EMAll.cpp@ 30567

Last change on this file since 30567 was 30567, checked in by vboxsync, 14 years ago
Correct logging statement. Fixes hypervisor assertion
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 112.6 KB

Line
1	/* $Id: EMAll.cpp 30567 2010-07-01 20:02:31Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_EM
22	#include <VBox/em.h>
23	#include <VBox/mm.h>
24	#include <VBox/selm.h>
25	#include <VBox/patm.h>
26	#include <VBox/csam.h>
27	#include <VBox/pgm.h>
28	#include <VBox/iom.h>
29	#include <VBox/stam.h>
30	#include "EMInternal.h"
31	#include <VBox/vm.h>
32	#include <VBox/vmm.h>
33	#include <VBox/hwaccm.h>
34	#include <VBox/tm.h>
35	#include <VBox/pdmapi.h>
36	#include <VBox/param.h>
37	#include <VBox/err.h>
38	#include <VBox/dis.h>
39	#include <VBox/disopcode.h>
40	#include <VBox/log.h>
41	#include <include/internal/pgm.h>
42	#include <iprt/assert.h>
43	#include <iprt/asm.h>
44	#include <iprt/string.h>
45
46
47	/*******************************************************************************
48	* Defined Constants And Macros *
49	*******************************************************************************/
50	/** @def EM_ASSERT_FAULT_RETURN
51	* Safety check.
52	*
53	* Could in theory misfire on a cross page boundary access...
54	*
55	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
56	* turns up an alias page instead of the original faulting one and annoying the
57	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
58	*/
59	#if 0
60	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
61	#else
62	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
63	#endif
64
65	/* Used to pass information during instruction disassembly. */
66	typedef struct
67	{
68	PVM pVM;
69	PVMCPU pVCpu;
70	RTGCPTR GCPtr;
71	uint8_t aOpcode[8];
72	} EMDISSTATE, *PEMDISSTATE;
73
74	/*******************************************************************************
75	* Internal Functions *
76	*******************************************************************************/
77	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize, EMCODETYPE enmCodeType = EMCODETYPE_SUPERVISOR);
78
79
80
81	/**
82	* Get the current execution manager status.
83	*
84	* @returns Current status.
85	* @param pVCpu The VMCPU to operate on.
86	*/
87	VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
88	{
89	return pVCpu->em.s.enmState;
90	}
91
92	/**
93	* Sets the current execution manager status. (use only when you know what you're doing!)
94	*
95	* @param pVCpu The VMCPU to operate on.
96	*/
97	VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
98	{
99	/* Only allowed combination: */
100	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
101	pVCpu->em.s.enmState = enmNewState;
102	}
103
104
105	/**
106	* Read callback for disassembly function; supports reading bytes that cross a page boundary
107	*
108	* @returns VBox status code.
109	* @param pSrc GC source pointer
110	* @param pDest HC destination pointer
111	* @param cb Number of bytes to read
112	* @param dwUserdata Callback specific user data (pDis)
113	*
114	*/
115	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
116	{
117	PDISCPUSTATE pDis = (PDISCPUSTATE)pvUserdata;
118	PEMDISSTATE pState = (PEMDISSTATE)pDis->apvUserData[0];
119	PVM pVM = pState->pVM;
120	PVMCPU pVCpu = pState->pVCpu;
121
122	# ifdef IN_RING0
123	int rc;
124
125	if ( pState->GCPtr
126	&& pSrc + cb <= pState->GCPtr + sizeof(pState->aOpcode))
127	{
128	unsigned offset = pSrc - pState->GCPtr;
129
130	Assert(pSrc >= pState->GCPtr);
131
132	for (unsigned i=0; i<cb; i++)
133	{
134	pDest[i] = pState->aOpcode[offset + i];
135	}
136	return VINF_SUCCESS;
137	}
138
139	rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
140	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for pSrc=%RGv cb=%x rc=%d\n", pSrc, cb, rc));
141	# elif defined(IN_RING3)
142	if (!PATMIsPatchGCAddr(pVM, pSrc))
143	{
144	int rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
145	AssertRC(rc);
146	}
147	else
148	memcpy(pDest, PATMR3GCPtrToHCPtr(pVM, pSrc), cb);
149
150	# elif defined(IN_RC)
151	if (!PATMIsPatchGCAddr(pVM, pSrc))
152	{
153	int rc = MMGCRamRead(pVM, pDest, (void *)(uintptr_t)pSrc, cb);
154	if (rc == VERR_ACCESS_DENIED)
155	{
156	/* Recently flushed; access the data manually. */
157	rc = PGMPhysSimpleReadGCPtr(pVCpu, pDest, pSrc, cb);
158	AssertRC(rc);
159	}
160	}
161	else /* the hypervisor region is always present. */
162	memcpy(pDest, (RTRCPTR)(uintptr_t)pSrc, cb);
163
164	# endif /* IN_RING3 */
165	return VINF_SUCCESS;
166	}
167
168
169	#ifndef IN_RC
170	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
171	{
172	EMDISSTATE State;
173
174	State.pVM = pVM;
175	State.pVCpu = pVCpu;
176	int rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, InstrGC, sizeof(State.aOpcode));
177	if (RT_SUCCESS(rc))
178	{
179	State.GCPtr = InstrGC;
180	}
181	else
182	{
183	if (PAGE_ADDRESS(InstrGC) == PAGE_ADDRESS(InstrGC + sizeof(State.aOpcode) - 1))
184	{
185	if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
186	HWACCMInvalidatePage(pVCpu, InstrGC);
187
188	Log(("emDisCoreOne: read failed with %d\n", rc));
189	return rc;
190	}
191	State.GCPtr = NIL_RTGCPTR;
192	}
193	return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
194	}
195
196	#else /* IN_RC */
197
198	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
199	{
200	EMDISSTATE State;
201
202	State.pVM = pVM;
203	State.pVCpu = pVCpu;
204	State.GCPtr = InstrGC;
205
206	return DISCoreOneEx(InstrGC, pDis->mode, EMReadBytes, &State, pDis, pOpsize);
207	}
208
209	#endif /* IN_RC */
210
211
212	/**
213	* Disassembles one instruction.
214	*
215	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
216	* details.
217	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
218	*
219	* @param pVM The VM handle.
220	* @param pVCpu The VMCPU handle.
221	* @param pCtxCore The context core (used for both the mode and instruction).
222	* @param pDis Where to return the parsed instruction info.
223	* @param pcbInstr Where to return the instruction size. (optional)
224	*/
225	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
226	{
227	RTGCPTR GCPtrInstr;
228	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
229	if (RT_FAILURE(rc))
230	{
231	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
232	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
233	return rc;
234	}
235	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
236	}
237
238
239	/**
240	* Disassembles one instruction.
241	*
242	* This is used by internally by the interpreter and by trap/access handlers.
243	*
244	* @returns VBox status code.
245	* @retval VERR_INTERNAL_ERROR on DISCoreOneEx failure.
246	*
247	* @param pVM The VM handle.
248	* @param pVCpu The VMCPU handle.
249	* @param GCPtrInstr The flat address of the instruction.
250	* @param pCtxCore The context core (used to determine the cpu mode).
251	* @param pDis Where to return the parsed instruction info.
252	* @param pcbInstr Where to return the instruction size. (optional)
253	*/
254	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
255	{
256	int rc;
257	EMDISSTATE State;
258
259	State.pVM = pVM;
260	State.pVCpu = pVCpu;
261
262	#ifdef IN_RC
263	State.GCPtr = GCPtrInstr;
264	#else /* ring 0/3 */
265	rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, GCPtrInstr, sizeof(State.aOpcode));
266	if (RT_SUCCESS(rc))
267	{
268	State.GCPtr = GCPtrInstr;
269	}
270	else
271	{
272	if (PAGE_ADDRESS(GCPtrInstr) == PAGE_ADDRESS(GCPtrInstr + sizeof(State.aOpcode) - 1))
273	{
274	if (rc == VERR_PAGE_TABLE_NOT_PRESENT)
275	HWACCMInvalidatePage(pVCpu, GCPtrInstr);
276
277	Log(("EMInterpretDisasOneEx: read failed with %d\n", rc));
278	return rc;
279	}
280	State.GCPtr = NIL_RTGCPTR;
281	}
282	#endif
283
284	rc = DISCoreOneEx(GCPtrInstr, SELMGetCpuModeFromSelector(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid),
285	EMReadBytes, &State,
286	pDis, pcbInstr);
287	if (RT_SUCCESS(rc))
288	return VINF_SUCCESS;
289	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
290	return VERR_INTERNAL_ERROR;
291	}
292
293
294	/**
295	* Interprets the current instruction.
296	*
297	* @returns VBox status code.
298	* @retval VINF_* Scheduling instructions.
299	* @retval VERR_EM_INTERPRETER Something we can't cope with.
300	* @retval VERR_* Fatal errors.
301	*
302	* @param pVM The VM handle.
303	* @param pVCpu The VMCPU handle.
304	* @param pRegFrame The register frame.
305	* Updates the EIP if an instruction was executed successfully.
306	* @param pvFault The fault address (CR2).
307	* @param pcbSize Size of the write (if applicable).
308	*
309	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
310	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
311	* to worry about e.g. invalid modrm combinations (!)
312	*/
313	VMMDECL(int) EMInterpretInstruction(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
314	{
315	RTGCPTR pbCode;
316
317	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
318	int rc = SELMToFlatEx(pVM, DIS_SELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
319	if (RT_SUCCESS(rc))
320	{
321	uint32_t cbOp;
322	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
323	pDis->mode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
324	rc = emDisCoreOne(pVM, pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
325	if (RT_SUCCESS(rc))
326	{
327	Assert(cbOp == pDis->opsize);
328	rc = EMInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize);
329	if (RT_SUCCESS(rc))
330	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
331
332	return rc;
333	}
334	}
335	return VERR_EM_INTERPRETER;
336	}
337
338
339	/**
340	* Interprets the current instruction using the supplied DISCPUSTATE structure.
341	*
342	* EIP is NOT updated!
343	*
344	* @returns VBox status code.
345	* @retval VINF_* Scheduling instructions. When these are returned, it
346	* starts to get a bit tricky to know whether code was
347	* executed or not... We'll address this when it becomes a problem.
348	* @retval VERR_EM_INTERPRETER Something we can't cope with.
349	* @retval VERR_* Fatal errors.
350	*
351	* @param pVM The VM handle.
352	* @param pVCpu The VMCPU handle.
353	* @param pDis The disassembler cpu state for the instruction to be
354	* interpreted.
355	* @param pRegFrame The register frame. EIP is NOT changed!
356	* @param pvFault The fault address (CR2).
357	* @param pcbSize Size of the write (if applicable).
358	* @param enmCodeType Code type (user/supervisor)
359	*
360	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
361	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
362	* to worry about e.g. invalid modrm combinations (!)
363	*
364	* @todo At this time we do NOT check if the instruction overwrites vital information.
365	* Make sure this can't happen!! (will add some assertions/checks later)
366	*/
367	VMMDECL(int) EMInterpretInstructionCPUEx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize, EMCODETYPE enmCodeType)
368	{
369	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
370	int rc = emInterpretInstructionCPU(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, enmCodeType);
371	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
372	if (RT_SUCCESS(rc))
373	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
374	else
375	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
376	return rc;
377	}
378
379
380	/**
381	* Interpret a port I/O instruction.
382	*
383	* @returns VBox status code suitable for scheduling.
384	* @param pVM The VM handle.
385	* @param pVCpu The VMCPU handle.
386	* @param pCtxCore The context core. This will be updated on successful return.
387	* @param pDis The instruction to interpret.
388	* @param cbOp The size of the instruction.
389	* @remark This may raise exceptions.
390	*/
391	VMMDECL(VBOXSTRICTRC) EMInterpretPortIO(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, uint32_t cbOp)
392	{
393	/*
394	* Hand it on to IOM.
395	*/
396	#ifdef IN_RC
397	VBOXSTRICTRC rcStrict = IOMGCIOPortHandler(pVM, pCtxCore, pDis);
398	if (IOM_SUCCESS(rcStrict))
399	pCtxCore->rip += cbOp;
400	return rcStrict;
401	#else
402	AssertReleaseMsgFailed(("not implemented\n"));
403	return VERR_NOT_IMPLEMENTED;
404	#endif
405	}
406
407
408	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
409	{
410	#ifdef IN_RC
411	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
412	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
413	return rc;
414	/*
415	* The page pool cache may end up here in some cases because it
416	* flushed one of the shadow mappings used by the trapping
417	* instruction and it either flushed the TLB or the CPU reused it.
418	*/
419	#endif
420	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
421	}
422
423
424	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
425	{
426	/* Don't use MMGCRamWrite here as it does not respect zero pages, shared
427	pages or write monitored pages. */
428	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
429	}
430
431
432	/** Convert sel:addr to a flat GC address. */
433	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, POP_PARAMETER pParam, RTGCPTR pvAddr)
434	{
435	DIS_SELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
436	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
437	}
438
439
440	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
441	/**
442	* Get the mnemonic for the disassembled instruction.
443	*
444	* GC/R0 doesn't include the strings in the DIS tables because
445	* of limited space.
446	*/
447	static const char *emGetMnemonic(PDISCPUSTATE pDis)
448	{
449	switch (pDis->pCurInstr->opcode)
450	{
451	case OP_XCHG: return "Xchg";
452	case OP_DEC: return "Dec";
453	case OP_INC: return "Inc";
454	case OP_POP: return "Pop";
455	case OP_OR: return "Or";
456	case OP_AND: return "And";
457	case OP_MOV: return "Mov";
458	case OP_INVLPG: return "InvlPg";
459	case OP_CPUID: return "CpuId";
460	case OP_MOV_CR: return "MovCRx";
461	case OP_MOV_DR: return "MovDRx";
462	case OP_LLDT: return "LLdt";
463	case OP_LGDT: return "LGdt";
464	case OP_LIDT: return "LIdt";
465	case OP_CLTS: return "Clts";
466	case OP_MONITOR: return "Monitor";
467	case OP_MWAIT: return "MWait";
468	case OP_RDMSR: return "Rdmsr";
469	case OP_WRMSR: return "Wrmsr";
470	case OP_ADD: return "Add";
471	case OP_ADC: return "Adc";
472	case OP_SUB: return "Sub";
473	case OP_SBB: return "Sbb";
474	case OP_RDTSC: return "Rdtsc";
475	case OP_STI: return "Sti";
476	case OP_CLI: return "Cli";
477	case OP_XADD: return "XAdd";
478	case OP_HLT: return "Hlt";
479	case OP_IRET: return "Iret";
480	case OP_MOVNTPS: return "MovNTPS";
481	case OP_STOSWD: return "StosWD";
482	case OP_WBINVD: return "WbInvd";
483	case OP_XOR: return "Xor";
484	case OP_BTR: return "Btr";
485	case OP_BTS: return "Bts";
486	case OP_BTC: return "Btc";
487	case OP_LMSW: return "Lmsw";
488	case OP_SMSW: return "Smsw";
489	case OP_CMPXCHG: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
490	case OP_CMPXCHG8B: return pDis->prefix & PREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
491
492	default:
493	Log(("Unknown opcode %d\n", pDis->pCurInstr->opcode));
494	return "???";
495	}
496	}
497	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
498
499
500	/**
501	* XCHG instruction emulation.
502	*/
503	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
504	{
505	OP_PARAMVAL param1, param2;
506
507	/* Source to make DISQueryParamVal read the register value - ugly hack */
508	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
509	if(RT_FAILURE(rc))
510	return VERR_EM_INTERPRETER;
511
512	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
513	if(RT_FAILURE(rc))
514	return VERR_EM_INTERPRETER;
515
516	#ifdef IN_RC
517	if (TRPMHasTrap(pVCpu))
518	{
519	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
520	{
521	#endif
522	RTGCPTR pParam1 = 0, pParam2 = 0;
523	uint64_t valpar1, valpar2;
524
525	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
526	switch(param1.type)
527	{
528	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
529	valpar1 = param1.val.val64;
530	break;
531
532	case PARMTYPE_ADDRESS:
533	pParam1 = (RTGCPTR)param1.val.val64;
534	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
535	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
536	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
537	if (RT_FAILURE(rc))
538	{
539	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
540	return VERR_EM_INTERPRETER;
541	}
542	break;
543
544	default:
545	AssertFailed();
546	return VERR_EM_INTERPRETER;
547	}
548
549	switch(param2.type)
550	{
551	case PARMTYPE_ADDRESS:
552	pParam2 = (RTGCPTR)param2.val.val64;
553	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pParam2);
554	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
555	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
556	if (RT_FAILURE(rc))
557	{
558	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
559	}
560	break;
561
562	case PARMTYPE_IMMEDIATE:
563	valpar2 = param2.val.val64;
564	break;
565
566	default:
567	AssertFailed();
568	return VERR_EM_INTERPRETER;
569	}
570
571	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
572	if (pParam1 == 0)
573	{
574	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
575	switch(param1.size)
576	{
577	case 1: //special case for AH etc
578	rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t )valpar2); break;
579	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)valpar2); break;
580	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)valpar2); break;
581	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, valpar2); break;
582	default: AssertFailedReturn(VERR_EM_INTERPRETER);
583	}
584	if (RT_FAILURE(rc))
585	return VERR_EM_INTERPRETER;
586	}
587	else
588	{
589	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
590	if (RT_FAILURE(rc))
591	{
592	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
593	return VERR_EM_INTERPRETER;
594	}
595	}
596
597	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
598	if (pParam2 == 0)
599	{
600	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
601	switch(param2.size)
602	{
603	case 1: //special case for AH etc
604	rc = DISWriteReg8(pRegFrame, pDis->param2.base.reg_gen, (uint8_t )valpar1); break;
605	case 2: rc = DISWriteReg16(pRegFrame, pDis->param2.base.reg_gen, (uint16_t)valpar1); break;
606	case 4: rc = DISWriteReg32(pRegFrame, pDis->param2.base.reg_gen, (uint32_t)valpar1); break;
607	case 8: rc = DISWriteReg64(pRegFrame, pDis->param2.base.reg_gen, valpar1); break;
608	default: AssertFailedReturn(VERR_EM_INTERPRETER);
609	}
610	if (RT_FAILURE(rc))
611	return VERR_EM_INTERPRETER;
612	}
613	else
614	{
615	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
616	if (RT_FAILURE(rc))
617	{
618	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
619	return VERR_EM_INTERPRETER;
620	}
621	}
622
623	*pcbSize = param2.size;
624	return VINF_SUCCESS;
625	#ifdef IN_RC
626	}
627	}
628	#endif
629	return VERR_EM_INTERPRETER;
630	}
631
632
633	/**
634	* INC and DEC emulation.
635	*/
636	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
637	PFNEMULATEPARAM2 pfnEmulate)
638	{
639	OP_PARAMVAL param1;
640
641	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
642	if(RT_FAILURE(rc))
643	return VERR_EM_INTERPRETER;
644
645	#ifdef IN_RC
646	if (TRPMHasTrap(pVCpu))
647	{
648	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
649	{
650	#endif
651	RTGCPTR pParam1 = 0;
652	uint64_t valpar1;
653
654	if (param1.type == PARMTYPE_ADDRESS)
655	{
656	pParam1 = (RTGCPTR)param1.val.val64;
657	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
658	#ifdef IN_RC
659	/* Safety check (in theory it could cross a page boundary and fault there though) */
660	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
661	#endif
662	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
663	if (RT_FAILURE(rc))
664	{
665	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
666	return VERR_EM_INTERPRETER;
667	}
668	}
669	else
670	{
671	AssertFailed();
672	return VERR_EM_INTERPRETER;
673	}
674
675	uint32_t eflags;
676
677	eflags = pfnEmulate(&valpar1, param1.size);
678
679	/* Write result back */
680	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
681	if (RT_FAILURE(rc))
682	{
683	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
684	return VERR_EM_INTERPRETER;
685	}
686
687	/* Update guest's eflags and finish. */
688	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
689	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
690
691	/* All done! */
692	*pcbSize = param1.size;
693	return VINF_SUCCESS;
694	#ifdef IN_RC
695	}
696	}
697	#endif
698	return VERR_EM_INTERPRETER;
699	}
700
701
702	/**
703	* POP Emulation.
704	*/
705	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
706	{
707	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
708	OP_PARAMVAL param1;
709	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
710	if(RT_FAILURE(rc))
711	return VERR_EM_INTERPRETER;
712
713	#ifdef IN_RC
714	if (TRPMHasTrap(pVCpu))
715	{
716	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
717	{
718	#endif
719	RTGCPTR pParam1 = 0;
720	uint32_t valpar1;
721	RTGCPTR pStackVal;
722
723	/* Read stack value first */
724	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == CPUMODE_16BIT)
725	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
726
727	/* Convert address; don't bother checking limits etc, as we only read here */
728	pStackVal = SELMToFlat(pVM, DIS_SELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
729	if (pStackVal == 0)
730	return VERR_EM_INTERPRETER;
731
732	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
733	if (RT_FAILURE(rc))
734	{
735	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
736	return VERR_EM_INTERPRETER;
737	}
738
739	if (param1.type == PARMTYPE_ADDRESS)
740	{
741	pParam1 = (RTGCPTR)param1.val.val64;
742
743	/* pop [esp+xx] uses esp after the actual pop! */
744	AssertCompile(USE_REG_ESP == USE_REG_SP);
745	if ( (pDis->param1.flags & USE_BASE)
746	&& (pDis->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
747	&& pDis->param1.base.reg_gen == USE_REG_ESP
748	)
749	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
750
751	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
752	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
753	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
754	if (RT_FAILURE(rc))
755	{
756	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
757	return VERR_EM_INTERPRETER;
758	}
759
760	/* Update ESP as the last step */
761	pRegFrame->esp += param1.size;
762	}
763	else
764	{
765	#ifndef DEBUG_bird // annoying assertion.
766	AssertFailed();
767	#endif
768	return VERR_EM_INTERPRETER;
769	}
770
771	/* All done! */
772	*pcbSize = param1.size;
773	return VINF_SUCCESS;
774	#ifdef IN_RC
775	}
776	}
777	#endif
778	return VERR_EM_INTERPRETER;
779	}
780
781
782	/**
783	* XOR/OR/AND Emulation.
784	*/
785	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
786	PFNEMULATEPARAM3 pfnEmulate)
787	{
788	OP_PARAMVAL param1, param2;
789
790	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
791	if(RT_FAILURE(rc))
792	return VERR_EM_INTERPRETER;
793
794	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
795	if(RT_FAILURE(rc))
796	return VERR_EM_INTERPRETER;
797
798	#ifdef IN_RC
799	if (TRPMHasTrap(pVCpu))
800	{
801	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
802	{
803	#endif
804	RTGCPTR pParam1;
805	uint64_t valpar1, valpar2;
806
807	if (pDis->param1.size != pDis->param2.size)
808	{
809	if (pDis->param1.size < pDis->param2.size)
810	{
811	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
812	return VERR_EM_INTERPRETER;
813	}
814	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
815	pDis->param2.size = pDis->param1.size;
816	param2.size = param1.size;
817	}
818
819	/* The destination is always a virtual address */
820	if (param1.type == PARMTYPE_ADDRESS)
821	{
822	pParam1 = (RTGCPTR)param1.val.val64;
823	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
824	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
825	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
826	if (RT_FAILURE(rc))
827	{
828	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
829	return VERR_EM_INTERPRETER;
830	}
831	}
832	else
833	{
834	AssertFailed();
835	return VERR_EM_INTERPRETER;
836	}
837
838	/* Register or immediate data */
839	switch(param2.type)
840	{
841	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
842	valpar2 = param2.val.val64;
843	break;
844
845	default:
846	AssertFailed();
847	return VERR_EM_INTERPRETER;
848	}
849
850	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
851
852	/* Data read, emulate instruction. */
853	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
854
855	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
856
857	/* Update guest's eflags and finish. */
858	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
859	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
860
861	/* And write it back */
862	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
863	if (RT_SUCCESS(rc))
864	{
865	/* All done! */
866	*pcbSize = param2.size;
867	return VINF_SUCCESS;
868	}
869	#ifdef IN_RC
870	}
871	}
872	#endif
873	return VERR_EM_INTERPRETER;
874	}
875
876
877	/**
878	* LOCK XOR/OR/AND Emulation.
879	*/
880	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
881	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
882	{
883	void *pvParam1;
884	OP_PARAMVAL param1, param2;
885
886	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
887	Assert(pDis->param1.size <= 4);
888	#endif
889
890	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
891	if(RT_FAILURE(rc))
892	return VERR_EM_INTERPRETER;
893
894	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
895	if(RT_FAILURE(rc))
896	return VERR_EM_INTERPRETER;
897
898	if (pDis->param1.size != pDis->param2.size)
899	{
900	AssertMsgReturn(pDis->param1.size >= pDis->param2.size, /* should never happen! */
901	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size),
902	VERR_EM_INTERPRETER);
903
904	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
905	pDis->param2.size = pDis->param1.size;
906	param2.size = param1.size;
907	}
908
909	#ifdef IN_RC
910	/* Safety check (in theory it could cross a page boundary and fault there though) */
911	Assert( TRPMHasTrap(pVCpu)
912	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
913	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
914	#endif
915
916	/* Register and immediate data == PARMTYPE_IMMEDIATE */
917	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
918	RTGCUINTREG ValPar2 = param2.val.val64;
919
920	/* The destination is always a virtual address */
921	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
922
923	RTGCPTR GCPtrPar1 = param1.val.val64;
924	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
925	PGMPAGEMAPLOCK Lock;
926	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
927	AssertRCReturn(rc, VERR_EM_INTERPRETER);
928
929	/* Try emulate it with a one-shot #PF handler in place. (RC) */
930	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
931
932	RTGCUINTREG32 eflags = 0;
933	rc = pfnEmulate(pvParam1, ValPar2, pDis->param2.size, &eflags);
934	PGMPhysReleasePageMappingLock(pVM, &Lock);
935	if (RT_FAILURE(rc))
936	{
937	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
938	return VERR_EM_INTERPRETER;
939	}
940
941	/* Update guest's eflags and finish. */
942	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
943	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
944
945	*pcbSize = param2.size;
946	return VINF_SUCCESS;
947	}
948
949
950	/**
951	* ADD, ADC & SUB Emulation.
952	*/
953	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
954	PFNEMULATEPARAM3 pfnEmulate)
955	{
956	OP_PARAMVAL param1, param2;
957	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
958	if(RT_FAILURE(rc))
959	return VERR_EM_INTERPRETER;
960
961	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
962	if(RT_FAILURE(rc))
963	return VERR_EM_INTERPRETER;
964
965	#ifdef IN_RC
966	if (TRPMHasTrap(pVCpu))
967	{
968	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
969	{
970	#endif
971	RTGCPTR pParam1;
972	uint64_t valpar1, valpar2;
973
974	if (pDis->param1.size != pDis->param2.size)
975	{
976	if (pDis->param1.size < pDis->param2.size)
977	{
978	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->param1.size, pDis->param2.size)); /* should never happen! */
979	return VERR_EM_INTERPRETER;
980	}
981	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
982	pDis->param2.size = pDis->param1.size;
983	param2.size = param1.size;
984	}
985
986	/* The destination is always a virtual address */
987	if (param1.type == PARMTYPE_ADDRESS)
988	{
989	pParam1 = (RTGCPTR)param1.val.val64;
990	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
991	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
992	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
993	if (RT_FAILURE(rc))
994	{
995	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
996	return VERR_EM_INTERPRETER;
997	}
998	}
999	else
1000	{
1001	#ifndef DEBUG_bird
1002	AssertFailed();
1003	#endif
1004	return VERR_EM_INTERPRETER;
1005	}
1006
1007	/* Register or immediate data */
1008	switch(param2.type)
1009	{
1010	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1011	valpar2 = param2.val.val64;
1012	break;
1013
1014	default:
1015	AssertFailed();
1016	return VERR_EM_INTERPRETER;
1017	}
1018
1019	/* Data read, emulate instruction. */
1020	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1021
1022	/* Update guest's eflags and finish. */
1023	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1024	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1025
1026	/* And write it back */
1027	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1028	if (RT_SUCCESS(rc))
1029	{
1030	/* All done! */
1031	*pcbSize = param2.size;
1032	return VINF_SUCCESS;
1033	}
1034	#ifdef IN_RC
1035	}
1036	}
1037	#endif
1038	return VERR_EM_INTERPRETER;
1039	}
1040
1041
1042	/**
1043	* ADC Emulation.
1044	*/
1045	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1046	{
1047	if (pRegFrame->eflags.Bits.u1CF)
1048	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1049	else
1050	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1051	}
1052
1053
1054	/**
1055	* BTR/C/S Emulation.
1056	*/
1057	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1058	PFNEMULATEPARAM2UINT32 pfnEmulate)
1059	{
1060	OP_PARAMVAL param1, param2;
1061	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1062	if(RT_FAILURE(rc))
1063	return VERR_EM_INTERPRETER;
1064
1065	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1066	if(RT_FAILURE(rc))
1067	return VERR_EM_INTERPRETER;
1068
1069	#ifdef IN_RC
1070	if (TRPMHasTrap(pVCpu))
1071	{
1072	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1073	{
1074	#endif
1075	RTGCPTR pParam1;
1076	uint64_t valpar1 = 0, valpar2;
1077	uint32_t eflags;
1078
1079	/* The destination is always a virtual address */
1080	if (param1.type != PARMTYPE_ADDRESS)
1081	return VERR_EM_INTERPRETER;
1082
1083	pParam1 = (RTGCPTR)param1.val.val64;
1084	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
1085
1086	/* Register or immediate data */
1087	switch(param2.type)
1088	{
1089	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1090	valpar2 = param2.val.val64;
1091	break;
1092
1093	default:
1094	AssertFailed();
1095	return VERR_EM_INTERPRETER;
1096	}
1097
1098	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1099	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1100	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1101	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1102	if (RT_FAILURE(rc))
1103	{
1104	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1105	return VERR_EM_INTERPRETER;
1106	}
1107
1108	Log2(("emInterpretBtx: val=%x\n", valpar1));
1109	/* Data read, emulate bit test instruction. */
1110	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1111
1112	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1113
1114	/* Update guest's eflags and finish. */
1115	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1116	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1117
1118	/* And write it back */
1119	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1120	if (RT_SUCCESS(rc))
1121	{
1122	/* All done! */
1123	*pcbSize = 1;
1124	return VINF_SUCCESS;
1125	}
1126	#ifdef IN_RC
1127	}
1128	}
1129	#endif
1130	return VERR_EM_INTERPRETER;
1131	}
1132
1133
1134	/**
1135	* LOCK BTR/C/S Emulation.
1136	*/
1137	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1138	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1139	{
1140	void *pvParam1;
1141
1142	OP_PARAMVAL param1, param2;
1143	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1144	if(RT_FAILURE(rc))
1145	return VERR_EM_INTERPRETER;
1146
1147	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1148	if(RT_FAILURE(rc))
1149	return VERR_EM_INTERPRETER;
1150
1151	/* The destination is always a virtual address */
1152	if (param1.type != PARMTYPE_ADDRESS)
1153	return VERR_EM_INTERPRETER;
1154
1155	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1156	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1157	uint64_t ValPar2 = param2.val.val64;
1158
1159	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1160	RTGCPTR GCPtrPar1 = param1.val.val64;
1161	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1162	ValPar2 &= 7;
1163
1164	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1165	#ifdef IN_RC
1166	Assert(TRPMHasTrap(pVCpu));
1167	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1168	#endif
1169
1170	PGMPAGEMAPLOCK Lock;
1171	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1172	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1173
1174	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1175
1176	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1177	RTGCUINTREG32 eflags = 0;
1178	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1179	PGMPhysReleasePageMappingLock(pVM, &Lock);
1180	if (RT_FAILURE(rc))
1181	{
1182	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1183	emGetMnemonic(pDis), GCPtrPar1, pDis->param2.size*8, ValPar2));
1184	return VERR_EM_INTERPRETER;
1185	}
1186
1187	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1188
1189	/* Update guest's eflags and finish. */
1190	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1191	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1192
1193	*pcbSize = 1;
1194	return VINF_SUCCESS;
1195	}
1196
1197
1198	/**
1199	* MOV emulation.
1200	*/
1201	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1202	{
1203	OP_PARAMVAL param1, param2;
1204	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_DEST);
1205	if(RT_FAILURE(rc))
1206	return VERR_EM_INTERPRETER;
1207
1208	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1209	if(RT_FAILURE(rc))
1210	return VERR_EM_INTERPRETER;
1211
1212	#ifdef IN_RC
1213	if (TRPMHasTrap(pVCpu))
1214	{
1215	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1216	{
1217	#else
1218	/** @todo Make this the default and don't rely on TRPM information. */
1219	if (param1.type == PARMTYPE_ADDRESS)
1220	{
1221	#endif
1222	RTGCPTR pDest;
1223	uint64_t val64;
1224
1225	switch(param1.type)
1226	{
1227	case PARMTYPE_IMMEDIATE:
1228	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1229	return VERR_EM_INTERPRETER;
1230	/* fallthru */
1231
1232	case PARMTYPE_ADDRESS:
1233	pDest = (RTGCPTR)param1.val.val64;
1234	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pDest);
1235	break;
1236
1237	default:
1238	AssertFailed();
1239	return VERR_EM_INTERPRETER;
1240	}
1241
1242	switch(param2.type)
1243	{
1244	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1245	val64 = param2.val.val64;
1246	break;
1247
1248	default:
1249	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1250	return VERR_EM_INTERPRETER;
1251	}
1252	#ifdef LOG_ENABLED
1253	if (pDis->mode == CPUMODE_64BIT)
1254	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1255	else
1256	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1257	#endif
1258
1259	Assert(param2.size <= 8 && param2.size > 0);
1260	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1261	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1262	if (RT_FAILURE(rc))
1263	return VERR_EM_INTERPRETER;
1264
1265	*pcbSize = param2.size;
1266	}
1267	else
1268	{ /* read fault */
1269	RTGCPTR pSrc;
1270	uint64_t val64;
1271
1272	/* Source */
1273	switch(param2.type)
1274	{
1275	case PARMTYPE_IMMEDIATE:
1276	if(!(param2.flags & (PARAM_VAL32\|PARAM_VAL64)))
1277	return VERR_EM_INTERPRETER;
1278	/* fallthru */
1279
1280	case PARMTYPE_ADDRESS:
1281	pSrc = (RTGCPTR)param2.val.val64;
1282	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param2, pSrc);
1283	break;
1284
1285	default:
1286	return VERR_EM_INTERPRETER;
1287	}
1288
1289	Assert(param1.size <= 8 && param1.size > 0);
1290	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1291	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1292	if (RT_FAILURE(rc))
1293	return VERR_EM_INTERPRETER;
1294
1295	/* Destination */
1296	switch(param1.type)
1297	{
1298	case PARMTYPE_REGISTER:
1299	switch(param1.size)
1300	{
1301	case 1: rc = DISWriteReg8(pRegFrame, pDis->param1.base.reg_gen, (uint8_t) val64); break;
1302	case 2: rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, (uint16_t)val64); break;
1303	case 4: rc = DISWriteReg32(pRegFrame, pDis->param1.base.reg_gen, (uint32_t)val64); break;
1304	case 8: rc = DISWriteReg64(pRegFrame, pDis->param1.base.reg_gen, val64); break;
1305	default:
1306	return VERR_EM_INTERPRETER;
1307	}
1308	if (RT_FAILURE(rc))
1309	return rc;
1310	break;
1311
1312	default:
1313	return VERR_EM_INTERPRETER;
1314	}
1315	#ifdef LOG_ENABLED
1316	if (pDis->mode == CPUMODE_64BIT)
1317	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1318	else
1319	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1320	#endif
1321	}
1322	return VINF_SUCCESS;
1323	#ifdef IN_RC
1324	}
1325	#endif
1326	return VERR_EM_INTERPRETER;
1327	}
1328
1329
1330	#ifndef IN_RC
1331	/**
1332	* [REP] STOSWD emulation
1333	*/
1334	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1335	{
1336	int rc;
1337	RTGCPTR GCDest, GCOffset;
1338	uint32_t cbSize;
1339	uint64_t cTransfers;
1340	int offIncrement;
1341
1342	/* Don't support any but these three prefix bytes. */
1343	if ((pDis->prefix & ~(PREFIX_ADDRSIZE\|PREFIX_OPSIZE\|PREFIX_REP\|PREFIX_REX)))
1344	return VERR_EM_INTERPRETER;
1345
1346	switch (pDis->addrmode)
1347	{
1348	case CPUMODE_16BIT:
1349	GCOffset = pRegFrame->di;
1350	cTransfers = pRegFrame->cx;
1351	break;
1352	case CPUMODE_32BIT:
1353	GCOffset = pRegFrame->edi;
1354	cTransfers = pRegFrame->ecx;
1355	break;
1356	case CPUMODE_64BIT:
1357	GCOffset = pRegFrame->rdi;
1358	cTransfers = pRegFrame->rcx;
1359	break;
1360	default:
1361	AssertFailed();
1362	return VERR_EM_INTERPRETER;
1363	}
1364
1365	GCDest = SELMToFlat(pVM, DIS_SELREG_ES, pRegFrame, GCOffset);
1366	switch (pDis->opmode)
1367	{
1368	case CPUMODE_16BIT:
1369	cbSize = 2;
1370	break;
1371	case CPUMODE_32BIT:
1372	cbSize = 4;
1373	break;
1374	case CPUMODE_64BIT:
1375	cbSize = 8;
1376	break;
1377	default:
1378	AssertFailed();
1379	return VERR_EM_INTERPRETER;
1380	}
1381
1382	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1383
1384	if (!(pDis->prefix & PREFIX_REP))
1385	{
1386	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1387
1388	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1389	if (RT_FAILURE(rc))
1390	return VERR_EM_INTERPRETER;
1391	Assert(rc == VINF_SUCCESS);
1392
1393	/* Update (e/r)di. */
1394	switch (pDis->addrmode)
1395	{
1396	case CPUMODE_16BIT:
1397	pRegFrame->di += offIncrement;
1398	break;
1399	case CPUMODE_32BIT:
1400	pRegFrame->edi += offIncrement;
1401	break;
1402	case CPUMODE_64BIT:
1403	pRegFrame->rdi += offIncrement;
1404	break;
1405	default:
1406	AssertFailed();
1407	return VERR_EM_INTERPRETER;
1408	}
1409
1410	}
1411	else
1412	{
1413	if (!cTransfers)
1414	return VINF_SUCCESS;
1415
1416	/*
1417	* Do not try emulate cross page stuff here because we don't know what might
1418	* be waiting for us on the subsequent pages. The caller has only asked us to
1419	* ignore access handlers fro the current page.
1420	* This also fends off big stores which would quickly kill PGMR0DynMap.
1421	*/
1422	if ( cbSize > PAGE_SIZE
1423	\|\| cTransfers > PAGE_SIZE
1424	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1425	{
1426	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1427	GCDest, cbSize, offIncrement, cTransfers));
1428	return VERR_EM_INTERPRETER;
1429	}
1430
1431	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1432	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1433	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1434	cTransfers * cbSize,
1435	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1436	if (rc != VINF_SUCCESS)
1437	{
1438	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1439	return VERR_EM_INTERPRETER;
1440	}
1441
1442	/* REP case */
1443	while (cTransfers)
1444	{
1445	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1446	if (RT_FAILURE(rc))
1447	{
1448	rc = VERR_EM_INTERPRETER;
1449	break;
1450	}
1451
1452	Assert(rc == VINF_SUCCESS);
1453	GCOffset += offIncrement;
1454	GCDest += offIncrement;
1455	cTransfers--;
1456	}
1457
1458	/* Update the registers. */
1459	switch (pDis->addrmode)
1460	{
1461	case CPUMODE_16BIT:
1462	pRegFrame->di = GCOffset;
1463	pRegFrame->cx = cTransfers;
1464	break;
1465	case CPUMODE_32BIT:
1466	pRegFrame->edi = GCOffset;
1467	pRegFrame->ecx = cTransfers;
1468	break;
1469	case CPUMODE_64BIT:
1470	pRegFrame->rdi = GCOffset;
1471	pRegFrame->rcx = cTransfers;
1472	break;
1473	default:
1474	AssertFailed();
1475	return VERR_EM_INTERPRETER;
1476	}
1477	}
1478
1479	*pcbSize = cbSize;
1480	return rc;
1481	}
1482	#endif /* !IN_RC */
1483
1484
1485	/**
1486	* [LOCK] CMPXCHG emulation.
1487	*/
1488	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1489	{
1490	OP_PARAMVAL param1, param2;
1491
1492	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1493	Assert(pDis->param1.size <= 4);
1494	#endif
1495
1496	/* Source to make DISQueryParamVal read the register value - ugly hack */
1497	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1498	if(RT_FAILURE(rc))
1499	return VERR_EM_INTERPRETER;
1500
1501	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param2, &param2, PARAM_SOURCE);
1502	if(RT_FAILURE(rc))
1503	return VERR_EM_INTERPRETER;
1504
1505	uint64_t valpar;
1506	switch(param2.type)
1507	{
1508	case PARMTYPE_IMMEDIATE: /* register actually */
1509	valpar = param2.val.val64;
1510	break;
1511
1512	default:
1513	return VERR_EM_INTERPRETER;
1514	}
1515
1516	PGMPAGEMAPLOCK Lock;
1517	RTGCPTR GCPtrPar1;
1518	void *pvParam1;
1519	uint64_t eflags;
1520
1521	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1522	switch(param1.type)
1523	{
1524	case PARMTYPE_ADDRESS:
1525	GCPtrPar1 = param1.val.val64;
1526	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1527
1528	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1529	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1530	break;
1531
1532	default:
1533	return VERR_EM_INTERPRETER;
1534	}
1535
1536	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1537
1538	if (pDis->prefix & PREFIX_LOCK)
1539	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1540	else
1541	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->param2.size);
1542
1543	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1544
1545	/* Update guest's eflags and finish. */
1546	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1547	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1548
1549	*pcbSize = param2.size;
1550	PGMPhysReleasePageMappingLock(pVM, &Lock);
1551	return VINF_SUCCESS;
1552	}
1553
1554
1555	/**
1556	* [LOCK] CMPXCHG8B emulation.
1557	*/
1558	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1559	{
1560	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1561	OP_PARAMVAL param1;
1562
1563	/* Source to make DISQueryParamVal read the register value - ugly hack */
1564	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1565	if(RT_FAILURE(rc))
1566	return VERR_EM_INTERPRETER;
1567
1568	RTGCPTR GCPtrPar1;
1569	void *pvParam1;
1570	uint64_t eflags;
1571	PGMPAGEMAPLOCK Lock;
1572
1573	AssertReturn(pDis->param1.size == 8, VERR_EM_INTERPRETER);
1574	switch(param1.type)
1575	{
1576	case PARMTYPE_ADDRESS:
1577	GCPtrPar1 = param1.val.val64;
1578	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, GCPtrPar1);
1579
1580	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1581	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1582	break;
1583
1584	default:
1585	return VERR_EM_INTERPRETER;
1586	}
1587
1588	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1589
1590	if (pDis->prefix & PREFIX_LOCK)
1591	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1592	else
1593	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1594
1595	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1596
1597	/* Update guest's eflags and finish; note that only ZF is affected. */
1598	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1599	\| (eflags & (X86_EFL_ZF));
1600
1601	*pcbSize = 8;
1602	PGMPhysReleasePageMappingLock(pVM, &Lock);
1603	return VINF_SUCCESS;
1604	}
1605
1606
1607	#ifdef IN_RC /** @todo test+enable for HWACCM as well. */
1608	/**
1609	* [LOCK] XADD emulation.
1610	*/
1611	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1612	{
1613	Assert(pDis->mode != CPUMODE_64BIT); /** @todo check */
1614	OP_PARAMVAL param1;
1615	void *pvParamReg2;
1616	size_t cbParamReg2;
1617
1618	/* Source to make DISQueryParamVal read the register value - ugly hack */
1619	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1620	if(RT_FAILURE(rc))
1621	return VERR_EM_INTERPRETER;
1622
1623	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->param2, &pvParamReg2, &cbParamReg2);
1624	Assert(cbParamReg2 <= 4);
1625	if(RT_FAILURE(rc))
1626	return VERR_EM_INTERPRETER;
1627
1628	#ifdef IN_RC
1629	if (TRPMHasTrap(pVCpu))
1630	{
1631	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1632	{
1633	#endif
1634	RTGCPTR GCPtrPar1;
1635	void *pvParam1;
1636	uint32_t eflags;
1637	PGMPAGEMAPLOCK Lock;
1638
1639	AssertReturn(pDis->param1.size == pDis->param2.size, VERR_EM_INTERPRETER);
1640	switch(param1.type)
1641	{
1642	case PARMTYPE_ADDRESS:
1643	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, (RTRCUINTPTR)param1.val.val64);
1644	#ifdef IN_RC
1645	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
1646	#endif
1647
1648	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1649	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1650	break;
1651
1652	default:
1653	return VERR_EM_INTERPRETER;
1654	}
1655
1656	LogFlow(("XAdd %RGv=%p reg=%08llx\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2));
1657
1658	if (pDis->prefix & PREFIX_LOCK)
1659	eflags = EMEmulateLockXAdd(pvParam1, pvParamReg2, cbParamReg2);
1660	else
1661	eflags = EMEmulateXAdd(pvParam1, pvParamReg2, cbParamReg2);
1662
1663	LogFlow(("XAdd %RGv=%p reg=%08llx ZF=%d\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2, !!(eflags & X86_EFL_ZF) ));
1664
1665	/* Update guest's eflags and finish. */
1666	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1667	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1668
1669	*pcbSize = cbParamReg2;
1670	PGMPhysReleasePageMappingLock(pVM, &Lock);
1671	return VINF_SUCCESS;
1672	#ifdef IN_RC
1673	}
1674	}
1675
1676	return VERR_EM_INTERPRETER;
1677	#endif
1678	}
1679	#endif /* IN_RC */
1680
1681
1682	#ifdef IN_RC
1683	/**
1684	* Interpret IRET (currently only to V86 code)
1685	*
1686	* @returns VBox status code.
1687	* @param pVM The VM handle.
1688	* @param pVCpu The VMCPU handle.
1689	* @param pRegFrame The register frame.
1690	*
1691	*/
1692	VMMDECL(int) EMInterpretIret(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1693	{
1694	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1695	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1696	int rc;
1697
1698	Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
1699
1700	rc = emRamRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1701	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1702	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1703	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1704	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1705
1706	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1707	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1708	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1709	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1710	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1711	rc \|= emRamRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1712	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1713
1714	pRegFrame->eip = eip & 0xffff;
1715	pRegFrame->cs = cs;
1716
1717	/* Mask away all reserved bits */
1718	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1719	eflags &= uMask;
1720
1721	#ifndef IN_RING0
1722	CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
1723	#endif
1724	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1725
1726	pRegFrame->esp = esp;
1727	pRegFrame->ss = ss;
1728	pRegFrame->ds = ds;
1729	pRegFrame->es = es;
1730	pRegFrame->fs = fs;
1731	pRegFrame->gs = gs;
1732
1733	return VINF_SUCCESS;
1734	}
1735	#endif /* IN_RC */
1736
1737
1738	/**
1739	* IRET Emulation.
1740	*/
1741	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1742	{
1743	/* only allow direct calls to EMInterpretIret for now */
1744	return VERR_EM_INTERPRETER;
1745	}
1746
1747	/**
1748	* WBINVD Emulation.
1749	*/
1750	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1751	{
1752	/* Nothing to do. */
1753	return VINF_SUCCESS;
1754	}
1755
1756
1757	/**
1758	* Interpret INVLPG
1759	*
1760	* @returns VBox status code.
1761	* @param pVM The VM handle.
1762	* @param pVCpu The VMCPU handle.
1763	* @param pRegFrame The register frame.
1764	* @param pAddrGC Operand address
1765	*
1766	*/
1767	VMMDECL(int) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1768	{
1769	int rc;
1770
1771	/** @todo is addr always a flat linear address or ds based
1772	* (in absence of segment override prefixes)????
1773	*/
1774	#ifdef IN_RC
1775	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1776	#endif
1777	rc = PGMInvalidatePage(pVCpu, pAddrGC);
1778	if ( rc == VINF_SUCCESS
1779	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1780	return VINF_SUCCESS;
1781	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1782	("%Rrc addr=%RGv\n", rc, pAddrGC),
1783	VERR_EM_INTERPRETER);
1784	return rc;
1785	}
1786
1787
1788	/**
1789	* INVLPG Emulation.
1790	*/
1791	static int emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1792	{
1793	OP_PARAMVAL param1;
1794	RTGCPTR addr;
1795
1796	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
1797	if(RT_FAILURE(rc))
1798	return VERR_EM_INTERPRETER;
1799
1800	switch(param1.type)
1801	{
1802	case PARMTYPE_IMMEDIATE:
1803	case PARMTYPE_ADDRESS:
1804	if(!(param1.flags & (PARAM_VAL32\|PARAM_VAL64)))
1805	return VERR_EM_INTERPRETER;
1806	addr = (RTGCPTR)param1.val.val64;
1807	break;
1808
1809	default:
1810	return VERR_EM_INTERPRETER;
1811	}
1812
1813	/** @todo is addr always a flat linear address or ds based
1814	* (in absence of segment override prefixes)????
1815	*/
1816	#ifdef IN_RC
1817	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
1818	#endif
1819	rc = PGMInvalidatePage(pVCpu, addr);
1820	if ( rc == VINF_SUCCESS
1821	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1822	return VINF_SUCCESS;
1823	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1824	("%Rrc addr=%RGv\n", rc, addr),
1825	VERR_EM_INTERPRETER);
1826	return rc;
1827	}
1828
1829
1830	/**
1831	* Interpret CPUID given the parameters in the CPU context
1832	*
1833	* @returns VBox status code.
1834	* @param pVM The VM handle.
1835	* @param pVCpu The VMCPU handle.
1836	* @param pRegFrame The register frame.
1837	*
1838	*/
1839	VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1840	{
1841	uint32_t iLeaf = pRegFrame->eax;
1842
1843	/* cpuid clears the high dwords of the affected 64 bits registers. */
1844	pRegFrame->rax = 0;
1845	pRegFrame->rbx = 0;
1846	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
1847	pRegFrame->rdx = 0;
1848
1849	/* Note: operates the same in 64 and non-64 bits mode. */
1850	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1851	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1852	return VINF_SUCCESS;
1853	}
1854
1855
1856	/**
1857	* CPUID Emulation.
1858	*/
1859	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1860	{
1861	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
1862	return rc;
1863	}
1864
1865
1866	/**
1867	* Interpret CRx read
1868	*
1869	* @returns VBox status code.
1870	* @param pVM The VM handle.
1871	* @param pVCpu The VMCPU handle.
1872	* @param pRegFrame The register frame.
1873	* @param DestRegGen General purpose register index (USE_REG_E**))
1874	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1875	*
1876	*/
1877	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1878	{
1879	int rc;
1880	uint64_t val64;
1881
1882	if (SrcRegCrx == USE_REG_CR8)
1883	{
1884	val64 = 0;
1885	rc = PDMApicGetTPR(pVCpu, (uint8_t *)&val64, NULL);
1886	AssertMsgRCReturn(rc, ("PDMApicGetTPR failed\n"), VERR_EM_INTERPRETER);
1887	val64 >>= 4; /* bits 7-4 contain the task priority that go in cr8, bits 3-0*/
1888	}
1889	else
1890	{
1891	rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
1892	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1893	}
1894
1895	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
1896	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1897	else
1898	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1899
1900	if(RT_SUCCESS(rc))
1901	{
1902	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
1903	return VINF_SUCCESS;
1904	}
1905	return VERR_EM_INTERPRETER;
1906	}
1907
1908
1909
1910	/**
1911	* Interpret CLTS
1912	*
1913	* @returns VBox status code.
1914	* @param pVM The VM handle.
1915	* @param pVCpu The VMCPU handle.
1916	*
1917	*/
1918	VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
1919	{
1920	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
1921	if (!(cr0 & X86_CR0_TS))
1922	return VINF_SUCCESS;
1923	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
1924	}
1925
1926	/**
1927	* CLTS Emulation.
1928	*/
1929	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1930	{
1931	return EMInterpretCLTS(pVM, pVCpu);
1932	}
1933
1934
1935	/**
1936	* Update CRx
1937	*
1938	* @returns VBox status code.
1939	* @param pVM The VM handle.
1940	* @param pVCpu The VMCPU handle.
1941	* @param pRegFrame The register frame.
1942	* @param DestRegCRx CRx register index (USE_REG_CR*)
1943	* @param val New CRx value
1944	*
1945	*/
1946	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
1947	{
1948	uint64_t oldval;
1949	uint64_t msrEFER;
1950	int rc, rc2;
1951
1952	/** @todo Clean up this mess. */
1953	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
1954	switch (DestRegCrx)
1955	{
1956	case USE_REG_CR0:
1957	oldval = CPUMGetGuestCR0(pVCpu);
1958	#ifdef IN_RC
1959	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
1960	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
1961	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
1962	return VERR_EM_INTERPRETER;
1963	#endif
1964	rc = VINF_SUCCESS;
1965	CPUMSetGuestCR0(pVCpu, val);
1966	val = CPUMGetGuestCR0(pVCpu);
1967	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
1968	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
1969	{
1970	/* global flush */
1971	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
1972	AssertRCReturn(rc, rc);
1973	}
1974
1975	/* Deal with long mode enabling/disabling. */
1976	msrEFER = CPUMGetGuestEFER(pVCpu);
1977	if (msrEFER & MSR_K6_EFER_LME)
1978	{
1979	if ( !(oldval & X86_CR0_PG)
1980	&& (val & X86_CR0_PG))
1981	{
1982	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1983	if (pRegFrame->csHid.Attr.n.u1Long)
1984	{
1985	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
1986	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1987	}
1988
1989	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1990	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
1991	{
1992	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
1993	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1994	}
1995	msrEFER \|= MSR_K6_EFER_LMA;
1996	}
1997	else
1998	if ( (oldval & X86_CR0_PG)
1999	&& !(val & X86_CR0_PG))
2000	{
2001	msrEFER &= ~MSR_K6_EFER_LMA;
2002	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2003	}
2004	CPUMSetGuestEFER(pVCpu, msrEFER);
2005	}
2006	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2007	return rc2 == VINF_SUCCESS ? rc : rc2;
2008
2009	case USE_REG_CR2:
2010	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2011	return VINF_SUCCESS;
2012
2013	case USE_REG_CR3:
2014	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2015	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2016	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2017	{
2018	/* flush */
2019	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2020	AssertRC(rc);
2021	}
2022	return rc;
2023
2024	case USE_REG_CR4:
2025	oldval = CPUMGetGuestCR4(pVCpu);
2026	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2027	val = CPUMGetGuestCR4(pVCpu);
2028
2029	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2030	msrEFER = CPUMGetGuestEFER(pVCpu);
2031	if ( (msrEFER & MSR_K6_EFER_LMA)
2032	&& (oldval & X86_CR4_PAE)
2033	&& !(val & X86_CR4_PAE))
2034	{
2035	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2036	}
2037
2038	rc = VINF_SUCCESS;
2039	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2040	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2041	{
2042	/* global flush */
2043	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2044	AssertRCReturn(rc, rc);
2045	}
2046
2047	/* Feeling extremely lazy. */
2048	# ifdef IN_RC
2049	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2050	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2051	{
2052	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2053	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2054	}
2055	# endif
2056	if ((val ^ oldval) & X86_CR4_VME)
2057	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2058
2059	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2060	return rc2 == VINF_SUCCESS ? rc : rc2;
2061
2062	case USE_REG_CR8:
2063	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2064
2065	default:
2066	AssertFailed();
2067	case USE_REG_CR1: /* illegal op */
2068	break;
2069	}
2070	return VERR_EM_INTERPRETER;
2071	}
2072
2073	/**
2074	* Interpret CRx write
2075	*
2076	* @returns VBox status code.
2077	* @param pVM The VM handle.
2078	* @param pVCpu The VMCPU handle.
2079	* @param pRegFrame The register frame.
2080	* @param DestRegCRx CRx register index (USE_REG_CR*)
2081	* @param SrcRegGen General purpose register index (USE_REG_E**))
2082	*
2083	*/
2084	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2085	{
2086	uint64_t val;
2087	int rc;
2088
2089	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2090	{
2091	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2092	}
2093	else
2094	{
2095	uint32_t val32;
2096	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2097	val = val32;
2098	}
2099
2100	if (RT_SUCCESS(rc))
2101	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2102
2103	return VERR_EM_INTERPRETER;
2104	}
2105
2106	/**
2107	* Interpret LMSW
2108	*
2109	* @returns VBox status code.
2110	* @param pVM The VM handle.
2111	* @param pVCpu The VMCPU handle.
2112	* @param pRegFrame The register frame.
2113	* @param u16Data LMSW source data.
2114	*
2115	*/
2116	VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2117	{
2118	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2119
2120	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2121	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2122	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2123
2124	return emUpdateCRx(pVM, pVCpu, pRegFrame, USE_REG_CR0, NewCr0);
2125	}
2126
2127	/**
2128	* LMSW Emulation.
2129	*/
2130	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2131	{
2132	OP_PARAMVAL param1;
2133	uint32_t val;
2134
2135	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2136	if(RT_FAILURE(rc))
2137	return VERR_EM_INTERPRETER;
2138
2139	switch(param1.type)
2140	{
2141	case PARMTYPE_IMMEDIATE:
2142	case PARMTYPE_ADDRESS:
2143	if(!(param1.flags & PARAM_VAL16))
2144	return VERR_EM_INTERPRETER;
2145	val = param1.val.val32;
2146	break;
2147
2148	default:
2149	return VERR_EM_INTERPRETER;
2150	}
2151
2152	LogFlow(("emInterpretLmsw %x\n", val));
2153	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2154	}
2155
2156	#ifdef EM_EMULATE_SMSW
2157	/**
2158	* SMSW Emulation.
2159	*/
2160	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2161	{
2162	OP_PARAMVAL param1;
2163	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2164
2165	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2166	if(RT_FAILURE(rc))
2167	return VERR_EM_INTERPRETER;
2168
2169	switch(param1.type)
2170	{
2171	case PARMTYPE_IMMEDIATE:
2172	if(param1.size != sizeof(uint16_t))
2173	return VERR_EM_INTERPRETER;
2174	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->param1.base.reg_gen, cr0));
2175	rc = DISWriteReg16(pRegFrame, pDis->param1.base.reg_gen, cr0);
2176	break;
2177
2178	case PARMTYPE_ADDRESS:
2179	{
2180	RTGCPTR pParam1;
2181
2182	/* Actually forced to 16 bits regardless of the operand size. */
2183	if(param1.size != sizeof(uint16_t))
2184	return VERR_EM_INTERPRETER;
2185
2186	pParam1 = (RTGCPTR)param1.val.val64;
2187	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, pParam1);
2188	LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
2189
2190	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2191	if (RT_FAILURE(rc))
2192	{
2193	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2194	return VERR_EM_INTERPRETER;
2195	}
2196	break;
2197	}
2198
2199	default:
2200	return VERR_EM_INTERPRETER;
2201	}
2202
2203	LogFlow(("emInterpretSmsw %x\n", cr0));
2204	return rc;
2205	}
2206	#endif
2207
2208	/**
2209	* MOV CRx
2210	*/
2211	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2212	{
2213	if ((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_CR)
2214	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_ctrl);
2215
2216	if (pDis->param1.flags == USE_REG_CR && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2217	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_ctrl, pDis->param2.base.reg_gen);
2218
2219	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2220	return VERR_EM_INTERPRETER;
2221	}
2222
2223
2224	/**
2225	* Interpret DRx write
2226	*
2227	* @returns VBox status code.
2228	* @param pVM The VM handle.
2229	* @param pVCpu The VMCPU handle.
2230	* @param pRegFrame The register frame.
2231	* @param DestRegDRx DRx register index (USE_REG_DR*)
2232	* @param SrcRegGen General purpose register index (USE_REG_E**))
2233	*
2234	*/
2235	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2236	{
2237	uint64_t val;
2238	int rc;
2239
2240	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2241	{
2242	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2243	}
2244	else
2245	{
2246	uint32_t val32;
2247	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2248	val = val32;
2249	}
2250
2251	if (RT_SUCCESS(rc))
2252	{
2253	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2254	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2255	if (RT_SUCCESS(rc))
2256	return rc;
2257	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2258	}
2259	return VERR_EM_INTERPRETER;
2260	}
2261
2262
2263	/**
2264	* Interpret DRx read
2265	*
2266	* @returns VBox status code.
2267	* @param pVM The VM handle.
2268	* @param pVCpu The VMCPU handle.
2269	* @param pRegFrame The register frame.
2270	* @param DestRegGen General purpose register index (USE_REG_E**))
2271	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2272	*
2273	*/
2274	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2275	{
2276	uint64_t val64;
2277
2278	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2279	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2280	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2281	{
2282	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2283	}
2284	else
2285	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2286
2287	if (RT_SUCCESS(rc))
2288	return VINF_SUCCESS;
2289
2290	return VERR_EM_INTERPRETER;
2291	}
2292
2293
2294	/**
2295	* MOV DRx
2296	*/
2297	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2298	{
2299	int rc = VERR_EM_INTERPRETER;
2300
2301	if((pDis->param1.flags == USE_REG_GEN32 \|\| pDis->param1.flags == USE_REG_GEN64) && pDis->param2.flags == USE_REG_DBG)
2302	{
2303	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_gen, pDis->param2.base.reg_dbg);
2304	}
2305	else
2306	if(pDis->param1.flags == USE_REG_DBG && (pDis->param2.flags == USE_REG_GEN32 \|\| pDis->param2.flags == USE_REG_GEN64))
2307	{
2308	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->param1.base.reg_dbg, pDis->param2.base.reg_gen);
2309	}
2310	else
2311	AssertMsgFailed(("Unexpected debug register move\n"));
2312
2313	return rc;
2314	}
2315
2316
2317	/**
2318	* LLDT Emulation.
2319	*/
2320	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2321	{
2322	OP_PARAMVAL param1;
2323	RTSEL sel;
2324
2325	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2326	if(RT_FAILURE(rc))
2327	return VERR_EM_INTERPRETER;
2328
2329	switch(param1.type)
2330	{
2331	case PARMTYPE_ADDRESS:
2332	return VERR_EM_INTERPRETER; //feeling lazy right now
2333
2334	case PARMTYPE_IMMEDIATE:
2335	if(!(param1.flags & PARAM_VAL16))
2336	return VERR_EM_INTERPRETER;
2337	sel = (RTSEL)param1.val.val16;
2338	break;
2339
2340	default:
2341	return VERR_EM_INTERPRETER;
2342	}
2343
2344	#ifdef IN_RING0
2345	/* Only for the VT-x real-mode emulation case. */
2346	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2347	CPUMSetGuestLDTR(pVCpu, sel);
2348	return VINF_SUCCESS;
2349	#else
2350	if (sel == 0)
2351	{
2352	if (CPUMGetHyperLDTR(pVCpu) == 0)
2353	{
2354	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2355	return VINF_SUCCESS;
2356	}
2357	}
2358	//still feeling lazy
2359	return VERR_EM_INTERPRETER;
2360	#endif
2361	}
2362
2363	#ifdef IN_RING0
2364	/**
2365	* LIDT/LGDT Emulation.
2366	*/
2367	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2368	{
2369	OP_PARAMVAL param1;
2370	RTGCPTR pParam1;
2371	X86XDTR32 dtr32;
2372
2373	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2374
2375	/* Only for the VT-x real-mode emulation case. */
2376	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2377
2378	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->param1, &param1, PARAM_SOURCE);
2379	if(RT_FAILURE(rc))
2380	return VERR_EM_INTERPRETER;
2381
2382	switch(param1.type)
2383	{
2384	case PARMTYPE_ADDRESS:
2385	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->param1, param1.val.val16);
2386	break;
2387
2388	default:
2389	return VERR_EM_INTERPRETER;
2390	}
2391
2392	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2393	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2394
2395	if (!(pDis->prefix & PREFIX_OPSIZE))
2396	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2397
2398	if (pDis->pCurInstr->opcode == OP_LIDT)
2399	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2400	else
2401	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2402
2403	return VINF_SUCCESS;
2404	}
2405	#endif
2406
2407
2408	#ifdef IN_RC
2409	/**
2410	* STI Emulation.
2411	*
2412	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2413	*/
2414	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2415	{
2416	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2417
2418	if(!pGCState)
2419	{
2420	Assert(pGCState);
2421	return VERR_EM_INTERPRETER;
2422	}
2423	pGCState->uVMFlags \|= X86_EFL_IF;
2424
2425	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2426	Assert(pvFault == SELMToFlat(pVM, DIS_SELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2427
2428	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->opsize;
2429	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2430
2431	return VINF_SUCCESS;
2432	}
2433	#endif /* IN_RC */
2434
2435
2436	/**
2437	* HLT Emulation.
2438	*/
2439	static int emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2440	{
2441	return VINF_EM_HALT;
2442	}
2443
2444
2445	/**
2446	* Interpret RDTSC
2447	*
2448	* @returns VBox status code.
2449	* @param pVM The VM handle.
2450	* @param pVCpu The VMCPU handle.
2451	* @param pRegFrame The register frame.
2452	*
2453	*/
2454	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2455	{
2456	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2457
2458	if (uCR4 & X86_CR4_TSD)
2459	return VERR_EM_INTERPRETER; /* genuine #GP */
2460
2461	uint64_t uTicks = TMCpuTickGet(pVCpu);
2462
2463	/* Same behaviour in 32 & 64 bits mode */
2464	pRegFrame->rax = (uint32_t)uTicks;
2465	pRegFrame->rdx = (uTicks >> 32ULL);
2466
2467	return VINF_SUCCESS;
2468	}
2469
2470	/**
2471	* Interpret RDTSCP
2472	*
2473	* @returns VBox status code.
2474	* @param pVM The VM handle.
2475	* @param pVCpu The VMCPU handle.
2476	* @param pCtx The CPU context.
2477	*
2478	*/
2479	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2480	{
2481	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2482
2483	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2484	{
2485	AssertFailed();
2486	return VERR_EM_INTERPRETER; /* genuine #UD */
2487	}
2488
2489	if (uCR4 & X86_CR4_TSD)
2490	return VERR_EM_INTERPRETER; /* genuine #GP */
2491
2492	uint64_t uTicks = TMCpuTickGet(pVCpu);
2493
2494	/* Same behaviour in 32 & 64 bits mode */
2495	pCtx->rax = (uint32_t)uTicks;
2496	pCtx->rdx = (uTicks >> 32ULL);
2497	/* Low dword of the TSC_AUX msr only. */
2498	pCtx->rcx = (uint32_t)CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2499
2500	return VINF_SUCCESS;
2501	}
2502
2503	/**
2504	* RDTSC Emulation.
2505	*/
2506	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2507	{
2508	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2509	}
2510
2511	/**
2512	* Interpret RDPMC
2513	*
2514	* @returns VBox status code.
2515	* @param pVM The VM handle.
2516	* @param pVCpu The VMCPU handle.
2517	* @param pRegFrame The register frame.
2518	*
2519	*/
2520	VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2521	{
2522	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2523
2524	/* If X86_CR4_PCE is not set, then CPL must be zero. */
2525	if ( !(uCR4 & X86_CR4_PCE)
2526	&& CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2527	{
2528	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2529	return VERR_EM_INTERPRETER; /* genuine #GP */
2530	}
2531
2532	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2533	pRegFrame->rax = 0;
2534	pRegFrame->rdx = 0;
2535	/* @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2536	return VINF_SUCCESS;
2537	}
2538
2539	/**
2540	* RDPMC Emulation
2541	*/
2542	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2543	{
2544	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2545	}
2546
2547	/**
2548	* MONITOR Emulation.
2549	*/
2550	VMMDECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2551	{
2552	uint32_t u32Dummy, u32ExtFeatures, cpl;
2553
2554	if (pRegFrame->ecx != 0)
2555	{
2556	Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
2557	return VERR_EM_INTERPRETER; /* illegal value. */
2558	}
2559
2560	/* Get the current privilege level. */
2561	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2562	if (cpl != 0)
2563	return VERR_EM_INTERPRETER; /* supervisor only */
2564
2565	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2566	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2567	return VERR_EM_INTERPRETER; /* not supported */
2568
2569	pVCpu->em.s.mwait.uMonitorEAX = pRegFrame->rax;
2570	pVCpu->em.s.mwait.uMonitorECX = pRegFrame->rcx;
2571	pVCpu->em.s.mwait.uMonitorEDX = pRegFrame->rdx;
2572	pVCpu->em.s.mwait.fWait \|= EMMWAIT_FLAG_MONITOR_ACTIVE;
2573	return VINF_SUCCESS;
2574	}
2575
2576	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2577	{
2578	return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
2579	}
2580
2581
2582	/**
2583	* MWAIT Emulation.
2584	*/
2585	VMMDECL(int) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2586	{
2587	uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
2588
2589	/* Get the current privilege level. */
2590	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2591	if (cpl != 0)
2592	return VERR_EM_INTERPRETER; /* supervisor only */
2593
2594	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2595	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2596	return VERR_EM_INTERPRETER; /* not supported */
2597
2598	/*
2599	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
2600	* CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
2601	*/
2602	CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
2603	if (pRegFrame->ecx > 1)
2604	{
2605	Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
2606	return VERR_EM_INTERPRETER; /* illegal value. */
2607	}
2608
2609	if (pRegFrame->ecx)
2610	{
2611	if (!(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
2612	{
2613	Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
2614	return VERR_EM_INTERPRETER; /* illegal value. */
2615	}
2616
2617	pVCpu->em.s.mwait.fWait = EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0;
2618	}
2619	else
2620	pVCpu->em.s.mwait.fWait = EMMWAIT_FLAG_ACTIVE;
2621
2622	pVCpu->em.s.mwait.uMWaitEAX = pRegFrame->rax;
2623	pVCpu->em.s.mwait.uMWaitECX = pRegFrame->rcx;
2624
2625	/** @todo not completely correct */
2626	return VINF_EM_HALT;
2627	}
2628
2629	static int emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2630	{
2631	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2632	}
2633
2634
2635	#ifdef LOG_ENABLED
2636	static const char *emMSRtoString(uint32_t uMsr)
2637	{
2638	switch (uMsr)
2639	{
2640	case MSR_IA32_APICBASE:
2641	return "MSR_IA32_APICBASE";
2642	case MSR_IA32_CR_PAT:
2643	return "MSR_IA32_CR_PAT";
2644	case MSR_IA32_SYSENTER_CS:
2645	return "MSR_IA32_SYSENTER_CS";
2646	case MSR_IA32_SYSENTER_EIP:
2647	return "MSR_IA32_SYSENTER_EIP";
2648	case MSR_IA32_SYSENTER_ESP:
2649	return "MSR_IA32_SYSENTER_ESP";
2650	case MSR_K6_EFER:
2651	return "MSR_K6_EFER";
2652	case MSR_K8_SF_MASK:
2653	return "MSR_K8_SF_MASK";
2654	case MSR_K6_STAR:
2655	return "MSR_K6_STAR";
2656	case MSR_K8_LSTAR:
2657	return "MSR_K8_LSTAR";
2658	case MSR_K8_CSTAR:
2659	return "MSR_K8_CSTAR";
2660	case MSR_K8_FS_BASE:
2661	return "MSR_K8_FS_BASE";
2662	case MSR_K8_GS_BASE:
2663	return "MSR_K8_GS_BASE";
2664	case MSR_K8_KERNEL_GS_BASE:
2665	return "MSR_K8_KERNEL_GS_BASE";
2666	case MSR_K8_TSC_AUX:
2667	return "MSR_K8_TSC_AUX";
2668	case MSR_IA32_BIOS_SIGN_ID:
2669	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2670	case MSR_IA32_PLATFORM_ID:
2671	return "Unsupported MSR_IA32_PLATFORM_ID";
2672	case MSR_IA32_BIOS_UPDT_TRIG:
2673	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2674	case MSR_IA32_TSC:
2675	return "MSR_IA32_TSC";
2676	case MSR_IA32_MISC_ENABLE:
2677	return "Unsupported MSR_IA32_MISC_ENABLE";
2678	case MSR_IA32_MTRR_CAP:
2679	return "Unsupported MSR_IA32_MTRR_CAP";
2680	case MSR_IA32_MCP_CAP:
2681	return "Unsupported MSR_IA32_MCP_CAP";
2682	case MSR_IA32_MCP_STATUS:
2683	return "Unsupported MSR_IA32_MCP_STATUS";
2684	case MSR_IA32_MCP_CTRL:
2685	return "Unsupported MSR_IA32_MCP_CTRL";
2686	case MSR_IA32_MTRR_DEF_TYPE:
2687	return "Unsupported MSR_IA32_MTRR_DEF_TYPE";
2688	case MSR_K7_EVNTSEL0:
2689	return "Unsupported MSR_K7_EVNTSEL0";
2690	case MSR_K7_EVNTSEL1:
2691	return "Unsupported MSR_K7_EVNTSEL1";
2692	case MSR_K7_EVNTSEL2:
2693	return "Unsupported MSR_K7_EVNTSEL2";
2694	case MSR_K7_EVNTSEL3:
2695	return "Unsupported MSR_K7_EVNTSEL3";
2696	case MSR_IA32_MC0_CTL:
2697	return "Unsupported MSR_IA32_MC0_CTL";
2698	case MSR_IA32_MC0_STATUS:
2699	return "Unsupported MSR_IA32_MC0_STATUS";
2700	case MSR_IA32_PERFEVTSEL0:
2701	return "Unsupported MSR_IA32_PERFEVTSEL0";
2702	case MSR_IA32_PERFEVTSEL1:
2703	return "Unsupported MSR_IA32_PERFEVTSEL1";
2704	case MSR_IA32_PERF_STATUS:
2705	return "MSR_IA32_PERF_STATUS";
2706	case MSR_IA32_PLATFORM_INFO:
2707	return "MSR_IA32_PLATFORM_INFO";
2708	case MSR_IA32_PERF_CTL:
2709	return "Unsupported MSR_IA32_PERF_CTL";
2710	case MSR_K7_PERFCTR0:
2711	return "Unsupported MSR_K7_PERFCTR0";
2712	case MSR_K7_PERFCTR1:
2713	return "Unsupported MSR_K7_PERFCTR1";
2714	case MSR_K7_PERFCTR2:
2715	return "Unsupported MSR_K7_PERFCTR2";
2716	case MSR_K7_PERFCTR3:
2717	return "Unsupported MSR_K7_PERFCTR3";
2718	case MSR_IA32_PMC0:
2719	return "Unsupported MSR_IA32_PMC0";
2720	case MSR_IA32_PMC1:
2721	return "Unsupported MSR_IA32_PMC1";
2722	case MSR_IA32_PMC2:
2723	return "Unsupported MSR_IA32_PMC2";
2724	case MSR_IA32_PMC3:
2725	return "Unsupported MSR_IA32_PMC3";
2726	}
2727	return "Unknown MSR";
2728	}
2729	#endif /* LOG_ENABLED */
2730
2731
2732	/**
2733	* Interpret RDMSR
2734	*
2735	* @returns VBox status code.
2736	* @param pVM The VM handle.
2737	* @param pVCpu The VMCPU handle.
2738	* @param pRegFrame The register frame.
2739	*
2740	*/
2741	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2742	{
2743	uint32_t u32Dummy, u32Features, cpl;
2744	uint64_t val;
2745	CPUMCTX *pCtx;
2746	int rc = VINF_SUCCESS;
2747
2748	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
2749	* That version clears the high dwords of both RDX & RAX */
2750	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2751
2752	/* Get the current privilege level. */
2753	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2754	if (cpl != 0)
2755	return VERR_EM_INTERPRETER; /* supervisor only */
2756
2757	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2758	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2759	return VERR_EM_INTERPRETER; /* not supported */
2760
2761	switch (pRegFrame->ecx)
2762	{
2763	case MSR_IA32_TSC:
2764	val = TMCpuTickGet(pVCpu);
2765	break;
2766
2767	case MSR_IA32_APICBASE:
2768	rc = PDMApicGetBase(pVM, &val);
2769	AssertRC(rc);
2770	break;
2771
2772	case MSR_IA32_CR_PAT:
2773	val = pCtx->msrPAT;
2774	break;
2775
2776	case MSR_IA32_SYSENTER_CS:
2777	val = pCtx->SysEnter.cs;
2778	break;
2779
2780	case MSR_IA32_SYSENTER_EIP:
2781	val = pCtx->SysEnter.eip;
2782	break;
2783
2784	case MSR_IA32_SYSENTER_ESP:
2785	val = pCtx->SysEnter.esp;
2786	break;
2787
2788	case MSR_K6_EFER:
2789	val = pCtx->msrEFER;
2790	break;
2791
2792	case MSR_K8_SF_MASK:
2793	val = pCtx->msrSFMASK;
2794	break;
2795
2796	case MSR_K6_STAR:
2797	val = pCtx->msrSTAR;
2798	break;
2799
2800	case MSR_K8_LSTAR:
2801	val = pCtx->msrLSTAR;
2802	break;
2803
2804	case MSR_K8_CSTAR:
2805	val = pCtx->msrCSTAR;
2806	break;
2807
2808	case MSR_K8_FS_BASE:
2809	val = pCtx->fsHid.u64Base;
2810	break;
2811
2812	case MSR_K8_GS_BASE:
2813	val = pCtx->gsHid.u64Base;
2814	break;
2815
2816	case MSR_K8_KERNEL_GS_BASE:
2817	val = pCtx->msrKERNELGSBASE;
2818	break;
2819
2820	case MSR_K8_TSC_AUX:
2821	val = CPUMGetGuestMsr(pVCpu, MSR_K8_TSC_AUX);
2822	break;
2823
2824	case MSR_IA32_PERF_STATUS:
2825	case MSR_IA32_PLATFORM_INFO:
2826	case MSR_IA32_MISC_ENABLE:
2827	case MSR_IA32_FSB_CLOCK_STS:
2828	case MSR_IA32_THERM_STATUS:
2829	val = CPUMGetGuestMsr(pVCpu, pRegFrame->ecx);
2830	break;
2831
2832	#if 0 /def IN_RING0 /
2833	case MSR_IA32_PLATFORM_ID:
2834	case MSR_IA32_BIOS_SIGN_ID:
2835	if (CPUMGetCPUVendor(pVM) == CPUMCPUVENDOR_INTEL)
2836	{
2837	/* Available since the P6 family. VT-x implies that this feature is present. */
2838	if (pRegFrame->ecx == MSR_IA32_PLATFORM_ID)
2839	val = ASMRdMsr(MSR_IA32_PLATFORM_ID);
2840	else
2841	if (pRegFrame->ecx == MSR_IA32_BIOS_SIGN_ID)
2842	val = ASMRdMsr(MSR_IA32_BIOS_SIGN_ID);
2843	break;
2844	}
2845	/* no break */
2846	#endif
2847	default:
2848	/* In X2APIC specification this range is reserved for APIC control. */
2849	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
2850	&& pRegFrame->ecx < MSR_IA32_APIC_END)
2851	rc = PDMApicReadMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, &val);
2852	else
2853	/* We should actually trigger a #GP here, but don't as that will cause more trouble. */
2854	val = 0;
2855	break;
2856	}
2857	LogFlow(("EMInterpretRdmsr %s (%x) -> val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2858	if (rc == VINF_SUCCESS)
2859	{
2860	pRegFrame->rax = (uint32_t) val;
2861	pRegFrame->rdx = (uint32_t)(val >> 32);
2862	}
2863	return rc;
2864	}
2865
2866
2867	/**
2868	* RDMSR Emulation.
2869	*/
2870	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2871	{
2872	/* Note: the Intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2873	Assert(!(pDis->prefix & PREFIX_REX));
2874	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
2875	}
2876
2877
2878	/**
2879	* Interpret WRMSR
2880	*
2881	* @returns VBox status code.
2882	* @param pVM The VM handle.
2883	* @param pVCpu The VMCPU handle.
2884	* @param pRegFrame The register frame.
2885	*/
2886	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2887	{
2888	uint32_t u32Dummy, u32Features, cpl;
2889	uint64_t val;
2890	CPUMCTX *pCtx;
2891
2892	/* Note: works the same in 32 and 64 bits modes. */
2893	pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2894
2895	/* Get the current privilege level. */
2896	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2897	if (cpl != 0)
2898	return VERR_EM_INTERPRETER; /* supervisor only */
2899
2900	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2901	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2902	return VERR_EM_INTERPRETER; /* not supported */
2903
2904	val = RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx);
2905	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, val));
2906	switch (pRegFrame->ecx)
2907	{
2908	case MSR_IA32_TSC:
2909	TMCpuTickSet(pVM, pVCpu, val);
2910	break;
2911
2912	case MSR_IA32_APICBASE:
2913	{
2914	int rc = PDMApicSetBase(pVM, val);
2915	AssertRC(rc);
2916	break;
2917	}
2918
2919	case MSR_IA32_CR_PAT:
2920	pCtx->msrPAT = val;
2921	break;
2922
2923	case MSR_IA32_SYSENTER_CS:
2924	pCtx->SysEnter.cs = val & 0xffff; /* 16 bits selector */
2925	break;
2926
2927	case MSR_IA32_SYSENTER_EIP:
2928	pCtx->SysEnter.eip = val;
2929	break;
2930
2931	case MSR_IA32_SYSENTER_ESP:
2932	pCtx->SysEnter.esp = val;
2933	break;
2934
2935	case MSR_K6_EFER:
2936	{
2937	uint64_t uMask = 0;
2938	uint64_t oldval = pCtx->msrEFER;
2939
2940	/* Filter out those bits the guest is allowed to change. (e.g. LMA is read-only) */
2941	CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2942	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_NX)
2943	uMask \|= MSR_K6_EFER_NXE;
2944	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
2945	uMask \|= MSR_K6_EFER_LME;
2946	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_SEP)
2947	uMask \|= MSR_K6_EFER_SCE;
2948	if (u32Features & X86_CPUID_AMD_FEATURE_EDX_FFXSR)
2949	uMask \|= MSR_K6_EFER_FFXSR;
2950
2951	/* Check for illegal MSR_K6_EFER_LME transitions: not allowed to change LME if paging is enabled. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2952	if ( ((pCtx->msrEFER & MSR_K6_EFER_LME) != (val & uMask & MSR_K6_EFER_LME))
2953	&& (pCtx->cr0 & X86_CR0_PG))
2954	{
2955	AssertMsgFailed(("Illegal MSR_K6_EFER_LME change: paging is enabled!!\n"));
2956	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2957	}
2958
2959	/* There are a few more: e.g. MSR_K6_EFER_LMSLE */
2960	AssertMsg(!(val & ~(MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA /* ignored anyway */ \|MSR_K6_EFER_SCE\|MSR_K6_EFER_FFXSR)), ("Unexpected value %RX64\n", val));
2961	pCtx->msrEFER = (pCtx->msrEFER & ~uMask) \| (val & uMask);
2962
2963	/* AMD64 Architecture Programmer's Manual: 15.15 TLB Control; flush the TLB if MSR_K6_EFER_NXE, MSR_K6_EFER_LME or MSR_K6_EFER_LMA are changed. */
2964	if ((oldval & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)) != (pCtx->msrEFER & (MSR_K6_EFER_NXE\|MSR_K6_EFER_LME\|MSR_K6_EFER_LMA)))
2965	HWACCMFlushTLB(pVCpu);
2966
2967	break;
2968	}
2969
2970	case MSR_K8_SF_MASK:
2971	pCtx->msrSFMASK = val;
2972	break;
2973
2974	case MSR_K6_STAR:
2975	pCtx->msrSTAR = val;
2976	break;
2977
2978	case MSR_K8_LSTAR:
2979	pCtx->msrLSTAR = val;
2980	break;
2981
2982	case MSR_K8_CSTAR:
2983	pCtx->msrCSTAR = val;
2984	break;
2985
2986	case MSR_K8_FS_BASE:
2987	pCtx->fsHid.u64Base = val;
2988	break;
2989
2990	case MSR_K8_GS_BASE:
2991	pCtx->gsHid.u64Base = val;
2992	break;
2993
2994	case MSR_K8_KERNEL_GS_BASE:
2995	pCtx->msrKERNELGSBASE = val;
2996	break;
2997
2998	case MSR_K8_TSC_AUX:
2999	case MSR_IA32_MISC_ENABLE:
3000	CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, val);
3001	break;
3002
3003	default:
3004	/* In X2APIC specification this range is reserved for APIC control. */
3005	if ( pRegFrame->ecx >= MSR_IA32_APIC_START
3006	&& pRegFrame->ecx < MSR_IA32_APIC_END)
3007	return PDMApicWriteMSR(pVM, pVCpu->idCpu, pRegFrame->ecx, val);
3008
3009	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
3010	break;
3011	}
3012	return VINF_SUCCESS;
3013	}
3014
3015
3016	/**
3017	* WRMSR Emulation.
3018	*/
3019	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3020	{
3021	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3022	}
3023
3024
3025	/**
3026	* Internal worker.
3027	* @copydoc EMInterpretInstructionCPU
3028	*/
3029	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
3030	uint32_t *pcbSize, EMCODETYPE enmCodeType)
3031	{
3032	Assert(enmCodeType == EMCODETYPE_SUPERVISOR \|\| enmCodeType == EMCODETYPE_ALL);
3033	Assert(pcbSize);
3034	*pcbSize = 0;
3035
3036	if (enmCodeType == EMCODETYPE_SUPERVISOR)
3037	{
3038	/*
3039	* Only supervisor guest code!!
3040	* And no complicated prefixes.
3041	*/
3042	/* Get the current privilege level. */
3043	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3044	if ( cpl != 0
3045	&& pDis->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3046	{
3047	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3048	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3049	return VERR_EM_INTERPRETER;
3050	}
3051	}
3052	else
3053	Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3054
3055	#ifdef IN_RC
3056	if ( (pDis->prefix & (PREFIX_REPNE \| PREFIX_REP))
3057	\|\| ( (pDis->prefix & PREFIX_LOCK)
3058	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3059	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3060	&& pDis->pCurInstr->opcode != OP_XADD
3061	&& pDis->pCurInstr->opcode != OP_OR
3062	&& pDis->pCurInstr->opcode != OP_AND
3063	&& pDis->pCurInstr->opcode != OP_XOR
3064	&& pDis->pCurInstr->opcode != OP_BTR
3065	)
3066	)
3067	#else
3068	if ( (pDis->prefix & PREFIX_REPNE)
3069	\|\| ( (pDis->prefix & PREFIX_REP)
3070	&& pDis->pCurInstr->opcode != OP_STOSWD
3071	)
3072	\|\| ( (pDis->prefix & PREFIX_LOCK)
3073	&& pDis->pCurInstr->opcode != OP_OR
3074	&& pDis->pCurInstr->opcode != OP_AND
3075	&& pDis->pCurInstr->opcode != OP_XOR
3076	&& pDis->pCurInstr->opcode != OP_BTR
3077	&& pDis->pCurInstr->opcode != OP_CMPXCHG
3078	&& pDis->pCurInstr->opcode != OP_CMPXCHG8B
3079	)
3080	)
3081	#endif
3082	{
3083	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3084	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3085	return VERR_EM_INTERPRETER;
3086	}
3087
3088	#if HC_ARCH_BITS == 32
3089	/*
3090	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3091	* Whitelisted instructions are safe.
3092	*/
3093	if ( pDis->param1.size > 4
3094	&& CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3095	{
3096	uint32_t uOpCode = pDis->pCurInstr->opcode;
3097	if ( uOpCode != OP_STOSWD
3098	&& uOpCode != OP_MOV
3099	&& uOpCode != OP_CMPXCHG8B
3100	&& uOpCode != OP_XCHG
3101	&& uOpCode != OP_BTS
3102	&& uOpCode != OP_BTR
3103	&& uOpCode != OP_BTC
3104	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3105	&& uOpCode != OP_CMPXCHG /* solaris */
3106	&& uOpCode != OP_AND /* windows */
3107	&& uOpCode != OP_OR /* windows */
3108	&& uOpCode != OP_XOR /* because we can */
3109	&& uOpCode != OP_ADD /* windows (dripple) */
3110	&& uOpCode != OP_ADC /* because we can */
3111	&& uOpCode != OP_SUB /* because we can */
3112	/** @todo OP_BTS or is that a different kind of failure? */
3113	# endif
3114	)
3115	{
3116	# ifdef VBOX_WITH_STATISTICS
3117	switch (pDis->pCurInstr->opcode)
3118	{
3119	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3120	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3121	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3122	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3123	INTERPRET_FAILED_CASE(OP_INC,Inc);
3124	INTERPRET_FAILED_CASE(OP_POP,Pop);
3125	INTERPRET_FAILED_CASE(OP_OR, Or);
3126	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3127	INTERPRET_FAILED_CASE(OP_AND,And);
3128	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3129	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3130	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3131	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3132	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3133	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3134	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3135	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3136	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3137	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3138	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3139	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3140	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3141	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3142	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3143	INTERPRET_FAILED_CASE(OP_ADD,Add);
3144	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3145	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3146	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3147	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3148	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3149	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3150	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3151	INTERPRET_FAILED_CASE(OP_STI, Sti);
3152	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3153	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3154	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3155	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3156	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3157	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3158	# undef INTERPRET_FAILED_CASE
3159	default:
3160	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3161	break;
3162	}
3163	# endif /* VBOX_WITH_STATISTICS */
3164	return VERR_EM_INTERPRETER;
3165	}
3166	}
3167	#endif
3168
3169	int rc;
3170	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3171	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3172	#endif
3173	switch (pDis->pCurInstr->opcode)
3174	{
3175	/*
3176	* Macros for generating the right case statements.
3177	*/
3178	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3179	case opcode:\
3180	if (pDis->prefix & PREFIX_LOCK) \
3181	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3182	else \
3183	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3184	if (RT_SUCCESS(rc)) \
3185	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3186	else \
3187	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3188	return rc
3189	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3190	case opcode:\
3191	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3192	if (RT_SUCCESS(rc)) \
3193	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3194	else \
3195	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3196	return rc
3197
3198	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3199	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3200	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3201	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3202
3203	#define INTERPRET_CASE(opcode, Instr) \
3204	case opcode:\
3205	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3206	if (RT_SUCCESS(rc)) \
3207	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3208	else \
3209	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3210	return rc
3211
3212	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3213	case opcode:\
3214	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3215	if (RT_SUCCESS(rc)) \
3216	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3217	else \
3218	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3219	return rc
3220
3221	#define INTERPRET_STAT_CASE(opcode, Instr) \
3222	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3223
3224	/*
3225	* The actual case statements.
3226	*/
3227	INTERPRET_CASE(OP_XCHG,Xchg);
3228	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3229	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3230	INTERPRET_CASE(OP_POP,Pop);
3231	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3232	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3233	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3234	INTERPRET_CASE(OP_MOV,Mov);
3235	#ifndef IN_RC
3236	INTERPRET_CASE(OP_STOSWD,StosWD);
3237	#endif
3238	INTERPRET_CASE(OP_INVLPG,InvlPg);
3239	INTERPRET_CASE(OP_CPUID,CpuId);
3240	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3241	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3242	#ifdef IN_RING0
3243	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3244	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3245	#endif
3246	INTERPRET_CASE(OP_LLDT,LLdt);
3247	INTERPRET_CASE(OP_LMSW,Lmsw);
3248	#ifdef EM_EMULATE_SMSW
3249	INTERPRET_CASE(OP_SMSW,Smsw);
3250	#endif
3251	INTERPRET_CASE(OP_CLTS,Clts);
3252	INTERPRET_CASE(OP_MONITOR, Monitor);
3253	INTERPRET_CASE(OP_MWAIT, MWait);
3254	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3255	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3256	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3257	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3258	INTERPRET_CASE(OP_ADC,Adc);
3259	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3260	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3261	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3262	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3263	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3264	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3265	#ifdef IN_RC
3266	INTERPRET_CASE(OP_STI,Sti);
3267	INTERPRET_CASE(OP_XADD, XAdd);
3268	#endif
3269	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3270	INTERPRET_CASE(OP_HLT,Hlt);
3271	INTERPRET_CASE(OP_IRET,Iret);
3272	INTERPRET_CASE(OP_WBINVD,WbInvd);
3273	#ifdef VBOX_WITH_STATISTICS
3274	# ifndef IN_RC
3275	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3276	# endif
3277	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3278	#endif
3279
3280	default:
3281	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->opcode));
3282	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3283	return VERR_EM_INTERPRETER;
3284
3285	#undef INTERPRET_CASE_EX_PARAM2
3286	#undef INTERPRET_STAT_CASE
3287	#undef INTERPRET_CASE_EX
3288	#undef INTERPRET_CASE
3289	} /* switch (opcode) */
3290	AssertFailed();
3291	return VERR_INTERNAL_ERROR;
3292	}
3293
3294
3295	/**
3296	* Sets the PC for which interrupts should be inhibited.
3297	*
3298	* @param pVCpu The VMCPU handle.
3299	* @param PC The PC.
3300	*/
3301	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
3302	{
3303	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
3304	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3305	}
3306
3307
3308	/**
3309	* Gets the PC for which interrupts should be inhibited.
3310	*
3311	* There are a few instructions which inhibits or delays interrupts
3312	* for the instruction following them. These instructions are:
3313	* - STI
3314	* - MOV SS, r/m16
3315	* - POP SS
3316	*
3317	* @returns The PC for which interrupts should be inhibited.
3318	* @param pVCpu The VMCPU handle.
3319	*
3320	*/
3321	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
3322	{
3323	return pVCpu->em.s.GCPtrInhibitInterrupts;
3324	}
3325
3326	/**
3327	* Locks REM execution to a single VCpu
3328	*
3329	* @param pVM VM handle.
3330	*/
3331	VMMDECL(void) EMRemLock(PVM pVM)
3332	{
3333	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3334	return; /* early init */
3335
3336	Assert(!PGMIsLockOwner(pVM) && !IOMIsLockOwner(pVM));
3337	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
3338	AssertMsg(rc == VINF_SUCCESS, ("%Rrc\n", rc));
3339	}
3340
3341	/**
3342	* Unlocks REM execution
3343	*
3344	* @param pVM VM handle.
3345	*/
3346	VMMDECL(void) EMRemUnlock(PVM pVM)
3347	{
3348	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
3349	return; /* early init */
3350
3351	PDMCritSectLeave(&pVM->em.s.CritSectREM);
3352	}
3353
3354	/**
3355	* Check if this VCPU currently owns the REM lock.
3356	*
3357	* @returns bool owner/not owner
3358	* @param pVM The VM to operate on.
3359	*/
3360	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
3361	{
3362	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
3363	}
3364
3365	/**
3366	* Try to acquire the REM lock.
3367	*
3368	* @returns VBox status code
3369	* @param pVM The VM to operate on.
3370	*/
3371	VMMDECL(int) EMTryEnterRemLock(PVM pVM)
3372	{
3373	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
3374	}
3375
3376	/**
3377	* Determine if we should continue after encountering a hlt or mwait instruction
3378	*
3379	* @returns boolean
3380	* @param pVCpu The VMCPU to operate on.
3381	* @param pCtx Current CPU context
3382	*/
3383	VMMDECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
3384	{
3385	if ( pCtx->eflags.Bits.u1IF
3386	\|\| ((pVCpu->em.s.mwait.fWait & (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)) == (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)))
3387	{
3388	pVCpu->em.s.mwait.fWait &= ~(EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0);
3389	return !!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC\|VMCPU_FF_INTERRUPT_PIC));
3390	}
3391
3392	return false;
3393	}
3394

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 30567

Download in other formats: