EMAll.cpp@ 47681

Last change on this file since 47681 was 47326, checked in by vboxsync, 11 years ago
IEM: Implemented the mwait & monitor instructions. (Still work to be done on mwait in EM, but that's a different topic.)
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 139.7 KB

Line
1	/* $Id: EMAll.cpp 47326 2013-07-22 21:46:43Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18	/*******************************************************************************
19	* Header Files *
20	*******************************************************************************/
21	#define LOG_GROUP LOG_GROUP_EM
22	#include <VBox/vmm/em.h>
23	#include <VBox/vmm/mm.h>
24	#include <VBox/vmm/selm.h>
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/csam.h>
27	#include <VBox/vmm/pgm.h>
28	#ifdef VBOX_WITH_IEM
29	# include <VBox/vmm/iem.h>
30	#endif
31	#include <VBox/vmm/iom.h>
32	#include <VBox/vmm/stam.h>
33	#include "EMInternal.h"
34	#include <VBox/vmm/vm.h>
35	#include <VBox/vmm/vmm.h>
36	#include <VBox/vmm/hm.h>
37	#include <VBox/vmm/tm.h>
38	#include <VBox/vmm/pdmapi.h>
39	#include <VBox/param.h>
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/log.h>
44	#include "internal/pgm.h"
45	#include <iprt/assert.h>
46	#include <iprt/asm.h>
47	#include <iprt/string.h>
48
49	#ifndef IN_RC
50	#undef VBOX_WITH_IEM
51	#endif
52	#ifdef VBOX_WITH_IEM
53	//# define VBOX_COMPARE_IEM_AND_EM /* debugging... */
54	//# define VBOX_SAME_AS_EM
55	//# define VBOX_COMPARE_IEM_LAST
56	#endif
57
58	#ifdef VBOX_WITH_RAW_RING1
59	# define EM_EMULATE_SMSW
60	#endif
61
62
63	/*******************************************************************************
64	* Defined Constants And Macros *
65	*******************************************************************************/
66	/** @def EM_ASSERT_FAULT_RETURN
67	* Safety check.
68	*
69	* Could in theory misfire on a cross page boundary access...
70	*
71	* Currently disabled because the CSAM (+ PATM) patch monitoring occasionally
72	* turns up an alias page instead of the original faulting one and annoying the
73	* heck out of anyone running a debug build. See @bugref{2609} and @bugref{1931}.
74	*/
75	#if 0
76	# define EM_ASSERT_FAULT_RETURN(expr, rc) AssertReturn(expr, rc)
77	#else
78	# define EM_ASSERT_FAULT_RETURN(expr, rc) do { } while (0)
79	#endif
80
81
82	/*******************************************************************************
83	* Internal Functions *
84	*******************************************************************************/
85	#if !defined(VBOX_WITH_IEM) \|\| defined(VBOX_COMPARE_IEM_AND_EM)
86	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
87	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize);
88	#endif
89
90
91	/*******************************************************************************
92	* Global Variables *
93	*******************************************************************************/
94	#ifdef VBOX_COMPARE_IEM_AND_EM
95	static const uint32_t g_fInterestingFFs = VMCPU_FF_TO_R3
96	\| VMCPU_FF_CSAM_PENDING_ACTION \| VMCPU_FF_CSAM_SCAN_PAGE \| VMCPU_FF_INHIBIT_INTERRUPTS
97	\| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
98	\| VMCPU_FF_TLB_FLUSH \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL;
99	static uint32_t g_fIncomingFFs;
100	static CPUMCTX g_IncomingCtx;
101	static bool g_fIgnoreRaxRdx = false;
102
103	static uint32_t g_fEmFFs;
104	static CPUMCTX g_EmCtx;
105	static uint8_t g_abEmWrote[256];
106	static size_t g_cbEmWrote;
107
108	static uint32_t g_fIemFFs;
109	static CPUMCTX g_IemCtx;
110	extern uint8_t g_abIemWrote[256];
111	#if defined(VBOX_COMPARE_IEM_FIRST) \|\| defined(VBOX_COMPARE_IEM_LAST)
112	extern size_t g_cbIemWrote;
113	#else
114	static size_t g_cbIemWrote;
115	#endif
116	#endif
117
118
119	/**
120	* Get the current execution manager status.
121	*
122	* @returns Current status.
123	* @param pVCpu Pointer to the VMCPU.
124	*/
125	VMM_INT_DECL(EMSTATE) EMGetState(PVMCPU pVCpu)
126	{
127	return pVCpu->em.s.enmState;
128	}
129
130	/**
131	* Sets the current execution manager status. (use only when you know what you're doing!)
132	*
133	* @param pVCpu Pointer to the VMCPU.
134	*/
135	VMM_INT_DECL(void) EMSetState(PVMCPU pVCpu, EMSTATE enmNewState)
136	{
137	/* Only allowed combination: */
138	Assert(pVCpu->em.s.enmState == EMSTATE_WAIT_SIPI && enmNewState == EMSTATE_HALTED);
139	pVCpu->em.s.enmState = enmNewState;
140	}
141
142
143	/**
144	* Sets the PC for which interrupts should be inhibited.
145	*
146	* @param pVCpu Pointer to the VMCPU.
147	* @param PC The PC.
148	*/
149	VMMDECL(void) EMSetInhibitInterruptsPC(PVMCPU pVCpu, RTGCUINTPTR PC)
150	{
151	pVCpu->em.s.GCPtrInhibitInterrupts = PC;
152	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
153	}
154
155
156	/**
157	* Gets the PC for which interrupts should be inhibited.
158	*
159	* There are a few instructions which inhibits or delays interrupts
160	* for the instruction following them. These instructions are:
161	* - STI
162	* - MOV SS, r/m16
163	* - POP SS
164	*
165	* @returns The PC for which interrupts should be inhibited.
166	* @param pVCpu Pointer to the VMCPU.
167	*
168	*/
169	VMMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVMCPU pVCpu)
170	{
171	return pVCpu->em.s.GCPtrInhibitInterrupts;
172	}
173
174
175	/**
176	* Prepare an MWAIT - essentials of the MONITOR instruction.
177	*
178	* @returns VINF_SUCCESS
179	* @param pVCpu The current CPU.
180	* @param rax The content of RAX.
181	* @param rcx The content of RCX.
182	* @param rdx The content of RDX.
183	* @param GCPhys The physical address corresponding to rax.
184	*/
185	VMM_INT_DECL(int) EMMonitorWaitPrepare(PVMCPU pVCpu, uint64_t rax, uint64_t rcx, uint64_t rdx, RTGCPHYS GCPhys)
186	{
187	pVCpu->em.s.MWait.uMonitorRAX = rax;
188	pVCpu->em.s.MWait.uMonitorRCX = rcx;
189	pVCpu->em.s.MWait.uMonitorRDX = rdx;
190	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_MONITOR_ACTIVE;
191	/** @todo Make use of GCPhys. */
192	/** @todo Complete MONITOR implementation. */
193	return VINF_SUCCESS;
194	}
195
196
197	/**
198	* Performs an MWAIT.
199	*
200	* @returns VINF_SUCCESS
201	* @param pVCpu The current CPU.
202	* @param rax The content of RAX.
203	* @param rcx The content of RCX.
204	*/
205	VMM_INT_DECL(int) EMMonitorWaitPerform(PVMCPU pVCpu, uint64_t rax, uint64_t rcx)
206	{
207	pVCpu->em.s.MWait.uMWaitRAX = rax;
208	pVCpu->em.s.MWait.uMWaitRCX = rcx;
209	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_ACTIVE;
210	if (rcx)
211	pVCpu->em.s.MWait.fWait \|= EMMWAIT_FLAG_BREAKIRQIF0;
212	else
213	pVCpu->em.s.MWait.fWait &= ~EMMWAIT_FLAG_BREAKIRQIF0;
214	/** @todo not completely correct?? */
215	return VINF_EM_HALT;
216	}
217
218
219
220	/**
221	* Determine if we should continue after encountering a hlt or mwait
222	* instruction.
223	*
224	* Clears MWAIT flags if returning @c true.
225	*
226	* @returns boolean
227	* @param pVCpu Pointer to the VMCPU.
228	* @param pCtx Current CPU context.
229	*/
230	VMM_INT_DECL(bool) EMShouldContinueAfterHalt(PVMCPU pVCpu, PCPUMCTX pCtx)
231	{
232	if ( pCtx->eflags.Bits.u1IF
233	\|\| ( (pVCpu->em.s.MWait.fWait & (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0))
234	== (EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0)) )
235	{
236	pVCpu->em.s.MWait.fWait &= ~(EMMWAIT_FLAG_ACTIVE \| EMMWAIT_FLAG_BREAKIRQIF0);
237	return !!VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC));
238	}
239
240	return false;
241	}
242
243
244	/**
245	* Locks REM execution to a single VCPU.
246	*
247	* @param pVM Pointer to the VM.
248	*/
249	VMMDECL(void) EMRemLock(PVM pVM)
250	{
251	#ifdef VBOX_WITH_REM
252	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
253	return; /* early init */
254
255	Assert(!PGMIsLockOwner(pVM));
256	Assert(!IOMIsLockWriteOwner(pVM));
257	int rc = PDMCritSectEnter(&pVM->em.s.CritSectREM, VERR_SEM_BUSY);
258	AssertRCSuccess(rc);
259	#endif
260	}
261
262
263	/**
264	* Unlocks REM execution
265	*
266	* @param pVM Pointer to the VM.
267	*/
268	VMMDECL(void) EMRemUnlock(PVM pVM)
269	{
270	#ifdef VBOX_WITH_REM
271	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
272	return; /* early init */
273
274	PDMCritSectLeave(&pVM->em.s.CritSectREM);
275	#endif
276	}
277
278
279	/**
280	* Check if this VCPU currently owns the REM lock.
281	*
282	* @returns bool owner/not owner
283	* @param pVM Pointer to the VM.
284	*/
285	VMMDECL(bool) EMRemIsLockOwner(PVM pVM)
286	{
287	#ifdef VBOX_WITH_REM
288	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
289	return true; /* early init */
290
291	return PDMCritSectIsOwner(&pVM->em.s.CritSectREM);
292	#else
293	return true;
294	#endif
295	}
296
297
298	/**
299	* Try to acquire the REM lock.
300	*
301	* @returns VBox status code
302	* @param pVM Pointer to the VM.
303	*/
304	VMM_INT_DECL(int) EMRemTryLock(PVM pVM)
305	{
306	#ifdef VBOX_WITH_REM
307	if (!PDMCritSectIsInitialized(&pVM->em.s.CritSectREM))
308	return VINF_SUCCESS; /* early init */
309
310	return PDMCritSectTryEnter(&pVM->em.s.CritSectREM);
311	#else
312	return VINF_SUCCESS;
313	#endif
314	}
315
316
317	/**
318	* @callback_method_impl{FNDISREADBYTES}
319	*/
320	static DECLCALLBACK(int) emReadBytes(PDISCPUSTATE pDis, uint8_t offInstr, uint8_t cbMinRead, uint8_t cbMaxRead)
321	{
322	PVMCPU pVCpu = (PVMCPU)pDis->pvUser;
323	#if defined(IN_RC) \|\| defined(IN_RING3)
324	PVM pVM = pVCpu->CTX_SUFF(pVM);
325	#endif
326	RTUINTPTR uSrcAddr = pDis->uInstrAddr + offInstr;
327	int rc;
328
329	/*
330	* Figure how much we can or must read.
331	*/
332	size_t cbToRead = PAGE_SIZE - (uSrcAddr & PAGE_OFFSET_MASK);
333	if (cbToRead > cbMaxRead)
334	cbToRead = cbMaxRead;
335	else if (cbToRead < cbMinRead)
336	cbToRead = cbMinRead;
337
338	#if defined(VBOX_WITH_RAW_MODE) && (defined(IN_RC) \|\| defined(IN_RING3))
339	/*
340	* We might be called upon to interpret an instruction in a patch.
341	*/
342	if (PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), uSrcAddr))
343	{
344	# ifdef IN_RC
345	memcpy(&pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
346	# else
347	memcpy(&pDis->abInstr[offInstr], PATMR3GCPtrToHCPtr(pVCpu->CTX_SUFF(pVM), uSrcAddr), cbToRead);
348	# endif
349	rc = VINF_SUCCESS;
350	}
351	else
352	#endif
353	{
354	# ifdef IN_RC
355	/*
356	* Try access it thru the shadow page tables first. Fall back on the
357	* slower PGM method if it fails because the TLB or page table was
358	* modified recently.
359	*/
360	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
361	if (rc == VERR_ACCESS_DENIED && cbToRead > cbMinRead)
362	{
363	cbToRead = cbMinRead;
364	rc = MMGCRamRead(pVCpu->pVMRC, &pDis->abInstr[offInstr], (void *)(uintptr_t)uSrcAddr, cbToRead);
365	}
366	if (rc == VERR_ACCESS_DENIED)
367	#endif
368	{
369	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
370	if (RT_FAILURE(rc))
371	{
372	if (cbToRead > cbMinRead)
373	{
374	cbToRead = cbMinRead;
375	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pDis->abInstr[offInstr], uSrcAddr, cbToRead);
376	}
377	if (RT_FAILURE(rc))
378	{
379	#ifndef IN_RC
380	/*
381	* If we fail to find the page via the guest's page tables
382	* we invalidate the page in the host TLB (pertaining to
383	* the guest in the NestedPaging case). See @bugref{6043}.
384	*/
385	if (rc == VERR_PAGE_TABLE_NOT_PRESENT \|\| rc == VERR_PAGE_NOT_PRESENT)
386	{
387	HMInvalidatePage(pVCpu, uSrcAddr);
388	if (((uSrcAddr + cbToRead - 1) >> PAGE_SHIFT) != (uSrcAddr >> PAGE_SHIFT))
389	HMInvalidatePage(pVCpu, uSrcAddr + cbToRead - 1);
390	}
391	#endif
392	}
393	}
394	}
395	}
396
397	pDis->cbCachedInstr = offInstr + (uint8_t)cbToRead;
398	return rc;
399	}
400
401
402	DECLINLINE(int) emDisCoreOne(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, RTGCUINTPTR InstrGC, uint32_t *pOpsize)
403	{
404	return DISInstrWithReader(InstrGC, (DISCPUMODE)pDis->uCpuMode, emReadBytes, pVCpu, pDis, pOpsize);
405	}
406
407
408	/**
409	* Disassembles the current instruction.
410	*
411	* @returns VBox status code, see SELMToFlatEx and EMInterpretDisasOneEx for
412	* details.
413	*
414	* @param pVM Pointer to the VM.
415	* @param pVCpu Pointer to the VMCPU.
416	* @param pDis Where to return the parsed instruction info.
417	* @param pcbInstr Where to return the instruction size. (optional)
418	*/
419	VMM_INT_DECL(int) EMInterpretDisasCurrent(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, unsigned *pcbInstr)
420	{
421	PCPUMCTXCORE pCtxCore = CPUMCTX2CORE(CPUMQueryGuestCtxPtr(pVCpu));
422	RTGCPTR GCPtrInstr;
423	#if 0
424	int rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pCtxCore, pCtxCore->rip, 0, &GCPtrInstr);
425	#else
426	/** @todo Get the CPU mode as well while we're at it! */
427	int rc = SELMValidateAndConvertCSAddr(pVCpu, pCtxCore->eflags, pCtxCore->ss.Sel, pCtxCore->cs.Sel, &pCtxCore->cs,
428	pCtxCore->rip, &GCPtrInstr);
429	#endif
430	if (RT_FAILURE(rc))
431	{
432	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RGv (cpl=%d) - rc=%Rrc !!\n",
433	pCtxCore->cs.Sel, (RTGCPTR)pCtxCore->rip, pCtxCore->ss.Sel & X86_SEL_RPL, rc));
434	return rc;
435	}
436	return EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pDis, pcbInstr);
437	}
438
439
440	/**
441	* Disassembles one instruction.
442	*
443	* This is used by internally by the interpreter and by trap/access handlers.
444	*
445	* @returns VBox status code.
446	*
447	* @param pVM Pointer to the VM.
448	* @param pVCpu Pointer to the VMCPU.
449	* @param GCPtrInstr The flat address of the instruction.
450	* @param pCtxCore The context core (used to determine the cpu mode).
451	* @param pDis Where to return the parsed instruction info.
452	* @param pcbInstr Where to return the instruction size. (optional)
453	*/
454	VMM_INT_DECL(int) EMInterpretDisasOneEx(PVM pVM, PVMCPU pVCpu, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore,
455	PDISCPUSTATE pDis, unsigned *pcbInstr)
456	{
457	Assert(pCtxCore == CPUMGetGuestCtxCore(pVCpu));
458	DISCPUMODE enmCpuMode = CPUMGetGuestDisMode(pVCpu);
459	/** @todo Deal with too long instruction (=> \#GP), opcode read errors (=>
460	* \#PF, \#GP, \#??), undefined opcodes (=> \#UD), and such. */
461	int rc = DISInstrWithReader(GCPtrInstr, enmCpuMode, emReadBytes, pVCpu, pDis, pcbInstr);
462	if (RT_SUCCESS(rc))
463	return VINF_SUCCESS;
464	AssertMsg(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT, ("DISCoreOne failed to GCPtrInstr=%RGv rc=%Rrc\n", GCPtrInstr, rc));
465	return rc;
466	}
467
468
469	#if defined(VBOX_COMPARE_IEM_FIRST) \|\| defined(VBOX_COMPARE_IEM_LAST)
470	static void emCompareWithIem(PVMCPU pVCpu, PCCPUMCTX pEmCtx, PCCPUMCTX pIemCtx,
471	VBOXSTRICTRC rcEm, VBOXSTRICTRC rcIem,
472	uint32_t cbEm, uint32_t cbIem)
473	{
474	/* Quick compare. */
475	if ( rcEm == rcIem
476	&& cbEm == cbIem
477	&& g_cbEmWrote == g_cbIemWrote
478	&& memcmp(g_abIemWrote, g_abEmWrote, g_cbIemWrote) == 0
479	&& memcmp(pIemCtx, pEmCtx, sizeof(*pIemCtx)) == 0
480	&& (g_fEmFFs & g_fInterestingFFs) == (g_fIemFFs & g_fInterestingFFs)
481	)
482	return;
483
484	/* Report exact differences. */
485	RTLogPrintf("! EM and IEM differs at %04x:%08RGv !\n", g_IncomingCtx.cs.Sel, g_IncomingCtx.rip);
486	if (rcEm != rcIem)
487	RTLogPrintf(" * rcIem=%Rrc rcEm=%Rrc\n", VBOXSTRICTRC_VAL(rcIem), VBOXSTRICTRC_VAL(rcEm));
488	else if (cbEm != cbIem)
489	RTLogPrintf(" * cbIem=%#x cbEm=%#x\n", cbIem, cbEm);
490
491	if (RT_SUCCESS(rcEm) && RT_SUCCESS(rcIem))
492	{
493	if (g_cbIemWrote != g_cbEmWrote)
494	RTLogPrintf("!! g_cbIemWrote=%#x g_cbEmWrote=%#x\n", g_cbIemWrote, g_cbEmWrote);
495	else if (memcmp(g_abIemWrote, g_abEmWrote, g_cbIemWrote))
496	{
497	RTLogPrintf("!! IemWrote %.*Rhxs\n", RT_MIN(RT_MAX(1, g_cbIemWrote), 64), g_abIemWrote);
498	RTLogPrintf("!! EemWrote %.*Rhxs\n", RT_MIN(RT_MAX(1, g_cbIemWrote), 64), g_abIemWrote);
499	}
500
501	if ((g_fEmFFs & g_fInterestingFFs) != (g_fIemFFs & g_fInterestingFFs))
502	RTLogPrintf("!! g_fIemFFs=%#x g_fEmFFs=%#x (diff=%#x)\n", g_fIemFFs & g_fInterestingFFs,
503	g_fEmFFs & g_fInterestingFFs, (g_fIemFFs ^ g_fEmFFs) & g_fInterestingFFs);
504
505	# define CHECK_FIELD(a_Field) \
506	do \
507	{ \
508	if (pEmCtx->a_Field != pIemCtx->a_Field) \
509	{ \
510	switch (sizeof(pEmCtx->a_Field)) \
511	{ \
512	case 1: RTLogPrintf("!! %8s differs - iem=%02x - em=%02x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
513	case 2: RTLogPrintf("!! %8s differs - iem=%04x - em=%04x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
514	case 4: RTLogPrintf("!! %8s differs - iem=%08x - em=%08x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
515	case 8: RTLogPrintf("!! %8s differs - iem=%016llx - em=%016llx\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); break; \
516	default: RTLogPrintf("!! %8s differs\n", #a_Field); break; \
517	} \
518	cDiffs++; \
519	} \
520	} while (0)
521
522	# define CHECK_BIT_FIELD(a_Field) \
523	do \
524	{ \
525	if (pEmCtx->a_Field != pIemCtx->a_Field) \
526	{ \
527	RTLogPrintf("!! %8s differs - iem=%02x - em=%02x\n", #a_Field, pIemCtx->a_Field, pEmCtx->a_Field); \
528	cDiffs++; \
529	} \
530	} while (0)
531
532	# define CHECK_SEL(a_Sel) \
533	do \
534	{ \
535	CHECK_FIELD(a_Sel.Sel); \
536	CHECK_FIELD(a_Sel.Attr.u); \
537	CHECK_FIELD(a_Sel.u64Base); \
538	CHECK_FIELD(a_Sel.u32Limit); \
539	CHECK_FIELD(a_Sel.fFlags); \
540	} while (0)
541
542	unsigned cDiffs = 0;
543	if (memcmp(&pEmCtx->fpu, &pIemCtx->fpu, sizeof(pIemCtx->fpu)))
544	{
545	RTLogPrintf(" the FPU state differs\n");
546	cDiffs++;
547	CHECK_FIELD(fpu.FCW);
548	CHECK_FIELD(fpu.FSW);
549	CHECK_FIELD(fpu.FTW);
550	CHECK_FIELD(fpu.FOP);
551	CHECK_FIELD(fpu.FPUIP);
552	CHECK_FIELD(fpu.CS);
553	CHECK_FIELD(fpu.Rsrvd1);
554	CHECK_FIELD(fpu.FPUDP);
555	CHECK_FIELD(fpu.DS);
556	CHECK_FIELD(fpu.Rsrvd2);
557	CHECK_FIELD(fpu.MXCSR);
558	CHECK_FIELD(fpu.MXCSR_MASK);
559	CHECK_FIELD(fpu.aRegs[0].au64[0]); CHECK_FIELD(fpu.aRegs[0].au64[1]);
560	CHECK_FIELD(fpu.aRegs[1].au64[0]); CHECK_FIELD(fpu.aRegs[1].au64[1]);
561	CHECK_FIELD(fpu.aRegs[2].au64[0]); CHECK_FIELD(fpu.aRegs[2].au64[1]);
562	CHECK_FIELD(fpu.aRegs[3].au64[0]); CHECK_FIELD(fpu.aRegs[3].au64[1]);
563	CHECK_FIELD(fpu.aRegs[4].au64[0]); CHECK_FIELD(fpu.aRegs[4].au64[1]);
564	CHECK_FIELD(fpu.aRegs[5].au64[0]); CHECK_FIELD(fpu.aRegs[5].au64[1]);
565	CHECK_FIELD(fpu.aRegs[6].au64[0]); CHECK_FIELD(fpu.aRegs[6].au64[1]);
566	CHECK_FIELD(fpu.aRegs[7].au64[0]); CHECK_FIELD(fpu.aRegs[7].au64[1]);
567	CHECK_FIELD(fpu.aXMM[ 0].au64[0]); CHECK_FIELD(fpu.aXMM[ 0].au64[1]);
568	CHECK_FIELD(fpu.aXMM[ 1].au64[0]); CHECK_FIELD(fpu.aXMM[ 1].au64[1]);
569	CHECK_FIELD(fpu.aXMM[ 2].au64[0]); CHECK_FIELD(fpu.aXMM[ 2].au64[1]);
570	CHECK_FIELD(fpu.aXMM[ 3].au64[0]); CHECK_FIELD(fpu.aXMM[ 3].au64[1]);
571	CHECK_FIELD(fpu.aXMM[ 4].au64[0]); CHECK_FIELD(fpu.aXMM[ 4].au64[1]);
572	CHECK_FIELD(fpu.aXMM[ 5].au64[0]); CHECK_FIELD(fpu.aXMM[ 5].au64[1]);
573	CHECK_FIELD(fpu.aXMM[ 6].au64[0]); CHECK_FIELD(fpu.aXMM[ 6].au64[1]);
574	CHECK_FIELD(fpu.aXMM[ 7].au64[0]); CHECK_FIELD(fpu.aXMM[ 7].au64[1]);
575	CHECK_FIELD(fpu.aXMM[ 8].au64[0]); CHECK_FIELD(fpu.aXMM[ 8].au64[1]);
576	CHECK_FIELD(fpu.aXMM[ 9].au64[0]); CHECK_FIELD(fpu.aXMM[ 9].au64[1]);
577	CHECK_FIELD(fpu.aXMM[10].au64[0]); CHECK_FIELD(fpu.aXMM[10].au64[1]);
578	CHECK_FIELD(fpu.aXMM[11].au64[0]); CHECK_FIELD(fpu.aXMM[11].au64[1]);
579	CHECK_FIELD(fpu.aXMM[12].au64[0]); CHECK_FIELD(fpu.aXMM[12].au64[1]);
580	CHECK_FIELD(fpu.aXMM[13].au64[0]); CHECK_FIELD(fpu.aXMM[13].au64[1]);
581	CHECK_FIELD(fpu.aXMM[14].au64[0]); CHECK_FIELD(fpu.aXMM[14].au64[1]);
582	CHECK_FIELD(fpu.aXMM[15].au64[0]); CHECK_FIELD(fpu.aXMM[15].au64[1]);
583	for (unsigned i = 0; i < RT_ELEMENTS(pEmCtx->fpu.au32RsrvdRest); i++)
584	CHECK_FIELD(fpu.au32RsrvdRest[i]);
585	}
586	CHECK_FIELD(rip);
587	if (pEmCtx->rflags.u != pIemCtx->rflags.u)
588	{
589	RTLogPrintf("!! rflags differs - iem=%08llx em=%08llx\n", pIemCtx->rflags.u, pEmCtx->rflags.u);
590	CHECK_BIT_FIELD(rflags.Bits.u1CF);
591	CHECK_BIT_FIELD(rflags.Bits.u1Reserved0);
592	CHECK_BIT_FIELD(rflags.Bits.u1PF);
593	CHECK_BIT_FIELD(rflags.Bits.u1Reserved1);
594	CHECK_BIT_FIELD(rflags.Bits.u1AF);
595	CHECK_BIT_FIELD(rflags.Bits.u1Reserved2);
596	CHECK_BIT_FIELD(rflags.Bits.u1ZF);
597	CHECK_BIT_FIELD(rflags.Bits.u1SF);
598	CHECK_BIT_FIELD(rflags.Bits.u1TF);
599	CHECK_BIT_FIELD(rflags.Bits.u1IF);
600	CHECK_BIT_FIELD(rflags.Bits.u1DF);
601	CHECK_BIT_FIELD(rflags.Bits.u1OF);
602	CHECK_BIT_FIELD(rflags.Bits.u2IOPL);
603	CHECK_BIT_FIELD(rflags.Bits.u1NT);
604	CHECK_BIT_FIELD(rflags.Bits.u1Reserved3);
605	CHECK_BIT_FIELD(rflags.Bits.u1RF);
606	CHECK_BIT_FIELD(rflags.Bits.u1VM);
607	CHECK_BIT_FIELD(rflags.Bits.u1AC);
608	CHECK_BIT_FIELD(rflags.Bits.u1VIF);
609	CHECK_BIT_FIELD(rflags.Bits.u1VIP);
610	CHECK_BIT_FIELD(rflags.Bits.u1ID);
611	}
612
613	if (!g_fIgnoreRaxRdx)
614	CHECK_FIELD(rax);
615	CHECK_FIELD(rcx);
616	if (!g_fIgnoreRaxRdx)
617	CHECK_FIELD(rdx);
618	CHECK_FIELD(rbx);
619	CHECK_FIELD(rsp);
620	CHECK_FIELD(rbp);
621	CHECK_FIELD(rsi);
622	CHECK_FIELD(rdi);
623	CHECK_FIELD(r8);
624	CHECK_FIELD(r9);
625	CHECK_FIELD(r10);
626	CHECK_FIELD(r11);
627	CHECK_FIELD(r12);
628	CHECK_FIELD(r13);
629	CHECK_SEL(cs);
630	CHECK_SEL(ss);
631	CHECK_SEL(ds);
632	CHECK_SEL(es);
633	CHECK_SEL(fs);
634	CHECK_SEL(gs);
635	CHECK_FIELD(cr0);
636	CHECK_FIELD(cr2);
637	CHECK_FIELD(cr3);
638	CHECK_FIELD(cr4);
639	CHECK_FIELD(dr[0]);
640	CHECK_FIELD(dr[1]);
641	CHECK_FIELD(dr[2]);
642	CHECK_FIELD(dr[3]);
643	CHECK_FIELD(dr[6]);
644	CHECK_FIELD(dr[7]);
645	CHECK_FIELD(gdtr.cbGdt);
646	CHECK_FIELD(gdtr.pGdt);
647	CHECK_FIELD(idtr.cbIdt);
648	CHECK_FIELD(idtr.pIdt);
649	CHECK_SEL(ldtr);
650	CHECK_SEL(tr);
651	CHECK_FIELD(SysEnter.cs);
652	CHECK_FIELD(SysEnter.eip);
653	CHECK_FIELD(SysEnter.esp);
654	CHECK_FIELD(msrEFER);
655	CHECK_FIELD(msrSTAR);
656	CHECK_FIELD(msrPAT);
657	CHECK_FIELD(msrLSTAR);
658	CHECK_FIELD(msrCSTAR);
659	CHECK_FIELD(msrSFMASK);
660	CHECK_FIELD(msrKERNELGSBASE);
661
662	# undef CHECK_FIELD
663	# undef CHECK_BIT_FIELD
664	}
665	}
666	#endif /* VBOX_COMPARE_IEM_AND_EM */
667
668
669	/**
670	* Interprets the current instruction.
671	*
672	* @returns VBox status code.
673	* @retval VINF_* Scheduling instructions.
674	* @retval VERR_EM_INTERPRETER Something we can't cope with.
675	* @retval VERR_* Fatal errors.
676	*
677	* @param pVCpu Pointer to the VMCPU.
678	* @param pRegFrame The register frame.
679	* Updates the EIP if an instruction was executed successfully.
680	* @param pvFault The fault address (CR2).
681	* @param pcbSize Size of the write (if applicable).
682	*
683	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
684	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
685	* to worry about e.g. invalid modrm combinations (!)
686	*/
687	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstruction(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
688	{
689	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
690	LogFlow(("EMInterpretInstruction %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
691	#ifdef VBOX_WITH_IEM
692	NOREF(pvFault);
693
694	# ifdef VBOX_COMPARE_IEM_AND_EM
695	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
696	g_IncomingCtx = *pCtx;
697	g_fIncomingFFs = pVCpu->fLocalForcedActions;
698	g_cbEmWrote = g_cbIemWrote = 0;
699
700	# ifdef VBOX_COMPARE_IEM_FIRST
701	/* IEM */
702	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
703	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
704	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
705	rcIem = VERR_EM_INTERPRETER;
706	g_IemCtx = *pCtx;
707	g_fIemFFs = pVCpu->fLocalForcedActions;
708	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
709	*pCtx = g_IncomingCtx;
710	# endif
711
712	/* EM */
713	RTGCPTR pbCode;
714	VBOXSTRICTRC rcEm = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
715	if (RT_SUCCESS(rcEm))
716	{
717	uint32_t cbOp;
718	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
719	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
720	rcEm = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
721	if (RT_SUCCESS(rcEm))
722	{
723	Assert(cbOp == pDis->cbInstr);
724	uint32_t cbIgnored;
725	rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
726	if (RT_SUCCESS(rcEm))
727	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
728
729	}
730	rcEm = VERR_EM_INTERPRETER;
731	}
732	else
733	rcEm = VERR_EM_INTERPRETER;
734	# ifdef VBOX_SAME_AS_EM
735	if (rcEm == VERR_EM_INTERPRETER)
736	{
737	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
738	return rcEm;
739	}
740	# endif
741	g_EmCtx = *pCtx;
742	g_fEmFFs = pVCpu->fLocalForcedActions;
743	VBOXSTRICTRC rc = rcEm;
744
745	# ifdef VBOX_COMPARE_IEM_LAST
746	/* IEM */
747	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
748	*pCtx = g_IncomingCtx;
749	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
750	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
751	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
752	rcIem = VERR_EM_INTERPRETER;
753	g_IemCtx = *pCtx;
754	g_fIemFFs = pVCpu->fLocalForcedActions;
755	rc = rcIem;
756	# endif
757
758	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
759	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, 0, 0);
760	# endif
761
762	# else
763	VBOXSTRICTRC rc = IEMExecOneBypassEx(pVCpu, pRegFrame, NULL);
764	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
765	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
766	rc = VERR_EM_INTERPRETER;
767	# endif
768	if (rc != VINF_SUCCESS)
769	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
770
771	return rc;
772	#else
773	RTGCPTR pbCode;
774	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
775	if (RT_SUCCESS(rc))
776	{
777	uint32_t cbOp;
778	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
779	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
780	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
781	if (RT_SUCCESS(rc))
782	{
783	Assert(cbOp == pDis->cbInstr);
784	uint32_t cbIgnored;
785	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbIgnored);
786	if (RT_SUCCESS(rc))
787	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
788
789	return rc;
790	}
791	}
792	return VERR_EM_INTERPRETER;
793	#endif
794	}
795
796
797	/**
798	* Interprets the current instruction.
799	*
800	* @returns VBox status code.
801	* @retval VINF_* Scheduling instructions.
802	* @retval VERR_EM_INTERPRETER Something we can't cope with.
803	* @retval VERR_* Fatal errors.
804	*
805	* @param pVM Pointer to the VM.
806	* @param pVCpu Pointer to the VMCPU.
807	* @param pRegFrame The register frame.
808	* Updates the EIP if an instruction was executed successfully.
809	* @param pvFault The fault address (CR2).
810	* @param pcbWritten Size of the write (if applicable).
811	*
812	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
813	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
814	* to worry about e.g. invalid modrm combinations (!)
815	*/
816	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstructionEx(PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbWritten)
817	{
818	LogFlow(("EMInterpretInstructionEx %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
819	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
820	#ifdef VBOX_WITH_IEM
821	NOREF(pvFault);
822
823	# ifdef VBOX_COMPARE_IEM_AND_EM
824	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
825	g_IncomingCtx = *pCtx;
826	g_fIncomingFFs = pVCpu->fLocalForcedActions;
827	g_cbEmWrote = g_cbIemWrote = 0;
828
829	# ifdef VBOX_COMPARE_IEM_FIRST
830	/* IEM */
831	uint32_t cbIemWritten = 0;
832	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, &cbIemWritten);
833	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
834	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
835	rcIem = VERR_EM_INTERPRETER;
836	g_IemCtx = *pCtx;
837	g_fIemFFs = pVCpu->fLocalForcedActions;
838	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
839	*pCtx = g_IncomingCtx;
840	# endif
841
842	/* EM */
843	uint32_t cbEmWritten = 0;
844	RTGCPTR pbCode;
845	VBOXSTRICTRC rcEm = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
846	if (RT_SUCCESS(rcEm))
847	{
848	uint32_t cbOp;
849	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
850	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
851	rcEm = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
852	if (RT_SUCCESS(rcEm))
853	{
854	Assert(cbOp == pDis->cbInstr);
855	rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, &cbEmWritten);
856	if (RT_SUCCESS(rcEm))
857	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
858
859	}
860	else
861	rcEm = VERR_EM_INTERPRETER;
862	}
863	else
864	rcEm = VERR_EM_INTERPRETER;
865	# ifdef VBOX_SAME_AS_EM
866	if (rcEm == VERR_EM_INTERPRETER)
867	{
868	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
869	return rcEm;
870	}
871	# endif
872	g_EmCtx = *pCtx;
873	g_fEmFFs = pVCpu->fLocalForcedActions;
874	*pcbWritten = cbEmWritten;
875	VBOXSTRICTRC rc = rcEm;
876
877	# ifdef VBOX_COMPARE_IEM_LAST
878	/* IEM */
879	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
880	*pCtx = g_IncomingCtx;
881	uint32_t cbIemWritten = 0;
882	VBOXSTRICTRC rcIem = IEMExecOneBypassEx(pVCpu, pRegFrame, &cbIemWritten);
883	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
884	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
885	rcIem = VERR_EM_INTERPRETER;
886	g_IemCtx = *pCtx;
887	g_fIemFFs = pVCpu->fLocalForcedActions;
888	*pcbWritten = cbIemWritten;
889	rc = rcIem;
890	# endif
891
892	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
893	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, cbEmWritten, cbIemWritten);
894	# endif
895
896	# else
897	VBOXSTRICTRC rc = IEMExecOneBypassEx(pVCpu, pRegFrame, pcbWritten);
898	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
899	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
900	rc = VERR_EM_INTERPRETER;
901	# endif
902	if (rc != VINF_SUCCESS)
903	Log(("EMInterpretInstructionEx: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
904
905	return rc;
906	#else
907	RTGCPTR pbCode;
908	VBOXSTRICTRC rc = SELMToFlatEx(pVCpu, DISSELREG_CS, pRegFrame, pRegFrame->rip, 0, &pbCode);
909	if (RT_SUCCESS(rc))
910	{
911	uint32_t cbOp;
912	PDISCPUSTATE pDis = &pVCpu->em.s.DisState;
913	pDis->uCpuMode = CPUMGetGuestDisMode(pVCpu);
914	rc = emDisCoreOne(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, (RTGCUINTPTR)pbCode, &cbOp);
915	if (RT_SUCCESS(rc))
916	{
917	Assert(cbOp == pDis->cbInstr);
918	rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, EMCODETYPE_SUPERVISOR, pcbWritten);
919	if (RT_SUCCESS(rc))
920	pRegFrame->rip += cbOp; /* Move on to the next instruction. */
921
922	return rc;
923	}
924	}
925	return VERR_EM_INTERPRETER;
926	#endif
927	}
928
929
930	/**
931	* Interprets the current instruction using the supplied DISCPUSTATE structure.
932	*
933	* IP/EIP/RIP IS updated!
934	*
935	* @returns VBox strict status code.
936	* @retval VINF_* Scheduling instructions. When these are returned, it
937	* starts to get a bit tricky to know whether code was
938	* executed or not... We'll address this when it becomes a problem.
939	* @retval VERR_EM_INTERPRETER Something we can't cope with.
940	* @retval VERR_* Fatal errors.
941	*
942	* @param pVM Pointer to the VM.
943	* @param pVCpu Pointer to the VMCPU.
944	* @param pDis The disassembler cpu state for the instruction to be
945	* interpreted.
946	* @param pRegFrame The register frame. IP/EIP/RIP IS changed!
947	* @param pvFault The fault address (CR2).
948	* @param pcbSize Size of the write (if applicable).
949	* @param enmCodeType Code type (user/supervisor)
950	*
951	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
952	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
953	* to worry about e.g. invalid modrm combinations (!)
954	*
955	* @todo At this time we do NOT check if the instruction overwrites vital information.
956	* Make sure this can't happen!! (will add some assertions/checks later)
957	*/
958	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInstructionDisasState(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
959	RTGCPTR pvFault, EMCODETYPE enmCodeType)
960	{
961	LogFlow(("EMInterpretInstructionDisasState %RGv fault %RGv\n", (RTGCPTR)pRegFrame->rip, pvFault));
962	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
963	#ifdef VBOX_WITH_IEM
964	NOREF(pDis); NOREF(pvFault); NOREF(enmCodeType);
965
966	# ifdef VBOX_COMPARE_IEM_AND_EM
967	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
968	g_IncomingCtx = *pCtx;
969	g_fIncomingFFs = pVCpu->fLocalForcedActions;
970	g_cbEmWrote = g_cbIemWrote = 0;
971
972	# ifdef VBOX_COMPARE_IEM_FIRST
973	VBOXSTRICTRC rcIem = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
974	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
975	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
976	rcIem = VERR_EM_INTERPRETER;
977	g_IemCtx = *pCtx;
978	g_fIemFFs = pVCpu->fLocalForcedActions;
979	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
980	*pCtx = g_IncomingCtx;
981	# endif
982
983	/* EM */
984	uint32_t cbIgnored;
985	VBOXSTRICTRC rcEm = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
986	if (RT_SUCCESS(rcEm))
987	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
988	# ifdef VBOX_SAME_AS_EM
989	if (rcEm == VERR_EM_INTERPRETER)
990	{
991	Log(("EMInterpretInstruction: returns %Rrc\n", VBOXSTRICTRC_VAL(rcEm)));
992	return rcEm;
993	}
994	# endif
995	g_EmCtx = *pCtx;
996	g_fEmFFs = pVCpu->fLocalForcedActions;
997	VBOXSTRICTRC rc = rcEm;
998
999	# ifdef VBOX_COMPARE_IEM_LAST
1000	/* IEM */
1001	pVCpu->fLocalForcedActions = (pVCpu->fLocalForcedActions & ~g_fInterestingFFs) \| (g_fIncomingFFs & g_fInterestingFFs);
1002	*pCtx = g_IncomingCtx;
1003	VBOXSTRICTRC rcIem = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
1004	if (RT_UNLIKELY( rcIem == VERR_IEM_ASPECT_NOT_IMPLEMENTED
1005	\|\| rcIem == VERR_IEM_INSTR_NOT_IMPLEMENTED))
1006	rcIem = VERR_EM_INTERPRETER;
1007	g_IemCtx = *pCtx;
1008	g_fIemFFs = pVCpu->fLocalForcedActions;
1009	rc = rcIem;
1010	# endif
1011
1012	# if defined(VBOX_COMPARE_IEM_LAST) \|\| defined(VBOX_COMPARE_IEM_FIRST)
1013	emCompareWithIem(pVCpu, &g_EmCtx, &g_IemCtx, rcEm, rcIem, 0, 0);
1014	# endif
1015
1016	# else
1017	VBOXSTRICTRC rc = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pRegFrame, pRegFrame->rip, pDis->abInstr, pDis->cbCachedInstr);
1018	if (RT_UNLIKELY( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
1019	\|\| rc == VERR_IEM_INSTR_NOT_IMPLEMENTED))
1020	rc = VERR_EM_INTERPRETER;
1021	# endif
1022
1023	if (rc != VINF_SUCCESS)
1024	Log(("EMInterpretInstructionDisasState: returns %Rrc\n", VBOXSTRICTRC_VAL(rc)));
1025
1026	return rc;
1027	#else
1028	uint32_t cbIgnored;
1029	VBOXSTRICTRC rc = emInterpretInstructionCPUOuter(pVCpu, pDis, pRegFrame, pvFault, enmCodeType, &cbIgnored);
1030	if (RT_SUCCESS(rc))
1031	pRegFrame->rip += pDis->cbInstr; /* Move on to the next instruction. */
1032	return rc;
1033	#endif
1034	}
1035
1036	#ifdef IN_RC
1037
1038	DECLINLINE(int) emRCStackRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
1039	{
1040	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
1041	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
1042	return rc;
1043	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
1044	}
1045
1046
1047	/**
1048	* Interpret IRET (currently only to V86 code) - PATM only.
1049	*
1050	* @returns VBox status code.
1051	* @param pVM Pointer to the VM.
1052	* @param pVCpu Pointer to the VMCPU.
1053	* @param pRegFrame The register frame.
1054	*
1055	*/
1056	VMM_INT_DECL(int) EMInterpretIretV86ForPatm(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1057	{
1058	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1059	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1060	int rc;
1061
1062	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1063	Assert(!CPUMIsGuestIn64BitCode(pVCpu));
1064	/** @todo Rainy day: Test what happens when VERR_EM_INTERPRETER is returned by
1065	* this function. Fear that it may guru on us, thus not converted to
1066	* IEM. */
1067
1068	rc = emRCStackRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1069	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1070	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1071	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1072	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1073
1074	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1075	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1076	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &es, (RTGCPTR)(pIretStack + 20), 4);
1077	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ds, (RTGCPTR)(pIretStack + 24), 4);
1078	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &fs, (RTGCPTR)(pIretStack + 28), 4);
1079	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &gs, (RTGCPTR)(pIretStack + 32), 4);
1080	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1081
1082	pRegFrame->eip = eip & 0xffff;
1083	pRegFrame->cs.Sel = cs;
1084
1085	/* Mask away all reserved bits */
1086	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1087	eflags &= uMask;
1088
1089	CPUMRawSetEFlags(pVCpu, eflags);
1090	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1091
1092	pRegFrame->esp = esp;
1093	pRegFrame->ss.Sel = ss;
1094	pRegFrame->ds.Sel = ds;
1095	pRegFrame->es.Sel = es;
1096	pRegFrame->fs.Sel = fs;
1097	pRegFrame->gs.Sel = gs;
1098
1099	return VINF_SUCCESS;
1100	}
1101
1102	/**
1103	* IRET Emulation.
1104	*/
1105	static int emInterpretIret(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1106	{
1107	#ifdef VBOX_WITH_RAW_RING1
1108	NOREF(pvFault); NOREF(pcbSize);
1109	if (EMIsRawRing1Enabled(pVM))
1110	{
1111	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1112	RTGCUINTPTR eip, cs, esp, ss, eflags, uMask;
1113	int rc;
1114	uint32_t cpl, rpl;
1115
1116	/* We only execute 32-bits protected mode code in raw mode, so no need to bother to check for 16-bits code here. */
1117	/* @todo: we don't verify all the edge cases that generate #GP faults */
1118
1119	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1120	Assert(!CPUMIsGuestIn64BitCode(pVCpu));
1121	/** @todo Rainy day: Test what happens when VERR_EM_INTERPRETER is returned by
1122	* this function. Fear that it may guru on us, thus not converted to
1123	* IEM. */
1124
1125	rc = emRCStackRead(pVM, pVCpu, pRegFrame, &eip, (RTGCPTR)pIretStack , 4);
1126	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &cs, (RTGCPTR)(pIretStack + 4), 4);
1127	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1128	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1129	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1130
1131	/* Deal with V86 above. */
1132	if (eflags & X86_EFL_VM)
1133	return EMInterpretIretV86ForPatm(pVM, pVCpu, pRegFrame);
1134
1135	cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
1136	rpl = cs & X86_SEL_RPL;
1137
1138	Log(("emInterpretIret: iret to CS:EIP=%04X:%08X eflags=%x\n", cs, eip, eflags));
1139	if (rpl != cpl)
1140	{
1141	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &esp, (RTGCPTR)(pIretStack + 12), 4);
1142	rc \|= emRCStackRead(pVM, pVCpu, pRegFrame, &ss, (RTGCPTR)(pIretStack + 16), 4);
1143	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1144	Log(("emInterpretIret: return to different privilege level (rpl=%d cpl=%d)\n", rpl, cpl));
1145	Log(("emInterpretIret: SS:ESP=%04X:08X\n", ss, esp));
1146	pRegFrame->ss.Sel = ss;
1147	pRegFrame->esp = esp;
1148	}
1149	pRegFrame->cs.Sel = cs;
1150	pRegFrame->eip = eip;
1151
1152	/* Adjust CS & SS as required. */
1153	CPUMRCRecheckRawState(pVCpu, pRegFrame);
1154
1155	/* Mask away all reserved bits */
1156	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1157	eflags &= uMask;
1158
1159	CPUMRawSetEFlags(pVCpu, eflags);
1160	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1161	return VINF_SUCCESS;
1162	}
1163	#else
1164	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
1165	#endif
1166	return VERR_EM_INTERPRETER;
1167	}
1168
1169	#endif /* IN_RC */
1170
1171
1172
1173	/*
1174	*
1175	* Old interpreter primitives used by HM, move/eliminate later.
1176	* Old interpreter primitives used by HM, move/eliminate later.
1177	* Old interpreter primitives used by HM, move/eliminate later.
1178	* Old interpreter primitives used by HM, move/eliminate later.
1179	* Old interpreter primitives used by HM, move/eliminate later.
1180	*
1181	*/
1182
1183
1184	/**
1185	* Interpret CPUID given the parameters in the CPU context.
1186	*
1187	* @returns VBox status code.
1188	* @param pVM Pointer to the VM.
1189	* @param pVCpu Pointer to the VMCPU.
1190	* @param pRegFrame The register frame.
1191	*
1192	*/
1193	VMM_INT_DECL(int) EMInterpretCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1194	{
1195	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1196	uint32_t iLeaf = pRegFrame->eax;
1197	NOREF(pVM);
1198
1199	/* cpuid clears the high dwords of the affected 64 bits registers. */
1200	pRegFrame->rax = 0;
1201	pRegFrame->rbx = 0;
1202	pRegFrame->rcx &= UINT64_C(0x00000000ffffffff);
1203	pRegFrame->rdx = 0;
1204
1205	/* Note: operates the same in 64 and non-64 bits mode. */
1206	CPUMGetGuestCpuId(pVCpu, iLeaf, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1207	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1208	return VINF_SUCCESS;
1209	}
1210
1211
1212	/**
1213	* Interpret RDTSC.
1214	*
1215	* @returns VBox status code.
1216	* @param pVM Pointer to the VM.
1217	* @param pVCpu Pointer to the VMCPU.
1218	* @param pRegFrame The register frame.
1219	*
1220	*/
1221	VMM_INT_DECL(int) EMInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1222	{
1223	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1224	unsigned uCR4 = CPUMGetGuestCR4(pVCpu);
1225
1226	if (uCR4 & X86_CR4_TSD)
1227	return VERR_EM_INTERPRETER; /* genuine #GP */
1228
1229	uint64_t uTicks = TMCpuTickGet(pVCpu);
1230
1231	/* Same behaviour in 32 & 64 bits mode */
1232	pRegFrame->rax = (uint32_t)uTicks;
1233	pRegFrame->rdx = (uTicks >> 32ULL);
1234	#ifdef VBOX_COMPARE_IEM_AND_EM
1235	g_fIgnoreRaxRdx = true;
1236	#endif
1237
1238	NOREF(pVM);
1239	return VINF_SUCCESS;
1240	}
1241
1242	/**
1243	* Interpret RDTSCP.
1244	*
1245	* @returns VBox status code.
1246	* @param pVM Pointer to the VM.
1247	* @param pVCpu Pointer to the VMCPU.
1248	* @param pCtx The CPU context.
1249	*
1250	*/
1251	VMM_INT_DECL(int) EMInterpretRdtscp(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1252	{
1253	Assert(pCtx == CPUMQueryGuestCtxPtr(pVCpu));
1254	uint32_t uCR4 = CPUMGetGuestCR4(pVCpu);
1255
1256	if (!CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
1257	{
1258	AssertFailed();
1259	return VERR_EM_INTERPRETER; /* genuine #UD */
1260	}
1261
1262	if (uCR4 & X86_CR4_TSD)
1263	return VERR_EM_INTERPRETER; /* genuine #GP */
1264
1265	uint64_t uTicks = TMCpuTickGet(pVCpu);
1266
1267	/* Same behaviour in 32 & 64 bits mode */
1268	pCtx->rax = (uint32_t)uTicks;
1269	pCtx->rdx = (uTicks >> 32ULL);
1270	#ifdef VBOX_COMPARE_IEM_AND_EM
1271	g_fIgnoreRaxRdx = true;
1272	#endif
1273	/* Low dword of the TSC_AUX msr only. */
1274	CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
1275	pCtx->rcx &= UINT32_C(0xffffffff);
1276
1277	return VINF_SUCCESS;
1278	}
1279
1280	/**
1281	* Interpret RDPMC.
1282	*
1283	* @returns VBox status code.
1284	* @param pVM Pointer to the VM.
1285	* @param pVCpu Pointer to the VMCPU.
1286	* @param pRegFrame The register frame.
1287	*
1288	*/
1289	VMM_INT_DECL(int) EMInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1290	{
1291	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1292	uint32_t uCR4 = CPUMGetGuestCR4(pVCpu);
1293
1294	/* If X86_CR4_PCE is not set, then CPL must be zero. */
1295	if ( !(uCR4 & X86_CR4_PCE)
1296	&& CPUMGetGuestCPL(pVCpu) != 0)
1297	{
1298	Assert(CPUMGetGuestCR0(pVCpu) & X86_CR0_PE);
1299	return VERR_EM_INTERPRETER; /* genuine #GP */
1300	}
1301
1302	/* Just return zero here; rather tricky to properly emulate this, especially as the specs are a mess. */
1303	pRegFrame->rax = 0;
1304	pRegFrame->rdx = 0;
1305	/** @todo We should trigger a #GP here if the CPU doesn't support the index in ecx
1306	* but see @bugref{3472}! */
1307
1308	NOREF(pVM);
1309	return VINF_SUCCESS;
1310	}
1311
1312
1313	/**
1314	* MWAIT Emulation.
1315	*/
1316	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretMWait(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1317	{
1318	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1319	uint32_t u32Dummy, u32ExtFeatures, cpl, u32MWaitFeatures;
1320	NOREF(pVM);
1321
1322	/* Get the current privilege level. */
1323	cpl = CPUMGetGuestCPL(pVCpu);
1324	if (cpl != 0)
1325	return VERR_EM_INTERPRETER; /* supervisor only */
1326
1327	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1328	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1329	return VERR_EM_INTERPRETER; /* not supported */
1330
1331	/*
1332	* CPUID.05H.ECX[0] defines support for power management extensions (eax)
1333	* CPUID.05H.ECX[1] defines support for interrupts as break events for mwait even when IF=0
1334	*/
1335	CPUMGetGuestCpuId(pVCpu, 5, &u32Dummy, &u32Dummy, &u32MWaitFeatures, &u32Dummy);
1336	if (pRegFrame->ecx > 1)
1337	{
1338	Log(("EMInterpretMWait: unexpected ecx value %x -> recompiler\n", pRegFrame->ecx));
1339	return VERR_EM_INTERPRETER; /* illegal value. */
1340	}
1341
1342	if (pRegFrame->ecx && !(u32MWaitFeatures & X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
1343	{
1344	Log(("EMInterpretMWait: unsupported X86_CPUID_MWAIT_ECX_BREAKIRQIF0 -> recompiler\n"));
1345	return VERR_EM_INTERPRETER; /* illegal value. */
1346	}
1347
1348	return EMMonitorWaitPerform(pVCpu, pRegFrame->rax, pRegFrame->rcx);
1349	}
1350
1351
1352	/**
1353	* MONITOR Emulation.
1354	*/
1355	VMM_INT_DECL(int) EMInterpretMonitor(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1356	{
1357	uint32_t u32Dummy, u32ExtFeatures, cpl;
1358	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1359	NOREF(pVM);
1360
1361	if (pRegFrame->ecx != 0)
1362	{
1363	Log(("emInterpretMonitor: unexpected ecx=%x -> recompiler!!\n", pRegFrame->ecx));
1364	return VERR_EM_INTERPRETER; /* illegal value. */
1365	}
1366
1367	/* Get the current privilege level. */
1368	cpl = CPUMGetGuestCPL(pVCpu);
1369	if (cpl != 0)
1370	return VERR_EM_INTERPRETER; /* supervisor only */
1371
1372	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
1373	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
1374	return VERR_EM_INTERPRETER; /* not supported */
1375
1376	EMMonitorWaitPrepare(pVCpu, pRegFrame->rax, pRegFrame->rcx, pRegFrame->rdx, NIL_RTGCPHYS);
1377	return VINF_SUCCESS;
1378	}
1379
1380
1381	/* VT-x only: */
1382
1383	/**
1384	* Interpret INVLPG.
1385	*
1386	* @returns VBox status code.
1387	* @param pVM Pointer to the VM.
1388	* @param pVCpu Pointer to the VMCPU.
1389	* @param pRegFrame The register frame.
1390	* @param pAddrGC Operand address.
1391	*
1392	*/
1393	VMM_INT_DECL(VBOXSTRICTRC) EMInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1394	{
1395	/** @todo is addr always a flat linear address or ds based
1396	* (in absence of segment override prefixes)????
1397	*/
1398	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1399	NOREF(pVM); NOREF(pRegFrame);
1400	#ifdef IN_RC
1401	LogFlow(("RC: EMULATE: invlpg %RGv\n", pAddrGC));
1402	#endif
1403	VBOXSTRICTRC rc = PGMInvalidatePage(pVCpu, pAddrGC);
1404	if ( rc == VINF_SUCCESS
1405	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
1406	return VINF_SUCCESS;
1407	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
1408	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), pAddrGC),
1409	VERR_EM_INTERPRETER);
1410	return rc;
1411	}
1412
1413
1414	/**
1415	* Update CRx.
1416	*
1417	* @returns VBox status code.
1418	* @param pVM Pointer to the VM.
1419	* @param pVCpu Pointer to the VMCPU.
1420	* @param pRegFrame The register frame.
1421	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
1422	* @param val New CRx value
1423	*
1424	*/
1425	static int emUpdateCRx(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint64_t val)
1426	{
1427	uint64_t oldval;
1428	uint64_t msrEFER;
1429	int rc, rc2;
1430	NOREF(pVM);
1431
1432	/** @todo Clean up this mess. */
1433	LogFlow(("EMInterpretCRxWrite at %RGv CR%d <- %RX64\n", (RTGCPTR)pRegFrame->rip, DestRegCrx, val));
1434	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1435	switch (DestRegCrx)
1436	{
1437	case DISCREG_CR0:
1438	oldval = CPUMGetGuestCR0(pVCpu);
1439	#ifdef IN_RC
1440	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
1441	if ( (val & (X86_CR0_WP \| X86_CR0_AM))
1442	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
1443	return VERR_EM_INTERPRETER;
1444	#endif
1445	rc = VINF_SUCCESS;
1446	#if !defined(VBOX_COMPARE_IEM_AND_EM) \|\| !defined(VBOX_COMPARE_IEM_LAST)
1447	CPUMSetGuestCR0(pVCpu, val);
1448	#else
1449	CPUMQueryGuestCtxPtr(pVCpu)->cr0 = val \| X86_CR0_ET;
1450	#endif
1451	val = CPUMGetGuestCR0(pVCpu);
1452	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
1453	!= (val & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
1454	{
1455	/* global flush */
1456	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
1457	AssertRCReturn(rc, rc);
1458	}
1459
1460	/* Deal with long mode enabling/disabling. */
1461	msrEFER = CPUMGetGuestEFER(pVCpu);
1462	if (msrEFER & MSR_K6_EFER_LME)
1463	{
1464	if ( !(oldval & X86_CR0_PG)
1465	&& (val & X86_CR0_PG))
1466	{
1467	/* Illegal to have an active 64 bits CS selector (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1468	if (pRegFrame->cs.Attr.n.u1Long)
1469	{
1470	AssertMsgFailed(("Illegal enabling of paging with CS.u1Long = 1!!\n"));
1471	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1472	}
1473
1474	/* Illegal to switch to long mode before activating PAE first (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1475	if (!(CPUMGetGuestCR4(pVCpu) & X86_CR4_PAE))
1476	{
1477	AssertMsgFailed(("Illegal enabling of paging with PAE disabled!!\n"));
1478	return VERR_EM_INTERPRETER; /* @todo generate #GP(0) */
1479	}
1480	msrEFER \|= MSR_K6_EFER_LMA;
1481	}
1482	else
1483	if ( (oldval & X86_CR0_PG)
1484	&& !(val & X86_CR0_PG))
1485	{
1486	msrEFER &= ~MSR_K6_EFER_LMA;
1487	/* @todo Do we need to cut off rip here? High dword of rip is undefined, so it shouldn't really matter. */
1488	}
1489	CPUMSetGuestEFER(pVCpu, msrEFER);
1490	}
1491	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
1492	return rc2 == VINF_SUCCESS ? rc : rc2;
1493
1494	case DISCREG_CR2:
1495	rc = CPUMSetGuestCR2(pVCpu, val); AssertRC(rc);
1496	return VINF_SUCCESS;
1497
1498	case DISCREG_CR3:
1499	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
1500	rc = CPUMSetGuestCR3(pVCpu, val); AssertRC(rc);
1501	if (CPUMGetGuestCR0(pVCpu) & X86_CR0_PG)
1502	{
1503	/* flush */
1504	rc = PGMFlushTLB(pVCpu, val, !(CPUMGetGuestCR4(pVCpu) & X86_CR4_PGE));
1505	AssertRC(rc);
1506	}
1507	return rc;
1508
1509	case DISCREG_CR4:
1510	oldval = CPUMGetGuestCR4(pVCpu);
1511	rc = CPUMSetGuestCR4(pVCpu, val); AssertRC(rc);
1512	val = CPUMGetGuestCR4(pVCpu);
1513
1514	/* Illegal to disable PAE when long mode is active. (AMD Arch. Programmer's Manual Volume 2: Table 14-5) */
1515	msrEFER = CPUMGetGuestEFER(pVCpu);
1516	if ( (msrEFER & MSR_K6_EFER_LMA)
1517	&& (oldval & X86_CR4_PAE)
1518	&& !(val & X86_CR4_PAE))
1519	{
1520	return VERR_EM_INTERPRETER; /** @todo generate #GP(0) */
1521	}
1522
1523	rc = VINF_SUCCESS;
1524	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
1525	!= (val & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
1526	{
1527	/* global flush */
1528	rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /* global */);
1529	AssertRCReturn(rc, rc);
1530	}
1531
1532	/* Feeling extremely lazy. */
1533	# ifdef IN_RC
1534	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
1535	!= (val & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
1536	{
1537	Log(("emInterpretMovCRx: CR4: %#RX64->%#RX64 => R3\n", oldval, val));
1538	VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
1539	}
1540	# endif
1541	# ifdef VBOX_WITH_RAW_MODE
1542	if (((val ^ oldval) & X86_CR4_VME) && !HMIsEnabled(pVM))
1543	VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
1544	# endif
1545
1546	rc2 = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
1547	return rc2 == VINF_SUCCESS ? rc : rc2;
1548
1549	case DISCREG_CR8:
1550	return PDMApicSetTPR(pVCpu, val << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
1551
1552	default:
1553	AssertFailed();
1554	case DISCREG_CR1: /* illegal op */
1555	break;
1556	}
1557	return VERR_EM_INTERPRETER;
1558	}
1559
1560
1561	/**
1562	* Interpret CRx write.
1563	*
1564	* @returns VBox status code.
1565	* @param pVM Pointer to the VM.
1566	* @param pVCpu Pointer to the VMCPU.
1567	* @param pRegFrame The register frame.
1568	* @param DestRegCRx CRx register index (DISUSE_REG_CR*)
1569	* @param SrcRegGen General purpose register index (USE_REG_E**))
1570	*
1571	*/
1572	VMM_INT_DECL(int) EMInterpretCRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
1573	{
1574	uint64_t val;
1575	int rc;
1576	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1577
1578	if (CPUMIsGuestIn64BitCode(pVCpu))
1579	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
1580	else
1581	{
1582	uint32_t val32;
1583	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1584	val = val32;
1585	}
1586
1587	if (RT_SUCCESS(rc))
1588	return emUpdateCRx(pVM, pVCpu, pRegFrame, DestRegCrx, val);
1589
1590	return VERR_EM_INTERPRETER;
1591	}
1592
1593	/**
1594	* Interpret LMSW.
1595	*
1596	* @returns VBox status code.
1597	* @param pVM Pointer to the VM.
1598	* @param pVCpu Pointer to the VMCPU.
1599	* @param pRegFrame The register frame.
1600	* @param u16Data LMSW source data.
1601	*
1602	*/
1603	VMM_INT_DECL(int) EMInterpretLMSW(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint16_t u16Data)
1604	{
1605	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1606	uint64_t OldCr0 = CPUMGetGuestCR0(pVCpu);
1607
1608	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1609	uint64_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1610	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1611
1612	return emUpdateCRx(pVM, pVCpu, pRegFrame, DISCREG_CR0, NewCr0);
1613	}
1614
1615
1616	/**
1617	* Interpret CLTS.
1618	*
1619	* @returns VBox status code.
1620	* @param pVM Pointer to the VM.
1621	* @param pVCpu Pointer to the VMCPU.
1622	*
1623	*/
1624	VMM_INT_DECL(int) EMInterpretCLTS(PVM pVM, PVMCPU pVCpu)
1625	{
1626	NOREF(pVM);
1627
1628	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
1629	if (!(cr0 & X86_CR0_TS))
1630	return VINF_SUCCESS;
1631	return CPUMSetGuestCR0(pVCpu, cr0 & ~X86_CR0_TS);
1632	}
1633
1634
1635	#ifdef LOG_ENABLED
1636	static const char *emMSRtoString(uint32_t uMsr)
1637	{
1638	switch (uMsr)
1639	{
1640	case MSR_IA32_APICBASE: return "MSR_IA32_APICBASE";
1641	case MSR_IA32_CR_PAT: return "MSR_IA32_CR_PAT";
1642	case MSR_IA32_SYSENTER_CS: return "MSR_IA32_SYSENTER_CS";
1643	case MSR_IA32_SYSENTER_EIP: return "MSR_IA32_SYSENTER_EIP";
1644	case MSR_IA32_SYSENTER_ESP: return "MSR_IA32_SYSENTER_ESP";
1645	case MSR_K6_EFER: return "MSR_K6_EFER";
1646	case MSR_K8_SF_MASK: return "MSR_K8_SF_MASK";
1647	case MSR_K6_STAR: return "MSR_K6_STAR";
1648	case MSR_K8_LSTAR: return "MSR_K8_LSTAR";
1649	case MSR_K8_CSTAR: return "MSR_K8_CSTAR";
1650	case MSR_K8_FS_BASE: return "MSR_K8_FS_BASE";
1651	case MSR_K8_GS_BASE: return "MSR_K8_GS_BASE";
1652	case MSR_K8_KERNEL_GS_BASE: return "MSR_K8_KERNEL_GS_BASE";
1653	case MSR_K8_TSC_AUX: return "MSR_K8_TSC_AUX";
1654	case MSR_IA32_BIOS_SIGN_ID: return "Unsupported MSR_IA32_BIOS_SIGN_ID";
1655	case MSR_IA32_PLATFORM_ID: return "Unsupported MSR_IA32_PLATFORM_ID";
1656	case MSR_IA32_BIOS_UPDT_TRIG: return "Unsupported MSR_IA32_BIOS_UPDT_TRIG";
1657	case MSR_IA32_TSC: return "MSR_IA32_TSC";
1658	case MSR_IA32_MISC_ENABLE: return "MSR_IA32_MISC_ENABLE";
1659	case MSR_IA32_MTRR_CAP: return "MSR_IA32_MTRR_CAP";
1660	case MSR_IA32_MCP_CAP: return "Unsupported MSR_IA32_MCP_CAP";
1661	case MSR_IA32_MCP_STATUS: return "Unsupported MSR_IA32_MCP_STATUS";
1662	case MSR_IA32_MCP_CTRL: return "Unsupported MSR_IA32_MCP_CTRL";
1663	case MSR_IA32_MTRR_DEF_TYPE: return "MSR_IA32_MTRR_DEF_TYPE";
1664	case MSR_K7_EVNTSEL0: return "Unsupported MSR_K7_EVNTSEL0";
1665	case MSR_K7_EVNTSEL1: return "Unsupported MSR_K7_EVNTSEL1";
1666	case MSR_K7_EVNTSEL2: return "Unsupported MSR_K7_EVNTSEL2";
1667	case MSR_K7_EVNTSEL3: return "Unsupported MSR_K7_EVNTSEL3";
1668	case MSR_IA32_MC0_CTL: return "Unsupported MSR_IA32_MC0_CTL";
1669	case MSR_IA32_MC0_STATUS: return "Unsupported MSR_IA32_MC0_STATUS";
1670	case MSR_IA32_PERFEVTSEL0: return "Unsupported MSR_IA32_PERFEVTSEL0";
1671	case MSR_IA32_PERFEVTSEL1: return "Unsupported MSR_IA32_PERFEVTSEL1";
1672	case MSR_IA32_PERF_STATUS: return "MSR_IA32_PERF_STATUS";
1673	case MSR_IA32_PLATFORM_INFO: return "MSR_IA32_PLATFORM_INFO";
1674	case MSR_IA32_PERF_CTL: return "Unsupported MSR_IA32_PERF_CTL";
1675	case MSR_K7_PERFCTR0: return "Unsupported MSR_K7_PERFCTR0";
1676	case MSR_K7_PERFCTR1: return "Unsupported MSR_K7_PERFCTR1";
1677	case MSR_K7_PERFCTR2: return "Unsupported MSR_K7_PERFCTR2";
1678	case MSR_K7_PERFCTR3: return "Unsupported MSR_K7_PERFCTR3";
1679	case MSR_IA32_PMC0: return "Unsupported MSR_IA32_PMC0";
1680	case MSR_IA32_PMC1: return "Unsupported MSR_IA32_PMC1";
1681	case MSR_IA32_PMC2: return "Unsupported MSR_IA32_PMC2";
1682	case MSR_IA32_PMC3: return "Unsupported MSR_IA32_PMC3";
1683	}
1684	return "Unknown MSR";
1685	}
1686	#endif /* LOG_ENABLED */
1687
1688
1689	/**
1690	* Interpret RDMSR
1691	*
1692	* @returns VBox status code.
1693	* @param pVM Pointer to the VM.
1694	* @param pVCpu Pointer to the VMCPU.
1695	* @param pRegFrame The register frame.
1696	*/
1697	VMM_INT_DECL(int) EMInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1698	{
1699	NOREF(pVM);
1700
1701	/* Get the current privilege level. */
1702	if (CPUMGetGuestCPL(pVCpu) != 0)
1703	{
1704	Log4(("EM: Refuse RDMSR: CPL != 0\n"));
1705	return VERR_EM_INTERPRETER; /* supervisor only */
1706	}
1707
1708	uint64_t uValue;
1709	int rc = CPUMQueryGuestMsr(pVCpu, pRegFrame->ecx, &uValue);
1710	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1711	{
1712	Assert(rc == VERR_CPUM_RAISE_GP_0);
1713	Log4(("EM: Refuse RDMSR: rc=%Rrc\n", rc));
1714	return VERR_EM_INTERPRETER;
1715	}
1716	pRegFrame->rax = (uint32_t) uValue;
1717	pRegFrame->rdx = (uint32_t)(uValue >> 32);
1718	LogFlow(("EMInterpretRdmsr %s (%x) -> %RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx, uValue));
1719	return rc;
1720	}
1721
1722
1723	/**
1724	* Interpret WRMSR
1725	*
1726	* @returns VBox status code.
1727	* @param pVM Pointer to the VM.
1728	* @param pVCpu Pointer to the VMCPU.
1729	* @param pRegFrame The register frame.
1730	*/
1731	VMM_INT_DECL(int) EMInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1732	{
1733	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1734
1735	/* Check the current privilege level, this instruction is supervisor only. */
1736	if (CPUMGetGuestCPL(pVCpu) != 0)
1737	{
1738	Log4(("EM: Refuse WRMSR: CPL != 0\n"));
1739	return VERR_EM_INTERPRETER; /** @todo raise \#GP(0) */
1740	}
1741
1742	int rc = CPUMSetGuestMsr(pVCpu, pRegFrame->ecx, RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx));
1743	if (rc != VINF_SUCCESS)
1744	{
1745	Assert(rc == VERR_CPUM_RAISE_GP_0);
1746	Log4(("EM: Refuse WRMSR: rc=%d\n", rc));
1747	return VERR_EM_INTERPRETER;
1748	}
1749	LogFlow(("EMInterpretWrmsr %s (%x) val=%RX64\n", emMSRtoString(pRegFrame->ecx), pRegFrame->ecx,
1750	RT_MAKE_U64(pRegFrame->eax, pRegFrame->edx)));
1751	NOREF(pVM);
1752	return rc;
1753	}
1754
1755
1756	/**
1757	* Interpret CRx read.
1758	*
1759	* @returns VBox status code.
1760	* @param pVM Pointer to the VM.
1761	* @param pVCpu Pointer to the VMCPU.
1762	* @param pRegFrame The register frame.
1763	* @param DestRegGen General purpose register index (USE_REG_E**))
1764	* @param SrcRegCRx CRx register index (DISUSE_REG_CR*)
1765	*
1766	*/
1767	VMM_INT_DECL(int) EMInterpretCRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1768	{
1769	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1770	uint64_t val64;
1771	int rc = CPUMGetGuestCRx(pVCpu, SrcRegCrx, &val64);
1772	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1773	NOREF(pVM);
1774
1775	if (CPUMIsGuestIn64BitCode(pVCpu))
1776	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1777	else
1778	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1779
1780	if (RT_SUCCESS(rc))
1781	{
1782	LogFlow(("MOV_CR: gen32=%d CR=%d val=%RX64\n", DestRegGen, SrcRegCrx, val64));
1783	return VINF_SUCCESS;
1784	}
1785	return VERR_EM_INTERPRETER;
1786	}
1787
1788
1789	/**
1790	* Interpret DRx write.
1791	*
1792	* @returns VBox status code.
1793	* @param pVM Pointer to the VM.
1794	* @param pVCpu Pointer to the VMCPU.
1795	* @param pRegFrame The register frame.
1796	* @param DestRegDRx DRx register index (USE_REG_DR*)
1797	* @param SrcRegGen General purpose register index (USE_REG_E**))
1798	*
1799	*/
1800	VMM_INT_DECL(int) EMInterpretDRxWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
1801	{
1802	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1803	uint64_t val;
1804	int rc;
1805	NOREF(pVM);
1806
1807	if (CPUMIsGuestIn64BitCode(pVCpu))
1808	rc = DISFetchReg64(pRegFrame, SrcRegGen, &val);
1809	else
1810	{
1811	uint32_t val32;
1812	rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1813	val = val32;
1814	}
1815
1816	if (RT_SUCCESS(rc))
1817	{
1818	/** @todo we don't fail if illegal bits are set/cleared for e.g. dr7 */
1819	rc = CPUMSetGuestDRx(pVCpu, DestRegDrx, val);
1820	if (RT_SUCCESS(rc))
1821	return rc;
1822	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
1823	}
1824	return VERR_EM_INTERPRETER;
1825	}
1826
1827
1828	/**
1829	* Interpret DRx read.
1830	*
1831	* @returns VBox status code.
1832	* @param pVM Pointer to the VM.
1833	* @param pVCpu Pointer to the VMCPU.
1834	* @param pRegFrame The register frame.
1835	* @param DestRegGen General purpose register index (USE_REG_E**))
1836	* @param SrcRegDRx DRx register index (USE_REG_DR*)
1837	*
1838	*/
1839	VMM_INT_DECL(int) EMInterpretDRxRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
1840	{
1841	uint64_t val64;
1842	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
1843	NOREF(pVM);
1844
1845	int rc = CPUMGetGuestDRx(pVCpu, SrcRegDrx, &val64);
1846	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
1847	if (CPUMIsGuestIn64BitCode(pVCpu))
1848	rc = DISWriteReg64(pRegFrame, DestRegGen, val64);
1849	else
1850	rc = DISWriteReg32(pRegFrame, DestRegGen, (uint32_t)val64);
1851
1852	if (RT_SUCCESS(rc))
1853	return VINF_SUCCESS;
1854
1855	return VERR_EM_INTERPRETER;
1856	}
1857
1858
1859	#if !defined(VBOX_WITH_IEM) \|\| defined(VBOX_COMPARE_IEM_AND_EM)
1860
1861
1862
1863
1864
1865
1866	/*
1867	*
1868	* The old interpreter.
1869	* The old interpreter.
1870	* The old interpreter.
1871	* The old interpreter.
1872	* The old interpreter.
1873	*
1874	*/
1875
1876	DECLINLINE(int) emRamRead(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, void *pvDst, RTGCPTR GCPtrSrc, uint32_t cb)
1877	{
1878	#ifdef IN_RC
1879	int rc = MMGCRamRead(pVM, pvDst, (void *)(uintptr_t)GCPtrSrc, cb);
1880	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
1881	return rc;
1882	/*
1883	* The page pool cache may end up here in some cases because it
1884	* flushed one of the shadow mappings used by the trapping
1885	* instruction and it either flushed the TLB or the CPU reused it.
1886	*/
1887	#else
1888	NOREF(pVM);
1889	#endif
1890	return PGMPhysInterpretedReadNoHandlers(pVCpu, pCtxCore, pvDst, GCPtrSrc, cb, /fMayTrap/ false);
1891	}
1892
1893
1894	DECLINLINE(int) emRamWrite(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, uint32_t cb)
1895	{
1896	/* Don't use MMGCRamWrite here as it does not respect zero pages, shared
1897	pages or write monitored pages. */
1898	NOREF(pVM);
1899	#if !defined(VBOX_COMPARE_IEM_AND_EM) \|\| !defined(VBOX_COMPARE_IEM_LAST)
1900	int rc = PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, /fMayTrap/ false);
1901	#else
1902	int rc = VINF_SUCCESS;
1903	#endif
1904	#ifdef VBOX_COMPARE_IEM_AND_EM
1905	Log(("EM Wrote: %RGv %.*Rhxs rc=%Rrc\n", GCPtrDst, RT_MAX(RT_MIN(cb, 64), 1), pvSrc, rc));
1906	g_cbEmWrote = cb;
1907	memcpy(g_abEmWrote, pvSrc, RT_MIN(cb, sizeof(g_abEmWrote)));
1908	#endif
1909	return rc;
1910	}
1911
1912
1913	/** Convert sel:addr to a flat GC address. */
1914	DECLINLINE(RTGCPTR) emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pDis, PDISOPPARAM pParam, RTGCPTR pvAddr)
1915	{
1916	DISSELREG enmPrefixSeg = DISDetectSegReg(pDis, pParam);
1917	return SELMToFlat(pVM, enmPrefixSeg, pRegFrame, pvAddr);
1918	}
1919
1920
1921	#if defined(VBOX_STRICT) \|\| defined(LOG_ENABLED)
1922	/**
1923	* Get the mnemonic for the disassembled instruction.
1924	*
1925	* GC/R0 doesn't include the strings in the DIS tables because
1926	* of limited space.
1927	*/
1928	static const char *emGetMnemonic(PDISCPUSTATE pDis)
1929	{
1930	switch (pDis->pCurInstr->uOpcode)
1931	{
1932	case OP_XCHG: return "Xchg";
1933	case OP_DEC: return "Dec";
1934	case OP_INC: return "Inc";
1935	case OP_POP: return "Pop";
1936	case OP_OR: return "Or";
1937	case OP_AND: return "And";
1938	case OP_MOV: return "Mov";
1939	case OP_INVLPG: return "InvlPg";
1940	case OP_CPUID: return "CpuId";
1941	case OP_MOV_CR: return "MovCRx";
1942	case OP_MOV_DR: return "MovDRx";
1943	case OP_LLDT: return "LLdt";
1944	case OP_LGDT: return "LGdt";
1945	case OP_LIDT: return "LIdt";
1946	case OP_CLTS: return "Clts";
1947	case OP_MONITOR: return "Monitor";
1948	case OP_MWAIT: return "MWait";
1949	case OP_RDMSR: return "Rdmsr";
1950	case OP_WRMSR: return "Wrmsr";
1951	case OP_ADD: return "Add";
1952	case OP_ADC: return "Adc";
1953	case OP_SUB: return "Sub";
1954	case OP_SBB: return "Sbb";
1955	case OP_RDTSC: return "Rdtsc";
1956	case OP_STI: return "Sti";
1957	case OP_CLI: return "Cli";
1958	case OP_XADD: return "XAdd";
1959	case OP_HLT: return "Hlt";
1960	case OP_IRET: return "Iret";
1961	case OP_MOVNTPS: return "MovNTPS";
1962	case OP_STOSWD: return "StosWD";
1963	case OP_WBINVD: return "WbInvd";
1964	case OP_XOR: return "Xor";
1965	case OP_BTR: return "Btr";
1966	case OP_BTS: return "Bts";
1967	case OP_BTC: return "Btc";
1968	case OP_LMSW: return "Lmsw";
1969	case OP_SMSW: return "Smsw";
1970	case OP_CMPXCHG: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg" : "CmpXchg";
1971	case OP_CMPXCHG8B: return pDis->fPrefix & DISPREFIX_LOCK ? "Lock CmpXchg8b" : "CmpXchg8b";
1972
1973	default:
1974	Log(("Unknown opcode %d\n", pDis->pCurInstr->uOpcode));
1975	return "???";
1976	}
1977	}
1978	#endif /* VBOX_STRICT \|\| LOG_ENABLED */
1979
1980
1981	/**
1982	* XCHG instruction emulation.
1983	*/
1984	static int emInterpretXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1985	{
1986	DISQPVPARAMVAL param1, param2;
1987	NOREF(pvFault);
1988
1989	/* Source to make DISQueryParamVal read the register value - ugly hack */
1990	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
1991	if(RT_FAILURE(rc))
1992	return VERR_EM_INTERPRETER;
1993
1994	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
1995	if(RT_FAILURE(rc))
1996	return VERR_EM_INTERPRETER;
1997
1998	#ifdef IN_RC
1999	if (TRPMHasTrap(pVCpu))
2000	{
2001	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2002	{
2003	#endif
2004	RTGCPTR pParam1 = 0, pParam2 = 0;
2005	uint64_t valpar1, valpar2;
2006
2007	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
2008	switch(param1.type)
2009	{
2010	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
2011	valpar1 = param1.val.val64;
2012	break;
2013
2014	case DISQPV_TYPE_ADDRESS:
2015	pParam1 = (RTGCPTR)param1.val.val64;
2016	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2017	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2018	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2019	if (RT_FAILURE(rc))
2020	{
2021	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2022	return VERR_EM_INTERPRETER;
2023	}
2024	break;
2025
2026	default:
2027	AssertFailed();
2028	return VERR_EM_INTERPRETER;
2029	}
2030
2031	switch(param2.type)
2032	{
2033	case DISQPV_TYPE_ADDRESS:
2034	pParam2 = (RTGCPTR)param2.val.val64;
2035	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pParam2);
2036	EM_ASSERT_FAULT_RETURN(pParam2 == pvFault, VERR_EM_INTERPRETER);
2037	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar2, pParam2, param2.size);
2038	if (RT_FAILURE(rc))
2039	{
2040	AssertMsgFailed(("MMGCRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2041	}
2042	break;
2043
2044	case DISQPV_TYPE_IMMEDIATE:
2045	valpar2 = param2.val.val64;
2046	break;
2047
2048	default:
2049	AssertFailed();
2050	return VERR_EM_INTERPRETER;
2051	}
2052
2053	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
2054	if (pParam1 == 0)
2055	{
2056	Assert(param1.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
2057	switch(param1.size)
2058	{
2059	case 1: //special case for AH etc
2060	rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t )valpar2); break;
2061	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)valpar2); break;
2062	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)valpar2); break;
2063	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, valpar2); break;
2064	default: AssertFailedReturn(VERR_EM_INTERPRETER);
2065	}
2066	if (RT_FAILURE(rc))
2067	return VERR_EM_INTERPRETER;
2068	}
2069	else
2070	{
2071	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar2, param1.size);
2072	if (RT_FAILURE(rc))
2073	{
2074	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2075	return VERR_EM_INTERPRETER;
2076	}
2077	}
2078
2079	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
2080	if (pParam2 == 0)
2081	{
2082	Assert(param2.type == DISQPV_TYPE_IMMEDIATE); /* register actually */
2083	switch(param2.size)
2084	{
2085	case 1: //special case for AH etc
2086	rc = DISWriteReg8(pRegFrame, pDis->Param2.Base.idxGenReg, (uint8_t )valpar1); break;
2087	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param2.Base.idxGenReg, (uint16_t)valpar1); break;
2088	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param2.Base.idxGenReg, (uint32_t)valpar1); break;
2089	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param2.Base.idxGenReg, valpar1); break;
2090	default: AssertFailedReturn(VERR_EM_INTERPRETER);
2091	}
2092	if (RT_FAILURE(rc))
2093	return VERR_EM_INTERPRETER;
2094	}
2095	else
2096	{
2097	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam2, &valpar1, param2.size);
2098	if (RT_FAILURE(rc))
2099	{
2100	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2101	return VERR_EM_INTERPRETER;
2102	}
2103	}
2104
2105	*pcbSize = param2.size;
2106	return VINF_SUCCESS;
2107	#ifdef IN_RC
2108	}
2109	}
2110	return VERR_EM_INTERPRETER;
2111	#endif
2112	}
2113
2114
2115	/**
2116	* INC and DEC emulation.
2117	*/
2118	static int emInterpretIncDec(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2119	PFNEMULATEPARAM2 pfnEmulate)
2120	{
2121	DISQPVPARAMVAL param1;
2122	NOREF(pvFault);
2123
2124	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2125	if(RT_FAILURE(rc))
2126	return VERR_EM_INTERPRETER;
2127
2128	#ifdef IN_RC
2129	if (TRPMHasTrap(pVCpu))
2130	{
2131	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2132	{
2133	#endif
2134	RTGCPTR pParam1 = 0;
2135	uint64_t valpar1;
2136
2137	if (param1.type == DISQPV_TYPE_ADDRESS)
2138	{
2139	pParam1 = (RTGCPTR)param1.val.val64;
2140	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2141	#ifdef IN_RC
2142	/* Safety check (in theory it could cross a page boundary and fault there though) */
2143	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2144	#endif
2145	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2146	if (RT_FAILURE(rc))
2147	{
2148	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2149	return VERR_EM_INTERPRETER;
2150	}
2151	}
2152	else
2153	{
2154	AssertFailed();
2155	return VERR_EM_INTERPRETER;
2156	}
2157
2158	uint32_t eflags;
2159
2160	eflags = pfnEmulate(&valpar1, param1.size);
2161
2162	/* Write result back */
2163	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2164	if (RT_FAILURE(rc))
2165	{
2166	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2167	return VERR_EM_INTERPRETER;
2168	}
2169
2170	/* Update guest's eflags and finish. */
2171	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2172	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2173
2174	/* All done! */
2175	*pcbSize = param1.size;
2176	return VINF_SUCCESS;
2177	#ifdef IN_RC
2178	}
2179	}
2180	return VERR_EM_INTERPRETER;
2181	#endif
2182	}
2183
2184
2185	/**
2186	* POP Emulation.
2187	*/
2188	static int emInterpretPop(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2189	{
2190	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
2191	DISQPVPARAMVAL param1;
2192	NOREF(pvFault);
2193
2194	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2195	if(RT_FAILURE(rc))
2196	return VERR_EM_INTERPRETER;
2197
2198	#ifdef IN_RC
2199	if (TRPMHasTrap(pVCpu))
2200	{
2201	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2202	{
2203	#endif
2204	RTGCPTR pParam1 = 0;
2205	uint32_t valpar1;
2206	RTGCPTR pStackVal;
2207
2208	/* Read stack value first */
2209	if (CPUMGetGuestCodeBits(pVCpu) == 16)
2210	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
2211
2212	/* Convert address; don't bother checking limits etc, as we only read here */
2213	pStackVal = SELMToFlat(pVM, DISSELREG_SS, pRegFrame, (RTGCPTR)pRegFrame->esp);
2214	if (pStackVal == 0)
2215	return VERR_EM_INTERPRETER;
2216
2217	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pStackVal, param1.size);
2218	if (RT_FAILURE(rc))
2219	{
2220	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2221	return VERR_EM_INTERPRETER;
2222	}
2223
2224	if (param1.type == DISQPV_TYPE_ADDRESS)
2225	{
2226	pParam1 = (RTGCPTR)param1.val.val64;
2227
2228	/* pop [esp+xx] uses esp after the actual pop! */
2229	AssertCompile(DISGREG_ESP == DISGREG_SP);
2230	if ( (pDis->Param1.fUse & DISUSE_BASE)
2231	&& (pDis->Param1.fUse & (DISUSE_REG_GEN16\|DISUSE_REG_GEN32))
2232	&& pDis->Param1.Base.idxGenReg == DISGREG_ESP
2233	)
2234	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
2235
2236	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2237	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, VERR_EM_INTERPRETER);
2238	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2239	if (RT_FAILURE(rc))
2240	{
2241	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2242	return VERR_EM_INTERPRETER;
2243	}
2244
2245	/* Update ESP as the last step */
2246	pRegFrame->esp += param1.size;
2247	}
2248	else
2249	{
2250	#ifndef DEBUG_bird // annoying assertion.
2251	AssertFailed();
2252	#endif
2253	return VERR_EM_INTERPRETER;
2254	}
2255
2256	/* All done! */
2257	*pcbSize = param1.size;
2258	return VINF_SUCCESS;
2259	#ifdef IN_RC
2260	}
2261	}
2262	return VERR_EM_INTERPRETER;
2263	#endif
2264	}
2265
2266
2267	/**
2268	* XOR/OR/AND Emulation.
2269	*/
2270	static int emInterpretOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2271	PFNEMULATEPARAM3 pfnEmulate)
2272	{
2273	DISQPVPARAMVAL param1, param2;
2274	NOREF(pvFault);
2275
2276	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2277	if(RT_FAILURE(rc))
2278	return VERR_EM_INTERPRETER;
2279
2280	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2281	if(RT_FAILURE(rc))
2282	return VERR_EM_INTERPRETER;
2283
2284	#ifdef IN_RC
2285	if (TRPMHasTrap(pVCpu))
2286	{
2287	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2288	{
2289	#endif
2290	RTGCPTR pParam1;
2291	uint64_t valpar1, valpar2;
2292
2293	if (pDis->Param1.cb != pDis->Param2.cb)
2294	{
2295	if (pDis->Param1.cb < pDis->Param2.cb)
2296	{
2297	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
2298	return VERR_EM_INTERPRETER;
2299	}
2300	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2301	pDis->Param2.cb = pDis->Param1.cb;
2302	param2.size = param1.size;
2303	}
2304
2305	/* The destination is always a virtual address */
2306	if (param1.type == DISQPV_TYPE_ADDRESS)
2307	{
2308	pParam1 = (RTGCPTR)param1.val.val64;
2309	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2310	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2311	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2312	if (RT_FAILURE(rc))
2313	{
2314	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2315	return VERR_EM_INTERPRETER;
2316	}
2317	}
2318	else
2319	{
2320	AssertFailed();
2321	return VERR_EM_INTERPRETER;
2322	}
2323
2324	/* Register or immediate data */
2325	switch(param2.type)
2326	{
2327	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2328	valpar2 = param2.val.val64;
2329	break;
2330
2331	default:
2332	AssertFailed();
2333	return VERR_EM_INTERPRETER;
2334	}
2335
2336	LogFlow(("emInterpretOrXorAnd %s %RGv %RX64 - %RX64 size %d (%d)\n", emGetMnemonic(pDis), pParam1, valpar1, valpar2, param2.size, param1.size));
2337
2338	/* Data read, emulate instruction. */
2339	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
2340
2341	LogFlow(("emInterpretOrXorAnd %s result %RX64\n", emGetMnemonic(pDis), valpar1));
2342
2343	/* Update guest's eflags and finish. */
2344	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2345	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2346
2347	/* And write it back */
2348	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2349	if (RT_SUCCESS(rc))
2350	{
2351	/* All done! */
2352	*pcbSize = param2.size;
2353	return VINF_SUCCESS;
2354	}
2355	#ifdef IN_RC
2356	}
2357	}
2358	#endif
2359	return VERR_EM_INTERPRETER;
2360	}
2361
2362
2363	#ifndef VBOX_COMPARE_IEM_AND_EM
2364	/**
2365	* LOCK XOR/OR/AND Emulation.
2366	*/
2367	static int emInterpretLockOrXorAnd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
2368	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
2369	{
2370	void *pvParam1;
2371	DISQPVPARAMVAL param1, param2;
2372	NOREF(pvFault);
2373
2374	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
2375	Assert(pDis->Param1.cb <= 4);
2376	#endif
2377
2378	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2379	if(RT_FAILURE(rc))
2380	return VERR_EM_INTERPRETER;
2381
2382	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2383	if(RT_FAILURE(rc))
2384	return VERR_EM_INTERPRETER;
2385
2386	if (pDis->Param1.cb != pDis->Param2.cb)
2387	{
2388	AssertMsgReturn(pDis->Param1.cb >= pDis->Param2.cb, /* should never happen! */
2389	("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb),
2390	VERR_EM_INTERPRETER);
2391
2392	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2393	pDis->Param2.cb = pDis->Param1.cb;
2394	param2.size = param1.size;
2395	}
2396
2397	#ifdef IN_RC
2398	/* Safety check (in theory it could cross a page boundary and fault there though) */
2399	Assert( TRPMHasTrap(pVCpu)
2400	&& (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW));
2401	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
2402	#endif
2403
2404	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
2405	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
2406	RTGCUINTREG ValPar2 = param2.val.val64;
2407
2408	/* The destination is always a virtual address */
2409	AssertReturn(param1.type == DISQPV_TYPE_ADDRESS, VERR_EM_INTERPRETER);
2410
2411	RTGCPTR GCPtrPar1 = param1.val.val64;
2412	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2413	PGMPAGEMAPLOCK Lock;
2414	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2415	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2416
2417	/* Try emulate it with a one-shot #PF handler in place. (RC) */
2418	Log2(("%s %RGv imm%d=%RX64\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2419
2420	RTGCUINTREG32 eflags = 0;
2421	rc = pfnEmulate(pvParam1, ValPar2, pDis->Param2.cb, &eflags);
2422	PGMPhysReleasePageMappingLock(pVM, &Lock);
2423	if (RT_FAILURE(rc))
2424	{
2425	Log(("%s %RGv imm%d=%RX64-> emulation failed due to page fault!\n", emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2426	return VERR_EM_INTERPRETER;
2427	}
2428
2429	/* Update guest's eflags and finish. */
2430	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2431	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2432
2433	*pcbSize = param2.size;
2434	return VINF_SUCCESS;
2435	}
2436	#endif /* !VBOX_COMPARE_IEM_AND_EM */
2437
2438
2439	/**
2440	* ADD, ADC & SUB Emulation.
2441	*/
2442	static int emInterpretAddSub(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2443	PFNEMULATEPARAM3 pfnEmulate)
2444	{
2445	NOREF(pvFault);
2446	DISQPVPARAMVAL param1, param2;
2447	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2448	if(RT_FAILURE(rc))
2449	return VERR_EM_INTERPRETER;
2450
2451	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2452	if(RT_FAILURE(rc))
2453	return VERR_EM_INTERPRETER;
2454
2455	#ifdef IN_RC
2456	if (TRPMHasTrap(pVCpu))
2457	{
2458	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2459	{
2460	#endif
2461	RTGCPTR pParam1;
2462	uint64_t valpar1, valpar2;
2463
2464	if (pDis->Param1.cb != pDis->Param2.cb)
2465	{
2466	if (pDis->Param1.cb < pDis->Param2.cb)
2467	{
2468	AssertMsgFailed(("%s at %RGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip, pDis->Param1.cb, pDis->Param2.cb)); /* should never happen! */
2469	return VERR_EM_INTERPRETER;
2470	}
2471	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
2472	pDis->Param2.cb = pDis->Param1.cb;
2473	param2.size = param1.size;
2474	}
2475
2476	/* The destination is always a virtual address */
2477	if (param1.type == DISQPV_TYPE_ADDRESS)
2478	{
2479	pParam1 = (RTGCPTR)param1.val.val64;
2480	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2481	EM_ASSERT_FAULT_RETURN(pParam1 == pvFault, VERR_EM_INTERPRETER);
2482	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, param1.size);
2483	if (RT_FAILURE(rc))
2484	{
2485	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2486	return VERR_EM_INTERPRETER;
2487	}
2488	}
2489	else
2490	{
2491	#ifndef DEBUG_bird
2492	AssertFailed();
2493	#endif
2494	return VERR_EM_INTERPRETER;
2495	}
2496
2497	/* Register or immediate data */
2498	switch(param2.type)
2499	{
2500	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2501	valpar2 = param2.val.val64;
2502	break;
2503
2504	default:
2505	AssertFailed();
2506	return VERR_EM_INTERPRETER;
2507	}
2508
2509	/* Data read, emulate instruction. */
2510	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
2511
2512	/* Update guest's eflags and finish. */
2513	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2514	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2515
2516	/* And write it back */
2517	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, param1.size);
2518	if (RT_SUCCESS(rc))
2519	{
2520	/* All done! */
2521	*pcbSize = param2.size;
2522	return VINF_SUCCESS;
2523	}
2524	#ifdef IN_RC
2525	}
2526	}
2527	#endif
2528	return VERR_EM_INTERPRETER;
2529	}
2530
2531
2532	/**
2533	* ADC Emulation.
2534	*/
2535	static int emInterpretAdc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2536	{
2537	if (pRegFrame->eflags.Bits.u1CF)
2538	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
2539	else
2540	return emInterpretAddSub(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
2541	}
2542
2543
2544	/**
2545	* BTR/C/S Emulation.
2546	*/
2547	static int emInterpretBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
2548	PFNEMULATEPARAM2UINT32 pfnEmulate)
2549	{
2550	DISQPVPARAMVAL param1, param2;
2551	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2552	if(RT_FAILURE(rc))
2553	return VERR_EM_INTERPRETER;
2554
2555	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2556	if(RT_FAILURE(rc))
2557	return VERR_EM_INTERPRETER;
2558
2559	#ifdef IN_RC
2560	if (TRPMHasTrap(pVCpu))
2561	{
2562	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
2563	{
2564	#endif
2565	RTGCPTR pParam1;
2566	uint64_t valpar1 = 0, valpar2;
2567	uint32_t eflags;
2568
2569	/* The destination is always a virtual address */
2570	if (param1.type != DISQPV_TYPE_ADDRESS)
2571	return VERR_EM_INTERPRETER;
2572
2573	pParam1 = (RTGCPTR)param1.val.val64;
2574	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
2575
2576	/* Register or immediate data */
2577	switch(param2.type)
2578	{
2579	case DISQPV_TYPE_IMMEDIATE: /* both immediate data and register (ugly) */
2580	valpar2 = param2.val.val64;
2581	break;
2582
2583	default:
2584	AssertFailed();
2585	return VERR_EM_INTERPRETER;
2586	}
2587
2588	Log2(("emInterpret%s: pvFault=%RGv pParam1=%RGv val2=%x\n", emGetMnemonic(pDis), pvFault, pParam1, valpar2));
2589	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
2590	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, VERR_EM_INTERPRETER);
2591	rc = emRamRead(pVM, pVCpu, pRegFrame, &valpar1, pParam1, 1);
2592	if (RT_FAILURE(rc))
2593	{
2594	AssertMsgFailed(("emRamRead %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
2595	return VERR_EM_INTERPRETER;
2596	}
2597
2598	Log2(("emInterpretBtx: val=%x\n", valpar1));
2599	/* Data read, emulate bit test instruction. */
2600	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
2601
2602	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
2603
2604	/* Update guest's eflags and finish. */
2605	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2606	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2607
2608	/* And write it back */
2609	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &valpar1, 1);
2610	if (RT_SUCCESS(rc))
2611	{
2612	/* All done! */
2613	*pcbSize = 1;
2614	return VINF_SUCCESS;
2615	}
2616	#ifdef IN_RC
2617	}
2618	}
2619	#endif
2620	return VERR_EM_INTERPRETER;
2621	}
2622
2623
2624	#ifndef VBOX_COMPARE_IEM_AND_EM
2625	/**
2626	* LOCK BTR/C/S Emulation.
2627	*/
2628	static int emInterpretLockBitTest(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
2629	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
2630	{
2631	void *pvParam1;
2632
2633	DISQPVPARAMVAL param1, param2;
2634	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2635	if(RT_FAILURE(rc))
2636	return VERR_EM_INTERPRETER;
2637
2638	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2639	if(RT_FAILURE(rc))
2640	return VERR_EM_INTERPRETER;
2641
2642	/* The destination is always a virtual address */
2643	if (param1.type != DISQPV_TYPE_ADDRESS)
2644	return VERR_EM_INTERPRETER;
2645
2646	/* Register and immediate data == DISQPV_TYPE_IMMEDIATE */
2647	AssertReturn(param2.type == DISQPV_TYPE_IMMEDIATE, VERR_EM_INTERPRETER);
2648	uint64_t ValPar2 = param2.val.val64;
2649
2650	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
2651	RTGCPTR GCPtrPar1 = param1.val.val64;
2652	GCPtrPar1 = (GCPtrPar1 + ValPar2 / 8);
2653	ValPar2 &= 7;
2654
2655	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
2656	#ifdef IN_RC
2657	Assert(TRPMHasTrap(pVCpu));
2658	EM_ASSERT_FAULT_RETURN((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault, VERR_EM_INTERPRETER);
2659	#endif
2660
2661	PGMPAGEMAPLOCK Lock;
2662	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
2663	AssertRCReturn(rc, VERR_EM_INTERPRETER);
2664
2665	Log2(("emInterpretLockBitTest %s: pvFault=%RGv GCPtrPar1=%RGv imm=%RX64\n", emGetMnemonic(pDis), pvFault, GCPtrPar1, ValPar2));
2666
2667	/* Try emulate it with a one-shot #PF handler in place. (RC) */
2668	RTGCUINTREG32 eflags = 0;
2669	rc = pfnEmulate(pvParam1, ValPar2, &eflags);
2670	PGMPhysReleasePageMappingLock(pVM, &Lock);
2671	if (RT_FAILURE(rc))
2672	{
2673	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RX64 -> emulation failed due to page fault!\n",
2674	emGetMnemonic(pDis), GCPtrPar1, pDis->Param2.cb*8, ValPar2));
2675	return VERR_EM_INTERPRETER;
2676	}
2677
2678	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RX64 CF=%d\n", emGetMnemonic(pDis), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
2679
2680	/* Update guest's eflags and finish. */
2681	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
2682	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
2683
2684	*pcbSize = 1;
2685	return VINF_SUCCESS;
2686	}
2687	#endif /* !VBOX_COMPARE_IEM_AND_EM */
2688
2689
2690	/**
2691	* MOV emulation.
2692	*/
2693	static int emInterpretMov(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2694	{
2695	NOREF(pvFault);
2696	DISQPVPARAMVAL param1, param2;
2697	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_DST);
2698	if(RT_FAILURE(rc))
2699	return VERR_EM_INTERPRETER;
2700
2701	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
2702	if(RT_FAILURE(rc))
2703	return VERR_EM_INTERPRETER;
2704
2705	if (param1.type == DISQPV_TYPE_ADDRESS)
2706	{
2707	RTGCPTR pDest;
2708	uint64_t val64;
2709
2710	switch(param1.type)
2711	{
2712	case DISQPV_TYPE_IMMEDIATE:
2713	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2714	return VERR_EM_INTERPRETER;
2715	/* fallthru */
2716
2717	case DISQPV_TYPE_ADDRESS:
2718	pDest = (RTGCPTR)param1.val.val64;
2719	pDest = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pDest);
2720	break;
2721
2722	default:
2723	AssertFailed();
2724	return VERR_EM_INTERPRETER;
2725	}
2726
2727	switch(param2.type)
2728	{
2729	case DISQPV_TYPE_IMMEDIATE: /* register type is translated to this one too */
2730	val64 = param2.val.val64;
2731	break;
2732
2733	default:
2734	Log(("emInterpretMov: unexpected type=%d rip=%RGv\n", param2.type, (RTGCPTR)pRegFrame->rip));
2735	return VERR_EM_INTERPRETER;
2736	}
2737	#ifdef LOG_ENABLED
2738	if (pDis->uCpuMode == DISCPUMODE_64BIT)
2739	LogFlow(("EMInterpretInstruction at %RGv: OP_MOV %RGv <- %RX64 (%d) &val64=%RHv\n", (RTGCPTR)pRegFrame->rip, pDest, val64, param2.size, &val64));
2740	else
2741	LogFlow(("EMInterpretInstruction at %08RX64: OP_MOV %RGv <- %08X (%d) &val64=%RHv\n", pRegFrame->rip, pDest, (uint32_t)val64, param2.size, &val64));
2742	#endif
2743
2744	Assert(param2.size <= 8 && param2.size > 0);
2745	EM_ASSERT_FAULT_RETURN(pDest == pvFault, VERR_EM_INTERPRETER);
2746	rc = emRamWrite(pVM, pVCpu, pRegFrame, pDest, &val64, param2.size);
2747	if (RT_FAILURE(rc))
2748	return VERR_EM_INTERPRETER;
2749
2750	*pcbSize = param2.size;
2751	}
2752	#if defined(IN_RC) && defined(VBOX_WITH_RAW_RING1)
2753	/* mov xx, cs instruction is dangerous in raw mode and replaced by an 'int3' by csam/patm. */
2754	else if ( param1.type == DISQPV_TYPE_REGISTER
2755	&& param2.type == DISQPV_TYPE_REGISTER)
2756	{
2757	AssertReturn((pDis->Param1.fUse & (DISUSE_REG_GEN8\|DISUSE_REG_GEN16\|DISUSE_REG_GEN32)), VERR_EM_INTERPRETER);
2758	AssertReturn(pDis->Param2.fUse == DISUSE_REG_SEG, VERR_EM_INTERPRETER);
2759	AssertReturn(pDis->Param2.Base.idxSegReg == DISSELREG_CS, VERR_EM_INTERPRETER);
2760
2761	uint32_t u32Cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
2762	uint32_t uValCS = (pRegFrame->cs.Sel & ~X86_SEL_RPL) \| u32Cpl;
2763
2764	Log(("EMInterpretInstruction: OP_MOV cs=%x->%x\n", pRegFrame->cs.Sel, uValCS));
2765	switch (param1.size)
2766	{
2767	case 1: rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t) uValCS); break;
2768	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)uValCS); break;
2769	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)uValCS); break;
2770	default:
2771	AssertFailed();
2772	return VERR_EM_INTERPRETER;
2773	}
2774	AssertRCReturn(rc, rc);
2775	}
2776	#endif
2777	else
2778	{ /* read fault */
2779	RTGCPTR pSrc;
2780	uint64_t val64;
2781
2782	/* Source */
2783	switch(param2.type)
2784	{
2785	case DISQPV_TYPE_IMMEDIATE:
2786	if(!(param2.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
2787	return VERR_EM_INTERPRETER;
2788	/* fallthru */
2789
2790	case DISQPV_TYPE_ADDRESS:
2791	pSrc = (RTGCPTR)param2.val.val64;
2792	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param2, pSrc);
2793	break;
2794
2795	default:
2796	return VERR_EM_INTERPRETER;
2797	}
2798
2799	Assert(param1.size <= 8 && param1.size > 0);
2800	EM_ASSERT_FAULT_RETURN(pSrc == pvFault, VERR_EM_INTERPRETER);
2801	rc = emRamRead(pVM, pVCpu, pRegFrame, &val64, pSrc, param1.size);
2802	if (RT_FAILURE(rc))
2803	return VERR_EM_INTERPRETER;
2804
2805	/* Destination */
2806	switch(param1.type)
2807	{
2808	case DISQPV_TYPE_REGISTER:
2809	switch(param1.size)
2810	{
2811	case 1: rc = DISWriteReg8(pRegFrame, pDis->Param1.Base.idxGenReg, (uint8_t) val64); break;
2812	case 2: rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, (uint16_t)val64); break;
2813	case 4: rc = DISWriteReg32(pRegFrame, pDis->Param1.Base.idxGenReg, (uint32_t)val64); break;
2814	case 8: rc = DISWriteReg64(pRegFrame, pDis->Param1.Base.idxGenReg, val64); break;
2815	default:
2816	return VERR_EM_INTERPRETER;
2817	}
2818	if (RT_FAILURE(rc))
2819	return rc;
2820	break;
2821
2822	default:
2823	return VERR_EM_INTERPRETER;
2824	}
2825	#ifdef LOG_ENABLED
2826	if (pDis->uCpuMode == DISCPUMODE_64BIT)
2827	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %RX64 (%d)\n", pSrc, val64, param1.size));
2828	else
2829	LogFlow(("EMInterpretInstruction: OP_MOV %RGv -> %08X (%d)\n", pSrc, (uint32_t)val64, param1.size));
2830	#endif
2831	}
2832	return VINF_SUCCESS;
2833	}
2834
2835
2836	#ifndef IN_RC
2837	/**
2838	* [REP] STOSWD emulation
2839	*/
2840	static int emInterpretStosWD(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2841	{
2842	int rc;
2843	RTGCPTR GCDest, GCOffset;
2844	uint32_t cbSize;
2845	uint64_t cTransfers;
2846	int offIncrement;
2847	NOREF(pvFault);
2848
2849	/* Don't support any but these three prefix bytes. */
2850	if ((pDis->fPrefix & ~(DISPREFIX_ADDRSIZE\|DISPREFIX_OPSIZE\|DISPREFIX_REP\|DISPREFIX_REX)))
2851	return VERR_EM_INTERPRETER;
2852
2853	switch (pDis->uAddrMode)
2854	{
2855	case DISCPUMODE_16BIT:
2856	GCOffset = pRegFrame->di;
2857	cTransfers = pRegFrame->cx;
2858	break;
2859	case DISCPUMODE_32BIT:
2860	GCOffset = pRegFrame->edi;
2861	cTransfers = pRegFrame->ecx;
2862	break;
2863	case DISCPUMODE_64BIT:
2864	GCOffset = pRegFrame->rdi;
2865	cTransfers = pRegFrame->rcx;
2866	break;
2867	default:
2868	AssertFailed();
2869	return VERR_EM_INTERPRETER;
2870	}
2871
2872	GCDest = SELMToFlat(pVM, DISSELREG_ES, pRegFrame, GCOffset);
2873	switch (pDis->uOpMode)
2874	{
2875	case DISCPUMODE_16BIT:
2876	cbSize = 2;
2877	break;
2878	case DISCPUMODE_32BIT:
2879	cbSize = 4;
2880	break;
2881	case DISCPUMODE_64BIT:
2882	cbSize = 8;
2883	break;
2884	default:
2885	AssertFailed();
2886	return VERR_EM_INTERPRETER;
2887	}
2888
2889	offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
2890
2891	if (!(pDis->fPrefix & DISPREFIX_REP))
2892	{
2893	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d\n", pRegFrame->es.Sel, GCOffset, GCDest, cbSize));
2894
2895	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
2896	if (RT_FAILURE(rc))
2897	return VERR_EM_INTERPRETER;
2898	Assert(rc == VINF_SUCCESS);
2899
2900	/* Update (e/r)di. */
2901	switch (pDis->uAddrMode)
2902	{
2903	case DISCPUMODE_16BIT:
2904	pRegFrame->di += offIncrement;
2905	break;
2906	case DISCPUMODE_32BIT:
2907	pRegFrame->edi += offIncrement;
2908	break;
2909	case DISCPUMODE_64BIT:
2910	pRegFrame->rdi += offIncrement;
2911	break;
2912	default:
2913	AssertFailed();
2914	return VERR_EM_INTERPRETER;
2915	}
2916
2917	}
2918	else
2919	{
2920	if (!cTransfers)
2921	return VINF_SUCCESS;
2922
2923	/*
2924	* Do not try emulate cross page stuff here because we don't know what might
2925	* be waiting for us on the subsequent pages. The caller has only asked us to
2926	* ignore access handlers fro the current page.
2927	* This also fends off big stores which would quickly kill PGMR0DynMap.
2928	*/
2929	if ( cbSize > PAGE_SIZE
2930	\|\| cTransfers > PAGE_SIZE
2931	\|\| (GCDest >> PAGE_SHIFT) != ((GCDest + offIncrement * cTransfers) >> PAGE_SHIFT))
2932	{
2933	Log(("STOSWD is crosses pages, chicken out to the recompiler; GCDest=%RGv cbSize=%#x offIncrement=%d cTransfers=%#x\n",
2934	GCDest, cbSize, offIncrement, cTransfers));
2935	return VERR_EM_INTERPRETER;
2936	}
2937
2938	LogFlow(("emInterpretStosWD dest=%04X:%RGv (%RGv) cbSize=%d cTransfers=%x DF=%d\n", pRegFrame->es.Sel, GCOffset, GCDest, cbSize, cTransfers, pRegFrame->eflags.Bits.u1DF));
2939	/* Access verification first; we currently can't recover properly from traps inside this instruction */
2940	rc = PGMVerifyAccess(pVCpu, GCDest - ((offIncrement > 0) ? 0 : ((cTransfers-1) * cbSize)),
2941	cTransfers * cbSize,
2942	X86_PTE_RW \| (CPUMGetGuestCPL(pVCpu) == 3 ? X86_PTE_US : 0));
2943	if (rc != VINF_SUCCESS)
2944	{
2945	Log(("STOSWD will generate a trap -> recompiler, rc=%d\n", rc));
2946	return VERR_EM_INTERPRETER;
2947	}
2948
2949	/* REP case */
2950	while (cTransfers)
2951	{
2952	rc = emRamWrite(pVM, pVCpu, pRegFrame, GCDest, &pRegFrame->rax, cbSize);
2953	if (RT_FAILURE(rc))
2954	{
2955	rc = VERR_EM_INTERPRETER;
2956	break;
2957	}
2958
2959	Assert(rc == VINF_SUCCESS);
2960	GCOffset += offIncrement;
2961	GCDest += offIncrement;
2962	cTransfers--;
2963	}
2964
2965	/* Update the registers. */
2966	switch (pDis->uAddrMode)
2967	{
2968	case DISCPUMODE_16BIT:
2969	pRegFrame->di = GCOffset;
2970	pRegFrame->cx = cTransfers;
2971	break;
2972	case DISCPUMODE_32BIT:
2973	pRegFrame->edi = GCOffset;
2974	pRegFrame->ecx = cTransfers;
2975	break;
2976	case DISCPUMODE_64BIT:
2977	pRegFrame->rdi = GCOffset;
2978	pRegFrame->rcx = cTransfers;
2979	break;
2980	default:
2981	AssertFailed();
2982	return VERR_EM_INTERPRETER;
2983	}
2984	}
2985
2986	*pcbSize = cbSize;
2987	return rc;
2988	}
2989	#endif /* !IN_RC */
2990
2991
2992	/**
2993	* [LOCK] CMPXCHG emulation.
2994	*/
2995	static int emInterpretCmpXchg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2996	{
2997	DISQPVPARAMVAL param1, param2;
2998	NOREF(pvFault);
2999
3000	#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0)
3001	Assert(pDis->Param1.cb <= 4);
3002	#endif
3003
3004	/* Source to make DISQueryParamVal read the register value - ugly hack */
3005	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3006	if(RT_FAILURE(rc))
3007	return VERR_EM_INTERPRETER;
3008
3009	rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param2, &param2, DISQPVWHICH_SRC);
3010	if(RT_FAILURE(rc))
3011	return VERR_EM_INTERPRETER;
3012
3013	uint64_t valpar;
3014	switch(param2.type)
3015	{
3016	case DISQPV_TYPE_IMMEDIATE: /* register actually */
3017	valpar = param2.val.val64;
3018	break;
3019
3020	default:
3021	return VERR_EM_INTERPRETER;
3022	}
3023
3024	PGMPAGEMAPLOCK Lock;
3025	RTGCPTR GCPtrPar1;
3026	void *pvParam1;
3027	uint64_t eflags;
3028
3029	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
3030	switch(param1.type)
3031	{
3032	case DISQPV_TYPE_ADDRESS:
3033	GCPtrPar1 = param1.val.val64;
3034	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
3035
3036	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
3037	AssertRCReturn(rc, VERR_EM_INTERPRETER);
3038	break;
3039
3040	default:
3041	return VERR_EM_INTERPRETER;
3042	}
3043
3044	LogFlow(("%s %RGv rax=%RX64 %RX64\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar));
3045
3046	#ifndef VBOX_COMPARE_IEM_AND_EM
3047	if (pDis->fPrefix & DISPREFIX_LOCK)
3048	eflags = EMEmulateLockCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
3049	else
3050	eflags = EMEmulateCmpXchg(pvParam1, &pRegFrame->rax, valpar, pDis->Param2.cb);
3051	#else /* VBOX_COMPARE_IEM_AND_EM */
3052	uint64_t u64;
3053	switch (pDis->Param2.cb)
3054	{
3055	case 1: u64 = (uint8_t )pvParam1; break;
3056	case 2: u64 = (uint16_t )pvParam1; break;
3057	case 4: u64 = (uint32_t )pvParam1; break;
3058	default:
3059	case 8: u64 = (uint64_t )pvParam1; break;
3060	}
3061	eflags = EMEmulateCmpXchg(&u64, &pRegFrame->rax, valpar, pDis->Param2.cb);
3062	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, pDis->Param2.cb); AssertRCSuccess(rc2);
3063	#endif /* VBOX_COMPARE_IEM_AND_EM */
3064
3065	LogFlow(("%s %RGv rax=%RX64 %RX64 ZF=%d\n", emGetMnemonic(pDis), GCPtrPar1, pRegFrame->rax, valpar, !!(eflags & X86_EFL_ZF)));
3066
3067	/* Update guest's eflags and finish. */
3068	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
3069	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
3070
3071	*pcbSize = param2.size;
3072	PGMPhysReleasePageMappingLock(pVM, &Lock);
3073	return VINF_SUCCESS;
3074	}
3075
3076
3077	/**
3078	* [LOCK] CMPXCHG8B emulation.
3079	*/
3080	static int emInterpretCmpXchg8b(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3081	{
3082	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
3083	DISQPVPARAMVAL param1;
3084	NOREF(pvFault);
3085
3086	/* Source to make DISQueryParamVal read the register value - ugly hack */
3087	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3088	if(RT_FAILURE(rc))
3089	return VERR_EM_INTERPRETER;
3090
3091	RTGCPTR GCPtrPar1;
3092	void *pvParam1;
3093	uint64_t eflags;
3094	PGMPAGEMAPLOCK Lock;
3095
3096	AssertReturn(pDis->Param1.cb == 8, VERR_EM_INTERPRETER);
3097	switch(param1.type)
3098	{
3099	case DISQPV_TYPE_ADDRESS:
3100	GCPtrPar1 = param1.val.val64;
3101	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, GCPtrPar1);
3102
3103	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
3104	AssertRCReturn(rc, VERR_EM_INTERPRETER);
3105	break;
3106
3107	default:
3108	return VERR_EM_INTERPRETER;
3109	}
3110
3111	LogFlow(("%s %RGv=%08x eax=%08x\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax));
3112
3113	#ifndef VBOX_COMPARE_IEM_AND_EM
3114	if (pDis->fPrefix & DISPREFIX_LOCK)
3115	eflags = EMEmulateLockCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
3116	else
3117	eflags = EMEmulateCmpXchg8b(pvParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
3118	#else /* VBOX_COMPARE_IEM_AND_EM */
3119	uint64_t u64 = (uint64_t )pvParam1;
3120	eflags = EMEmulateCmpXchg8b(&u64, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx);
3121	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, sizeof(u64)); AssertRCSuccess(rc2);
3122	#endif /* VBOX_COMPARE_IEM_AND_EM */
3123
3124	LogFlow(("%s %RGv=%08x eax=%08x ZF=%d\n", emGetMnemonic(pDis), pvParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
3125
3126	/* Update guest's eflags and finish; note that only ZF is affected. */
3127	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
3128	\| (eflags & (X86_EFL_ZF));
3129
3130	*pcbSize = 8;
3131	PGMPhysReleasePageMappingLock(pVM, &Lock);
3132	return VINF_SUCCESS;
3133	}
3134
3135
3136	#ifdef IN_RC /** @todo test+enable for HM as well. */
3137	/**
3138	* [LOCK] XADD emulation.
3139	*/
3140	static int emInterpretXAdd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3141	{
3142	Assert(pDis->uCpuMode != DISCPUMODE_64BIT); /** @todo check */
3143	DISQPVPARAMVAL param1;
3144	void *pvParamReg2;
3145	size_t cbParamReg2;
3146	NOREF(pvFault);
3147
3148	/* Source to make DISQueryParamVal read the register value - ugly hack */
3149	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3150	if(RT_FAILURE(rc))
3151	return VERR_EM_INTERPRETER;
3152
3153	rc = DISQueryParamRegPtr(pRegFrame, pDis, &pDis->Param2, &pvParamReg2, &cbParamReg2);
3154	Assert(cbParamReg2 <= 4);
3155	if(RT_FAILURE(rc))
3156	return VERR_EM_INTERPRETER;
3157
3158	#ifdef IN_RC
3159	if (TRPMHasTrap(pVCpu))
3160	{
3161	if (TRPMGetErrorCode(pVCpu) & X86_TRAP_PF_RW)
3162	{
3163	#endif
3164	RTGCPTR GCPtrPar1;
3165	void *pvParam1;
3166	uint32_t eflags;
3167	PGMPAGEMAPLOCK Lock;
3168
3169	AssertReturn(pDis->Param1.cb == pDis->Param2.cb, VERR_EM_INTERPRETER);
3170	switch(param1.type)
3171	{
3172	case DISQPV_TYPE_ADDRESS:
3173	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, (RTRCUINTPTR)param1.val.val64);
3174	#ifdef IN_RC
3175	EM_ASSERT_FAULT_RETURN(GCPtrPar1 == pvFault, VERR_EM_INTERPRETER);
3176	#endif
3177
3178	rc = PGMPhysGCPtr2CCPtr(pVCpu, GCPtrPar1, &pvParam1, &Lock);
3179	AssertRCReturn(rc, VERR_EM_INTERPRETER);
3180	break;
3181
3182	default:
3183	return VERR_EM_INTERPRETER;
3184	}
3185
3186	LogFlow(("XAdd %RGv=%p reg=%08llx\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2));
3187
3188	#ifndef VBOX_COMPARE_IEM_AND_EM
3189	if (pDis->fPrefix & DISPREFIX_LOCK)
3190	eflags = EMEmulateLockXAdd(pvParam1, pvParamReg2, cbParamReg2);
3191	else
3192	eflags = EMEmulateXAdd(pvParam1, pvParamReg2, cbParamReg2);
3193	#else /* VBOX_COMPARE_IEM_AND_EM */
3194	uint64_t u64;
3195	switch (cbParamReg2)
3196	{
3197	case 1: u64 = (uint8_t )pvParam1; break;
3198	case 2: u64 = (uint16_t )pvParam1; break;
3199	case 4: u64 = (uint32_t )pvParam1; break;
3200	default:
3201	case 8: u64 = (uint64_t )pvParam1; break;
3202	}
3203	eflags = EMEmulateXAdd(&u64, pvParamReg2, cbParamReg2);
3204	int rc2 = emRamWrite(pVM, pVCpu, pRegFrame, GCPtrPar1, &u64, pDis->Param2.cb); AssertRCSuccess(rc2);
3205	#endif /* VBOX_COMPARE_IEM_AND_EM */
3206
3207	LogFlow(("XAdd %RGv=%p reg=%08llx ZF=%d\n", GCPtrPar1, pvParam1, (uint64_t )pvParamReg2, !!(eflags & X86_EFL_ZF) ));
3208
3209	/* Update guest's eflags and finish. */
3210	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
3211	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
3212
3213	*pcbSize = cbParamReg2;
3214	PGMPhysReleasePageMappingLock(pVM, &Lock);
3215	return VINF_SUCCESS;
3216	#ifdef IN_RC
3217	}
3218	}
3219
3220	return VERR_EM_INTERPRETER;
3221	#endif
3222	}
3223	#endif /* IN_RC */
3224
3225
3226	/**
3227	* WBINVD Emulation.
3228	*/
3229	static int emInterpretWbInvd(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3230	{
3231	/* Nothing to do. */
3232	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3233	return VINF_SUCCESS;
3234	}
3235
3236
3237	/**
3238	* INVLPG Emulation.
3239	*/
3240	static VBOXSTRICTRC emInterpretInvlPg(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3241	{
3242	DISQPVPARAMVAL param1;
3243	RTGCPTR addr;
3244	NOREF(pvFault); NOREF(pVM); NOREF(pcbSize);
3245
3246	VBOXSTRICTRC rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3247	if(RT_FAILURE(rc))
3248	return VERR_EM_INTERPRETER;
3249
3250	switch(param1.type)
3251	{
3252	case DISQPV_TYPE_IMMEDIATE:
3253	case DISQPV_TYPE_ADDRESS:
3254	if(!(param1.flags & (DISQPV_FLAG_32\|DISQPV_FLAG_64)))
3255	return VERR_EM_INTERPRETER;
3256	addr = (RTGCPTR)param1.val.val64;
3257	break;
3258
3259	default:
3260	return VERR_EM_INTERPRETER;
3261	}
3262
3263	/** @todo is addr always a flat linear address or ds based
3264	* (in absence of segment override prefixes)????
3265	*/
3266	#ifdef IN_RC
3267	LogFlow(("RC: EMULATE: invlpg %RGv\n", addr));
3268	#endif
3269	rc = PGMInvalidatePage(pVCpu, addr);
3270	if ( rc == VINF_SUCCESS
3271	\|\| rc == VINF_PGM_SYNC_CR3 /* we can rely on the FF */)
3272	return VINF_SUCCESS;
3273	AssertMsgReturn(rc == VINF_EM_RAW_EMULATE_INSTR,
3274	("%Rrc addr=%RGv\n", VBOXSTRICTRC_VAL(rc), addr),
3275	VERR_EM_INTERPRETER);
3276	return rc;
3277	}
3278
3279	/** @todo change all these EMInterpretXXX methods to VBOXSTRICTRC. */
3280
3281	/**
3282	* CPUID Emulation.
3283	*/
3284	static int emInterpretCpuId(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3285	{
3286	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3287	int rc = EMInterpretCpuId(pVM, pVCpu, pRegFrame);
3288	return rc;
3289	}
3290
3291
3292	/**
3293	* CLTS Emulation.
3294	*/
3295	static int emInterpretClts(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3296	{
3297	NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3298	return EMInterpretCLTS(pVM, pVCpu);
3299	}
3300
3301
3302	/**
3303	* LMSW Emulation.
3304	*/
3305	static int emInterpretLmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3306	{
3307	DISQPVPARAMVAL param1;
3308	uint32_t val;
3309	NOREF(pvFault); NOREF(pcbSize);
3310
3311	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3312	if(RT_FAILURE(rc))
3313	return VERR_EM_INTERPRETER;
3314
3315	switch(param1.type)
3316	{
3317	case DISQPV_TYPE_IMMEDIATE:
3318	case DISQPV_TYPE_ADDRESS:
3319	if(!(param1.flags & DISQPV_FLAG_16))
3320	return VERR_EM_INTERPRETER;
3321	val = param1.val.val32;
3322	break;
3323
3324	default:
3325	return VERR_EM_INTERPRETER;
3326	}
3327
3328	LogFlow(("emInterpretLmsw %x\n", val));
3329	return EMInterpretLMSW(pVM, pVCpu, pRegFrame, val);
3330	}
3331
3332	#ifdef EM_EMULATE_SMSW
3333	/**
3334	* SMSW Emulation.
3335	*/
3336	static int emInterpretSmsw(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3337	{
3338	DISQPVPARAMVAL param1;
3339	uint64_t cr0 = CPUMGetGuestCR0(pVCpu);
3340
3341	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3342	if(RT_FAILURE(rc))
3343	return VERR_EM_INTERPRETER;
3344
3345	switch(param1.type)
3346	{
3347	case DISQPV_TYPE_IMMEDIATE:
3348	if(param1.size != sizeof(uint16_t))
3349	return VERR_EM_INTERPRETER;
3350	LogFlow(("emInterpretSmsw %d <- cr0 (%x)\n", pDis->Param1.Base.idxGenReg, cr0));
3351	rc = DISWriteReg16(pRegFrame, pDis->Param1.Base.idxGenReg, cr0);
3352	break;
3353
3354	case DISQPV_TYPE_ADDRESS:
3355	{
3356	RTGCPTR pParam1;
3357
3358	/* Actually forced to 16 bits regardless of the operand size. */
3359	if(param1.size != sizeof(uint16_t))
3360	return VERR_EM_INTERPRETER;
3361
3362	pParam1 = (RTGCPTR)param1.val.val64;
3363	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, pParam1);
3364	LogFlow(("emInterpretSmsw %RGv <- cr0 (%x)\n", pParam1, cr0));
3365
3366	rc = emRamWrite(pVM, pVCpu, pRegFrame, pParam1, &cr0, sizeof(uint16_t));
3367	if (RT_FAILURE(rc))
3368	{
3369	AssertMsgFailed(("emRamWrite %RGv size=%d failed with %Rrc\n", pParam1, param1.size, rc));
3370	return VERR_EM_INTERPRETER;
3371	}
3372	break;
3373	}
3374
3375	default:
3376	return VERR_EM_INTERPRETER;
3377	}
3378
3379	LogFlow(("emInterpretSmsw %x\n", cr0));
3380	return rc;
3381	}
3382	#endif
3383
3384	/**
3385	* MOV CRx
3386	*/
3387	static int emInterpretMovCRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3388	{
3389	NOREF(pvFault); NOREF(pcbSize);
3390	if ((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_CR)
3391	return EMInterpretCRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxCtrlReg);
3392
3393	if (pDis->Param1.fUse == DISUSE_REG_CR && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
3394	return EMInterpretCRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxCtrlReg, pDis->Param2.Base.idxGenReg);
3395
3396	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
3397	}
3398
3399
3400	/**
3401	* MOV DRx
3402	*/
3403	static int emInterpretMovDRx(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3404	{
3405	int rc = VERR_EM_INTERPRETER;
3406	NOREF(pvFault); NOREF(pcbSize);
3407
3408	if((pDis->Param1.fUse == DISUSE_REG_GEN32 \|\| pDis->Param1.fUse == DISUSE_REG_GEN64) && pDis->Param2.fUse == DISUSE_REG_DBG)
3409	{
3410	rc = EMInterpretDRxRead(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxGenReg, pDis->Param2.Base.idxDbgReg);
3411	}
3412	else
3413	if(pDis->Param1.fUse == DISUSE_REG_DBG && (pDis->Param2.fUse == DISUSE_REG_GEN32 \|\| pDis->Param2.fUse == DISUSE_REG_GEN64))
3414	{
3415	rc = EMInterpretDRxWrite(pVM, pVCpu, pRegFrame, pDis->Param1.Base.idxDbgReg, pDis->Param2.Base.idxGenReg);
3416	}
3417	else
3418	AssertMsgFailed(("Unexpected debug register move\n"));
3419
3420	return rc;
3421	}
3422
3423
3424	/**
3425	* LLDT Emulation.
3426	*/
3427	static int emInterpretLLdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3428	{
3429	DISQPVPARAMVAL param1;
3430	RTSEL sel;
3431	NOREF(pVM); NOREF(pvFault); NOREF(pcbSize);
3432
3433	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3434	if(RT_FAILURE(rc))
3435	return VERR_EM_INTERPRETER;
3436
3437	switch(param1.type)
3438	{
3439	case DISQPV_TYPE_ADDRESS:
3440	return VERR_EM_INTERPRETER; //feeling lazy right now
3441
3442	case DISQPV_TYPE_IMMEDIATE:
3443	if(!(param1.flags & DISQPV_FLAG_16))
3444	return VERR_EM_INTERPRETER;
3445	sel = (RTSEL)param1.val.val16;
3446	break;
3447
3448	default:
3449	return VERR_EM_INTERPRETER;
3450	}
3451
3452	#ifdef IN_RING0
3453	/* Only for the VT-x real-mode emulation case. */
3454	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
3455	CPUMSetGuestLDTR(pVCpu, sel);
3456	return VINF_SUCCESS;
3457	#else
3458	if (sel == 0)
3459	{
3460	if (CPUMGetHyperLDTR(pVCpu) == 0)
3461	{
3462	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
3463	return VINF_SUCCESS;
3464	}
3465	}
3466	//still feeling lazy
3467	return VERR_EM_INTERPRETER;
3468	#endif
3469	}
3470
3471	#ifdef IN_RING0
3472	/**
3473	* LIDT/LGDT Emulation.
3474	*/
3475	static int emInterpretLIGdt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3476	{
3477	DISQPVPARAMVAL param1;
3478	RTGCPTR pParam1;
3479	X86XDTR32 dtr32;
3480	NOREF(pvFault); NOREF(pcbSize);
3481
3482	Log(("Emulate %s at %RGv\n", emGetMnemonic(pDis), (RTGCPTR)pRegFrame->rip));
3483
3484	/* Only for the VT-x real-mode emulation case. */
3485	AssertReturn(CPUMIsGuestInRealMode(pVCpu), VERR_EM_INTERPRETER);
3486
3487	int rc = DISQueryParamVal(pRegFrame, pDis, &pDis->Param1, &param1, DISQPVWHICH_SRC);
3488	if(RT_FAILURE(rc))
3489	return VERR_EM_INTERPRETER;
3490
3491	switch(param1.type)
3492	{
3493	case DISQPV_TYPE_ADDRESS:
3494	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pDis, &pDis->Param1, param1.val.val16);
3495	break;
3496
3497	default:
3498	return VERR_EM_INTERPRETER;
3499	}
3500
3501	rc = emRamRead(pVM, pVCpu, pRegFrame, &dtr32, pParam1, sizeof(dtr32));
3502	AssertRCReturn(rc, VERR_EM_INTERPRETER);
3503
3504	if (!(pDis->fPrefix & DISPREFIX_OPSIZE))
3505	dtr32.uAddr &= 0xffffff; /* 16 bits operand size */
3506
3507	if (pDis->pCurInstr->uOpcode == OP_LIDT)
3508	CPUMSetGuestIDTR(pVCpu, dtr32.uAddr, dtr32.cb);
3509	else
3510	CPUMSetGuestGDTR(pVCpu, dtr32.uAddr, dtr32.cb);
3511
3512	return VINF_SUCCESS;
3513	}
3514	#endif
3515
3516
3517	#ifdef IN_RC
3518	/**
3519	* STI Emulation.
3520	*
3521	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
3522	*/
3523	static int emInterpretSti(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3524	{
3525	NOREF(pcbSize);
3526	PPATMGCSTATE pGCState = PATMGetGCState(pVM);
3527
3528	if(!pGCState)
3529	{
3530	Assert(pGCState);
3531	return VERR_EM_INTERPRETER;
3532	}
3533	pGCState->uVMFlags \|= X86_EFL_IF;
3534
3535	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
3536	Assert(pvFault == SELMToFlat(pVM, DISSELREG_CS, pRegFrame, (RTGCPTR)pRegFrame->rip));
3537
3538	pVCpu->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pDis->cbInstr;
3539	VMCPU_FF_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3540
3541	return VINF_SUCCESS;
3542	}
3543	#endif /* IN_RC */
3544
3545
3546	/**
3547	* HLT Emulation.
3548	*/
3549	static VBOXSTRICTRC
3550	emInterpretHlt(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3551	{
3552	NOREF(pVM); NOREF(pVCpu); NOREF(pDis); NOREF(pRegFrame); NOREF(pvFault); NOREF(pcbSize);
3553	return VINF_EM_HALT;
3554	}
3555
3556
3557	/**
3558	* RDTSC Emulation.
3559	*/
3560	static int emInterpretRdtsc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3561	{
3562	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3563	return EMInterpretRdtsc(pVM, pVCpu, pRegFrame);
3564	}
3565
3566	/**
3567	* RDPMC Emulation
3568	*/
3569	static int emInterpretRdpmc(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3570	{
3571	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3572	return EMInterpretRdpmc(pVM, pVCpu, pRegFrame);
3573	}
3574
3575
3576	static int emInterpretMonitor(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3577	{
3578	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3579	return EMInterpretMonitor(pVM, pVCpu, pRegFrame);
3580	}
3581
3582
3583	static VBOXSTRICTRC emInterpretMWait(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3584	{
3585	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3586	return EMInterpretMWait(pVM, pVCpu, pRegFrame);
3587	}
3588
3589
3590	/**
3591	* RDMSR Emulation.
3592	*/
3593	static int emInterpretRdmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3594	{
3595	/* Note: The Intel manual claims there's a REX version of RDMSR that's slightly
3596	different, so we play safe by completely disassembling the instruction. */
3597	Assert(!(pDis->fPrefix & DISPREFIX_REX));
3598	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3599	return EMInterpretRdmsr(pVM, pVCpu, pRegFrame);
3600	}
3601
3602
3603	/**
3604	* WRMSR Emulation.
3605	*/
3606	static int emInterpretWrmsr(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
3607	{
3608	NOREF(pDis); NOREF(pvFault); NOREF(pcbSize);
3609	return EMInterpretWrmsr(pVM, pVCpu, pRegFrame);
3610	}
3611
3612
3613	/**
3614	* Internal worker.
3615	* @copydoc emInterpretInstructionCPUOuter
3616	*/
3617	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPU(PVM pVM, PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3618	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3619	{
3620	Assert(pRegFrame == CPUMGetGuestCtxCore(pVCpu));
3621	Assert(enmCodeType == EMCODETYPE_SUPERVISOR \|\| enmCodeType == EMCODETYPE_ALL);
3622	Assert(pcbSize);
3623	*pcbSize = 0;
3624
3625	if (enmCodeType == EMCODETYPE_SUPERVISOR)
3626	{
3627	/*
3628	* Only supervisor guest code!!
3629	* And no complicated prefixes.
3630	*/
3631	/* Get the current privilege level. */
3632	uint32_t cpl = CPUMGetGuestCPL(pVCpu);
3633	#ifdef VBOX_WITH_RAW_RING1
3634	if ( !EMIsRawRing1Enabled(pVM)
3635	\|\| cpl > 1
3636	\|\| pRegFrame->eflags.Bits.u2IOPL > cpl
3637	)
3638	#endif
3639	{
3640	if ( cpl != 0
3641	&& pDis->pCurInstr->uOpcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
3642	{
3643	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
3644	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedUserMode));
3645	return VERR_EM_INTERPRETER;
3646	}
3647	}
3648	}
3649	else
3650	Log2(("emInterpretInstructionCPU allowed to interpret user-level code!!\n"));
3651
3652	#ifdef IN_RC
3653	if ( (pDis->fPrefix & (DISPREFIX_REPNE \| DISPREFIX_REP))
3654	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3655	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3656	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3657	&& pDis->pCurInstr->uOpcode != OP_XADD
3658	&& pDis->pCurInstr->uOpcode != OP_OR
3659	&& pDis->pCurInstr->uOpcode != OP_AND
3660	&& pDis->pCurInstr->uOpcode != OP_XOR
3661	&& pDis->pCurInstr->uOpcode != OP_BTR
3662	)
3663	)
3664	#else
3665	if ( (pDis->fPrefix & DISPREFIX_REPNE)
3666	\|\| ( (pDis->fPrefix & DISPREFIX_REP)
3667	&& pDis->pCurInstr->uOpcode != OP_STOSWD
3668	)
3669	\|\| ( (pDis->fPrefix & DISPREFIX_LOCK)
3670	&& pDis->pCurInstr->uOpcode != OP_OR
3671	&& pDis->pCurInstr->uOpcode != OP_AND
3672	&& pDis->pCurInstr->uOpcode != OP_XOR
3673	&& pDis->pCurInstr->uOpcode != OP_BTR
3674	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG
3675	&& pDis->pCurInstr->uOpcode != OP_CMPXCHG8B
3676	)
3677	)
3678	#endif
3679	{
3680	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
3681	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedPrefix));
3682	Log4(("EM: Refuse %u on REP/REPNE/LOCK prefix grounds\n", pDis->pCurInstr->uOpcode));
3683	return VERR_EM_INTERPRETER;
3684	}
3685
3686	#if HC_ARCH_BITS == 32
3687	/*
3688	* Unable to emulate most >4 bytes accesses in 32 bits mode.
3689	* Whitelisted instructions are safe.
3690	*/
3691	if ( pDis->Param1.cb > 4
3692	&& CPUMIsGuestIn64BitCode(pVCpu))
3693	{
3694	uint32_t uOpCode = pDis->pCurInstr->uOpcode;
3695	if ( uOpCode != OP_STOSWD
3696	&& uOpCode != OP_MOV
3697	&& uOpCode != OP_CMPXCHG8B
3698	&& uOpCode != OP_XCHG
3699	&& uOpCode != OP_BTS
3700	&& uOpCode != OP_BTR
3701	&& uOpCode != OP_BTC
3702	# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL_IN_R0
3703	&& uOpCode != OP_CMPXCHG /* solaris */
3704	&& uOpCode != OP_AND /* windows */
3705	&& uOpCode != OP_OR /* windows */
3706	&& uOpCode != OP_XOR /* because we can */
3707	&& uOpCode != OP_ADD /* windows (dripple) */
3708	&& uOpCode != OP_ADC /* because we can */
3709	&& uOpCode != OP_SUB /* because we can */
3710	/** @todo OP_BTS or is that a different kind of failure? */
3711	# endif
3712	)
3713	{
3714	# ifdef VBOX_WITH_STATISTICS
3715	switch (pDis->pCurInstr->uOpcode)
3716	{
3717	# define INTERPRET_FAILED_CASE(opcode, Instr) \
3718	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); break;
3719	INTERPRET_FAILED_CASE(OP_XCHG,Xchg);
3720	INTERPRET_FAILED_CASE(OP_DEC,Dec);
3721	INTERPRET_FAILED_CASE(OP_INC,Inc);
3722	INTERPRET_FAILED_CASE(OP_POP,Pop);
3723	INTERPRET_FAILED_CASE(OP_OR, Or);
3724	INTERPRET_FAILED_CASE(OP_XOR,Xor);
3725	INTERPRET_FAILED_CASE(OP_AND,And);
3726	INTERPRET_FAILED_CASE(OP_MOV,Mov);
3727	INTERPRET_FAILED_CASE(OP_STOSWD,StosWD);
3728	INTERPRET_FAILED_CASE(OP_INVLPG,InvlPg);
3729	INTERPRET_FAILED_CASE(OP_CPUID,CpuId);
3730	INTERPRET_FAILED_CASE(OP_MOV_CR,MovCRx);
3731	INTERPRET_FAILED_CASE(OP_MOV_DR,MovDRx);
3732	INTERPRET_FAILED_CASE(OP_LLDT,LLdt);
3733	INTERPRET_FAILED_CASE(OP_LIDT,LIdt);
3734	INTERPRET_FAILED_CASE(OP_LGDT,LGdt);
3735	INTERPRET_FAILED_CASE(OP_LMSW,Lmsw);
3736	INTERPRET_FAILED_CASE(OP_CLTS,Clts);
3737	INTERPRET_FAILED_CASE(OP_MONITOR,Monitor);
3738	INTERPRET_FAILED_CASE(OP_MWAIT,MWait);
3739	INTERPRET_FAILED_CASE(OP_RDMSR,Rdmsr);
3740	INTERPRET_FAILED_CASE(OP_WRMSR,Wrmsr);
3741	INTERPRET_FAILED_CASE(OP_ADD,Add);
3742	INTERPRET_FAILED_CASE(OP_SUB,Sub);
3743	INTERPRET_FAILED_CASE(OP_ADC,Adc);
3744	INTERPRET_FAILED_CASE(OP_BTR,Btr);
3745	INTERPRET_FAILED_CASE(OP_BTS,Bts);
3746	INTERPRET_FAILED_CASE(OP_BTC,Btc);
3747	INTERPRET_FAILED_CASE(OP_RDTSC,Rdtsc);
3748	INTERPRET_FAILED_CASE(OP_CMPXCHG, CmpXchg);
3749	INTERPRET_FAILED_CASE(OP_STI, Sti);
3750	INTERPRET_FAILED_CASE(OP_XADD,XAdd);
3751	INTERPRET_FAILED_CASE(OP_CMPXCHG8B,CmpXchg8b);
3752	INTERPRET_FAILED_CASE(OP_HLT, Hlt);
3753	INTERPRET_FAILED_CASE(OP_IRET,Iret);
3754	INTERPRET_FAILED_CASE(OP_WBINVD,WbInvd);
3755	INTERPRET_FAILED_CASE(OP_MOVNTPS,MovNTPS);
3756	# undef INTERPRET_FAILED_CASE
3757	default:
3758	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3759	break;
3760	}
3761	# endif /* VBOX_WITH_STATISTICS */
3762	Log4(("EM: Refuse %u on grounds of accessing %u bytes\n", pDis->pCurInstr->uOpcode, pDis->Param1.cb));
3763	return VERR_EM_INTERPRETER;
3764	}
3765	}
3766	#endif
3767
3768	VBOXSTRICTRC rc;
3769	#if (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
3770	LogFlow(("emInterpretInstructionCPU %s\n", emGetMnemonic(pDis)));
3771	#endif
3772	switch (pDis->pCurInstr->uOpcode)
3773	{
3774	/*
3775	* Macros for generating the right case statements.
3776	*/
3777	# ifndef VBOX_COMPARE_IEM_AND_EM
3778	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3779	case opcode:\
3780	if (pDis->fPrefix & DISPREFIX_LOCK) \
3781	rc = emInterpretLock##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
3782	else \
3783	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3784	if (RT_SUCCESS(rc)) \
3785	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3786	else \
3787	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3788	return rc
3789	# else /* VBOX_COMPARE_IEM_AND_EM */
3790	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3791	case opcode:\
3792	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3793	if (RT_SUCCESS(rc)) \
3794	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3795	else \
3796	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3797	return rc
3798	# endif /* VBOX_COMPARE_IEM_AND_EM */
3799
3800	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
3801	case opcode:\
3802	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize, pfnEmulate); \
3803	if (RT_SUCCESS(rc)) \
3804	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3805	else \
3806	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3807	return rc
3808
3809	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
3810	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
3811	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
3812	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
3813
3814	#define INTERPRET_CASE(opcode, Instr) \
3815	case opcode:\
3816	rc = emInterpret##Instr(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3817	if (RT_SUCCESS(rc)) \
3818	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3819	else \
3820	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3821	return rc
3822
3823	#define INTERPRET_CASE_EX_DUAL_PARAM2(opcode, Instr, InstrFn) \
3824	case opcode:\
3825	rc = emInterpret##InstrFn(pVM, pVCpu, pDis, pRegFrame, pvFault, pcbSize); \
3826	if (RT_SUCCESS(rc)) \
3827	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Instr)); \
3828	else \
3829	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); \
3830	return rc
3831
3832	#define INTERPRET_STAT_CASE(opcode, Instr) \
3833	case opcode: STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
3834
3835	/*
3836	* The actual case statements.
3837	*/
3838	INTERPRET_CASE(OP_XCHG,Xchg);
3839	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
3840	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
3841	INTERPRET_CASE(OP_POP,Pop);
3842	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
3843	INTERPRET_CASE_EX_LOCK_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor, EMEmulateLockXor);
3844	INTERPRET_CASE_EX_LOCK_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd, EMEmulateLockAnd);
3845	INTERPRET_CASE(OP_MOV,Mov);
3846	#ifndef IN_RC
3847	INTERPRET_CASE(OP_STOSWD,StosWD);
3848	#endif
3849	INTERPRET_CASE(OP_INVLPG,InvlPg);
3850	INTERPRET_CASE(OP_CPUID,CpuId);
3851	INTERPRET_CASE(OP_MOV_CR,MovCRx);
3852	INTERPRET_CASE(OP_MOV_DR,MovDRx);
3853	#ifdef IN_RING0
3854	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LIDT, LIdt, LIGdt);
3855	INTERPRET_CASE_EX_DUAL_PARAM2(OP_LGDT, LGdt, LIGdt);
3856	#endif
3857	INTERPRET_CASE(OP_LLDT,LLdt);
3858	INTERPRET_CASE(OP_LMSW,Lmsw);
3859	#ifdef EM_EMULATE_SMSW
3860	INTERPRET_CASE(OP_SMSW,Smsw);
3861	#endif
3862	INTERPRET_CASE(OP_CLTS,Clts);
3863	INTERPRET_CASE(OP_MONITOR, Monitor);
3864	INTERPRET_CASE(OP_MWAIT, MWait);
3865	INTERPRET_CASE(OP_RDMSR, Rdmsr);
3866	INTERPRET_CASE(OP_WRMSR, Wrmsr);
3867	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
3868	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
3869	INTERPRET_CASE(OP_ADC,Adc);
3870	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
3871	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
3872	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
3873	INTERPRET_CASE(OP_RDPMC,Rdpmc);
3874	INTERPRET_CASE(OP_RDTSC,Rdtsc);
3875	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
3876	#ifdef IN_RC
3877	INTERPRET_CASE(OP_STI,Sti);
3878	INTERPRET_CASE(OP_XADD, XAdd);
3879	INTERPRET_CASE(OP_IRET,Iret);
3880	#endif
3881	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
3882	INTERPRET_CASE(OP_HLT,Hlt);
3883	INTERPRET_CASE(OP_WBINVD,WbInvd);
3884	#ifdef VBOX_WITH_STATISTICS
3885	# ifndef IN_RC
3886	INTERPRET_STAT_CASE(OP_XADD, XAdd);
3887	# endif
3888	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
3889	#endif
3890
3891	default:
3892	Log3(("emInterpretInstructionCPU: opcode=%d\n", pDis->pCurInstr->uOpcode));
3893	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,FailedMisc));
3894	return VERR_EM_INTERPRETER;
3895
3896	#undef INTERPRET_CASE_EX_PARAM2
3897	#undef INTERPRET_STAT_CASE
3898	#undef INTERPRET_CASE_EX
3899	#undef INTERPRET_CASE
3900	} /* switch (opcode) */
3901	/* not reached */
3902	}
3903
3904	/**
3905	* Interprets the current instruction using the supplied DISCPUSTATE structure.
3906	*
3907	* EIP is NOT updated!
3908	*
3909	* @returns VBox strict status code.
3910	* @retval VINF_* Scheduling instructions. When these are returned, it
3911	* starts to get a bit tricky to know whether code was
3912	* executed or not... We'll address this when it becomes a problem.
3913	* @retval VERR_EM_INTERPRETER Something we can't cope with.
3914	* @retval VERR_* Fatal errors.
3915	*
3916	* @param pVCpu Pointer to the VMCPU.
3917	* @param pDis The disassembler cpu state for the instruction to be
3918	* interpreted.
3919	* @param pRegFrame The register frame. EIP is NOT changed!
3920	* @param pvFault The fault address (CR2).
3921	* @param pcbSize Size of the write (if applicable).
3922	* @param enmCodeType Code type (user/supervisor)
3923	*
3924	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
3925	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
3926	* to worry about e.g. invalid modrm combinations (!)
3927	*
3928	* @todo At this time we do NOT check if the instruction overwrites vital information.
3929	* Make sure this can't happen!! (will add some assertions/checks later)
3930	*/
3931	DECLINLINE(VBOXSTRICTRC) emInterpretInstructionCPUOuter(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTXCORE pRegFrame,
3932	RTGCPTR pvFault, EMCODETYPE enmCodeType, uint32_t *pcbSize)
3933	{
3934	STAM_PROFILE_START(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3935	VBOXSTRICTRC rc = emInterpretInstructionCPU(pVCpu->CTX_SUFF(pVM), pVCpu, pDis, pRegFrame, pvFault, enmCodeType, pcbSize);
3936	STAM_PROFILE_STOP(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,Emulate), a);
3937	if (RT_SUCCESS(rc))
3938	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretSucceeded));
3939	else
3940	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,InterpretFailed));
3941	return rc;
3942	}
3943
3944
3945	#endif /* !VBOX_WITH_IEM */

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 47681

Download in other formats: