EMAll.cpp@ 44375

Last change on this file since 44375 was 44375, checked in by vboxsync, 12 years ago
EM: pVM -> pUVM for main, mark as many as possible interfaces module internal.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 135.8 KB

Line
1	/* $Id: EMAll.cpp 44375 2013-01-25 12:41:24Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_EM
22	#include <VBox/vmm/em.h>
23	#include <VBox/vmm/mm.h>
24	#include <VBox/vmm/selm.h>
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/csam.h>
27	#include <VBox/vmm/pgm.h>
28	#ifdef VBOX_WITH_IEM
29	# include <VBox/vmm/iem.h>
30	#endif
31	#include <VBox/vmm/iom.h>
32	#include <VBox/vmm/stam.h>
33	#include "EMInternal.h"
34	#include <VBox/vmm/vm.h>
35	#include <VBox/vmm/vmm.h>
36	#include <VBox/vmm/hm.h>
37	#include <VBox/vmm/tm.h>
38	#include <VBox/vmm/pdmapi.h>
39	#include <VBox/param.h>
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/log.h>
44	#include "internal/pgm.h"
45	#include <iprt/assert.h>
46	#include <iprt/asm.h>
47	#include <iprt/string.h>
48
49	#ifndef IN_RC
50	#undef VBOX_WITH_IEM
51	#endif
52	#ifdef VBOX_WITH_IEM
53	//# define VBOX_COMPARE_IEM_AND_EM /* debugging... */
54	//# define VBOX_SAME_AS_EM
55	//# define VBOX_COMPARE_IEM_LAST
56	#endif
57
58	/*******************************************************************************
59	* Defined Constants And Macros *
60	*******************************************************************************/
61	/** @def EM_ASSERT_FAULT_RETURN
62	* Safety check.
63	*
64	* Could in theory misfire on a cross page boundary access...
65	*
66	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
67	* turns up an alias page instead of the original faulting one and annoying the
68	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
69	*/
70	#if 0
71	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
72	#else
73	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
74	#endif
75
76
77	/*******************************************************************************
78	* Internal Functions *
79	*******************************************************************************/
80	#if !defined(VBOX_WITH_IEM) \|\| defined(VBOX_COMPARE_IEM_AND_EM)
81	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
82	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize);
83	#endif
84
85
86	/*******************************************************************************
87	* Global Variables *
88	*******************************************************************************/
89	#ifdef VBOX_COMPARE_IEM_AND_EM
90	static const uint32_t g_fInterestingFFs = VMCPU_FF_TO_R3
91	\| VMCPU_FF_CSAM_PENDING_ACTION \| VMCPU_FF_CSAM_SCAN_PAGE \| VMCPU_FF_INHIBIT_INTERRUPTS
92	\| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
93	\| VMCPU_FF_TLB_FLUSH \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL;
94	static uint32_t g_fIncomingFFs;
95	static CPUMCTX g_IncomingCtx;
96	static bool g_fIgnoreRaxRdx = false;
97
98	static uint32_t g_fEmFFs;
99	static CPUMCTX g_EmCtx;
100	static uint8_t g_abEmWrote[256];
101	static size_t g_cbEmWrote;
102
103	static uint32_t g_fIemFFs;
104	static CPUMCTX g_IemCtx;
105	extern uint8_t g_abIemWrote[256];
106	#if defined(VBOX_COMPARE_IEM_FIRST) \|\| defined(VBOX_COMPARE_IEM_LAST)
107	extern size_t g_cbIemWrote;
108	#else
109	static size_t g_cbIemWrote;
110	#endif
111	#endif
112
113
114	/**
115	* Get the current execution manager status.
116	*
117	* @returns Current status.
118	* @param pVCpu Pointer to the VMCPU.
119	*/
120	VMM_INT_DECL(EMSTATE) EMGetState(PVMCPU pVCpu)
121	{
122	return pVCpu->em.s.enmState;
123	}
124
125	/**
126	* Sets the current execution manager status. (use only when you know what you're doing!)
127	*
128	* @param pVCpu Pointer to the VMCPU.
129	*/
130	VMM_INT_DECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
131	{
132	/* Only allowed combination: */
133	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
134	pVCpu->em.s.enmState = enmNewState;
135	}
136
137
138	/**
139	* Sets the PC for which interrupts should be inhibited.
140	*
141	* @param pVCpu Pointer to the VMCPU.
142	* @param PC The PC.
143	*/
144	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
145	{
146	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
147	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
148	}
149
150
151	/**
152	* Gets the PC for which interrupts should be inhibited.
153	*
154	* There are a few instructions which inhibits or delays interrupts
155	* for the instruction following them. These instructions are:
156	* - STI
157	* - MOV SS, r/m16
158	* - POP SS
159	*
160	* @returns The PC for which interrupts should be inhibited.
161	* @param pVCpu Pointer to the VMCPU.
162	*
163	*/
164	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
165	{
166	return pVCpu->em.s.GCPtrInhibitInterrupts;
167	}
168
169
170	/**
171	* Prepare an MWAIT - essentials of the MONITOR instruction.
172	*
173	* @returns VINF_SUCCESS
174	* @param pVCpu The current CPU.
175	* @param rax The content of RAX.
176	* @param rcx The content of RCX.
177	* @param rdx The content of RDX.
178	*/
179	VMM_INT_DECL(int) EMMonitorWaitPrepare(PVMCPU pVCpu, uint64_t rax, uint64_t rcx, uint64_t rdx)
180	{
181	pVCpu->em.s.MWait.uMonitorRAX = rax;
182	pVCpu->em.s.MWait.uMonitorRCX = rcx;
183	pVCpu->em.s.MWait.uMonitorRDX = rdx;
184	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_MONITOR_ACTIVE;
185	/** @todo Complete MONITOR implementation. */
186	return VINF_SUCCESS;
187	}
188
189
190	/**
191	* Performs an MWAIT.
192	*
193	* @returns VINF_SUCCESS
194	* @param pVCpu The current CPU.
195	* @param rax The content of RAX.
196	* @param rcx The content of RCX.
197	*/
198	VMM_INT_DECL(int) EMMonitorWaitPerform(PVMCPU pVCpu, uint64_t rax, uint64_t rcx)
199	{
200	pVCpu->em.s.MWait.uMWaitRAX = rax;
201	pVCpu->em.s.MWait.uMWaitRCX = rcx;
202	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_ACTIVE;
203	if (rcx)
204	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_BREAKIRQIF0;
205	else
206	pVCpu->em.s.MWait.fWait &= ~EMMWAIT_FLAG_BREAKIRQIF0;
207	/** @todo not completely correct?? */
208	return VINF_EM_HALT;
209	}
210
211
212
213	/**
214	* Determine if we should continue after encountering a hlt or mwait
215	* instruction.
216	*
217	* Clears MWAIT flags if returning @c true.
218	*
219	* @returns boolean
220	* @param pVCpu Pointer to the VMCPU.
221	* @param pCtx Current CPU context.
222	*/
223	VMM_INT_DECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
224	{
225	if ( pCtx->eflags.Bits.u1IF
226	\|\| ( (pVCpu->em.s.MWait.fWait & (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0))
227	== (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)) )
228	{
229	pVCpu->em.s.MWait.fWait &= ~(EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0);
230	return !!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC));
231	}
232
233	return false;
234	}
235
236
237	/**
238	* Locks REM execution to a single VCPU.
239	*
240	* @param pVM Pointer to the VM.
241	*/
242	VMMDECL(void) EMRemLock(PVM pVM)
243	{
244	#ifdef VBOX_WITH_REM
245	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
246	return; /* early init */
247
248	Assert(!PGMIsLockOwner(pVM));
249	Assert(!IOMIsLockOwner(pVM));
250	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
251	AssertRCSuccess(rc);
252	#endif
253	}
254
255
256	/**
257	* Unlocks REM execution
258	*
259	* @param pVM Pointer to the VM.
260	*/
261	VMMDECL(void) EMRemUnlock(PVM pVM)
262	{
263	#ifdef VBOX_WITH_REM
264	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
265	return; /* early init */
266
267	PDMCritSectLeave(&pVM->em.s.CritSectREM);
268	#endif
269	}
270
271
272	/**
273	* Check if this VCPU currently owns the REM lock.
274	*
275	* @returns bool owner/not owner
276	* @param pVM Pointer to the VM.
277	*/
278	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
279	{
280	#ifdef VBOX_WITH_REM
281	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
282	return true; /* early init */
283
284	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
285	#else
286	return true;
287	#endif
288	}
289
290
291	/**
292	* Try to acquire the REM lock.
293	*
294	* @returns VBox status code
295	* @param pVM Pointer to the VM.
296	*/
297	VMM_INT_DECL(int) EMRemTryLock(PVM pVM)
298	{
299	#ifdef VBOX_WITH_REM
300	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
301	return VINF_SUCCESS; /* early init */
302
303	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
304	#else
305	return VINF_SUCCESS;
306	#endif
307	}
308
309
310	/**
311	* @callback_method_impl{FNDISREADBYTES}
312	*/
313	static DECLCALLBACK(int) emReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
314	{
315	PVMCPU pVCpu = (PVMCPU)pDis->pvUser;
316	#if defined(IN_RC) \|\| defined(IN_RING3)
317	PVM pVM = pVCpu->CTX_SUFF(pVM);
318	#endif
319	RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
320	int rc;
321
322	/*
323	* Figure how much we can or must read.
324	*/
325	size_t cbToRead = PAGE_SIZE - (uSrcAddr & PAGE_OFFSET_MASK);
326	if (cbToRead > cbMaxRead)
327	cbToRead = cbMaxRead;
328	else if (cbToRead < cbMinRead)
329	cbToRead = cbMinRead;
330
331	#if defined(IN_RC) \|\| defined(IN_RING3)
332	/*
333	* We might be called upon to interpret an instruction in a patch.
334	*/
335	if (PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), uSrcAddr))
336	{
337	# ifdef IN_RC
338	memcpy(&pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
339	# else
340	memcpy(&pDis->abInstr[offInstr], PATMR3GCPtrToHCPtr(pVCpu->CTX_SUFF(pVM), uSrcAddr), cbToRead);
341	# endif
342	rc = VINF_SUCCESS;
343	}
344	else
345	#endif
346	{
347	# ifdef IN_RC
348	/*
349	* Try access it thru the shadow page tables first. Fall back on the
350	* slower PGM method if it fails because the TLB or page table was
351	* modified recently.
352	*/
353	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
354	if (rc == VERR_ACCESS_DENIED && cbToRead > cbMinRead)
355	{
356	cbToRead = cbMinRead;
357	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
358	}
359	if (rc == VERR_ACCESS_DENIED)
360	#endif
361	{
362	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
363	if (RT_FAILURE(rc))
364	{
365	if (cbToRead > cbMinRead)
366	{
367	cbToRead = cbMinRead;
368	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
369	}
370	if (RT_FAILURE(rc))
371	{
372	#ifndef IN_RC
373	/*
374	* If we fail to find the page via the guest's page tables
375	* we invalidate the page in the host TLB (pertaining to
376	* the guest in the NestedPaging case). See @bugref{6043}.
377	*/
378	if (rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT)
379	{
380	HMInvalidatePage(pVCpu, uSrcAddr);
381	if (((uSrcAddr + cbToRead - 1) >> PAGE_SHIFT) != (uSrcAddr >> PAGE_SHIFT))
382	HMInvalidatePage(pVCpu, uSrcAddr + cbToRead - 1);
383	}
384	#endif
385	}
386	}
387	}
388	}
389
390	pDis->cbCachedInstr = offInstr + (uint8_t)cbToRead;
391	return rc;
392	}
393
394
395	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
396	{
397	return DISInstrWithReader(InstrGC, (DISCPUMODE)pDis->uCpuMode, emReadBytes, pVCpu, pDis, pOpsize);
398	}
399
400
401	/**
402	* Disassembles the current instruction.
403	*
404	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
405	* details.
406	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
407	*
408	* @param pVM Pointer to the VM.
409	* @param pVCpu Pointer to the VMCPU.
410	* @param pDis Where to return the parsed instruction info.
411	* @param pcbInstr Where to return the instruction size. (optional)
412	*/
413	VMM_INT_DECL(int) EMInterpretDisasCurrent(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, unsigned *pcbInstr)
414	{
415	PCPUMCTXCORE pCtxCore = CPUMCTX2CORE(CPUMQueryGuestCtxPtr(pVCpu));
416	RTGCPTR GCPtrInstr;
417	#if 0
418	int rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
419	#else
420	/** @todo Get the CPU mode as well while we're at it! */
421	int rc = SELMValidateAndConvertCSAddr(pVCpu, pCtxCore->eflags, pCtxCore->ss.Sel, pCtxCore->cs.Sel, &pCtxCore->cs,
422	pCtxCore->rip, &GCPtrInstr);
423	#endif
424	if (RT_FAILURE(rc))
425	{
426	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
427	pCtxCore->cs.Sel, (RTGCPTR)pCtxCore->rip, pCtxCore->ss.Sel & X86_SEL_RPL, rc));
428	return rc;
429	}
430	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
431	}
432
433
434	/**
435	* Disassembles one instruction.
436	*
437	* This is used by internally by the interpreter and by trap/access handlers.
438	*
439	* @returns VBox status code.
440	* @retval VERR_EM_INTERNAL_DISAS_ERROR on DISCoreOneEx failure.
441	*
442	* @param pVM Pointer to the VM.
443	* @param pVCpu Pointer to the VMCPU.
444	* @param GCPtrInstr The flat address of the instruction.
445	* @param pCtxCore The context core (used to determine the cpu mode).
446	* @param pDis Where to return the parsed instruction info.
447	* @param pcbInstr Where to return the instruction size. (optional)
448	*/
449	VMM_INT_DECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore,
450	PDISCPUSTATE pDis, unsigned *pcbInstr)
451	{
452	Assert(pCtxCore == CPUMGetGuestCtxCore(pVCpu));
453	DISCPUMODE enmCpuMode = CPUMGetGuestDisMode(pVCpu);
454	/** @todo Deal with too long instruction (=> \#GP), opcode read errors (=>
455	* \#PF, \#GP, \#??), undefined opcodes (=> \#UD), and such. */
456	int rc = DISInstrWithReader(GCPtrInstr, enmCpuMode, emReadBytes, pVCpu, pDis, pcbInstr);
457	if (RT_SUCCESS(rc))
458	return VINF_SUCCESS;
459	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
460	return VERR_EM_INTERNAL_DISAS_ERROR;
461	}
462
463
464	#if defined(VBOX_COMPARE_IEM_FIRST) \|\| defined(VBOX_COMPARE_IEM_LAST)
465	static void emCompareWithIem(PVMCPU pVCpu, PCCPUMCTX pEmCtx, PCCPUMCTX pIemCtx,
466	VBOXSTRICTRC rcEm, VBOXSTRICTRC rcIem,
467	uint32_t cbEm, uint32_t cbIem)
468	{
469	/* Quick compare. */
470	if ( rcEm == rcIem
471	&& cbEm == cbIem
472	&& g_cbEmWrote == g_cbIemWrote
473	&& memcmp(g_abIemWrote, g_abEmWrote, g_cbIemWrote) == 0
474	&& memcmp(pIemCtx, pEmCtx, sizeof(*pIemCtx)) == 0
475	&& (g_fEmFFs & g_fInterestingFFs) == (g_fIemFFs & g_fInterestingFFs)
476	)
477	return;
478
479	/* Report exact differences. */
480	RTLogPrintf("! EM and IEM differs at %04x:%08RGv !\n", g_IncomingCtx.cs.Sel, g_IncomingCtx.rip);
481	if (rcEm != rcIem)
482	RTLogPrintf(" * rcIem=%Rrc rcEm=%Rrc\n", VBOXSTRICTRC_VAL(rcIem), VBOXSTRICTRC_VAL(rcEm));
483	else if (cbEm != cbIem)
484	RTLogPrintf(" * cbIem=%#x cbEm=%#x\n", cbIem, cbEm);
485
486	if (RT_SUCCESS(rcEm) && RT_SUCCESS(rcIem))
487	{
488	if (g_cbIemWrote != g_cbEmWrote)
489	RTLogPrintf("!! g_cbIemWrote=%#x g_cbEmWrote=%#x\n", g_cbIemWrote, g_cbEmWrote);
490	else if (memcmp(g_abIemWrote, g_abEmWrote, g_cbIemWrote))
491	{
492	RTLogPrintf("!! IemWrote %.*Rhxs\n", RT_MIN(RT_MAX(1, g_cbIemWrote), 64), g_abIemWrote);
493	RTLogPrintf("!! EemWrote %.*Rhxs\n", RT_MIN(RT_MAX(1, g_cbIemWrote), 64), g_abIemWrote);
494	}
495
496	if ((g_fEmFFs & g_fInterestingFFs) != (g_fIemFFs & g_fInterestingFFs))
497	RTLogPrintf("!! g_fIemFFs=%#x g_fEmFFs=%#x (diff=%#x)\n", g_fIemFFs & g_fInterestingFFs,
498	g_fEmFFs & g_fInterestingFFs, (g_fIemFFs ^ g_fEmFFs) & g_fInterestingFFs);
499
500	# define CHECK_FIELD(a_Field) \
501	do \
502	{ \
503	if (pEmCtx->a_Field != pIemCtx->a_Field) \
504	{ \
505	switch (sizeof(pEmCtx->a_Field)) \
506	{ \
507	case 1: RTLogPrintf("!! %8s differs - iem=%02x - em=%02x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
508	case 2: RTLogPrintf("!! %8s differs - iem=%04x - em=%04x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
509	case 4: RTLogPrintf("!! %8s differs - iem=%08x - em=%08x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
510	case 8: RTLogPrintf("!! %8s differs - iem=%016llx - em=%016llx\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
511	default: RTLogPrintf("!! %8s differs\n", #a_Field); break; \
512	} \
513	cDiffs++; \
514	} \
515	} while (0)
516
517	# define CHECK_BIT_FIELD(a_Field) \
518	do \
519	{ \
520	if (pEmCtx->a_Field != pIemCtx->a_Field) \
521	{ \
522	RTLogPrintf("!! %8s differs - iem=%02x - em=%02x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); \
523	cDiffs++; \
524	} \
525	} while (0)
526
527	# define CHECK_SEL(a_Sel) \
528	do \
529	{ \
530	CHECK_FIELD(a_Sel.Sel); \
531	CHECK_FIELD(a_Sel.Attr.u); \
532	CHECK_FIELD(a_Sel.u64Base); \
533	CHECK_FIELD(a_Sel.u32Limit); \
534	CHECK_FIELD(a_Sel.fFlags); \
535	} while (0)
536
537	unsigned cDiffs = 0;
538	if (memcmp(&pEmCtx->fpu, &pIemCtx->fpu, sizeof(pIemCtx->fpu)))
539	{
540	RTLogPrintf(" the FPU state differs\n");
541	cDiffs++;
542	CHECK_FIELD(fpu.FCW);
543	CHECK_FIELD(fpu.FSW);
544	CHECK_FIELD(fpu.FTW);
545	CHECK_FIELD(fpu.FOP);
546	CHECK_FIELD(fpu.FPUIP);
547	CHECK_FIELD(fpu.CS);
548	CHECK_FIELD(fpu.Rsrvd1);
549	CHECK_FIELD(fpu.FPUDP);
550	CHECK_FIELD(fpu.DS);
551	CHECK_FIELD(fpu.Rsrvd2);
552	CHECK_FIELD(fpu.MXCSR);
553	CHECK_FIELD(fpu.MXCSR_MASK);
554	CHECK_FIELD(fpu.aRegs[0].au64[0]); CHECK_FIELD(fpu.aRegs[0].au64[1]);
555	CHECK_FIELD(fpu.aRegs[1].au64[0]); CHECK_FIELD(fpu.aRegs[1].au64[1]);
556	CHECK_FIELD(fpu.aRegs[2].au64[0]); CHECK_FIELD(fpu.aRegs[2].au64[1]);
557	CHECK_FIELD(fpu.aRegs[3].au64[0]); CHECK_FIELD(fpu.aRegs[3].au64[1]);
558	CHECK_FIELD(fpu.aRegs[4].au64[0]); CHECK_FIELD(fpu.aRegs[4].au64[1]);
559	CHECK_FIELD(fpu.aRegs[5].au64[0]); CHECK_FIELD(fpu.aRegs[5].au64[1]);
560	CHECK_FIELD(fpu.aRegs[6].au64[0]); CHECK_FIELD(fpu.aRegs[6].au64[1]);
561	CHECK_FIELD(fpu.aRegs[7].au64[0]); CHECK_FIELD(fpu.aRegs[7].au64[1]);
562	CHECK_FIELD(fpu.aXMM[ 0].au64[0]); CHECK_FIELD(fpu.aXMM[ 0].au64[1]);
563	CHECK_FIELD(fpu.aXMM[ 1].au64[0]); CHECK_FIELD(fpu.aXMM[ 1].au64[1]);
564	CHECK_FIELD(fpu.aXMM[ 2].au64[0]); CHECK_FIELD(fpu.aXMM[ 2].au64[1]);
565	CHECK_FIELD(fpu.aXMM[ 3].au64[0]); CHECK_FIELD(fpu.aXMM[ 3].au64[1]);
566	CHECK_FIELD(fpu.aXMM[ 4].au64[0]); CHECK_FIELD(fpu.aXMM[ 4].au64[1]);
567	CHECK_FIELD(fpu.aXMM[ 5].au64[0]); CHECK_FIELD(fpu.aXMM[ 5].au64[1]);
568	CHECK_FIELD(fpu.aXMM[ 6].au64[0]); CHECK_FIELD(fpu.aXMM[ 6].au64[1]);
569	CHECK_FIELD(fpu.aXMM[ 7].au64[0]); CHECK_FIELD(fpu.aXMM[ 7].au64[1]);
570	CHECK_FIELD(fpu.aXMM[ 8].au64[0]); CHECK_FIELD(fpu.aXMM[ 8].au64[1]);
571	CHECK_FIELD(fpu.aXMM[ 9].au64[0]); CHECK_FIELD(fpu.aXMM[ 9].au64[1]);
572	CHECK_FIELD(fpu.aXMM[10].au64[0]); CHECK_FIELD(fpu.aXMM[10].au64[1]);
573	CHECK_FIELD(fpu.aXMM[11].au64[0]); CHECK_FIELD(fpu.aXMM[11].au64[1]);
574	CHECK_FIELD(fpu.aXMM[12].au64[0]); CHECK_FIELD(fpu.aXMM[12].au64[1]);
575	CHECK_FIELD(fpu.aXMM[13].au64[0]); CHECK_FIELD(fpu.aXMM[13].au64[1]);
576	CHECK_FIELD(fpu.aXMM[14].au64[0]); CHECK_FIELD(fpu.aXMM[14].au64[1]);
577	CHECK_FIELD(fpu.aXMM[15].au64[0]); CHECK_FIELD(fpu.aXMM[15].au64[1]);
578	for (unsigned i = 0; i < RT_ELEMENTS(pEmCtx->fpu.au32RsrvdRest); i++)
579	CHECK_FIELD(fpu.au32RsrvdRest[i]);
580	}
581	CHECK_FIELD(rip);
582	if (pEmCtx->rflags.u != pIemCtx->rflags.u)
583	{
584	RTLogPrintf("!! rflags differs - iem=%08llx em=%08llx\n", pIemCtx->rflags.u, pEmCtx->rflags.u);
585	CHECK_BIT_FIELD(rflags.Bits.u1CF);
586	CHECK_BIT_FIELD(rflags.Bits.u1Reserved0);
587	CHECK_BIT_FIELD(rflags.Bits.u1PF);
588	CHECK_BIT_FIELD(rflags.Bits.u1Reserved1);
589	CHECK_BIT_FIELD(rflags.Bits.u1AF);
590	CHECK_BIT_FIELD(rflags.Bits.u1Reserved2);
591	CHECK_BIT_FIELD(rflags.Bits.u1ZF);
592	CHECK_BIT_FIELD(rflags.Bits.u1SF);
593	CHECK_BIT_FIELD(rflags.Bits.u1TF);
594	CHECK_BIT_FIELD(rflags.Bits.u1IF);
595	CHECK_BIT_FIELD(rflags.Bits.u1DF);
596	CHECK_BIT_FIELD(rflags.Bits.u1OF);
597	CHECK_BIT_FIELD(rflags.Bits.u2IOPL);
598	CHECK_BIT_FIELD(rflags.Bits.u1NT);
599	CHECK_BIT_FIELD(rflags.Bits.u1Reserved3);
600	CHECK_BIT_FIELD(rflags.Bits.u1RF);
601	CHECK_BIT_FIELD(rflags.Bits.u1VM);
602	CHECK_BIT_FIELD(rflags.Bits.u1AC);
603	CHECK_BIT_FIELD(rflags.Bits.u1VIF);
604	CHECK_BIT_FIELD(rflags.Bits.u1VIP);
605	CHECK_BIT_FIELD(rflags.Bits.u1ID);
606	}
607
608	if (!g_fIgnoreRaxRdx)
609	CHECK_FIELD(rax);
610	CHECK_FIELD(rcx);
611	if (!g_fIgnoreRaxRdx)
612	CHECK_FIELD(rdx);
613	CHECK_FIELD(rbx);
614	CHECK_FIELD(rsp);
615	CHECK_FIELD(rbp);
616	CHECK_FIELD(rsi);
617	CHECK_FIELD(rdi);
618	CHECK_FIELD(r8);
619	CHECK_FIELD(r9);
620	CHECK_FIELD(r10);
621	CHECK_FIELD(r11);
622	CHECK_FIELD(r12);
623	CHECK_FIELD(r13);
624	CHECK_SEL(cs);
625	CHECK_SEL(ss);
626	CHECK_SEL(ds);
627	CHECK_SEL(es);
628	CHECK_SEL(fs);
629	CHECK_SEL(gs);
630	CHECK_FIELD(cr0);
631	CHECK_FIELD(cr2);
632	CHECK_FIELD(cr3);
633	CHECK_FIELD(cr4);
634	CHECK_FIELD(dr[0]);
635	CHECK_FIELD(dr[1]);
636	CHECK_FIELD(dr[2]);
637	CHECK_FIELD(dr[3]);
638	CHECK_FIELD(dr[6]);
639	CHECK_FIELD(dr[7]);
640	CHECK_FIELD(gdtr.cbGdt);
641	CHECK_FIELD(gdtr.pGdt);
642	CHECK_FIELD(idtr.cbIdt);
643	CHECK_FIELD(idtr.pIdt);
644	CHECK_SEL(ldtr);
645	CHECK_SEL(tr);
646	CHECK_FIELD(SysEnter.cs);
647	CHECK_FIELD(SysEnter.eip);
648	CHECK_FIELD(SysEnter.esp);
649	CHECK_FIELD(msrEFER);
650	CHECK_FIELD(msrSTAR);
651	CHECK_FIELD(msrPAT);
652	CHECK_FIELD(msrLSTAR);
653	CHECK_FIELD(msrCSTAR);
654	CHECK_FIELD(msrSFMASK);
655	CHECK_FIELD(msrKERNELGSBASE);
656
657	# undef CHECK_FIELD
658	# undef CHECK_BIT_FIELD
659	}
660	}
661	#endif /* VBOX_COMPARE_IEM_AND_EM */
662
663
664	/**
665	* Interprets the current instruction.
666	*
667	* @returns VBox status code.
668	* @retval VINF_* Scheduling instructions.
669	* @retval VERR_EM_INTERPRETER Something we can't cope with.
670	* @retval VERR_* Fatal errors.
671	*
672	* @param pVCpu Pointer to the VMCPU.
673	* @param pRegFrame The register frame.
674	* Updates the EIP if an instruction was executed successfully.
675	* @param pvFault The fault address (CR2).
676	* @param pcbSize Size of the write (if applicable).
677	*
678	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
679	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
680	* to worry about e.g. invalid modrm combinations (!)
681	*/
682	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstruction(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
683	{
684	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
685	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
686	#ifdef VBOX_WITH_IEM
687	NOREF(pvFault);
688
689	# ifdef VBOX_COMPARE_IEM_AND_EM
690	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
691	g_IncomingCtx = *pCtx;
692	g_fIncomingFFs = pVCpu->fLocalForcedActions;
693	g_cbEmWrote = g_cbIemWrote = 0;
694
695	# ifdef VBOX_COMPARE_IEM_FIRST
696	/* IEM */
697	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
698	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
699	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
700	rcIem = VERR_EM_INTERPRETER;
701	g_IemCtx = *pCtx;
702	g_fIemFFs = pVCpu->fLocalForcedActions;
703	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
704	*pCtx = g_IncomingCtx;
705	# endif
706
707	/* EM */
708	RTGCPTR pbCode;
709	VBOXSTRICTRC rcEm = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
710	if (RT_SUCCESS(rcEm))
711	{
712	uint32_t cbOp;
713	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
714	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
715	rcEm = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
716	if (RT_SUCCESS(rcEm))
717	{
718	Assert(cbOp == pDis->cbInstr);
719	uint32_t cbIgnored;
720	rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
721	if (RT_SUCCESS(rcEm))
722	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
723
724	}
725	rcEm = VERR_EM_INTERPRETER;
726	}
727	else
728	rcEm = VERR_EM_INTERPRETER;
729	# ifdef VBOX_SAME_AS_EM
730	if (rcEm == VERR_EM_INTERPRETER)
731	{
732	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
733	return rcEm;
734	}
735	# endif
736	g_EmCtx = *pCtx;
737	g_fEmFFs = pVCpu->fLocalForcedActions;
738	VBOXSTRICTRC rc = rcEm;
739
740	# ifdef VBOX_COMPARE_IEM_LAST
741	/* IEM */
742	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
743	*pCtx = g_IncomingCtx;
744	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
745	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
746	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
747	rcIem = VERR_EM_INTERPRETER;
748	g_IemCtx = *pCtx;
749	g_fIemFFs = pVCpu->fLocalForcedActions;
750	rc = rcIem;
751	# endif
752
753	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
754	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, 0, 0);
755	# endif
756
757	# else
758	VBOXSTRICTRC rc = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
759	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
760	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
761	rc = VERR_EM_INTERPRETER;
762	# endif
763	if (rc != VINF_SUCCESS)
764	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
765
766	return rc;
767	#else
768	RTGCPTR pbCode;
769	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
770	if (RT_SUCCESS(rc))
771	{
772	uint32_t cbOp;
773	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
774	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
775	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
776	if (RT_SUCCESS(rc))
777	{
778	Assert(cbOp == pDis->cbInstr);
779	uint32_t cbIgnored;
780	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
781	if (RT_SUCCESS(rc))
782	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
783
784	return rc;
785	}
786	}
787	return VERR_EM_INTERPRETER;
788	#endif
789	}
790
791
792	/**
793	* Interprets the current instruction.
794	*
795	* @returns VBox status code.
796	* @retval VINF_* Scheduling instructions.
797	* @retval VERR_EM_INTERPRETER Something we can't cope with.
798	* @retval VERR_* Fatal errors.
799	*
800	* @param pVM Pointer to the VM.
801	* @param pVCpu Pointer to the VMCPU.
802	* @param pRegFrame The register frame.
803	* Updates the EIP if an instruction was executed successfully.
804	* @param pvFault The fault address (CR2).
805	* @param pcbWritten Size of the write (if applicable).
806	*
807	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
808	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
809	* to worry about e.g. invalid modrm combinations (!)
810	*/
811	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstructionEx(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbWritten)
812	{
813	LogFlow(("EMInterpretInstructionEx %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
814	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
815	#ifdef VBOX_WITH_IEM
816	NOREF(pvFault);
817
818	# ifdef VBOX_COMPARE_IEM_AND_EM
819	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
820	g_IncomingCtx = *pCtx;
821	g_fIncomingFFs = pVCpu->fLocalForcedActions;
822	g_cbEmWrote = g_cbIemWrote = 0;
823
824	# ifdef VBOX_COMPARE_IEM_FIRST
825	/* IEM */
826	uint32_t cbIemWritten = 0;
827	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, &cbIemWritten);
828	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
829	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
830	rcIem = VERR_EM_INTERPRETER;
831	g_IemCtx = *pCtx;
832	g_fIemFFs = pVCpu->fLocalForcedActions;
833	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
834	*pCtx = g_IncomingCtx;
835	# endif
836
837	/* EM */
838	uint32_t cbEmWritten = 0;
839	RTGCPTR pbCode;
840	VBOXSTRICTRC rcEm = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
841	if (RT_SUCCESS(rcEm))
842	{
843	uint32_t cbOp;
844	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
845	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
846	rcEm = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
847	if (RT_SUCCESS(rcEm))
848	{
849	Assert(cbOp == pDis->cbInstr);
850	rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbEmWritten);
851	if (RT_SUCCESS(rcEm))
852	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
853
854	}
855	else
856	rcEm = VERR_EM_INTERPRETER;
857	}
858	else
859	rcEm = VERR_EM_INTERPRETER;
860	# ifdef VBOX_SAME_AS_EM
861	if (rcEm == VERR_EM_INTERPRETER)
862	{
863	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
864	return rcEm;
865	}
866	# endif
867	g_EmCtx = *pCtx;
868	g_fEmFFs = pVCpu->fLocalForcedActions;
869	*pcbWritten = cbEmWritten;
870	VBOXSTRICTRC rc = rcEm;
871
872	# ifdef VBOX_COMPARE_IEM_LAST
873	/* IEM */
874	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
875	*pCtx = g_IncomingCtx;
876	uint32_t cbIemWritten = 0;
877	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, &cbIemWritten);
878	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
879	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
880	rcIem = VERR_EM_INTERPRETER;
881	g_IemCtx = *pCtx;
882	g_fIemFFs = pVCpu->fLocalForcedActions;
883	*pcbWritten = cbIemWritten;
884	rc = rcIem;
885	# endif
886
887	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
888	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, cbEmWritten, cbIemWritten);
889	# endif
890
891	# else
892	VBOXSTRICTRC rc = IEMExecOneBypassEx(pVCpu, pRegFrame, pcbWritten);
893	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
894	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
895	rc = VERR_EM_INTERPRETER;
896	# endif
897	if (rc != VINF_SUCCESS)
898	Log(("EMInterpretInstructionEx: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
899
900	return rc;
901	#else
902	RTGCPTR pbCode;
903	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
904	if (RT_SUCCESS(rc))
905	{
906	uint32_t cbOp;
907	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
908	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
909	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
910	if (RT_SUCCESS(rc))
911	{
912	Assert(cbOp == pDis->cbInstr);
913	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, pcbWritten);
914	if (RT_SUCCESS(rc))
915	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
916
917	return rc;
918	}
919	}
920	return VERR_EM_INTERPRETER;
921	#endif
922	}
923
924
925	/**
926	* Interprets the current instruction using the supplied DISCPUSTATE structure.
927	*
928	* IP/EIP/RIP IS updated!
929	*
930	* @returns VBox strict status code.
931	* @retval VINF_* Scheduling instructions. When these are returned, it
932	* starts to get a bit tricky to know whether code was
933	* executed or not... We'll address this when it becomes a problem.
934	* @retval VERR_EM_INTERPRETER Something we can't cope with.
935	* @retval VERR_* Fatal errors.
936	*
937	* @param pVM Pointer to the VM.
938	* @param pVCpu Pointer to the VMCPU.
939	* @param pDis The disassembler cpu state for the instruction to be
940	* interpreted.
941	* @param pRegFrame The register frame. IP/EIP/RIP IS changed!
942	* @param pvFault The fault address (CR2).
943	* @param pcbSize Size of the write (if applicable).
944	* @param enmCodeType Code type (user/supervisor)
945	*
946	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
947	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
948	* to worry about e.g. invalid modrm combinations (!)
949	*
950	* @todo At this time we do NOT check if the instruction overwrites vital information.
951	* Make sure this can't happen!! (will add some assertions/checks later)
952	*/
953	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstructionDisasState(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
954	RTGCPTR pvFault, EMCODETYPE enmCodeType)
955	{
956	LogFlow(("EMInterpretInstructionDisasState %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
957	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
958	#ifdef VBOX_WITH_IEM
959	NOREF(pDis); NOREF(pvFault); NOREF(enmCodeType);
960
961	# ifdef VBOX_COMPARE_IEM_AND_EM
962	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
963	g_IncomingCtx = *pCtx;
964	g_fIncomingFFs = pVCpu->fLocalForcedActions;
965	g_cbEmWrote = g_cbIemWrote = 0;
966
967	# ifdef VBOX_COMPARE_IEM_FIRST
968	VBOXSTRICTRC rcIem = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
969	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
970	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
971	rcIem = VERR_EM_INTERPRETER;
972	g_IemCtx = *pCtx;
973	g_fIemFFs = pVCpu->fLocalForcedActions;
974	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
975	*pCtx = g_IncomingCtx;
976	# endif
977
978	/* EM */
979	uint32_t cbIgnored;
980	VBOXSTRICTRC rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
981	if (RT_SUCCESS(rcEm))
982	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
983	# ifdef VBOX_SAME_AS_EM
984	if (rcEm == VERR_EM_INTERPRETER)
985	{
986	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
987	return rcEm;
988	}
989	# endif
990	g_EmCtx = *pCtx;
991	g_fEmFFs = pVCpu->fLocalForcedActions;
992	VBOXSTRICTRC rc = rcEm;
993
994	# ifdef VBOX_COMPARE_IEM_LAST
995	/* IEM */
996	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
997	*pCtx = g_IncomingCtx;
998	VBOXSTRICTRC rcIem = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
999	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
1000	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
1001	rcIem = VERR_EM_INTERPRETER;
1002	g_IemCtx = *pCtx;
1003	g_fIemFFs = pVCpu->fLocalForcedActions;
1004	rc = rcIem;
1005	# endif
1006
1007	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
1008	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, 0, 0);
1009	# endif
1010
1011	# else
1012	VBOXSTRICTRC rc = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
1013	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
1014	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
1015	rc = VERR_EM_INTERPRETER;
1016	# endif
1017
1018	if (rc != VINF_SUCCESS)
1019	Log(("EMInterpretInstructionDisasState: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
1020
1021	return rc;
1022	#else
1023	uint32_t cbIgnored;
1024	VBOXSTRICTRC rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
1025	if (RT_SUCCESS(rc))
1026	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
1027	return rc;
1028	#endif
1029	}
1030
1031	#if defined(IN_RC) /&& defined(VBOX_WITH_PATM)/
1032
1033	DECLINLINE(int) emRCStackRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
1034	{
1035	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
1036	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
1037	return rc;
1038	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
1039	}
1040
1041
1042	/**
1043	* Interpret IRET (currently only to V86 code) - PATM only.
1044	*
1045	* @returns VBox status code.
1046	* @param pVM Pointer to the VM.
1047	* @param pVCpu Pointer to the VMCPU.
1048	* @param pRegFrame The register frame.
1049	*
1050	*/
1051	VMM_INT_DECL(int) EMInterpretIretV86ForPatm(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1052	{
1053	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1054	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1055	int rc;
1056
1057	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1058	Assert(!CPUMIsGuestIn64BitCode(pVCpu));
1059	/** @todo Rainy day: Test what happens when VERR_EM_INTERPRETER is returned by
1060	* this function. Fear that it may guru on us, thus not converted to
1061	* IEM. */
1062
1063	rc = emRCStackRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1064	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1065	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1066	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1067	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1068
1069	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1070	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1071	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1072	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1073	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1074	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1075	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1076
1077	pRegFrame->eip = eip & 0xffff;
1078	pRegFrame->cs.Sel = cs;
1079
1080	/* Mask away all reserved bits */
1081	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1082	eflags &= uMask;
1083
1084	CPUMRawSetEFlags(pVCpu, eflags);
1085	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1086
1087	pRegFrame->esp = esp;
1088	pRegFrame->ss.Sel = ss;
1089	pRegFrame->ds.Sel = ds;
1090	pRegFrame->es.Sel = es;
1091	pRegFrame->fs.Sel = fs;
1092	pRegFrame->gs.Sel = gs;
1093
1094	return VINF_SUCCESS;
1095	}
1096
1097	#endif /* IN_RC && VBOX_WITH_PATM */
1098
1099
1100
1101	/*
1102	*
1103	* Old interpreter primitives used by HM, move/eliminate later.
1104	* Old interpreter primitives used by HM, move/eliminate later.
1105	* Old interpreter primitives used by HM, move/eliminate later.
1106	* Old interpreter primitives used by HM, move/eliminate later.
1107	* Old interpreter primitives used by HM, move/eliminate later.
1108	*
1109	*/
1110
1111
1112	/**
1113	* Interpret CPUID given the parameters in the CPU context.
1114	*
1115	* @returns VBox status code.
1116	* @param pVM Pointer to the VM.
1117	* @param pVCpu Pointer to the VMCPU.
1118	* @param pRegFrame The register frame.
1119	*
1120	*/
1121	VMM_INT_DECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1122	{
1123	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1124	uint32_t iLeaf = pRegFrame->eax;
1125	NOREF(pVM);
1126
1127	/* cpuid clears the high dwords of the affected 64 bits registers. */
1128	pRegFrame->rax = 0;
1129	pRegFrame->rbx = 0;
1130	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
1131	pRegFrame->rdx = 0;
1132
1133	/* Note: operates the same in 64 and non-64 bits mode. */
1134	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1135	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1136	return VINF_SUCCESS;
1137	}
1138
1139
1140	/**
1141	* Interpret RDTSC.
1142	*
1143	* @returns VBox status code.
1144	* @param pVM Pointer to the VM.
1145	* @param pVCpu Pointer to the VMCPU.
1146	* @param pRegFrame The register frame.
1147	*
1148	*/
1149	VMM_INT_DECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1150	{
1151	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1152	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
1153
1154	if (uCR4 & X86_CR4_TSD)
1155	return VERR_EM_INTERPRETER; /* genuine #GP */
1156
1157	uint64_t uTicks = TMCpuTickGet(pVCpu);
1158
1159	/* Same behaviour in 32 & 64 bits mode */
1160	pRegFrame->rax = (uint32_t)uTicks;
1161	pRegFrame->rdx = (uTicks >> 32ULL);
1162	#ifdef VBOX_COMPARE_IEM_AND_EM
1163	g_fIgnoreRaxRdx = true;
1164	#endif
1165
1166	NOREF(pVM);
1167	return VINF_SUCCESS;
1168	}
1169
1170	/**
1171	* Interpret RDTSCP.
1172	*
1173	* @returns VBox status code.
1174	* @param pVM Pointer to the VM.
1175	* @param pVCpu Pointer to the VMCPU.
1176	* @param pCtx The CPU context.
1177	*
1178	*/
1179	VMM_INT_DECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1180	{
1181	Assert(pCtx == CPUMQueryGuestCtxPtr(pVCpu));
1182	uint32_t uCR4 = CPUMGetGuestCR4(pVCpu);
1183
1184	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
1185	{
1186	AssertFailed();
1187	return VERR_EM_INTERPRETER; /* genuine #UD */
1188	}
1189
1190	if (uCR4 & X86_CR4_TSD)
1191	return VERR_EM_INTERPRETER; /* genuine #GP */
1192
1193	uint64_t uTicks = TMCpuTickGet(pVCpu);
1194
1195	/* Same behaviour in 32 & 64 bits mode */
1196	pCtx->rax = (uint32_t)uTicks;
1197	pCtx->rdx = (uTicks >> 32ULL);
1198	#ifdef VBOX_COMPARE_IEM_AND_EM
1199	g_fIgnoreRaxRdx = true;
1200	#endif
1201	/* Low dword of the TSC_AUX msr only. */
1202	CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
1203	pCtx->rcx &= UINT32_C(0xffffffff);
1204
1205	return VINF_SUCCESS;
1206	}
1207
1208	/**
1209	* Interpret RDPMC.
1210	*
1211	* @returns VBox status code.
1212	* @param pVM Pointer to the VM.
1213	* @param pVCpu Pointer to the VMCPU.
1214	* @param pRegFrame The register frame.
1215	*
1216	*/
1217	VMM_INT_DECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1218	{
1219	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1220	uint32_t uCR4 = CPUMGetGuestCR4(pVCpu);
1221
1222	/* If X86_CR4_PCE is not set, then CPL must be zero. */
1223	if ( !(uCR4 & X86_CR4_PCE)
1224	&& CPUMGetGuestCPL(pVCpu) != 0)
1225	{
1226	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
1227	return VERR_EM_INTERPRETER; /* genuine #GP */
1228	}
1229
1230	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
1231	pRegFrame->rax = 0;
1232	pRegFrame->rdx = 0;
1233	/** @todo We should trigger a #GP here if the CPU doesn't support the index in ecx
1234	* but see @bugref{3472}! */
1235
1236	NOREF(pVM);
1237	return VINF_SUCCESS;
1238	}
1239
1240
1241	/**
1242	* MWAIT Emulation.
1243	*/
1244	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1245	{
1246	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1247	uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
1248	NOREF(pVM);
1249
1250	/* Get the current privilege level. */
1251	cpl = CPUMGetGuestCPL(pVCpu);
1252	if (cpl != 0)
1253	return VERR_EM_INTERPRETER; /* supervisor only */
1254
1255	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1256	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1257	return VERR_EM_INTERPRETER; /* not supported */
1258
1259	/*
1260	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
1261	* CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
1262	*/
1263	CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
1264	if (pRegFrame->ecx > 1)
1265	{
1266	Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
1267	return VERR_EM_INTERPRETER; /* illegal value. */
1268	}
1269
1270	if (pRegFrame->ecx && !(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
1271	{
1272	Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
1273	return VERR_EM_INTERPRETER; /* illegal value. */
1274	}
1275
1276	return EMMonitorWaitPerform(pVCpu, pRegFrame->rax, pRegFrame->rcx);
1277	}
1278
1279
1280	/**
1281	* MONITOR Emulation.
1282	*/
1283	VMM_INT_DECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1284	{
1285	uint32_t u32Dummy, u32ExtFeatures, cpl;
1286	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1287	NOREF(pVM);
1288
1289	if (pRegFrame->ecx != 0)
1290	{
1291	Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
1292	return VERR_EM_INTERPRETER; /* illegal value. */
1293	}
1294
1295	/* Get the current privilege level. */
1296	cpl = CPUMGetGuestCPL(pVCpu);
1297	if (cpl != 0)
1298	return VERR_EM_INTERPRETER; /* supervisor only */
1299
1300	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1301	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1302	return VERR_EM_INTERPRETER; /* not supported */
1303
1304	EMMonitorWaitPrepare(pVCpu, pRegFrame->rax, pRegFrame->rcx, pRegFrame->rdx);
1305	return VINF_SUCCESS;
1306	}
1307
1308
1309	/* VT-x only: */
1310
1311	/**
1312	* Interpret INVLPG.
1313	*
1314	* @returns VBox status code.
1315	* @param pVM Pointer to the VM.
1316	* @param pVCpu Pointer to the VMCPU.
1317	* @param pRegFrame The register frame.
1318	* @param pAddrGC Operand address.
1319	*
1320	*/
1321	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1322	{
1323	/** @todo is addr always a flat linear address or ds based
1324	* (in absence of segment override prefixes)????
1325	*/
1326	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1327	NOREF(pVM); NOREF(pRegFrame);
1328	#ifdef IN_RC
1329	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1330	#endif
1331	VBOXSTRICTRC rc = PGMInvalidatePage(pVCpu, pAddrGC);
1332	if ( rc == VINF_SUCCESS
1333	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1334	return VINF_SUCCESS;
1335	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1336	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), pAddrGC),
1337	VERR_EM_INTERPRETER);
1338	return rc;
1339	}
1340
1341
1342	/**
1343	* Update CRx.
1344	*
1345	* @returns VBox status code.
1346	* @param pVM Pointer to the VM.
1347	* @param pVCpu Pointer to the VMCPU.
1348	* @param pRegFrame The register frame.
1349	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
1350	* @param val New CRx value
1351	*
1352	*/
1353	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
1354	{
1355	uint64_t oldval;
1356	uint64_t msrEFER;
1357	int rc, rc2;
1358	NOREF(pVM);
1359
1360	/** @todo Clean up this mess. */
1361	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
1362	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1363	switch (DestRegCrx)
1364	{
1365	case DISCREG_CR0:
1366	oldval = CPUMGetGuestCR0(pVCpu);
1367	#ifdef IN_RC
1368	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
1369	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
1370	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
1371	return VERR_EM_INTERPRETER;
1372	#endif
1373	rc = VINF_SUCCESS;
1374	#if !defined(VBOX_COMPARE_IEM_AND_EM) \|\| !defined(VBOX_COMPARE_IEM_LAST)
1375	CPUMSetGuestCR0(pVCpu, val);
1376	#else
1377	CPUMQueryGuestCtxPtr(pVCpu)->cr0 = val \| X86_CR0_ET;
1378	#endif
1379	val = CPUMGetGuestCR0(pVCpu);
1380	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
1381	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
1382	{
1383	/* global flush */
1384	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
1385	AssertRCReturn(rc, rc);
1386	}
1387
1388	/* Deal with long mode enabling/disabling. */
1389	msrEFER = CPUMGetGuestEFER(pVCpu);
1390	if (msrEFER & MSR_K6_EFER_LME)
1391	{
1392	if ( !(oldval & X86_CR0_PG)
1393	&& (val & X86_CR0_PG))
1394	{
1395	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1396	if (pRegFrame->cs.Attr.n.u1Long)
1397	{
1398	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
1399	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1400	}
1401
1402	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1403	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
1404	{
1405	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
1406	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1407	}
1408	msrEFER \|= MSR_K6_EFER_LMA;
1409	}
1410	else
1411	if ( (oldval & X86_CR0_PG)
1412	&& !(val & X86_CR0_PG))
1413	{
1414	msrEFER &= ~MSR_K6_EFER_LMA;
1415	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
1416	}
1417	CPUMSetGuestEFER(pVCpu, msrEFER);
1418	}
1419	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
1420	return rc2 == VINF_SUCCESS ? rc : rc2;
1421
1422	case DISCREG_CR2:
1423	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
1424	return VINF_SUCCESS;
1425
1426	case DISCREG_CR3:
1427	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
1428	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
1429	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
1430	{
1431	/* flush */
1432	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
1433	AssertRC(rc);
1434	}
1435	return rc;
1436
1437	case DISCREG_CR4:
1438	oldval = CPUMGetGuestCR4(pVCpu);
1439	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
1440	val = CPUMGetGuestCR4(pVCpu);
1441
1442	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1443	msrEFER = CPUMGetGuestEFER(pVCpu);
1444	if ( (msrEFER & MSR_K6_EFER_LMA)
1445	&& (oldval & X86_CR4_PAE)
1446	&& !(val & X86_CR4_PAE))
1447	{
1448	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
1449	}
1450
1451	rc = VINF_SUCCESS;
1452	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
1453	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
1454	{
1455	/* global flush */
1456	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
1457	AssertRCReturn(rc, rc);
1458	}
1459
1460	/* Feeling extremely lazy. */
1461	# ifdef IN_RC
1462	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
1463	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
1464	{
1465	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
1466	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
1467	}
1468	# endif
1469	if ((val ^ oldval) & X86_CR4_VME)
1470	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
1471
1472	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
1473	return rc2 == VINF_SUCCESS ? rc : rc2;
1474
1475	case DISCREG_CR8:
1476	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
1477
1478	default:
1479	AssertFailed();
1480	case DISCREG_CR1: /* illegal op */
1481	break;
1482	}
1483	return VERR_EM_INTERPRETER;
1484	}
1485
1486
1487	/**
1488	* Interpret CRx write.
1489	*
1490	* @returns VBox status code.
1491	* @param pVM Pointer to the VM.
1492	* @param pVCpu Pointer to the VMCPU.
1493	* @param pRegFrame The register frame.
1494	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
1495	* @param SrcRegGen General purpose register index (USE_REG_E**))
1496	*
1497	*/
1498	VMM_INT_DECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
1499	{
1500	uint64_t val;
1501	int rc;
1502	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1503
1504	if (CPUMIsGuestIn64BitCode(pVCpu))
1505	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
1506	else
1507	{
1508	uint32_t val32;
1509	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1510	val = val32;
1511	}
1512
1513	if (RT_SUCCESS(rc))
1514	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
1515
1516	return VERR_EM_INTERPRETER;
1517	}
1518
1519	/**
1520	* Interpret LMSW.
1521	*
1522	* @returns VBox status code.
1523	* @param pVM Pointer to the VM.
1524	* @param pVCpu Pointer to the VMCPU.
1525	* @param pRegFrame The register frame.
1526	* @param u16Data LMSW source data.
1527	*
1528	*/
1529	VMM_INT_DECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
1530	{
1531	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1532	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
1533
1534	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1535	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1536	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1537
1538	return emUpdateCRx(pVM, pVCpu, pRegFrame, DISCREG_CR0, NewCr0);
1539	}
1540
1541
1542	/**
1543	* Interpret CLTS.
1544	*
1545	* @returns VBox status code.
1546	* @param pVM Pointer to the VM.
1547	* @param pVCpu Pointer to the VMCPU.
1548	*
1549	*/
1550	VMM_INT_DECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
1551	{
1552	NOREF(pVM);
1553
1554	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
1555	if (!(cr0 & X86_CR0_TS))
1556	return VINF_SUCCESS;
1557	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
1558	}
1559
1560
1561	/**
1562	* Interpret CRx read.
1563	*
1564	* @returns VBox status code.
1565	* @param pVM Pointer to the VM.
1566	* @param pVCpu Pointer to the VMCPU.
1567	* @param pRegFrame The register frame.
1568	* @param DestRegGen General purpose register index (USE_REG_E**))
1569	* @param SrcRegCRx CRx register index (DISUSE_REG_CR*)
1570	*
1571	*/
1572	VMM_INT_DECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1573	{
1574	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1575	uint64_t val64;
1576	int rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
1577	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1578	NOREF(pVM);
1579
1580	if (CPUMIsGuestIn64BitCode(pVCpu))
1581	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1582	else
1583	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1584
1585	if (RT_SUCCESS(rc))
1586	{
1587	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
1588	return VINF_SUCCESS;
1589	}
1590	return VERR_EM_INTERPRETER;
1591	}
1592
1593
1594	/**
1595	* Interpret DRx write.
1596	*
1597	* @returns VBox status code.
1598	* @param pVM Pointer to the VM.
1599	* @param pVCpu Pointer to the VMCPU.
1600	* @param pRegFrame The register frame.
1601	* @param DestRegDRx DRx register index (USE_REG_DR*)
1602	* @param SrcRegGen General purpose register index (USE_REG_E**))
1603	*
1604	*/
1605	VMM_INT_DECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
1606	{
1607	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1608	uint64_t val;
1609	int rc;
1610	NOREF(pVM);
1611
1612	if (CPUMIsGuestIn64BitCode(pVCpu))
1613	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
1614	else
1615	{
1616	uint32_t val32;
1617	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1618	val = val32;
1619	}
1620
1621	if (RT_SUCCESS(rc))
1622	{
1623	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
1624	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
1625	if (RT_SUCCESS(rc))
1626	return rc;
1627	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
1628	}
1629	return VERR_EM_INTERPRETER;
1630	}
1631
1632
1633	/**
1634	* Interpret DRx read.
1635	*
1636	* @returns VBox status code.
1637	* @param pVM Pointer to the VM.
1638	* @param pVCpu Pointer to the VMCPU.
1639	* @param pRegFrame The register frame.
1640	* @param DestRegGen General purpose register index (USE_REG_E**))
1641	* @param SrcRegDRx DRx register index (USE_REG_DR*)
1642	*
1643	*/
1644	VMM_INT_DECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
1645	{
1646	uint64_t val64;
1647	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1648	NOREF(pVM);
1649
1650	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
1651	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
1652	if (CPUMIsGuestIn64BitCode(pVCpu))
1653	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1654	else
1655	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
1656
1657	if (RT_SUCCESS(rc))
1658	return VINF_SUCCESS;
1659
1660	return VERR_EM_INTERPRETER;
1661	}
1662
1663
1664	#if !defined(VBOX_WITH_IEM) \|\| defined(VBOX_COMPARE_IEM_AND_EM)
1665
1666
1667
1668
1669
1670
1671	/*
1672	*
1673	* The old interpreter.
1674	* The old interpreter.
1675	* The old interpreter.
1676	* The old interpreter.
1677	* The old interpreter.
1678	*
1679	*/
1680
1681	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
1682	{
1683	#ifdef IN_RC
1684	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
1685	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
1686	return rc;
1687	/*
1688	* The page pool cache may end up here in some cases because it
1689	* flushed one of the shadow mappings used by the trapping
1690	* instruction and it either flushed the TLB or the CPU reused it.
1691	*/
1692	#else
1693	NOREF(pVM);
1694	#endif
1695	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
1696	}
1697
1698
1699	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
1700	{
1701	/* Don't use MMGCRamWrite here as it does not respect zero pages, shared
1702	pages or write monitored pages. */
1703	NOREF(pVM);
1704	#if !defined(VBOX_COMPARE_IEM_AND_EM) \|\| !defined(VBOX_COMPARE_IEM_LAST)
1705	int rc = PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
1706	#else
1707	int rc = VINF_SUCCESS;
1708	#endif
1709	#ifdef VBOX_COMPARE_IEM_AND_EM
1710	Log(("EM Wrote: %RGv %.*Rhxs rc=%Rrc\n", GCPtrDst, RT_MAX(RT_MIN(cb, 64), 1), pvSrc, rc));
1711	g_cbEmWrote = cb;
1712	memcpy(g_abEmWrote, pvSrc, RT_MIN(cb, sizeof(g_abEmWrote)));
1713	#endif
1714	return rc;
1715	}
1716
1717
1718	/** Convert sel:addr to a flat GC address. */
1719	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, PDISOPPARAM pParam, RTGCPTR pvAddr)
1720	{
1721	DISSELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
1722	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
1723	}
1724
1725
1726	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
1727	/**
1728	* Get the mnemonic for the disassembled instruction.
1729	*
1730	* GC/R0 doesn't include the strings in the DIS tables because
1731	* of limited space.
1732	*/
1733	static const char *emGetMnemonic(PDISCPUSTATE pDis)
1734	{
1735	switch (pDis->pCurInstr->uOpcode)
1736	{
1737	case OP_XCHG: return "Xchg";
1738	case OP_DEC: return "Dec";
1739	case OP_INC: return "Inc";
1740	case OP_POP: return "Pop";
1741	case OP_OR: return "Or";
1742	case OP_AND: return "And";
1743	case OP_MOV: return "Mov";
1744	case OP_INVLPG: return "InvlPg";
1745	case OP_CPUID: return "CpuId";
1746	case OP_MOV_CR: return "MovCRx";
1747	case OP_MOV_DR: return "MovDRx";
1748	case OP_LLDT: return "LLdt";
1749	case OP_LGDT: return "LGdt";
1750	case OP_LIDT: return "LIdt";
1751	case OP_CLTS: return "Clts";
1752	case OP_MONITOR: return "Monitor";
1753	case OP_MWAIT: return "MWait";
1754	case OP_RDMSR: return "Rdmsr";
1755	case OP_WRMSR: return "Wrmsr";
1756	case OP_ADD: return "Add";
1757	case OP_ADC: return "Adc";
1758	case OP_SUB: return "Sub";
1759	case OP_SBB: return "Sbb";
1760	case OP_RDTSC: return "Rdtsc";
1761	case OP_STI: return "Sti";
1762	case OP_CLI: return "Cli";
1763	case OP_XADD: return "XAdd";
1764	case OP_HLT: return "Hlt";
1765	case OP_IRET: return "Iret";
1766	case OP_MOVNTPS: return "MovNTPS";
1767	case OP_STOSWD: return "StosWD";
1768	case OP_WBINVD: return "WbInvd";
1769	case OP_XOR: return "Xor";
1770	case OP_BTR: return "Btr";
1771	case OP_BTS: return "Bts";
1772	case OP_BTC: return "Btc";
1773	case OP_LMSW: return "Lmsw";
1774	case OP_SMSW: return "Smsw";
1775	case OP_CMPXCHG: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
1776	case OP_CMPXCHG8B: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
1777
1778	default:
1779	Log(("Unknown opcode %d\n", pDis->pCurInstr->uOpcode));
1780	return "???";
1781	}
1782	}
1783	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
1784
1785
1786	/**
1787	* XCHG instruction emulation.
1788	*/
1789	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1790	{
1791	DISQPVPARAMVAL param1, param2;
1792	NOREF(pvFault);
1793
1794	/* Source to make DISQueryParamVal read the register value - ugly hack */
1795	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1796	if(RT_FAILURE(rc))
1797	return VERR_EM_INTERPRETER;
1798
1799	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1800	if(RT_FAILURE(rc))
1801	return VERR_EM_INTERPRETER;
1802
1803	#ifdef IN_RC
1804	if (TRPMHasTrap(pVCpu))
1805	{
1806	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1807	{
1808	#endif
1809	RTGCPTR pParam1 = 0, pParam2 = 0;
1810	uint64_t valpar1, valpar2;
1811
1812	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
1813	switch(param1.type)
1814	{
1815	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
1816	valpar1 = param1.val.val64;
1817	break;
1818
1819	case DISQPV_TYPE_ADDRESS:
1820	pParam1 = (RTGCPTR)param1.val.val64;
1821	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1822	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1823	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1824	if (RT_FAILURE(rc))
1825	{
1826	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1827	return VERR_EM_INTERPRETER;
1828	}
1829	break;
1830
1831	default:
1832	AssertFailed();
1833	return VERR_EM_INTERPRETER;
1834	}
1835
1836	switch(param2.type)
1837	{
1838	case DISQPV_TYPE_ADDRESS:
1839	pParam2 = (RTGCPTR)param2.val.val64;
1840	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pParam2);
1841	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
1842	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
1843	if (RT_FAILURE(rc))
1844	{
1845	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1846	}
1847	break;
1848
1849	case DISQPV_TYPE_IMMEDIATE:
1850	valpar2 = param2.val.val64;
1851	break;
1852
1853	default:
1854	AssertFailed();
1855	return VERR_EM_INTERPRETER;
1856	}
1857
1858	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
1859	if (pParam1 == 0)
1860	{
1861	Assert(param1.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
1862	switch(param1.size)
1863	{
1864	case 1: //special case for AH etc
1865	rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t )valpar2); break;
1866	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)valpar2); break;
1867	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)valpar2); break;
1868	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, valpar2); break;
1869	default: AssertFailedReturn(VERR_EM_INTERPRETER);
1870	}
1871	if (RT_FAILURE(rc))
1872	return VERR_EM_INTERPRETER;
1873	}
1874	else
1875	{
1876	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
1877	if (RT_FAILURE(rc))
1878	{
1879	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1880	return VERR_EM_INTERPRETER;
1881	}
1882	}
1883
1884	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
1885	if (pParam2 == 0)
1886	{
1887	Assert(param2.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
1888	switch(param2.size)
1889	{
1890	case 1: //special case for AH etc
1891	rc = DISWriteReg8(pRegFrame, pDis->Param2.Base.idxGenReg, (uint8_t )valpar1); break;
1892	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param2.Base.idxGenReg, (uint16_t)valpar1); break;
1893	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param2.Base.idxGenReg, (uint32_t)valpar1); break;
1894	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param2.Base.idxGenReg, valpar1); break;
1895	default: AssertFailedReturn(VERR_EM_INTERPRETER);
1896	}
1897	if (RT_FAILURE(rc))
1898	return VERR_EM_INTERPRETER;
1899	}
1900	else
1901	{
1902	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
1903	if (RT_FAILURE(rc))
1904	{
1905	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1906	return VERR_EM_INTERPRETER;
1907	}
1908	}
1909
1910	*pcbSize = param2.size;
1911	return VINF_SUCCESS;
1912	#ifdef IN_RC
1913	}
1914	}
1915	return VERR_EM_INTERPRETER;
1916	#endif
1917	}
1918
1919
1920	/**
1921	* INC and DEC emulation.
1922	*/
1923	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
1924	PFNEMULATEPARAM2 pfnEmulate)
1925	{
1926	DISQPVPARAMVAL param1;
1927	NOREF(pvFault);
1928
1929	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
1930	if(RT_FAILURE(rc))
1931	return VERR_EM_INTERPRETER;
1932
1933	#ifdef IN_RC
1934	if (TRPMHasTrap(pVCpu))
1935	{
1936	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
1937	{
1938	#endif
1939	RTGCPTR pParam1 = 0;
1940	uint64_t valpar1;
1941
1942	if (param1.type == DISQPV_TYPE_ADDRESS)
1943	{
1944	pParam1 = (RTGCPTR)param1.val.val64;
1945	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
1946	#ifdef IN_RC
1947	/* Safety check (in theory it could cross a page boundary and fault there though) */
1948	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
1949	#endif
1950	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
1951	if (RT_FAILURE(rc))
1952	{
1953	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1954	return VERR_EM_INTERPRETER;
1955	}
1956	}
1957	else
1958	{
1959	AssertFailed();
1960	return VERR_EM_INTERPRETER;
1961	}
1962
1963	uint32_t eflags;
1964
1965	eflags = pfnEmulate(&valpar1, param1.size);
1966
1967	/* Write result back */
1968	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
1969	if (RT_FAILURE(rc))
1970	{
1971	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
1972	return VERR_EM_INTERPRETER;
1973	}
1974
1975	/* Update guest's eflags and finish. */
1976	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1977	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1978
1979	/* All done! */
1980	*pcbSize = param1.size;
1981	return VINF_SUCCESS;
1982	#ifdef IN_RC
1983	}
1984	}
1985	return VERR_EM_INTERPRETER;
1986	#endif
1987	}
1988
1989
1990	/**
1991	* POP Emulation.
1992	*/
1993	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1994	{
1995	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
1996	DISQPVPARAMVAL param1;
1997	NOREF(pvFault);
1998
1999	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2000	if(RT_FAILURE(rc))
2001	return VERR_EM_INTERPRETER;
2002
2003	#ifdef IN_RC
2004	if (TRPMHasTrap(pVCpu))
2005	{
2006	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2007	{
2008	#endif
2009	RTGCPTR pParam1 = 0;
2010	uint32_t valpar1;
2011	RTGCPTR pStackVal;
2012
2013	/* Read stack value first */
2014	if (CPUMGetGuestCodeBits(pVCpu) == 16)
2015	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
2016
2017	/* Convert address; don't bother checking limits etc, as we only read here */
2018	pStackVal = SELMToFlat(pVM, DISSELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
2019	if (pStackVal == 0)
2020	return VERR_EM_INTERPRETER;
2021
2022	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
2023	if (RT_FAILURE(rc))
2024	{
2025	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2026	return VERR_EM_INTERPRETER;
2027	}
2028
2029	if (param1.type == DISQPV_TYPE_ADDRESS)
2030	{
2031	pParam1 = (RTGCPTR)param1.val.val64;
2032
2033	/* pop [esp+xx] uses esp after the actual pop! */
2034	AssertCompile(DISGREG_ESP == DISGREG_SP);
2035	if ( (pDis->Param1.fUse & DISUSE_BASE)
2036	&& (pDis->Param1.fUse & (DISUSE_REG_GEN16\|DISUSE_REG_GEN32))
2037	&& pDis->Param1.Base.idxGenReg == DISGREG_ESP
2038	)
2039	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
2040
2041	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2042	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
2043	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2044	if (RT_FAILURE(rc))
2045	{
2046	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2047	return VERR_EM_INTERPRETER;
2048	}
2049
2050	/* Update ESP as the last step */
2051	pRegFrame->esp += param1.size;
2052	}
2053	else
2054	{
2055	#ifndef DEBUG_bird // annoying assertion.
2056	AssertFailed();
2057	#endif
2058	return VERR_EM_INTERPRETER;
2059	}
2060
2061	/* All done! */
2062	*pcbSize = param1.size;
2063	return VINF_SUCCESS;
2064	#ifdef IN_RC
2065	}
2066	}
2067	return VERR_EM_INTERPRETER;
2068	#endif
2069	}
2070
2071
2072	/**
2073	* XOR/OR/AND Emulation.
2074	*/
2075	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2076	PFNEMULATEPARAM3 pfnEmulate)
2077	{
2078	DISQPVPARAMVAL param1, param2;
2079	NOREF(pvFault);
2080
2081	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2082	if(RT_FAILURE(rc))
2083	return VERR_EM_INTERPRETER;
2084
2085	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2086	if(RT_FAILURE(rc))
2087	return VERR_EM_INTERPRETER;
2088
2089	#ifdef IN_RC
2090	if (TRPMHasTrap(pVCpu))
2091	{
2092	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2093	{
2094	#endif
2095	RTGCPTR pParam1;
2096	uint64_t valpar1, valpar2;
2097
2098	if (pDis->Param1.cb != pDis->Param2.cb)
2099	{
2100	if (pDis->Param1.cb < pDis->Param2.cb)
2101	{
2102	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
2103	return VERR_EM_INTERPRETER;
2104	}
2105	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2106	pDis->Param2.cb = pDis->Param1.cb;
2107	param2.size = param1.size;
2108	}
2109
2110	/* The destination is always a virtual address */
2111	if (param1.type == DISQPV_TYPE_ADDRESS)
2112	{
2113	pParam1 = (RTGCPTR)param1.val.val64;
2114	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2115	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2116	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2117	if (RT_FAILURE(rc))
2118	{
2119	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2120	return VERR_EM_INTERPRETER;
2121	}
2122	}
2123	else
2124	{
2125	AssertFailed();
2126	return VERR_EM_INTERPRETER;
2127	}
2128
2129	/* Register or immediate data */
2130	switch(param2.type)
2131	{
2132	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2133	valpar2 = param2.val.val64;
2134	break;
2135
2136	default:
2137	AssertFailed();
2138	return VERR_EM_INTERPRETER;
2139	}
2140
2141	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
2142
2143	/* Data read, emulate instruction. */
2144	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
2145
2146	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
2147
2148	/* Update guest's eflags and finish. */
2149	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2150	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2151
2152	/* And write it back */
2153	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2154	if (RT_SUCCESS(rc))
2155	{
2156	/* All done! */
2157	*pcbSize = param2.size;
2158	return VINF_SUCCESS;
2159	}
2160	#ifdef IN_RC
2161	}
2162	}
2163	#endif
2164	return VERR_EM_INTERPRETER;
2165	}
2166
2167
2168	#ifndef VBOX_COMPARE_IEM_AND_EM
2169	/**
2170	* LOCK XOR/OR/AND Emulation.
2171	*/
2172	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
2173	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
2174	{
2175	void *pvParam1;
2176	DISQPVPARAMVAL param1, param2;
2177	NOREF(pvFault);
2178
2179	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
2180	Assert(pDis->Param1.cb <= 4);
2181	#endif
2182
2183	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2184	if(RT_FAILURE(rc))
2185	return VERR_EM_INTERPRETER;
2186
2187	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2188	if(RT_FAILURE(rc))
2189	return VERR_EM_INTERPRETER;
2190
2191	if (pDis->Param1.cb != pDis->Param2.cb)
2192	{
2193	AssertMsgReturn(pDis->Param1.cb >= pDis->Param2.cb, /* should never happen! */
2194	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb),
2195	VERR_EM_INTERPRETER);
2196
2197	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2198	pDis->Param2.cb = pDis->Param1.cb;
2199	param2.size = param1.size;
2200	}
2201
2202	#ifdef IN_RC
2203	/* Safety check (in theory it could cross a page boundary and fault there though) */
2204	Assert( TRPMHasTrap(pVCpu)
2205	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
2206	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
2207	#endif
2208
2209	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
2210	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
2211	RTGCUINTREG ValPar2 = param2.val.val64;
2212
2213	/* The destination is always a virtual address */
2214	AssertReturn(param1.type == DISQPV_TYPE_ADDRESS, VERR_EM_INTERPRETER);
2215
2216	RTGCPTR GCPtrPar1 = param1.val.val64;
2217	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2218	PGMPAGEMAPLOCK Lock;
2219	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2220	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2221
2222	/* Try emulate it with a one-shot #PF handler in place. (RC) */
2223	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2224
2225	RTGCUINTREG32 eflags = 0;
2226	rc = pfnEmulate(pvParam1, ValPar2, pDis->Param2.cb, &eflags);
2227	PGMPhysReleasePageMappingLock(pVM, &Lock);
2228	if (RT_FAILURE(rc))
2229	{
2230	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2231	return VERR_EM_INTERPRETER;
2232	}
2233
2234	/* Update guest's eflags and finish. */
2235	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2236	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2237
2238	*pcbSize = param2.size;
2239	return VINF_SUCCESS;
2240	}
2241	#endif /* !VBOX_COMPARE_IEM_AND_EM */
2242
2243
2244	/**
2245	* ADD, ADC & SUB Emulation.
2246	*/
2247	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2248	PFNEMULATEPARAM3 pfnEmulate)
2249	{
2250	NOREF(pvFault);
2251	DISQPVPARAMVAL param1, param2;
2252	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2253	if(RT_FAILURE(rc))
2254	return VERR_EM_INTERPRETER;
2255
2256	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2257	if(RT_FAILURE(rc))
2258	return VERR_EM_INTERPRETER;
2259
2260	#ifdef IN_RC
2261	if (TRPMHasTrap(pVCpu))
2262	{
2263	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2264	{
2265	#endif
2266	RTGCPTR pParam1;
2267	uint64_t valpar1, valpar2;
2268
2269	if (pDis->Param1.cb != pDis->Param2.cb)
2270	{
2271	if (pDis->Param1.cb < pDis->Param2.cb)
2272	{
2273	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
2274	return VERR_EM_INTERPRETER;
2275	}
2276	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2277	pDis->Param2.cb = pDis->Param1.cb;
2278	param2.size = param1.size;
2279	}
2280
2281	/* The destination is always a virtual address */
2282	if (param1.type == DISQPV_TYPE_ADDRESS)
2283	{
2284	pParam1 = (RTGCPTR)param1.val.val64;
2285	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2286	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2287	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2288	if (RT_FAILURE(rc))
2289	{
2290	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2291	return VERR_EM_INTERPRETER;
2292	}
2293	}
2294	else
2295	{
2296	#ifndef DEBUG_bird
2297	AssertFailed();
2298	#endif
2299	return VERR_EM_INTERPRETER;
2300	}
2301
2302	/* Register or immediate data */
2303	switch(param2.type)
2304	{
2305	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2306	valpar2 = param2.val.val64;
2307	break;
2308
2309	default:
2310	AssertFailed();
2311	return VERR_EM_INTERPRETER;
2312	}
2313
2314	/* Data read, emulate instruction. */
2315	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
2316
2317	/* Update guest's eflags and finish. */
2318	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2319	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2320
2321	/* And write it back */
2322	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2323	if (RT_SUCCESS(rc))
2324	{
2325	/* All done! */
2326	*pcbSize = param2.size;
2327	return VINF_SUCCESS;
2328	}
2329	#ifdef IN_RC
2330	}
2331	}
2332	#endif
2333	return VERR_EM_INTERPRETER;
2334	}
2335
2336
2337	/**
2338	* ADC Emulation.
2339	*/
2340	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2341	{
2342	if (pRegFrame->eflags.Bits.u1CF)
2343	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
2344	else
2345	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
2346	}
2347
2348
2349	/**
2350	* BTR/C/S Emulation.
2351	*/
2352	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2353	PFNEMULATEPARAM2UINT32 pfnEmulate)
2354	{
2355	DISQPVPARAMVAL param1, param2;
2356	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2357	if(RT_FAILURE(rc))
2358	return VERR_EM_INTERPRETER;
2359
2360	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2361	if(RT_FAILURE(rc))
2362	return VERR_EM_INTERPRETER;
2363
2364	#ifdef IN_RC
2365	if (TRPMHasTrap(pVCpu))
2366	{
2367	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2368	{
2369	#endif
2370	RTGCPTR pParam1;
2371	uint64_t valpar1 = 0, valpar2;
2372	uint32_t eflags;
2373
2374	/* The destination is always a virtual address */
2375	if (param1.type != DISQPV_TYPE_ADDRESS)
2376	return VERR_EM_INTERPRETER;
2377
2378	pParam1 = (RTGCPTR)param1.val.val64;
2379	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2380
2381	/* Register or immediate data */
2382	switch(param2.type)
2383	{
2384	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2385	valpar2 = param2.val.val64;
2386	break;
2387
2388	default:
2389	AssertFailed();
2390	return VERR_EM_INTERPRETER;
2391	}
2392
2393	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
2394	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
2395	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
2396	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
2397	if (RT_FAILURE(rc))
2398	{
2399	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2400	return VERR_EM_INTERPRETER;
2401	}
2402
2403	Log2(("emInterpretBtx: val=%x\n", valpar1));
2404	/* Data read, emulate bit test instruction. */
2405	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
2406
2407	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
2408
2409	/* Update guest's eflags and finish. */
2410	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2411	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2412
2413	/* And write it back */
2414	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
2415	if (RT_SUCCESS(rc))
2416	{
2417	/* All done! */
2418	*pcbSize = 1;
2419	return VINF_SUCCESS;
2420	}
2421	#ifdef IN_RC
2422	}
2423	}
2424	#endif
2425	return VERR_EM_INTERPRETER;
2426	}
2427
2428
2429	#ifndef VBOX_COMPARE_IEM_AND_EM
2430	/**
2431	* LOCK BTR/C/S Emulation.
2432	*/
2433	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
2434	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
2435	{
2436	void *pvParam1;
2437
2438	DISQPVPARAMVAL param1, param2;
2439	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2440	if(RT_FAILURE(rc))
2441	return VERR_EM_INTERPRETER;
2442
2443	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2444	if(RT_FAILURE(rc))
2445	return VERR_EM_INTERPRETER;
2446
2447	/* The destination is always a virtual address */
2448	if (param1.type != DISQPV_TYPE_ADDRESS)
2449	return VERR_EM_INTERPRETER;
2450
2451	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
2452	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
2453	uint64_t ValPar2 = param2.val.val64;
2454
2455	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
2456	RTGCPTR GCPtrPar1 = param1.val.val64;
2457	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
2458	ValPar2 &= 7;
2459
2460	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2461	#ifdef IN_RC
2462	Assert(TRPMHasTrap(pVCpu));
2463	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
2464	#endif
2465
2466	PGMPAGEMAPLOCK Lock;
2467	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2468	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2469
2470	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
2471
2472	/* Try emulate it with a one-shot #PF handler in place. (RC) */
2473	RTGCUINTREG32 eflags = 0;
2474	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
2475	PGMPhysReleasePageMappingLock(pVM, &Lock);
2476	if (RT_FAILURE(rc))
2477	{
2478	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
2479	emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2480	return VERR_EM_INTERPRETER;
2481	}
2482
2483	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
2484
2485	/* Update guest's eflags and finish. */
2486	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2487	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2488
2489	*pcbSize = 1;
2490	return VINF_SUCCESS;
2491	}
2492	#endif /* !VBOX_COMPARE_IEM_AND_EM */
2493
2494
2495	/**
2496	* MOV emulation.
2497	*/
2498	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2499	{
2500	NOREF(pvFault);
2501	DISQPVPARAMVAL param1, param2;
2502	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2503	if(RT_FAILURE(rc))
2504	return VERR_EM_INTERPRETER;
2505
2506	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2507	if(RT_FAILURE(rc))
2508	return VERR_EM_INTERPRETER;
2509
2510	#ifdef IN_RC
2511	if (TRPMHasTrap(pVCpu))
2512	{
2513	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2514	{
2515	#else
2516	/** @todo Make this the default and don't rely on TRPM information. */
2517	if (param1.type == DISQPV_TYPE_ADDRESS)
2518	{
2519	#endif
2520	RTGCPTR pDest;
2521	uint64_t val64;
2522
2523	switch(param1.type)
2524	{
2525	case DISQPV_TYPE_IMMEDIATE:
2526	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2527	return VERR_EM_INTERPRETER;
2528	/* fallthru */
2529
2530	case DISQPV_TYPE_ADDRESS:
2531	pDest = (RTGCPTR)param1.val.val64;
2532	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pDest);
2533	break;
2534
2535	default:
2536	AssertFailed();
2537	return VERR_EM_INTERPRETER;
2538	}
2539
2540	switch(param2.type)
2541	{
2542	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
2543	val64 = param2.val.val64;
2544	break;
2545
2546	default:
2547	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
2548	return VERR_EM_INTERPRETER;
2549	}
2550	#ifdef LOG_ENABLED
2551	if (pDis->uCpuMode == DISCPUMODE_64BIT)
2552	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
2553	else
2554	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
2555	#endif
2556
2557	Assert(param2.size <= 8 && param2.size > 0);
2558	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
2559	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
2560	if (RT_FAILURE(rc))
2561	return VERR_EM_INTERPRETER;
2562
2563	*pcbSize = param2.size;
2564	}
2565	else
2566	{ /* read fault */
2567	RTGCPTR pSrc;
2568	uint64_t val64;
2569
2570	/* Source */
2571	switch(param2.type)
2572	{
2573	case DISQPV_TYPE_IMMEDIATE:
2574	if(!(param2.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2575	return VERR_EM_INTERPRETER;
2576	/* fallthru */
2577
2578	case DISQPV_TYPE_ADDRESS:
2579	pSrc = (RTGCPTR)param2.val.val64;
2580	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pSrc);
2581	break;
2582
2583	default:
2584	return VERR_EM_INTERPRETER;
2585	}
2586
2587	Assert(param1.size <= 8 && param1.size > 0);
2588	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
2589	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
2590	if (RT_FAILURE(rc))
2591	return VERR_EM_INTERPRETER;
2592
2593	/* Destination */
2594	switch(param1.type)
2595	{
2596	case DISQPV_TYPE_REGISTER:
2597	switch(param1.size)
2598	{
2599	case 1: rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t) val64); break;
2600	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)val64); break;
2601	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)val64); break;
2602	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, val64); break;
2603	default:
2604	return VERR_EM_INTERPRETER;
2605	}
2606	if (RT_FAILURE(rc))
2607	return rc;
2608	break;
2609
2610	default:
2611	return VERR_EM_INTERPRETER;
2612	}
2613	#ifdef LOG_ENABLED
2614	if (pDis->uCpuMode == DISCPUMODE_64BIT)
2615	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
2616	else
2617	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
2618	#endif
2619	}
2620	return VINF_SUCCESS;
2621	#ifdef IN_RC
2622	}
2623	return VERR_EM_INTERPRETER;
2624	#endif
2625	}
2626
2627
2628	#ifndef IN_RC
2629	/**
2630	* [REP] STOSWD emulation
2631	*/
2632	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2633	{
2634	int rc;
2635	RTGCPTR GCDest, GCOffset;
2636	uint32_t cbSize;
2637	uint64_t cTransfers;
2638	int offIncrement;
2639	NOREF(pvFault);
2640
2641	/* Don't support any but these three prefix bytes. */
2642	if ((pDis->fPrefix & ~(DISPREFIX_ADDRSIZE\|DISPREFIX_OPSIZE\|DISPREFIX_REP\|DISPREFIX_REX)))
2643	return VERR_EM_INTERPRETER;
2644
2645	switch (pDis->uAddrMode)
2646	{
2647	case DISCPUMODE_16BIT:
2648	GCOffset = pRegFrame->di;
2649	cTransfers = pRegFrame->cx;
2650	break;
2651	case DISCPUMODE_32BIT:
2652	GCOffset = pRegFrame->edi;
2653	cTransfers = pRegFrame->ecx;
2654	break;
2655	case DISCPUMODE_64BIT:
2656	GCOffset = pRegFrame->rdi;
2657	cTransfers = pRegFrame->rcx;
2658	break;
2659	default:
2660	AssertFailed();
2661	return VERR_EM_INTERPRETER;
2662	}
2663
2664	GCDest = SELMToFlat(pVM, DISSELREG_ES, pRegFrame, GCOffset);
2665	switch (pDis->uOpMode)
2666	{
2667	case DISCPUMODE_16BIT:
2668	cbSize = 2;
2669	break;
2670	case DISCPUMODE_32BIT:
2671	cbSize = 4;
2672	break;
2673	case DISCPUMODE_64BIT:
2674	cbSize = 8;
2675	break;
2676	default:
2677	AssertFailed();
2678	return VERR_EM_INTERPRETER;
2679	}
2680
2681	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
2682
2683	if (!(pDis->fPrefix & DISPREFIX_REP))
2684	{
2685	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es.Sel, GCOffset, GCDest, cbSize));
2686
2687	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
2688	if (RT_FAILURE(rc))
2689	return VERR_EM_INTERPRETER;
2690	Assert(rc == VINF_SUCCESS);
2691
2692	/* Update (e/r)di. */
2693	switch (pDis->uAddrMode)
2694	{
2695	case DISCPUMODE_16BIT:
2696	pRegFrame->di += offIncrement;
2697	break;
2698	case DISCPUMODE_32BIT:
2699	pRegFrame->edi += offIncrement;
2700	break;
2701	case DISCPUMODE_64BIT:
2702	pRegFrame->rdi += offIncrement;
2703	break;
2704	default:
2705	AssertFailed();
2706	return VERR_EM_INTERPRETER;
2707	}
2708
2709	}
2710	else
2711	{
2712	if (!cTransfers)
2713	return VINF_SUCCESS;
2714
2715	/*
2716	* Do not try emulate cross page stuff here because we don't know what might
2717	* be waiting for us on the subsequent pages. The caller has only asked us to
2718	* ignore access handlers fro the current page.
2719	* This also fends off big stores which would quickly kill PGMR0DynMap.
2720	*/
2721	if ( cbSize > PAGE_SIZE
2722	\|\| cTransfers > PAGE_SIZE
2723	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
2724	{
2725	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
2726	GCDest, cbSize, offIncrement, cTransfers));
2727	return VERR_EM_INTERPRETER;
2728	}
2729
2730	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es.Sel, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
2731	/* Access verification first; we currently can't recover properly from traps inside this instruction */
2732	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
2733	cTransfers * cbSize,
2734	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu) == 3 ? X86_PTE_US : 0));
2735	if (rc != VINF_SUCCESS)
2736	{
2737	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
2738	return VERR_EM_INTERPRETER;
2739	}
2740
2741	/* REP case */
2742	while (cTransfers)
2743	{
2744	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
2745	if (RT_FAILURE(rc))
2746	{
2747	rc = VERR_EM_INTERPRETER;
2748	break;
2749	}
2750
2751	Assert(rc == VINF_SUCCESS);
2752	GCOffset += offIncrement;
2753	GCDest += offIncrement;
2754	cTransfers--;
2755	}
2756
2757	/* Update the registers. */
2758	switch (pDis->uAddrMode)
2759	{
2760	case DISCPUMODE_16BIT:
2761	pRegFrame->di = GCOffset;
2762	pRegFrame->cx = cTransfers;
2763	break;
2764	case DISCPUMODE_32BIT:
2765	pRegFrame->edi = GCOffset;
2766	pRegFrame->ecx = cTransfers;
2767	break;
2768	case DISCPUMODE_64BIT:
2769	pRegFrame->rdi = GCOffset;
2770	pRegFrame->rcx = cTransfers;
2771	break;
2772	default:
2773	AssertFailed();
2774	return VERR_EM_INTERPRETER;
2775	}
2776	}
2777
2778	*pcbSize = cbSize;
2779	return rc;
2780	}
2781	#endif /* !IN_RC */
2782
2783
2784	/**
2785	* [LOCK] CMPXCHG emulation.
2786	*/
2787	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2788	{
2789	DISQPVPARAMVAL param1, param2;
2790	NOREF(pvFault);
2791
2792	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
2793	Assert(pDis->Param1.cb <= 4);
2794	#endif
2795
2796	/* Source to make DISQueryParamVal read the register value - ugly hack */
2797	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2798	if(RT_FAILURE(rc))
2799	return VERR_EM_INTERPRETER;
2800
2801	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2802	if(RT_FAILURE(rc))
2803	return VERR_EM_INTERPRETER;
2804
2805	uint64_t valpar;
2806	switch(param2.type)
2807	{
2808	case DISQPV_TYPE_IMMEDIATE: /* register actually */
2809	valpar = param2.val.val64;
2810	break;
2811
2812	default:
2813	return VERR_EM_INTERPRETER;
2814	}
2815
2816	PGMPAGEMAPLOCK Lock;
2817	RTGCPTR GCPtrPar1;
2818	void *pvParam1;
2819	uint64_t eflags;
2820
2821	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
2822	switch(param1.type)
2823	{
2824	case DISQPV_TYPE_ADDRESS:
2825	GCPtrPar1 = param1.val.val64;
2826	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2827
2828	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2829	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2830	break;
2831
2832	default:
2833	return VERR_EM_INTERPRETER;
2834	}
2835
2836	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
2837
2838	#ifndef VBOX_COMPARE_IEM_AND_EM
2839	if (pDis->fPrefix & DISPREFIX_LOCK)
2840	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
2841	else
2842	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
2843	#else /* VBOX_COMPARE_IEM_AND_EM */
2844	uint64_t u64;
2845	switch (pDis->Param2.cb)
2846	{
2847	case 1: u64 = (uint8_t )pvParam1; break;
2848	case 2: u64 = (uint16_t )pvParam1; break;
2849	case 4: u64 = (uint32_t )pvParam1; break;
2850	default:
2851	case 8: u64 = (uint64_t )pvParam1; break;
2852	}
2853	eflags = EMEmulateCmpXchg(&u64, &pRegFrame->rax, valpar, pDis->Param2.cb);
2854	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, pDis->Param2.cb); AssertRCSuccess(rc2);
2855	#endif /* VBOX_COMPARE_IEM_AND_EM */
2856
2857	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
2858
2859	/* Update guest's eflags and finish. */
2860	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2861	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2862
2863	*pcbSize = param2.size;
2864	PGMPhysReleasePageMappingLock(pVM, &Lock);
2865	return VINF_SUCCESS;
2866	}
2867
2868
2869	/**
2870	* [LOCK] CMPXCHG8B emulation.
2871	*/
2872	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2873	{
2874	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
2875	DISQPVPARAMVAL param1;
2876	NOREF(pvFault);
2877
2878	/* Source to make DISQueryParamVal read the register value - ugly hack */
2879	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2880	if(RT_FAILURE(rc))
2881	return VERR_EM_INTERPRETER;
2882
2883	RTGCPTR GCPtrPar1;
2884	void *pvParam1;
2885	uint64_t eflags;
2886	PGMPAGEMAPLOCK Lock;
2887
2888	AssertReturn(pDis->Param1.cb == 8, VERR_EM_INTERPRETER);
2889	switch(param1.type)
2890	{
2891	case DISQPV_TYPE_ADDRESS:
2892	GCPtrPar1 = param1.val.val64;
2893	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2894
2895	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2896	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2897	break;
2898
2899	default:
2900	return VERR_EM_INTERPRETER;
2901	}
2902
2903	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
2904
2905	#ifndef VBOX_COMPARE_IEM_AND_EM
2906	if (pDis->fPrefix & DISPREFIX_LOCK)
2907	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
2908	else
2909	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
2910	#else /* VBOX_COMPARE_IEM_AND_EM */
2911	uint64_t u64 = (uint64_t )pvParam1;
2912	eflags = EMEmulateCmpXchg8b(&u64, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
2913	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, sizeof(u64)); AssertRCSuccess(rc2);
2914	#endif /* VBOX_COMPARE_IEM_AND_EM */
2915
2916	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
2917
2918	/* Update guest's eflags and finish; note that only ZF is affected. */
2919	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
2920	\| (eflags & (X86_EFL_ZF));
2921
2922	*pcbSize = 8;
2923	PGMPhysReleasePageMappingLock(pVM, &Lock);
2924	return VINF_SUCCESS;
2925	}
2926
2927
2928	#ifdef IN_RC /** @todo test+enable for HM as well. */
2929	/**
2930	* [LOCK] XADD emulation.
2931	*/
2932	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2933	{
2934	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
2935	DISQPVPARAMVAL param1;
2936	void *pvParamReg2;
2937	size_t cbParamReg2;
2938	NOREF(pvFault);
2939
2940	/* Source to make DISQueryParamVal read the register value - ugly hack */
2941	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
2942	if(RT_FAILURE(rc))
2943	return VERR_EM_INTERPRETER;
2944
2945	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->Param2, &pvParamReg2, &cbParamReg2);
2946	Assert(cbParamReg2 <= 4);
2947	if(RT_FAILURE(rc))
2948	return VERR_EM_INTERPRETER;
2949
2950	#ifdef IN_RC
2951	if (TRPMHasTrap(pVCpu))
2952	{
2953	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2954	{
2955	#endif
2956	RTGCPTR GCPtrPar1;
2957	void *pvParam1;
2958	uint32_t eflags;
2959	PGMPAGEMAPLOCK Lock;
2960
2961	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
2962	switch(param1.type)
2963	{
2964	case DISQPV_TYPE_ADDRESS:
2965	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, (RTRCUINTPTR)param1.val.val64);
2966	#ifdef IN_RC
2967	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
2968	#endif
2969
2970	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2971	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2972	break;
2973
2974	default:
2975	return VERR_EM_INTERPRETER;
2976	}
2977
2978	LogFlow(("XAdd %RGv=%p reg=%08llx\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2));
2979
2980	#ifndef VBOX_COMPARE_IEM_AND_EM
2981	if (pDis->fPrefix & DISPREFIX_LOCK)
2982	eflags = EMEmulateLockXAdd(pvParam1, pvParamReg2, cbParamReg2);
2983	else
2984	eflags = EMEmulateXAdd(pvParam1, pvParamReg2, cbParamReg2);
2985	#else /* VBOX_COMPARE_IEM_AND_EM */
2986	uint64_t u64;
2987	switch (cbParamReg2)
2988	{
2989	case 1: u64 = (uint8_t )pvParam1; break;
2990	case 2: u64 = (uint16_t )pvParam1; break;
2991	case 4: u64 = (uint32_t )pvParam1; break;
2992	default:
2993	case 8: u64 = (uint64_t )pvParam1; break;
2994	}
2995	eflags = EMEmulateXAdd(&u64, pvParamReg2, cbParamReg2);
2996	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, pDis->Param2.cb); AssertRCSuccess(rc2);
2997	#endif /* VBOX_COMPARE_IEM_AND_EM */
2998
2999	LogFlow(("XAdd %RGv=%p reg=%08llx ZF=%d\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2, !!(eflags & X86_EFL_ZF) ));
3000
3001	/* Update guest's eflags and finish. */
3002	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
3003	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
3004
3005	*pcbSize = cbParamReg2;
3006	PGMPhysReleasePageMappingLock(pVM, &Lock);
3007	return VINF_SUCCESS;
3008	#ifdef IN_RC
3009	}
3010	}
3011
3012	return VERR_EM_INTERPRETER;
3013	#endif
3014	}
3015	#endif /* IN_RC */
3016
3017
3018	/**
3019	* IRET Emulation.
3020	*/
3021	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3022	{
3023	/* only allow direct calls to EMInterpretIret for now */
3024	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3025	return VERR_EM_INTERPRETER;
3026	}
3027
3028	/**
3029	* WBINVD Emulation.
3030	*/
3031	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3032	{
3033	/* Nothing to do. */
3034	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3035	return VINF_SUCCESS;
3036	}
3037
3038
3039	/**
3040	* INVLPG Emulation.
3041	*/
3042	static VBOXSTRICTRC emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3043	{
3044	DISQPVPARAMVAL param1;
3045	RTGCPTR addr;
3046	NOREF(pvFault); NOREF(pVM); NOREF(pcbSize);
3047
3048	VBOXSTRICTRC rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3049	if(RT_FAILURE(rc))
3050	return VERR_EM_INTERPRETER;
3051
3052	switch(param1.type)
3053	{
3054	case DISQPV_TYPE_IMMEDIATE:
3055	case DISQPV_TYPE_ADDRESS:
3056	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
3057	return VERR_EM_INTERPRETER;
3058	addr = (RTGCPTR)param1.val.val64;
3059	break;
3060
3061	default:
3062	return VERR_EM_INTERPRETER;
3063	}
3064
3065	/** @todo is addr always a flat linear address or ds based
3066	* (in absence of segment override prefixes)????
3067	*/
3068	#ifdef IN_RC
3069	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
3070	#endif
3071	rc = PGMInvalidatePage(pVCpu, addr);
3072	if ( rc == VINF_SUCCESS
3073	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
3074	return VINF_SUCCESS;
3075	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
3076	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), addr),
3077	VERR_EM_INTERPRETER);
3078	return rc;
3079	}
3080
3081	/** @todo change all these EMInterpretXXX methods to VBOXSTRICTRC. */
3082
3083	/**
3084	* CPUID Emulation.
3085	*/
3086	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3087	{
3088	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3089	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
3090	return rc;
3091	}
3092
3093
3094	/**
3095	* CLTS Emulation.
3096	*/
3097	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3098	{
3099	NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3100	return EMInterpretCLTS(pVM, pVCpu);
3101	}
3102
3103
3104	/**
3105	* LMSW Emulation.
3106	*/
3107	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3108	{
3109	DISQPVPARAMVAL param1;
3110	uint32_t val;
3111	NOREF(pvFault); NOREF(pcbSize);
3112
3113	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3114	if(RT_FAILURE(rc))
3115	return VERR_EM_INTERPRETER;
3116
3117	switch(param1.type)
3118	{
3119	case DISQPV_TYPE_IMMEDIATE:
3120	case DISQPV_TYPE_ADDRESS:
3121	if(!(param1.flags & DISQPV_FLAG_16))
3122	return VERR_EM_INTERPRETER;
3123	val = param1.val.val32;
3124	break;
3125
3126	default:
3127	return VERR_EM_INTERPRETER;
3128	}
3129
3130	LogFlow(("emInterpretLmsw %x\n", val));
3131	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
3132	}
3133
3134	#ifdef EM_EMULATE_SMSW
3135	/**
3136	* SMSW Emulation.
3137	*/
3138	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3139	{
3140	DISQPVPARAMVAL param1;
3141	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
3142
3143	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3144	if(RT_FAILURE(rc))
3145	return VERR_EM_INTERPRETER;
3146
3147	switch(param1.type)
3148	{
3149	case DISQPV_TYPE_IMMEDIATE:
3150	if(param1.size != sizeof(uint16_t))
3151	return VERR_EM_INTERPRETER;
3152	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->Param1.Base.idxGenReg, cr0));
3153	rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, cr0);
3154	break;
3155
3156	case DISQPV_TYPE_ADDRESS:
3157	{
3158	RTGCPTR pParam1;
3159
3160	/* Actually forced to 16 bits regardless of the operand size. */
3161	if(param1.size != sizeof(uint16_t))
3162	return VERR_EM_INTERPRETER;
3163
3164	pParam1 = (RTGCPTR)param1.val.val64;
3165	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
3166	LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
3167
3168	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
3169	if (RT_FAILURE(rc))
3170	{
3171	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
3172	return VERR_EM_INTERPRETER;
3173	}
3174	break;
3175	}
3176
3177	default:
3178	return VERR_EM_INTERPRETER;
3179	}
3180
3181	LogFlow(("emInterpretSmsw %x\n", cr0));
3182	return rc;
3183	}
3184	#endif
3185
3186	/**
3187	* MOV CRx
3188	*/
3189	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3190	{
3191	NOREF(pvFault); NOREF(pcbSize);
3192	if ((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_CR)
3193	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxCtrlReg);
3194
3195	if (pDis->Param1.fUse == DISUSE_REG_CR && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
3196	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxCtrlReg, pDis->Param2.Base.idxGenReg);
3197
3198	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
3199	}
3200
3201
3202	/**
3203	* MOV DRx
3204	*/
3205	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3206	{
3207	int rc = VERR_EM_INTERPRETER;
3208	NOREF(pvFault); NOREF(pcbSize);
3209
3210	if((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_DBG)
3211	{
3212	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxDbgReg);
3213	}
3214	else
3215	if(pDis->Param1.fUse == DISUSE_REG_DBG && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
3216	{
3217	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxDbgReg, pDis->Param2.Base.idxGenReg);
3218	}
3219	else
3220	AssertMsgFailed(("Unexpected debug register move\n"));
3221
3222	return rc;
3223	}
3224
3225
3226	/**
3227	* LLDT Emulation.
3228	*/
3229	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3230	{
3231	DISQPVPARAMVAL param1;
3232	RTSEL sel;
3233	NOREF(pVM); NOREF(pvFault); NOREF(pcbSize);
3234
3235	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3236	if(RT_FAILURE(rc))
3237	return VERR_EM_INTERPRETER;
3238
3239	switch(param1.type)
3240	{
3241	case DISQPV_TYPE_ADDRESS:
3242	return VERR_EM_INTERPRETER; //feeling lazy right now
3243
3244	case DISQPV_TYPE_IMMEDIATE:
3245	if(!(param1.flags & DISQPV_FLAG_16))
3246	return VERR_EM_INTERPRETER;
3247	sel = (RTSEL)param1.val.val16;
3248	break;
3249
3250	default:
3251	return VERR_EM_INTERPRETER;
3252	}
3253
3254	#ifdef IN_RING0
3255	/* Only for the VT-x real-mode emulation case. */
3256	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
3257	CPUMSetGuestLDTR(pVCpu, sel);
3258	return VINF_SUCCESS;
3259	#else
3260	if (sel == 0)
3261	{
3262	if (CPUMGetHyperLDTR(pVCpu) == 0)
3263	{
3264	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
3265	return VINF_SUCCESS;
3266	}
3267	}
3268	//still feeling lazy
3269	return VERR_EM_INTERPRETER;
3270	#endif
3271	}
3272
3273	#ifdef IN_RING0
3274	/**
3275	* LIDT/LGDT Emulation.
3276	*/
3277	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3278	{
3279	DISQPVPARAMVAL param1;
3280	RTGCPTR pParam1;
3281	X86XDTR32 dtr32;
3282	NOREF(pvFault); NOREF(pcbSize);
3283
3284	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
3285
3286	/* Only for the VT-x real-mode emulation case. */
3287	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
3288
3289	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3290	if(RT_FAILURE(rc))
3291	return VERR_EM_INTERPRETER;
3292
3293	switch(param1.type)
3294	{
3295	case DISQPV_TYPE_ADDRESS:
3296	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, param1.val.val16);
3297	break;
3298
3299	default:
3300	return VERR_EM_INTERPRETER;
3301	}
3302
3303	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
3304	AssertRCReturn(rc, VERR_EM_INTERPRETER);
3305
3306	if (!(pDis->fPrefix & DISPREFIX_OPSIZE))
3307	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
3308
3309	if (pDis->pCurInstr->uOpcode == OP_LIDT)
3310	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
3311	else
3312	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
3313
3314	return VINF_SUCCESS;
3315	}
3316	#endif
3317
3318
3319	#ifdef IN_RC
3320	/**
3321	* STI Emulation.
3322	*
3323	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
3324	*/
3325	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3326	{
3327	NOREF(pcbSize);
3328	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
3329
3330	if(!pGCState)
3331	{
3332	Assert(pGCState);
3333	return VERR_EM_INTERPRETER;
3334	}
3335	pGCState->uVMFlags \|= X86_EFL_IF;
3336
3337	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
3338	Assert(pvFault == SELMToFlat(pVM, DISSELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
3339
3340	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->cbInstr;
3341	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3342
3343	return VINF_SUCCESS;
3344	}
3345	#endif /* IN_RC */
3346
3347
3348	/**
3349	* HLT Emulation.
3350	*/
3351	static VBOXSTRICTRC
3352	emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3353	{
3354	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3355	return VINF_EM_HALT;
3356	}
3357
3358
3359	/**
3360	* RDTSC Emulation.
3361	*/
3362	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3363	{
3364	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3365	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
3366	}
3367
3368	/**
3369	* RDPMC Emulation
3370	*/
3371	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3372	{
3373	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3374	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
3375	}
3376
3377
3378	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3379	{
3380	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3381	return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
3382	}
3383
3384
3385	static VBOXSTRICTRC emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3386	{
3387	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3388	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
3389	}
3390
3391
3392	#ifdef LOG_ENABLED
3393	static const char *emMSRtoString(uint32_t uMsr)
3394	{
3395	switch (uMsr)
3396	{
3397	case MSR_IA32_APICBASE:
3398	return "MSR_IA32_APICBASE";
3399	case MSR_IA32_CR_PAT:
3400	return "MSR_IA32_CR_PAT";
3401	case MSR_IA32_SYSENTER_CS:
3402	return "MSR_IA32_SYSENTER_CS";
3403	case MSR_IA32_SYSENTER_EIP:
3404	return "MSR_IA32_SYSENTER_EIP";
3405	case MSR_IA32_SYSENTER_ESP:
3406	return "MSR_IA32_SYSENTER_ESP";
3407	case MSR_K6_EFER:
3408	return "MSR_K6_EFER";
3409	case MSR_K8_SF_MASK:
3410	return "MSR_K8_SF_MASK";
3411	case MSR_K6_STAR:
3412	return "MSR_K6_STAR";
3413	case MSR_K8_LSTAR:
3414	return "MSR_K8_LSTAR";
3415	case MSR_K8_CSTAR:
3416	return "MSR_K8_CSTAR";
3417	case MSR_K8_FS_BASE:
3418	return "MSR_K8_FS_BASE";
3419	case MSR_K8_GS_BASE:
3420	return "MSR_K8_GS_BASE";
3421	case MSR_K8_KERNEL_GS_BASE:
3422	return "MSR_K8_KERNEL_GS_BASE";
3423	case MSR_K8_TSC_AUX:
3424	return "MSR_K8_TSC_AUX";
3425	case MSR_IA32_BIOS_SIGN_ID:
3426	return "Unsupported MSR_IA32_BIOS_SIGN_ID";
3427	case MSR_IA32_PLATFORM_ID:
3428	return "Unsupported MSR_IA32_PLATFORM_ID";
3429	case MSR_IA32_BIOS_UPDT_TRIG:
3430	return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
3431	case MSR_IA32_TSC:
3432	return "MSR_IA32_TSC";
3433	case MSR_IA32_MISC_ENABLE:
3434	return "MSR_IA32_MISC_ENABLE";
3435	case MSR_IA32_MTRR_CAP:
3436	return "MSR_IA32_MTRR_CAP";
3437	case MSR_IA32_MCP_CAP:
3438	return "Unsupported MSR_IA32_MCP_CAP";
3439	case MSR_IA32_MCP_STATUS:
3440	return "Unsupported MSR_IA32_MCP_STATUS";
3441	case MSR_IA32_MCP_CTRL:
3442	return "Unsupported MSR_IA32_MCP_CTRL";
3443	case MSR_IA32_MTRR_DEF_TYPE:
3444	return "MSR_IA32_MTRR_DEF_TYPE";
3445	case MSR_K7_EVNTSEL0:
3446	return "Unsupported MSR_K7_EVNTSEL0";
3447	case MSR_K7_EVNTSEL1:
3448	return "Unsupported MSR_K7_EVNTSEL1";
3449	case MSR_K7_EVNTSEL2:
3450	return "Unsupported MSR_K7_EVNTSEL2";
3451	case MSR_K7_EVNTSEL3:
3452	return "Unsupported MSR_K7_EVNTSEL3";
3453	case MSR_IA32_MC0_CTL:
3454	return "Unsupported MSR_IA32_MC0_CTL";
3455	case MSR_IA32_MC0_STATUS:
3456	return "Unsupported MSR_IA32_MC0_STATUS";
3457	case MSR_IA32_PERFEVTSEL0:
3458	return "Unsupported MSR_IA32_PERFEVTSEL0";
3459	case MSR_IA32_PERFEVTSEL1:
3460	return "Unsupported MSR_IA32_PERFEVTSEL1";
3461	case MSR_IA32_PERF_STATUS:
3462	return "MSR_IA32_PERF_STATUS";
3463	case MSR_IA32_PLATFORM_INFO:
3464	return "MSR_IA32_PLATFORM_INFO";
3465	case MSR_IA32_PERF_CTL:
3466	return "Unsupported MSR_IA32_PERF_CTL";
3467	case MSR_K7_PERFCTR0:
3468	return "Unsupported MSR_K7_PERFCTR0";
3469	case MSR_K7_PERFCTR1:
3470	return "Unsupported MSR_K7_PERFCTR1";
3471	case MSR_K7_PERFCTR2:
3472	return "Unsupported MSR_K7_PERFCTR2";
3473	case MSR_K7_PERFCTR3:
3474	return "Unsupported MSR_K7_PERFCTR3";
3475	case MSR_IA32_PMC0:
3476	return "Unsupported MSR_IA32_PMC0";
3477	case MSR_IA32_PMC1:
3478	return "Unsupported MSR_IA32_PMC1";
3479	case MSR_IA32_PMC2:
3480	return "Unsupported MSR_IA32_PMC2";
3481	case MSR_IA32_PMC3:
3482	return "Unsupported MSR_IA32_PMC3";
3483	}
3484	return "Unknown MSR";
3485	}
3486	#endif /* LOG_ENABLED */
3487
3488
3489	/**
3490	* Interpret RDMSR
3491	*
3492	* @returns VBox status code.
3493	* @param pVM Pointer to the VM.
3494	* @param pVCpu Pointer to the VMCPU.
3495	* @param pRegFrame The register frame.
3496	*/
3497	VMM_INT_DECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3498	{
3499	NOREF(pVM);
3500
3501	/* Get the current privilege level. */
3502	if (CPUMGetGuestCPL(pVCpu) != 0)
3503	{
3504	Log4(("EM: Refuse RDMSR: CPL != 0\n"));
3505	return VERR_EM_INTERPRETER; /* supervisor only */
3506	}
3507
3508	uint64_t uValue;
3509	int rc = CPUMQueryGuestMsr(pVCpu, pRegFrame->ecx, &uValue);
3510	if (RT_UNLIKELY(rc != VINF_SUCCESS))
3511	{
3512	Assert(rc == VERR_CPUM_RAISE_GP_0);
3513	Log4(("EM: Refuse RDMSR: rc=%Rrc\n", rc));
3514	return VERR_EM_INTERPRETER;
3515	}
3516	pRegFrame->rax = (uint32_t) uValue;
3517	pRegFrame->rdx = (uint32_t)(uValue >> 32);
3518	LogFlow(("EMInterpretRdmsr %s (%x) -> %RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, uValue));
3519	return rc;
3520	}
3521
3522
3523	/**
3524	* RDMSR Emulation.
3525	*/
3526	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3527	{
3528	/* Note: The Intel manual claims there's a REX version of RDMSR that's slightly
3529	different, so we play safe by completely disassembling the instruction. */
3530	Assert(!(pDis->fPrefix & DISPREFIX_REX));
3531	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3532	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
3533	}
3534
3535
3536	/**
3537	* Interpret WRMSR
3538	*
3539	* @returns VBox status code.
3540	* @param pVM Pointer to the VM.
3541	* @param pVCpu Pointer to the VMCPU.
3542	* @param pRegFrame The register frame.
3543	*/
3544	VMM_INT_DECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
3545	{
3546	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
3547
3548	/* Check the current privilege level, this instruction is supervisor only. */
3549	if (CPUMGetGuestCPL(pVCpu) != 0)
3550	{
3551	Log4(("EM: Refuse WRMSR: CPL != 0\n"));
3552	return VERR_EM_INTERPRETER; /** @todo raise \#GP(0) */
3553	}
3554
3555	int rc = CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx));
3556	if (rc != VINF_SUCCESS)
3557	{
3558	Assert(rc == VERR_CPUM_RAISE_GP_0);
3559	Log4(("EM: Refuse WRMSR: rc=%d\n", rc));
3560	return VERR_EM_INTERPRETER;
3561	}
3562	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx,
3563	RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx)));
3564	NOREF(pVM);
3565	return rc;
3566	}
3567
3568
3569	/**
3570	* WRMSR Emulation.
3571	*/
3572	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3573	{
3574	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3575	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3576	}
3577
3578
3579	/**
3580	* Internal worker.
3581	* @copydoc emInterpretInstructionCPUOuter
3582	*/
3583	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3584	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3585	{
3586	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
3587	Assert(enmCodeType == EMCODETYPE_SUPERVISOR \|\| enmCodeType == EMCODETYPE_ALL);
3588	Assert(pcbSize);
3589	*pcbSize = 0;
3590
3591	if (enmCodeType == EMCODETYPE_SUPERVISOR)
3592	{
3593	/*
3594	* Only supervisor guest code!!
3595	* And no complicated prefixes.
3596	*/
3597	/* Get the current privilege level. */
3598	uint32_t cpl = CPUMGetGuestCPL(pVCpu);
3599	if ( cpl != 0
3600	&& pDis->pCurInstr->uOpcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3601	{
3602	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3603	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3604	return VERR_EM_INTERPRETER;
3605	}
3606	}
3607	else
3608	Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3609
3610	#ifdef IN_RC
3611	if ( (pDis->fPrefix & (DISPREFIX_REPNE \| DISPREFIX_REP))
3612	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3613	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3614	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3615	&& pDis->pCurInstr->uOpcode != OP_XADD
3616	&& pDis->pCurInstr->uOpcode != OP_OR
3617	&& pDis->pCurInstr->uOpcode != OP_AND
3618	&& pDis->pCurInstr->uOpcode != OP_XOR
3619	&& pDis->pCurInstr->uOpcode != OP_BTR
3620	)
3621	)
3622	#else
3623	if ( (pDis->fPrefix & DISPREFIX_REPNE)
3624	\|\| ( (pDis->fPrefix & DISPREFIX_REP)
3625	&& pDis->pCurInstr->uOpcode != OP_STOSWD
3626	)
3627	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3628	&& pDis->pCurInstr->uOpcode != OP_OR
3629	&& pDis->pCurInstr->uOpcode != OP_AND
3630	&& pDis->pCurInstr->uOpcode != OP_XOR
3631	&& pDis->pCurInstr->uOpcode != OP_BTR
3632	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3633	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3634	)
3635	)
3636	#endif
3637	{
3638	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3639	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3640	Log4(("EM: Refuse %u on REP/REPNE/LOCK prefix grounds\n", pDis->pCurInstr->uOpcode));
3641	return VERR_EM_INTERPRETER;
3642	}
3643
3644	#if HC_ARCH_BITS == 32
3645	/*
3646	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3647	* Whitelisted instructions are safe.
3648	*/
3649	if ( pDis->Param1.cb > 4
3650	&& CPUMIsGuestIn64BitCode(pVCpu))
3651	{
3652	uint32_t uOpCode = pDis->pCurInstr->uOpcode;
3653	if ( uOpCode != OP_STOSWD
3654	&& uOpCode != OP_MOV
3655	&& uOpCode != OP_CMPXCHG8B
3656	&& uOpCode != OP_XCHG
3657	&& uOpCode != OP_BTS
3658	&& uOpCode != OP_BTR
3659	&& uOpCode != OP_BTC
3660	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3661	&& uOpCode != OP_CMPXCHG /* solaris */
3662	&& uOpCode != OP_AND /* windows */
3663	&& uOpCode != OP_OR /* windows */
3664	&& uOpCode != OP_XOR /* because we can */
3665	&& uOpCode != OP_ADD /* windows (dripple) */
3666	&& uOpCode != OP_ADC /* because we can */
3667	&& uOpCode != OP_SUB /* because we can */
3668	/** @todo OP_BTS or is that a different kind of failure? */
3669	# endif
3670	)
3671	{
3672	# ifdef VBOX_WITH_STATISTICS
3673	switch (pDis->pCurInstr->uOpcode)
3674	{
3675	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3676	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3677	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3678	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3679	INTERPRET_FAILED_CASE(OP_INC,Inc);
3680	INTERPRET_FAILED_CASE(OP_POP,Pop);
3681	INTERPRET_FAILED_CASE(OP_OR, Or);
3682	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3683	INTERPRET_FAILED_CASE(OP_AND,And);
3684	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3685	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3686	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3687	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3688	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3689	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3690	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3691	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3692	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3693	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3694	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3695	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3696	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3697	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3698	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3699	INTERPRET_FAILED_CASE(OP_ADD,Add);
3700	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3701	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3702	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3703	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3704	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3705	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3706	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3707	INTERPRET_FAILED_CASE(OP_STI, Sti);
3708	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3709	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3710	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3711	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3712	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3713	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3714	# undef INTERPRET_FAILED_CASE
3715	default:
3716	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3717	break;
3718	}
3719	# endif /* VBOX_WITH_STATISTICS */
3720	Log4(("EM: Refuse %u on grounds of accessing %u bytes\n", pDis->pCurInstr->uOpcode, pDis->Param1.cb));
3721	return VERR_EM_INTERPRETER;
3722	}
3723	}
3724	#endif
3725
3726	VBOXSTRICTRC rc;
3727	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3728	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3729	#endif
3730	switch (pDis->pCurInstr->uOpcode)
3731	{
3732	/*
3733	* Macros for generating the right case statements.
3734	*/
3735	# ifndef VBOX_COMPARE_IEM_AND_EM
3736	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3737	case opcode:\
3738	if (pDis->fPrefix & DISPREFIX_LOCK) \
3739	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3740	else \
3741	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3742	if (RT_SUCCESS(rc)) \
3743	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3744	else \
3745	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3746	return rc
3747	# else /* VBOX_COMPARE_IEM_AND_EM */
3748	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3749	case opcode:\
3750	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3751	if (RT_SUCCESS(rc)) \
3752	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3753	else \
3754	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3755	return rc
3756	# endif /* VBOX_COMPARE_IEM_AND_EM */
3757
3758	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3759	case opcode:\
3760	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3761	if (RT_SUCCESS(rc)) \
3762	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3763	else \
3764	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3765	return rc
3766
3767	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3768	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3769	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3770	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3771
3772	#define INTERPRET_CASE(opcode, Instr) \
3773	case opcode:\
3774	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3775	if (RT_SUCCESS(rc)) \
3776	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3777	else \
3778	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3779	return rc
3780
3781	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3782	case opcode:\
3783	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3784	if (RT_SUCCESS(rc)) \
3785	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3786	else \
3787	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3788	return rc
3789
3790	#define INTERPRET_STAT_CASE(opcode, Instr) \
3791	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3792
3793	/*
3794	* The actual case statements.
3795	*/
3796	INTERPRET_CASE(OP_XCHG,Xchg);
3797	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3798	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3799	INTERPRET_CASE(OP_POP,Pop);
3800	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3801	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3802	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3803	INTERPRET_CASE(OP_MOV,Mov);
3804	#ifndef IN_RC
3805	INTERPRET_CASE(OP_STOSWD,StosWD);
3806	#endif
3807	INTERPRET_CASE(OP_INVLPG,InvlPg);
3808	INTERPRET_CASE(OP_CPUID,CpuId);
3809	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3810	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3811	#ifdef IN_RING0
3812	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3813	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3814	#endif
3815	INTERPRET_CASE(OP_LLDT,LLdt);
3816	INTERPRET_CASE(OP_LMSW,Lmsw);
3817	#ifdef EM_EMULATE_SMSW
3818	INTERPRET_CASE(OP_SMSW,Smsw);
3819	#endif
3820	INTERPRET_CASE(OP_CLTS,Clts);
3821	INTERPRET_CASE(OP_MONITOR, Monitor);
3822	INTERPRET_CASE(OP_MWAIT, MWait);
3823	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3824	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3825	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3826	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3827	INTERPRET_CASE(OP_ADC,Adc);
3828	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3829	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3830	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3831	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3832	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3833	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3834	#ifdef IN_RC
3835	INTERPRET_CASE(OP_STI,Sti);
3836	INTERPRET_CASE(OP_XADD, XAdd);
3837	#endif
3838	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3839	INTERPRET_CASE(OP_HLT,Hlt);
3840	INTERPRET_CASE(OP_IRET,Iret);
3841	INTERPRET_CASE(OP_WBINVD,WbInvd);
3842	#ifdef VBOX_WITH_STATISTICS
3843	# ifndef IN_RC
3844	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3845	# endif
3846	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3847	#endif
3848
3849	default:
3850	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->uOpcode));
3851	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3852	return VERR_EM_INTERPRETER;
3853
3854	#undef INTERPRET_CASE_EX_PARAM2
3855	#undef INTERPRET_STAT_CASE
3856	#undef INTERPRET_CASE_EX
3857	#undef INTERPRET_CASE
3858	} /* switch (opcode) */
3859	/* not reached */
3860	}
3861
3862	/**
3863	* Interprets the current instruction using the supplied DISCPUSTATE structure.
3864	*
3865	* EIP is NOT updated!
3866	*
3867	* @returns VBox strict status code.
3868	* @retval VINF_* Scheduling instructions. When these are returned, it
3869	* starts to get a bit tricky to know whether code was
3870	* executed or not... We'll address this when it becomes a problem.
3871	* @retval VERR_EM_INTERPRETER Something we can't cope with.
3872	* @retval VERR_* Fatal errors.
3873	*
3874	* @param pVCpu Pointer to the VMCPU.
3875	* @param pDis The disassembler cpu state for the instruction to be
3876	* interpreted.
3877	* @param pRegFrame The register frame. EIP is NOT changed!
3878	* @param pvFault The fault address (CR2).
3879	* @param pcbSize Size of the write (if applicable).
3880	* @param enmCodeType Code type (user/supervisor)
3881	*
3882	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
3883	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
3884	* to worry about e.g. invalid modrm combinations (!)
3885	*
3886	* @todo At this time we do NOT check if the instruction overwrites vital information.
3887	* Make sure this can't happen!! (will add some assertions/checks later)
3888	*/
3889	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3890	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3891	{
3892	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3893	VBOXSTRICTRC rc = emInterpretInstructionCPU(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, pRegFrame, pvFault, enmCodeType, pcbSize);
3894	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3895	if (RT_SUCCESS(rc))
3896	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
3897	else
3898	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
3899	return rc;
3900	}
3901
3902
3903	#endif /* !VBOX_WITH_IEM */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 44375

Download in other formats: