IOMAllMMIO.cpp@ 31996

Last change on this file since 31996 was 31593, checked in by vboxsync, 14 years ago
PGM,IOM: MMIO optimization - hacking in progress. (still disabled)
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 71.9 KB

Line
1	/* $Id: IOMAllMMIO.cpp 31593 2010-08-12 00:52:52Z vboxsync $ */
2	/** @file
3	* IOM - Input / Output Monitor - Any Context, MMIO & String I/O.
4	*/
5
6	/*
7	* Copyright (C) 2006-2010 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_IOM
23	#include <VBox/iom.h>
24	#include <VBox/cpum.h>
25	#include <VBox/pgm.h>
26	#include <VBox/selm.h>
27	#include <VBox/mm.h>
28	#include <VBox/em.h>
29	#include <VBox/pgm.h>
30	#include <VBox/trpm.h>
31	#include "IOMInternal.h"
32	#include <VBox/vm.h>
33	#include <VBox/vmm.h>
34	#include <VBox/hwaccm.h>
35
36	#include <VBox/dis.h>
37	#include <VBox/disopcode.h>
38	#include <VBox/pdmdev.h>
39	#include <VBox/param.h>
40	#include <VBox/err.h>
41	#include <iprt/assert.h>
42	#include <VBox/log.h>
43	#include <iprt/asm.h>
44	#include <iprt/string.h>
45
46
47	/*******************************************************************************
48	* Global Variables *
49	*******************************************************************************/
50
51	/**
52	* Array for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
53	*/
54	static const unsigned g_aSize2Shift[] =
55	{
56	~0, /* 0 - invalid */
57	0, /* 1 == 2^0 /
58	1, /* 2 == 2^1 /
59	~0, /* 3 - invalid */
60	2, /* 4 == 2^2 /
61	~0, /* 5 - invalid */
62	~0, /* 6 - invalid */
63	~0, /* 7 - invalid */
64	3 /* 8 == 2^3 /
65	};
66
67	/**
68	* Macro for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
69	*/
70	#define SIZE_2_SHIFT(cb) (g_aSize2Shift[cb])
71
72
73	/**
74	* Wrapper which does the write and updates range statistics when such are enabled.
75	* @warning RT_SUCCESS(rc=VINF_IOM_HC_MMIO_WRITE) is TRUE!
76	*/
77	DECLINLINE(int) iomMMIODoWrite(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cb)
78	{
79	#ifdef VBOX_WITH_STATISTICS
80	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
81	Assert(pStats);
82	#endif
83
84	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
85	int rc;
86	if (RT_LIKELY(pRange->CTX_SUFF(pfnWriteCallback)))
87	rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhysFault, (void )pvData, cb); /* @todo fix const!! */
88	else
89	rc = VINF_SUCCESS;
90	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
91	STAM_COUNTER_INC(&pStats->Accesses);
92	return rc;
93	}
94
95
96	/**
97	* Wrapper which does the read and updates range statistics when such are enabled.
98	*/
99	DECLINLINE(int) iomMMIODoRead(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
100	{
101	#ifdef VBOX_WITH_STATISTICS
102	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
103	Assert(pStats);
104	#endif
105
106	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a);
107	int rc;
108	if (RT_LIKELY(pRange->CTX_SUFF(pfnReadCallback)))
109	rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pvValue, cbValue);
110	else
111	rc = VINF_IOM_MMIO_UNUSED_FF;
112	if (rc != VINF_SUCCESS)
113	{
114	switch (rc)
115	{
116	case VINF_IOM_MMIO_UNUSED_FF:
117	switch (cbValue)
118	{
119	case 1: (uint8_t )pvValue = UINT8_C(0xff); break;
120	case 2: (uint16_t )pvValue = UINT16_C(0xffff); break;
121	case 4: (uint32_t )pvValue = UINT32_C(0xffffffff); break;
122	case 8: (uint64_t )pvValue = UINT64_C(0xffffffffffffffff); break;
123	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
124	}
125	rc = VINF_SUCCESS;
126	break;
127
128	case VINF_IOM_MMIO_UNUSED_00:
129	switch (cbValue)
130	{
131	case 1: (uint8_t )pvValue = UINT8_C(0x00); break;
132	case 2: (uint16_t )pvValue = UINT16_C(0x0000); break;
133	case 4: (uint32_t )pvValue = UINT32_C(0x00000000); break;
134	case 8: (uint64_t )pvValue = UINT64_C(0x0000000000000000); break;
135	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
136	}
137	rc = VINF_SUCCESS;
138	break;
139	}
140	}
141	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
142	STAM_COUNTER_INC(&pStats->Accesses);
143	return rc;
144	}
145
146
147	/**
148	* Internal - statistics only.
149	*/
150	DECLINLINE(void) iomMMIOStatLength(PVM pVM, unsigned cb)
151	{
152	#ifdef VBOX_WITH_STATISTICS
153	switch (cb)
154	{
155	case 1:
156	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO1Byte);
157	break;
158	case 2:
159	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO2Bytes);
160	break;
161	case 4:
162	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO4Bytes);
163	break;
164	case 8:
165	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO8Bytes);
166	break;
167	default:
168	/* No way. */
169	AssertMsgFailed(("Invalid data length %d\n", cb));
170	break;
171	}
172	#else
173	NOREF(pVM); NOREF(cb);
174	#endif
175	}
176
177
178	/**
179	* MOV reg, mem (read)
180	* MOVZX reg, mem (read)
181	* MOVSX reg, mem (read)
182	*
183	* @returns VBox status code.
184	*
185	* @param pVM The virtual machine.
186	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
187	* @param pCpu Disassembler CPU state.
188	* @param pRange Pointer MMIO range.
189	* @param GCPhysFault The GC physical address corresponding to pvFault.
190	*/
191	static int iomInterpretMOVxXRead(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
192	{
193	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
194
195	/*
196	* Get the data size from parameter 2,
197	* and call the handler function to get the data.
198	*/
199	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
200	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
201
202	uint64_t u64Data = 0;
203	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &u64Data, cb);
204	if (rc == VINF_SUCCESS)
205	{
206	/*
207	* Do sign extension for MOVSX.
208	*/
209	/** @todo checkup MOVSX implementation! */
210	if (pCpu->pCurInstr->opcode == OP_MOVSX)
211	{
212	if (cb == 1)
213	{
214	/* DWORD <- BYTE */
215	int64_t iData = (int8_t)u64Data;
216	u64Data = (uint64_t)iData;
217	}
218	else
219	{
220	/* DWORD <- WORD */
221	int64_t iData = (int16_t)u64Data;
222	u64Data = (uint64_t)iData;
223	}
224	}
225
226	/*
227	* Store the result to register (parameter 1).
228	*/
229	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, u64Data);
230	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
231	}
232
233	if (rc == VINF_SUCCESS)
234	iomMMIOStatLength(pVM, cb);
235	return rc;
236	}
237
238
239	/**
240	* MOV mem, reg\|imm (write)
241	*
242	* @returns VBox status code.
243	*
244	* @param pVM The virtual machine.
245	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
246	* @param pCpu Disassembler CPU state.
247	* @param pRange Pointer MMIO range.
248	* @param GCPhysFault The GC physical address corresponding to pvFault.
249	*/
250	static int iomInterpretMOVxXWrite(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
251	{
252	Assert(pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
253
254	/*
255	* Get data to write from second parameter,
256	* and call the callback to write it.
257	*/
258	unsigned cb = 0;
259	uint64_t u64Data = 0;
260	bool fRc = iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &u64Data, &cb);
261	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
262
263	int rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &u64Data, cb);
264	if (rc == VINF_SUCCESS)
265	iomMMIOStatLength(pVM, cb);
266	return rc;
267	}
268
269
270	/** Wrapper for reading virtual memory. */
271	DECLINLINE(int) iomRamRead(PVMCPU pVCpu, void *pDest, RTGCPTR GCSrc, uint32_t cb)
272	{
273	/* Note: This will fail in R0 or RC if it hits an access handler. That
274	isn't a problem though since the operation can be restarted in REM. */
275	#ifdef IN_RC
276	return MMGCRamReadNoTrapHandler(pDest, (void *)(uintptr_t)GCSrc, cb);
277	#else
278	return PGMPhysReadGCPtr(pVCpu, pDest, GCSrc, cb);
279	#endif
280	}
281
282
283	/** Wrapper for writing virtual memory. */
284	DECLINLINE(int) iomRamWrite(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, void *pvSrc, uint32_t cb)
285	{
286	/** @todo Need to update PGMVerifyAccess to take access handlers into account for Ring-0 and
287	* raw mode code. Some thought needs to be spent on theoretical concurrency issues as
288	* as well since we're not behind the pgm lock and handler may change between calls.
289	*
290	* PGMPhysInterpretedWriteNoHandlers/PGMPhysWriteGCPtr may mess up
291	* the state of some shadowed structures. */
292	#if defined(IN_RING0) \|\| defined(IN_RC)
293	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, false /fRaiseTrap/);
294	#else
295	NOREF(pCtxCore);
296	return PGMPhysWriteGCPtr(pVCpu, GCPtrDst, pvSrc, cb);
297	#endif
298	}
299
300
301	#ifdef IOM_WITH_MOVS_SUPPORT
302	/**
303	* [REP] MOVSB
304	* [REP] MOVSW
305	* [REP] MOVSD
306	*
307	* Restricted implementation.
308	*
309	*
310	* @returns VBox status code.
311	*
312	* @param pVM The virtual machine.
313	* @param uErrorCode CPU Error code.
314	* @param pRegFrame Trap register frame.
315	* @param GCPhysFault The GC physical address corresponding to pvFault.
316	* @param pCpu Disassembler CPU state.
317	* @param pRange Pointer MMIO range.
318	* @param ppStat Which sub-sample to attribute this call to.
319	*/
320	static int iomInterpretMOVS(PVM pVM, bool fWriteAccess, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, PSTAMPROFILE *ppStat)
321	{
322	/*
323	* We do not support segment prefixes or REPNE.
324	*/
325	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
326	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> interpret whatever. */
327
328	PVMCPU pVCpu = VMMGetCpu(pVM);
329
330	/*
331	* Get bytes/words/dwords/qword count to copy.
332	*/
333	uint32_t cTransfers = 1;
334	if (pCpu->prefix & PREFIX_REP)
335	{
336	#ifndef IN_RC
337	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
338	&& pRegFrame->rcx >= _4G)
339	return VINF_EM_RAW_EMULATE_INSTR;
340	#endif
341
342	cTransfers = pRegFrame->ecx;
343	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
344	cTransfers &= 0xffff;
345
346	if (!cTransfers)
347	return VINF_SUCCESS;
348	}
349
350	/* Get the current privilege level. */
351	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
352
353	/*
354	* Get data size.
355	*/
356	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
357	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
358	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
359
360	#ifdef VBOX_WITH_STATISTICS
361	if (pVM->iom.s.cMovsMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
362	pVM->iom.s.cMovsMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
363	#endif
364
365	/** @todo re-evaluate on page boundraries. */
366
367	RTGCPHYS Phys = GCPhysFault;
368	int rc;
369	if (fWriteAccess)
370	{
371	/*
372	* Write operation: [Mem] -> [MMIO]
373	* ds:esi (Virt Src) -> es:edi (Phys Dst)
374	*/
375	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsToMMIO; });
376
377	/* Check callback. */
378	if (!pRange->CTX_SUFF(pfnWriteCallback))
379	return VINF_IOM_HC_MMIO_WRITE;
380
381	/* Convert source address ds:esi. */
382	RTGCUINTPTR pu8Virt;
383	rc = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, (RTGCPTR)pRegFrame->rsi,
384	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
385	(PRTGCPTR)&pu8Virt);
386	if (RT_SUCCESS(rc))
387	{
388
389	/* Access verification first; we currently can't recover properly from traps inside this instruction */
390	rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, (cpl == 3) ? X86_PTE_US : 0);
391	if (rc != VINF_SUCCESS)
392	{
393	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
394	return VINF_EM_RAW_EMULATE_INSTR;
395	}
396
397	#ifdef IN_RC
398	MMGCRamRegisterTrapHandler(pVM);
399	#endif
400
401	/* copy loop. */
402	while (cTransfers)
403	{
404	uint32_t u32Data = 0;
405	rc = iomRamRead(pVCpu, &u32Data, (RTGCPTR)pu8Virt, cb);
406	if (rc != VINF_SUCCESS)
407	break;
408	rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
409	if (rc != VINF_SUCCESS)
410	break;
411
412	pu8Virt += offIncrement;
413	Phys += offIncrement;
414	pRegFrame->rsi += offIncrement;
415	pRegFrame->rdi += offIncrement;
416	cTransfers--;
417	}
418	#ifdef IN_RC
419	MMGCRamDeregisterTrapHandler(pVM);
420	#endif
421	/* Update ecx. */
422	if (pCpu->prefix & PREFIX_REP)
423	pRegFrame->ecx = cTransfers;
424	}
425	else
426	rc = VINF_IOM_HC_MMIO_READ_WRITE;
427	}
428	else
429	{
430	/*
431	* Read operation: [MMIO] -> [mem] or [MMIO] -> [MMIO]
432	* ds:[eSI] (Phys Src) -> es:[eDI] (Virt Dst)
433	*/
434	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsFromMMIO; });
435
436	/* Check callback. */
437	if (!pRange->CTX_SUFF(pfnReadCallback))
438	return VINF_IOM_HC_MMIO_READ;
439
440	/* Convert destination address. */
441	RTGCUINTPTR pu8Virt;
442	rc = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, (RTGCPTR)pRegFrame->rdi,
443	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
444	(RTGCPTR *)&pu8Virt);
445	if (RT_FAILURE(rc))
446	return VINF_IOM_HC_MMIO_READ;
447
448	/* Check if destination address is MMIO. */
449	PIOMMMIORANGE pMMIODst;
450	RTGCPHYS PhysDst;
451	rc = PGMGstGetPage(pVCpu, (RTGCPTR)pu8Virt, NULL, &PhysDst);
452	PhysDst \|= (RTGCUINTPTR)pu8Virt & PAGE_OFFSET_MASK;
453	if ( RT_SUCCESS(rc)
454	&& (pMMIODst = iomMMIOGetRange(&pVM->iom.s, PhysDst)))
455	{
456	/** @todo implement per-device locks for MMIO access. */
457	Assert(!pMMIODst->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
458
459	/*
460	* Extra: [MMIO] -> [MMIO]
461	*/
462	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsMMIO; });
463	if (!pMMIODst->CTX_SUFF(pfnWriteCallback) && pMMIODst->pfnWriteCallbackR3)
464	return VINF_IOM_HC_MMIO_READ_WRITE;
465
466	/* copy loop. */
467	while (cTransfers)
468	{
469	uint32_t u32Data;
470	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
471	if (rc != VINF_SUCCESS)
472	break;
473	rc = iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb);
474	if (rc != VINF_SUCCESS)
475	break;
476
477	Phys += offIncrement;
478	PhysDst += offIncrement;
479	pRegFrame->rsi += offIncrement;
480	pRegFrame->rdi += offIncrement;
481	cTransfers--;
482	}
483	}
484	else
485	{
486	/*
487	* Normal: [MMIO] -> [Mem]
488	*/
489	/* Access verification first; we currently can't recover properly from traps inside this instruction */
490	rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
491	if (rc != VINF_SUCCESS)
492	{
493	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
494	return VINF_EM_RAW_EMULATE_INSTR;
495	}
496
497	/* copy loop. */
498	#ifdef IN_RC
499	MMGCRamRegisterTrapHandler(pVM);
500	#endif
501	while (cTransfers)
502	{
503	uint32_t u32Data;
504	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
505	if (rc != VINF_SUCCESS)
506	break;
507	rc = iomRamWrite(pVCpu, pRegFrame, (RTGCPTR)pu8Virt, &u32Data, cb);
508	if (rc != VINF_SUCCESS)
509	{
510	Log(("iomRamWrite %08X size=%d failed with %d\n", pu8Virt, cb, rc));
511	break;
512	}
513
514	pu8Virt += offIncrement;
515	Phys += offIncrement;
516	pRegFrame->rsi += offIncrement;
517	pRegFrame->rdi += offIncrement;
518	cTransfers--;
519	}
520	#ifdef IN_RC
521	MMGCRamDeregisterTrapHandler(pVM);
522	#endif
523	}
524
525	/* Update ecx on exit. */
526	if (pCpu->prefix & PREFIX_REP)
527	pRegFrame->ecx = cTransfers;
528	}
529
530	/* work statistics. */
531	if (rc == VINF_SUCCESS)
532	iomMMIOStatLength(pVM, cb);
533	NOREF(ppStat);
534	return rc;
535	}
536	#endif /* IOM_WITH_MOVS_SUPPORT */
537
538
539	/**
540	* [REP] STOSB
541	* [REP] STOSW
542	* [REP] STOSD
543	*
544	* Restricted implementation.
545	*
546	*
547	* @returns VBox status code.
548	*
549	* @param pVM The virtual machine.
550	* @param pRegFrame Trap register frame.
551	* @param GCPhysFault The GC physical address corresponding to pvFault.
552	* @param pCpu Disassembler CPU state.
553	* @param pRange Pointer MMIO range.
554	*/
555	static int iomInterpretSTOS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
556	{
557	/*
558	* We do not support segment prefixes or REPNE..
559	*/
560	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
561	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
562
563	/*
564	* Get bytes/words/dwords count to copy.
565	*/
566	uint32_t cTransfers = 1;
567	if (pCpu->prefix & PREFIX_REP)
568	{
569	#ifndef IN_RC
570	if ( CPUMIsGuestIn64BitCode(VMMGetCpu(pVM), pRegFrame)
571	&& pRegFrame->rcx >= _4G)
572	return VINF_EM_RAW_EMULATE_INSTR;
573	#endif
574
575	cTransfers = pRegFrame->ecx;
576	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
577	cTransfers &= 0xffff;
578
579	if (!cTransfers)
580	return VINF_SUCCESS;
581	}
582
583	/** @todo r=bird: bounds checks! */
584
585	/*
586	* Get data size.
587	*/
588	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
589	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
590	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
591
592	#ifdef VBOX_WITH_STATISTICS
593	if (pVM->iom.s.cStosMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
594	pVM->iom.s.cStosMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
595	#endif
596
597
598	RTGCPHYS Phys = GCPhysFault;
599	uint32_t u32Data = pRegFrame->eax;
600	int rc;
601	if (pRange->CTX_SUFF(pfnFillCallback))
602	{
603	/*
604	* Use the fill callback.
605	*/
606	/** @todo pfnFillCallback must return number of bytes successfully written!!! */
607	if (offIncrement > 0)
608	{
609	/* addr++ variant. */
610	rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), Phys, u32Data, cb, cTransfers);
611	if (rc == VINF_SUCCESS)
612	{
613	/* Update registers. */
614	pRegFrame->rdi += cTransfers << SIZE_2_SHIFT(cb);
615	if (pCpu->prefix & PREFIX_REP)
616	pRegFrame->ecx = 0;
617	}
618	}
619	else
620	{
621	/* addr-- variant. */
622	rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), Phys - ((cTransfers - 1) << SIZE_2_SHIFT(cb)), u32Data, cb, cTransfers);
623	if (rc == VINF_SUCCESS)
624	{
625	/* Update registers. */
626	pRegFrame->rdi -= cTransfers << SIZE_2_SHIFT(cb);
627	if (pCpu->prefix & PREFIX_REP)
628	pRegFrame->ecx = 0;
629	}
630	}
631	}
632	else
633	{
634	/*
635	* Use the write callback.
636	*/
637	Assert(pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
638
639	/* fill loop. */
640	do
641	{
642	rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
643	if (rc != VINF_SUCCESS)
644	break;
645
646	Phys += offIncrement;
647	pRegFrame->rdi += offIncrement;
648	cTransfers--;
649	} while (cTransfers);
650
651	/* Update ecx on exit. */
652	if (pCpu->prefix & PREFIX_REP)
653	pRegFrame->ecx = cTransfers;
654	}
655
656	/*
657	* Work statistics and return.
658	*/
659	if (rc == VINF_SUCCESS)
660	iomMMIOStatLength(pVM, cb);
661	return rc;
662	}
663
664
665	/**
666	* [REP] LODSB
667	* [REP] LODSW
668	* [REP] LODSD
669	*
670	* Restricted implementation.
671	*
672	*
673	* @returns VBox status code.
674	*
675	* @param pVM The virtual machine.
676	* @param pRegFrame Trap register frame.
677	* @param GCPhysFault The GC physical address corresponding to pvFault.
678	* @param pCpu Disassembler CPU state.
679	* @param pRange Pointer MMIO range.
680	*/
681	static int iomInterpretLODS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
682	{
683	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
684
685	/*
686	* We do not support segment prefixes or REP*.
687	*/
688	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REP \| PREFIX_REPNE))
689	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
690
691	/*
692	* Get data size.
693	*/
694	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
695	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
696	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
697
698	/*
699	* Perform read.
700	*/
701	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &pRegFrame->rax, cb);
702	if (rc == VINF_SUCCESS)
703	pRegFrame->rsi += offIncrement;
704
705	/*
706	* Work statistics and return.
707	*/
708	if (rc == VINF_SUCCESS)
709	iomMMIOStatLength(pVM, cb);
710	return rc;
711	}
712
713
714	/**
715	* CMP [MMIO], reg\|imm
716	* CMP reg\|imm, [MMIO]
717	*
718	* Restricted implementation.
719	*
720	*
721	* @returns VBox status code.
722	*
723	* @param pVM The virtual machine.
724	* @param pRegFrame Trap register frame.
725	* @param GCPhysFault The GC physical address corresponding to pvFault.
726	* @param pCpu Disassembler CPU state.
727	* @param pRange Pointer MMIO range.
728	*/
729	static int iomInterpretCMP(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
730	{
731	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
732
733	/*
734	* Get the operands.
735	*/
736	unsigned cb = 0;
737	uint64_t uData1 = 0;
738	uint64_t uData2 = 0;
739	int rc;
740	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
741	/* cmp reg, [MMIO]. */
742	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
743	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
744	/* cmp [MMIO], reg\|imm. */
745	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
746	else
747	{
748	AssertMsgFailed(("Disassember CMP problem..\n"));
749	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
750	}
751
752	if (rc == VINF_SUCCESS)
753	{
754	/* Emulate CMP and update guest flags. */
755	uint32_t eflags = EMEmulateCmp(uData1, uData2, cb);
756	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
757	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
758	iomMMIOStatLength(pVM, cb);
759	}
760
761	return rc;
762	}
763
764
765	/**
766	* AND [MMIO], reg\|imm
767	* AND reg, [MMIO]
768	* OR [MMIO], reg\|imm
769	* OR reg, [MMIO]
770	*
771	* Restricted implementation.
772	*
773	*
774	* @returns VBox status code.
775	*
776	* @param pVM The virtual machine.
777	* @param pRegFrame Trap register frame.
778	* @param GCPhysFault The GC physical address corresponding to pvFault.
779	* @param pCpu Disassembler CPU state.
780	* @param pRange Pointer MMIO range.
781	* @param pfnEmulate Instruction emulation function.
782	*/
783	static int iomInterpretOrXorAnd(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, PFNEMULATEPARAM3 pfnEmulate)
784	{
785	unsigned cb = 0;
786	uint64_t uData1 = 0;
787	uint64_t uData2 = 0;
788	bool fAndWrite;
789	int rc;
790
791	#ifdef LOG_ENABLED
792	const char *pszInstr;
793
794	if (pCpu->pCurInstr->opcode == OP_XOR)
795	pszInstr = "Xor";
796	else if (pCpu->pCurInstr->opcode == OP_OR)
797	pszInstr = "Or";
798	else if (pCpu->pCurInstr->opcode == OP_AND)
799	pszInstr = "And";
800	else
801	pszInstr = "OrXorAnd??";
802	#endif
803
804	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
805	{
806	/* and reg, [MMIO]. */
807	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
808	fAndWrite = false;
809	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
810	}
811	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
812	{
813	/* and [MMIO], reg\|imm. */
814	fAndWrite = true;
815	if ( (pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3)
816	&& (pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3))
817	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
818	else
819	rc = VINF_IOM_HC_MMIO_READ_WRITE;
820	}
821	else
822	{
823	AssertMsgFailed(("Disassember AND problem..\n"));
824	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
825	}
826
827	if (rc == VINF_SUCCESS)
828	{
829	/* Emulate AND and update guest flags. */
830	uint32_t eflags = pfnEmulate((uint32_t *)&uData1, uData2, cb);
831
832	LogFlow(("iomInterpretOrXorAnd %s result %RX64\n", pszInstr, uData1));
833
834	if (fAndWrite)
835	/* Store result to MMIO. */
836	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
837	else
838	{
839	/* Store result to register. */
840	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData1);
841	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
842	}
843	if (rc == VINF_SUCCESS)
844	{
845	/* Update guest's eflags and finish. */
846	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
847	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
848	iomMMIOStatLength(pVM, cb);
849	}
850	}
851
852	return rc;
853	}
854
855
856	/**
857	* TEST [MMIO], reg\|imm
858	* TEST reg, [MMIO]
859	*
860	* Restricted implementation.
861	*
862	*
863	* @returns VBox status code.
864	*
865	* @param pVM The virtual machine.
866	* @param pRegFrame Trap register frame.
867	* @param GCPhysFault The GC physical address corresponding to pvFault.
868	* @param pCpu Disassembler CPU state.
869	* @param pRange Pointer MMIO range.
870	*/
871	static int iomInterpretTEST(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
872	{
873	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
874
875	unsigned cb = 0;
876	uint64_t uData1 = 0;
877	uint64_t uData2 = 0;
878	int rc;
879
880	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
881	{
882	/* and test, [MMIO]. */
883	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
884	}
885	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
886	{
887	/* test [MMIO], reg\|imm. */
888	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
889	}
890	else
891	{
892	AssertMsgFailed(("Disassember TEST problem..\n"));
893	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
894	}
895
896	if (rc == VINF_SUCCESS)
897	{
898	/* Emulate TEST (=AND without write back) and update guest EFLAGS. */
899	uint32_t eflags = EMEmulateAnd((uint32_t *)&uData1, uData2, cb);
900	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
901	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
902	iomMMIOStatLength(pVM, cb);
903	}
904
905	return rc;
906	}
907
908
909	/**
910	* BT [MMIO], reg\|imm
911	*
912	* Restricted implementation.
913	*
914	*
915	* @returns VBox status code.
916	*
917	* @param pVM The virtual machine.
918	* @param pRegFrame Trap register frame.
919	* @param GCPhysFault The GC physical address corresponding to pvFault.
920	* @param pCpu Disassembler CPU state.
921	* @param pRange Pointer MMIO range.
922	*/
923	static int iomInterpretBT(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
924	{
925	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
926
927	uint64_t uBit = 0;
928	uint64_t uData = 0;
929	unsigned cbIgnored;
930
931	if (!iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uBit, &cbIgnored))
932	{
933	AssertMsgFailed(("Disassember BT problem..\n"));
934	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
935	}
936	/* The size of the memory operand only matters here. */
937	unsigned cbData = DISGetParamSize(pCpu, &pCpu->param1);
938
939	/* bt [MMIO], reg\|imm. */
940	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData, cbData);
941	if (rc == VINF_SUCCESS)
942	{
943	/* Find the bit inside the faulting address */
944	pRegFrame->eflags.Bits.u1CF = (uData >> uBit);
945	iomMMIOStatLength(pVM, cbData);
946	}
947
948	return rc;
949	}
950
951	/**
952	* XCHG [MMIO], reg
953	* XCHG reg, [MMIO]
954	*
955	* Restricted implementation.
956	*
957	*
958	* @returns VBox status code.
959	*
960	* @param pVM The virtual machine.
961	* @param pRegFrame Trap register frame.
962	* @param GCPhysFault The GC physical address corresponding to pvFault.
963	* @param pCpu Disassembler CPU state.
964	* @param pRange Pointer MMIO range.
965	*/
966	static int iomInterpretXCHG(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
967	{
968	/* Check for read & write handlers since IOMMMIOHandler doesn't cover this. */
969	if ( (!pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
970	\|\| (!pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3))
971	return VINF_IOM_HC_MMIO_READ_WRITE;
972
973	int rc;
974	unsigned cb = 0;
975	uint64_t uData1 = 0;
976	uint64_t uData2 = 0;
977	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
978	{
979	/* xchg reg, [MMIO]. */
980	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
981	if (rc == VINF_SUCCESS)
982	{
983	/* Store result to MMIO. */
984	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
985
986	if (rc == VINF_SUCCESS)
987	{
988	/* Store result to register. */
989	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData2);
990	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
991	}
992	else
993	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
994	}
995	else
996	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
997	}
998	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
999	{
1000	/* xchg [MMIO], reg. */
1001	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1002	if (rc == VINF_SUCCESS)
1003	{
1004	/* Store result to MMIO. */
1005	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData2, cb);
1006	if (rc == VINF_SUCCESS)
1007	{
1008	/* Store result to register. */
1009	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param2, pRegFrame, uData1);
1010	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1011	}
1012	else
1013	AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE \|\| rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE, ("rc=%Rrc\n", rc));
1014	}
1015	else
1016	AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE \|\| rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ, ("rc=%Rrc\n", rc));
1017	}
1018	else
1019	{
1020	AssertMsgFailed(("Disassember XCHG problem..\n"));
1021	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1022	}
1023	return rc;
1024	}
1025
1026
1027	/**
1028	* \#PF Handler callback for MMIO ranges.
1029	*
1030	* @returns VBox status code (appropriate for GC return).
1031	* @param pVM VM Handle.
1032	* @param uErrorCode CPU Error code. This is UINT32_MAX when we don't have
1033	* any error code (the EPT misconfig hack).
1034	* @param pCtxCore Trap register frame.
1035	* @param GCPhysFault The GC physical address corresponding to pvFault.
1036	* @param pvUser Pointer to the MMIO ring-3 range entry.
1037	*/
1038	static int iomMMIOHandler(PVM pVM, uint32_t uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault, void *pvUser)
1039	{
1040	/* Take the IOM lock before performing any MMIO. */
1041	int rc = iomLock(pVM);
1042	#ifndef IN_RING3
1043	if (rc == VERR_SEM_BUSY)
1044	return VINF_IOM_HC_MMIO_READ_WRITE;
1045	#endif
1046	AssertRC(rc);
1047
1048	STAM_PROFILE_START(&pVM->iom.s.StatRZMMIOHandler, a);
1049	Log(("iomMMIOHandler: GCPhys=%RGp uErr=%#x rip=%RGv\n",
1050	GCPhysFault, uErrorCode, (RTGCPTR)pCtxCore->rip));
1051
1052	PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1053	Assert(pRange);
1054	Assert(pRange == iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1055	/** @todo implement per-device locks for MMIO access. It can replace the IOM
1056	* lock for most of the code, provided that we retake the lock while
1057	* deregistering PIOMMMIORANGE to deal with remapping/access races
1058	* (unlikely, but an SMP guest shouldn't cause us to crash). */
1059	Assert(!pRange->CTX_SUFF(pDevIns) \|\| !pRange->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
1060
1061	#ifdef VBOX_WITH_STATISTICS
1062	/*
1063	* Locate the statistics, if > PAGE_SIZE we'll use the first byte for everything.
1064	*/
1065	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
1066	if (!pStats)
1067	{
1068	# ifdef IN_RING3
1069	iomUnlock(pVM);
1070	return VERR_NO_MEMORY;
1071	# else
1072	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1073	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1074	iomUnlock(pVM);
1075	return VINF_IOM_HC_MMIO_READ_WRITE;
1076	# endif
1077	}
1078	#endif
1079
1080	#ifndef IN_RING3
1081	/*
1082	* Should we defer the request right away? This isn't usually the case, so
1083	* do the simple test first and the try deal with uErrorCode being N/A.
1084	*/
1085	if (RT_UNLIKELY( ( !pRange->CTX_SUFF(pfnWriteCallback)
1086	\|\| !pRange->CTX_SUFF(pfnReadCallback))
1087	&& ( uErrorCode == UINT32_MAX
1088	? pRange->pfnWriteCallbackR3 \|\| pRange->pfnReadCallbackR3
1089	: uErrorCode & X86_TRAP_PF_RW
1090	? !pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3
1091	: !pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3
1092	)
1093	)
1094	)
1095	{
1096	if (uErrorCode & X86_TRAP_PF_RW)
1097	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1098	else
1099	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1100
1101	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1102	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1103	iomUnlock(pVM);
1104	return VINF_IOM_HC_MMIO_READ_WRITE;
1105	}
1106	#endif /* !IN_RING3 */
1107
1108	/*
1109	* Disassemble the instruction and interpret it.
1110	*/
1111	PVMCPU pVCpu = VMMGetCpu(pVM);
1112	PDISCPUSTATE pDis = &pVCpu->iom.s.DisState;
1113	unsigned cbOp;
1114	rc = EMInterpretDisasOne(pVM, pVCpu, pCtxCore, pDis, &cbOp);
1115	AssertRC(rc);
1116	if (RT_FAILURE(rc))
1117	{
1118	iomUnlock(pVM);
1119	return rc;
1120	}
1121	switch (pDis->pCurInstr->opcode)
1122	{
1123	case OP_MOV:
1124	case OP_MOVZX:
1125	case OP_MOVSX:
1126	{
1127	STAM_PROFILE_START(&pVM->iom.s.StatRZInstMov, b);
1128	AssertMsg(uErrorCode == UINT32_MAX \|\| DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags) == !!(uErrorCode & X86_TRAP_PF_RW), ("flags1=%#llx/%RTbool flags2=%#llx/%RTbool ErrCd=%#x\n", pDis->param1.flags, DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags), pDis->param2.flags, DIS_IS_EFFECTIVE_ADDR(pDis->param2.flags), uErrorCode));
1129	if (uErrorCode != UINT32_MAX /* EPT+MMIO optimization */
1130	? uErrorCode & X86_TRAP_PF_RW
1131	: DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags))
1132	rc = iomInterpretMOVxXWrite(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1133	else
1134	rc = iomInterpretMOVxXRead(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1135	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstMov, b);
1136	break;
1137	}
1138
1139
1140	#ifdef IOM_WITH_MOVS_SUPPORT
1141	case OP_MOVSB:
1142	case OP_MOVSWD:
1143	{
1144	if (uErrorCode == UINT32_MAX)
1145	return VINF_IOM_HC_MMIO_READ_WRITE;
1146	STAM_PROFILE_ADV_START(&pVM->iom.s.StatRZInstMovs, c);
1147	PSTAMPROFILE pStat = NULL;
1148	rc = iomInterpretMOVS(pVM, !!(uErrorCode & X86_TRAP_PF_RW), pCtxCore, GCPhysFault, pDis, pRange, &pStat);
1149	STAM_PROFILE_ADV_STOP_EX(&pVM->iom.s.StatRZInstMovs, pStat, c);
1150	break;
1151	}
1152	#endif
1153
1154	case OP_STOSB:
1155	case OP_STOSWD:
1156	Assert(uErrorCode & X86_TRAP_PF_RW);
1157	STAM_PROFILE_START(&pVM->iom.s.StatRZInstStos, d);
1158	rc = iomInterpretSTOS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1159	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstStos, d);
1160	break;
1161
1162	case OP_LODSB:
1163	case OP_LODSWD:
1164	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1165	STAM_PROFILE_START(&pVM->iom.s.StatRZInstLods, e);
1166	rc = iomInterpretLODS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1167	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstLods, e);
1168	break;
1169
1170	case OP_CMP:
1171	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1172	STAM_PROFILE_START(&pVM->iom.s.StatRZInstCmp, f);
1173	rc = iomInterpretCMP(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1174	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstCmp, f);
1175	break;
1176
1177	case OP_AND:
1178	STAM_PROFILE_START(&pVM->iom.s.StatRZInstAnd, g);
1179	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateAnd);
1180	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstAnd, g);
1181	break;
1182
1183	case OP_OR:
1184	STAM_PROFILE_START(&pVM->iom.s.StatRZInstOr, k);
1185	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateOr);
1186	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstOr, k);
1187	break;
1188
1189	case OP_XOR:
1190	STAM_PROFILE_START(&pVM->iom.s.StatRZInstXor, m);
1191	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateXor);
1192	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXor, m);
1193	break;
1194
1195	case OP_TEST:
1196	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1197	STAM_PROFILE_START(&pVM->iom.s.StatRZInstTest, h);
1198	rc = iomInterpretTEST(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1199	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstTest, h);
1200	break;
1201
1202	case OP_BT:
1203	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1204	STAM_PROFILE_START(&pVM->iom.s.StatRZInstBt, l);
1205	rc = iomInterpretBT(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1206	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstBt, l);
1207	break;
1208
1209	case OP_XCHG:
1210	STAM_PROFILE_START(&pVM->iom.s.StatRZInstXchg, i);
1211	rc = iomInterpretXCHG(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1212	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXchg, i);
1213	break;
1214
1215
1216	/*
1217	* The instruction isn't supported. Hand it on to ring-3.
1218	*/
1219	default:
1220	STAM_COUNTER_INC(&pVM->iom.s.StatRZInstOther);
1221	rc = VINF_IOM_HC_MMIO_READ_WRITE;
1222	break;
1223	}
1224
1225	/*
1226	* On success advance EIP.
1227	*/
1228	if (rc == VINF_SUCCESS)
1229	pCtxCore->rip += cbOp;
1230	else
1231	{
1232	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1233	#if defined(VBOX_WITH_STATISTICS) && !defined(IN_RING3)
1234	switch (rc)
1235	{
1236	case VINF_IOM_HC_MMIO_READ:
1237	case VINF_IOM_HC_MMIO_READ_WRITE:
1238	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1239	break;
1240	case VINF_IOM_HC_MMIO_WRITE:
1241	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1242	break;
1243	}
1244	#endif
1245	}
1246
1247	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1248	iomUnlock(pVM);
1249	return rc;
1250	}
1251
1252	/**
1253	* \#PF Handler callback for MMIO ranges.
1254	*
1255	* @returns VBox status code (appropriate for GC return).
1256	* @param pVM VM Handle.
1257	* @param uErrorCode CPU Error code.
1258	* @param pCtxCore Trap register frame.
1259	* @param pvFault The fault address (cr2).
1260	* @param GCPhysFault The GC physical address corresponding to pvFault.
1261	* @param pvUser Pointer to the MMIO ring-3 range entry.
1262	*/
1263	VMMDECL(int) IOMMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
1264	{
1265	LogFlow(("IOMMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
1266	GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip));
1267	VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, pvUser);
1268	return VBOXSTRICTRC_VAL(rcStrict);
1269	}
1270
1271	/**
1272	* Physical access handler for MMIO ranges.
1273	*
1274	* @returns VBox status code (appropriate for GC return).
1275	* @param pVM VM Handle.
1276	* @param uErrorCode CPU Error code.
1277	* @param pCtxCore Trap register frame.
1278	* @param GCPhysFault The GC physical address.
1279	*/
1280	VMMDECL(VBOXSTRICTRC) IOMMMIOPhysHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault)
1281	{
1282	int rc2 = iomLock(pVM);
1283	#ifndef IN_RING3
1284	if (rc2 == VERR_SEM_BUSY)
1285	return VINF_IOM_HC_MMIO_READ_WRITE;
1286	#endif
1287	VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1288	iomUnlock(pVM);
1289	return VBOXSTRICTRC_VAL(rcStrict);
1290	}
1291
1292	#ifdef IN_RING3
1293	/**
1294	* \#PF Handler callback for MMIO ranges.
1295	*
1296	* @returns VINF_SUCCESS if the handler have carried out the operation.
1297	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1298	* @param pVM VM Handle.
1299	* @param GCPhys The physical address the guest is writing to.
1300	* @param pvPhys The HC mapping of that address.
1301	* @param pvBuf What the guest is reading/writing.
1302	* @param cbBuf How much it's reading/writing.
1303	* @param enmAccessType The access type.
1304	* @param pvUser Pointer to the MMIO range entry.
1305	*/
1306	DECLCALLBACK(int) IOMR3MMIOHandler(PVM pVM, RTGCPHYS GCPhysFault, void pvPhys, void pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
1307	{
1308	PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1309	STAM_COUNTER_INC(&pVM->iom.s.StatR3MMIOHandler);
1310
1311	/* Take the IOM lock before performing any MMIO. */
1312	int rc = iomLock(pVM);
1313	AssertRC(rc);
1314
1315	AssertMsg(cbBuf == 1 \|\| cbBuf == 2 \|\| cbBuf == 4 \|\| cbBuf == 8, ("%zu\n", cbBuf));
1316
1317	Assert(pRange);
1318	Assert(pRange == iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1319	/** @todo implement per-device locks for MMIO access. It can replace the IOM
1320	* lock for most of the code, provided that we retake the lock while
1321	* deregistering PIOMMMIORANGE to deal with remapping/access races
1322	* (unlikely, but an SMP guest shouldn't cause us to crash). */
1323	Assert(!pRange->CTX_SUFF(pDevIns) \|\| !pRange->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
1324
1325	if (enmAccessType == PGMACCESSTYPE_READ)
1326	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1327	else
1328	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1329
1330	AssertRC(rc);
1331	iomUnlock(pVM);
1332	return rc;
1333	}
1334	#endif /* IN_RING3 */
1335
1336	/**
1337	* Reads a MMIO register.
1338	*
1339	* @returns VBox status code.
1340	*
1341	* @param pVM VM handle.
1342	* @param GCPhys The physical address to read.
1343	* @param pu32Value Where to store the value read.
1344	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1345	*/
1346	VMMDECL(VBOXSTRICTRC) IOMMMIORead(PVM pVM, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue)
1347	{
1348	/* Take the IOM lock before performing any MMIO. */
1349	int rc = iomLock(pVM);
1350	#ifndef IN_RING3
1351	if (rc == VERR_SEM_BUSY)
1352	return VINF_IOM_HC_MMIO_WRITE;
1353	#endif
1354	AssertRC(rc);
1355
1356	/*
1357	* Lookup the current context range node and statistics.
1358	*/
1359	PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1360	AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1361	if (!pRange)
1362	{
1363	iomUnlock(pVM);
1364	return VERR_INTERNAL_ERROR;
1365	}
1366	/** @todo implement per-device locks for MMIO access. */
1367	Assert(!pRange->CTX_SUFF(pDevIns) \|\| !pRange->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
1368	#ifdef VBOX_WITH_STATISTICS
1369	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1370	if (!pStats)
1371	{
1372	iomUnlock(pVM);
1373	# ifdef IN_RING3
1374	return VERR_NO_MEMORY;
1375	# else
1376	return VINF_IOM_HC_MMIO_READ;
1377	# endif
1378	}
1379	STAM_COUNTER_INC(&pStats->Accesses);
1380	#endif /* VBOX_WITH_STATISTICS */
1381
1382	if (pRange->CTX_SUFF(pfnReadCallback))
1383	{
1384	/*
1385	* Perform the read and deal with the result.
1386	*/
1387	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a);
1388	rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pu32Value, (unsigned)cbValue);
1389	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
1390	switch (rc)
1391	{
1392	case VINF_SUCCESS:
1393	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1394	iomUnlock(pVM);
1395	return rc;
1396	#ifndef IN_RING3
1397	case VINF_IOM_HC_MMIO_READ:
1398	case VINF_IOM_HC_MMIO_READ_WRITE:
1399	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1400	#endif
1401	default:
1402	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, rc));
1403	iomUnlock(pVM);
1404	return rc;
1405
1406	case VINF_IOM_MMIO_UNUSED_00:
1407	switch (cbValue)
1408	{
1409	case 1: (uint8_t )pu32Value = UINT8_C(0x00); break;
1410	case 2: (uint16_t )pu32Value = UINT16_C(0x0000); break;
1411	case 4: (uint32_t )pu32Value = UINT32_C(0x00000000); break;
1412	case 8: (uint64_t )pu32Value = UINT64_C(0x0000000000000000); break;
1413	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1414	}
1415	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, rc));
1416	iomUnlock(pVM);
1417	return VINF_SUCCESS;
1418
1419	case VINF_IOM_MMIO_UNUSED_FF:
1420	switch (cbValue)
1421	{
1422	case 1: (uint8_t )pu32Value = UINT8_C(0xff); break;
1423	case 2: (uint16_t )pu32Value = UINT16_C(0xffff); break;
1424	case 4: (uint32_t )pu32Value = UINT32_C(0xffffffff); break;
1425	case 8: (uint64_t )pu32Value = UINT64_C(0xffffffffffffffff); break;
1426	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1427	}
1428	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, rc));
1429	iomUnlock(pVM);
1430	return VINF_SUCCESS;
1431	}
1432	}
1433	#ifndef IN_RING3
1434	if (pRange->pfnReadCallbackR3)
1435	{
1436	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1437	iomUnlock(pVM);
1438	return VINF_IOM_HC_MMIO_READ;
1439	}
1440	#endif
1441
1442	/*
1443	* Lookup the ring-3 range.
1444	*/
1445	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a); /** @todo STAM_PROFILE_ADD_ZERO_PERIOD */
1446	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
1447	/* Unassigned memory; this is actually not supposed to happen. */
1448	switch (cbValue)
1449	{
1450	case 1: (uint8_t )pu32Value = UINT8_C(0xff); break;
1451	case 2: (uint16_t )pu32Value = UINT16_C(0xffff); break;
1452	case 4: (uint32_t )pu32Value = UINT32_C(0xffffffff); break;
1453	case 8: (uint64_t )pu32Value = UINT64_C(0xffffffffffffffff); break;
1454	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1455	}
1456	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1457	iomUnlock(pVM);
1458	return VINF_SUCCESS;
1459	}
1460
1461
1462	/**
1463	* Writes to a MMIO register.
1464	*
1465	* @returns VBox status code.
1466	*
1467	* @param pVM VM handle.
1468	* @param GCPhys The physical address to write to.
1469	* @param u32Value The value to write.
1470	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1471	*/
1472	VMMDECL(VBOXSTRICTRC) IOMMMIOWrite(PVM pVM, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue)
1473	{
1474	/* Take the IOM lock before performing any MMIO. */
1475	int rc = iomLock(pVM);
1476	#ifndef IN_RING3
1477	if (rc == VERR_SEM_BUSY)
1478	return VINF_IOM_HC_MMIO_WRITE;
1479	#endif
1480	AssertRC(rc);
1481
1482	/*
1483	* Lookup the current context range node.
1484	*/
1485	PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1486	AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1487	if (!pRange)
1488	{
1489	iomUnlock(pVM);
1490	return VERR_INTERNAL_ERROR;
1491	}
1492	/** @todo implement per-device locks for MMIO access. */
1493	Assert(!pRange->CTX_SUFF(pDevIns) \|\| !pRange->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
1494	#ifdef VBOX_WITH_STATISTICS
1495	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1496	if (!pStats)
1497	{
1498	iomUnlock(pVM);
1499	# ifdef IN_RING3
1500	return VERR_NO_MEMORY;
1501	# else
1502	return VINF_IOM_HC_MMIO_WRITE;
1503	# endif
1504	}
1505	STAM_COUNTER_INC(&pStats->Accesses);
1506	#endif /* VBOX_WITH_STATISTICS */
1507
1508	/*
1509	* Perform the write if there's a write handler. R0/GC may have
1510	* to defer it to ring-3.
1511	*/
1512	if (pRange->CTX_SUFF(pfnWriteCallback))
1513	{
1514	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
1515	rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, &u32Value, (unsigned)cbValue);
1516	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
1517	#ifndef IN_RING3
1518	if ( rc == VINF_IOM_HC_MMIO_WRITE
1519	\|\| rc == VINF_IOM_HC_MMIO_READ_WRITE)
1520	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1521	#endif
1522	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, rc));
1523	iomUnlock(pVM);
1524	return rc;
1525	}
1526	#ifndef IN_RING3
1527	if (pRange->pfnWriteCallbackR3)
1528	{
1529	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1530	iomUnlock(pVM);
1531	return VINF_IOM_HC_MMIO_WRITE;
1532	}
1533	#endif
1534
1535	/*
1536	* No write handler, nothing to do.
1537	*/
1538	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
1539	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
1540	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, VINF_SUCCESS));
1541	iomUnlock(pVM);
1542	return VINF_SUCCESS;
1543	}
1544
1545	/**
1546	* [REP*] INSB/INSW/INSD
1547	* ES:EDI,DX[,ECX]
1548	*
1549	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1550	*
1551	* @returns Strict VBox status code. Informational status codes other than the one documented
1552	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1553	* @retval VINF_SUCCESS Success.
1554	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1555	* status code must be passed on to EM.
1556	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1557	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1558	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1559	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1560	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1561	*
1562	* @param pVM The virtual machine.
1563	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1564	* @param uPort IO Port
1565	* @param uPrefix IO instruction prefix
1566	* @param cbTransfer Size of transfer unit
1567	*/
1568	VMMDECL(VBOXSTRICTRC) IOMInterpretINSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1569	{
1570	STAM_COUNTER_INC(&pVM->iom.s.StatInstIns);
1571
1572	/*
1573	* We do not support REPNE or decrementing destination
1574	* pointer. Segment prefixes are deliberately ignored, as per the instruction specification.
1575	*/
1576	if ( (uPrefix & PREFIX_REPNE)
1577	\|\| pRegFrame->eflags.Bits.u1DF)
1578	return VINF_EM_RAW_EMULATE_INSTR;
1579
1580	PVMCPU pVCpu = VMMGetCpu(pVM);
1581
1582	/*
1583	* Get bytes/words/dwords count to transfer.
1584	*/
1585	RTGCUINTREG cTransfers = 1;
1586	if (uPrefix & PREFIX_REP)
1587	{
1588	#ifndef IN_RC
1589	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
1590	&& pRegFrame->rcx >= _4G)
1591	return VINF_EM_RAW_EMULATE_INSTR;
1592	#endif
1593	cTransfers = pRegFrame->ecx;
1594
1595	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
1596	cTransfers &= 0xffff;
1597
1598	if (!cTransfers)
1599	return VINF_SUCCESS;
1600	}
1601
1602	/* Convert destination address es:edi. */
1603	RTGCPTR GCPtrDst;
1604	int rc2 = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, (RTGCPTR)pRegFrame->rdi,
1605	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1606	&GCPtrDst);
1607	if (RT_FAILURE(rc2))
1608	{
1609	Log(("INS destination address conversion failed -> fallback, rc2=%d\n", rc2));
1610	return VINF_EM_RAW_EMULATE_INSTR;
1611	}
1612
1613	/* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
1614	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
1615
1616	rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrDst, cTransfers * cbTransfer,
1617	X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
1618	if (rc2 != VINF_SUCCESS)
1619	{
1620	Log(("INS will generate a trap -> fallback, rc2=%d\n", rc2));
1621	return VINF_EM_RAW_EMULATE_INSTR;
1622	}
1623
1624	Log(("IOM: rep ins%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1625	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1626	if (cTransfers > 1)
1627	{
1628	/* If the device supports string transfers, ask it to do as
1629	* much as it wants. The rest is done with single-word transfers. */
1630	const RTGCUINTREG cTransfersOrg = cTransfers;
1631	rcStrict = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbTransfer);
1632	AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
1633	pRegFrame->rdi += (cTransfersOrg - cTransfers) * cbTransfer;
1634	}
1635
1636	#ifdef IN_RC
1637	MMGCRamRegisterTrapHandler(pVM);
1638	#endif
1639	while (cTransfers && rcStrict == VINF_SUCCESS)
1640	{
1641	uint32_t u32Value;
1642	rcStrict = IOMIOPortRead(pVM, uPort, &u32Value, cbTransfer);
1643	if (!IOM_SUCCESS(rcStrict))
1644	break;
1645	rc2 = iomRamWrite(pVCpu, pRegFrame, GCPtrDst, &u32Value, cbTransfer);
1646	Assert(rc2 == VINF_SUCCESS); NOREF(rc2);
1647	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbTransfer);
1648	pRegFrame->rdi += cbTransfer;
1649	cTransfers--;
1650	}
1651	#ifdef IN_RC
1652	MMGCRamDeregisterTrapHandler(pVM);
1653	#endif
1654
1655	/* Update ecx on exit. */
1656	if (uPrefix & PREFIX_REP)
1657	pRegFrame->ecx = cTransfers;
1658
1659	AssertMsg(rcStrict == VINF_SUCCESS \|\| rcStrict == VINF_IOM_HC_IOPORT_READ \|\| (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1660	return rcStrict;
1661	}
1662
1663
1664	/**
1665	* [REP*] INSB/INSW/INSD
1666	* ES:EDI,DX[,ECX]
1667	*
1668	* @returns Strict VBox status code. Informational status codes other than the one documented
1669	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1670	* @retval VINF_SUCCESS Success.
1671	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1672	* status code must be passed on to EM.
1673	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1674	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1675	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1676	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1677	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1678	*
1679	* @param pVM The virtual machine.
1680	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1681	* @param pCpu Disassembler CPU state.
1682	*/
1683	VMMDECL(VBOXSTRICTRC) IOMInterpretINS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1684	{
1685	/*
1686	* Get port number directly from the register (no need to bother the
1687	* disassembler). And get the I/O register size from the opcode / prefix.
1688	*/
1689	RTIOPORT Port = pRegFrame->edx & 0xffff;
1690	unsigned cb = 0;
1691	if (pCpu->pCurInstr->opcode == OP_INSB)
1692	cb = 1;
1693	else
1694	cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
1695
1696	VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1697	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1698	{
1699	AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1700	return rcStrict;
1701	}
1702
1703	return IOMInterpretINSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1704	}
1705
1706
1707	/**
1708	* [REP*] OUTSB/OUTSW/OUTSD
1709	* DS:ESI,DX[,ECX]
1710	*
1711	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1712	*
1713	* @returns Strict VBox status code. Informational status codes other than the one documented
1714	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1715	* @retval VINF_SUCCESS Success.
1716	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1717	* status code must be passed on to EM.
1718	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1719	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1720	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1721	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1722	*
1723	* @param pVM The virtual machine.
1724	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1725	* @param uPort IO Port
1726	* @param uPrefix IO instruction prefix
1727	* @param cbTransfer Size of transfer unit
1728	*/
1729	VMMDECL(VBOXSTRICTRC) IOMInterpretOUTSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1730	{
1731	STAM_COUNTER_INC(&pVM->iom.s.StatInstOuts);
1732
1733	/*
1734	* We do not support segment prefixes, REPNE or
1735	* decrementing source pointer.
1736	*/
1737	if ( (uPrefix & (PREFIX_SEG \| PREFIX_REPNE))
1738	\|\| pRegFrame->eflags.Bits.u1DF)
1739	return VINF_EM_RAW_EMULATE_INSTR;
1740
1741	PVMCPU pVCpu = VMMGetCpu(pVM);
1742
1743	/*
1744	* Get bytes/words/dwords count to transfer.
1745	*/
1746	RTGCUINTREG cTransfers = 1;
1747	if (uPrefix & PREFIX_REP)
1748	{
1749	#ifndef IN_RC
1750	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
1751	&& pRegFrame->rcx >= _4G)
1752	return VINF_EM_RAW_EMULATE_INSTR;
1753	#endif
1754	cTransfers = pRegFrame->ecx;
1755	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
1756	cTransfers &= 0xffff;
1757
1758	if (!cTransfers)
1759	return VINF_SUCCESS;
1760	}
1761
1762	/* Convert source address ds:esi. */
1763	RTGCPTR GCPtrSrc;
1764	int rc2 = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, (RTGCPTR)pRegFrame->rsi,
1765	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1766	&GCPtrSrc);
1767	if (RT_FAILURE(rc2))
1768	{
1769	Log(("OUTS source address conversion failed -> fallback, rc2=%Rrc\n", rc2));
1770	return VINF_EM_RAW_EMULATE_INSTR;
1771	}
1772
1773	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1774	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
1775	rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrSrc, cTransfers * cbTransfer,
1776	(cpl == 3) ? X86_PTE_US : 0);
1777	if (rc2 != VINF_SUCCESS)
1778	{
1779	Log(("OUTS will generate a trap -> fallback, rc2=%Rrc\n", rc2));
1780	return VINF_EM_RAW_EMULATE_INSTR;
1781	}
1782
1783	Log(("IOM: rep outs%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1784	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1785	if (cTransfers > 1)
1786	{
1787	/*
1788	* If the device supports string transfers, ask it to do as
1789	* much as it wants. The rest is done with single-word transfers.
1790	*/
1791	const RTGCUINTREG cTransfersOrg = cTransfers;
1792	rcStrict = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbTransfer);
1793	AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
1794	pRegFrame->rsi += (cTransfersOrg - cTransfers) * cbTransfer;
1795	}
1796
1797	#ifdef IN_RC
1798	MMGCRamRegisterTrapHandler(pVM);
1799	#endif
1800
1801	while (cTransfers && rcStrict == VINF_SUCCESS)
1802	{
1803	uint32_t u32Value = 0;
1804	rcStrict = iomRamRead(pVCpu, &u32Value, GCPtrSrc, cbTransfer);
1805	if (rcStrict != VINF_SUCCESS)
1806	break;
1807	rcStrict = IOMIOPortWrite(pVM, uPort, u32Value, cbTransfer);
1808	if (!IOM_SUCCESS(rcStrict))
1809	break;
1810	GCPtrSrc = (RTGCPTR)((RTUINTPTR)GCPtrSrc + cbTransfer);
1811	pRegFrame->rsi += cbTransfer;
1812	cTransfers--;
1813	}
1814
1815	#ifdef IN_RC
1816	MMGCRamDeregisterTrapHandler(pVM);
1817	#endif
1818
1819	/* Update ecx on exit. */
1820	if (uPrefix & PREFIX_REP)
1821	pRegFrame->ecx = cTransfers;
1822
1823	AssertMsg(rcStrict == VINF_SUCCESS \|\| rcStrict == VINF_IOM_HC_IOPORT_WRITE \|\| (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1824	return rcStrict;
1825	}
1826
1827
1828	/**
1829	* [REP*] OUTSB/OUTSW/OUTSD
1830	* DS:ESI,DX[,ECX]
1831	*
1832	* @returns Strict VBox status code. Informational status codes other than the one documented
1833	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1834	* @retval VINF_SUCCESS Success.
1835	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1836	* status code must be passed on to EM.
1837	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1838	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the write to the REM.
1839	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1840	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1841	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1842	*
1843	* @param pVM The virtual machine.
1844	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1845	* @param pCpu Disassembler CPU state.
1846	*/
1847	VMMDECL(VBOXSTRICTRC) IOMInterpretOUTS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1848	{
1849	/*
1850	* Get port number from the first parameter.
1851	* And get the I/O register size from the opcode / prefix.
1852	*/
1853	uint64_t Port = 0;
1854	unsigned cb = 0;
1855	bool fRc = iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &Port, &cb);
1856	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
1857	if (pCpu->pCurInstr->opcode == OP_OUTSB)
1858	cb = 1;
1859	else
1860	cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
1861
1862	VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1863	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1864	{
1865	AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1866	return rcStrict;
1867	}
1868
1869	return IOMInterpretOUTSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1870	}
1871
1872
1873	#ifndef IN_RC
1874	/**
1875	* Mapping an MMIO2 page in place of an MMIO page for direct access.
1876	*
1877	* (This is a special optimization used by the VGA device.)
1878	*
1879	* @returns VBox status code.
1880	*
1881	* @param pVM The virtual machine.
1882	* @param GCPhys The address of the MMIO page to be changed.
1883	* @param GCPhysRemapped The address of the MMIO2 page.
1884	* @param fPageFlags Page flags to set. Must be (X86_PTE_RW \| X86_PTE_P)
1885	* for the time being.
1886	*/
1887	VMMDECL(int) IOMMMIOMapMMIO2Page(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysRemapped, uint64_t fPageFlags)
1888	{
1889	/* Currently only called from the VGA device during MMIO. */
1890	Assert(IOMIsLockOwner(pVM));
1891	Log(("IOMMMIOMapMMIO2Page %RGp -> %RGp flags=%RX64\n", GCPhys, GCPhysRemapped, fPageFlags));
1892
1893	AssertReturn(fPageFlags == (X86_PTE_RW \| X86_PTE_P), VERR_INVALID_PARAMETER);
1894
1895	PVMCPU pVCpu = VMMGetCpu(pVM);
1896
1897	/* This currently only works in real mode, protected mode without paging or with nested paging. */
1898	if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
1899	\|\| ( CPUMIsGuestInPagedProtectedMode(pVCpu)
1900	&& !HWACCMIsNestedPagingActive(pVM)))
1901	return VINF_SUCCESS; /* ignore */
1902
1903	/*
1904	* Lookup the context range node the page belongs to.
1905	*/
1906	PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1907	AssertMsgReturn(pRange,
1908	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
1909
1910	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
1911	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
1912
1913	/*
1914	* Do the aliasing; page align the addresses since PGM is picky.
1915	*/
1916	GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1917	GCPhysRemapped &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1918
1919	int rc = PGMHandlerPhysicalPageAlias(pVM, pRange->GCPhys, GCPhys, GCPhysRemapped);
1920	AssertRCReturn(rc, rc);
1921
1922	/*
1923	* Modify the shadow page table. Since it's an MMIO page it won't be present and we
1924	* can simply prefetch it.
1925	*
1926	* Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1927	*/
1928	#if 0 /* The assertion is wrong for the PGM_SYNC_CLEAR_PGM_POOL and VINF_PGM_HANDLER_ALREADY_ALIASED cases. */
1929	# ifdef VBOX_STRICT
1930	uint64_t fFlags;
1931	RTHCPHYS HCPhys;
1932	rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
1933	Assert(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1934	# endif
1935	#endif
1936	rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1937	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1938	return VINF_SUCCESS;
1939	}
1940
1941	/**
1942	* Mapping a HC page in place of an MMIO page for direct access.
1943	*
1944	* (This is a special optimization used by the APIC in the VT-x case.)
1945	*
1946	* @returns VBox status code.
1947	*
1948	* @param pVM The virtual machine.
1949	* @param GCPhys The address of the MMIO page to be changed.
1950	* @param HCPhys The address of the host physical page.
1951	* @param fPageFlags Page flags to set. Must be (X86_PTE_RW \| X86_PTE_P)
1952	* for the time being.
1953	*/
1954	VMMDECL(int) IOMMMIOMapMMIOHCPage(PVM pVM, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags)
1955	{
1956	/* Currently only called from VT-x code during a page fault. */
1957	Log(("IOMMMIOMapMMIOHCPage %RGp -> %RGp flags=%RX64\n", GCPhys, HCPhys, fPageFlags));
1958
1959	AssertReturn(fPageFlags == (X86_PTE_RW \| X86_PTE_P), VERR_INVALID_PARAMETER);
1960	Assert(HWACCMIsEnabled(pVM));
1961
1962	PVMCPU pVCpu = VMMGetCpu(pVM);
1963
1964	/*
1965	* Lookup the context range node the page belongs to.
1966	*/
1967	#ifdef VBOX_STRICT
1968	/* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
1969	PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(&pVM->iom.s, GCPhys);
1970	AssertMsgReturn(pRange,
1971	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
1972	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
1973	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
1974	#endif
1975
1976	/*
1977	* Do the aliasing; page align the addresses since PGM is picky.
1978	*/
1979	GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1980	HCPhys &= ~(RTHCPHYS)PAGE_OFFSET_MASK;
1981
1982	int rc = PGMHandlerPhysicalPageAliasHC(pVM, GCPhys, GCPhys, HCPhys);
1983	AssertRCReturn(rc, rc);
1984
1985	/*
1986	* Modify the shadow page table. Since it's an MMIO page it won't be present and we
1987	* can simply prefetch it.
1988	*
1989	* Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1990	*/
1991	rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1992	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
1993	return VINF_SUCCESS;
1994	}
1995
1996	/**
1997	* Reset a previously modified MMIO region; restore the access flags.
1998	*
1999	* @returns VBox status code.
2000	*
2001	* @param pVM The virtual machine.
2002	* @param GCPhys Physical address that's part of the MMIO region to be reset.
2003	*/
2004	VMMDECL(int) IOMMMIOResetRegion(PVM pVM, RTGCPHYS GCPhys)
2005	{
2006	Log(("IOMMMIOResetRegion %RGp\n", GCPhys));
2007
2008	PVMCPU pVCpu = VMMGetCpu(pVM);
2009
2010	/* This currently only works in real mode, protected mode without paging or with nested paging. */
2011	if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
2012	\|\| ( CPUMIsGuestInPagedProtectedMode(pVCpu)
2013	&& !HWACCMIsNestedPagingActive(pVM)))
2014	return VINF_SUCCESS; /* ignore */
2015
2016	/*
2017	* Lookup the context range node the page belongs to.
2018	*/
2019	#ifdef VBOX_STRICT
2020	/* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
2021	PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(&pVM->iom.s, GCPhys);
2022	AssertMsgReturn(pRange,
2023	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
2024	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
2025	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2026	#endif
2027
2028	/*
2029	* Call PGM to do the job work.
2030	*
2031	* After the call, all the pages should be non-present... unless there is
2032	* a page pool flush pending (unlikely).
2033	*/
2034	int rc = PGMHandlerPhysicalReset(pVM, GCPhys);
2035	AssertRC(rc);
2036
2037	#ifdef VBOX_STRICT
2038	if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
2039	{
2040	uint32_t cb = pRange->cb;
2041	GCPhys = pRange->GCPhys;
2042	while (cb)
2043	{
2044	uint64_t fFlags;
2045	RTHCPHYS HCPhys;
2046	rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
2047	Assert(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2048	cb -= PAGE_SIZE;
2049	GCPhys += PAGE_SIZE;
2050	}
2051	}
2052	#endif
2053	return rc;
2054	}
2055	#endif /* !IN_RC */
2056

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp@ 31996

Download in other formats: