVCpu The VMCPU handle.
353 * @param pDis The disassembler cpu state for the instruction to be
354 * interpreted.
355 * @param pRegFrame The register frame. EIP is *NOT* changed!
356 * @param pvFault The fault address (CR2).
357 * @param pcbSize Size of the write (if applicable).
358 * @param enmCodeType Code type (user/supervisor)
359 *
360 * @remark Invalid opcode exceptions have a higher priority than GP (see Intel
361 * Architecture System Developers Manual, Vol 3, 5.5) so we don't need
362 * to worry about e.g. invalid modrm combinations (!)
363 *
364 * @todo At this time we do NOT check if the instruction overwrites vital information.
365 * Make sure this can't happen!! (will add some assertions/checks later)
366 */
367VMMDECL(int) EMInterpretInstructionCPUEx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize, EMCODETYPE enmCodeType)
368{
369 STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
370 int rc = emInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, enmCodeType);
371 STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
372 if (RT_SUCCESS(rc))
373 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
374 else
375 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
376 return rc;
377}
378
379
380/**
381 * Interpret a port I/O instruction.
382 *
383 * @returns VBox status code suitable for scheduling.
384 * @param pVM The VM handle.
385 * @param pVCpu The VMCPU handle.
386 * @param pCtxCore The context core. This will be updated on successful return.
387 * @param pDis The instruction to interpret.
388 * @param cbOp The size of the instruction.
389 * @remark This may raise exceptions.
390 */
391VMMDECL(VBOXSTRICTRC) EMInterpretPortIO(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, uint32_t cbOp)
392{
393 /*
394 * Hand it on to IOM.
395 */
396#ifdef IN_RC
397 VBOXSTRICTRC rcStrict = IOMGCIOPortHandler(pVM, pCtxCore, pDis);
398 if (IOM_SUCCESS(rcStrict))
399 pCtxCore->rip += cbOp;
400 return rcStrict;
401#else
402 AssertReleaseMsgFailed(("not implemented\n"));
403 return VERR_NOT_IMPLEMENTED;
404#endif
405}
406
407
408DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
409{
410#ifdef IN_RC
411 int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
412 if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
413 return rc;
414 /*
415 * The page pool cache may end up here in some cases because it
416 * flushed one of the shadow mappings used by the trapping
417 * instruction and it either flushed the TLB or the CPU reused it.
418 */
419#endif
420 return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /*fMayTrap*/ false);
421}
422
423
424DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
425{
426#ifdef IN_RC
427 int rc = MMGCRamWrite(pVM, (void *)(uintptr_t)GCPtrDst, (void *)pvSrc, cb);
428 if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
429 return rc;
430 /*
431 * The page pool cache may end up here in some cases because it
432 * flushed one of the shadow mappings used by the trapping
433 * instruction and it either flushed the TLB or the CPU reused it.
434 * We want to play safe here, verifying that we've got write
435 * access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
436 */
437#endif
438 return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /*fMayTrap*/ false);
439}
440
441
442/** Convert sel:addr to a flat GC address. */
443DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, POP_PARAMETER pParam, RTGCPTR pvAddr)
444{
445 DIS_SELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
446 return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
447}
448
449
450#if defined(VBOX_STRICT) || defined(LOG_ENABLED)
451/**
452 * Get the mnemonic for the disassembled instruction.
453 *
454 * GC/R0 doesn't include the strings in the DIS tables because
455 * of limited space.
456 */
457static const char *emGetMnemonic(PDISCPUSTATE pDis)
458{
459 switch (pDis->pCurInstr->opcode)
460 {
461 case OP_XCHG: return "Xchg";
462 case OP_DEC: return "Dec";
463 case OP_INC: return "Inc";
464 case OP_POP: return "Pop";
465 case OP_OR: return "Or";
466 case OP_AND: return "And";
467 case OP_MOV: return "Mov";
468 case OP_INVLPG: return "InvlPg";
469 case OP_CPUID: return "CpuId";
470 case OP_MOV_CR: return "MovCRx";
471 case OP_MOV_DR: return "MovDRx";
472 case OP_LLDT: return "LLdt";
473 case OP_LGDT: return "LGdt";
474 case OP_LIDT: return "LIdt";
475 case OP_CLTS: return "Clts";
476 case OP_MONITOR: return "Monitor";
477 case OP_MWAIT: return "MWait";
478 case OP_RDMSR: return "Rdmsr";
479 case OP_WRMSR: return "Wrmsr";
480 case OP_ADD: return "Add";
481 case OP_ADC: return "Adc";
482 case OP_SUB: return "Sub";
483 case OP_SBB: return "Sbb";
484 case OP_RDTSC: return "Rdtsc";
485 case OP_STI: return "Sti";
486 case OP_CLI: return "Cli";
487 case OP_XADD: return "XAdd";
488 case OP_HLT: return "Hlt";
489 case OP_IRET: return "Iret";
490 case OP_MOVNTPS: return "MovNTPS";
491 case OP_STOSWD: return "StosWD";
492 case OP_WBINVD: return "WbInvd";
493 case OP_XOR: return "Xor";
494 case OP_BTR: return "Btr";
495 case OP_BTS: return "Bts";
496 case OP_BTC: return "Btc";
497 case OP_LMSW: return "Lmsw";
498 case OP_SMSW: return "Smsw";
499 case OP_CMPXCHG: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
500 case OP_CMPXCHG8B: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
501
502 default:
503 Log(("Unknown opcode %d\n", pDis->pCurInstr->opcode));
504 return "???";
505 }
506}
507#endif /* VBOX_STRICT || LOG_ENABLED */
508
509
510/**
511 * XCHG instruction emulation.
512 */
513static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
514{
515 OP_PARAMVAL param1, param2;
516
517 /* Source to make DISQueryParamVal read the register value - ugly hack */
518 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
519 if(RT_FAILURE(rc))
520 return VERR_EM_INTERPRETER;
521
522 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
523 if(RT_FAILURE(rc))
524 return VERR_EM_INTERPRETER;
525
526#ifdef IN_RC
527 if (TRPMHasTrap(pVCpu))
528 {
529 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
530 {
531#endif
532 RTGCPTR pParam1 = 0, pParam2 = 0;
533 uint64_t valpar1, valpar2;
534
535 AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
536 switch(param1.type)
537 {
538 case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
539 valpar1 = param1.val.val64;
540 break;
541
542 case PARMTYPE_ADDRESS:
543 pParam1 = (RTGCPTR)param1.val.val64;
544 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
545 EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
546 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
547 if (RT_FAILURE(rc))
548 {
549 AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
550 return VERR_EM_INTERPRETER;
551 }
552 break;
553
554 default:
555 AssertFailed();
556 return VERR_EM_INTERPRETER;
557 }
558
559 switch(param2.type)
560 {
561 case PARMTYPE_ADDRESS:
562 pParam2 = (RTGCPTR)param2.val.val64;
563 pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pParam2);
564 EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
565 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
566 if (RT_FAILURE(rc))
567 {
568 AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
569 }
570 break;
571
572 case PARMTYPE_IMMEDIATE:
573 valpar2 = param2.val.val64;
574 break;
575
576 default:
577 AssertFailed();
578 return VERR_EM_INTERPRETER;
579 }
580
581 /* Write value of parameter 2 to parameter 1 (reg or memory address) */
582 if (pParam1 == 0)
583 {
584 Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
585 switch(param1.size)
586 {
587 case 1: //special case for AH etc
588 rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t )valpar2); break;
589 case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)valpar2); break;
590 case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)valpar2); break;
591 case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, valpar2); break;
592 default: AssertFailedReturn(VERR_EM_INTERPRETER);
593 }
594 if (RT_FAILURE(rc))
595 return VERR_EM_INTERPRETER;
596 }
597 else
598 {
599 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
600 if (RT_FAILURE(rc))
601 {
602 AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
603 return VERR_EM_INTERPRETER;
604 }
605 }
606
607 /* Write value of parameter 1 to parameter 2 (reg or memory address) */
608 if (pParam2 == 0)
609 {
610 Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
611 switch(param2.size)
612 {
613 case 1: //special case for AH etc
614 rc = DISWriteReg8(pRegFrame, pDis->param2.base.reg_gen, (uint8_t )valpar1); break;
615 case 2: rc = DISWriteReg16(pRegFrame, pDis->param2.base.reg_gen, (uint16_t)valpar1); break;
616 case 4: rc = DISWriteReg32(pRegFrame, pDis->param2.base.reg_gen, (uint32_t)valpar1); break;
617 case 8: rc = DISWriteReg64(pRegFrame, pDis->param2.base.reg_gen, valpar1); break;
618 default: AssertFailedReturn(VERR_EM_INTERPRETER);
619 }
620 if (RT_FAILURE(rc))
621 return VERR_EM_INTERPRETER;
622 }
623 else
624 {
625 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
626 if (RT_FAILURE(rc))
627 {
628 AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
629 return VERR_EM_INTERPRETER;
630 }
631 }
632
633 *pcbSize = param2.size;
634 return VINF_SUCCESS;
635#ifdef IN_RC
636 }
637 }
638#endif
639 return VERR_EM_INTERPRETER;
640}
641
642
643/**
644 * INC and DEC emulation.
645 */
646static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
647 PFNEMULATEPARAM2 pfnEmulate)
648{
649 OP_PARAMVAL param1;
650
651 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
652 if(RT_FAILURE(rc))
653 return VERR_EM_INTERPRETER;
654
655#ifdef IN_RC
656 if (TRPMHasTrap(pVCpu))
657 {
658 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
659 {
660#endif
661 RTGCPTR pParam1 = 0;
662 uint64_t valpar1;
663
664 if (param1.type == PARMTYPE_ADDRESS)
665 {
666 pParam1 = (RTGCPTR)param1.val.val64;
667 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
668#ifdef IN_RC
669 /* Safety check (in theory it could cross a page boundary and fault there though) */
670 AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
671#endif
672 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
673 if (RT_FAILURE(rc))
674 {
675 AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
676 return VERR_EM_INTERPRETER;
677 }
678 }
679 else
680 {
681 AssertFailed();
682 return VERR_EM_INTERPRETER;
683 }
684
685 uint32_t eflags;
686
687 eflags = pfnEmulate(&valpar1, param1.size);
688
689 /* Write result back */
690 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
691 if (RT_FAILURE(rc))
692 {
693 AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
694 return VERR_EM_INTERPRETER;
695 }
696
697 /* Update guest's eflags and finish. */
698 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
699 | (eflags & (X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
700
701 /* All done! */
702 *pcbSize = param1.size;
703 return VINF_SUCCESS;
704#ifdef IN_RC
705 }
706 }
707#endif
708 return VERR_EM_INTERPRETER;
709}
710
711
712/**
713 * POP Emulation.
714 */
715static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
716{
717 Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
718 OP_PARAMVAL param1;
719 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
720 if(RT_FAILURE(rc))
721 return VERR_EM_INTERPRETER;
722
723#ifdef IN_RC
724 if (TRPMHasTrap(pVCpu))
725 {
726 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
727 {
728#endif
729 RTGCPTR pParam1 = 0;
730 uint32_t valpar1;
731 RTGCPTR pStackVal;
732
733 /* Read stack value first */
734 if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
735 return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
736
737 /* Convert address; don't bother checking limits etc, as we only read here */
738 pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
739 if (pStackVal == 0)
740 return VERR_EM_INTERPRETER;
741
742 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
743 if (RT_FAILURE(rc))
744 {
745 AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
746 return VERR_EM_INTERPRETER;
747 }
748
749 if (param1.type == PARMTYPE_ADDRESS)
750 {
751 pParam1 = (RTGCPTR)param1.val.val64;
752
753 /* pop [esp+xx] uses esp after the actual pop! */
754 AssertCompile(USE_REG_ESP == USE_REG_SP);
755 if ( (pDis->param1.flags & USE_BASE)
756 && (pDis->param1.flags & (USE_REG_GEN16|USE_REG_GEN32))
757 && pDis->param1.base.reg_gen == USE_REG_ESP
758 )
759 pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
760
761 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
762 EM_ASSERT_FAULT_RETURN(pParam1 == pvFault || (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
763 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
764 if (RT_FAILURE(rc))
765 {
766 AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
767 return VERR_EM_INTERPRETER;
768 }
769
770 /* Update ESP as the last step */
771 pRegFrame->esp += param1.size;
772 }
773 else
774 {
775#ifndef DEBUG_bird // annoying assertion.
776 AssertFailed();
777#endif
778 return VERR_EM_INTERPRETER;
779 }
780
781 /* All done! */
782 *pcbSize = param1.size;
783 return VINF_SUCCESS;
784#ifdef IN_RC
785 }
786 }
787#endif
788 return VERR_EM_INTERPRETER;
789}
790
791
792/**
793 * XOR/OR/AND Emulation.
794 */
795static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
796 PFNEMULATEPARAM3 pfnEmulate)
797{
798 OP_PARAMVAL param1, param2;
799
800 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
801 if(RT_FAILURE(rc))
802 return VERR_EM_INTERPRETER;
803
804 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
805 if(RT_FAILURE(rc))
806 return VERR_EM_INTERPRETER;
807
808#ifdef IN_RC
809 if (TRPMHasTrap(pVCpu))
810 {
811 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
812 {
813#endif
814 RTGCPTR pParam1;
815 uint64_t valpar1, valpar2;
816
817 if (pDis->param1.size != pDis->param2.size)
818 {
819 if (pDis->param1.size < pDis->param2.size)
820 {
821 AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
822 return VERR_EM_INTERPRETER;
823 }
824 /* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
825 pDis->param2.size = pDis->param1.size;
826 param2.size = param1.size;
827 }
828
829 /* The destination is always a virtual address */
830 if (param1.type == PARMTYPE_ADDRESS)
831 {
832 pParam1 = (RTGCPTR)param1.val.val64;
833 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
834 EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
835 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
836 if (RT_FAILURE(rc))
837 {
838 AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
839 return VERR_EM_INTERPRETER;
840 }
841 }
842 else
843 {
844 AssertFailed();
845 return VERR_EM_INTERPRETER;
846 }
847
848 /* Register or immediate data */
849 switch(param2.type)
850 {
851 case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
852 valpar2 = param2.val.val64;
853 break;
854
855 default:
856 AssertFailed();
857 return VERR_EM_INTERPRETER;
858 }
859
860 LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
861
862 /* Data read, emulate instruction. */
863 uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
864
865 LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
866
867 /* Update guest's eflags and finish. */
868 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
869 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
870
871 /* And write it back */
872 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
873 if (RT_SUCCESS(rc))
874 {
875 /* All done! */
876 *pcbSize = param2.size;
877 return VINF_SUCCESS;
878 }
879#ifdef IN_RC
880 }
881 }
882#endif
883 return VERR_EM_INTERPRETER;
884}
885
886
887/**
888 * LOCK XOR/OR/AND Emulation.
889 */
890static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
891 uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
892{
893 void *pvParam1;
894 OP_PARAMVAL param1, param2;
895
896#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
897 Assert(pDis->param1.size <= 4);
898#endif
899
900 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
901 if(RT_FAILURE(rc))
902 return VERR_EM_INTERPRETER;
903
904 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
905 if(RT_FAILURE(rc))
906 return VERR_EM_INTERPRETER;
907
908 if (pDis->param1.size != pDis->param2.size)
909 {
910 AssertMsgReturn(pDis->param1.size >= pDis->param2.size, /* should never happen! */
911 ("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size),
912 VERR_EM_INTERPRETER);
913
914 /* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
915 pDis->param2.size = pDis->param1.size;
916 param2.size = param1.size;
917 }
918
919#ifdef IN_RC
920 /* Safety check (in theory it could cross a page boundary and fault there though) */
921 Assert( TRPMHasTrap(pVCpu)
922 && (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
923 EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
924#endif
925
926 /* Register and immediate data == PARMTYPE_IMMEDIATE */
927 AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
928 RTGCUINTREG ValPar2 = param2.val.val64;
929
930 /* The destination is always a virtual address */
931 AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
932
933 RTGCPTR GCPtrPar1 = param1.val.val64;
934 GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
935#ifdef IN_RC
936 pvParam1 = (void *)(uintptr_t)GCPtrPar1;
937#else
938 PGMPAGEMAPLOCK Lock;
939 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
940 AssertRCReturn(rc, VERR_EM_INTERPRETER);
941#endif
942
943 /* Try emulate it with a one-shot #PF handler in place. (RC) */
944 Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
945
946 RTGCUINTREG32 eflags = 0;
947#ifdef IN_RC
948 MMGCRamRegisterTrapHandler(pVM);
949#endif
950 rc = pfnEmulate(pvParam1, ValPar2, pDis->param2.size, &eflags);
951#ifdef IN_RC
952 MMGCRamDeregisterTrapHandler(pVM);
953#else
954 PGMPhysReleasePageMappingLock(pVM, &Lock);
955#endif
956 if (RT_FAILURE(rc))
957 {
958 Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
959 return VERR_EM_INTERPRETER;
960 }
961
962 /* Update guest's eflags and finish. */
963 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
964 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
965
966 *pcbSize = param2.size;
967 return VINF_SUCCESS;
968}
969
970
971/**
972 * ADD, ADC & SUB Emulation.
973 */
974static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
975 PFNEMULATEPARAM3 pfnEmulate)
976{
977 OP_PARAMVAL param1, param2;
978 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
979 if(RT_FAILURE(rc))
980 return VERR_EM_INTERPRETER;
981
982 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
983 if(RT_FAILURE(rc))
984 return VERR_EM_INTERPRETER;
985
986#ifdef IN_RC
987 if (TRPMHasTrap(pVCpu))
988 {
989 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
990 {
991#endif
992 RTGCPTR pParam1;
993 uint64_t valpar1, valpar2;
994
995 if (pDis->param1.size != pDis->param2.size)
996 {
997 if (pDis->param1.size < pDis->param2.size)
998 {
999 AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
1000 return VERR_EM_INTERPRETER;
1001 }
1002 /* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1003 pDis->param2.size = pDis->param1.size;
1004 param2.size = param1.size;
1005 }
1006
1007 /* The destination is always a virtual address */
1008 if (param1.type == PARMTYPE_ADDRESS)
1009 {
1010 pParam1 = (RTGCPTR)param1.val.val64;
1011 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1012 EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1013 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1014 if (RT_FAILURE(rc))
1015 {
1016 AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1017 return VERR_EM_INTERPRETER;
1018 }
1019 }
1020 else
1021 {
1022#ifndef DEBUG_bird
1023 AssertFailed();
1024#endif
1025 return VERR_EM_INTERPRETER;
1026 }
1027
1028 /* Register or immediate data */
1029 switch(param2.type)
1030 {
1031 case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1032 valpar2 = param2.val.val64;
1033 break;
1034
1035 default:
1036 AssertFailed();
1037 return VERR_EM_INTERPRETER;
1038 }
1039
1040 /* Data read, emulate instruction. */
1041 uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1042
1043 /* Update guest's eflags and finish. */
1044 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1045 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1046
1047 /* And write it back */
1048 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1049 if (RT_SUCCESS(rc))
1050 {
1051 /* All done! */
1052 *pcbSize = param2.size;
1053 return VINF_SUCCESS;
1054 }
1055#ifdef IN_RC
1056 }
1057 }
1058#endif
1059 return VERR_EM_INTERPRETER;
1060}
1061
1062
1063/**
1064 * ADC Emulation.
1065 */
1066static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1067{
1068 if (pRegFrame->eflags.Bits.u1CF)
1069 return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1070 else
1071 return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1072}
1073
1074
1075/**
1076 * BTR/C/S Emulation.
1077 */
1078static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1079 PFNEMULATEPARAM2UINT32 pfnEmulate)
1080{
1081 OP_PARAMVAL param1, param2;
1082 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1083 if(RT_FAILURE(rc))
1084 return VERR_EM_INTERPRETER;
1085
1086 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1087 if(RT_FAILURE(rc))
1088 return VERR_EM_INTERPRETER;
1089
1090#ifdef IN_RC
1091 if (TRPMHasTrap(pVCpu))
1092 {
1093 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1094 {
1095#endif
1096 RTGCPTR pParam1;
1097 uint64_t valpar1 = 0, valpar2;
1098 uint32_t eflags;
1099
1100 /* The destination is always a virtual address */
1101 if (param1.type != PARMTYPE_ADDRESS)
1102 return VERR_EM_INTERPRETER;
1103
1104 pParam1 = (RTGCPTR)param1.val.val64;
1105 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1106
1107 /* Register or immediate data */
1108 switch(param2.type)
1109 {
1110 case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1111 valpar2 = param2.val.val64;
1112 break;
1113
1114 default:
1115 AssertFailed();
1116 return VERR_EM_INTERPRETER;
1117 }
1118
1119 Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1120 pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1121 EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1122 rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1123 if (RT_FAILURE(rc))
1124 {
1125 AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1126 return VERR_EM_INTERPRETER;
1127 }
1128
1129 Log2(("emInterpretBtx: val=%x\n", valpar1));
1130 /* Data read, emulate bit test instruction. */
1131 eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1132
1133 Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1134
1135 /* Update guest's eflags and finish. */
1136 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1137 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1138
1139 /* And write it back */
1140 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1141 if (RT_SUCCESS(rc))
1142 {
1143 /* All done! */
1144 *pcbSize = 1;
1145 return VINF_SUCCESS;
1146 }
1147#ifdef IN_RC
1148 }
1149 }
1150#endif
1151 return VERR_EM_INTERPRETER;
1152}
1153
1154
1155/**
1156 * LOCK BTR/C/S Emulation.
1157 */
1158static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1159 uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1160{
1161 void *pvParam1;
1162
1163 OP_PARAMVAL param1, param2;
1164 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1165 if(RT_FAILURE(rc))
1166 return VERR_EM_INTERPRETER;
1167
1168 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1169 if(RT_FAILURE(rc))
1170 return VERR_EM_INTERPRETER;
1171
1172 /* The destination is always a virtual address */
1173 if (param1.type != PARMTYPE_ADDRESS)
1174 return VERR_EM_INTERPRETER;
1175
1176 /* Register and immediate data == PARMTYPE_IMMEDIATE */
1177 AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1178 uint64_t ValPar2 = param2.val.val64;
1179
1180 /* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1181 RTGCPTR GCPtrPar1 = param1.val.val64;
1182 GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1183 ValPar2 &= 7;
1184
1185 GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1186#ifdef IN_RC
1187 Assert(TRPMHasTrap(pVCpu));
1188 EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1189#endif
1190
1191#ifdef IN_RC
1192 pvParam1 = (void *)(uintptr_t)GCPtrPar1;
1193#else
1194 PGMPAGEMAPLOCK Lock;
1195 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1196 AssertRCReturn(rc, VERR_EM_INTERPRETER);
1197#endif
1198
1199 Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1200
1201 /* Try emulate it with a one-shot #PF handler in place. (RC) */
1202 RTGCUINTREG32 eflags = 0;
1203#ifdef IN_RC
1204 MMGCRamRegisterTrapHandler(pVM);
1205#endif
1206 rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1207#ifdef IN_RC
1208 MMGCRamDeregisterTrapHandler(pVM);
1209#else
1210 PGMPhysReleasePageMappingLock(pVM, &Lock);
1211#endif
1212 if (RT_FAILURE(rc))
1213 {
1214 Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1215 emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
1216 return VERR_EM_INTERPRETER;
1217 }
1218
1219 Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1220
1221 /* Update guest's eflags and finish. */
1222 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1223 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1224
1225 *pcbSize = 1;
1226 return VINF_SUCCESS;
1227}
1228
1229
1230/**
1231 * MOV emulation.
1232 */
1233static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1234{
1235 OP_PARAMVAL param1, param2;
1236 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1237 if(RT_FAILURE(rc))
1238 return VERR_EM_INTERPRETER;
1239
1240 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1241 if(RT_FAILURE(rc))
1242 return VERR_EM_INTERPRETER;
1243
1244#ifdef IN_RC
1245 if (TRPMHasTrap(pVCpu))
1246 {
1247 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1248 {
1249#else
1250 /** @todo Make this the default and don't rely on TRPM information. */
1251 if (param1.type == PARMTYPE_ADDRESS)
1252 {
1253#endif
1254 RTGCPTR pDest;
1255 uint64_t val64;
1256
1257 switch(param1.type)
1258 {
1259 case PARMTYPE_IMMEDIATE:
1260 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
1261 return VERR_EM_INTERPRETER;
1262 /* fallthru */
1263
1264 case PARMTYPE_ADDRESS:
1265 pDest = (RTGCPTR)param1.val.val64;
1266 pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pDest);
1267 break;
1268
1269 default:
1270 AssertFailed();
1271 return VERR_EM_INTERPRETER;
1272 }
1273
1274 switch(param2.type)
1275 {
1276 case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1277 val64 = param2.val.val64;
1278 break;
1279
1280 default:
1281 Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1282 return VERR_EM_INTERPRETER;
1283 }
1284#ifdef LOG_ENABLED
1285 if (pDis->mode == CPUMODE_64BIT)
1286 LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1287 else
1288 LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1289#endif
1290
1291 Assert(param2.size <= 8 && param2.size > 0);
1292 EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1293 rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1294 if (RT_FAILURE(rc))
1295 return VERR_EM_INTERPRETER;
1296
1297 *pcbSize = param2.size;
1298 }
1299 else
1300 { /* read fault */
1301 RTGCPTR pSrc;
1302 uint64_t val64;
1303
1304 /* Source */
1305 switch(param2.type)
1306 {
1307 case PARMTYPE_IMMEDIATE:
1308 if(!(param2.flags & (PARAM_VAL32|PARAM_VAL64)))
1309 return VERR_EM_INTERPRETER;
1310 /* fallthru */
1311
1312 case PARMTYPE_ADDRESS:
1313 pSrc = (RTGCPTR)param2.val.val64;
1314 pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pSrc);
1315 break;
1316
1317 default:
1318 return VERR_EM_INTERPRETER;
1319 }
1320
1321 Assert(param1.size <= 8 && param1.size > 0);
1322 EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1323 rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1324 if (RT_FAILURE(rc))
1325 return VERR_EM_INTERPRETER;
1326
1327 /* Destination */
1328 switch(param1.type)
1329 {
1330 case PARMTYPE_REGISTER:
1331 switch(param1.size)
1332 {
1333 case 1: rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t) val64); break;
1334 case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)val64); break;
1335 case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)val64); break;
1336 case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, val64); break;
1337 default:
1338 return VERR_EM_INTERPRETER;
1339 }
1340 if (RT_FAILURE(rc))
1341 return rc;
1342 break;
1343
1344 default:
1345 return VERR_EM_INTERPRETER;
1346 }
1347#ifdef LOG_ENABLED
1348 if (pDis->mode == CPUMODE_64BIT)
1349 LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1350 else
1351 LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1352#endif
1353 }
1354 return VINF_SUCCESS;
1355#ifdef IN_RC
1356 }
1357#endif
1358 return VERR_EM_INTERPRETER;
1359}
1360
1361
1362#ifndef IN_RC
1363/**
1364 * [REP] STOSWD emulation
1365 */
1366static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1367{
1368 int rc;
1369 RTGCPTR GCDest, GCOffset;
1370 uint32_t cbSize;
1371 uint64_t cTransfers;
1372 int offIncrement;
1373
1374 /* Don't support any but these three prefix bytes. */
1375 if ((pDis->prefix & ~(PREFIX_ADDRSIZE|PREFIX_OPSIZE|PREFIX_REP|PREFIX_REX)))
1376 return VERR_EM_INTERPRETER;
1377
1378 switch (pDis->addrmode)
1379 {
1380 case CPUMODE_16BIT:
1381 GCOffset = pRegFrame->di;
1382 cTransfers = pRegFrame->cx;
1383 break;
1384 case CPUMODE_32BIT:
1385 GCOffset = pRegFrame->edi;
1386 cTransfers = pRegFrame->ecx;
1387 break;
1388 case CPUMODE_64BIT:
1389 GCOffset = pRegFrame->rdi;
1390 cTransfers = pRegFrame->rcx;
1391 break;
1392 default:
1393 AssertFailed();
1394 return VERR_EM_INTERPRETER;
1395 }
1396
1397 GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1398 switch (pDis->opmode)
1399 {
1400 case CPUMODE_16BIT:
1401 cbSize = 2;
1402 break;
1403 case CPUMODE_32BIT:
1404 cbSize = 4;
1405 break;
1406 case CPUMODE_64BIT:
1407 cbSize = 8;
1408 break;
1409 default:
1410 AssertFailed();
1411 return VERR_EM_INTERPRETER;
1412 }
1413
1414 offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1415
1416 if (!(pDis->prefix & PREFIX_REP))
1417 {
1418 LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1419
1420 rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1421 if (RT_FAILURE(rc))
1422 return VERR_EM_INTERPRETER;
1423 Assert(rc == VINF_SUCCESS);
1424
1425 /* Update (e/r)di. */
1426 switch (pDis->addrmode)
1427 {
1428 case CPUMODE_16BIT:
1429 pRegFrame->di += offIncrement;
1430 break;
1431 case CPUMODE_32BIT:
1432 pRegFrame->edi += offIncrement;
1433 break;
1434 case CPUMODE_64BIT:
1435 pRegFrame->rdi += offIncrement;
1436 break;
1437 default:
1438 AssertFailed();
1439 return VERR_EM_INTERPRETER;
1440 }
1441
1442 }
1443 else
1444 {
1445 if (!cTransfers)
1446 return VINF_SUCCESS;
1447
1448 /*
1449 * Do *not* try emulate cross page stuff here because we don't know what might
1450 * be waiting for us on the subsequent pages. The caller has only asked us to
1451 * ignore access handlers fro the current page.
1452 * This also fends off big stores which would quickly kill PGMR0DynMap.
1453 */
1454 if ( cbSize > PAGE_SIZE
1455 || cTransfers > PAGE_SIZE
1456 || (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1457 {
1458 Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1459 GCDest, cbSize, offIncrement, cTransfers));
1460 return VERR_EM_INTERPRETER;
1461 }
1462
1463 LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1464 /* Access verification first; we currently can't recover properly from traps inside this instruction */
1465 rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1466 cTransfers * cbSize,
1467 X86_PTE_RW | (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1468 if (rc != VINF_SUCCESS)
1469 {
1470 Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1471 return VERR_EM_INTERPRETER;
1472 }
1473
1474 /* REP case */
1475 while (cTransfers)
1476 {
1477 rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1478 if (RT_FAILURE(rc))
1479 {
1480 rc = VERR_EM_INTERPRETER;
1481 break;
1482 }
1483
1484 Assert(rc == VINF_SUCCESS);
1485 GCOffset += offIncrement;
1486 GCDest += offIncrement;
1487 cTransfers--;
1488 }
1489
1490 /* Update the registers. */
1491 switch (pDis->addrmode)
1492 {
1493 case CPUMODE_16BIT:
1494 pRegFrame->di = GCOffset;
1495 pRegFrame->cx = cTransfers;
1496 break;
1497 case CPUMODE_32BIT:
1498 pRegFrame->edi = GCOffset;
1499 pRegFrame->ecx = cTransfers;
1500 break;
1501 case CPUMODE_64BIT:
1502 pRegFrame->rdi = GCOffset;
1503 pRegFrame->rcx = cTransfers;
1504 break;
1505 default:
1506 AssertFailed();
1507 return VERR_EM_INTERPRETER;
1508 }
1509 }
1510
1511 *pcbSize = cbSize;
1512 return rc;
1513}
1514#endif /* !IN_RC */
1515
1516#ifndef IN_RC
1517
1518/**
1519 * [LOCK] CMPXCHG emulation.
1520 */
1521static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1522{
1523 OP_PARAMVAL param1, param2;
1524
1525#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1526 Assert(pDis->param1.size <= 4);
1527#endif
1528
1529 /* Source to make DISQueryParamVal read the register value - ugly hack */
1530 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1531 if(RT_FAILURE(rc))
1532 return VERR_EM_INTERPRETER;
1533
1534 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1535 if(RT_FAILURE(rc))
1536 return VERR_EM_INTERPRETER;
1537
1538 uint64_t valpar;
1539 switch(param2.type)
1540 {
1541 case PARMTYPE_IMMEDIATE: /* register actually */
1542 valpar = param2.val.val64;
1543 break;
1544
1545 default:
1546 return VERR_EM_INTERPRETER;
1547 }
1548
1549 PGMPAGEMAPLOCK Lock;
1550 RTGCPTR GCPtrPar1;
1551 void *pvParam1;
1552 uint64_t eflags;
1553
1554 AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1555 switch(param1.type)
1556 {
1557 case PARMTYPE_ADDRESS:
1558 GCPtrPar1 = param1.val.val64;
1559 GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1560
1561 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1562 AssertRCReturn(rc, VERR_EM_INTERPRETER);
1563 break;
1564
1565 default:
1566 return VERR_EM_INTERPRETER;
1567 }
1568
1569 LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1570
1571 if (pDis->prefix & PREFIX_LOCK)
1572 eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1573 else
1574 eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1575
1576 LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1577
1578 /* Update guest's eflags and finish. */
1579 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1580 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1581
1582 *pcbSize = param2.size;
1583 PGMPhysReleasePageMappingLock(pVM, &Lock);
1584 return VINF_SUCCESS;
1585}
1586
1587
1588/**
1589 * [LOCK] CMPXCHG8B emulation.
1590 */
1591static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1592{
1593 Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1594 OP_PARAMVAL param1;
1595
1596 /* Source to make DISQueryParamVal read the register value - ugly hack */
1597 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1598 if(RT_FAILURE(rc))
1599 return VERR_EM_INTERPRETER;
1600
1601 RTGCPTR GCPtrPar1;
1602 void *pvParam1;
1603 uint64_t eflags;
1604 PGMPAGEMAPLOCK Lock;
1605
1606 AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1607 switch(param1.type)
1608 {
1609 case PARMTYPE_ADDRESS:
1610 GCPtrPar1 = param1.val.val64;
1611 GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1612
1613 rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1614 AssertRCReturn(rc, VERR_EM_INTERPRETER);
1615 break;
1616
1617 default:
1618 return VERR_EM_INTERPRETER;
1619 }
1620
1621 LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1622
1623 if (pDis->prefix & PREFIX_LOCK)
1624 eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1625 else
1626 eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1627
1628 LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1629
1630 /* Update guest's eflags and finish; note that *only* ZF is affected. */
1631 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1632 | (eflags & (X86_EFL_ZF));
1633
1634 *pcbSize = 8;
1635 PGMPhysReleasePageMappingLock(pVM, &Lock);
1636 return VINF_SUCCESS;
1637}
1638
1639#else /* IN_RC */
1640
1641/**
1642 * [LOCK] CMPXCHG emulation.
1643 */
1644static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1645{
1646 Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1647 OP_PARAMVAL param1, param2;
1648
1649 /* Source to make DISQueryParamVal read the register value - ugly hack */
1650 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1651 if(RT_FAILURE(rc))
1652 return VERR_EM_INTERPRETER;
1653
1654 rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1655 if(RT_FAILURE(rc))
1656 return VERR_EM_INTERPRETER;
1657
1658 if (TRPMHasTrap(pVCpu))
1659 {
1660 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1661 {
1662 RTRCPTR pParam1;
1663 uint32_t valpar, eflags;
1664
1665 AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1666 switch(param1.type)
1667 {
1668 case PARMTYPE_ADDRESS:
1669 pParam1 = (RTRCPTR)(uintptr_t)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTRCUINTPTR)param1.val.val64);
1670 EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1671 break;
1672
1673 default:
1674 return VERR_EM_INTERPRETER;
1675 }
1676
1677 switch(param2.type)
1678 {
1679 case PARMTYPE_IMMEDIATE: /* register actually */
1680 valpar = param2.val.val32;
1681 break;
1682
1683 default:
1684 return VERR_EM_INTERPRETER;
1685 }
1686
1687 LogFlow(("%s %RRv eax=%08x %08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1688
1689 MMGCRamRegisterTrapHandler(pVM);
1690 if (pDis->prefix & PREFIX_LOCK)
1691 rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1692 else
1693 rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pDis->param2.size, &eflags);
1694 MMGCRamDeregisterTrapHandler(pVM);
1695
1696 if (RT_FAILURE(rc))
1697 {
1698 Log(("%s %RGv eax=%08x %08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar));
1699 return VERR_EM_INTERPRETER;
1700 }
1701
1702 LogFlow(("%s %RRv eax=%08x %08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1703
1704 /* Update guest's eflags and finish. */
1705 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1706 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1707
1708 *pcbSize = param2.size;
1709 return VINF_SUCCESS;
1710 }
1711 }
1712 return VERR_EM_INTERPRETER;
1713}
1714
1715
1716/**
1717 * [LOCK] CMPXCHG8B emulation.
1718 */
1719static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1720{
1721 Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1722 OP_PARAMVAL param1;
1723
1724 /* Source to make DISQueryParamVal read the register value - ugly hack */
1725 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1726 if(RT_FAILURE(rc))
1727 return VERR_EM_INTERPRETER;
1728
1729 if (TRPMHasTrap(pVCpu))
1730 {
1731 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1732 {
1733 RTRCPTR pParam1;
1734 uint32_t eflags;
1735
1736 AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1737 switch(param1.type)
1738 {
1739 case PARMTYPE_ADDRESS:
1740 pParam1 = (RTRCPTR)(uintptr_t)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTRCUINTPTR)param1.val.val64);
1741 EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1742 break;
1743
1744 default:
1745 return VERR_EM_INTERPRETER;
1746 }
1747
1748 LogFlow(("%s %RRv=%08x eax=%08x\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1749
1750 MMGCRamRegisterTrapHandler(pVM);
1751 if (pDis->prefix & PREFIX_LOCK)
1752 rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1753 else
1754 rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1755 MMGCRamDeregisterTrapHandler(pVM);
1756
1757 if (RT_FAILURE(rc))
1758 {
1759 Log(("%s %RGv=%08x eax=%08x -> emulation failed due to page fault!\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax));
1760 return VERR_EM_INTERPRETER;
1761 }
1762
1763 LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1764
1765 /* Update guest's eflags and finish; note that *only* ZF is affected. */
1766 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1767 | (eflags & (X86_EFL_ZF));
1768
1769 *pcbSize = 8;
1770 return VINF_SUCCESS;
1771 }
1772 }
1773 return VERR_EM_INTERPRETER;
1774}
1775
1776#endif /* IN_RC */
1777
1778#ifdef IN_RC
1779/**
1780 * [LOCK] XADD emulation.
1781 */
1782static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1783{
1784 Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1785 OP_PARAMVAL param1;
1786 uint32_t *pParamReg2;
1787 size_t cbSizeParamReg2;
1788
1789 /* Source to make DISQueryParamVal read the register value - ugly hack */
1790 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1791 if(RT_FAILURE(rc))
1792 return VERR_EM_INTERPRETER;
1793
1794 rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1795 Assert(cbSizeParamReg2 <= 4);
1796 if(RT_FAILURE(rc))
1797 return VERR_EM_INTERPRETER;
1798
1799 if (TRPMHasTrap(pVCpu))
1800 {
1801 if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1802 {
1803 RTRCPTR pParam1;
1804 uint32_t eflags;
1805
1806 AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1807 switch(param1.type)
1808 {
1809 case PARMTYPE_ADDRESS:
1810 pParam1 = (RTRCPTR)(uintptr_t)emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTRCUINTPTR)param1.val.val64);
1811 EM_ASSERT_FAULT_RETURN(pParam1 == (RTRCPTR)pvFault, VERR_EM_INTERPRETER);
1812 break;
1813
1814 default:
1815 return VERR_EM_INTERPRETER;
1816 }
1817
1818 LogFlow(("XAdd %RRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1819
1820 MMGCRamRegisterTrapHandler(pVM);
1821 if (pDis->prefix & PREFIX_LOCK)
1822 rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1823 else
1824 rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1825 MMGCRamDeregisterTrapHandler(pVM);
1826
1827 if (RT_FAILURE(rc))
1828 {
1829 Log(("XAdd %RGv reg=%08x -> emulation failed due to page fault!\n", pParam1, *pParamReg2));
1830 return VERR_EM_INTERPRETER;
1831 }
1832
1833 LogFlow(("XAdd %RGv reg=%08x ZF=%d\n", pParam1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1834
1835 /* Update guest's eflags and finish. */
1836 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
1837 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
1838
1839 *pcbSize = cbSizeParamReg2;
1840 return VINF_SUCCESS;
1841 }
1842 }
1843 return VERR_EM_INTERPRETER;
1844}
1845#endif /* IN_RC */
1846
1847
1848#ifdef IN_RC
1849/**
1850 * Interpret IRET (currently only to V86 code)
1851 *
1852 * @returns VBox status code.
1853 * @param pVM The VM handle.
1854 * @param pVCpu The VMCPU handle.
1855 * @param pRegFrame The register frame.
1856 *
1857 */
1858VMMDECL(int) EMInterpretIret(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1859{
1860 RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1861 RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1862 int rc;
1863
1864 Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
1865
1866 rc = emRamRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1867 rc |= emRamRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1868 rc |= emRamRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1869 AssertRCReturn(rc, VERR_EM_INTERPRETER);
1870 AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1871
1872 rc |= emRamRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1873 rc |= emRamRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1874 rc |= emRamRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1875 rc |= emRamRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1876 rc |= emRamRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1877 rc |= emRamRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1878 AssertRCReturn(rc, VERR_EM_INTERPRETER);
1879
1880 pRegFrame->eip = eip & 0xffff;
1881 pRegFrame->cs = cs;
1882
1883 /* Mask away all reserved bits */
1884 uMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT | X86_EFL_RF | X86_EFL_VM | X86_EFL_AC | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_ID;
1885 eflags &= uMask;
1886
1887#ifndef IN_RING0
1888 CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
1889#endif
1890 Assert((pRegFrame->eflags.u32 & (X86_EFL_IF|X86_EFL_IOPL)) == X86_EFL_IF);
1891
1892 pRegFrame->esp = esp;
1893 pRegFrame->ss = ss;
1894 pRegFrame->ds = ds;
1895 pRegFrame->es = es;
1896 pRegFrame->fs = fs;
1897 pRegFrame->gs = gs;
1898
1899 return VINF_SUCCESS;
1900}
1901#endif /* IN_RC */
1902
1903
1904/**
1905 * IRET Emulation.
1906 */
1907static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1908{
1909 /* only allow direct calls to EMInterpretIret for now */
1910 return VERR_EM_INTERPRETER;
1911}
1912
1913/**
1914 * WBINVD Emulation.
1915 */
1916static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1917{
1918 /* Nothing to do. */
1919 return VINF_SUCCESS;
1920}
1921
1922
1923/**
1924 * Interpret INVLPG
1925 *
1926 * @returns VBox status code.
1927 * @param pVM The VM handle.
1928 * @param pVCpu The VMCPU handle.
1929 * @param pRegFrame The register frame.
1930 * @param pAddrGC Operand address
1931 *
1932 */
1933VMMDECL(int) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1934{
1935 int rc;
1936
1937 /** @todo is addr always a flat linear address or ds based
1938 * (in absence of segment override prefixes)????
1939 */
1940#ifdef IN_RC
1941 LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1942#endif
1943 rc = PGMInvalidatePage(pVCpu, pAddrGC);
1944 if ( rc == VINF_SUCCESS
1945 || rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1946 return VINF_SUCCESS;
1947 AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1948 ("%Rrc addr=%RGv\n", rc, pAddrGC),
1949 VERR_EM_INTERPRETER);
1950 return rc;
1951}
1952
1953
1954/**
1955 * INVLPG Emulation.
1956 */
1957static int emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1958{
1959 OP_PARAMVAL param1;
1960 RTGCPTR addr;
1961
1962 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1963 if(RT_FAILURE(rc))
1964 return VERR_EM_INTERPRETER;
1965
1966 switch(param1.type)
1967 {
1968 case PARMTYPE_IMMEDIATE:
1969 case PARMTYPE_ADDRESS:
1970 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
1971 return VERR_EM_INTERPRETER;
1972 addr = (RTGCPTR)param1.val.val64;
1973 break;
1974
1975 default:
1976 return VERR_EM_INTERPRETER;
1977 }
1978
1979 /** @todo is addr always a flat linear address or ds based
1980 * (in absence of segment override prefixes)????
1981 */
1982#ifdef IN_RC
1983 LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1984#endif
1985 rc = PGMInvalidatePage(pVCpu, addr);
1986 if ( rc == VINF_SUCCESS
1987 || rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1988 return VINF_SUCCESS;
1989 AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1990 ("%Rrc addr=%RGv\n", rc, addr),
1991 VERR_EM_INTERPRETER);
1992 return rc;
1993}
1994
1995
1996/**
1997 * Interpret CPUID given the parameters in the CPU context
1998 *
1999 * @returns VBox status code.
2000 * @param pVM The VM handle.
2001 * @param pVCpu The VMCPU handle.
2002 * @param pRegFrame The register frame.
2003 *
2004 */
2005VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2006{
2007 uint32_t iLeaf = pRegFrame->eax;
2008
2009 /* cpuid clears the high dwords of the affected 64 bits registers. */
2010 pRegFrame->rax = 0;
2011 pRegFrame->rbx = 0;
2012 pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
2013 pRegFrame->rdx = 0;
2014
2015 /* Note: operates the same in 64 and non-64 bits mode. */
2016 CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
2017 Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
2018 return VINF_SUCCESS;
2019}
2020
2021
2022/**
2023 * CPUID Emulation.
2024 */
2025static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2026{
2027 int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
2028 return rc;
2029}
2030
2031
2032/**
2033 * Interpret CRx read
2034 *
2035 * @returns VBox status code.
2036 * @param pVM The VM handle.
2037 * @param pVCpu The VMCPU handle.
2038 * @param pRegFrame The register frame.
2039 * @param DestRegGen General purpose register index (USE_REG_E**))
2040 * @param SrcRegCRx CRx register index (USE_REG_CR*)
2041 *
2042 */
2043VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
2044{
2045 int rc;
2046 uint64_t val64;
2047
2048 if (SrcRegCrx == USE_REG_CR8)
2049 {
2050 val64 = 0;
2051 rc = PDMApicGetTPR(pVCpu, (uint8_t *)&val64, NULL);
2052 AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
2053 val64 >>= 4; /* bits 7-4 contain the task priority that go in cr8, bits 3-0*/
2054 }
2055 else
2056 {
2057 rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
2058 AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
2059 }
2060
2061 if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2062 rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2063 else
2064 rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
2065
2066 if(RT_SUCCESS(rc))
2067 {
2068 LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2069 return VINF_SUCCESS;
2070 }
2071 return VERR_EM_INTERPRETER;
2072}
2073
2074
2075
2076/**
2077 * Interpret CLTS
2078 *
2079 * @returns VBox status code.
2080 * @param pVM The VM handle.
2081 * @param pVCpu The VMCPU handle.
2082 *
2083 */
2084VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
2085{
2086 uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2087 if (!(cr0 & X86_CR0_TS))
2088 return VINF_SUCCESS;
2089 return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
2090}
2091
2092/**
2093 * CLTS Emulation.
2094 */
2095static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2096{
2097 return EMInterpretCLTS(pVM, pVCpu);
2098}
2099
2100
2101/**
2102 * Update CRx
2103 *
2104 * @returns VBox status code.
2105 * @param pVM The VM handle.
2106 * @param pVCpu The VMCPU handle.
2107 * @param pRegFrame The register frame.
2108 * @param DestRegCRx CRx register index (USE_REG_CR*)
2109 * @param val New CRx value
2110 *
2111 */
2112static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2113{
2114 uint64_t oldval;
2115 uint64_t msrEFER;
2116 int rc, rc2;
2117
2118 /** @todo Clean up this mess. */
2119 LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2120 switch (DestRegCrx)
2121 {
2122 case USE_REG_CR0:
2123 oldval = CPUMGetGuestCR0(pVCpu);
2124#ifdef IN_RC
2125 /* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2126 if ( (val & (X86_CR0_WP | X86_CR0_AM))
2127 != (oldval & (X86_CR0_WP | X86_CR0_AM)))
2128 return VERR_EM_INTERPRETER;
2129#endif
2130 rc = VINF_SUCCESS;
2131 CPUMSetGuestCR0(pVCpu, val);
2132 val = CPUMGetGuestCR0(pVCpu);
2133 if ( (oldval & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
2134 != (val & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)))
2135 {
2136 /* global flush */
2137 rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2138 AssertRCReturn(rc, rc);
2139 }
2140
2141 /* Deal with long mode enabling/disabling. */
2142 msrEFER = CPUMGetGuestEFER(pVCpu);
2143 if (msrEFER & MSR_K6_EFER_LME)
2144 {
2145 if ( !(oldval & X86_CR0_PG)
2146 && (val & X86_CR0_PG))
2147 {
2148 /* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2149 if (pRegFrame->csHid.Attr.n.u1Long)
2150 {
2151 AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2152 return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2153 }
2154
2155 /* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2156 if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
2157 {
2158 AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2159 return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2160 }
2161 msrEFER |= MSR_K6_EFER_LMA;
2162 }
2163 else
2164 if ( (oldval & X86_CR0_PG)
2165 && !(val & X86_CR0_PG))
2166 {
2167 msrEFER &= ~MSR_K6_EFER_LMA;
2168 /* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2169 }
2170 CPUMSetGuestEFER(pVCpu, msrEFER);
2171 }
2172 rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2173 return rc2 == VINF_SUCCESS ? rc : rc2;
2174
2175 case USE_REG_CR2:
2176 rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2177 return VINF_SUCCESS;
2178
2179 case USE_REG_CR3:
2180 /* Reloading the current CR3 means the guest just wants to flush the TLBs */
2181 rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2182 if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2183 {
2184 /* flush */
2185 rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2186 AssertRC(rc);
2187 }
2188 return rc;
2189
2190 case USE_REG_CR4:
2191 oldval = CPUMGetGuestCR4(pVCpu);
2192 rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2193 val = CPUMGetGuestCR4(pVCpu);
2194
2195 /* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2196 msrEFER = CPUMGetGuestEFER(pVCpu);
2197 if ( (msrEFER & MSR_K6_EFER_LMA)
2198 && (oldval & X86_CR4_PAE)
2199 && !(val & X86_CR4_PAE))
2200 {
2201 return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2202 }
2203
2204 rc = VINF_SUCCESS;
2205 if ( (oldval & (X86_CR4_PGE|X86_CR4_PAE|X86_CR4_PSE))
2206 != (val & (X86_CR4_PGE|X86_CR4_PAE|X86_CR4_PSE)))
2207 {
2208 /* global flush */
2209 rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2210 AssertRCReturn(rc, rc);
2211 }
2212
2213 /* Feeling extremely lazy. */
2214# ifdef IN_RC
2215 if ( (oldval & (X86_CR4_OSFSXR|X86_CR4_OSXMMEEXCPT|X86_CR4_PCE|X86_CR4_MCE|X86_CR4_PAE|X86_CR4_DE|X86_CR4_TSD|X86_CR4_PVI|X86_CR4_VME))
2216 != (val & (X86_CR4_OSFSXR|X86_CR4_OSXMMEEXCPT|X86_CR4_PCE|X86_CR4_MCE|X86_CR4_PAE|X86_CR4_DE|X86_CR4_TSD|X86_CR4_PVI|X86_CR4_VME)))
2217 {
2218 Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2219 VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2220 }
2221# endif
2222 if ((val ^ oldval) & X86_CR4_VME)
2223 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2224
2225 rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2226 return rc2 == VINF_SUCCESS ? rc : rc2;
2227
2228 case USE_REG_CR8:
2229 return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2230
2231 default:
2232 AssertFailed();
2233 case USE_REG_CR1: /* illegal op */
2234 break;
2235 }
2236 return VERR_EM_INTERPRETER;
2237}
2238
2239/**
2240 * Interpret CRx write
2241 *
2242 * @returns VBox status code.
2243 * @param pVM The VM handle.
2244 * @param pVCpu The VMCPU handle.
2245 * @param pRegFrame The register frame.
2246 * @param DestRegCRx CRx register index (USE_REG_CR*)
2247 * @param SrcRegGen General purpose register index (USE_REG_E**))
2248 *
2249 */
2250VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2251{
2252 uint64_t val;
2253 int rc;
2254
2255 if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2256 {
2257 rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2258 }
2259 else
2260 {
2261 uint32_t val32;
2262 rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2263 val = val32;
2264 }
2265
2266 if (RT_SUCCESS(rc))
2267 return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2268
2269 return VERR_EM_INTERPRETER;
2270}
2271
2272/**
2273 * Interpret LMSW
2274 *
2275 * @returns VBox status code.
2276 * @param pVM The VM handle.
2277 * @param pVCpu The VMCPU handle.
2278 * @param pRegFrame The register frame.
2279 * @param u16Data LMSW source data.
2280 *
2281 */
2282VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2283{
2284 uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2285
2286 /* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2287 uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP | X86_CR0_EM | X86_CR0_TS))
2288 | (u16Data & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS));
2289
2290 return emUpdateCRx(pVM, pVCpu, pRegFrame, USE_REG_CR0, NewCr0);
2291}
2292
2293/**
2294 * LMSW Emulation.
2295 */
2296static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2297{
2298 OP_PARAMVAL param1;
2299 uint32_t val;
2300
2301 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2302 if(RT_FAILURE(rc))
2303 return VERR_EM_INTERPRETER;
2304
2305 switch(param1.type)
2306 {
2307 case PARMTYPE_IMMEDIATE:
2308 case PARMTYPE_ADDRESS:
2309 if(!(param1.flags & PARAM_VAL16))
2310 return VERR_EM_INTERPRETER;
2311 val = param1.val.val32;
2312 break;
2313
2314 default:
2315 return VERR_EM_INTERPRETER;
2316 }
2317
2318 LogFlow(("emInterpretLmsw %x\n", val));
2319 return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2320}
2321
2322#ifdef EM_EMULATE_SMSW
2323/**
2324 * SMSW Emulation.
2325 */
2326static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2327{
2328 OP_PARAMVAL param1;
2329 uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2330
2331 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2332 if(RT_FAILURE(rc))
2333 return VERR_EM_INTERPRETER;
2334
2335 switch(param1.type)
2336 {
2337 case PARMTYPE_IMMEDIATE:
2338 if(param1.size != sizeof(uint16_t))
2339 return VERR_EM_INTERPRETER;
2340 LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->param1.base.reg_gen, cr0));
2341 rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, cr0);
2342 break;
2343
2344 case PARMTYPE_ADDRESS:
2345 {
2346 RTGCPTR pParam1;
2347
2348 /* Actually forced to 16 bits regardless of the operand size. */
2349 if(param1.size != sizeof(uint16_t))
2350 return VERR_EM_INTERPRETER;
2351
2352 pParam1 = (RTGCPTR)param1.val.val64;
2353 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
2354 LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
2355
2356 rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2357 if (RT_FAILURE(rc))
2358 {
2359 AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2360 return VERR_EM_INTERPRETER;
2361 }
2362 break;
2363 }
2364
2365 default:
2366 return VERR_EM_INTERPRETER;
2367 }
2368
2369 LogFlow(("emInterpretSmsw %x\n", cr0));
2370 return rc;
2371}
2372#endif
2373
2374/**
2375 * MOV CRx
2376 */
2377static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2378{
2379 if ((pDis->param1.flags == USE_REG_GEN32 || pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_CR)
2380 return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_ctrl);
2381
2382 if (pDis->param1.flags == USE_REG_CR && (pDis->param2.flags == USE_REG_GEN32 || pDis->param2.flags == USE_REG_GEN64))
2383 return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_ctrl, pDis->param2.base.reg_gen);
2384
2385 AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2386 return VERR_EM_INTERPRETER;
2387}
2388
2389
2390/**
2391 * Interpret DRx write
2392 *
2393 * @returns VBox status code.
2394 * @param pVM The VM handle.
2395 * @param pVCpu The VMCPU handle.
2396 * @param pRegFrame The register frame.
2397 * @param DestRegDRx DRx register index (USE_REG_DR*)
2398 * @param SrcRegGen General purpose register index (USE_REG_E**))
2399 *
2400 */
2401VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2402{
2403 uint64_t val;
2404 int rc;
2405
2406 if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2407 {
2408 rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2409 }
2410 else
2411 {
2412 uint32_t val32;
2413 rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2414 val = val32;
2415 }
2416
2417 if (RT_SUCCESS(rc))
2418 {
2419 /** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2420 rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2421 if (RT_SUCCESS(rc))
2422 return rc;
2423 AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2424 }
2425 return VERR_EM_INTERPRETER;
2426}
2427
2428
2429/**
2430 * Interpret DRx read
2431 *
2432 * @returns VBox status code.
2433 * @param pVM The VM handle.
2434 * @param pVCpu The VMCPU handle.
2435 * @param pRegFrame The register frame.
2436 * @param DestRegGen General purpose register index (USE_REG_E**))
2437 * @param SrcRegDRx DRx register index (USE_REG_DR*)
2438 *
2439 */
2440VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2441{
2442 uint64_t val64;
2443
2444 int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2445 AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2446 if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2447 {
2448 rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2449 }
2450 else
2451 rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2452
2453 if (RT_SUCCESS(rc))
2454 return VINF_SUCCESS;
2455
2456 return VERR_EM_INTERPRETER;
2457}
2458
2459
2460/**
2461 * MOV DRx
2462 */
2463static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2464{
2465 int rc = VERR_EM_INTERPRETER;
2466
2467 if((pDis->param1.flags == USE_REG_GEN32 || pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_DBG)
2468 {
2469 rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_dbg);
2470 }
2471 else
2472 if(pDis->param1.flags == USE_REG_DBG && (pDis->param2.flags == USE_REG_GEN32 || pDis->param2.flags == USE_REG_GEN64))
2473 {
2474 rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_dbg, pDis->param2.base.reg_gen);
2475 }
2476 else
2477 AssertMsgFailed(("Unexpected debug register move\n"));
2478
2479 return rc;
2480}
2481
2482
2483/**
2484 * LLDT Emulation.
2485 */
2486static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2487{
2488 OP_PARAMVAL param1;
2489 RTSEL sel;
2490
2491 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2492 if(RT_FAILURE(rc))
2493 return VERR_EM_INTERPRETER;
2494
2495 switch(param1.type)
2496 {
2497 case PARMTYPE_ADDRESS:
2498 return VERR_EM_INTERPRETER; //feeling lazy right now
2499
2500 case PARMTYPE_IMMEDIATE:
2501 if(!(param1.flags & PARAM_VAL16))
2502 return VERR_EM_INTERPRETER;
2503 sel = (RTSEL)param1.val.val16;
2504 break;
2505
2506 default:
2507 return VERR_EM_INTERPRETER;
2508 }
2509
2510#ifdef IN_RING0
2511 /* Only for the VT-x real-mode emulation case. */
2512 AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2513 CPUMSetGuestLDTR(pVCpu, sel);
2514 return VINF_SUCCESS;
2515#else
2516 if (sel == 0)
2517 {
2518 if (CPUMGetHyperLDTR(pVCpu) == 0)
2519 {
2520 // this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2521 return VINF_SUCCESS;
2522 }
2523 }
2524 //still feeling lazy
2525 return VERR_EM_INTERPRETER;
2526#endif
2527}
2528
2529#ifdef IN_RING0
2530/**
2531 * LIDT/LGDT Emulation.
2532 */
2533static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2534{
2535 OP_PARAMVAL param1;
2536 RTGCPTR pParam1;
2537 X86XDTR32 dtr32;
2538
2539 Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2540
2541 /* Only for the VT-x real-mode emulation case. */
2542 AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2543
2544 int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2545 if(RT_FAILURE(rc))
2546 return VERR_EM_INTERPRETER;
2547
2548 switch(param1.type)
2549 {
2550 case PARMTYPE_ADDRESS:
2551 pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, param1.val.val16);
2552 break;
2553
2554 default:
2555 return VERR_EM_INTERPRETER;
2556 }
2557
2558 rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2559 AssertRCReturn(rc, VERR_EM_INTERPRETER);
2560
2561 if (!(pDis->prefix & PREFIX_OPSIZE))
2562 dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2563
2564 if (pDis->pCurInstr->opcode == OP_LIDT)
2565 CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2566 else
2567 CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2568
2569 return VINF_SUCCESS;
2570}
2571#endif
2572
2573
2574#ifdef IN_RC
2575/**
2576 * STI Emulation.
2577 *
2578 * @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2579 */
2580static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2581{
2582 PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2583
2584 if(!pGCState)
2585 {
2586 Assert(pGCState);
2587 return VERR_EM_INTERPRETER;
2588 }
2589 pGCState->uVMFlags |= X86_EFL_IF;
2590
2591 Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2592 Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2593
2594 pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->opsize;
2595 VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2596
2597 return VINF_SUCCESS;
2598}
2599#endif /* IN_RC */
2600
2601
2602/**
2603 * HLT Emulation.
2604 */
2605static int emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2606{
2607 return VINF_EM_HALT;
2608}
2609
2610
2611/**
2612 * Interpret RDTSC
2613 *
2614 * @returns VBox status code.
2615 * @param pVM The VM handle.
2616 * @param pVCpu The VMCPU handle.
2617 * @param pRegFrame The register frame.
2618 *
2619 */
2620VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2621{
2622 unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2623
2624 if (uCR4 & X86_CR4_TSD)
2625 return VERR_EM_INTERPRETER; /* genuine #GP */
2626
2627 uint64_t uTicks = TMCpuTickGet(pVCpu);
2628
2629 /* Same behaviour in 32 & 64 bits mode */
2630 pRegFrame->rax = (uint32_t)uTicks;
2631 pRegFrame->rdx = (uTicks >> 32ULL);
2632
2633 return VINF_SUCCESS;
2634}
2635
2636/**
2637 * Interpret RDTSCP
2638 *
2639 * @returns VBox status code.
2640 * @param pVM The VM handle.
2641 * @param pVCpu The VMCPU handle.
2642 * @param pCtx The CPU context.
2643 *
2644 */
2645VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2646{
2647 unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2648
2649 if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2650 {
2651 AssertFailed();
2652 return VERR_EM_INTERPRETER; /* genuine #UD */
2653 }
2654
2655 if (uCR4 & X86_CR4_TSD)
2656 return VERR_EM_INTERPRETER; /* genuine #GP */
2657
2658 uint64_t uTicks = TMCpuTickGet(pVCpu);
2659
2660 /* Same behaviour in 32 & 64 bits mode */
2661 pCtx->rax = (uint32_t)uTicks;
2662 pCtx->rdx = (uTicks >> 32ULL);
2663 /* Low dword of the TSC_AUX msr only. */
2664 pCtx->rcx = (uint32_t)CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2665
2666 return VINF_SUCCESS;
2667}
2668
2669/**
2670 * RDTSC Emulation.
2671 */
2672static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2673{
2674 return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2675}
2676
2677/**
2678 * Interpret RDPMC
2679 *
2680 * @returns VBox status code.
2681 * @param pVM The VM handle.
2682 * @param pVCpu The VMCPU handle.
2683 * @param pRegFrame The register frame.
2684 *
2685 */
2686VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2687{
2688 unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2689
2690 /* If X86_CR4_PCE is not set, then CPL must be zero. */
2691 if ( !(uCR4 & X86_CR4_PCE)
2692 && CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2693 {
2694 Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2695 return VERR_EM_INTERPRETER; /* genuine #GP */
2696 }
2697
2698 /* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2699 pRegFrame->rax = 0;
2700 pRegFrame->rdx = 0;
2701 /* @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2702 return VINF_SUCCESS;
2703}
2704
2705/**
2706 * RDPMC Emulation
2707 */
2708static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2709{
2710 return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2711}
2712
2713/**
2714 * MONITOR Emulation.
2715 */
2716VMMDECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2717{
2718 uint32_t u32Dummy, u32ExtFeatures, cpl;
2719
2720 if (pRegFrame->ecx != 0)
2721 {
2722 Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
2723 return VERR_EM_INTERPRETER; /* illegal value. */
2724 }
2725
2726 /* Get the current privilege level. */
2727 cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2728 if (cpl != 0)
2729 return VERR_EM_INTERPRETER; /* supervisor only */
2730
2731 CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2732 if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2733 return VERR_EM_INTERPRETER; /* not supported */
2734
2735 pVCpu->em.s.mwait.uMonitorEAX = pRegFrame->rax;
2736 pVCpu->em.s.mwait.uMonitorECX = pRegFrame->rcx;
2737 pVCpu->em.s.mwait.uMonitorEDX = pRegFrame->rdx;
2738 pVCpu->em.s.mwait.fWait |= EMMWAIT_FLAG_MONITOR_ACTIVE;
2739 return VINF_SUCCESS;
2740}
2741
2742static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2743{
2744 return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
2745}
2746
2747
2748/**
2749 * MWAIT Emulation.
2750 */
2751VMMDECL(int) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2752{
2753 uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
2754
2755 /* Get the current privilege level. */
2756 cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2757 if (cpl != 0)
2758 return VERR_EM_INTERPRETER; /* supervisor only */
2759
2760 CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2761 if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2762 return VERR_EM_INTERPRETER; /* not supported */
2763
2764 /*
2765 * CPUID.05H.ECX[0] defines support for power management extensions (eax)
2766 * CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
2767 */
2768 CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
2769 if (pRegFrame->ecx > 1)
2770 {
2771 Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
2772 return VERR_EM_INTERPRETER; /* illegal value. */
2773 }
2774
2775 if (pRegFrame->ecx)
2776 {
2777 if (!(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
2778 {
2779 Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
2780 return VERR_EM_INTERPRETER; /* illegal value. */
2781 }
2782
2783 pVCpu->em.s.mwait.fWait = EMMWAIT_FLAG_ACTIVE | EMMWAIT_FLAG_BREAKIRQIF0;
2784 }
2785 else
2786 pVCpu->em.s.mwait.fWait = EMMWAIT_FLAG_ACTIVE;
2787
2788 pVCpu->em.s.mwait.uMWaitEAX = pRegFrame->rax;
2789 pVCpu->em.s.mwait.uMWaitECX = pRegFrame->rcx;
2790
2791 /** @todo not completely correct */
2792 return VINF_EM_HALT;
2793}
2794
2795static int emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2796{
2797 return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2798}
2799
2800
2801#ifdef LOG_ENABLED
2802static const char *emMSRtoString(uint32_t uMsr)
2803{
2804 switch (uMsr)
2805 {
2806 case MSR_IA32_APICBASE:
2807 return "MSR_IA32_APICBASE";
2808 case MSR_IA32_CR_PAT:
2809 return "MSR_IA32_CR_PAT";
2810 case MSR_IA32_SYSENTER_CS:
2811 return "MSR_IA32_SYSENTER_CS";
2812 case MSR_IA32_SYSENTER_EIP:
2813 return "MSR_IA32_SYSENTER_EIP";
2814 case MSR_IA32_SYSENTER_ESP:
2815 return "MSR_IA32_SYSENTER_ESP";
2816 case MSR_K6_EFER:
2817 return "MSR_K6_EFER";
2818 case MSR_K8_SF_MASK:
2819 return "MSR_K8_SF_MASK";
2820 case MSR_K6_STAR:
2821 return "MSR_K6_STAR";
2822 case MSR_K8_LSTAR:
2823 return "MSR_K8_LSTAR";
2824 case MSR_K8_CSTAR:
2825 return "MSR_K8_CSTAR";
2826 case MSR_K8_FS_BASE:
2827 return "MSR_K8_FS_BASE";
2828 case MSR_K8_GS_BASE:
2829 return "MSR_K8_GS_BASE";
2830 case MSR_K8_KERNEL_GS_BASE:
2831 return "MSR_K8_KERNEL_GS_BASE";
2832 case MSR_K8_TSC_AUX:
2833 return "MSR_K8_TSC_AUX";
2834 case MSR_IA32_BIOS_SIGN_ID:
2835 return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2836 case MSR_IA32_PLATFORM_ID:
2837 return "Unsupported MSR_IA32_PLATFORM_ID";
2838 case MSR_IA32_BIOS_UPDT_TRIG:
2839 return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2840 case MSR_IA32_TSC:
2841 return "MSR_IA32_TSC";
2842 case MSR_IA32_MISC_ENABLE:
2843 return "Unsupported MSR_IA32_MISC_ENABLE";
2844 case MSR_IA32_MTRR_CAP:
2845 return "Unsupported MSR_IA32_MTRR_CAP";
2846 case MSR_IA32_MCP_CAP:
2847 return "Unsupported MSR_IA32_MCP_CAP";
2848 case MSR_IA32_MCP_STATUS:
2849 return "Unsupported MSR_IA32_MCP_STATUS";
2850 case MSR_IA32_MCP_CTRL:
2851 return "Unsupported MSR_IA32_MCP_CTRL";
2852 case MSR_IA32_MTRR_DEF_TYPE:
2853 return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2854 case MSR_K7_EVNTSEL0:
2855 return "Unsupported MSR_K7_EVNTSEL0";
2856 case MSR_K7_EVNTSEL1:
2857 return "Unsupported MSR_K7_EVNTSEL1";
2858 case MSR_K7_EVNTSEL2:
2859 return "Unsupported MSR_K7_EVNTSEL2";
2860 case MSR_K7_EVNTSEL3:
2861 return "Unsupported MSR_K7_EVNTSEL3";
2862 case MSR_IA32_MC0_CTL:
2863 return "Unsupported MSR_IA32_MC0_CTL";
2864 case MSR_IA32_MC0_STATUS:
2865 return "Unsupported MSR_IA32_MC0_STATUS";
2866 case MSR_IA32_PERFEVTSEL0:
2867 return "Unsupported MSR_IA32_PERFEVTSEL0";
2868 case MSR_IA32_PERFEVTSEL1:
2869 return "Unsupported MSR_IA32_PERFEVTSEL1";
2870 case MSR_IA32_PERF_STATUS:
2871 return "MSR_IA32_PERF_STATUS";
2872 case MSR_IA32_PLATFORM_INFO:
2873 return "MSR_IA32_PLATFORM_INFO";
2874 case MSR_IA32_PERF_CTL:
2875 return "Unsupported MSR_IA32_PERF_CTL";
2876 case MSR_K7_PERFCTR0:
2877 return "Unsupported MSR_K7_PERFCTR0";
2878 case MSR_K7_PERFCTR1:
2879 return "Unsupported MSR_K7_PERFCTR1";
2880 case MSR_K7_PERFCTR2:
2881 return "Unsupported MSR_K7_PERFCTR2";
2882 case MSR_K7_PERFCTR3:
2883 return "Unsupported MSR_K7_PERFCTR3";
2884 case MSR_IA32_PMC0:
2885 return "Unsupported MSR_IA32_PMC0";
2886 case MSR_IA32_PMC1:
2887 return "Unsupported MSR_IA32_PMC1";
2888 case MSR_IA32_PMC2:
2889 return "Unsupported MSR_IA32_PMC2";
2890 case MSR_IA32_PMC3:
2891 return "Unsupported MSR_IA32_PMC3";
2892 }
2893 return "Unknown MSR";
2894}
2895#endif /* LOG_ENABLED */
2896
2897
2898/**
2899 * Interpret RDMSR
2900 *
2901 * @returns VBox status code.
2902 * @param pVM The VM handle.
2903 * @param pVCpu The VMCPU handle.
2904 * @param pRegFrame The register frame.
2905 *
2906 */
2907VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2908{
2909 uint32_t u32Dummy, u32Features, cpl;
2910 uint64_t val;
2911 CPUMCTX *pCtx;
2912 int rc = VINF_SUCCESS;
2913
2914 /** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2915 * That version clears the high dwords of both RDX & RAX */
2916 pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2917
2918 /* Get the current privilege level. */
2919 cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2920 if (cpl != 0)
2921 return VERR_EM_INTERPRETER; /* supervisor only */
2922
2923 CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2924 if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2925 return VERR_EM_INTERPRETER; /* not supported */
2926
2927 switch (pRegFrame->ecx)
2928 {
2929 case MSR_IA32_TSC:
2930 val = TMCpuTickGet(pVCpu);
2931 break;
2932
2933 case MSR_IA32_APICBASE:
2934 rc = PDMApicGetBase(pVM, &val);
2935 AssertRC(rc);
2936 break;
2937
2938 case MSR_IA32_CR_PAT:
2939 val = pCtx->msrPAT;
2940 break;
2941
2942 case MSR_IA32_SYSENTER_CS:
2943 val = pCtx->SysEnter.cs;
2944 break;
2945
2946 case MSR_IA32_SYSENTER_EIP:
2947 val = pCtx->SysEnter.eip;
2948 break;
2949
2950 case MSR_IA32_SYSENTER_ESP:
2951 val = pCtx->SysEnter.esp;
2952 break;
2953
2954 case MSR_K6_EFER:
2955 val = pCtx->msrEFER;
2956 break;
2957
2958 case MSR_K8_SF_MASK:
2959 val = pCtx->msrSFMASK;
2960 break;
2961
2962 case MSR_K6_STAR:
2963 val = pCtx->msrSTAR;
2964 break;
2965
2966 case MSR_K8_LSTAR:
2967 val = pCtx->msrLSTAR;
2968 break;
2969
2970 case MSR_K8_CSTAR:
2971 val = pCtx->msrCSTAR;
2972 break;
2973
2974 case MSR_K8_FS_BASE:
2975 val = pCtx->fsHid.u64Base;
2976 break;
2977
2978 case MSR_K8_GS_BASE:
2979 val = pCtx->gsHid.u64Base;
2980 break;
2981
2982 case MSR_K8_KERNEL_GS_BASE:
2983 val = pCtx->msrKERNELGSBASE;
2984 break;
2985
2986 case MSR_K8_TSC_AUX:
2987 val = CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2988 break;
2989
2990 case MSR_IA32_PERF_STATUS:
2991 case MSR_IA32_PLATFORM_INFO:
2992 case MSR_IA32_MISC_ENABLE:
2993 case MSR_IA32_FSB_CLOCK_STS:
2994 case MSR_IA32_THERM_STATUS:
2995 val = CPUMGetGuestMsr(pVCpu, pRegFrame->ecx);
2996 break;
2997
2998#if 0 /*def IN_RING0 */
2999 case MSR_IA32_PLATFORM_ID:
3000 case MSR_IA32_BIOS_SIGN_ID:
3001 if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
3002 {
3003 /* Available since the P6 family. VT-x implies that this feature is present. */
3004 if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
3005 val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
3006 else
3007 if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
3008 val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
3009 break;
3010 }
3011 /* no break */
3012#endif
3013 default:
3014 /* In X2APIC specification this range is reserved for APIC control. */
3015 if ( pRegFrame->ecx >= MSR_IA32_APIC_START
3016 && pRegFrame->ecx < MSR_IA32_APIC_END)
3017 rc = PDMApicReadMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, &val);
3018 else
3019 /* We should actually trigger a #GP here, but don't as that will cause more trouble. */
3020 val = 0;
3021 break;
3022 }
3023 LogFlow(("EMInterpretRdmsr %s (%x) -> val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
3024 if (rc == VINF_SUCCESS)
3025 {
3026 pRegFrame->rax = (uint32_t) val;
3027 pRegFrame->rdx = (uint32_t)(val >> 32);
3028 }
3029 return rc;
3030}
3031
3032
3033/**
3034 * RDMSR Emulation.
3035 */
3036static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3037{
3038 /* Note: the Intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
3039 Assert(!(pDis->prefix & PREFIX_REX));
3040 return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
3041}
3042
3043
3044/**
3045 * Interpret WRMSR
3046 *
3047 * @returns VBox status code.
3048 * @param pVM The VM handle.
3049 * @param pVCpu The VMCPU handle.
3050 * @param pRegFrame The register frame.
3051 */
3052VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3053{
3054 uint32_t u32Dummy, u32Features, cpl;
3055 uint64_t val;
3056 CPUMCTX *pCtx;
3057
3058 /* Note: works the same in 32 and 64 bits modes. */
3059 pCtx = CPUMQueryGuestCtxPtr(pVCpu);
3060
3061 /* Get the current privilege level. */
3062 cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3063 if (cpl != 0)
3064 return VERR_EM_INTERPRETER; /* supervisor only */
3065
3066 CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
3067 if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
3068 return VERR_EM_INTERPRETER; /* not supported */
3069
3070 val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
3071 LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
3072 switch (pRegFrame->ecx)
3073 {
3074 case MSR_IA32_TSC:
3075 TMCpuTickSet(pVM, pVCpu, val);
3076 break;
3077
3078 case MSR_IA32_APICBASE:
3079 {
3080 int rc = PDMApicSetBase(pVM, val);
3081 AssertRC(rc);
3082 break;
3083 }
3084
3085 case MSR_IA32_CR_PAT:
3086 pCtx->msrPAT = val;
3087 break;
3088
3089 case MSR_IA32_SYSENTER_CS:
3090 pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
3091 break;
3092
3093 case MSR_IA32_SYSENTER_EIP:
3094 pCtx->SysEnter.eip = val;
3095 break;
3096
3097 case MSR_IA32_SYSENTER_ESP:
3098 pCtx->SysEnter.esp = val;
3099 break;
3100
3101 case MSR_K6_EFER:
3102 {
3103 uint64_t uMask = 0;
3104 uint64_t oldval = pCtx->msrEFER;
3105
3106 /* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
3107 CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
3108 if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
3109 uMask |= MSR_K6_EFER_NXE;
3110 if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
3111 uMask |= MSR_K6_EFER_LME;
3112 if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
3113 uMask |= MSR_K6_EFER_SCE;
3114 if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
3115 uMask |= MSR_K6_EFER_FFXSR;
3116
3117 /* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
3118 if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
3119 && (pCtx->cr0 & X86_CR0_PG))
3120 {
3121 AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
3122 return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
3123 }
3124
3125 /* There are a few more: e.g. MSR_K6_EFER_LMSLE */
3126 AssertMsg(!(val & ~(MSR_K6_EFER_NXE|MSR_K6_EFER_LME|MSR_K6_EFER_LMA /* ignored anyway */ |MSR_K6_EFER_SCE|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
3127 pCtx->msrEFER = (pCtx->msrEFER & ~uMask) | (val & uMask);
3128
3129 /* AMD64 Architecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
3130 if ((oldval & (MSR_K6_EFER_NXE|MSR_K6_EFER_LME|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE|MSR_K6_EFER_LME|MSR_K6_EFER_LMA)))
3131 HWACCMFlushTLB(pVCpu);
3132
3133 break;
3134 }
3135
3136 case MSR_K8_SF_MASK:
3137 pCtx->msrSFMASK = val;
3138 break;
3139
3140 case MSR_K6_STAR:
3141 pCtx->msrSTAR = val;
3142 break;
3143
3144 case MSR_K8_LSTAR:
3145 pCtx->msrLSTAR = val;
3146 break;
3147
3148 case MSR_K8_CSTAR:
3149 pCtx->msrCSTAR = val;
3150 break;
3151
3152 case MSR_K8_FS_BASE:
3153 pCtx->fsHid.u64Base = val;
3154 break;
3155
3156 case MSR_K8_GS_BASE:
3157 pCtx->gsHid.u64Base = val;
3158 break;
3159
3160 case MSR_K8_KERNEL_GS_BASE:
3161 pCtx->msrKERNELGSBASE = val;
3162 break;
3163
3164 case MSR_K8_TSC_AUX:
3165 case MSR_IA32_MISC_ENABLE:
3166 CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, val);
3167 break;
3168
3169 default:
3170 /* In X2APIC specification this range is reserved for APIC control. */
3171 if ( pRegFrame->ecx >= MSR_IA32_APIC_START
3172 && pRegFrame->ecx < MSR_IA32_APIC_END)
3173 return PDMApicWriteMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, val);
3174
3175 /* We should actually trigger a #GP here, but don't as that might cause more trouble. */
3176 break;
3177 }
3178 return VINF_SUCCESS;
3179}
3180
3181
3182/**
3183 * WRMSR Emulation.
3184 */
3185static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3186{
3187 return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3188}
3189
3190
3191/**
3192 * Internal worker.
3193 * @copydoc EMInterpretInstructionCPU
3194 */
3195DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize, EMCODETYPE enmCodeType)
3196{
3197 Assert(enmCodeType == EMCODETYPE_SUPERVISOR || enmCodeType == EMCODETYPE_ALL);
3198 Assert(pcbSize);
3199 *pcbSize = 0;
3200
3201 if (enmCodeType == EMCODETYPE_SUPERVISOR)
3202 {
3203 /*
3204 * Only supervisor guest code!!
3205 * And no complicated prefixes.
3206 */
3207 /* Get the current privilege level. */
3208 uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3209 if ( cpl != 0
3210 && pDis->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3211 {
3212 Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3213 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3214 return VERR_EM_INTERPRETER;
3215 }
3216 }
3217 else
3218 Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3219
3220#ifdef IN_RC
3221 if ( (pDis->prefix & (PREFIX_REPNE | PREFIX_REP))
3222 || ( (pDis->prefix & PREFIX_LOCK)
3223 && pDis->pCurInstr->opcode != OP_CMPXCHG
3224 && pDis->pCurInstr->opcode != OP_CMPXCHG8B
3225 && pDis->pCurInstr->opcode != OP_XADD
3226 && pDis->pCurInstr->opcode != OP_OR
3227 && pDis->pCurInstr->opcode != OP_AND
3228 && pDis->pCurInstr->opcode != OP_XOR
3229 && pDis->pCurInstr->opcode != OP_BTR
3230 )
3231 )
3232#else
3233 if ( (pDis->prefix & PREFIX_REPNE)
3234 || ( (pDis->prefix & PREFIX_REP)
3235 && pDis->pCurInstr->opcode != OP_STOSWD
3236 )
3237 || ( (pDis->prefix & PREFIX_LOCK)
3238 && pDis->pCurInstr->opcode != OP_OR
3239 && pDis->pCurInstr->opcode != OP_AND
3240 && pDis->pCurInstr->opcode != OP_XOR
3241 && pDis->pCurInstr->opcode != OP_BTR
3242 && pDis->pCurInstr->opcode != OP_CMPXCHG
3243 && pDis->pCurInstr->opcode != OP_CMPXCHG8B
3244 )
3245 )
3246#endif
3247 {
3248 //Log(("EMInterpretInstruction: wrong prefix!!\n"));
3249 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3250 return VERR_EM_INTERPRETER;
3251 }
3252
3253#if HC_ARCH_BITS == 32
3254 /*
3255 * Unable to emulate most >4 bytes accesses in 32 bits mode.
3256 * Whitelisted instructions are safe.
3257 */
3258 if ( pDis->param1.size > 4
3259 && CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3260 {
3261 uint32_t uOpCode = pDis->pCurInstr->opcode;
3262 if ( uOpCode != OP_STOSWD
3263 && uOpCode != OP_MOV
3264 && uOpCode != OP_CMPXCHG8B
3265 && uOpCode != OP_XCHG
3266 && uOpCode != OP_BTS
3267 && uOpCode != OP_BTR
3268 && uOpCode != OP_BTC
3269# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3270 && uOpCode != OP_CMPXCHG /* solaris */
3271 && uOpCode != OP_AND /* windows */
3272 && uOpCode != OP_OR /* windows */
3273 && uOpCode != OP_XOR /* because we can */
3274 && uOpCode != OP_ADD /* windows (dripple) */
3275 && uOpCode != OP_ADC /* because we can */
3276 && uOpCode != OP_SUB /* because we can */
3277 /** @todo OP_BTS or is that a different kind of failure? */
3278# endif
3279 )
3280 {
3281# ifdef VBOX_WITH_STATISTICS
3282 switch (pDis->pCurInstr->opcode)
3283 {
3284# define INTERPRET_FAILED_CASE(opcode, Instr) \
3285 case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3286 INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3287 INTERPRET_FAILED_CASE(OP_DEC,Dec);
3288 INTERPRET_FAILED_CASE(OP_INC,Inc);
3289 INTERPRET_FAILED_CASE(OP_POP,Pop);
3290 INTERPRET_FAILED_CASE(OP_OR, Or);
3291 INTERPRET_FAILED_CASE(OP_XOR,Xor);
3292 INTERPRET_FAILED_CASE(OP_AND,And);
3293 INTERPRET_FAILED_CASE(OP_MOV,Mov);
3294 INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3295 INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3296 INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3297 INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3298 INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3299 INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3300 INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3301 INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3302 INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3303 INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3304 INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3305 INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3306 INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3307 INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3308 INTERPRET_FAILED_CASE(OP_ADD,Add);
3309 INTERPRET_FAILED_CASE(OP_SUB,Sub);
3310 INTERPRET_FAILED_CASE(OP_ADC,Adc);
3311 INTERPRET_FAILED_CASE(OP_BTR,Btr);
3312 INTERPRET_FAILED_CASE(OP_BTS,Bts);
3313 INTERPRET_FAILED_CASE(OP_BTC,Btc);
3314 INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3315 INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3316 INTERPRET_FAILED_CASE(OP_STI, Sti);
3317 INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3318 INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3319 INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3320 INTERPRET_FAILED_CASE(OP_IRET,Iret);
3321 INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3322 INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3323# undef INTERPRET_FAILED_CASE
3324 default:
3325 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3326 break;
3327 }
3328# endif /* VBOX_WITH_STATISTICS */
3329 return VERR_EM_INTERPRETER;
3330 }
3331 }
3332#endif
3333
3334 int rc;
3335#if (defined(VBOX_STRICT) || defined(LOG_ENABLED))
3336 LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3337#endif
3338 switch (pDis->pCurInstr->opcode)
3339 {
3340 /*
3341 * Macros for generating the right case statements.
3342 */
3343# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3344 case opcode:\
3345 if (pDis->prefix & PREFIX_LOCK) \
3346 rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3347 else \
3348 rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3349 if (RT_SUCCESS(rc)) \
3350 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3351 else \
3352 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3353 return rc
3354#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3355 case opcode:\
3356 rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3357 if (RT_SUCCESS(rc)) \
3358 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3359 else \
3360 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3361 return rc
3362
3363#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3364 INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3365#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3366 INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3367
3368#define INTERPRET_CASE(opcode, Instr) \
3369 case opcode:\
3370 rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3371 if (RT_SUCCESS(rc)) \
3372 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3373 else \
3374 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3375 return rc
3376
3377#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3378 case opcode:\
3379 rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3380 if (RT_SUCCESS(rc)) \
3381 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3382 else \
3383 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3384 return rc
3385
3386#define INTERPRET_STAT_CASE(opcode, Instr) \
3387 case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3388
3389 /*
3390 * The actual case statements.
3391 */
3392 INTERPRET_CASE(OP_XCHG,Xchg);
3393 INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3394 INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3395 INTERPRET_CASE(OP_POP,Pop);
3396 INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3397 INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3398 INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3399 INTERPRET_CASE(OP_MOV,Mov);
3400#ifndef IN_RC
3401 INTERPRET_CASE(OP_STOSWD,StosWD);
3402#endif
3403 INTERPRET_CASE(OP_INVLPG,InvlPg);
3404 INTERPRET_CASE(OP_CPUID,CpuId);
3405 INTERPRET_CASE(OP_MOV_CR,MovCRx);
3406 INTERPRET_CASE(OP_MOV_DR,MovDRx);
3407#ifdef IN_RING0
3408 INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3409 INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3410#endif
3411 INTERPRET_CASE(OP_LLDT,LLdt);
3412 INTERPRET_CASE(OP_LMSW,Lmsw);
3413#ifdef EM_EMULATE_SMSW
3414 INTERPRET_CASE(OP_SMSW,Smsw);
3415#endif
3416 INTERPRET_CASE(OP_CLTS,Clts);
3417 INTERPRET_CASE(OP_MONITOR, Monitor);
3418 INTERPRET_CASE(OP_MWAIT, MWait);
3419 INTERPRET_CASE(OP_RDMSR, Rdmsr);
3420 INTERPRET_CASE(OP_WRMSR, Wrmsr);
3421 INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3422 INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3423 INTERPRET_CASE(OP_ADC,Adc);
3424 INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3425 INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3426 INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3427 INTERPRET_CASE(OP_RDPMC,Rdpmc);
3428 INTERPRET_CASE(OP_RDTSC,Rdtsc);
3429 INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3430#ifdef IN_RC
3431 INTERPRET_CASE(OP_STI,Sti);
3432 INTERPRET_CASE(OP_XADD, XAdd);
3433#endif
3434 INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3435 INTERPRET_CASE(OP_HLT,Hlt);
3436 INTERPRET_CASE(OP_IRET,Iret);
3437 INTERPRET_CASE(OP_WBINVD,WbInvd);
3438#ifdef VBOX_WITH_STATISTICS
3439# ifndef IN_RC
3440 INTERPRET_STAT_CASE(OP_XADD, XAdd);
3441# endif
3442 INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3443#endif
3444
3445 default:
3446 Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->opcode));
3447 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3448 return VERR_EM_INTERPRETER;
3449
3450#undef INTERPRET_CASE_EX_PARAM2
3451#undef INTERPRET_STAT_CASE
3452#undef INTERPRET_CASE_EX
3453#undef INTERPRET_CASE
3454 } /* switch (opcode) */
3455 AssertFailed();
3456 return VERR_INTERNAL_ERROR;
3457}
3458
3459
3460/**
3461 * Sets the PC for which interrupts should be inhibited.
3462 *
3463 * @param pVCpu The VMCPU handle.
3464 * @param PC The PC.
3465 */
3466VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
3467{
3468 pVCpu->em.s.GCPtrInhibitInterrupts = PC;
3469 VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3470}
3471
3472
3473/**
3474 * Gets the PC for which interrupts should be inhibited.
3475 *
3476 * There are a few instructions which inhibits or delays interrupts
3477 * for the instruction following them. These instructions are:
3478 * - STI
3479 * - MOV SS, r/m16
3480 * - POP SS
3481 *
3482 * @returns The PC for which interrupts should be inhibited.
3483 * @param pVCpu The VMCPU handle.
3484 *
3485 */
3486VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
3487{
3488 return pVCpu->em.s.GCPtrInhibitInterrupts;
3489}
3490
3491/**
3492 * Locks REM execution to a single VCpu
3493 *
3494 * @param pVM VM handle.
3495 */
3496VMMDECL(void) EMRemLock(PVM pVM)
3497{
3498 if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3499 return; /* early init */
3500
3501 Assert(!PGMIsLockOwner(pVM) && !IOMIsLockOwner(pVM));
3502 int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
3503 AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
3504}
3505
3506/**
3507 * Unlocks REM execution
3508 *
3509 * @param pVM VM handle.
3510 */
3511VMMDECL(void) EMRemUnlock(PVM pVM)
3512{
3513 if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3514 return; /* early init */
3515
3516 PDMCritSectLeave(&pVM->em.s.CritSectREM);
3517}
3518
3519/**
3520 * Check if this VCPU currently owns the REM lock.
3521 *
3522 * @returns bool owner/not owner
3523 * @param pVM The VM to operate on.
3524 */
3525VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
3526{
3527 return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
3528}
3529
3530/**
3531 * Try to acquire the REM lock.
3532 *
3533 * @returns VBox status code
3534 * @param pVM The VM to operate on.
3535 */
3536VMMDECL(int) EMTryEnterRemLock(PVM pVM)
3537{
3538 return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
3539}
3540
3541/**
3542 * Determine if we should continue after encountering a hlt or mwait instruction
3543 *
3544 * @returns boolean
3545 * @param pVCpu The VMCPU to operate on.
3546 * @param pCtx Current CPU context
3547 */
3548VMMDECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
3549{
3550 if ( pCtx->eflags.Bits.u1IF
3551 || ((pVCpu->em.s.mwait.fWait & (EMMWAIT_FLAG_ACTIVE | EMMWAIT_FLAG_BREAKIRQIF0)) == (EMMWAIT_FLAG_ACTIVE | EMMWAIT_FLAG_BREAKIRQIF0)))
3552 {
3553 pVCpu->em.s.mwait.fWait &= ~(EMMWAIT_FLAG_ACTIVE | EMMWAIT_FLAG_BREAKIRQIF0);
3554 return !!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC));
3555 }
3556
3557 return false;
3558}
3559
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette