EMAll.cpp@ 9300

Last change on this file since 9300 was 9300, checked in by vboxsync, 17 years ago
More 64 bits guest ptr fixes
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 80.5 KB

Line
1	/* $Id: EMAll.cpp 9300 2008-06-02 13:30:12Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor(/Manager) - All contexts
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_EM
27	#include <VBox/em.h>
28	#include <VBox/mm.h>
29	#include <VBox/selm.h>
30	#include <VBox/patm.h>
31	#include <VBox/csam.h>
32	#include <VBox/pgm.h>
33	#include <VBox/iom.h>
34	#include <VBox/stam.h>
35	#include "EMInternal.h"
36	#include <VBox/vm.h>
37	#include <VBox/hwaccm.h>
38	#include <VBox/tm.h>
39	#include <VBox/pdmapi.h>
40
41	#include <VBox/param.h>
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <iprt/assert.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Structures and Typedefs *
53	*******************************************************************************/
54	typedef DECLCALLBACK(uint32_t) PFN_EMULATE_PARAM2_UINT32(uint32_t *pu32Param1, uint32_t val2);
55	typedef DECLCALLBACK(uint32_t) PFN_EMULATE_PARAM2(uint32_t *pu32Param1, size_t val2);
56	typedef DECLCALLBACK(uint32_t) PFN_EMULATE_PARAM3(uint32_t *pu32Param1, uint32_t val2, size_t val3);
57	typedef DECLCALLBACK(int) FNEMULATELOCKPARAM2(RTGCPTR GCPtrParam1, RTGCUINTREG Val2, RTGCUINTREG32 *pf);
58	typedef FNEMULATELOCKPARAM2 *PFNEMULATELOCKPARAM2;
59	typedef DECLCALLBACK(int) FNEMULATELOCKPARAM3(RTGCPTR GCPtrParam1, RTGCUINTREG Val2, size_t cb, RTGCUINTREG32 *pf);
60	typedef FNEMULATELOCKPARAM3 *PFNEMULATELOCKPARAM3;
61
62
63	/*******************************************************************************
64	* Internal Functions *
65	*******************************************************************************/
66	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize);
67
68
69	/**
70	* Get the current execution manager status.
71	*
72	* @returns Current status.
73	*/
74	EMDECL(EMSTATE) EMGetState(PVM pVM)
75	{
76	return pVM->em.s.enmState;
77	}
78
79
80	#ifndef IN_GC
81	/**
82	* Read callback for disassembly function; supports reading bytes that cross a page boundary
83	*
84	* @returns VBox status code.
85	* @param pSrc GC source pointer
86	* @param pDest HC destination pointer
87	* @param cb Number of bytes to read
88	* @param dwUserdata Callback specific user data (pCpu)
89	*
90	*/
91	DECLCALLBACK(int) EMReadBytes(RTUINTPTR pSrc, uint8_t pDest, unsigned cb, void pvUserdata)
92	{
93	DISCPUSTATE pCpu = (DISCPUSTATE )pvUserdata;
94	PVM pVM = (PVM)pCpu->apvUserData[0];
95	#ifdef IN_RING0
96	int rc = PGMPhysReadGCPtr(pVM, pDest, pSrc, cb);
97	AssertRC(rc);
98	#else
99	if (!PATMIsPatchGCAddr(pVM, pSrc))
100	{
101	int rc = PGMPhysReadGCPtr(pVM, pDest, pSrc, cb);
102	AssertRC(rc);
103	}
104	else
105	{
106	for (uint32_t i = 0; i < cb; i++)
107	{
108	uint8_t opcode;
109	if (VBOX_SUCCESS(PATMR3QueryOpcode(pVM, (RTGCPTR)pSrc + i, &opcode)))
110	{
111	*(pDest+i) = opcode;
112	}
113	}
114	}
115	#endif /* IN_RING0 */
116	return VINF_SUCCESS;
117	}
118
119	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
120	{
121	return DISCoreOneEx(InstrGC, pCpu->mode, EMReadBytes, pVM, pCpu, pOpsize);
122	}
123
124	#else
125
126	DECLINLINE(int) emDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
127	{
128	return DISCoreOne(pCpu, InstrGC, pOpsize);
129	}
130
131	#endif
132
133
134	/**
135	* Disassembles one instruction.
136	*
137	* @param pVM The VM handle.
138	* @param pCtxCore The context core (used for both the mode and instruction).
139	* @param pCpu Where to return the parsed instruction info.
140	* @param pcbInstr Where to return the instruction size. (optional)
141	*/
142	EMDECL(int) EMInterpretDisasOne(PVM pVM, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
143	{
144	RTGCPTR GCPtrInstr;
145	int rc = SELMValidateAndConvertCSAddr(pVM, pCtxCore->eflags, pCtxCore->ss, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid, (RTGCPTR)pCtxCore->eip, &GCPtrInstr);
146	if (VBOX_FAILURE(rc))
147	{
148	Log(("EMInterpretDisasOne: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Vrc !!\n",
149	pCtxCore->cs, pCtxCore->eip, pCtxCore->ss & X86_SEL_RPL, rc));
150	return rc;
151	}
152	return EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)GCPtrInstr, pCtxCore, pCpu, pcbInstr);
153	}
154
155
156	/**
157	* Disassembles one instruction.
158	*
159	* This is used by internally by the interpreter and by trap/access handlers.
160	*
161	* @param pVM The VM handle.
162	* @param GCPtrInstr The flat address of the instruction.
163	* @param pCtxCore The context core (used to determin the cpu mode).
164	* @param pCpu Where to return the parsed instruction info.
165	* @param pcbInstr Where to return the instruction size. (optional)
166	*/
167	EMDECL(int) EMInterpretDisasOneEx(PVM pVM, RTGCUINTPTR GCPtrInstr, PCCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, unsigned *pcbInstr)
168	{
169	int rc = DISCoreOneEx(GCPtrInstr, SELMIsSelector32Bit(pVM, pCtxCore->eflags, pCtxCore->cs, (PCPUMSELREGHID)&pCtxCore->csHid) ? CPUMODE_32BIT : CPUMODE_16BIT,
170	#ifdef IN_GC
171	NULL, NULL,
172	#else
173	EMReadBytes, pVM,
174	#endif
175	pCpu, pcbInstr);
176	if (VBOX_SUCCESS(rc))
177	return VINF_SUCCESS;
178	AssertMsgFailed(("DISCoreOne failed to GCPtrInstr=%VGv rc=%Vrc\n", GCPtrInstr, rc));
179	return VERR_INTERNAL_ERROR;
180	}
181
182
183	/**
184	* Interprets the current instruction.
185	*
186	* @returns VBox status code.
187	* @retval VINF_* Scheduling instructions.
188	* @retval VERR_EM_INTERPRETER Something we can't cope with.
189	* @retval VERR_* Fatal errors.
190	*
191	* @param pVM The VM handle.
192	* @param pRegFrame The register frame.
193	* Updates the EIP if an instruction was executed successfully.
194	* @param pvFault The fault address (CR2).
195	* @param pcbSize Size of the write (if applicable).
196	*
197	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
198	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
199	* to worry about e.g. invalid modrm combinations (!)
200	*/
201	EMDECL(int) EMInterpretInstruction(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
202	{
203	RTGCPTR pbCode;
204
205	LogFlow(("EMInterpretInstruction %VRv fault %VGv\n", pRegFrame->eip, pvFault));
206	int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &pbCode);
207	if (VBOX_SUCCESS(rc))
208	{
209	uint32_t cbOp;
210	DISCPUSTATE Cpu;
211	Cpu.mode = SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) ? CPUMODE_32BIT : CPUMODE_16BIT;
212	rc = emDisCoreOne(pVM, &Cpu, (RTGCUINTPTR)pbCode, &cbOp);
213	if (VBOX_SUCCESS(rc))
214	{
215	Assert(cbOp == Cpu.opsize);
216	rc = EMInterpretInstructionCPU(pVM, &Cpu, pRegFrame, pvFault, pcbSize);
217	if (VBOX_SUCCESS(rc))
218	{
219	pRegFrame->eip += cbOp; /* Move on to the next instruction. */
220	}
221	return rc;
222	}
223	}
224	return VERR_EM_INTERPRETER;
225	}
226
227	/**
228	* Interprets the current instruction using the supplied DISCPUSTATE structure.
229	*
230	* EIP is NOT updated!
231	*
232	* @returns VBox status code.
233	* @retval VINF_* Scheduling instructions. When these are returned, it
234	* starts to get a bit tricky to know whether code was
235	* executed or not... We'll address this when it becomes a problem.
236	* @retval VERR_EM_INTERPRETER Something we can't cope with.
237	* @retval VERR_* Fatal errors.
238	*
239	* @param pVM The VM handle.
240	* @param pCpu The disassembler cpu state for the instruction to be interpreted.
241	* @param pRegFrame The register frame. EIP is NOT changed!
242	* @param pvFault The fault address (CR2).
243	* @param pcbSize Size of the write (if applicable).
244	*
245	* @remark Invalid opcode exceptions have a higher priority than GP (see Intel
246	* Architecture System Developers Manual, Vol 3, 5.5) so we don't need
247	* to worry about e.g. invalid modrm combinations (!)
248	*
249	* @todo At this time we do NOT check if the instruction overwrites vital information.
250	* Make sure this can't happen!! (will add some assertions/checks later)
251	*/
252	EMDECL(int) EMInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
253	{
254	STAM_PROFILE_START(&CTXMID(pVM->em.s.CTXSUFF(pStats)->Stat,Emulate), a);
255	int rc = emInterpretInstructionCPU(pVM, pCpu, pRegFrame, pvFault, pcbSize);
256	STAM_PROFILE_STOP(&CTXMID(pVM->em.s.CTXSUFF(pStats)->Stat,Emulate), a);
257	if (VBOX_SUCCESS(rc))
258	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,InterpretSucceeded));
259	else
260	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,InterpretFailed));
261	return rc;
262	}
263
264
265	/**
266	* Interpret a port I/O instruction.
267	*
268	* @returns VBox status code suitable for scheduling.
269	* @param pVM The VM handle.
270	* @param pCtxCore The context core. This will be updated on successful return.
271	* @param pCpu The instruction to interpret.
272	* @param cbOp The size of the instruction.
273	* @remark This may raise exceptions.
274	*/
275	EMDECL(int) EMInterpretPortIO(PVM pVM, PCPUMCTXCORE pCtxCore, PDISCPUSTATE pCpu, uint32_t cbOp)
276	{
277	/*
278	* Hand it on to IOM.
279	*/
280	#ifdef IN_GC
281	int rc = IOMGCIOPortHandler(pVM, pCtxCore, pCpu);
282	if (IOM_SUCCESS(rc))
283	pCtxCore->eip += cbOp;
284	return rc;
285	#else
286	AssertReleaseMsgFailed(("not implemented\n"));
287	return VERR_NOT_IMPLEMENTED;
288	#endif
289	}
290
291
292	DECLINLINE(int) emRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
293	{
294	#ifdef IN_GC
295	int rc = MMGCRamRead(pVM, pDest, (void *)GCSrc, cb);
296	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
297	return rc;
298	/*
299	* The page pool cache may end up here in some cases because it
300	* flushed one of the shadow mappings used by the trapping
301	* instruction and it either flushed the TLB or the CPU reused it.
302	*/
303	RTGCPHYS GCPhys;
304	rc = PGMPhysGCPtr2GCPhys(pVM, GCSrc, &GCPhys);
305	AssertRCReturn(rc, rc);
306	PGMPhysRead(pVM, GCPhys, pDest, cb);
307	return VINF_SUCCESS;
308	#else
309	return PGMPhysReadGCPtrSafe(pVM, pDest, GCSrc, cb);
310	#endif
311	}
312
313	DECLINLINE(int) emRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
314	{
315	#ifdef IN_GC
316	int rc = MMGCRamWrite(pVM, (void *)GCDest, pSrc, cb);
317	if (RT_LIKELY(rc != VERR_ACCESS_DENIED))
318	return rc;
319	/*
320	* The page pool cache may end up here in some cases because it
321	* flushed one of the shadow mappings used by the trapping
322	* instruction and it either flushed the TLB or the CPU reused it.
323	* We want to play safe here, verifying that we've got write
324	* access doesn't cost us much (see PGMPhysGCPtr2GCPhys()).
325	*/
326	uint64_t fFlags;
327	RTGCPHYS GCPhys;
328	rc = PGMGstGetPage(pVM, GCDest, &fFlags, &GCPhys);
329	if (RT_FAILURE(rc))
330	return rc;
331	if ( !(fFlags & X86_PTE_RW)
332	&& (CPUMGetGuestCR0(pVM) & X86_CR0_WP))
333	return VERR_ACCESS_DENIED;
334
335	PGMPhysWrite(pVM, GCPhys + ((RTGCUINTPTR)GCDest & PAGE_OFFSET_MASK), pSrc, cb);
336	return VINF_SUCCESS;
337
338	#else
339	return PGMPhysWriteGCPtrSafe(pVM, GCDest, pSrc, cb);
340	#endif
341	}
342
343	/* Convert sel:addr to a flat GC address */
344	static RTGCPTR emConvertToFlatAddr(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, POP_PARAMETER pParam, RTGCPTR pvAddr)
345	{
346	int prefix_seg, rc;
347	RTSEL sel;
348	CPUMSELREGHID *pSelHidReg;
349
350	prefix_seg = DISDetectSegReg(pCpu, pParam);
351	rc = DISFetchRegSegEx(pRegFrame, prefix_seg, &sel, &pSelHidReg);
352	if (VBOX_FAILURE(rc))
353	return pvAddr;
354
355	return SELMToFlat(pVM, pRegFrame->eflags, sel, pSelHidReg, pvAddr);
356	}
357
358	#if defined(IN_GC) && (defined(VBOX_STRICT) \|\| defined(LOG_ENABLED))
359	/**
360	* Get the mnemonic for the disassembled instruction.
361	*
362	* GC/R0 doesn't include the strings in the DIS tables because
363	* of limited space.
364	*/
365	static const char *emGetMnemonic(PDISCPUSTATE pCpu)
366	{
367	switch (pCpu->pCurInstr->opcode)
368	{
369	case OP_XOR: return "Xor";
370	case OP_OR: return "Or";
371	case OP_AND: return "And";
372	case OP_BTR: return "Btr";
373	case OP_BTS: return "Bts";
374	default:
375	AssertMsgFailed(("%d\n", pCpu->pCurInstr->opcode));
376	return "???";
377	}
378	}
379	#endif
380
381	/**
382	* XCHG instruction emulation.
383	*/
384	static int emInterpretXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
385	{
386	OP_PARAMVAL param1, param2;
387
388	/* Source to make DISQueryParamVal read the register value - ugly hack */
389	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
390	if(VBOX_FAILURE(rc))
391	return VERR_EM_INTERPRETER;
392
393	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
394	if(VBOX_FAILURE(rc))
395	return VERR_EM_INTERPRETER;
396
397	#ifdef IN_GC
398	if (TRPMHasTrap(pVM))
399	{
400	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
401	{
402	#endif
403	RTGCPTR pParam1 = 0, pParam2 = 0;
404	uint32_t valpar1, valpar2;
405
406	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
407	switch(param1.type)
408	{
409	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
410	valpar1 = param1.val.val32;
411	break;
412
413	case PARMTYPE_ADDRESS:
414	pParam1 = (RTGCPTR)param1.val.val32;
415	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
416	#ifdef IN_GC
417	/* Safety check (in theory it could cross a page boundary and fault there though) */
418	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
419	#endif
420	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
421	if (VBOX_FAILURE(rc))
422	{
423	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
424	return VERR_EM_INTERPRETER;
425	}
426	break;
427
428	default:
429	AssertFailed();
430	return VERR_EM_INTERPRETER;
431	}
432
433	switch(param2.type)
434	{
435	case PARMTYPE_ADDRESS:
436	pParam2 = (RTGCPTR)param2.val.val32;
437	pParam2 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pParam2);
438	#ifdef IN_GC
439	/* Safety check (in theory it could cross a page boundary and fault there though) */
440	AssertReturn(pParam2 == pvFault, VERR_EM_INTERPRETER);
441	#endif
442	rc = emRamRead(pVM, &valpar2, pParam2, param2.size);
443	if (VBOX_FAILURE(rc))
444	{
445	AssertMsgFailed(("MMGCRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
446	}
447	break;
448
449	case PARMTYPE_IMMEDIATE:
450	valpar2 = param2.val.val32;
451	break;
452
453	default:
454	AssertFailed();
455	return VERR_EM_INTERPRETER;
456	}
457
458	/* Write value of parameter 2 to parameter 1 (reg or memory address) */
459	if (pParam1 == 0)
460	{
461	Assert(param1.type == PARMTYPE_IMMEDIATE); /* register actually */
462	switch(param1.size)
463	{
464	case 1: //special case for AH etc
465	rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t)valpar2); break;
466	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)valpar2); break;
467	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, valpar2); break;
468	default: AssertFailedReturn(VERR_EM_INTERPRETER);
469	}
470	if (VBOX_FAILURE(rc))
471	return VERR_EM_INTERPRETER;
472	}
473	else
474	{
475	rc = emRamWrite(pVM, pParam1, &valpar2, param1.size);
476	if (VBOX_FAILURE(rc))
477	{
478	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
479	return VERR_EM_INTERPRETER;
480	}
481	}
482
483	/* Write value of parameter 1 to parameter 2 (reg or memory address) */
484	if (pParam2 == 0)
485	{
486	Assert(param2.type == PARMTYPE_IMMEDIATE); /* register actually */
487	switch(param2.size)
488	{
489	case 1: //special case for AH etc
490	rc = DISWriteReg8(pRegFrame, pCpu->param2.base.reg_gen, (uint8_t)valpar1); break;
491	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param2.base.reg_gen, (uint16_t)valpar1); break;
492	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param2.base.reg_gen, valpar1); break;
493	default: AssertFailedReturn(VERR_EM_INTERPRETER);
494	}
495	if (VBOX_FAILURE(rc))
496	return VERR_EM_INTERPRETER;
497	}
498	else
499	{
500	rc = emRamWrite(pVM, pParam2, &valpar1, param2.size);
501	if (VBOX_FAILURE(rc))
502	{
503	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
504	return VERR_EM_INTERPRETER;
505	}
506	}
507
508	*pcbSize = param2.size;
509	return VINF_SUCCESS;
510	#ifdef IN_GC
511	}
512	}
513	#endif
514	return VERR_EM_INTERPRETER;
515	}
516
517	/**
518	* INC and DEC emulation.
519	*/
520	static int emInterpretIncDec(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
521	PFN_EMULATE_PARAM2 pfnEmulate)
522	{
523	OP_PARAMVAL param1;
524
525	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
526	if(VBOX_FAILURE(rc))
527	return VERR_EM_INTERPRETER;
528
529	#ifdef IN_GC
530	if (TRPMHasTrap(pVM))
531	{
532	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
533	{
534	#endif
535	RTGCPTR pParam1 = 0;
536	uint32_t valpar1;
537
538	if (param1.type == PARMTYPE_ADDRESS)
539	{
540	pParam1 = (RTGCPTR)param1.val.val32;
541	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
542	#ifdef IN_GC
543	/* Safety check (in theory it could cross a page boundary and fault there though) */
544	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
545	#endif
546	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
547	if (VBOX_FAILURE(rc))
548	{
549	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
550	return VERR_EM_INTERPRETER;
551	}
552	}
553	else
554	{
555	AssertFailed();
556	return VERR_EM_INTERPRETER;
557	}
558
559	uint32_t eflags;
560
561	eflags = pfnEmulate(&valpar1, param1.size);
562
563	/* Write result back */
564	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
565	if (VBOX_FAILURE(rc))
566	{
567	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
568	return VERR_EM_INTERPRETER;
569	}
570
571	/* Update guest's eflags and finish. */
572	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
573	\| (eflags & (X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
574
575	/* All done! */
576	*pcbSize = param1.size;
577	return VINF_SUCCESS;
578	#ifdef IN_GC
579	}
580	}
581	#endif
582	return VERR_EM_INTERPRETER;
583	}
584
585	/**
586	* POP Emulation.
587	*/
588	static int emInterpretPop(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
589	{
590	OP_PARAMVAL param1;
591	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
592	if(VBOX_FAILURE(rc))
593	return VERR_EM_INTERPRETER;
594
595	#ifdef IN_GC
596	if (TRPMHasTrap(pVM))
597	{
598	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
599	{
600	#endif
601	RTGCPTR pParam1 = 0;
602	uint32_t valpar1;
603	RTGCPTR pStackVal;
604
605	/* Read stack value first */
606	if (SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid) == false)
607	return VERR_EM_INTERPRETER; /* No legacy 16 bits stuff here, please. */
608
609	/* Convert address; don't bother checking limits etc, as we only read here */
610	pStackVal = SELMToFlat(pVM, pRegFrame->eflags, pRegFrame->ss, &pRegFrame->ssHid, (RTGCPTR)pRegFrame->esp);
611	if (pStackVal == 0)
612	return VERR_EM_INTERPRETER;
613
614	rc = emRamRead(pVM, &valpar1, pStackVal, param1.size);
615	if (VBOX_FAILURE(rc))
616	{
617	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
618	return VERR_EM_INTERPRETER;
619	}
620
621	if (param1.type == PARMTYPE_ADDRESS)
622	{
623	pParam1 = (RTGCPTR)param1.val.val32;
624
625	/* pop [esp+xx] uses esp after the actual pop! */
626	AssertCompile(USE_REG_ESP == USE_REG_SP);
627	if ( (pCpu->param1.flags & USE_BASE)
628	&& (pCpu->param1.flags & (USE_REG_GEN16\|USE_REG_GEN32))
629	&& pCpu->param1.base.reg_gen == USE_REG_ESP
630	)
631	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + param1.size);
632
633	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
634
635	#ifdef IN_GC
636	/* Safety check (in theory it could cross a page boundary and fault there though) */
637	AssertMsgReturn(pParam1 == pvFault \|\| (RTGCPTR)pRegFrame->esp == pvFault, ("%VGv != %VGv ss:esp=%04X:%08x\n", pParam1, pvFault, pRegFrame->ss, pRegFrame->esp), VERR_EM_INTERPRETER);
638	#endif
639	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
640	if (VBOX_FAILURE(rc))
641	{
642	AssertMsgFailed(("emRamWrite %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
643	return VERR_EM_INTERPRETER;
644	}
645
646	/* Update ESP as the last step */
647	pRegFrame->esp += param1.size;
648	}
649	else
650	{
651	#ifndef DEBUG_bird // annoying assertion.
652	AssertFailed();
653	#endif
654	return VERR_EM_INTERPRETER;
655	}
656
657	/* All done! */
658	*pcbSize = param1.size;
659	return VINF_SUCCESS;
660	#ifdef IN_GC
661	}
662	}
663	#endif
664	return VERR_EM_INTERPRETER;
665	}
666
667
668	/**
669	* XOR/OR/AND Emulation.
670	*/
671	static int emInterpretOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
672	PFN_EMULATE_PARAM3 pfnEmulate)
673	{
674	OP_PARAMVAL param1, param2;
675	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
676	if(VBOX_FAILURE(rc))
677	return VERR_EM_INTERPRETER;
678
679	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
680	if(VBOX_FAILURE(rc))
681	return VERR_EM_INTERPRETER;
682
683	#ifdef LOG_ENABLED
684	const char *pszInstr;
685
686	if (pCpu->pCurInstr->opcode == OP_XOR)
687	pszInstr = "Xor";
688	else if (pCpu->pCurInstr->opcode == OP_OR)
689	pszInstr = "Or";
690	else if (pCpu->pCurInstr->opcode == OP_AND)
691	pszInstr = "And";
692	else
693	pszInstr = "OrXorAnd??";
694	#endif
695
696	#ifdef IN_GC
697	if (TRPMHasTrap(pVM))
698	{
699	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
700	{
701	#endif
702	RTGCPTR pParam1;
703	uint32_t valpar1, valpar2;
704
705	if (pCpu->param1.size != pCpu->param2.size)
706	{
707	if (pCpu->param1.size < pCpu->param2.size)
708	{
709	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", pszInstr, pRegFrame->eip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
710	return VERR_EM_INTERPRETER;
711	}
712	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
713	pCpu->param2.size = pCpu->param1.size;
714	param2.size = param1.size;
715	}
716
717	/* The destination is always a virtual address */
718	if (param1.type == PARMTYPE_ADDRESS)
719	{
720	pParam1 = (RTGCPTR)param1.val.val32;
721	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
722
723	#ifdef IN_GC
724	/* Safety check (in theory it could cross a page boundary and fault there though) */
725	AssertMsgReturn(pParam1 == pvFault, ("eip=%VGv, pParam1=%VGv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
726	#endif
727	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
728	if (VBOX_FAILURE(rc))
729	{
730	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
731	return VERR_EM_INTERPRETER;
732	}
733	}
734	else
735	{
736	AssertFailed();
737	return VERR_EM_INTERPRETER;
738	}
739
740	/* Register or immediate data */
741	switch(param2.type)
742	{
743	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
744	valpar2 = param2.val.val32;
745	break;
746
747	default:
748	AssertFailed();
749	return VERR_EM_INTERPRETER;
750	}
751
752	/* Data read, emulate instruction. */
753	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
754
755	/* Update guest's eflags and finish. */
756	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
757	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
758
759	/* And write it back */
760	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
761	if (VBOX_SUCCESS(rc))
762	{
763	/* All done! */
764	*pcbSize = param2.size;
765	return VINF_SUCCESS;
766	}
767	#ifdef IN_GC
768	}
769	}
770	#endif
771	return VERR_EM_INTERPRETER;
772	}
773
774	#ifdef IN_GC
775	/**
776	* LOCK XOR/OR/AND Emulation.
777	*/
778	static int emInterpretLockOrXorAnd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
779	uint32_t *pcbSize, PFNEMULATELOCKPARAM3 pfnEmulate)
780	{
781	OP_PARAMVAL param1, param2;
782	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
783	if(VBOX_FAILURE(rc))
784	return VERR_EM_INTERPRETER;
785
786	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
787	if(VBOX_FAILURE(rc))
788	return VERR_EM_INTERPRETER;
789
790	if (pCpu->param1.size != pCpu->param2.size)
791	{
792	AssertMsgReturn(pCpu->param1.size >= pCpu->param2.size, /* should never happen! */
793	("%s at %VGv parameter mismatch %d vs %d!!\n", emGetMnemonic(pCpu), pRegFrame->eip, pCpu->param1.size, pCpu->param2.size),
794	VERR_EM_INTERPRETER);
795
796	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
797	pCpu->param2.size = pCpu->param1.size;
798	param2.size = param1.size;
799	}
800
801	/* The destination is always a virtual address */
802	AssertReturn(param1.type == PARMTYPE_ADDRESS, VERR_EM_INTERPRETER);
803	RTGCPTR GCPtrPar1 = (RTGCPTR)param1.val.val32;
804	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
805
806	# ifdef IN_GC
807	/* Safety check (in theory it could cross a page boundary and fault there though) */
808	Assert( TRPMHasTrap(pVM)
809	&& (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW));
810	AssertMsgReturn(GCPtrPar1 == pvFault, ("eip=%VGv, GCPtrPar1=%VGv pvFault=%VGv\n", pRegFrame->eip, GCPtrPar1, pvFault), VERR_EM_INTERPRETER);
811	# endif
812
813	/* Register and immediate data == PARMTYPE_IMMEDIATE */
814	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
815	RTGCUINTREG ValPar2 = param2.val.val32;
816
817	/* Try emulate it with a one-shot #PF handler in place. */
818	Log2(("%s %RGv imm%d=%RGr\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
819
820	RTGCUINTREG32 eflags = 0;
821	MMGCRamRegisterTrapHandler(pVM);
822	rc = pfnEmulate(GCPtrPar1, ValPar2, pCpu->param2.size, &eflags);
823	MMGCRamDeregisterTrapHandler(pVM);
824
825	if (RT_FAILURE(rc))
826	{
827	Log(("%s %RGv imm%d=%RGr -> emulation failed due to page fault!\n", emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
828	return VERR_EM_INTERPRETER;
829	}
830
831	/* Update guest's eflags and finish. */
832	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
833	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
834
835	*pcbSize = param2.size;
836	return VINF_SUCCESS;
837	}
838	#endif
839
840	/**
841	* ADD, ADC & SUB Emulation.
842	*/
843	static int emInterpretAddSub(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
844	PFN_EMULATE_PARAM3 pfnEmulate)
845	{
846	OP_PARAMVAL param1, param2;
847	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
848	if(VBOX_FAILURE(rc))
849	return VERR_EM_INTERPRETER;
850
851	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
852	if(VBOX_FAILURE(rc))
853	return VERR_EM_INTERPRETER;
854
855	#ifdef LOG_ENABLED
856	const char *pszInstr;
857
858	if (pCpu->pCurInstr->opcode == OP_SUB)
859	pszInstr = "Sub";
860	else if (pCpu->pCurInstr->opcode == OP_ADD)
861	pszInstr = "Add";
862	else if (pCpu->pCurInstr->opcode == OP_ADC)
863	pszInstr = "Adc";
864	else
865	pszInstr = "AddSub??";
866	#endif
867
868	#ifdef IN_GC
869	if (TRPMHasTrap(pVM))
870	{
871	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
872	{
873	#endif
874	RTGCPTR pParam1;
875	uint32_t valpar1, valpar2;
876
877	if (pCpu->param1.size != pCpu->param2.size)
878	{
879	if (pCpu->param1.size < pCpu->param2.size)
880	{
881	AssertMsgFailed(("%s at %VGv parameter mismatch %d vs %d!!\n", pszInstr, pRegFrame->eip, pCpu->param1.size, pCpu->param2.size)); /* should never happen! */
882	return VERR_EM_INTERPRETER;
883	}
884	/* Or %Ev, Ib -> just a hack to save some space; the data width of the 1st parameter determines the real width */
885	pCpu->param2.size = pCpu->param1.size;
886	param2.size = param1.size;
887	}
888
889	/* The destination is always a virtual address */
890	if (param1.type == PARMTYPE_ADDRESS)
891	{
892	pParam1 = (RTGCPTR)param1.val.val32;
893	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
894
895	#ifdef IN_GC
896	/* Safety check (in theory it could cross a page boundary and fault there though) */
897	AssertReturn(pParam1 == pvFault, VERR_EM_INTERPRETER);
898	#endif
899	rc = emRamRead(pVM, &valpar1, pParam1, param1.size);
900	if (VBOX_FAILURE(rc))
901	{
902	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
903	return VERR_EM_INTERPRETER;
904	}
905	}
906	else
907	{
908	#ifndef DEBUG_bird
909	AssertFailed();
910	#endif
911	return VERR_EM_INTERPRETER;
912	}
913
914	/* Register or immediate data */
915	switch(param2.type)
916	{
917	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
918	valpar2 = param2.val.val32;
919	break;
920
921	default:
922	AssertFailed();
923	return VERR_EM_INTERPRETER;
924	}
925
926	/* Data read, emulate instruction. */
927	uint32_t eflags = pfnEmulate(&valpar1, valpar2, param2.size);
928
929	/* Update guest's eflags and finish. */
930	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
931	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
932
933	/* And write it back */
934	rc = emRamWrite(pVM, pParam1, &valpar1, param1.size);
935	if (VBOX_SUCCESS(rc))
936	{
937	/* All done! */
938	*pcbSize = param2.size;
939	return VINF_SUCCESS;
940	}
941	#ifdef IN_GC
942	}
943	}
944	#endif
945	return VERR_EM_INTERPRETER;
946	}
947
948	/**
949	* ADC Emulation.
950	*/
951	static int emInterpretAdc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
952	{
953	if (pRegFrame->eflags.Bits.u1CF)
954	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdcWithCarrySet);
955	else
956	return emInterpretAddSub(pVM, pCpu, pRegFrame, pvFault, pcbSize, EMEmulateAdd);
957	}
958
959	/**
960	* BTR/C/S Emulation.
961	*/
962	static int emInterpretBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize,
963	PFN_EMULATE_PARAM2_UINT32 pfnEmulate)
964	{
965	OP_PARAMVAL param1, param2;
966	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
967	if(VBOX_FAILURE(rc))
968	return VERR_EM_INTERPRETER;
969
970	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
971	if(VBOX_FAILURE(rc))
972	return VERR_EM_INTERPRETER;
973
974	#ifdef LOG_ENABLED
975	const char *pszInstr;
976
977	if (pCpu->pCurInstr->opcode == OP_BTR)
978	pszInstr = "Btr";
979	else if (pCpu->pCurInstr->opcode == OP_BTS)
980	pszInstr = "Bts";
981	else if (pCpu->pCurInstr->opcode == OP_BTC)
982	pszInstr = "Btc";
983	else
984	pszInstr = "Bit??";
985	#endif
986
987	#ifdef IN_GC
988	if (TRPMHasTrap(pVM))
989	{
990	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
991	{
992	#endif
993	RTGCPTR pParam1;
994	uint32_t valpar1 = 0, valpar2;
995	uint32_t eflags;
996
997	/* The destination is always a virtual address */
998	if (param1.type != PARMTYPE_ADDRESS)
999	return VERR_EM_INTERPRETER;
1000
1001	pParam1 = (RTGCPTR)param1.val.val32;
1002	pParam1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pParam1);
1003
1004	/* Register or immediate data */
1005	switch(param2.type)
1006	{
1007	case PARMTYPE_IMMEDIATE: /* both immediate data and register (ugly) */
1008	valpar2 = param2.val.val32;
1009	break;
1010
1011	default:
1012	AssertFailed();
1013	return VERR_EM_INTERPRETER;
1014	}
1015
1016	Log2(("emInterpret%s: pvFault=%VGv pParam1=%VGv val2=%x\n", pszInstr, pvFault, pParam1, valpar2));
1017	pParam1 = (RTGCPTR)((RTGCUINTPTR)pParam1 + valpar2/8);
1018	#ifdef IN_GC
1019	/* Safety check. */
1020	AssertMsgReturn((RTGCPTR)((RTGCUINTPTR)pParam1 & ~3) == pvFault, ("pParam1=%VGv pvFault=%VGv\n", pParam1, pvFault), VERR_EM_INTERPRETER);
1021	#endif
1022	rc = emRamRead(pVM, &valpar1, pParam1, 1);
1023	if (VBOX_FAILURE(rc))
1024	{
1025	AssertMsgFailed(("emRamRead %VGv size=%d failed with %Vrc\n", pParam1, param1.size, rc));
1026	return VERR_EM_INTERPRETER;
1027	}
1028
1029	Log2(("emInterpretBtx: val=%x\n", valpar1));
1030	/* Data read, emulate bit test instruction. */
1031	eflags = pfnEmulate(&valpar1, valpar2 & 0x7);
1032
1033	Log2(("emInterpretBtx: val=%x CF=%d\n", valpar1, !!(eflags & X86_EFL_CF)));
1034
1035	/* Update guest's eflags and finish. */
1036	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1037	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1038
1039	/* And write it back */
1040	rc = emRamWrite(pVM, pParam1, &valpar1, 1);
1041	if (VBOX_SUCCESS(rc))
1042	{
1043	/* All done! */
1044	*pcbSize = 1;
1045	return VINF_SUCCESS;
1046	}
1047	#ifdef IN_GC
1048	}
1049	}
1050	#endif
1051	return VERR_EM_INTERPRETER;
1052	}
1053
1054	#ifdef IN_GC
1055	/**
1056	* LOCK BTR/C/S Emulation.
1057	*/
1058	static int emInterpretLockBitTest(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
1059	uint32_t *pcbSize, PFNEMULATELOCKPARAM2 pfnEmulate)
1060	{
1061	OP_PARAMVAL param1, param2;
1062	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1063	if(VBOX_FAILURE(rc))
1064	return VERR_EM_INTERPRETER;
1065
1066	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1067	if(VBOX_FAILURE(rc))
1068	return VERR_EM_INTERPRETER;
1069
1070	/* The destination is always a virtual address */
1071	if (param1.type != PARMTYPE_ADDRESS)
1072	return VERR_EM_INTERPRETER;
1073
1074	RTGCPTR GCPtrPar1 = (RTGCPTR)param1.val.val32;
1075	GCPtrPar1 = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, GCPtrPar1);
1076
1077	/* Register and immediate data == PARMTYPE_IMMEDIATE */
1078	AssertReturn(param2.type == PARMTYPE_IMMEDIATE, VERR_EM_INTERPRETER);
1079	RTGCUINTREG ValPar2 = param2.val.val32;
1080
1081	Log2(("emInterpretLockBitTest %s: pvFault=%VGv GCPtrPar1=%RGv imm=%RGr\n", emGetMnemonic(pCpu), pvFault, GCPtrPar1, ValPar2));
1082
1083	/* Adjust the parameters so what we're dealing with is a bit within the byte pointed to. */
1084	GCPtrPar1 = (RTGCPTR)((RTGCUINTPTR)GCPtrPar1 + ValPar2 / 8);
1085	ValPar2 &= 7;
1086	# ifdef IN_GC
1087	Assert(TRPMHasTrap(pVM));
1088	AssertMsgReturn((RTGCPTR)((RTGCUINTPTR)GCPtrPar1 & ~(RTGCUINTPTR)3) == pvFault,
1089	("GCPtrPar1=%VGv pvFault=%VGv\n", GCPtrPar1, pvFault),
1090	VERR_EM_INTERPRETER);
1091	# endif
1092
1093	/* Try emulate it with a one-shot #PF handler in place. */
1094	RTGCUINTREG32 eflags = 0;
1095	MMGCRamRegisterTrapHandler(pVM);
1096	rc = pfnEmulate(GCPtrPar1, ValPar2, &eflags);
1097	MMGCRamDeregisterTrapHandler(pVM);
1098
1099	if (RT_FAILURE(rc))
1100	{
1101	Log(("emInterpretLockBitTest %s: %RGv imm%d=%RGr -> emulation failed due to page fault!\n",
1102	emGetMnemonic(pCpu), GCPtrPar1, pCpu->param2.size*8, ValPar2));
1103	return VERR_EM_INTERPRETER;
1104	}
1105
1106	Log2(("emInterpretLockBitTest %s: GCPtrPar1=%RGv imm=%RGr CF=%d\n", emGetMnemonic(pCpu), GCPtrPar1, ValPar2, !!(eflags & X86_EFL_CF)));
1107
1108	/* Update guest's eflags and finish. */
1109	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1110	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1111
1112	*pcbSize = 1;
1113	return VINF_SUCCESS;
1114	}
1115	#endif /* IN_GC */
1116
1117	/**
1118	* MOV emulation.
1119	*/
1120	static int emInterpretMov(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1121	{
1122	OP_PARAMVAL param1, param2;
1123	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_DEST);
1124	if(VBOX_FAILURE(rc))
1125	return VERR_EM_INTERPRETER;
1126
1127	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1128	if(VBOX_FAILURE(rc))
1129	return VERR_EM_INTERPRETER;
1130
1131	#ifdef IN_GC
1132	if (TRPMHasTrap(pVM))
1133	{
1134	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1135	{
1136	#else
1137	/** @todo Make this the default and don't rely on TRPM information. */
1138	if (param1.type == PARMTYPE_ADDRESS)
1139	{
1140	#endif
1141	RTGCPTR pDest;
1142	uint32_t val32;
1143
1144	switch(param1.type)
1145	{
1146	case PARMTYPE_IMMEDIATE:
1147	if(!(param1.flags & PARAM_VAL32))
1148	return VERR_EM_INTERPRETER;
1149	/* fallthru */
1150
1151	case PARMTYPE_ADDRESS:
1152	pDest = (RTGCPTR)param1.val.val32;
1153	pDest = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, pDest);
1154	break;
1155
1156	default:
1157	AssertFailed();
1158	return VERR_EM_INTERPRETER;
1159	}
1160
1161	switch(param2.type)
1162	{
1163	case PARMTYPE_IMMEDIATE: /* register type is translated to this one too */
1164	val32 = param2.val.val32;
1165	break;
1166
1167	default:
1168	Log(("emInterpretMov: unexpected type=%d eip=%VGv\n", param2.type, pRegFrame->eip));
1169	return VERR_EM_INTERPRETER;
1170	}
1171	LogFlow(("EMInterpretInstruction at %08x: OP_MOV %08X <- %08X (%d) &val32=%08x\n", pRegFrame->eip, pDest, val32, param2.size, &val32));
1172
1173	Assert(param2.size <= 4 && param2.size > 0);
1174
1175	#if 0 /* CSAM/PATM translates aliases which causes this to incorrectly trigger. See #2609 and #1498. */
1176	#ifdef IN_GC
1177	/* Safety check (in theory it could cross a page boundary and fault there though) */
1178	AssertMsgReturn(pDest == pvFault, ("eip=%VGv pDest=%VGv pvFault=%VGv\n", pRegFrame->eip, pDest, pvFault), VERR_EM_INTERPRETER);
1179	#endif
1180	#endif
1181	rc = emRamWrite(pVM, pDest, &val32, param2.size);
1182	if (VBOX_FAILURE(rc))
1183	return VERR_EM_INTERPRETER;
1184
1185	*pcbSize = param2.size;
1186	}
1187	else
1188	{ /* read fault */
1189	RTGCPTR pSrc;
1190	uint32_t val32;
1191
1192	/* Source */
1193	switch(param2.type)
1194	{
1195	case PARMTYPE_IMMEDIATE:
1196	if(!(param2.flags & PARAM_VAL32))
1197	return VERR_EM_INTERPRETER;
1198	/* fallthru */
1199
1200	case PARMTYPE_ADDRESS:
1201	pSrc = (RTGCPTR)param2.val.val32;
1202	pSrc = emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param2, pSrc);
1203	break;
1204
1205	default:
1206	return VERR_EM_INTERPRETER;
1207	}
1208
1209	Assert(param1.size <= 4 && param1.size > 0);
1210	#ifdef IN_GC
1211	/* Safety check (in theory it could cross a page boundary and fault there though) */
1212	AssertReturn(pSrc == pvFault, VERR_EM_INTERPRETER);
1213	#endif
1214	rc = emRamRead(pVM, &val32, pSrc, param1.size);
1215	if (VBOX_FAILURE(rc))
1216	return VERR_EM_INTERPRETER;
1217
1218	/* Destination */
1219	switch(param1.type)
1220	{
1221	case PARMTYPE_REGISTER:
1222	switch(param1.size)
1223	{
1224	case 1: rc = DISWriteReg8(pRegFrame, pCpu->param1.base.reg_gen, (uint8_t)val32); break;
1225	case 2: rc = DISWriteReg16(pRegFrame, pCpu->param1.base.reg_gen, (uint16_t)val32); break;
1226	case 4: rc = DISWriteReg32(pRegFrame, pCpu->param1.base.reg_gen, val32); break;
1227	default:
1228	return VERR_EM_INTERPRETER;
1229	}
1230	if (VBOX_FAILURE(rc))
1231	return rc;
1232	break;
1233
1234	default:
1235	return VERR_EM_INTERPRETER;
1236	}
1237	LogFlow(("EMInterpretInstruction: OP_MOV %08X -> %08X (%d)\n", pSrc, val32, param1.size));
1238	}
1239	return VINF_SUCCESS;
1240	#ifdef IN_GC
1241	}
1242	#endif
1243	return VERR_EM_INTERPRETER;
1244	}
1245
1246	/*
1247	* [LOCK] CMPXCHG emulation.
1248	*/
1249	#ifdef IN_GC
1250	static int emInterpretCmpXchg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1251	{
1252	OP_PARAMVAL param1, param2;
1253
1254	#ifdef LOG_ENABLED
1255	const char *pszInstr;
1256
1257	if (pCpu->prefix & PREFIX_LOCK)
1258	pszInstr = "Lock CmpXchg";
1259	else
1260	pszInstr = "CmpXchg";
1261	#endif
1262
1263	/* Source to make DISQueryParamVal read the register value - ugly hack */
1264	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1265	if(VBOX_FAILURE(rc))
1266	return VERR_EM_INTERPRETER;
1267
1268	rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param2, &param2, PARAM_SOURCE);
1269	if(VBOX_FAILURE(rc))
1270	return VERR_EM_INTERPRETER;
1271
1272	if (TRPMHasTrap(pVM))
1273	{
1274	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1275	{
1276	RTRCPTR pParam1;
1277	uint32_t valpar, eflags;
1278	#ifdef VBOX_STRICT
1279	uint32_t valpar1 = 0; /// @todo used uninitialized...
1280	#endif
1281
1282	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1283	switch(param1.type)
1284	{
1285	case PARMTYPE_ADDRESS:
1286	pParam1 = (RTRCPTR)param1.val.val32;
1287	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1288
1289	/* Safety check (in theory it could cross a page boundary and fault there though) */
1290	AssertMsgReturn(pParam1 == (RTRCPTR)pvFault, ("eip=%VRv pParam1=%VRv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
1291	break;
1292
1293	default:
1294	return VERR_EM_INTERPRETER;
1295	}
1296
1297	switch(param2.type)
1298	{
1299	case PARMTYPE_IMMEDIATE: /* register actually */
1300	valpar = param2.val.val32;
1301	break;
1302
1303	default:
1304	return VERR_EM_INTERPRETER;
1305	}
1306
1307	LogFlow(("%s %VRv=%08x eax=%08x %08x\n", pszInstr, pParam1, valpar1, pRegFrame->eax, valpar));
1308
1309	MMGCRamRegisterTrapHandler(pVM);
1310	if (pCpu->prefix & PREFIX_LOCK)
1311	rc = EMGCEmulateLockCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1312	else
1313	rc = EMGCEmulateCmpXchg(pParam1, &pRegFrame->eax, valpar, pCpu->param2.size, &eflags);
1314	MMGCRamDeregisterTrapHandler(pVM);
1315
1316	if (VBOX_FAILURE(rc))
1317	{
1318	Log(("%s %VGv=%08x eax=%08x %08x -> emulation failed due to page fault!\n", pszInstr, pParam1, valpar1, pRegFrame->eax, valpar));
1319	return VERR_EM_INTERPRETER;
1320	}
1321
1322	LogFlow(("%s %VRv=%08x eax=%08x %08x ZF=%d\n", pszInstr, pParam1, valpar1, pRegFrame->eax, valpar, !!(eflags & X86_EFL_ZF)));
1323
1324	/* Update guest's eflags and finish. */
1325	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1326	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1327
1328	*pcbSize = param2.size;
1329	return VINF_SUCCESS;
1330	}
1331	}
1332	return VERR_EM_INTERPRETER;
1333	}
1334
1335	/*
1336	* [LOCK] CMPXCHG8B emulation.
1337	*/
1338	static int emInterpretCmpXchg8b(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1339	{
1340	OP_PARAMVAL param1;
1341
1342	#ifdef LOG_ENABLED
1343	const char *pszInstr;
1344
1345	if (pCpu->prefix & PREFIX_LOCK)
1346	pszInstr = "Lock CmpXchg8b";
1347	else
1348	pszInstr = "CmpXchg8b";
1349	#endif
1350
1351	/* Source to make DISQueryParamVal read the register value - ugly hack */
1352	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1353	if(VBOX_FAILURE(rc))
1354	return VERR_EM_INTERPRETER;
1355
1356	if (TRPMHasTrap(pVM))
1357	{
1358	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1359	{
1360	RTRCPTR pParam1;
1361	uint32_t eflags;
1362
1363	AssertReturn(pCpu->param1.size == 8, VERR_EM_INTERPRETER);
1364	switch(param1.type)
1365	{
1366	case PARMTYPE_ADDRESS:
1367	pParam1 = (RTRCPTR)param1.val.val32;
1368	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1369
1370	/* Safety check (in theory it could cross a page boundary and fault there though) */
1371	AssertMsgReturn(pParam1 == (RTRCPTR)pvFault, ("eip=%VRv pParam1=%VRv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
1372	break;
1373
1374	default:
1375	return VERR_EM_INTERPRETER;
1376	}
1377
1378	LogFlow(("%s %VRv=%08x eax=%08x\n", pszInstr, pParam1, pRegFrame->eax));
1379
1380	MMGCRamRegisterTrapHandler(pVM);
1381	if (pCpu->prefix & PREFIX_LOCK)
1382	rc = EMGCEmulateLockCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1383	else
1384	rc = EMGCEmulateCmpXchg8b(pParam1, &pRegFrame->eax, &pRegFrame->edx, pRegFrame->ebx, pRegFrame->ecx, &eflags);
1385	MMGCRamDeregisterTrapHandler(pVM);
1386
1387	if (VBOX_FAILURE(rc))
1388	{
1389	Log(("%s %VGv=%08x eax=%08x -> emulation failed due to page fault!\n", pszInstr, pParam1, pRegFrame->eax));
1390	return VERR_EM_INTERPRETER;
1391	}
1392
1393	LogFlow(("%s %VGv=%08x eax=%08x ZF=%d\n", pszInstr, pParam1, pRegFrame->eax, !!(eflags & X86_EFL_ZF)));
1394
1395	/* Update guest's eflags and finish; note that only ZF is affected. */
1396	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_ZF))
1397	\| (eflags & (X86_EFL_ZF));
1398
1399	*pcbSize = 8;
1400	return VINF_SUCCESS;
1401	}
1402	}
1403	return VERR_EM_INTERPRETER;
1404	}
1405	#endif
1406
1407	/*
1408	* [LOCK] XADD emulation.
1409	*/
1410	#ifdef IN_GC
1411	static int emInterpretXAdd(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1412	{
1413	OP_PARAMVAL param1;
1414	uint32_t *pParamReg2;
1415	size_t cbSizeParamReg2;
1416
1417	/* Source to make DISQueryParamVal read the register value - ugly hack */
1418	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1419	if(VBOX_FAILURE(rc))
1420	return VERR_EM_INTERPRETER;
1421
1422	rc = DISQueryParamRegPtr(pRegFrame, pCpu, &pCpu->param2, (void **)&pParamReg2, &cbSizeParamReg2);
1423	Assert(cbSizeParamReg2 <= 4);
1424	if(VBOX_FAILURE(rc))
1425	return VERR_EM_INTERPRETER;
1426
1427	if (TRPMHasTrap(pVM))
1428	{
1429	if (TRPMGetErrorCode(pVM) & X86_TRAP_PF_RW)
1430	{
1431	RTRCPTR pParam1;
1432	uint32_t eflags;
1433	#ifdef VBOX_STRICT
1434	uint32_t valpar1 = 0; /// @todo used uninitialized...
1435	#endif
1436
1437	AssertReturn(pCpu->param1.size == pCpu->param2.size, VERR_EM_INTERPRETER);
1438	switch(param1.type)
1439	{
1440	case PARMTYPE_ADDRESS:
1441	pParam1 = (RTRCPTR)param1.val.val32;
1442	pParam1 = (RTRCPTR)emConvertToFlatAddr(pVM, pRegFrame, pCpu, &pCpu->param1, (RTGCPTR)(RTRCUINTPTR)pParam1);
1443
1444	/* Safety check (in theory it could cross a page boundary and fault there though) */
1445	AssertMsgReturn(pParam1 == (RTRCPTR)pvFault, ("eip=%VRv pParam1=%VRv pvFault=%VGv\n", pRegFrame->eip, pParam1, pvFault), VERR_EM_INTERPRETER);
1446	break;
1447
1448	default:
1449	return VERR_EM_INTERPRETER;
1450	}
1451
1452	LogFlow(("XAdd %VRv=%08x reg=%08x\n", pParam1, *pParamReg2));
1453
1454	MMGCRamRegisterTrapHandler(pVM);
1455	if (pCpu->prefix & PREFIX_LOCK)
1456	rc = EMGCEmulateLockXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1457	else
1458	rc = EMGCEmulateXAdd(pParam1, pParamReg2, cbSizeParamReg2, &eflags);
1459	MMGCRamDeregisterTrapHandler(pVM);
1460
1461	if (VBOX_FAILURE(rc))
1462	{
1463	Log(("XAdd %VGv=%08x reg=%08x -> emulation failed due to page fault!\n", pParam1, valpar1, *pParamReg2));
1464	return VERR_EM_INTERPRETER;
1465	}
1466
1467	LogFlow(("XAdd %VGv=%08x reg=%08x ZF=%d\n", pParam1, valpar1, *pParamReg2, !!(eflags & X86_EFL_ZF)));
1468
1469	/* Update guest's eflags and finish. */
1470	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1471	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1472
1473	*pcbSize = cbSizeParamReg2;
1474	return VINF_SUCCESS;
1475	}
1476	}
1477	return VERR_EM_INTERPRETER;
1478	}
1479	#endif
1480
1481	/**
1482	* Interpret IRET (currently only to V86 code)
1483	*
1484	* @returns VBox status code.
1485	* @param pVM The VM handle.
1486	* @param pRegFrame The register frame.
1487	*
1488	*/
1489	EMDECL(int) EMInterpretIret(PVM pVM, PCPUMCTXCORE pRegFrame)
1490	{
1491	RTGCUINTPTR pIretStack = (RTGCUINTPTR)pRegFrame->esp;
1492	RTGCUINTPTR eip, cs, esp, ss, eflags, ds, es, fs, gs, uMask;
1493	int rc;
1494
1495	rc = emRamRead(pVM, &eip, (RTGCPTR)pIretStack , 4);
1496	rc \|= emRamRead(pVM, &cs, (RTGCPTR)(pIretStack + 4), 4);
1497	rc \|= emRamRead(pVM, &eflags, (RTGCPTR)(pIretStack + 8), 4);
1498	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1499	AssertReturn(eflags & X86_EFL_VM, VERR_EM_INTERPRETER);
1500
1501	rc \|= emRamRead(pVM, &esp, (RTGCPTR)(pIretStack + 12), 4);
1502	rc \|= emRamRead(pVM, &ss, (RTGCPTR)(pIretStack + 16), 4);
1503	rc \|= emRamRead(pVM, &es, (RTGCPTR)(pIretStack + 20), 4);
1504	rc \|= emRamRead(pVM, &ds, (RTGCPTR)(pIretStack + 24), 4);
1505	rc \|= emRamRead(pVM, &fs, (RTGCPTR)(pIretStack + 28), 4);
1506	rc \|= emRamRead(pVM, &gs, (RTGCPTR)(pIretStack + 32), 4);
1507	AssertRCReturn(rc, VERR_EM_INTERPRETER);
1508
1509	pRegFrame->eip = eip & 0xffff;
1510	pRegFrame->cs = cs;
1511
1512	/* Mask away all reserved bits */
1513	uMask = X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_TF \| X86_EFL_IF \| X86_EFL_DF \| X86_EFL_OF \| X86_EFL_IOPL \| X86_EFL_NT \| X86_EFL_RF \| X86_EFL_VM \| X86_EFL_AC \| X86_EFL_VIF \| X86_EFL_VIP \| X86_EFL_ID;
1514	eflags &= uMask;
1515
1516	#ifndef IN_RING0
1517	CPUMRawSetEFlags(pVM, pRegFrame, eflags);
1518	#endif
1519	Assert((pRegFrame->eflags.u32 & (X86_EFL_IF\|X86_EFL_IOPL)) == X86_EFL_IF);
1520
1521	pRegFrame->esp = esp;
1522	pRegFrame->ss = ss;
1523	pRegFrame->ds = ds;
1524	pRegFrame->es = es;
1525	pRegFrame->fs = fs;
1526	pRegFrame->gs = gs;
1527
1528	return VINF_SUCCESS;
1529	}
1530
1531
1532	/**
1533	* IRET Emulation.
1534	*/
1535	static int emInterpretIret(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1536	{
1537	/* only allow direct calls to EMInterpretIret for now */
1538	return VERR_EM_INTERPRETER;
1539	}
1540
1541	/**
1542	* INVLPG Emulation.
1543	*/
1544
1545	/**
1546	* Interpret INVLPG
1547	*
1548	* @returns VBox status code.
1549	* @param pVM The VM handle.
1550	* @param pRegFrame The register frame.
1551	* @param pAddrGC Operand address
1552	*
1553	*/
1554	EMDECL(int) EMInterpretInvlpg(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pAddrGC)
1555	{
1556	int rc;
1557
1558	/** @todo is addr always a flat linear address or ds based
1559	* (in absence of segment override prefixes)????
1560	*/
1561	#ifdef IN_GC
1562	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1563	LogFlow(("GC: EMULATE: invlpg %08X\n", pAddrGC));
1564	rc = PGMGCInvalidatePage(pVM, pAddrGC);
1565	#else
1566	rc = PGMInvalidatePage(pVM, pAddrGC);
1567	#endif
1568	if (VBOX_SUCCESS(rc))
1569	return VINF_SUCCESS;
1570	Log(("PGMInvalidatePage %VGv returned %VGv (%d)\n", pAddrGC, rc, rc));
1571	Assert(rc == VERR_REM_FLUSHED_PAGES_OVERFLOW);
1572	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1573	return VERR_EM_INTERPRETER;
1574	}
1575
1576	static int emInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1577	{
1578	OP_PARAMVAL param1;
1579	RTGCPTR addr;
1580
1581	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1582	if(VBOX_FAILURE(rc))
1583	return VERR_EM_INTERPRETER;
1584
1585	switch(param1.type)
1586	{
1587	case PARMTYPE_IMMEDIATE:
1588	case PARMTYPE_ADDRESS:
1589	if(!(param1.flags & PARAM_VAL32))
1590	return VERR_EM_INTERPRETER;
1591	addr = (RTGCPTR)param1.val.val32;
1592	break;
1593
1594	default:
1595	return VERR_EM_INTERPRETER;
1596	}
1597
1598	/** @todo is addr always a flat linear address or ds based
1599	* (in absence of segment override prefixes)????
1600	*/
1601	#ifdef IN_GC
1602	// Note: we could also use PGMFlushPage here, but it currently doesn't always use invlpg!!!!!!!!!!
1603	LogFlow(("GC: EMULATE: invlpg %08X\n", addr));
1604	rc = PGMGCInvalidatePage(pVM, addr);
1605	#else
1606	rc = PGMInvalidatePage(pVM, addr);
1607	#endif
1608	if (VBOX_SUCCESS(rc))
1609	return VINF_SUCCESS;
1610	/** @todo r=bird: we shouldn't ignore returns codes like this... I'm 99% sure the error is fatal. */
1611	return VERR_EM_INTERPRETER;
1612	}
1613
1614	/**
1615	* CPUID Emulation.
1616	*/
1617
1618	/**
1619	* Interpret CPUID given the parameters in the CPU context
1620	*
1621	* @returns VBox status code.
1622	* @param pVM The VM handle.
1623	* @param pRegFrame The register frame.
1624	*
1625	*/
1626	EMDECL(int) EMInterpretCpuId(PVM pVM, PCPUMCTXCORE pRegFrame)
1627	{
1628	CPUMGetGuestCpuId(pVM, pRegFrame->eax, &pRegFrame->eax, &pRegFrame->ebx, &pRegFrame->ecx, &pRegFrame->edx);
1629	return VINF_SUCCESS;
1630	}
1631
1632	static int emInterpretCpuId(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1633	{
1634	uint32_t iLeaf = pRegFrame->eax; NOREF(iLeaf);
1635
1636	int rc = EMInterpretCpuId(pVM, pRegFrame);
1637	Log(("Emulate: CPUID %x -> %08x %08x %08x %08x\n", iLeaf, pRegFrame->eax, pRegFrame->ebx, pRegFrame->ecx, pRegFrame->edx));
1638	return rc;
1639	}
1640
1641	/**
1642	* MOV CRx Emulation.
1643	*/
1644
1645	/**
1646	* Interpret CRx read
1647	*
1648	* @returns VBox status code.
1649	* @param pVM The VM handle.
1650	* @param pRegFrame The register frame.
1651	* @param DestRegGen General purpose register index (USE_REG_E**))
1652	* @param SrcRegCRx CRx register index (USE_REG_CR*)
1653	*
1654	*/
1655	EMDECL(int) EMInterpretCRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegCrx)
1656	{
1657	uint64_t val64;
1658
1659	int rc = CPUMGetGuestCRx(pVM, SrcRegCrx, &val64);
1660	AssertMsgRCReturn(rc, ("CPUMGetGuestCRx %d failed\n", SrcRegCrx), VERR_EM_INTERPRETER);
1661	/** @todo AMD64 */
1662	rc = DISWriteReg32(pRegFrame, DestRegGen, val64);
1663	if(VBOX_SUCCESS(rc))
1664	{
1665	LogFlow(("MOV_CR: gen32=%d CR=%d val=%VX64\n", DestRegGen, SrcRegCrx, val64));
1666	return VINF_SUCCESS;
1667	}
1668	return VERR_EM_INTERPRETER;
1669	}
1670
1671
1672	/**
1673	* Interpret LMSW
1674	*
1675	* @returns VBox status code.
1676	* @param pVM The VM handle.
1677	* @param u16Data LMSW source data.
1678	*
1679	*/
1680	EMDECL(int) EMInterpretLMSW(PVM pVM, uint16_t u16Data)
1681	{
1682	uint32_t OldCr0 = CPUMGetGuestCR0(pVM);
1683
1684	/* don't use this path to go into protected mode! */
1685	Assert(OldCr0 & X86_CR0_PE);
1686	if (!(OldCr0 & X86_CR0_PE))
1687	return VERR_EM_INTERPRETER;
1688
1689	/* Only PE, MP, EM and TS can be changed; note that PE can't be cleared by this instruction. */
1690	uint32_t NewCr0 = ( OldCr0 & ~( X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS))
1691	\| (u16Data & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS));
1692
1693	#ifdef IN_GC
1694	/* Need to change the hyper CR0? Doing it the lazy way then. */
1695	if ( (OldCr0 & (X86_CR0_AM \| X86_CR0_WP))
1696	!= (NewCr0 & (X86_CR0_AM \| X86_CR0_WP)))
1697	{
1698	Log(("EMInterpretLMSW: CR0: %#x->%#x => R3\n", OldCr0, NewCr0));
1699	VM_FF_SET(pVM, VM_FF_TO_R3);
1700	}
1701	#endif
1702
1703	return CPUMSetGuestCR0(pVM, NewCr0);
1704	}
1705
1706
1707	/**
1708	* Interpret CLTS
1709	*
1710	* @returns VBox status code.
1711	* @param pVM The VM handle.
1712	*
1713	*/
1714	EMDECL(int) EMInterpretCLTS(PVM pVM)
1715	{
1716	uint32_t cr0 = CPUMGetGuestCR0(pVM);
1717	if (!(cr0 & X86_CR0_TS))
1718	return VINF_SUCCESS;
1719	return CPUMSetGuestCR0(pVM, cr0 & ~X86_CR0_TS);
1720	}
1721
1722	static int emInterpretClts(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1723	{
1724	return EMInterpretCLTS(pVM);
1725	}
1726
1727	/**
1728	* Interpret CRx write
1729	*
1730	* @returns VBox status code.
1731	* @param pVM The VM handle.
1732	* @param pRegFrame The register frame.
1733	* @param DestRegCRx CRx register index (USE_REG_CR*)
1734	* @param SrcRegGen General purpose register index (USE_REG_E**))
1735	*
1736	*/
1737	EMDECL(int) EMInterpretCRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegCrx, uint32_t SrcRegGen)
1738	{
1739	uint32_t val32;
1740	uint32_t oldval;
1741	/** @todo Clean up this mess. */
1742
1743	/** @todo AMD64 */
1744	int rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1745	if (VBOX_SUCCESS(rc))
1746	{
1747	switch (DestRegCrx)
1748	{
1749	case USE_REG_CR0:
1750	oldval = CPUMGetGuestCR0(pVM);
1751	#ifdef IN_GC
1752	/* CR0.WP and CR0.AM changes require a reschedule run in ring 3. */
1753	if ( (val32 & (X86_CR0_WP \| X86_CR0_AM))
1754	!= (oldval & (X86_CR0_WP \| X86_CR0_AM)))
1755	return VERR_EM_INTERPRETER;
1756	#endif
1757	CPUMSetGuestCR0(pVM, val32);
1758	val32 = CPUMGetGuestCR0(pVM);
1759	if ( (oldval & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE))
1760	!= (val32 & (X86_CR0_PG \| X86_CR0_WP \| X86_CR0_PE)))
1761	{
1762	/* global flush */
1763	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
1764	AssertRCReturn(rc, rc);
1765	}
1766	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
1767
1768	case USE_REG_CR2:
1769	rc = CPUMSetGuestCR2(pVM, val32); AssertRC(rc);
1770	return VINF_SUCCESS;
1771
1772	case USE_REG_CR3:
1773	/* Reloading the current CR3 means the guest just wants to flush the TLBs */
1774	rc = CPUMSetGuestCR3(pVM, val32); AssertRC(rc);
1775	if (CPUMGetGuestCR0(pVM) & X86_CR0_PG)
1776	{
1777	/* flush */
1778	rc = PGMFlushTLB(pVM, val32, !(CPUMGetGuestCR4(pVM) & X86_CR4_PGE));
1779	AssertRCReturn(rc, rc);
1780	}
1781	return VINF_SUCCESS;
1782
1783	case USE_REG_CR4:
1784	oldval = CPUMGetGuestCR4(pVM);
1785	rc = CPUMSetGuestCR4(pVM, val32); AssertRC(rc);
1786	val32 = CPUMGetGuestCR4(pVM);
1787	if ( (oldval & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE))
1788	!= (val32 & (X86_CR4_PGE\|X86_CR4_PAE\|X86_CR4_PSE)))
1789	{
1790	/* global flush */
1791	rc = PGMFlushTLB(pVM, CPUMGetGuestCR3(pVM), true /* global */);
1792	AssertRCReturn(rc, rc);
1793	}
1794	# ifdef IN_GC
1795	/* Feeling extremely lazy. */
1796	if ( (oldval & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME))
1797	!= (val32 & (X86_CR4_OSFSXR\|X86_CR4_OSXMMEEXCPT\|X86_CR4_PCE\|X86_CR4_MCE\|X86_CR4_PAE\|X86_CR4_DE\|X86_CR4_TSD\|X86_CR4_PVI\|X86_CR4_VME)))
1798	{
1799	Log(("emInterpretMovCRx: CR4: %#x->%#x => R3\n", oldval, val32));
1800	VM_FF_SET(pVM, VM_FF_TO_R3);
1801	}
1802	# endif
1803	return PGMChangeMode(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR4(pVM), CPUMGetGuestEFER(pVM));
1804
1805	default:
1806	AssertFailed();
1807	case USE_REG_CR1: /* illegal op */
1808	break;
1809	}
1810	}
1811	return VERR_EM_INTERPRETER;
1812	}
1813
1814	static int emInterpretMovCRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1815	{
1816	if (pCpu->param1.flags == USE_REG_GEN32 && pCpu->param2.flags == USE_REG_CR)
1817	return EMInterpretCRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_ctrl);
1818	if (pCpu->param1.flags == USE_REG_CR && pCpu->param2.flags == USE_REG_GEN32)
1819	return EMInterpretCRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_ctrl, pCpu->param2.base.reg_gen);
1820	AssertMsgFailedReturn(("Unexpected control register move\n"), VERR_EM_INTERPRETER);
1821	return VERR_EM_INTERPRETER;
1822	}
1823
1824	/**
1825	* MOV DRx
1826	*/
1827
1828	/**
1829	* Interpret DRx write
1830	*
1831	* @returns VBox status code.
1832	* @param pVM The VM handle.
1833	* @param pRegFrame The register frame.
1834	* @param DestRegDRx DRx register index (USE_REG_DR*)
1835	* @param SrcRegGen General purpose register index (USE_REG_E**))
1836	*
1837	*/
1838	EMDECL(int) EMInterpretDRxWrite(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegDrx, uint32_t SrcRegGen)
1839	{
1840	uint32_t val32;
1841
1842	int rc = DISFetchReg32(pRegFrame, SrcRegGen, &val32);
1843	if (VBOX_SUCCESS(rc))
1844	{
1845	rc = CPUMSetGuestDRx(pVM, DestRegDrx, val32);
1846	if (VBOX_SUCCESS(rc))
1847	return rc;
1848	AssertMsgFailed(("CPUMSetGuestDRx %d failed\n", DestRegDrx));
1849	}
1850	return VERR_EM_INTERPRETER;
1851	}
1852
1853	/**
1854	* Interpret DRx read
1855	*
1856	* @returns VBox status code.
1857	* @param pVM The VM handle.
1858	* @param pRegFrame The register frame.
1859	* @param DestRegGen General purpose register index (USE_REG_E**))
1860	* @param SrcRegDRx DRx register index (USE_REG_DR*)
1861	*
1862	*/
1863	EMDECL(int) EMInterpretDRxRead(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t DestRegGen, uint32_t SrcRegDrx)
1864	{
1865	uint32_t val32;
1866
1867	int rc = CPUMGetGuestDRx(pVM, SrcRegDrx, &val32);
1868	AssertMsgRCReturn(rc, ("CPUMGetGuestDRx %d failed\n", SrcRegDrx), VERR_EM_INTERPRETER);
1869	rc = DISWriteReg32(pRegFrame, DestRegGen, val32);
1870	if (VBOX_SUCCESS(rc))
1871	return VINF_SUCCESS;
1872	return VERR_EM_INTERPRETER;
1873	}
1874
1875	static int emInterpretMovDRx(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1876	{
1877	int rc = VERR_EM_INTERPRETER;
1878
1879	if(pCpu->param1.flags == USE_REG_GEN32 && pCpu->param2.flags == USE_REG_DBG)
1880	{
1881	rc = EMInterpretDRxRead(pVM, pRegFrame, pCpu->param1.base.reg_gen, pCpu->param2.base.reg_dbg);
1882	}
1883	else
1884	if(pCpu->param1.flags == USE_REG_DBG && pCpu->param2.flags == USE_REG_GEN32)
1885	{
1886	rc = EMInterpretDRxWrite(pVM, pRegFrame, pCpu->param1.base.reg_dbg, pCpu->param2.base.reg_gen);
1887	}
1888	else
1889	AssertMsgFailed(("Unexpected debug register move\n"));
1890	return rc;
1891	}
1892
1893	/**
1894	* LLDT Emulation.
1895	*/
1896	static int emInterpretLLdt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1897	{
1898	OP_PARAMVAL param1;
1899	RTSEL sel;
1900
1901	int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1902	if(VBOX_FAILURE(rc))
1903	return VERR_EM_INTERPRETER;
1904
1905	switch(param1.type)
1906	{
1907	case PARMTYPE_ADDRESS:
1908	return VERR_EM_INTERPRETER; //feeling lazy right now
1909
1910	case PARMTYPE_IMMEDIATE:
1911	if(!(param1.flags & PARAM_VAL16))
1912	return VERR_EM_INTERPRETER;
1913	sel = (RTSEL)param1.val.val16;
1914	break;
1915
1916	default:
1917	return VERR_EM_INTERPRETER;
1918	}
1919
1920	if (sel == 0)
1921	{
1922	if (CPUMGetHyperLDTR(pVM) == 0)
1923	{
1924	// this simple case is most frequent in Windows 2000 (31k - boot & shutdown)
1925	return VINF_SUCCESS;
1926	}
1927	}
1928	//still feeling lazy
1929	return VERR_EM_INTERPRETER;
1930	}
1931
1932	#ifdef IN_GC
1933	/**
1934	* STI Emulation.
1935	*
1936	* @remark the instruction following sti is guaranteed to be executed before any interrupts are dispatched
1937	*/
1938	static int emInterpretSti(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1939	{
1940	PPATMGCSTATE pGCState = PATMQueryGCState(pVM);
1941
1942	if(!pGCState)
1943	{
1944	Assert(pGCState);
1945	return VERR_EM_INTERPRETER;
1946	}
1947	pGCState->uVMFlags \|= X86_EFL_IF;
1948
1949	Assert(pRegFrame->eflags.u32 & X86_EFL_IF);
1950	Assert(pvFault == SELMToFlat(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip));
1951
1952	pVM->em.s.GCPtrInhibitInterrupts = pRegFrame->eip + pCpu->opsize;
1953	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
1954
1955	return VINF_SUCCESS;
1956	}
1957	#endif /* IN_GC */
1958
1959
1960	/**
1961	* HLT Emulation.
1962	*/
1963	static int emInterpretHlt(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1964	{
1965	return VINF_EM_HALT;
1966	}
1967
1968
1969	/**
1970	* RDTSC Emulation.
1971	*/
1972
1973	/**
1974	* Interpret RDTSC
1975	*
1976	* @returns VBox status code.
1977	* @param pVM The VM handle.
1978	* @param pRegFrame The register frame.
1979	*
1980	*/
1981	EMDECL(int) EMInterpretRdtsc(PVM pVM, PCPUMCTXCORE pRegFrame)
1982	{
1983	unsigned uCR4 = CPUMGetGuestCR4(pVM);
1984
1985	if (uCR4 & X86_CR4_TSD)
1986	return VERR_EM_INTERPRETER; /* genuine #GP */
1987
1988	uint64_t uTicks = TMCpuTickGet(pVM);
1989
1990	pRegFrame->eax = uTicks;
1991	pRegFrame->edx = (uTicks >> 32ULL);
1992
1993	return VINF_SUCCESS;
1994	}
1995
1996	static int emInterpretRdtsc(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
1997	{
1998	return EMInterpretRdtsc(pVM, pRegFrame);
1999	}
2000
2001	/**
2002	* MONITOR Emulation.
2003	*/
2004	static int emInterpretMonitor(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2005	{
2006	uint32_t u32Dummy, u32ExtFeatures, cpl;
2007
2008	if (pRegFrame->ecx != 0)
2009	return VERR_EM_INTERPRETER; /* illegal value. */
2010
2011	/* Get the current privilege level. */
2012	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2013	if (cpl != 0)
2014	return VERR_EM_INTERPRETER; /* supervisor only */
2015
2016	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2017	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2018	return VERR_EM_INTERPRETER; /* not supported */
2019
2020	return VINF_SUCCESS;
2021	}
2022
2023
2024	/**
2025	* MWAIT Emulation.
2026	*/
2027	static int emInterpretMWait(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2028	{
2029	uint32_t u32Dummy, u32ExtFeatures, cpl;
2030
2031	if (pRegFrame->ecx != 0)
2032	return VERR_EM_INTERPRETER; /* illegal value. */
2033
2034	/* Get the current privilege level. */
2035	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2036	if (cpl != 0)
2037	return VERR_EM_INTERPRETER; /* supervisor only */
2038
2039	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Dummy);
2040	if (!(u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR))
2041	return VERR_EM_INTERPRETER; /* not supported */
2042
2043	/** @todo not completely correct */
2044	return VINF_EM_HALT;
2045	}
2046
2047	/**
2048	* Interpret RDMSR
2049	*
2050	* @returns VBox status code.
2051	* @param pVM The VM handle.
2052	* @param pRegFrame The register frame.
2053	*
2054	*/
2055	EMDECL(int) EMInterpretRdmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2056	{
2057	uint32_t u32Dummy, u32Features, cpl;
2058	uint64_t val;
2059	CPUMCTX *pCtx;
2060	int rc;
2061
2062	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2063	AssertRC(rc);
2064
2065	/* Get the current privilege level. */
2066	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2067	if (cpl != 0)
2068	return VERR_EM_INTERPRETER; /* supervisor only */
2069
2070	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2071	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2072	return VERR_EM_INTERPRETER; /* not supported */
2073
2074	switch (pRegFrame->ecx)
2075	{
2076	case MSR_IA32_APICBASE:
2077	rc = PDMApicGetBase(pVM, &val);
2078	AssertRC(rc);
2079	break;
2080
2081	case MSR_IA32_CR_PAT:
2082	val = pCtx->msrPAT;
2083	break;
2084
2085	case MSR_IA32_SYSENTER_CS:
2086	val = pCtx->SysEnter.cs;
2087	break;
2088
2089	case MSR_IA32_SYSENTER_EIP:
2090	val = pCtx->SysEnter.eip;
2091	break;
2092
2093	case MSR_IA32_SYSENTER_ESP:
2094	val = pCtx->SysEnter.esp;
2095	break;
2096
2097	case MSR_K6_EFER:
2098	val = pCtx->msrEFER;
2099	break;
2100
2101	case MSR_K8_SF_MASK:
2102	val = pCtx->msrSFMASK;
2103	break;
2104
2105	case MSR_K6_STAR:
2106	val = pCtx->msrSTAR;
2107	break;
2108
2109	case MSR_K8_LSTAR:
2110	val = pCtx->msrLSTAR;
2111	break;
2112
2113	case MSR_K8_CSTAR:
2114	val = pCtx->msrCSTAR;
2115	break;
2116
2117	case MSR_K8_FS_BASE:
2118	val = pCtx->msrFSBASE;
2119	break;
2120
2121	case MSR_K8_GS_BASE:
2122	val = pCtx->msrGSBASE;
2123	break;
2124
2125	case MSR_K8_KERNEL_GS_BASE:
2126	val = pCtx->msrKERNELGSBASE;
2127	break;
2128
2129	default:
2130	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2131	val = 0;
2132	break;
2133	}
2134	Log(("EMInterpretRdmsr %x -> val=%VX64\n", pRegFrame->ecx, val));
2135	pRegFrame->eax = (uint32_t) val;
2136	pRegFrame->edx = (uint32_t) (val >> 32ULL);
2137	return VINF_SUCCESS;
2138	}
2139
2140	/**
2141	* RDMSR Emulation.
2142	*/
2143	static int emInterpretRdmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2144	{
2145	return EMInterpretRdmsr(pVM, pRegFrame);
2146	}
2147
2148	/**
2149	* Interpret WRMSR
2150	*
2151	* @returns VBox status code.
2152	* @param pVM The VM handle.
2153	* @param pRegFrame The register frame.
2154	*
2155	*/
2156	EMDECL(int) EMInterpretWrmsr(PVM pVM, PCPUMCTXCORE pRegFrame)
2157	{
2158	uint32_t u32Dummy, u32Features, cpl;
2159	uint64_t val;
2160	CPUMCTX *pCtx;
2161	int rc;
2162
2163	rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2164	AssertRC(rc);
2165
2166	/* Get the current privilege level. */
2167	cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2168	if (cpl != 0)
2169	return VERR_EM_INTERPRETER; /* supervisor only */
2170
2171	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32Dummy, &u32Features);
2172	if (!(u32Features & X86_CPUID_FEATURE_EDX_MSR))
2173	return VERR_EM_INTERPRETER; /* not supported */
2174
2175	val = (uint64_t)pRegFrame->eax \| ((uint64_t)pRegFrame->edx << 32ULL);
2176	Log(("EMInterpretWrmsr %x val=%VX64\n", pRegFrame->ecx, val));
2177	switch (pRegFrame->ecx)
2178	{
2179	case MSR_IA32_APICBASE:
2180	rc = PDMApicSetBase(pVM, val);
2181	AssertRC(rc);
2182	break;
2183
2184	case MSR_IA32_CR_PAT:
2185	pCtx->msrPAT = val;
2186	break;
2187
2188	case MSR_IA32_SYSENTER_CS:
2189	pCtx->SysEnter.cs = val;
2190	break;
2191
2192	case MSR_IA32_SYSENTER_EIP:
2193	pCtx->SysEnter.eip = val;
2194	break;
2195
2196	case MSR_IA32_SYSENTER_ESP:
2197	pCtx->SysEnter.esp = val;
2198	break;
2199
2200	case MSR_K6_EFER:
2201	AssertFailed();
2202	pCtx->msrEFER = val;
2203	break;
2204
2205	case MSR_K8_SF_MASK:
2206	pCtx->msrSFMASK = val;
2207	break;
2208
2209	case MSR_K6_STAR:
2210	pCtx->msrSTAR = val;
2211	break;
2212
2213	case MSR_K8_LSTAR:
2214	pCtx->msrLSTAR = val;
2215	break;
2216
2217	case MSR_K8_CSTAR:
2218	pCtx->msrCSTAR = val;
2219	break;
2220
2221	case MSR_K8_FS_BASE:
2222	pCtx->msrFSBASE = val;
2223	break;
2224
2225	case MSR_K8_GS_BASE:
2226	pCtx->msrGSBASE = val;
2227	break;
2228
2229	case MSR_K8_KERNEL_GS_BASE:
2230	pCtx->msrKERNELGSBASE = val;
2231	break;
2232
2233	default:
2234	/* We should actually trigger a #GP here, but don't as that might cause more trouble. */
2235	break;
2236	}
2237	return VINF_SUCCESS;
2238	}
2239
2240	/**
2241	* WRMSR Emulation.
2242	*/
2243	static int emInterpretWrmsr(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2244	{
2245	return EMInterpretWrmsr(pVM, pRegFrame);
2246	}
2247
2248	/**
2249	* Internal worker.
2250	* @copydoc EMInterpretInstructionCPU
2251	*/
2252	DECLINLINE(int) emInterpretInstructionCPU(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize)
2253	{
2254	Assert(pcbSize);
2255	*pcbSize = 0;
2256
2257	/*
2258	* Only supervisor guest code!!
2259	* And no complicated prefixes.
2260	*/
2261	/* Get the current privilege level. */
2262	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
2263	if ( cpl != 0
2264	&& pCpu->pCurInstr->opcode != OP_RDTSC) /* rdtsc requires emulation in ring 3 as well */
2265	{
2266	Log(("WARNING: refusing instruction emulation for user-mode code!!\n"));
2267	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedUserMode));
2268	return VERR_EM_INTERPRETER;
2269	}
2270
2271	#ifdef IN_GC
2272	if ( (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP))
2273	\|\| ( (pCpu->prefix & PREFIX_LOCK)
2274	&& pCpu->pCurInstr->opcode != OP_CMPXCHG
2275	&& pCpu->pCurInstr->opcode != OP_CMPXCHG8B
2276	&& pCpu->pCurInstr->opcode != OP_XADD
2277	&& pCpu->pCurInstr->opcode != OP_OR
2278	&& pCpu->pCurInstr->opcode != OP_BTR
2279	)
2280	)
2281	#else
2282	if (pCpu->prefix & (PREFIX_REPNE \| PREFIX_REP \| PREFIX_LOCK))
2283	#endif
2284	{
2285	//Log(("EMInterpretInstruction: wrong prefix!!\n"));
2286	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedPrefix));
2287	return VERR_EM_INTERPRETER;
2288	}
2289
2290	int rc;
2291	switch (pCpu->pCurInstr->opcode)
2292	{
2293	#ifdef IN_GC
2294	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2295	case opcode:\
2296	if (pCpu->prefix & PREFIX_LOCK) \
2297	rc = emInterpretLock##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulateLock); \
2298	else \
2299	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2300	if (VBOX_SUCCESS(rc)) \
2301	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
2302	else \
2303	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
2304	return rc
2305	#else
2306	# define INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2307	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
2308	#endif
2309	#define INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate) \
2310	case opcode:\
2311	rc = emInterpret##InstrFn(pVM, pCpu, pRegFrame, pvFault, pcbSize, pfnEmulate); \
2312	if (VBOX_SUCCESS(rc)) \
2313	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
2314	else \
2315	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
2316	return rc
2317
2318	#define INTERPRET_CASE_EX_PARAM2(opcode, Instr, InstrFn, pfnEmulate) \
2319	INTERPRET_CASE_EX_PARAM3(opcode, Instr, InstrFn, pfnEmulate)
2320	#define INTERPRET_CASE_EX_LOCK_PARAM2(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock) \
2321	INTERPRET_CASE_EX_LOCK_PARAM3(opcode, Instr, InstrFn, pfnEmulate, pfnEmulateLock)
2322
2323	#define INTERPRET_CASE(opcode, Instr) \
2324	case opcode:\
2325	rc = emInterpret##Instr(pVM, pCpu, pRegFrame, pvFault, pcbSize); \
2326	if (VBOX_SUCCESS(rc)) \
2327	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Instr)); \
2328	else \
2329	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); \
2330	return rc
2331	#define INTERPRET_STAT_CASE(opcode, Instr) \
2332	case opcode: STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,Failed##Instr)); return VERR_EM_INTERPRETER;
2333
2334	INTERPRET_CASE(OP_XCHG,Xchg);
2335	INTERPRET_CASE_EX_PARAM2(OP_DEC,Dec, IncDec, EMEmulateDec);
2336	INTERPRET_CASE_EX_PARAM2(OP_INC,Inc, IncDec, EMEmulateInc);
2337	INTERPRET_CASE(OP_POP,Pop);
2338	INTERPRET_CASE_EX_LOCK_PARAM3(OP_OR, Or, OrXorAnd, EMEmulateOr, EMEmulateLockOr);
2339	INTERPRET_CASE_EX_PARAM3(OP_XOR,Xor, OrXorAnd, EMEmulateXor);
2340	INTERPRET_CASE_EX_PARAM3(OP_AND,And, OrXorAnd, EMEmulateAnd);
2341	INTERPRET_CASE(OP_MOV,Mov);
2342	INTERPRET_CASE(OP_INVLPG,InvlPg);
2343	INTERPRET_CASE(OP_CPUID,CpuId);
2344	INTERPRET_CASE(OP_MOV_CR,MovCRx);
2345	INTERPRET_CASE(OP_MOV_DR,MovDRx);
2346	INTERPRET_CASE(OP_LLDT,LLdt);
2347	INTERPRET_CASE(OP_CLTS,Clts);
2348	INTERPRET_CASE(OP_MONITOR, Monitor);
2349	INTERPRET_CASE(OP_MWAIT, MWait);
2350	#ifdef VBOX_WITH_MSR_EMULATION
2351	INTERPRET_CASE(OP_RDMSR, Rdmsr);
2352	INTERPRET_CASE(OP_WRMSR, Wrmsr);
2353	#endif
2354	INTERPRET_CASE_EX_PARAM3(OP_ADD,Add, AddSub, EMEmulateAdd);
2355	INTERPRET_CASE_EX_PARAM3(OP_SUB,Sub, AddSub, EMEmulateSub);
2356	INTERPRET_CASE(OP_ADC,Adc);
2357	INTERPRET_CASE_EX_LOCK_PARAM2(OP_BTR,Btr, BitTest, EMEmulateBtr, EMEmulateLockBtr);
2358	INTERPRET_CASE_EX_PARAM2(OP_BTS,Bts, BitTest, EMEmulateBts);
2359	INTERPRET_CASE_EX_PARAM2(OP_BTC,Btc, BitTest, EMEmulateBtc);
2360	INTERPRET_CASE(OP_RDTSC,Rdtsc);
2361	#ifdef IN_GC
2362	INTERPRET_CASE(OP_STI,Sti);
2363	INTERPRET_CASE(OP_CMPXCHG, CmpXchg);
2364	INTERPRET_CASE(OP_CMPXCHG8B, CmpXchg8b);
2365	INTERPRET_CASE(OP_XADD, XAdd);
2366	#endif
2367	INTERPRET_CASE(OP_HLT,Hlt);
2368	INTERPRET_CASE(OP_IRET,Iret);
2369	#ifdef VBOX_WITH_STATISTICS
2370	#ifndef IN_GC
2371	INTERPRET_STAT_CASE(OP_CMPXCHG,CmpXchg);
2372	INTERPRET_STAT_CASE(OP_CMPXCHG8B, CmpXchg8b);
2373	INTERPRET_STAT_CASE(OP_XADD, XAdd);
2374	#endif
2375	INTERPRET_STAT_CASE(OP_MOVNTPS,MovNTPS);
2376	INTERPRET_STAT_CASE(OP_STOSWD,StosWD);
2377	INTERPRET_STAT_CASE(OP_WBINVD,WbInvd);
2378	#endif
2379	default:
2380	Log3(("emInterpretInstructionCPU: opcode=%d\n", pCpu->pCurInstr->opcode));
2381	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->CTXMID(Stat,FailedMisc));
2382	return VERR_EM_INTERPRETER;
2383	#undef INTERPRET_CASE_EX_PARAM2
2384	#undef INTERPRET_STAT_CASE
2385	#undef INTERPRET_CASE_EX
2386	#undef INTERPRET_CASE
2387	}
2388	AssertFailed();
2389	return VERR_INTERNAL_ERROR;
2390	}
2391
2392
2393	/**
2394	* Sets the PC for which interrupts should be inhibited.
2395	*
2396	* @param pVM The VM handle.
2397	* @param PC The PC.
2398	*/
2399	EMDECL(void) EMSetInhibitInterruptsPC(PVM pVM, RTGCUINTPTR PC)
2400	{
2401	pVM->em.s.GCPtrInhibitInterrupts = PC;
2402	VM_FF_SET(pVM, VM_FF_INHIBIT_INTERRUPTS);
2403	}
2404
2405
2406	/**
2407	* Gets the PC for which interrupts should be inhibited.
2408	*
2409	* There are a few instructions which inhibits or delays interrupts
2410	* for the instruction following them. These instructions are:
2411	* - STI
2412	* - MOV SS, r/m16
2413	* - POP SS
2414	*
2415	* @returns The PC for which interrupts should be inhibited.
2416	* @param pVM VM handle.
2417	*
2418	*/
2419	EMDECL(RTGCUINTPTR) EMGetInhibitInterruptsPC(PVM pVM)
2420	{
2421	return pVM->em.s.GCPtrInhibitInterrupts;
2422	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/EMAll.cpp@ 9300

Download in other formats: