EMAll.cpp@ 41744

Last change on this file since 41744 was 41744, checked in by vboxsync, 12 years ago
DISOPPARAM: s/base.reg_/Base.idxReg/ + docs
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 114.9 KB

Line
1	/* $Id: EMAll.cpp 41744 2012-06-15 02:29:09Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_EM
22	#include <VBox/vmm/em.h>
23	#include <VBox/vmm/mm.h>
24	#include <VBox/vmm/selm.h>
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/csam.h>
27	#include <VBox/vmm/pgm.h>
28	#ifdef VBOX_WITH_IEM
29	# include <VBox/vmm/iem.h>
30	#endif
31	#include <VBox/vmm/iom.h>
32	#include <VBox/vmm/stam.h>
33	#include "EMInternal.h"
34	#include <VBox/vmm/vm.h>
35	#include <VBox/vmm/vmm.h>
36	#include <VBox/vmm/hwaccm.h>
37	#include <VBox/vmm/tm.h>
38	#include <VBox/vmm/pdmapi.h>
39	#include <VBox/param.h>
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/log.h>
44	#include "internal/pgm.h"
45	#include <iprt/assert.h>
46	#include <iprt/asm.h>
47	#include <iprt/string.h>
48
49
50	/*******************************************************************************
51	* Defined Constants And Macros *
52	*******************************************************************************/
53	/** @def EM_ASSERT_FAULT_RETURN
54	* Safety check.
55	*
56	* Could in theory misfire on a cross page boundary access...
57	*
58	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
59	* turns up an alias page instead of the original faulting one and annoying the
60	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
61	*/
62	#if 0
63	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
64	#else
65	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
66	#endif
67
68	/** Used to pass information during instruction disassembly. */
69	typedef struct
70	{
71	PVM pVM;
72	PVMCPU pVCpu;
73	RTGCPTR GCPtr;
74	uint8_t aOpcode[8];
75	} EMDISSTATE, *PEMDISSTATE;
76
77	/*******************************************************************************
78	* Internal Functions *
79	*******************************************************************************/
80	#ifndef VBOX_WITH_IEM
81	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
82	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize);
83	#endif
84
85
86
87	/**
88	* Get the current execution manager status.
89	*
90	* @returns Current status.
91	* @param pVCpu The VMCPU to operate on.
92	*/
93	VMMDECL(EMSTATE) EMGetState(PVMCPU pVCpu)
94	{
95	return pVCpu->em.s.enmState;
96	}
97
98	/**
99	* Sets the current execution manager status. (use only when you know what you're doing!)
100	*
101	* @param pVCpu The VMCPU to operate on.
102	*/
103	VMMDECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
104	{
105	/* Only allowed combination: */
106	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
107	pVCpu->em.s.enmState = enmNewState;
108	}
109
110
111	/**
112	* Sets the PC for which interrupts should be inhibited.
113	*
114	* @param pVCpu The VMCPU handle.
115	* @param PC The PC.
116	*/
117	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
118	{
119	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
120	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
121	}
122
123
124	/**
125	* Gets the PC for which interrupts should be inhibited.
126	*
127	* There are a few instructions which inhibits or delays interrupts
128	* for the instruction following them. These instructions are:
129	* - STI
130	* - MOV SS, r/m16
131	* - POP SS
132	*
133	* @returns The PC for which interrupts should be inhibited.
134	* @param pVCpu The VMCPU handle.
135	*
136	*/
137	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
138	{
139	return pVCpu->em.s.GCPtrInhibitInterrupts;
140	}
141
142
143	/**
144	* Prepare an MWAIT - essentials of the MONITOR instruction.
145	*
146	* @returns VINF_SUCCESS
147	* @param pVCpu The current CPU.
148	* @param rax The content of RAX.
149	* @param rcx The content of RCX.
150	* @param rdx The content of RDX.
151	*/
152	VMM_INT_DECL(int) EMMonitorWaitPrepare(PVMCPU pVCpu, uint64_t rax, uint64_t rcx, uint64_t rdx)
153	{
154	pVCpu->em.s.MWait.uMonitorRAX = rax;
155	pVCpu->em.s.MWait.uMonitorRCX = rcx;
156	pVCpu->em.s.MWait.uMonitorRDX = rdx;
157	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_MONITOR_ACTIVE;
158	/** @todo Complete MONITOR implementation. */
159	return VINF_SUCCESS;
160	}
161
162
163	/**
164	* Performs an MWAIT.
165	*
166	* @returns VINF_SUCCESS
167	* @param pVCpu The current CPU.
168	* @param rax The content of RAX.
169	* @param rcx The content of RCX.
170	*/
171	VMM_INT_DECL(int) EMMonitorWaitPerform(PVMCPU pVCpu, uint64_t rax, uint64_t rcx)
172	{
173	pVCpu->em.s.MWait.uMWaitRAX = rax;
174	pVCpu->em.s.MWait.uMWaitRCX = rcx;
175	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_ACTIVE;
176	if (rcx)
177	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_BREAKIRQIF0;
178	else
179	pVCpu->em.s.MWait.fWait &= ~EMMWAIT_FLAG_BREAKIRQIF0;
180	/** @todo not completely correct?? */
181	return VINF_EM_HALT;
182	}
183
184
185
186	/**
187	* Determine if we should continue after encountering a hlt or mwait
188	* instruction.
189	*
190	* Clears MWAIT flags if returning @c true.
191	*
192	* @returns boolean
193	* @param pVCpu The VMCPU to operate on.
194	* @param pCtx Current CPU context.
195	*/
196	VMM_INT_DECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
197	{
198	if ( pCtx->eflags.Bits.u1IF
199	\|\| ( (pVCpu->em.s.MWait.fWait & (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0))
200	== (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)) )
201	{
202	pVCpu->em.s.MWait.fWait &= ~(EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0);
203	return !!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC));
204	}
205
206	return false;
207	}
208
209
210	/**
211	* Locks REM execution to a single VCpu
212	*
213	* @param pVM VM handle.
214	*/
215	VMMDECL(void) EMRemLock(PVM pVM)
216	{
217	#ifdef VBOX_WITH_REM
218	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
219	return; /* early init */
220
221	Assert(!PGMIsLockOwner(pVM));
222	Assert(!IOMIsLockOwner(pVM));
223	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
224	AssertRCSuccess(rc);
225	#endif
226	}
227
228
229	/**
230	* Unlocks REM execution
231	*
232	* @param pVM VM handle.
233	*/
234	VMMDECL(void) EMRemUnlock(PVM pVM)
235	{
236	#ifdef VBOX_WITH_REM
237	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
238	return; /* early init */
239
240	PDMCritSectLeave(&pVM->em.s.CritSectREM);
241	#endif
242	}
243
244
245	/**
246	* Check if this VCPU currently owns the REM lock.
247	*
248	* @returns bool owner/not owner
249	* @param pVM The VM to operate on.
250	*/
251	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
252	{
253	#ifdef VBOX_WITH_REM
254	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
255	return true; /* early init */
256
257	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
258	#else
259	return true;
260	#endif
261	}
262
263
264	/**
265	* Try to acquire the REM lock.
266	*
267	* @returns VBox status code
268	* @param pVM The VM to operate on.
269	*/
270	VMMDECL(int) EMRemTryLock(PVM pVM)
271	{
272	#ifdef VBOX_WITH_REM
273	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
274	return VINF_SUCCESS; /* early init */
275
276	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
277	#else
278	return VINF_SUCCESS;
279	#endif
280	}
281
282
283	/**
284	* @callback_method_impl{FNDISREADBYTES}
285	*/
286	static DECLCALLBACK(int) emReadBytes(PDISCPUSTATE pDisState, uint8_t *pbDst, RTUINTPTR uSrcAddr, uint32_t cbToRead)
287	{
288	PEMDISSTATE pState = (PEMDISSTATE)pDisState->pvUser;
289	# ifndef IN_RING0
290	PVM pVM = pState->pVM;
291	# endif
292	PVMCPU pVCpu = pState->pVCpu;
293
294	# ifdef IN_RING0
295	int rc;
296
297	if ( pState->GCPtr
298	&& uSrcAddr + cbToRead <= pState->GCPtr + sizeof(pState->aOpcode))
299	{
300	unsigned offset = uSrcAddr - pState->GCPtr;
301	Assert(uSrcAddr >= pState->GCPtr);
302
303	for (unsigned i = 0; i < cbToRead; i++)
304	pbDst[i] = pState->aOpcode[offset + i];
305	return VINF_SUCCESS;
306	}
307
308	rc = PGMPhysSimpleReadGCPtr(pVCpu, pbDst, uSrcAddr, cbToRead);
309	AssertMsgRC(rc, ("PGMPhysSimpleReadGCPtr failed for uSrcAddr=%RTptr cbToRead=%x rc=%d\n", uSrcAddr, cbToRead, rc));
310	# elif defined(IN_RING3)
311	if (!PATMIsPatchGCAddr(pVM, uSrcAddr))
312	{
313	int rc = PGMPhysSimpleReadGCPtr(pVCpu, pbDst, uSrcAddr, cbToRead);
314	AssertRC(rc);
315	}
316	else
317	memcpy(pbDst, PATMR3GCPtrToHCPtr(pVM, uSrcAddr), cbToRead);
318
319	# elif defined(IN_RC)
320	if (!PATMIsPatchGCAddr(pVM, uSrcAddr))
321	{
322	int rc = MMGCRamRead(pVM, pbDst, (void *)(uintptr_t)uSrcAddr, cbToRead);
323	if (rc == VERR_ACCESS_DENIED)
324	{
325	/* Recently flushed; access the data manually. */
326	rc = PGMPhysSimpleReadGCPtr(pVCpu, pbDst, uSrcAddr, cbToRead);
327	AssertRC(rc);
328	}
329	}
330	else /* the hypervisor region is always present. */
331	memcpy(pbDst, (RTRCPTR)(uintptr_t)uSrcAddr, cbToRead);
332
333	# endif /* IN_RING3 */
334	return VINF_SUCCESS;
335	}
336
337	#ifndef IN_RC
338
339	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
340	{
341	EMDISSTATE State;
342
343	State.pVM = pVM;
344	State.pVCpu = pVCpu;
345	int rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, InstrGC, sizeof(State.aOpcode));
346	if (RT_SUCCESS(rc))
347	{
348	State.GCPtr = InstrGC;
349	}
350	else
351	{
352	if (PAGE_ADDRESS(InstrGC) == PAGE_ADDRESS(InstrGC + sizeof(State.aOpcode) - 1))
353	{
354	/*
355	* If we fail to find the page via the guest's page tables we invalidate the page
356	* in the host TLB (pertaining to the guest in the NestedPaging case). See #6043
357	*/
358	if (rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT)
359	HWACCMInvalidatePage(pVCpu, InstrGC);
360
361	Log(("emDisCoreOne: read failed with %d\n", rc));
362	return rc;
363	}
364	State.GCPtr = NIL_RTGCPTR;
365	}
366	return DISInstrWithReader(InstrGC, (DISCPUMODE)pDis->uCpuMode, emReadBytes, &State, pDis, pOpsize);
367	}
368
369	#else /* IN_RC */
370
371	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
372	{
373	EMDISSTATE State;
374
375	State.pVM = pVM;
376	State.pVCpu = pVCpu;
377	State.GCPtr = InstrGC;
378
379	return DISInstrWithReader(InstrGC, (DISCPUMODE)pDis->uCpuMode, emReadBytes, &State, pDis, pOpsize);
380	}
381
382	#endif /* IN_RC */
383
384
385	/**
386	* Disassembles one instruction.
387	*
388	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
389	* details.
390	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
391	*
392	* @param pVM The VM handle.
393	* @param pVCpu The VMCPU handle.
394	* @param pCtxCore The context core (used for both the mode and instruction).
395	* @param pDis Where to return the parsed instruction info.
396	* @param pcbInstr Where to return the instruction size. (optional)
397	*/
398	VMMDECL(int) EMInterpretDisasOne(PVM pVM, PVMCPU pVCpu, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
399	{
400	RTGCPTR GCPtrInstr;
401	int rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
402	if (RT_FAILURE(rc))
403	{
404	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
405	pCtxCore->cs, (RTGCPTR)pCtxCore->rip, pCtxCore->ss & X86_SEL_RPL, rc));
406	return rc;
407	}
408	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
409	}
410
411
412	/**
413	* Disassembles one instruction.
414	*
415	* This is used by internally by the interpreter and by trap/access handlers.
416	*
417	* @returns VBox status code.
418	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
419	*
420	* @param pVM The VM handle.
421	* @param pVCpu The VMCPU handle.
422	* @param GCPtrInstr The flat address of the instruction.
423	* @param pCtxCore The context core (used to determine the cpu mode).
424	* @param pDis Where to return the parsed instruction info.
425	* @param pcbInstr Where to return the instruction size. (optional)
426	*/
427	VMMDECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pDis, unsigned *pcbInstr)
428	{
429	int rc;
430	EMDISSTATE State;
431
432	State.pVM = pVM;
433	State.pVCpu = pVCpu;
434
435	#ifdef IN_RC
436	State.GCPtr = GCPtrInstr;
437	#else /* ring 0/3 */
438	rc = PGMPhysSimpleReadGCPtr(pVCpu, &State.aOpcode, GCPtrInstr, sizeof(State.aOpcode));
439	if (RT_SUCCESS(rc))
440	{
441	State.GCPtr = GCPtrInstr;
442	}
443	else
444	{
445	if (PAGE_ADDRESS(GCPtrInstr) == PAGE_ADDRESS(GCPtrInstr + sizeof(State.aOpcode) - 1))
446	{
447	/*
448	* If we fail to find the page via the guest's page tables we invalidate the page
449	* in the host TLB (pertaining to the guest in the NestedPaging case). See #6043
450	*/
451	if (rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT)
452	HWACCMInvalidatePage(pVCpu, GCPtrInstr);
453
454	Log(("EMInterpretDisasOneEx: read failed with %d\n", rc));
455	return rc;
456	}
457	State.GCPtr = NIL_RTGCPTR;
458	}
459	#endif
460
461	DISCPUMODE enmCpuMode = SELMGetCpuModeFromSelector(pVCpu, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid);
462	rc = DISInstrWithReader(GCPtrInstr, enmCpuMode, emReadBytes, &State, pDis, pcbInstr);
463	if (RT_SUCCESS(rc))
464	return VINF_SUCCESS;
465	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
466	return VERR_EM_INTERNAL_DISAS_ERROR;
467	}
468
469
470	/**
471	* Interprets the current instruction.
472	*
473	* @returns VBox status code.
474	* @retval VINF_* Scheduling instructions.
475	* @retval VERR_EM_INTERPRETER Something we can't cope with.
476	* @retval VERR_* Fatal errors.
477	*
478	* @param pVCpu The VMCPU handle.
479	* @param pRegFrame The register frame.
480	* Updates the EIP if an instruction was executed successfully.
481	* @param pvFault The fault address (CR2).
482	* @param pcbSize Size of the write (if applicable).
483	*
484	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
485	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
486	* to worry about e.g. invalid modrm combinations (!)
487	*/
488	VMMDECL(VBOXSTRICTRC) EMInterpretInstruction(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
489	{
490	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
491	#ifdef VBOX_WITH_IEM
492	NOREF(pvFault);
493	VBOXSTRICTRC rc = IEMExecOneEx(pVCpu, pRegFrame, NULL);
494	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
495	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
496	return VERR_EM_INTERPRETER;
497	return rc;
498	#else
499	RTGCPTR pbCode;
500	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
501	if (RT_SUCCESS(rc))
502	{
503	uint32_t cbOp;
504	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
505	pDis->uCpuMode = SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
506	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
507	if (RT_SUCCESS(rc))
508	{
509	Assert(cbOp == pDis->cbInstr);
510	uint32_t cbIgnored;
511	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
512	if (RT_SUCCESS(rc))
513	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
514
515	return rc;
516	}
517	}
518	return VERR_EM_INTERPRETER;
519	#endif
520	}
521
522
523	/**
524	* Interprets the current instruction.
525	*
526	* @returns VBox status code.
527	* @retval VINF_* Scheduling instructions.
528	* @retval VERR_EM_INTERPRETER Something we can't cope with.
529	* @retval VERR_* Fatal errors.
530	*
531	* @param pVM The VM handle.
532	* @param pVCpu The VMCPU handle.
533	* @param pRegFrame The register frame.
534	* Updates the EIP if an instruction was executed successfully.
535	* @param pvFault The fault address (CR2).
536	* @param pcbWritten Size of the write (if applicable).
537	*
538	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
539	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
540	* to worry about e.g. invalid modrm combinations (!)
541	*/
542	VMMDECL(VBOXSTRICTRC) EMInterpretInstructionEx(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbWritten)
543	{
544	LogFlow(("EMInterpretInstructionEx %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
545	#ifdef VBOX_WITH_IEM
546	NOREF(pvFault);
547	VBOXSTRICTRC rc = IEMExecOneEx(pVCpu, pRegFrame, pcbWritten);
548	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
549	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
550	return VERR_EM_INTERPRETER;
551	return rc;
552	#else
553	RTGCPTR pbCode;
554	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
555	if (RT_SUCCESS(rc))
556	{
557	uint32_t cbOp;
558	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
559	pDis->uCpuMode = SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
560	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
561	if (RT_SUCCESS(rc))
562	{
563	Assert(cbOp == pDis->cbInstr);
564	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, pcbWritten);
565	if (RT_SUCCESS(rc))
566	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
567
568	return rc;
569	}
570	}
571	return VERR_EM_INTERPRETER;
572	#endif
573	}
574
575
576	/**
577	* Interprets the current instruction using the supplied DISCPUSTATE structure.
578	*
579	* IP/EIP/RIP IS updated!
580	*
581	* @returns VBox strict status code.
582	* @retval VINF_* Scheduling instructions. When these are returned, it
583	* starts to get a bit tricky to know whether code was
584	* executed or not... We'll address this when it becomes a problem.
585	* @retval VERR_EM_INTERPRETER Something we can't cope with.
586	* @retval VERR_* Fatal errors.
587	*
588	* @param pVM The VM handle.
589	* @param pVCpu The VMCPU handle.
590	* @param pDis The disassembler cpu state for the instruction to be
591	* interpreted.
592	* @param pRegFrame The register frame. IP/EIP/RIP IS changed!
593	* @param pvFault The fault address (CR2).
594	* @param pcbSize Size of the write (if applicable).
595	* @param enmCodeType Code type (user/supervisor)
596	*
597	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
598	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
599	* to worry about e.g. invalid modrm combinations (!)
600	*
601	* @todo At this time we do NOT check if the instruction overwrites vital information.
602	* Make sure this can't happen!! (will add some assertions/checks later)
603	*/
604	VMMDECL(VBOXSTRICTRC) EMInterpretInstructionDisasState(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
605	RTGCPTR pvFault, EMCODETYPE enmCodeType)
606	{
607	LogFlow(("EMInterpretInstructionDisasState %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
608	#ifdef VBOX_WITH_IEM
609	NOREF(pDis); NOREF(pvFault); NOREF(enmCodeType);
610	VBOXSTRICTRC rc = IEMExecOneEx(pVCpu, pRegFrame, NULL);
611	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
612	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
613	return VERR_EM_INTERPRETER;
614	return rc;
615	#else
616	uint32_t cbIgnored;
617	VBOXSTRICTRC rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
618	if (RT_SUCCESS(rc))
619	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
620	return rc;
621	#endif
622	}
623
624	#if defined(IN_RC) /&& defined(VBOX_WITH_PATM)/
625
626	DECLINLINE(int) emRCStackRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
627	{
628	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
629	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
630	return rc;
631	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
632	}
633
634
635	/**
636	* Interpret IRET (currently only to V86 code) - PATM only.
637	*
638	* @returns VBox status code.
639	* @param pVM The VM handle.
640	* @param pVCpu The VMCPU handle.
641	* @param pRegFrame The register frame.
642	*
643	*/
644	VMMDECL(int) EMInterpretIretV86ForPatm(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
645	{
646	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
647	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
648	int rc;
649
650	Assert(!CPUMIsGuestIn64BitCode(pVCpu, pRegFrame));
651	/** @todo Rainy day: Test what happens when VERR_EM_INTERPRETER is returned by
652	* this function. Fear that it may guru on us, thus not converted to
653	* IEM. */
654
655	rc = emRCStackRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
656	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
657	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
658	AssertRCReturn(rc, VERR_EM_INTERPRETER);
659	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
660
661	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
662	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
663	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
664	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
665	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
666	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
667	AssertRCReturn(rc, VERR_EM_INTERPRETER);
668
669	pRegFrame->eip = eip & 0xffff;
670	pRegFrame->cs = cs;
671
672	/* Mask away all reserved bits */
673	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
674	eflags &= uMask;
675
676	CPUMRawSetEFlags(pVCpu, pRegFrame, eflags);
677	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
678
679	pRegFrame->esp = esp;
680	pRegFrame->ss = ss;
681	pRegFrame->ds = ds;
682	pRegFrame->es = es;
683	pRegFrame->fs = fs;
684	pRegFrame->gs = gs;
685
686	return VINF_SUCCESS;
687	}
688
689	#endif /* IN_RC && VBOX_WITH_PATM */
690	#ifndef VBOX_WITH_IEM
691
692
693
694
695
696
697	/*
698	*
699	* The old interpreter.
700	* The old interpreter.
701	* The old interpreter.
702	* The old interpreter.
703	* The old interpreter.
704	*
705	*/
706
707	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
708	{
709	#ifdef IN_RC
710	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
711	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
712	return rc;
713	/*
714	* The page pool cache may end up here in some cases because it
715	* flushed one of the shadow mappings used by the trapping
716	* instruction and it either flushed the TLB or the CPU reused it.
717	*/
718	#else
719	NOREF(pVM);
720	#endif
721	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
722	}
723
724
725	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
726	{
727	/* Don't use MMGCRamWrite here as it does not respect zero pages, shared
728	pages or write monitored pages. */
729	NOREF(pVM);
730	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
731	}
732
733
734	/** Convert sel:addr to a flat GC address. */
735	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, PDISOPPARAM pParam, RTGCPTR pvAddr)
736	{
737	DISSELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
738	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
739	}
740
741
742	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
743	/**
744	* Get the mnemonic for the disassembled instruction.
745	*
746	* GC/R0 doesn't include the strings in the DIS tables because
747	* of limited space.
748	*/
749	static const char *emGetMnemonic(PDISCPUSTATE pDis)
750	{
751	switch (pDis->pCurInstr->uOpcode)
752	{
753	case OP_XCHG: return "Xchg";
754	case OP_DEC: return "Dec";
755	case OP_INC: return "Inc";
756	case OP_POP: return "Pop";
757	case OP_OR: return "Or";
758	case OP_AND: return "And";
759	case OP_MOV: return "Mov";
760	case OP_INVLPG: return "InvlPg";
761	case OP_CPUID: return "CpuId";
762	case OP_MOV_CR: return "MovCRx";
763	case OP_MOV_DR: return "MovDRx";
764	case OP_LLDT: return "LLdt";
765	case OP_LGDT: return "LGdt";
766	case OP_LIDT: return "LIdt";
767	case OP_CLTS: return "Clts";
768	case OP_MONITOR: return "Monitor";
769	case OP_MWAIT: return "MWait";
770	case OP_RDMSR: return "Rdmsr";
771	case OP_WRMSR: return "Wrmsr";
772	case OP_ADD: return "Add";
773	case OP_ADC: return "Adc";
774	case OP_SUB: return "Sub";
775	case OP_SBB: return "Sbb";
776	case OP_RDTSC: return "Rdtsc";
777	case OP_STI: return "Sti";
778	case OP_CLI: return "Cli";
779	case OP_XADD: return "XAdd";
780	case OP_HLT: return "Hlt";
781	case OP_IRET: return "Iret";
782	case OP_MOVNTPS: return "MovNTPS";
783	case OP_STOSWD: return "StosWD";
784	case OP_WBINVD: return "WbInvd";
785	case OP_XOR: return "Xor";
786	case OP_BTR: return "Btr";
787	case OP_BTS: return "Bts";
788	case OP_BTC: return "Btc";
789	case OP_LMSW: return "Lmsw";
790	case OP_SMSW: return "Smsw";
791	case OP_CMPXCHG: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
792	case OP_CMPXCHG8B: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
793
794	default:
795	Log(("Unknown opcode %d\n", pDis->pCurInstr->uOpcode));
796	return "???";
797	}
798	}
799	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
800
801
802	/**
803	* XCHG instruction emulation.
804	*/
805	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
806	{
807	DISQPVPARAMVAL param1, param2;
808	NOREF(pvFault);
809
810	/* Source to make DISQueryParamVal read the register value - ugly hack */
811	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
812	if(RT_FAILURE(rc))
813	return VERR_EM_INTERPRETER;
814
815	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
816	if(RT_FAILURE(rc))
817	return VERR_EM_INTERPRETER;
818
819	#ifdef IN_RC
820	if (TRPMHasTrap(pVCpu))
821	{
822	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
823	{
824	#endif
825	RTGCPTR pParam1 = 0, pParam2 = 0;
826	uint64_t valpar1, valpar2;
827
828	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
829	switch(param1.type)
830	{
831	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
832	valpar1 = param1.val.val64;
833	break;
834
835	case DISQPV_TYPE_ADDRESS:
836	pParam1 = (RTGCPTR)param1.val.val64;
837	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
838	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
839	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
840	if (RT_FAILURE(rc))
841	{
842	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
843	return VERR_EM_INTERPRETER;
844	}
845	break;
846
847	default:
848	AssertFailed();
849	return VERR_EM_INTERPRETER;
850	}
851
852	switch(param2.type)
853	{
854	case DISQPV_TYPE_ADDRESS:
855	pParam2 = (RTGCPTR)param2.val.val64;
856	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pParam2);
857	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
858	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
859	if (RT_FAILURE(rc))
860	{
861	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
862	}
863	break;
864
865	case DISQPV_TYPE_IMMEDIATE:
866	valpar2 = param2.val.val64;
867	break;
868
869	default:
870	AssertFailed();
871	return VERR_EM_INTERPRETER;
872	}
873
874	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
875	if (pParam1 == 0)
876	{
877	Assert(param1.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
878	switch(param1.size)
879	{
880	case 1: //special case for AH etc
881	rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t )valpar2); break;
882	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)valpar2); break;
883	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)valpar2); break;
884	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, valpar2); break;
885	default: AssertFailedReturn(VERR_EM_INTERPRETER);
886	}
887	if (RT_FAILURE(rc))
888	return VERR_EM_INTERPRETER;
889	}
890	else
891	{
892	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
893	if (RT_FAILURE(rc))
894	{
895	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
896	return VERR_EM_INTERPRETER;
897	}
898	}
899
900	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
901	if (pParam2 == 0)
902	{
903	Assert(param2.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
904	switch(param2.size)
905	{
906	case 1: //special case for AH etc
907	rc = DISWriteReg8(pRegFrame, pDis->Param2.Base.idxGenReg, (uint8_t )valpar1); break;
908	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param2.Base.idxGenReg, (uint16_t)valpar1); break;
909	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param2.Base.idxGenReg, (uint32_t)valpar1); break;
910	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param2.Base.idxGenReg, valpar1); break;
911	default: AssertFailedReturn(VERR_EM_INTERPRETER);
912	}
913	if (RT_FAILURE(rc))
914	return VERR_EM_INTERPRETER;
915	}
916	else
917	{
918	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
919	if (RT_FAILURE(rc))
920	{
921	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
922	return VERR_EM_INTERPRETER;
923	}
924	}
925
926	*pcbSize = param2.size;
927	return VINF_SUCCESS;
928	#ifdef IN_RC
929	}
930	}
931	return VERR_EM_INTERPRETER;
932	#endif
933	}
934
935
936	/**
937	* INC and DEC emulation.
938	*/
939	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
940	PFNEMULATEPARAM2 pfnEmulate)
941	{
942	DISQPVPARAMVAL param1;
943	NOREF(pvFault);
944
945	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
946	if(RT_FAILURE(rc))
947	return VERR_EM_INTERPRETER;
948
949	#ifdef IN_RC
950	if (TRPMHasTrap(pVCpu))
951	{
952	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
953	{
954	#endif
955	RTGCPTR pParam1 = 0;
956	uint64_t valpar1;
957
958	if (param1.type == DISQPV_TYPE_ADDRESS)
959	{
960	pParam1 = (RTGCPTR)param1.val.val64;
961	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
962	#ifdef IN_RC
963	/* Safety check (in theory it could cross a page boundary and fault there though) */
964	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
965	#endif
966	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
967	if (RT_FAILURE(rc))
968	{
969	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
970	return VERR_EM_INTERPRETER;
971	}
972	}
973	else
974	{
975	AssertFailed();
976	return VERR_EM_INTERPRETER;
977	}
978
979	uint32_t eflags;
980
981	eflags = pfnEmulate(&valpar1, param1.size);
982
983	/* Write result back */
984	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
985	if (RT_FAILURE(rc))
986	{
987	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
988	return VERR_EM_INTERPRETER;
989	}
990
991	/* Update guest's eflags and finish. */
992	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
993	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
994
995	/* All done! */
996	*pcbSize = param1.size;
997	return VINF_SUCCESS;
998	#ifdef IN_RC
999	}
1000	}
1001	return VERR_EM_INTERPRETER;
1002	#endif
1003	}
1004
1005
1006	/**
1007	* POP Emulation.
1008	*/
1009	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1010	{
1011	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1012	DISQPVPARAMVAL param1;
1013	NOREF(pvFault);
1014
1015	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1016	if(RT_FAILURE(rc))
1017	return VERR_EM_INTERPRETER;
1018
1019	#ifdef IN_RC
1020	if (TRPMHasTrap(pVCpu))
1021	{
1022	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1023	{
1024	#endif
1025	RTGCPTR pParam1 = 0;
1026	uint32_t valpar1;
1027	RTGCPTR pStackVal;
1028
1029	/* Read stack value first */
1030	if (SELMGetCpuModeFromSelector(pVCpu, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == DISCPUMODE_16BIT)
1031	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
1032
1033	/* Convert address; don't bother checking limits etc, as we only read here */
1034	pStackVal = SELMToFlat(pVM, DISSELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
1035	if (pStackVal == 0)
1036	return VERR_EM_INTERPRETER;
1037
1038	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
1039	if (RT_FAILURE(rc))
1040	{
1041	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1042	return VERR_EM_INTERPRETER;
1043	}
1044
1045	if (param1.type == DISQPV_TYPE_ADDRESS)
1046	{
1047	pParam1 = (RTGCPTR)param1.val.val64;
1048
1049	/* pop [esp+xx] uses esp after the actual pop! */
1050	AssertCompile(DISGREG_ESP == DISGREG_SP);
1051	if ( (pDis->Param1.fUse & DISUSE_BASE)
1052	&& (pDis->Param1.fUse & (DISUSE_REG_GEN16\|DISUSE_REG_GEN32))
1053	&& pDis->Param1.Base.idxGenReg == DISGREG_ESP
1054	)
1055	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
1056
1057	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1058	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
1059	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1060	if (RT_FAILURE(rc))
1061	{
1062	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1063	return VERR_EM_INTERPRETER;
1064	}
1065
1066	/* Update ESP as the last step */
1067	pRegFrame->esp += param1.size;
1068	}
1069	else
1070	{
1071	#ifndef DEBUG_bird // annoying assertion.
1072	AssertFailed();
1073	#endif
1074	return VERR_EM_INTERPRETER;
1075	}
1076
1077	/* All done! */
1078	*pcbSize = param1.size;
1079	return VINF_SUCCESS;
1080	#ifdef IN_RC
1081	}
1082	}
1083	return VERR_EM_INTERPRETER;
1084	#endif
1085	}
1086
1087
1088	/**
1089	* XOR/OR/AND Emulation.
1090	*/
1091	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1092	PFNEMULATEPARAM3 pfnEmulate)
1093	{
1094	DISQPVPARAMVAL param1, param2;
1095	NOREF(pvFault);
1096
1097	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1098	if(RT_FAILURE(rc))
1099	return VERR_EM_INTERPRETER;
1100
1101	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1102	if(RT_FAILURE(rc))
1103	return VERR_EM_INTERPRETER;
1104
1105	#ifdef IN_RC
1106	if (TRPMHasTrap(pVCpu))
1107	{
1108	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1109	{
1110	#endif
1111	RTGCPTR pParam1;
1112	uint64_t valpar1, valpar2;
1113
1114	if (pDis->Param1.cb != pDis->Param2.cb)
1115	{
1116	if (pDis->Param1.cb < pDis->Param2.cb)
1117	{
1118	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
1119	return VERR_EM_INTERPRETER;
1120	}
1121	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1122	pDis->Param2.cb = pDis->Param1.cb;
1123	param2.size = param1.size;
1124	}
1125
1126	/* The destination is always a virtual address */
1127	if (param1.type == DISQPV_TYPE_ADDRESS)
1128	{
1129	pParam1 = (RTGCPTR)param1.val.val64;
1130	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1131	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1132	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1133	if (RT_FAILURE(rc))
1134	{
1135	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1136	return VERR_EM_INTERPRETER;
1137	}
1138	}
1139	else
1140	{
1141	AssertFailed();
1142	return VERR_EM_INTERPRETER;
1143	}
1144
1145	/* Register or immediate data */
1146	switch(param2.type)
1147	{
1148	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1149	valpar2 = param2.val.val64;
1150	break;
1151
1152	default:
1153	AssertFailed();
1154	return VERR_EM_INTERPRETER;
1155	}
1156
1157	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
1158
1159	/* Data read, emulate instruction. */
1160	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1161
1162	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
1163
1164	/* Update guest's eflags and finish. */
1165	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1166	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1167
1168	/* And write it back */
1169	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1170	if (RT_SUCCESS(rc))
1171	{
1172	/* All done! */
1173	*pcbSize = param2.size;
1174	return VINF_SUCCESS;
1175	}
1176	#ifdef IN_RC
1177	}
1178	}
1179	#endif
1180	return VERR_EM_INTERPRETER;
1181	}
1182
1183
1184	/**
1185	* LOCK XOR/OR/AND Emulation.
1186	*/
1187	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1188	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
1189	{
1190	void *pvParam1;
1191	DISQPVPARAMVAL param1, param2;
1192	NOREF(pvFault);
1193
1194	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1195	Assert(pDis->Param1.cb <= 4);
1196	#endif
1197
1198	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1199	if(RT_FAILURE(rc))
1200	return VERR_EM_INTERPRETER;
1201
1202	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1203	if(RT_FAILURE(rc))
1204	return VERR_EM_INTERPRETER;
1205
1206	if (pDis->Param1.cb != pDis->Param2.cb)
1207	{
1208	AssertMsgReturn(pDis->Param1.cb >= pDis->Param2.cb, /* should never happen! */
1209	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb),
1210	VERR_EM_INTERPRETER);
1211
1212	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1213	pDis->Param2.cb = pDis->Param1.cb;
1214	param2.size = param1.size;
1215	}
1216
1217	#ifdef IN_RC
1218	/* Safety check (in theory it could cross a page boundary and fault there though) */
1219	Assert( TRPMHasTrap(pVCpu)
1220	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
1221	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
1222	#endif
1223
1224	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
1225	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1226	RTGCUINTREG ValPar2 = param2.val.val64;
1227
1228	/* The destination is always a virtual address */
1229	AssertReturn(param1.type == DISQPV_TYPE_ADDRESS, VERR_EM_INTERPRETER);
1230
1231	RTGCPTR GCPtrPar1 = param1.val.val64;
1232	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1233	PGMPAGEMAPLOCK Lock;
1234	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1235	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1236
1237	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1238	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1239
1240	RTGCUINTREG32 eflags = 0;
1241	rc = pfnEmulate(pvParam1, ValPar2, pDis->Param2.cb, &eflags);
1242	PGMPhysReleasePageMappingLock(pVM, &Lock);
1243	if (RT_FAILURE(rc))
1244	{
1245	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1246	return VERR_EM_INTERPRETER;
1247	}
1248
1249	/* Update guest's eflags and finish. */
1250	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1251	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1252
1253	*pcbSize = param2.size;
1254	return VINF_SUCCESS;
1255	}
1256
1257
1258	/**
1259	* ADD, ADC & SUB Emulation.
1260	*/
1261	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1262	PFNEMULATEPARAM3 pfnEmulate)
1263	{
1264	NOREF(pvFault);
1265	DISQPVPARAMVAL param1, param2;
1266	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1267	if(RT_FAILURE(rc))
1268	return VERR_EM_INTERPRETER;
1269
1270	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1271	if(RT_FAILURE(rc))
1272	return VERR_EM_INTERPRETER;
1273
1274	#ifdef IN_RC
1275	if (TRPMHasTrap(pVCpu))
1276	{
1277	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1278	{
1279	#endif
1280	RTGCPTR pParam1;
1281	uint64_t valpar1, valpar2;
1282
1283	if (pDis->Param1.cb != pDis->Param2.cb)
1284	{
1285	if (pDis->Param1.cb < pDis->Param2.cb)
1286	{
1287	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
1288	return VERR_EM_INTERPRETER;
1289	}
1290	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
1291	pDis->Param2.cb = pDis->Param1.cb;
1292	param2.size = param1.size;
1293	}
1294
1295	/* The destination is always a virtual address */
1296	if (param1.type == DISQPV_TYPE_ADDRESS)
1297	{
1298	pParam1 = (RTGCPTR)param1.val.val64;
1299	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1300	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1301	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1302	if (RT_FAILURE(rc))
1303	{
1304	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1305	return VERR_EM_INTERPRETER;
1306	}
1307	}
1308	else
1309	{
1310	#ifndef DEBUG_bird
1311	AssertFailed();
1312	#endif
1313	return VERR_EM_INTERPRETER;
1314	}
1315
1316	/* Register or immediate data */
1317	switch(param2.type)
1318	{
1319	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1320	valpar2 = param2.val.val64;
1321	break;
1322
1323	default:
1324	AssertFailed();
1325	return VERR_EM_INTERPRETER;
1326	}
1327
1328	/* Data read, emulate instruction. */
1329	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
1330
1331	/* Update guest's eflags and finish. */
1332	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1333	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1334
1335	/* And write it back */
1336	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1337	if (RT_SUCCESS(rc))
1338	{
1339	/* All done! */
1340	*pcbSize = param2.size;
1341	return VINF_SUCCESS;
1342	}
1343	#ifdef IN_RC
1344	}
1345	}
1346	#endif
1347	return VERR_EM_INTERPRETER;
1348	}
1349
1350
1351	/**
1352	* ADC Emulation.
1353	*/
1354	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1355	{
1356	if (pRegFrame->eflags.Bits.u1CF)
1357	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
1358	else
1359	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
1360	}
1361
1362
1363	/**
1364	* BTR/C/S Emulation.
1365	*/
1366	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1367	PFNEMULATEPARAM2UINT32 pfnEmulate)
1368	{
1369	DISQPVPARAMVAL param1, param2;
1370	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1371	if(RT_FAILURE(rc))
1372	return VERR_EM_INTERPRETER;
1373
1374	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1375	if(RT_FAILURE(rc))
1376	return VERR_EM_INTERPRETER;
1377
1378	#ifdef IN_RC
1379	if (TRPMHasTrap(pVCpu))
1380	{
1381	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1382	{
1383	#endif
1384	RTGCPTR pParam1;
1385	uint64_t valpar1 = 0, valpar2;
1386	uint32_t eflags;
1387
1388	/* The destination is always a virtual address */
1389	if (param1.type != DISQPV_TYPE_ADDRESS)
1390	return VERR_EM_INTERPRETER;
1391
1392	pParam1 = (RTGCPTR)param1.val.val64;
1393	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1394
1395	/* Register or immediate data */
1396	switch(param2.type)
1397	{
1398	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1399	valpar2 = param2.val.val64;
1400	break;
1401
1402	default:
1403	AssertFailed();
1404	return VERR_EM_INTERPRETER;
1405	}
1406
1407	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
1408	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1409	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
1410	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
1411	if (RT_FAILURE(rc))
1412	{
1413	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1414	return VERR_EM_INTERPRETER;
1415	}
1416
1417	Log2(("emInterpretBtx: val=%x\n", valpar1));
1418	/* Data read, emulate bit test instruction. */
1419	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1420
1421	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1422
1423	/* Update guest's eflags and finish. */
1424	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1425	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1426
1427	/* And write it back */
1428	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
1429	if (RT_SUCCESS(rc))
1430	{
1431	/* All done! */
1432	*pcbSize = 1;
1433	return VINF_SUCCESS;
1434	}
1435	#ifdef IN_RC
1436	}
1437	}
1438	#endif
1439	return VERR_EM_INTERPRETER;
1440	}
1441
1442
1443	/**
1444	* LOCK BTR/C/S Emulation.
1445	*/
1446	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1447	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1448	{
1449	void *pvParam1;
1450
1451	DISQPVPARAMVAL param1, param2;
1452	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1453	if(RT_FAILURE(rc))
1454	return VERR_EM_INTERPRETER;
1455
1456	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1457	if(RT_FAILURE(rc))
1458	return VERR_EM_INTERPRETER;
1459
1460	/* The destination is always a virtual address */
1461	if (param1.type != DISQPV_TYPE_ADDRESS)
1462	return VERR_EM_INTERPRETER;
1463
1464	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
1465	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1466	uint64_t ValPar2 = param2.val.val64;
1467
1468	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1469	RTGCPTR GCPtrPar1 = param1.val.val64;
1470	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
1471	ValPar2 &= 7;
1472
1473	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1474	#ifdef IN_RC
1475	Assert(TRPMHasTrap(pVCpu));
1476	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
1477	#endif
1478
1479	PGMPAGEMAPLOCK Lock;
1480	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1481	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1482
1483	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
1484
1485	/* Try emulate it with a one-shot #PF handler in place. (RC) */
1486	RTGCUINTREG32 eflags = 0;
1487	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
1488	PGMPhysReleasePageMappingLock(pVM, &Lock);
1489	if (RT_FAILURE(rc))
1490	{
1491	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
1492	emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
1493	return VERR_EM_INTERPRETER;
1494	}
1495
1496	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1497
1498	/* Update guest's eflags and finish. */
1499	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1500	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1501
1502	*pcbSize = 1;
1503	return VINF_SUCCESS;
1504	}
1505
1506
1507	/**
1508	* MOV emulation.
1509	*/
1510	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1511	{
1512	NOREF(pvFault);
1513	DISQPVPARAMVAL param1, param2;
1514	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1515	if(RT_FAILURE(rc))
1516	return VERR_EM_INTERPRETER;
1517
1518	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1519	if(RT_FAILURE(rc))
1520	return VERR_EM_INTERPRETER;
1521
1522	#ifdef IN_RC
1523	if (TRPMHasTrap(pVCpu))
1524	{
1525	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1526	{
1527	#else
1528	/** @todo Make this the default and don't rely on TRPM information. */
1529	if (param1.type == DISQPV_TYPE_ADDRESS)
1530	{
1531	#endif
1532	RTGCPTR pDest;
1533	uint64_t val64;
1534
1535	switch(param1.type)
1536	{
1537	case DISQPV_TYPE_IMMEDIATE:
1538	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
1539	return VERR_EM_INTERPRETER;
1540	/* fallthru */
1541
1542	case DISQPV_TYPE_ADDRESS:
1543	pDest = (RTGCPTR)param1.val.val64;
1544	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pDest);
1545	break;
1546
1547	default:
1548	AssertFailed();
1549	return VERR_EM_INTERPRETER;
1550	}
1551
1552	switch(param2.type)
1553	{
1554	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
1555	val64 = param2.val.val64;
1556	break;
1557
1558	default:
1559	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
1560	return VERR_EM_INTERPRETER;
1561	}
1562	#ifdef LOG_ENABLED
1563	if (pDis->uCpuMode == DISCPUMODE_64BIT)
1564	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
1565	else
1566	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
1567	#endif
1568
1569	Assert(param2.size <= 8 && param2.size > 0);
1570	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
1571	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
1572	if (RT_FAILURE(rc))
1573	return VERR_EM_INTERPRETER;
1574
1575	*pcbSize = param2.size;
1576	}
1577	else
1578	{ /* read fault */
1579	RTGCPTR pSrc;
1580	uint64_t val64;
1581
1582	/* Source */
1583	switch(param2.type)
1584	{
1585	case DISQPV_TYPE_IMMEDIATE:
1586	if(!(param2.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
1587	return VERR_EM_INTERPRETER;
1588	/* fallthru */
1589
1590	case DISQPV_TYPE_ADDRESS:
1591	pSrc = (RTGCPTR)param2.val.val64;
1592	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pSrc);
1593	break;
1594
1595	default:
1596	return VERR_EM_INTERPRETER;
1597	}
1598
1599	Assert(param1.size <= 8 && param1.size > 0);
1600	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
1601	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
1602	if (RT_FAILURE(rc))
1603	return VERR_EM_INTERPRETER;
1604
1605	/* Destination */
1606	switch(param1.type)
1607	{
1608	case DISQPV_TYPE_REGISTER:
1609	switch(param1.size)
1610	{
1611	case 1: rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t) val64); break;
1612	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)val64); break;
1613	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)val64); break;
1614	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, val64); break;
1615	default:
1616	return VERR_EM_INTERPRETER;
1617	}
1618	if (RT_FAILURE(rc))
1619	return rc;
1620	break;
1621
1622	default:
1623	return VERR_EM_INTERPRETER;
1624	}
1625	#ifdef LOG_ENABLED
1626	if (pDis->uCpuMode == DISCPUMODE_64BIT)
1627	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
1628	else
1629	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
1630	#endif
1631	}
1632	return VINF_SUCCESS;
1633	#ifdef IN_RC
1634	}
1635	return VERR_EM_INTERPRETER;
1636	#endif
1637	}
1638
1639
1640	#ifndef IN_RC
1641	/**
1642	* [REP] STOSWD emulation
1643	*/
1644	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1645	{
1646	int rc;
1647	RTGCPTR GCDest, GCOffset;
1648	uint32_t cbSize;
1649	uint64_t cTransfers;
1650	int offIncrement;
1651	NOREF(pvFault);
1652
1653	/* Don't support any but these three prefix bytes. */
1654	if ((pDis->fPrefix & ~(DISPREFIX_ADDRSIZE\|DISPREFIX_OPSIZE\|DISPREFIX_REP\|DISPREFIX_REX)))
1655	return VERR_EM_INTERPRETER;
1656
1657	switch (pDis->uAddrMode)
1658	{
1659	case DISCPUMODE_16BIT:
1660	GCOffset = pRegFrame->di;
1661	cTransfers = pRegFrame->cx;
1662	break;
1663	case DISCPUMODE_32BIT:
1664	GCOffset = pRegFrame->edi;
1665	cTransfers = pRegFrame->ecx;
1666	break;
1667	case DISCPUMODE_64BIT:
1668	GCOffset = pRegFrame->rdi;
1669	cTransfers = pRegFrame->rcx;
1670	break;
1671	default:
1672	AssertFailed();
1673	return VERR_EM_INTERPRETER;
1674	}
1675
1676	GCDest = SELMToFlat(pVM, DISSELREG_ES, pRegFrame, GCOffset);
1677	switch (pDis->uOpMode)
1678	{
1679	case DISCPUMODE_16BIT:
1680	cbSize = 2;
1681	break;
1682	case DISCPUMODE_32BIT:
1683	cbSize = 4;
1684	break;
1685	case DISCPUMODE_64BIT:
1686	cbSize = 8;
1687	break;
1688	default:
1689	AssertFailed();
1690	return VERR_EM_INTERPRETER;
1691	}
1692
1693	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
1694
1695	if (!(pDis->fPrefix & DISPREFIX_REP))
1696	{
1697	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize));
1698
1699	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1700	if (RT_FAILURE(rc))
1701	return VERR_EM_INTERPRETER;
1702	Assert(rc == VINF_SUCCESS);
1703
1704	/* Update (e/r)di. */
1705	switch (pDis->uAddrMode)
1706	{
1707	case DISCPUMODE_16BIT:
1708	pRegFrame->di += offIncrement;
1709	break;
1710	case DISCPUMODE_32BIT:
1711	pRegFrame->edi += offIncrement;
1712	break;
1713	case DISCPUMODE_64BIT:
1714	pRegFrame->rdi += offIncrement;
1715	break;
1716	default:
1717	AssertFailed();
1718	return VERR_EM_INTERPRETER;
1719	}
1720
1721	}
1722	else
1723	{
1724	if (!cTransfers)
1725	return VINF_SUCCESS;
1726
1727	/*
1728	* Do not try emulate cross page stuff here because we don't know what might
1729	* be waiting for us on the subsequent pages. The caller has only asked us to
1730	* ignore access handlers fro the current page.
1731	* This also fends off big stores which would quickly kill PGMR0DynMap.
1732	*/
1733	if ( cbSize > PAGE_SIZE
1734	\|\| cTransfers > PAGE_SIZE
1735	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
1736	{
1737	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
1738	GCDest, cbSize, offIncrement, cTransfers));
1739	return VERR_EM_INTERPRETER;
1740	}
1741
1742	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
1743	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1744	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
1745	cTransfers * cbSize,
1746	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu, pRegFrame) == 3 ? X86_PTE_US : 0));
1747	if (rc != VINF_SUCCESS)
1748	{
1749	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
1750	return VERR_EM_INTERPRETER;
1751	}
1752
1753	/* REP case */
1754	while (cTransfers)
1755	{
1756	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
1757	if (RT_FAILURE(rc))
1758	{
1759	rc = VERR_EM_INTERPRETER;
1760	break;
1761	}
1762
1763	Assert(rc == VINF_SUCCESS);
1764	GCOffset += offIncrement;
1765	GCDest += offIncrement;
1766	cTransfers--;
1767	}
1768
1769	/* Update the registers. */
1770	switch (pDis->uAddrMode)
1771	{
1772	case DISCPUMODE_16BIT:
1773	pRegFrame->di = GCOffset;
1774	pRegFrame->cx = cTransfers;
1775	break;
1776	case DISCPUMODE_32BIT:
1777	pRegFrame->edi = GCOffset;
1778	pRegFrame->ecx = cTransfers;
1779	break;
1780	case DISCPUMODE_64BIT:
1781	pRegFrame->rdi = GCOffset;
1782	pRegFrame->rcx = cTransfers;
1783	break;
1784	default:
1785	AssertFailed();
1786	return VERR_EM_INTERPRETER;
1787	}
1788	}
1789
1790	*pcbSize = cbSize;
1791	return rc;
1792	}
1793	#endif /* !IN_RC */
1794
1795
1796	/**
1797	* [LOCK] CMPXCHG emulation.
1798	*/
1799	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1800	{
1801	DISQPVPARAMVAL param1, param2;
1802	NOREF(pvFault);
1803
1804	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
1805	Assert(pDis->Param1.cb <= 4);
1806	#endif
1807
1808	/* Source to make DISQueryParamVal read the register value - ugly hack */
1809	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1810	if(RT_FAILURE(rc))
1811	return VERR_EM_INTERPRETER;
1812
1813	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1814	if(RT_FAILURE(rc))
1815	return VERR_EM_INTERPRETER;
1816
1817	uint64_t valpar;
1818	switch(param2.type)
1819	{
1820	case DISQPV_TYPE_IMMEDIATE: /* register actually */
1821	valpar = param2.val.val64;
1822	break;
1823
1824	default:
1825	return VERR_EM_INTERPRETER;
1826	}
1827
1828	PGMPAGEMAPLOCK Lock;
1829	RTGCPTR GCPtrPar1;
1830	void *pvParam1;
1831	uint64_t eflags;
1832
1833	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
1834	switch(param1.type)
1835	{
1836	case DISQPV_TYPE_ADDRESS:
1837	GCPtrPar1 = param1.val.val64;
1838	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1839
1840	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1841	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1842	break;
1843
1844	default:
1845	return VERR_EM_INTERPRETER;
1846	}
1847
1848	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
1849
1850	if (pDis->fPrefix & DISPREFIX_LOCK)
1851	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
1852	else
1853	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
1854
1855	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
1856
1857	/* Update guest's eflags and finish. */
1858	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1859	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1860
1861	*pcbSize = param2.size;
1862	PGMPhysReleasePageMappingLock(pVM, &Lock);
1863	return VINF_SUCCESS;
1864	}
1865
1866
1867	/**
1868	* [LOCK] CMPXCHG8B emulation.
1869	*/
1870	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1871	{
1872	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1873	DISQPVPARAMVAL param1;
1874	NOREF(pvFault);
1875
1876	/* Source to make DISQueryParamVal read the register value - ugly hack */
1877	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1878	if(RT_FAILURE(rc))
1879	return VERR_EM_INTERPRETER;
1880
1881	RTGCPTR GCPtrPar1;
1882	void *pvParam1;
1883	uint64_t eflags;
1884	PGMPAGEMAPLOCK Lock;
1885
1886	AssertReturn(pDis->Param1.cb == 8, VERR_EM_INTERPRETER);
1887	switch(param1.type)
1888	{
1889	case DISQPV_TYPE_ADDRESS:
1890	GCPtrPar1 = param1.val.val64;
1891	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
1892
1893	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1894	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1895	break;
1896
1897	default:
1898	return VERR_EM_INTERPRETER;
1899	}
1900
1901	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
1902
1903	if (pDis->fPrefix & DISPREFIX_LOCK)
1904	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1905	else
1906	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
1907
1908	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1909
1910	/* Update guest's eflags and finish; note that only ZF is affected. */
1911	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1912	\| (eflags & (X86_EFL_ZF));
1913
1914	*pcbSize = 8;
1915	PGMPhysReleasePageMappingLock(pVM, &Lock);
1916	return VINF_SUCCESS;
1917	}
1918
1919
1920	#ifdef IN_RC /** @todo test+enable for HWACCM as well. */
1921	/**
1922	* [LOCK] XADD emulation.
1923	*/
1924	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1925	{
1926	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1927	DISQPVPARAMVAL param1;
1928	void *pvParamReg2;
1929	size_t cbParamReg2;
1930	NOREF(pvFault);
1931
1932	/* Source to make DISQueryParamVal read the register value - ugly hack */
1933	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1934	if(RT_FAILURE(rc))
1935	return VERR_EM_INTERPRETER;
1936
1937	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->Param2, &pvParamReg2, &cbParamReg2);
1938	Assert(cbParamReg2 <= 4);
1939	if(RT_FAILURE(rc))
1940	return VERR_EM_INTERPRETER;
1941
1942	#ifdef IN_RC
1943	if (TRPMHasTrap(pVCpu))
1944	{
1945	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1946	{
1947	#endif
1948	RTGCPTR GCPtrPar1;
1949	void *pvParam1;
1950	uint32_t eflags;
1951	PGMPAGEMAPLOCK Lock;
1952
1953	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
1954	switch(param1.type)
1955	{
1956	case DISQPV_TYPE_ADDRESS:
1957	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, (RTRCUINTPTR)param1.val.val64);
1958	#ifdef IN_RC
1959	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
1960	#endif
1961
1962	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
1963	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1964	break;
1965
1966	default:
1967	return VERR_EM_INTERPRETER;
1968	}
1969
1970	LogFlow(("XAdd %RGv=%p reg=%08llx\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2));
1971
1972	if (pDis->fPrefix & DISPREFIX_LOCK)
1973	eflags = EMEmulateLockXAdd(pvParam1, pvParamReg2, cbParamReg2);
1974	else
1975	eflags = EMEmulateXAdd(pvParam1, pvParamReg2, cbParamReg2);
1976
1977	LogFlow(("XAdd %RGv=%p reg=%08llx ZF=%d\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2, !!(eflags & X86_EFL_ZF) ));
1978
1979	/* Update guest's eflags and finish. */
1980	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1981	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1982
1983	*pcbSize = cbParamReg2;
1984	PGMPhysReleasePageMappingLock(pVM, &Lock);
1985	return VINF_SUCCESS;
1986	#ifdef IN_RC
1987	}
1988	}
1989
1990	return VERR_EM_INTERPRETER;
1991	#endif
1992	}
1993	#endif /* IN_RC */
1994
1995
1996	/**
1997	* IRET Emulation.
1998	*/
1999	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2000	{
2001	/* only allow direct calls to EMInterpretIret for now */
2002	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2003	return VERR_EM_INTERPRETER;
2004	}
2005
2006	/**
2007	* WBINVD Emulation.
2008	*/
2009	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2010	{
2011	/* Nothing to do. */
2012	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2013	return VINF_SUCCESS;
2014	}
2015
2016
2017	/**
2018	* Interpret INVLPG
2019	*
2020	* @returns VBox status code.
2021	* @param pVM The VM handle.
2022	* @param pVCpu The VMCPU handle.
2023	* @param pRegFrame The register frame.
2024	* @param pAddrGC Operand address
2025	*
2026	*/
2027	VMMDECL(VBOXSTRICTRC) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
2028	{
2029	/** @todo is addr always a flat linear address or ds based
2030	* (in absence of segment override prefixes)????
2031	*/
2032	NOREF(pVM); NOREF(pRegFrame);
2033	#ifdef IN_RC
2034	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
2035	#endif
2036	VBOXSTRICTRC rc = PGMInvalidatePage(pVCpu, pAddrGC);
2037	if ( rc == VINF_SUCCESS
2038	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
2039	return VINF_SUCCESS;
2040	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
2041	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), pAddrGC),
2042	VERR_EM_INTERPRETER);
2043	return rc;
2044	}
2045
2046
2047	/**
2048	* INVLPG Emulation.
2049	*/
2050	static VBOXSTRICTRC emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2051	{
2052	DISQPVPARAMVAL param1;
2053	RTGCPTR addr;
2054	NOREF(pvFault); NOREF(pVM); NOREF(pcbSize);
2055
2056	VBOXSTRICTRC rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2057	if(RT_FAILURE(rc))
2058	return VERR_EM_INTERPRETER;
2059
2060	switch(param1.type)
2061	{
2062	case DISQPV_TYPE_IMMEDIATE:
2063	case DISQPV_TYPE_ADDRESS:
2064	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2065	return VERR_EM_INTERPRETER;
2066	addr = (RTGCPTR)param1.val.val64;
2067	break;
2068
2069	default:
2070	return VERR_EM_INTERPRETER;
2071	}
2072
2073	/** @todo is addr always a flat linear address or ds based
2074	* (in absence of segment override prefixes)????
2075	*/
2076	#ifdef IN_RC
2077	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
2078	#endif
2079	rc = PGMInvalidatePage(pVCpu, addr);
2080	if ( rc == VINF_SUCCESS
2081	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
2082	return VINF_SUCCESS;
2083	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
2084	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), addr),
2085	VERR_EM_INTERPRETER);
2086	return rc;
2087	}
2088
2089	/** @todo change all these EMInterpretXXX methods to VBOXSTRICTRC. */
2090
2091	/**
2092	* Interpret CPUID given the parameters in the CPU context
2093	*
2094	* @returns VBox status code.
2095	* @param pVM The VM handle.
2096	* @param pVCpu The VMCPU handle.
2097	* @param pRegFrame The register frame.
2098	*
2099	*/
2100	VMMDECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2101	{
2102	uint32_t iLeaf = pRegFrame->eax;
2103	NOREF(pVM);
2104
2105	/* cpuid clears the high dwords of the affected 64 bits registers. */
2106	pRegFrame->rax = 0;
2107	pRegFrame->rbx = 0;
2108	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
2109	pRegFrame->rdx = 0;
2110
2111	/* Note: operates the same in 64 and non-64 bits mode. */
2112	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
2113	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
2114	return VINF_SUCCESS;
2115	}
2116
2117
2118	/**
2119	* CPUID Emulation.
2120	*/
2121	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2122	{
2123	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2124	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
2125	return rc;
2126	}
2127
2128
2129	/**
2130	* Interpret CRx read
2131	*
2132	* @returns VBox status code.
2133	* @param pVM The VM handle.
2134	* @param pVCpu The VMCPU handle.
2135	* @param pRegFrame The register frame.
2136	* @param DestRegGen General purpose register index (USE_REG_E**))
2137	* @param SrcRegCRx CRx register index (DISUSE_REG_CR*)
2138	*
2139	*/
2140	VMMDECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
2141	{
2142	uint64_t val64;
2143	int rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
2144	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
2145	NOREF(pVM);
2146
2147	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2148	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2149	else
2150	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
2151
2152	if (RT_SUCCESS(rc))
2153	{
2154	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
2155	return VINF_SUCCESS;
2156	}
2157	return VERR_EM_INTERPRETER;
2158	}
2159
2160
2161
2162	/**
2163	* Interpret CLTS
2164	*
2165	* @returns VBox status code.
2166	* @param pVM The VM handle.
2167	* @param pVCpu The VMCPU handle.
2168	*
2169	*/
2170	VMMDECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
2171	{
2172	NOREF(pVM);
2173	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2174	if (!(cr0 & X86_CR0_TS))
2175	return VINF_SUCCESS;
2176	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
2177	}
2178
2179	/**
2180	* CLTS Emulation.
2181	*/
2182	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2183	{
2184	NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2185	return EMInterpretCLTS(pVM, pVCpu);
2186	}
2187
2188
2189	/**
2190	* Update CRx
2191	*
2192	* @returns VBox status code.
2193	* @param pVM The VM handle.
2194	* @param pVCpu The VMCPU handle.
2195	* @param pRegFrame The register frame.
2196	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
2197	* @param val New CRx value
2198	*
2199	*/
2200	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
2201	{
2202	uint64_t oldval;
2203	uint64_t msrEFER;
2204	int rc, rc2;
2205	NOREF(pVM);
2206
2207	/** @todo Clean up this mess. */
2208	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
2209	switch (DestRegCrx)
2210	{
2211	case DISCREG_CR0:
2212	oldval = CPUMGetGuestCR0(pVCpu);
2213	#ifdef IN_RC
2214	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
2215	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
2216	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
2217	return VERR_EM_INTERPRETER;
2218	#endif
2219	rc = VINF_SUCCESS;
2220	CPUMSetGuestCR0(pVCpu, val);
2221	val = CPUMGetGuestCR0(pVCpu);
2222	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
2223	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
2224	{
2225	/* global flush */
2226	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2227	AssertRCReturn(rc, rc);
2228	}
2229
2230	/* Deal with long mode enabling/disabling. */
2231	msrEFER = CPUMGetGuestEFER(pVCpu);
2232	if (msrEFER & MSR_K6_EFER_LME)
2233	{
2234	if ( !(oldval & X86_CR0_PG)
2235	&& (val & X86_CR0_PG))
2236	{
2237	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2238	if (pRegFrame->csHid.Attr.n.u1Long)
2239	{
2240	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
2241	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2242	}
2243
2244	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2245	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
2246	{
2247	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
2248	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
2249	}
2250	msrEFER \|= MSR_K6_EFER_LMA;
2251	}
2252	else
2253	if ( (oldval & X86_CR0_PG)
2254	&& !(val & X86_CR0_PG))
2255	{
2256	msrEFER &= ~MSR_K6_EFER_LMA;
2257	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
2258	}
2259	CPUMSetGuestEFER(pVCpu, msrEFER);
2260	}
2261	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2262	return rc2 == VINF_SUCCESS ? rc : rc2;
2263
2264	case DISCREG_CR2:
2265	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
2266	return VINF_SUCCESS;
2267
2268	case DISCREG_CR3:
2269	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
2270	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
2271	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
2272	{
2273	/* flush */
2274	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
2275	AssertRC(rc);
2276	}
2277	return rc;
2278
2279	case DISCREG_CR4:
2280	oldval = CPUMGetGuestCR4(pVCpu);
2281	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
2282	val = CPUMGetGuestCR4(pVCpu);
2283
2284	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
2285	msrEFER = CPUMGetGuestEFER(pVCpu);
2286	if ( (msrEFER & MSR_K6_EFER_LMA)
2287	&& (oldval & X86_CR4_PAE)
2288	&& !(val & X86_CR4_PAE))
2289	{
2290	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
2291	}
2292
2293	rc = VINF_SUCCESS;
2294	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
2295	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
2296	{
2297	/* global flush */
2298	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
2299	AssertRCReturn(rc, rc);
2300	}
2301
2302	/* Feeling extremely lazy. */
2303	# ifdef IN_RC
2304	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
2305	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
2306	{
2307	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
2308	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
2309	}
2310	# endif
2311	if ((val ^ oldval) & X86_CR4_VME)
2312	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2313
2314	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2315	return rc2 == VINF_SUCCESS ? rc : rc2;
2316
2317	case DISCREG_CR8:
2318	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2319
2320	default:
2321	AssertFailed();
2322	case DISCREG_CR1: /* illegal op */
2323	break;
2324	}
2325	return VERR_EM_INTERPRETER;
2326	}
2327
2328	/**
2329	* Interpret CRx write
2330	*
2331	* @returns VBox status code.
2332	* @param pVM The VM handle.
2333	* @param pVCpu The VMCPU handle.
2334	* @param pRegFrame The register frame.
2335	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
2336	* @param SrcRegGen General purpose register index (USE_REG_E**))
2337	*
2338	*/
2339	VMMDECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
2340	{
2341	uint64_t val;
2342	int rc;
2343
2344	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2345	{
2346	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2347	}
2348	else
2349	{
2350	uint32_t val32;
2351	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2352	val = val32;
2353	}
2354
2355	if (RT_SUCCESS(rc))
2356	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
2357
2358	return VERR_EM_INTERPRETER;
2359	}
2360
2361	/**
2362	* Interpret LMSW
2363	*
2364	* @returns VBox status code.
2365	* @param pVM The VM handle.
2366	* @param pVCpu The VMCPU handle.
2367	* @param pRegFrame The register frame.
2368	* @param u16Data LMSW source data.
2369	*
2370	*/
2371	VMMDECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
2372	{
2373	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
2374
2375	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
2376	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
2377	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
2378
2379	return emUpdateCRx(pVM, pVCpu, pRegFrame, DISCREG_CR0, NewCr0);
2380	}
2381
2382	/**
2383	* LMSW Emulation.
2384	*/
2385	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2386	{
2387	DISQPVPARAMVAL param1;
2388	uint32_t val;
2389	NOREF(pvFault); NOREF(pcbSize);
2390
2391	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2392	if(RT_FAILURE(rc))
2393	return VERR_EM_INTERPRETER;
2394
2395	switch(param1.type)
2396	{
2397	case DISQPV_TYPE_IMMEDIATE:
2398	case DISQPV_TYPE_ADDRESS:
2399	if(!(param1.flags & DISQPV_FLAG_16))
2400	return VERR_EM_INTERPRETER;
2401	val = param1.val.val32;
2402	break;
2403
2404	default:
2405	return VERR_EM_INTERPRETER;
2406	}
2407
2408	LogFlow(("emInterpretLmsw %x\n", val));
2409	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
2410	}
2411
2412	#ifdef EM_EMULATE_SMSW
2413	/**
2414	* SMSW Emulation.
2415	*/
2416	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2417	{
2418	DISQPVPARAMVAL param1;
2419	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
2420
2421	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2422	if(RT_FAILURE(rc))
2423	return VERR_EM_INTERPRETER;
2424
2425	switch(param1.type)
2426	{
2427	case DISQPV_TYPE_IMMEDIATE:
2428	if(param1.size != sizeof(uint16_t))
2429	return VERR_EM_INTERPRETER;
2430	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->Param1.Base.idxGenReg, cr0));
2431	rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, cr0);
2432	break;
2433
2434	case DISQPV_TYPE_ADDRESS:
2435	{
2436	RTGCPTR pParam1;
2437
2438	/* Actually forced to 16 bits regardless of the operand size. */
2439	if(param1.size != sizeof(uint16_t))
2440	return VERR_EM_INTERPRETER;
2441
2442	pParam1 = (RTGCPTR)param1.val.val64;
2443	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2444	LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
2445
2446	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
2447	if (RT_FAILURE(rc))
2448	{
2449	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2450	return VERR_EM_INTERPRETER;
2451	}
2452	break;
2453	}
2454
2455	default:
2456	return VERR_EM_INTERPRETER;
2457	}
2458
2459	LogFlow(("emInterpretSmsw %x\n", cr0));
2460	return rc;
2461	}
2462	#endif
2463
2464	/**
2465	* MOV CRx
2466	*/
2467	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2468	{
2469	NOREF(pvFault); NOREF(pcbSize);
2470	if ((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_CR)
2471	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxCtrlReg);
2472
2473	if (pDis->Param1.fUse == DISUSE_REG_CR && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
2474	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxCtrlReg, pDis->Param2.Base.idxGenReg);
2475
2476	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
2477	}
2478
2479
2480	/**
2481	* Interpret DRx write
2482	*
2483	* @returns VBox status code.
2484	* @param pVM The VM handle.
2485	* @param pVCpu The VMCPU handle.
2486	* @param pRegFrame The register frame.
2487	* @param DestRegDRx DRx register index (USE_REG_DR*)
2488	* @param SrcRegGen General purpose register index (USE_REG_E**))
2489	*
2490	*/
2491	VMMDECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
2492	{
2493	uint64_t val;
2494	int rc;
2495	NOREF(pVM);
2496
2497	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2498	{
2499	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
2500	}
2501	else
2502	{
2503	uint32_t val32;
2504	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
2505	val = val32;
2506	}
2507
2508	if (RT_SUCCESS(rc))
2509	{
2510	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
2511	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
2512	if (RT_SUCCESS(rc))
2513	return rc;
2514	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
2515	}
2516	return VERR_EM_INTERPRETER;
2517	}
2518
2519
2520	/**
2521	* Interpret DRx read
2522	*
2523	* @returns VBox status code.
2524	* @param pVM The VM handle.
2525	* @param pVCpu The VMCPU handle.
2526	* @param pRegFrame The register frame.
2527	* @param DestRegGen General purpose register index (USE_REG_E**))
2528	* @param SrcRegDRx DRx register index (USE_REG_DR*)
2529	*
2530	*/
2531	VMMDECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
2532	{
2533	uint64_t val64;
2534	NOREF(pVM);
2535
2536	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
2537	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
2538	if (CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
2539	{
2540	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
2541	}
2542	else
2543	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
2544
2545	if (RT_SUCCESS(rc))
2546	return VINF_SUCCESS;
2547
2548	return VERR_EM_INTERPRETER;
2549	}
2550
2551
2552	/**
2553	* MOV DRx
2554	*/
2555	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2556	{
2557	int rc = VERR_EM_INTERPRETER;
2558	NOREF(pvFault); NOREF(pcbSize);
2559
2560	if((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_DBG)
2561	{
2562	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxDbgReg);
2563	}
2564	else
2565	if(pDis->Param1.fUse == DISUSE_REG_DBG && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
2566	{
2567	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxDbgReg, pDis->Param2.Base.idxGenReg);
2568	}
2569	else
2570	AssertMsgFailed(("Unexpected debug register move\n"));
2571
2572	return rc;
2573	}
2574
2575
2576	/**
2577	* LLDT Emulation.
2578	*/
2579	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2580	{
2581	DISQPVPARAMVAL param1;
2582	RTSEL sel;
2583	NOREF(pVM); NOREF(pvFault); NOREF(pcbSize);
2584
2585	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2586	if(RT_FAILURE(rc))
2587	return VERR_EM_INTERPRETER;
2588
2589	switch(param1.type)
2590	{
2591	case DISQPV_TYPE_ADDRESS:
2592	return VERR_EM_INTERPRETER; //feeling lazy right now
2593
2594	case DISQPV_TYPE_IMMEDIATE:
2595	if(!(param1.flags & DISQPV_FLAG_16))
2596	return VERR_EM_INTERPRETER;
2597	sel = (RTSEL)param1.val.val16;
2598	break;
2599
2600	default:
2601	return VERR_EM_INTERPRETER;
2602	}
2603
2604	#ifdef IN_RING0
2605	/* Only for the VT-x real-mode emulation case. */
2606	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2607	CPUMSetGuestLDTR(pVCpu, sel);
2608	return VINF_SUCCESS;
2609	#else
2610	if (sel == 0)
2611	{
2612	if (CPUMGetHyperLDTR(pVCpu) == 0)
2613	{
2614	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
2615	return VINF_SUCCESS;
2616	}
2617	}
2618	//still feeling lazy
2619	return VERR_EM_INTERPRETER;
2620	#endif
2621	}
2622
2623	#ifdef IN_RING0
2624	/**
2625	* LIDT/LGDT Emulation.
2626	*/
2627	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2628	{
2629	DISQPVPARAMVAL param1;
2630	RTGCPTR pParam1;
2631	X86XDTR32 dtr32;
2632	NOREF(pvFault); NOREF(pcbSize);
2633
2634	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
2635
2636	/* Only for the VT-x real-mode emulation case. */
2637	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
2638
2639	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2640	if(RT_FAILURE(rc))
2641	return VERR_EM_INTERPRETER;
2642
2643	switch(param1.type)
2644	{
2645	case DISQPV_TYPE_ADDRESS:
2646	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, param1.val.val16);
2647	break;
2648
2649	default:
2650	return VERR_EM_INTERPRETER;
2651	}
2652
2653	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
2654	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2655
2656	if (!(pDis->fPrefix & DISPREFIX_OPSIZE))
2657	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
2658
2659	if (pDis->pCurInstr->uOpcode == OP_LIDT)
2660	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2661	else
2662	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
2663
2664	return VINF_SUCCESS;
2665	}
2666	#endif
2667
2668
2669	#ifdef IN_RC
2670	/**
2671	* STI Emulation.
2672	*
2673	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
2674	*/
2675	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2676	{
2677	NOREF(pcbSize);
2678	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
2679
2680	if(!pGCState)
2681	{
2682	Assert(pGCState);
2683	return VERR_EM_INTERPRETER;
2684	}
2685	pGCState->uVMFlags \|= X86_EFL_IF;
2686
2687	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
2688	Assert(pvFault == SELMToFlat(pVM, DISSELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
2689
2690	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->cbInstr;
2691	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2692
2693	return VINF_SUCCESS;
2694	}
2695	#endif /* IN_RC */
2696
2697
2698	/**
2699	* HLT Emulation.
2700	*/
2701	static VBOXSTRICTRC
2702	emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2703	{
2704	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
2705	return VINF_EM_HALT;
2706	}
2707
2708
2709	/**
2710	* Interpret RDTSC
2711	*
2712	* @returns VBox status code.
2713	* @param pVM The VM handle.
2714	* @param pVCpu The VMCPU handle.
2715	* @param pRegFrame The register frame.
2716	*
2717	*/
2718	VMMDECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2719	{
2720	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2721
2722	if (uCR4 & X86_CR4_TSD)
2723	return VERR_EM_INTERPRETER; /* genuine #GP */
2724
2725	uint64_t uTicks = TMCpuTickGet(pVCpu);
2726
2727	/* Same behaviour in 32 & 64 bits mode */
2728	pRegFrame->rax = (uint32_t)uTicks;
2729	pRegFrame->rdx = (uTicks >> 32ULL);
2730
2731	NOREF(pVM);
2732	return VINF_SUCCESS;
2733	}
2734
2735	/**
2736	* Interpret RDTSCP
2737	*
2738	* @returns VBox status code.
2739	* @param pVM The VM handle.
2740	* @param pVCpu The VMCPU handle.
2741	* @param pCtx The CPU context.
2742	*
2743	*/
2744	VMMDECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2745	{
2746	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2747
2748	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
2749	{
2750	AssertFailed();
2751	return VERR_EM_INTERPRETER; /* genuine #UD */
2752	}
2753
2754	if (uCR4 & X86_CR4_TSD)
2755	return VERR_EM_INTERPRETER; /* genuine #GP */
2756
2757	uint64_t uTicks = TMCpuTickGet(pVCpu);
2758
2759	/* Same behaviour in 32 & 64 bits mode */
2760	pCtx->rax = (uint32_t)uTicks;
2761	pCtx->rdx = (uTicks >> 32ULL);
2762	/* Low dword of the TSC_AUX msr only. */
2763	CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
2764	pCtx->rcx &= UINT32_C(0xffffffff);
2765
2766	return VINF_SUCCESS;
2767	}
2768
2769	/**
2770	* RDTSC Emulation.
2771	*/
2772	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2773	{
2774	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2775	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
2776	}
2777
2778	/**
2779	* Interpret RDPMC
2780	*
2781	* @returns VBox status code.
2782	* @param pVM The VM handle.
2783	* @param pVCpu The VMCPU handle.
2784	* @param pRegFrame The register frame.
2785	*
2786	*/
2787	VMMDECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2788	{
2789	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
2790
2791	/* If X86_CR4_PCE is not set, then CPL must be zero. */
2792	if ( !(uCR4 & X86_CR4_PCE)
2793	&& CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
2794	{
2795	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
2796	return VERR_EM_INTERPRETER; /* genuine #GP */
2797	}
2798
2799	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
2800	pRegFrame->rax = 0;
2801	pRegFrame->rdx = 0;
2802	/** @todo We should trigger a #GP here if the cpu doesn't support the index in ecx. */
2803
2804	NOREF(pVM);
2805	return VINF_SUCCESS;
2806	}
2807
2808	/**
2809	* RDPMC Emulation
2810	*/
2811	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2812	{
2813	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2814	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
2815	}
2816
2817
2818	/**
2819	* MONITOR Emulation.
2820	*/
2821	VMMDECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2822	{
2823	uint32_t u32Dummy, u32ExtFeatures, cpl;
2824	NOREF(pVM);
2825
2826	if (pRegFrame->ecx != 0)
2827	{
2828	Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
2829	return VERR_EM_INTERPRETER; /* illegal value. */
2830	}
2831
2832	/* Get the current privilege level. */
2833	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2834	if (cpl != 0)
2835	return VERR_EM_INTERPRETER; /* supervisor only */
2836
2837	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2838	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2839	return VERR_EM_INTERPRETER; /* not supported */
2840
2841	EMMonitorWaitPrepare(pVCpu, pRegFrame->rax, pRegFrame->rcx, pRegFrame->rdx);
2842	return VINF_SUCCESS;
2843	}
2844
2845	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2846	{
2847	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2848	return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
2849	}
2850
2851
2852	/**
2853	* MWAIT Emulation.
2854	*/
2855	VMMDECL(VBOXSTRICTRC) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
2856	{
2857	uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
2858	NOREF(pVM);
2859
2860	/* Get the current privilege level. */
2861	cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2862	if (cpl != 0)
2863	return VERR_EM_INTERPRETER; /* supervisor only */
2864
2865	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2866	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2867	return VERR_EM_INTERPRETER; /* not supported */
2868
2869	/*
2870	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
2871	* CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
2872	*/
2873	CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
2874	if (pRegFrame->ecx > 1)
2875	{
2876	Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
2877	return VERR_EM_INTERPRETER; /* illegal value. */
2878	}
2879
2880	if (pRegFrame->ecx && !(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
2881	{
2882	Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
2883	return VERR_EM_INTERPRETER; /* illegal value. */
2884	}
2885
2886	return EMMonitorWaitPerform(pVCpu, pRegFrame->rax, pRegFrame->rcx);
2887	}
2888
2889	static VBOXSTRICTRC emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2890	{
2891	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
2892	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
2893	}
2894
2895
2896	#ifdef LOG_ENABLED
2897	static const char *emMSRtoString(uint32_t uMsr)
2898	{
2899	switch (uMsr)
2900	{
2901	case MSR_IA32_APICBASE:
2902	return "MSR_IA32_APICBASE";
2903	case MSR_IA32_CR_PAT:
2904	return "MSR_IA32_CR_PAT";
2905	case MSR_IA32_SYSENTER_CS:
2906	return "MSR_IA32_SYSENTER_CS";
2907	case MSR_IA32_SYSENTER_EIP:
2908	return "MSR_IA32_SYSENTER_EIP";
2909	case MSR_IA32_SYSENTER_ESP:
2910	return "MSR_IA32_SYSENTER_ESP";
2911	case MSR_K6_EFER:
2912	return "MSR_K6_EFER";
2913	case MSR_K8_SF_MASK:
2914	return "MSR_K8_SF_MASK";
2915	case MSR_K6_STAR:
2916	return "MSR_K6_STAR";
2917	case MSR_K8_LSTAR:
2918	return "MSR_K8_LSTAR";
2919	case MSR_K8_CSTAR:
2920	return "MSR_K8_CSTAR";
2921	case MSR_K8_FS_BASE:
2922	return "MSR_K8_FS_BASE";
2923	case MSR_K8_GS_BASE:
2924	return "MSR_K8_GS_BASE";
2925	case MSR_K8_KERNEL_GS_BASE:
2926	return "MSR_K8_KERNEL_GS_BASE";
2927	case MSR_K8_TSC_AUX:
2928	return "MSR_K8_TSC_AUX";
2929	case MSR_IA32_BIOS_SIGN_ID:
2930	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
2931	case MSR_IA32_PLATFORM_ID:
2932	return "Unsupported MSR_IA32_PLATFORM_ID";
2933	case MSR_IA32_BIOS_UPDT_TRIG:
2934	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
2935	case MSR_IA32_TSC:
2936	return "MSR_IA32_TSC";
2937	case MSR_IA32_MISC_ENABLE:
2938	return "MSR_IA32_MISC_ENABLE";
2939	case MSR_IA32_MTRR_CAP:
2940	return "MSR_IA32_MTRR_CAP";
2941	case MSR_IA32_MCP_CAP:
2942	return "Unsupported MSR_IA32_MCP_CAP";
2943	case MSR_IA32_MCP_STATUS:
2944	return "Unsupported MSR_IA32_MCP_STATUS";
2945	case MSR_IA32_MCP_CTRL:
2946	return "Unsupported MSR_IA32_MCP_CTRL";
2947	case MSR_IA32_MTRR_DEF_TYPE:
2948	return "MSR_IA32_MTRR_DEF_TYPE";
2949	case MSR_K7_EVNTSEL0:
2950	return "Unsupported MSR_K7_EVNTSEL0";
2951	case MSR_K7_EVNTSEL1:
2952	return "Unsupported MSR_K7_EVNTSEL1";
2953	case MSR_K7_EVNTSEL2:
2954	return "Unsupported MSR_K7_EVNTSEL2";
2955	case MSR_K7_EVNTSEL3:
2956	return "Unsupported MSR_K7_EVNTSEL3";
2957	case MSR_IA32_MC0_CTL:
2958	return "Unsupported MSR_IA32_MC0_CTL";
2959	case MSR_IA32_MC0_STATUS:
2960	return "Unsupported MSR_IA32_MC0_STATUS";
2961	case MSR_IA32_PERFEVTSEL0:
2962	return "Unsupported MSR_IA32_PERFEVTSEL0";
2963	case MSR_IA32_PERFEVTSEL1:
2964	return "Unsupported MSR_IA32_PERFEVTSEL1";
2965	case MSR_IA32_PERF_STATUS:
2966	return "MSR_IA32_PERF_STATUS";
2967	case MSR_IA32_PLATFORM_INFO:
2968	return "MSR_IA32_PLATFORM_INFO";
2969	case MSR_IA32_PERF_CTL:
2970	return "Unsupported MSR_IA32_PERF_CTL";
2971	case MSR_K7_PERFCTR0:
2972	return "Unsupported MSR_K7_PERFCTR0";
2973	case MSR_K7_PERFCTR1:
2974	return "Unsupported MSR_K7_PERFCTR1";
2975	case MSR_K7_PERFCTR2:
2976	return "Unsupported MSR_K7_PERFCTR2";
2977	case MSR_K7_PERFCTR3:
2978	return "Unsupported MSR_K7_PERFCTR3";
2979	case MSR_IA32_PMC0:
2980	return "Unsupported MSR_IA32_PMC0";
2981	case MSR_IA32_PMC1:
2982	return "Unsupported MSR_IA32_PMC1";
2983	case MSR_IA32_PMC2:
2984	return "Unsupported MSR_IA32_PMC2";
2985	case MSR_IA32_PMC3:
2986	return "Unsupported MSR_IA32_PMC3";
2987	}
2988	return "Unknown MSR";
2989	}
2990	#endif /* LOG_ENABLED */
2991
2992
2993	/**
2994	* Interpret RDMSR
2995	*
2996	* @returns VBox status code.
2997	* @param pVM The VM handle.
2998	* @param pVCpu The VMCPU handle.
2999	* @param pRegFrame The register frame.
3000	*/
3001	VMMDECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3002	{
3003	/** @todo According to the Intel manuals, there's a REX version of RDMSR that is slightly different.
3004	* That version clears the high dwords of both RDX & RAX */
3005	NOREF(pVM);
3006
3007	/* Get the current privilege level. */
3008	if (CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
3009	return VERR_EM_INTERPRETER; /* supervisor only */
3010
3011	uint64_t uValue;
3012	int rc = CPUMQueryGuestMsr(pVCpu, pRegFrame->ecx, &uValue);
3013	if (RT_UNLIKELY(rc != VINF_SUCCESS))
3014	{
3015	Assert(rc == VERR_CPUM_RAISE_GP_0);
3016	return VERR_EM_INTERPRETER;
3017	}
3018	pRegFrame->rax = (uint32_t) uValue;
3019	pRegFrame->rdx = (uint32_t)(uValue >> 32);
3020	LogFlow(("EMInterpretRdmsr %s (%x) -> %RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, uValue));
3021	return rc;
3022	}
3023
3024
3025	/**
3026	* RDMSR Emulation.
3027	*/
3028	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3029	{
3030	/* Note: The Intel manual claims there's a REX version of RDMSR that's slightly
3031	different, so we play safe by completely disassembling the instruction. */
3032	Assert(!(pDis->fPrefix & DISPREFIX_REX));
3033	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3034	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
3035	}
3036
3037
3038	/**
3039	* Interpret WRMSR
3040	*
3041	* @returns VBox status code.
3042	* @param pVM The VM handle.
3043	* @param pVCpu The VMCPU handle.
3044	* @param pRegFrame The register frame.
3045	*/
3046	VMMDECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3047	{
3048	/* Check the current privilege level, this instruction is supervisor only. */
3049	if (CPUMGetGuestCPL(pVCpu, pRegFrame) != 0)
3050	return VERR_EM_INTERPRETER; /** @todo raise \#GP(0) */
3051
3052	int rc = CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx));
3053	if (rc != VINF_SUCCESS)
3054	{
3055	Assert(rc == VERR_CPUM_RAISE_GP_0);
3056	return VERR_EM_INTERPRETER;
3057	}
3058	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx,
3059	RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx)));
3060	NOREF(pVM);
3061	return rc;
3062	}
3063
3064
3065	/**
3066	* WRMSR Emulation.
3067	*/
3068	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3069	{
3070	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3071	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3072	}
3073
3074
3075	/**
3076	* Internal worker.
3077	* @copydoc emInterpretInstructionCPUOuter
3078	*/
3079	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3080	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3081	{
3082	Assert(enmCodeType == EMCODETYPE_SUPERVISOR \|\| enmCodeType == EMCODETYPE_ALL);
3083	Assert(pcbSize);
3084	*pcbSize = 0;
3085
3086	if (enmCodeType == EMCODETYPE_SUPERVISOR)
3087	{
3088	/*
3089	* Only supervisor guest code!!
3090	* And no complicated prefixes.
3091	*/
3092	/* Get the current privilege level. */
3093	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
3094	if ( cpl != 0
3095	&& pDis->pCurInstr->uOpcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3096	{
3097	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3098	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3099	return VERR_EM_INTERPRETER;
3100	}
3101	}
3102	else
3103	Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3104
3105	#ifdef IN_RC
3106	if ( (pDis->fPrefix & (DISPREFIX_REPNE \| DISPREFIX_REP))
3107	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3108	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3109	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3110	&& pDis->pCurInstr->uOpcode != OP_XADD
3111	&& pDis->pCurInstr->uOpcode != OP_OR
3112	&& pDis->pCurInstr->uOpcode != OP_AND
3113	&& pDis->pCurInstr->uOpcode != OP_XOR
3114	&& pDis->pCurInstr->uOpcode != OP_BTR
3115	)
3116	)
3117	#else
3118	if ( (pDis->fPrefix & DISPREFIX_REPNE)
3119	\|\| ( (pDis->fPrefix & DISPREFIX_REP)
3120	&& pDis->pCurInstr->uOpcode != OP_STOSWD
3121	)
3122	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3123	&& pDis->pCurInstr->uOpcode != OP_OR
3124	&& pDis->pCurInstr->uOpcode != OP_AND
3125	&& pDis->pCurInstr->uOpcode != OP_XOR
3126	&& pDis->pCurInstr->uOpcode != OP_BTR
3127	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3128	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3129	)
3130	)
3131	#endif
3132	{
3133	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3134	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3135	return VERR_EM_INTERPRETER;
3136	}
3137
3138	#if HC_ARCH_BITS == 32
3139	/*
3140	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3141	* Whitelisted instructions are safe.
3142	*/
3143	if ( pDis->Param1.cb > 4
3144	&& CPUMIsGuestIn64BitCode(pVCpu, pRegFrame))
3145	{
3146	uint32_t uOpCode = pDis->pCurInstr->uOpcode;
3147	if ( uOpCode != OP_STOSWD
3148	&& uOpCode != OP_MOV
3149	&& uOpCode != OP_CMPXCHG8B
3150	&& uOpCode != OP_XCHG
3151	&& uOpCode != OP_BTS
3152	&& uOpCode != OP_BTR
3153	&& uOpCode != OP_BTC
3154	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3155	&& uOpCode != OP_CMPXCHG /* solaris */
3156	&& uOpCode != OP_AND /* windows */
3157	&& uOpCode != OP_OR /* windows */
3158	&& uOpCode != OP_XOR /* because we can */
3159	&& uOpCode != OP_ADD /* windows (dripple) */
3160	&& uOpCode != OP_ADC /* because we can */
3161	&& uOpCode != OP_SUB /* because we can */
3162	/** @todo OP_BTS or is that a different kind of failure? */
3163	# endif
3164	)
3165	{
3166	# ifdef VBOX_WITH_STATISTICS
3167	switch (pDis->pCurInstr->uOpcode)
3168	{
3169	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3170	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3171	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3172	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3173	INTERPRET_FAILED_CASE(OP_INC,Inc);
3174	INTERPRET_FAILED_CASE(OP_POP,Pop);
3175	INTERPRET_FAILED_CASE(OP_OR, Or);
3176	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3177	INTERPRET_FAILED_CASE(OP_AND,And);
3178	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3179	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3180	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3181	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3182	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3183	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3184	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3185	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3186	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3187	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3188	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3189	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3190	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3191	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3192	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3193	INTERPRET_FAILED_CASE(OP_ADD,Add);
3194	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3195	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3196	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3197	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3198	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3199	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3200	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3201	INTERPRET_FAILED_CASE(OP_STI, Sti);
3202	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3203	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3204	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3205	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3206	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3207	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3208	# undef INTERPRET_FAILED_CASE
3209	default:
3210	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3211	break;
3212	}
3213	# endif /* VBOX_WITH_STATISTICS */
3214	return VERR_EM_INTERPRETER;
3215	}
3216	}
3217	#endif
3218
3219	VBOXSTRICTRC rc;
3220	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3221	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3222	#endif
3223	switch (pDis->pCurInstr->uOpcode)
3224	{
3225	/*
3226	* Macros for generating the right case statements.
3227	*/
3228	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3229	case opcode:\
3230	if (pDis->fPrefix & DISPREFIX_LOCK) \
3231	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3232	else \
3233	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3234	if (RT_SUCCESS(rc)) \
3235	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3236	else \
3237	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3238	return rc
3239	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3240	case opcode:\
3241	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3242	if (RT_SUCCESS(rc)) \
3243	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3244	else \
3245	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3246	return rc
3247
3248	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3249	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3250	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3251	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3252
3253	#define INTERPRET_CASE(opcode, Instr) \
3254	case opcode:\
3255	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3256	if (RT_SUCCESS(rc)) \
3257	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3258	else \
3259	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3260	return rc
3261
3262	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3263	case opcode:\
3264	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3265	if (RT_SUCCESS(rc)) \
3266	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3267	else \
3268	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3269	return rc
3270
3271	#define INTERPRET_STAT_CASE(opcode, Instr) \
3272	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3273
3274	/*
3275	* The actual case statements.
3276	*/
3277	INTERPRET_CASE(OP_XCHG,Xchg);
3278	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3279	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3280	INTERPRET_CASE(OP_POP,Pop);
3281	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3282	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3283	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3284	INTERPRET_CASE(OP_MOV,Mov);
3285	#ifndef IN_RC
3286	INTERPRET_CASE(OP_STOSWD,StosWD);
3287	#endif
3288	INTERPRET_CASE(OP_INVLPG,InvlPg);
3289	INTERPRET_CASE(OP_CPUID,CpuId);
3290	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3291	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3292	#ifdef IN_RING0
3293	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3294	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3295	#endif
3296	INTERPRET_CASE(OP_LLDT,LLdt);
3297	INTERPRET_CASE(OP_LMSW,Lmsw);
3298	#ifdef EM_EMULATE_SMSW
3299	INTERPRET_CASE(OP_SMSW,Smsw);
3300	#endif
3301	INTERPRET_CASE(OP_CLTS,Clts);
3302	INTERPRET_CASE(OP_MONITOR, Monitor);
3303	INTERPRET_CASE(OP_MWAIT, MWait);
3304	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3305	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3306	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3307	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3308	INTERPRET_CASE(OP_ADC,Adc);
3309	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3310	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3311	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3312	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3313	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3314	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3315	#ifdef IN_RC
3316	INTERPRET_CASE(OP_STI,Sti);
3317	INTERPRET_CASE(OP_XADD, XAdd);
3318	#endif
3319	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3320	INTERPRET_CASE(OP_HLT,Hlt);
3321	INTERPRET_CASE(OP_IRET,Iret);
3322	INTERPRET_CASE(OP_WBINVD,WbInvd);
3323	#ifdef VBOX_WITH_STATISTICS
3324	# ifndef IN_RC
3325	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3326	# endif
3327	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3328	#endif
3329
3330	default:
3331	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->uOpcode));
3332	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3333	return VERR_EM_INTERPRETER;
3334
3335	#undef INTERPRET_CASE_EX_PARAM2
3336	#undef INTERPRET_STAT_CASE
3337	#undef INTERPRET_CASE_EX
3338	#undef INTERPRET_CASE
3339	} /* switch (opcode) */
3340	/* not reached */
3341	}
3342
3343	/**
3344	* Interprets the current instruction using the supplied DISCPUSTATE structure.
3345	*
3346	* EIP is NOT updated!
3347	*
3348	* @returns VBox strict status code.
3349	* @retval VINF_* Scheduling instructions. When these are returned, it
3350	* starts to get a bit tricky to know whether code was
3351	* executed or not... We'll address this when it becomes a problem.
3352	* @retval VERR_EM_INTERPRETER Something we can't cope with.
3353	* @retval VERR_* Fatal errors.
3354	*
3355	* @param pVCpu The VMCPU handle.
3356	* @param pDis The disassembler cpu state for the instruction to be
3357	* interpreted.
3358	* @param pRegFrame The register frame. EIP is NOT changed!
3359	* @param pvFault The fault address (CR2).
3360	* @param pcbSize Size of the write (if applicable).
3361	* @param enmCodeType Code type (user/supervisor)
3362	*
3363	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
3364	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
3365	* to worry about e.g. invalid modrm combinations (!)
3366	*
3367	* @todo At this time we do NOT check if the instruction overwrites vital information.
3368	* Make sure this can't happen!! (will add some assertions/checks later)
3369	*/
3370	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3371	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3372	{
3373	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3374	VBOXSTRICTRC rc = emInterpretInstructionCPU(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, pRegFrame, pvFault, enmCodeType, pcbSize);
3375	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3376	if (RT_SUCCESS(rc))
3377	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
3378	else
3379	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
3380	return rc;
3381	}
3382
3383
3384	#endif /* !VBOX_WITH_IEM */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 41744

Download in other formats: