IOMAllMMIO.cpp@ 39111

Last change on this file since 39111 was 39111, checked in by vboxsync, 13 years ago
IOM,PDM: Working on moving unaligned and non-dword MMIO access splitting and buffering up into IOM (from the device emulation).
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 86.4 KB

Line
1	/* $Id: IOMAllMMIO.cpp 39111 2011-10-25 14:47:02Z vboxsync $ */
2	/** @file
3	* IOM - Input / Output Monitor - Any Context, MMIO & String I/O.
4	*/
5
6	/*
7	* Copyright (C) 2006-2010 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_IOM
23	#include <VBox/vmm/iom.h>
24	#include <VBox/vmm/cpum.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/selm.h>
27	#include <VBox/vmm/mm.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/pgm.h>
30	#include <VBox/vmm/trpm.h>
31	#if defined(IEM_VERIFICATION_MODE) && defined(IN_RING3)
32	# include <VBox/vmm/iem.h>
33	#endif
34	#include "IOMInternal.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/vmm.h>
37	#include <VBox/vmm/hwaccm.h>
38	#include "IOMInline.h"
39
40	#include <VBox/dis.h>
41	#include <VBox/disopcode.h>
42	#include <VBox/vmm/pdmdev.h>
43	#include <VBox/param.h>
44	#include <VBox/err.h>
45	#include <iprt/assert.h>
46	#include <VBox/log.h>
47	#include <iprt/asm.h>
48	#include <iprt/string.h>
49
50
51	/*******************************************************************************
52	* Global Variables *
53	*******************************************************************************/
54
55	/**
56	* Array for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
57	*/
58	static const unsigned g_aSize2Shift[] =
59	{
60	~0U, /* 0 - invalid */
61	0, /* 1 == 2^0 /
62	1, /* 2 == 2^1 /
63	~0U, /* 3 - invalid */
64	2, /* 4 == 2^2 /
65	~0U, /* 5 - invalid */
66	~0U, /* 6 - invalid */
67	~0U, /* 7 - invalid */
68	3 /* 8 == 2^3 /
69	};
70
71	/**
72	* Macro for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
73	*/
74	#define SIZE_2_SHIFT(cb) (g_aSize2Shift[cb])
75
76
77	/**
78	* Deals with complicated MMIO writes.
79	*
80	* Complicatd means unaligned or non-dword/qword align accesses depending on
81	* the MMIO region's access mode flags.
82	*
83	* @returns Strict VBox status code. Any EM scheduling status code,
84	* VINF_IOM_HC_MMIO_WRITE, VINF_IOM_HC_MMIO_READ_WRITE or
85	* VINF_IOM_HC_MMIO_READ may be returned.
86	*
87	* @param pRange The range to write to.
88	* @param GCPhys The physical address to start writing.
89	* @param pvValue Where to store the value.
90	* @param cbValue The size of the value to write.
91	*/
92	static VBOXSTRICTRC iomMMIODoComplicatedWrite(PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void const *pvValue, unsigned cbValue)
93	{
94	AssertReturn( (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) != IOMMMIO_FLAGS_WRITE_PASSTHRU
95	\|\| (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) <= IOMMMIO_FLAGS_WRITE_DWORD_QWORD_READ_MISSING,
96	VERR_INTERNAL_ERROR_5);
97	AssertReturn(cbValue != 0 && cbValue <= 16, VERR_INTERNAL_ERROR_4);
98	RTGCPHYS const GCPhysStart = GCPhys; NOREF(GCPhysStart);
99	bool const fReadMissing = (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) >= IOMMMIO_FLAGS_WRITE_DWORD_READ_MISSING;
100
101	/*
102	* Split and conquer.
103	*/
104	int rc = VINF_SUCCESS;
105	for (;;)
106	{
107	unsigned const offAccess = GCPhys & 3;
108	unsigned cbThisPart = 4 - offAccess;
109	if (cbThisPart > cbValue)
110	cbThisPart = cbValue;
111
112	/*
113	* Get the missing bits (if any).
114	*/
115	uint32_t u32MissingValue = 0;
116	if (fReadMissing && cbThisPart != 4)
117	{
118	int rc2 = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
119	GCPhys & ~(RTGCPHYS)3, &u32MissingValue, sizeof(u32MissingValue));
120	switch (rc2)
121	{
122	case VINF_SUCCESS:
123	break;
124	case VINF_IOM_MMIO_UNUSED_FF:
125	u32MissingValue = UINT32_C(0xffffffff);
126	break;
127	case VINF_IOM_MMIO_UNUSED_00:
128	u32MissingValue = 0;
129	break;
130	case VINF_IOM_HC_MMIO_READ:
131	case VINF_IOM_HC_MMIO_READ_WRITE:
132	case VINF_IOM_HC_MMIO_WRITE:
133	/** @todo What if we've split a transfer and already read
134	* something? Since reads can have sideeffects we could be
135	* kind of screwed here... */
136	LogFlow(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, rc2));
137	return rc2;
138	default:
139	if (RT_FAILURE(rc2))
140	{
141	Log(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, rc2));
142	return rc2;
143	}
144	AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
145	if (rc == VINF_SUCCESS \|\| rc2 < rc)
146	rc = rc2;
147	break;
148	}
149	}
150
151	/*
152	* Merge missing and given bits.
153	*/
154	uint32_t u32GivenMask;
155	uint32_t u32GivenValue;
156	switch (cbThisPart)
157	{
158	case 1:
159	u32GivenValue = (uint8_t const )pvValue;
160	u32GivenMask = UINT32_C(0x000000ff);
161	break;
162	case 2:
163	u32GivenValue = (uint16_t const )pvValue;
164	u32GivenMask = UINT32_C(0x0000ffff);
165	break;
166	case 3:
167	u32GivenValue = RT_MAKE_U32_FROM_U8(((uint8_t const )pvValue)[0], ((uint8_t const )pvValue)[1],
168	((uint8_t const *)pvValue)[2], 0);
169	u32GivenMask = UINT32_C(0x00ffffff);
170	break;
171	case 4:
172	u32GivenValue = (uint32_t const )pvValue;
173	u32GivenMask = UINT32_C(0xffffffff);
174	break;
175	default:
176	AssertFailedReturn(VERR_INTERNAL_ERROR_3);
177	}
178	if (offAccess)
179	{
180	u32GivenValue <<= offAccess * 8;
181	u32GivenMask <<= offAccess * 8;
182	}
183
184	uint32_t u32Value = (u32MissingValue & ~u32GivenMask)
185	\| (u32GivenValue & u32GivenMask);
186
187	/*
188	* Do DWORD write to the device.
189	*/
190	int rc2 = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
191	GCPhys & ~(RTGCPHYS)3, &u32Value, sizeof(u32Value));
192	switch (rc2)
193	{
194	case VINF_SUCCESS:
195	break;
196	case VINF_IOM_HC_MMIO_READ:
197	case VINF_IOM_HC_MMIO_READ_WRITE:
198	case VINF_IOM_HC_MMIO_WRITE:
199	/** @todo What if we've split a transfer and already read
200	* something? Since reads can have sideeffects we could be
201	* kind of screwed here... */
202	LogFlow(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, rc2));
203	return rc2;
204	default:
205	if (RT_FAILURE(rc2))
206	{
207	Log(("iomMMIODoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, rc2));
208	return rc2;
209	}
210	AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
211	if (rc == VINF_SUCCESS \|\| rc2 < rc)
212	rc = rc2;
213	break;
214	}
215
216	/*
217	* Advance.
218	*/
219	cbValue -= cbThisPart;
220	if (!cbValue)
221	break;
222	GCPhys += cbThisPart;
223	pvValue = (uint8_t const *)pvValue + cbThisPart;
224	}
225
226	return rc;
227	}
228
229
230
231
232	/**
233	* Wrapper which does the write and updates range statistics when such are enabled.
234	* @warning RT_SUCCESS(rc=VINF_IOM_HC_MMIO_WRITE) is TRUE!
235	*/
236	static int iomMMIODoWrite(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cb)
237	{
238	#ifdef VBOX_WITH_STATISTICS
239	PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, GCPhysFault, pRange);
240	Assert(pStats);
241	#endif
242
243	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
244	VBOXSTRICTRC rc;
245	if (RT_LIKELY(pRange->CTX_SUFF(pfnWriteCallback)))
246	{
247	if ( (cb == 4 && !(GCPhysFault & 3))
248	\|\| (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_PASSTHRU
249	\|\| (cb == 8 && !(GCPhysFault & 7)) )
250	rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
251	GCPhysFault, (void )pvData, cb); /* @todo fix const!! */
252	else
253	rc = iomMMIODoComplicatedWrite(pRange, GCPhysFault, pvData, cb);
254	}
255	else
256	rc = VINF_SUCCESS;
257	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
258	STAM_COUNTER_INC(&pStats->Accesses);
259	return VBOXSTRICTRC_TODO(rc);
260	}
261
262
263	/**
264	* Deals with complicated MMIO reads.
265	*
266	* Complicatd means unaligned or non-dword/qword align accesses depending on
267	* the MMIO region's access mode flags.
268	*
269	* @returns Strict VBox status code. Any EM scheduling status code,
270	* VINF_IOM_HC_MMIO_READ, VINF_IOM_HC_MMIO_READ_WRITE or
271	* VINF_IOM_HC_MMIO_WRITE may be returned.
272	*
273	* @param pRange The range to read from.
274	* @param GCPhys The physical address to start reading.
275	* @param pvValue Where to store the value.
276	* @param cbValue The size of the value to read.
277	*/
278	static VBOXSTRICTRC iomMMIODoComplicatedRead(PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
279	{
280	AssertReturn( (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD
281	\|\| (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD,
282	VERR_INTERNAL_ERROR_5);
283	AssertReturn(cbValue != 0 && cbValue <= 16, VERR_INTERNAL_ERROR_4);
284	RTGCPHYS const GCPhysStart = GCPhys; NOREF(GCPhysStart);
285
286	/*
287	* Split and conquer.
288	*/
289	int rc = VINF_SUCCESS;
290	for (;;)
291	{
292	/*
293	* Do DWORD read from the device.
294	*/
295	uint32_t u32Value;
296	int rc2 = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
297	GCPhys & ~(RTGCPHYS)3, &u32Value, sizeof(u32Value));
298	switch (rc2)
299	{
300	case VINF_SUCCESS:
301	break;
302	case VINF_IOM_MMIO_UNUSED_FF:
303	u32Value = UINT32_C(0xffffffff);
304	break;
305	case VINF_IOM_MMIO_UNUSED_00:
306	u32Value = 0;
307	break;
308	case VINF_IOM_HC_MMIO_READ:
309	case VINF_IOM_HC_MMIO_READ_WRITE:
310	case VINF_IOM_HC_MMIO_WRITE:
311	/** @todo What if we've split a transfer and already read
312	* something? Since reads can have sideeffects we could be
313	* kind of screwed here... */
314	LogFlow(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc\n", GCPhys, GCPhysStart, cbValue, rc2));
315	return rc2;
316	default:
317	if (RT_FAILURE(rc2))
318	{
319	Log(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc\n", GCPhys, GCPhysStart, cbValue, rc2));
320	return rc2;
321	}
322	AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", rc2), VERR_IPE_UNEXPECTED_INFO_STATUS);
323	if (rc == VINF_SUCCESS \|\| rc2 < rc)
324	rc = rc2;
325	break;
326	}
327	u32Value >>= (GCPhys & 3) * 8;
328
329	/*
330	* Write what we've read.
331	*/
332	unsigned cbThisPart = 4 - (GCPhys & 3);
333	if (cbThisPart > cbValue)
334	cbThisPart = cbValue;
335
336	switch (cbThisPart)
337	{
338	case 1:
339	(uint8_t )pvValue = (uint8_t)u32Value;
340	break;
341	case 2:
342	(uint16_t )pvValue = (uint16_t)u32Value;
343	break;
344	case 3:
345	((uint8_t *)pvValue)[0] = RT_BYTE1(u32Value);
346	((uint8_t *)pvValue)[1] = RT_BYTE2(u32Value);
347	((uint8_t *)pvValue)[2] = RT_BYTE3(u32Value);
348	break;
349	case 4:
350	(uint32_t )pvValue = u32Value;
351	break;
352	}
353
354	/*
355	* Advance.
356	*/
357	cbValue -= cbThisPart;
358	if (!cbValue)
359	break;
360	GCPhys += cbThisPart;
361	pvValue = (uint8_t *)pvValue + cbThisPart;
362	}
363
364	return rc;
365	}
366
367
368	/**
369	* Implements VINF_IOM_MMIO_UNUSED_FF.
370	*
371	* @returns VINF_SUCCESS.
372	* @param pvValue Where to store the zeros.
373	* @param cbValue How many bytes to read.
374	*/
375	static int iomMMIODoReadFFs(void *pvValue, unsigned cbValue)
376	{
377	switch (cbValue)
378	{
379	case 1: (uint8_t )pvValue = UINT8_C(0xff); break;
380	case 2: (uint16_t )pvValue = UINT16_C(0xffff); break;
381	case 4: (uint32_t )pvValue = UINT32_C(0xffffffff); break;
382	case 8: (uint64_t )pvValue = UINT64_C(0xffffffffffffffff); break;
383	default:
384	{
385	uint8_t pb = (uint8_t )pvValue;
386	while (cbValue--)
387	*pb++ = UINT8_C(0xff);
388	break;
389	}
390	}
391	return VINF_SUCCESS;
392	}
393
394
395	/**
396	* Implements VINF_IOM_MMIO_UNUSED_00.
397	*
398	* @returns VINF_SUCCESS.
399	* @param pvValue Where to store the zeros.
400	* @param cbValue How many bytes to read.
401	*/
402	static int iomMMIODoRead00s(void *pvValue, unsigned cbValue)
403	{
404	switch (cbValue)
405	{
406	case 1: (uint8_t )pvValue = UINT8_C(0x00); break;
407	case 2: (uint16_t )pvValue = UINT16_C(0x0000); break;
408	case 4: (uint32_t )pvValue = UINT32_C(0x00000000); break;
409	case 8: (uint64_t )pvValue = UINT64_C(0x0000000000000000); break;
410	default:
411	{
412	uint8_t pb = (uint8_t )pvValue;
413	while (cbValue--)
414	*pb++ = UINT8_C(0x00);
415	break;
416	}
417	}
418	return VINF_SUCCESS;
419	}
420
421
422	/**
423	* Wrapper which does the read and updates range statistics when such are enabled.
424	*/
425	DECLINLINE(int) iomMMIODoRead(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
426	{
427	#ifdef VBOX_WITH_STATISTICS
428	PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, GCPhys, pRange);
429	Assert(pStats);
430	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a);
431	#endif
432
433	VBOXSTRICTRC rc;
434	if (RT_LIKELY(pRange->CTX_SUFF(pfnReadCallback)))
435	{
436	if ( (cbValue == 4 && !(GCPhys & 3))
437	\|\| (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_PASSTHRU
438	\|\| (cbValue == 8 && !(GCPhys & 7)) )
439	rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pvValue, cbValue);
440	else
441	rc = iomMMIODoComplicatedRead(pRange, GCPhys, pvValue, cbValue);
442	}
443	else
444	rc = VINF_IOM_MMIO_UNUSED_FF;
445	if (rc != VINF_SUCCESS)
446	{
447	switch (VBOXSTRICTRC_VAL(rc))
448	{
449	case VINF_IOM_MMIO_UNUSED_FF: rc = iomMMIODoReadFFs(pvValue, cbValue); break;
450	case VINF_IOM_MMIO_UNUSED_00: rc = iomMMIODoRead00s(pvValue, cbValue); break;
451	}
452	}
453	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
454	STAM_COUNTER_INC(&pStats->Accesses);
455	return VBOXSTRICTRC_VAL(rc);
456	}
457
458
459	/**
460	* Internal - statistics only.
461	*/
462	DECLINLINE(void) iomMMIOStatLength(PVM pVM, unsigned cb)
463	{
464	#ifdef VBOX_WITH_STATISTICS
465	switch (cb)
466	{
467	case 1:
468	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO1Byte);
469	break;
470	case 2:
471	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO2Bytes);
472	break;
473	case 4:
474	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO4Bytes);
475	break;
476	case 8:
477	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO8Bytes);
478	break;
479	default:
480	/* No way. */
481	AssertMsgFailed(("Invalid data length %d\n", cb));
482	break;
483	}
484	#else
485	NOREF(pVM); NOREF(cb);
486	#endif
487	}
488
489
490	/**
491	* MOV reg, mem (read)
492	* MOVZX reg, mem (read)
493	* MOVSX reg, mem (read)
494	*
495	* @returns VBox status code.
496	*
497	* @param pVM The virtual machine.
498	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
499	* @param pCpu Disassembler CPU state.
500	* @param pRange Pointer MMIO range.
501	* @param GCPhysFault The GC physical address corresponding to pvFault.
502	*/
503	static int iomInterpretMOVxXRead(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
504	{
505	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
506
507	/*
508	* Get the data size from parameter 2,
509	* and call the handler function to get the data.
510	*/
511	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
512	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
513
514	uint64_t u64Data = 0;
515	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &u64Data, cb);
516	if (rc == VINF_SUCCESS)
517	{
518	/*
519	* Do sign extension for MOVSX.
520	*/
521	/** @todo checkup MOVSX implementation! */
522	if (pCpu->pCurInstr->opcode == OP_MOVSX)
523	{
524	if (cb == 1)
525	{
526	/* DWORD <- BYTE */
527	int64_t iData = (int8_t)u64Data;
528	u64Data = (uint64_t)iData;
529	}
530	else
531	{
532	/* DWORD <- WORD */
533	int64_t iData = (int16_t)u64Data;
534	u64Data = (uint64_t)iData;
535	}
536	}
537
538	/*
539	* Store the result to register (parameter 1).
540	*/
541	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, u64Data);
542	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
543	}
544
545	if (rc == VINF_SUCCESS)
546	iomMMIOStatLength(pVM, cb);
547	return rc;
548	}
549
550
551	/**
552	* MOV mem, reg\|imm (write)
553	*
554	* @returns VBox status code.
555	*
556	* @param pVM The virtual machine.
557	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
558	* @param pCpu Disassembler CPU state.
559	* @param pRange Pointer MMIO range.
560	* @param GCPhysFault The GC physical address corresponding to pvFault.
561	*/
562	static int iomInterpretMOVxXWrite(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
563	{
564	Assert(pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
565
566	/*
567	* Get data to write from second parameter,
568	* and call the callback to write it.
569	*/
570	unsigned cb = 0;
571	uint64_t u64Data = 0;
572	bool fRc = iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &u64Data, &cb);
573	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
574
575	int rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &u64Data, cb);
576	if (rc == VINF_SUCCESS)
577	iomMMIOStatLength(pVM, cb);
578	return rc;
579	}
580
581
582	/** Wrapper for reading virtual memory. */
583	DECLINLINE(int) iomRamRead(PVMCPU pVCpu, void *pDest, RTGCPTR GCSrc, uint32_t cb)
584	{
585	/* Note: This will fail in R0 or RC if it hits an access handler. That
586	isn't a problem though since the operation can be restarted in REM. */
587	#ifdef IN_RC
588	NOREF(pVCpu);
589	return MMGCRamReadNoTrapHandler(pDest, (void *)(uintptr_t)GCSrc, cb);
590	#else
591	return PGMPhysReadGCPtr(pVCpu, pDest, GCSrc, cb);
592	#endif
593	}
594
595
596	/** Wrapper for writing virtual memory. */
597	DECLINLINE(int) iomRamWrite(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, void *pvSrc, uint32_t cb)
598	{
599	/** @todo Need to update PGMVerifyAccess to take access handlers into account for Ring-0 and
600	* raw mode code. Some thought needs to be spent on theoretical concurrency issues as
601	* as well since we're not behind the pgm lock and handler may change between calls.
602	*
603	* PGMPhysInterpretedWriteNoHandlers/PGMPhysWriteGCPtr may mess up
604	* the state of some shadowed structures. */
605	#if defined(IN_RING0) \|\| defined(IN_RC)
606	return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, false /fRaiseTrap/);
607	#else
608	NOREF(pCtxCore);
609	return PGMPhysWriteGCPtr(pVCpu, GCPtrDst, pvSrc, cb);
610	#endif
611	}
612
613
614	#if defined(IOM_WITH_MOVS_SUPPORT) && 0 /* locking prevents this from working. has buggy ecx handling. */
615	/**
616	* [REP] MOVSB
617	* [REP] MOVSW
618	* [REP] MOVSD
619	*
620	* Restricted implementation.
621	*
622	*
623	* @returns VBox status code.
624	*
625	* @param pVM The virtual machine.
626	* @param uErrorCode CPU Error code.
627	* @param pRegFrame Trap register frame.
628	* @param GCPhysFault The GC physical address corresponding to pvFault.
629	* @param pCpu Disassembler CPU state.
630	* @param pRange Pointer MMIO range.
631	* @param ppStat Which sub-sample to attribute this call to.
632	*/
633	static int iomInterpretMOVS(PVM pVM, bool fWriteAccess, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange,
634	PSTAMPROFILE *ppStat)
635	{
636	/*
637	* We do not support segment prefixes or REPNE.
638	*/
639	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
640	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> interpret whatever. */
641
642	PVMCPU pVCpu = VMMGetCpu(pVM);
643
644	/*
645	* Get bytes/words/dwords/qword count to copy.
646	*/
647	uint32_t cTransfers = 1;
648	if (pCpu->prefix & PREFIX_REP)
649	{
650	#ifndef IN_RC
651	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
652	&& pRegFrame->rcx >= _4G)
653	return VINF_EM_RAW_EMULATE_INSTR;
654	#endif
655
656	cTransfers = pRegFrame->ecx;
657	if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
658	cTransfers &= 0xffff;
659
660	if (!cTransfers)
661	return VINF_SUCCESS;
662	}
663
664	/* Get the current privilege level. */
665	uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
666
667	/*
668	* Get data size.
669	*/
670	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
671	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
672	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
673
674	#ifdef VBOX_WITH_STATISTICS
675	if (pVM->iom.s.cMovsMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
676	pVM->iom.s.cMovsMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
677	#endif
678
679	/** @todo re-evaluate on page boundaries. */
680
681	RTGCPHYS Phys = GCPhysFault;
682	int rc;
683	if (fWriteAccess)
684	{
685	/*
686	* Write operation: [Mem] -> [MMIO]
687	* ds:esi (Virt Src) -> es:edi (Phys Dst)
688	*/
689	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsToMMIO; });
690
691	/* Check callback. */
692	if (!pRange->CTX_SUFF(pfnWriteCallback))
693	return VINF_IOM_HC_MMIO_WRITE;
694
695	/* Convert source address ds:esi. */
696	RTGCUINTPTR pu8Virt;
697	rc = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, (RTGCPTR)pRegFrame->rsi,
698	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
699	(PRTGCPTR)&pu8Virt);
700	if (RT_SUCCESS(rc))
701	{
702
703	/* Access verification first; we currently can't recover properly from traps inside this instruction */
704	rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, (cpl == 3) ? X86_PTE_US : 0);
705	if (rc != VINF_SUCCESS)
706	{
707	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
708	return VINF_EM_RAW_EMULATE_INSTR;
709	}
710
711	#ifdef IN_RC
712	MMGCRamRegisterTrapHandler(pVM);
713	#endif
714
715	/* copy loop. */
716	while (cTransfers)
717	{
718	uint32_t u32Data = 0;
719	rc = iomRamRead(pVCpu, &u32Data, (RTGCPTR)pu8Virt, cb);
720	if (rc != VINF_SUCCESS)
721	break;
722	rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
723	if (rc != VINF_SUCCESS)
724	break;
725
726	pu8Virt += offIncrement;
727	Phys += offIncrement;
728	pRegFrame->rsi += offIncrement;
729	pRegFrame->rdi += offIncrement;
730	cTransfers--;
731	}
732	#ifdef IN_RC
733	MMGCRamDeregisterTrapHandler(pVM);
734	#endif
735	/* Update ecx. */
736	if (pCpu->prefix & PREFIX_REP)
737	pRegFrame->ecx = cTransfers;
738	}
739	else
740	rc = VINF_IOM_HC_MMIO_READ_WRITE;
741	}
742	else
743	{
744	/*
745	* Read operation: [MMIO] -> [mem] or [MMIO] -> [MMIO]
746	* ds:[eSI] (Phys Src) -> es:[eDI] (Virt Dst)
747	*/
748	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsFromMMIO; });
749
750	/* Check callback. */
751	if (!pRange->CTX_SUFF(pfnReadCallback))
752	return VINF_IOM_HC_MMIO_READ;
753
754	/* Convert destination address. */
755	RTGCUINTPTR pu8Virt;
756	rc = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, (RTGCPTR)pRegFrame->rdi,
757	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
758	(RTGCPTR *)&pu8Virt);
759	if (RT_FAILURE(rc))
760	return VINF_IOM_HC_MMIO_READ;
761
762	/* Check if destination address is MMIO. */
763	PIOMMMIORANGE pMMIODst;
764	RTGCPHYS PhysDst;
765	rc = PGMGstGetPage(pVCpu, (RTGCPTR)pu8Virt, NULL, &PhysDst);
766	PhysDst \|= (RTGCUINTPTR)pu8Virt & PAGE_OFFSET_MASK;
767	if ( RT_SUCCESS(rc)
768	&& (pMMIODst = iomMmioGetRangeWithRef(pVM, PhysDst)))
769	{
770	/** @todo implement per-device locks for MMIO access. */
771	Assert(!pMMIODst->CTX_SUFF(pDevIns)->CTX_SUFF(pCritSect));
772
773	/*
774	* Extra: [MMIO] -> [MMIO]
775	*/
776	STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsMMIO; });
777	if (!pMMIODst->CTX_SUFF(pfnWriteCallback) && pMMIODst->pfnWriteCallbackR3)
778	{
779	iomMmioReleaseRange(pVM, pRange);
780	return VINF_IOM_HC_MMIO_READ_WRITE;
781	}
782
783	/* copy loop. */
784	while (cTransfers)
785	{
786	uint32_t u32Data;
787	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
788	if (rc != VINF_SUCCESS)
789	break;
790	rc = iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb);
791	if (rc != VINF_SUCCESS)
792	break;
793
794	Phys += offIncrement;
795	PhysDst += offIncrement;
796	pRegFrame->rsi += offIncrement;
797	pRegFrame->rdi += offIncrement;
798	cTransfers--;
799	}
800	iomMmioReleaseRange(pVM, pRange);
801	}
802	else
803	{
804	/*
805	* Normal: [MMIO] -> [Mem]
806	*/
807	/* Access verification first; we currently can't recover properly from traps inside this instruction */
808	rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
809	if (rc != VINF_SUCCESS)
810	{
811	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
812	return VINF_EM_RAW_EMULATE_INSTR;
813	}
814
815	/* copy loop. */
816	#ifdef IN_RC
817	MMGCRamRegisterTrapHandler(pVM);
818	#endif
819	while (cTransfers)
820	{
821	uint32_t u32Data;
822	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
823	if (rc != VINF_SUCCESS)
824	break;
825	rc = iomRamWrite(pVCpu, pRegFrame, (RTGCPTR)pu8Virt, &u32Data, cb);
826	if (rc != VINF_SUCCESS)
827	{
828	Log(("iomRamWrite %08X size=%d failed with %d\n", pu8Virt, cb, rc));
829	break;
830	}
831
832	pu8Virt += offIncrement;
833	Phys += offIncrement;
834	pRegFrame->rsi += offIncrement;
835	pRegFrame->rdi += offIncrement;
836	cTransfers--;
837	}
838	#ifdef IN_RC
839	MMGCRamDeregisterTrapHandler(pVM);
840	#endif
841	}
842
843	/* Update ecx on exit. */
844	if (pCpu->prefix & PREFIX_REP)
845	pRegFrame->ecx = cTransfers;
846	}
847
848	/* work statistics. */
849	if (rc == VINF_SUCCESS)
850	iomMMIOStatLength(pVM, cb);
851	NOREF(ppStat);
852	return rc;
853	}
854	#endif /* IOM_WITH_MOVS_SUPPORT */
855
856
857	/**
858	* Gets the address / opcode mask corresponding to the given CPU mode.
859	*
860	* @returns Mask.
861	* @param enmCpuMode CPU mode.
862	*/
863	static uint64_t iomDisModeToMask(DISCPUMODE enmCpuMode)
864	{
865	switch (enmCpuMode)
866	{
867	case CPUMODE_16BIT: return UINT16_MAX;
868	case CPUMODE_32BIT: return UINT32_MAX;
869	case CPUMODE_64BIT: return UINT64_MAX;
870	default:
871	AssertFailedReturn(UINT32_MAX);
872	}
873	}
874
875
876	/**
877	* [REP] STOSB
878	* [REP] STOSW
879	* [REP] STOSD
880	*
881	* Restricted implementation.
882	*
883	*
884	* @returns VBox status code.
885	*
886	* @param pVM The virtual machine.
887	* @param pRegFrame Trap register frame.
888	* @param GCPhysFault The GC physical address corresponding to pvFault.
889	* @param pCpu Disassembler CPU state.
890	* @param pRange Pointer MMIO range.
891	*/
892	static int iomInterpretSTOS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
893	{
894	/*
895	* We do not support segment prefixes or REPNE..
896	*/
897	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
898	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
899
900	/*
901	* Get bytes/words/dwords/qwords count to copy.
902	*/
903	uint64_t const fAddrMask = iomDisModeToMask(pCpu->addrmode);
904	RTGCUINTREG cTransfers = 1;
905	if (pCpu->prefix & PREFIX_REP)
906	{
907	#ifndef IN_RC
908	if ( CPUMIsGuestIn64BitCode(VMMGetCpu(pVM), pRegFrame)
909	&& pRegFrame->rcx >= _4G)
910	return VINF_EM_RAW_EMULATE_INSTR;
911	#endif
912
913	cTransfers = pRegFrame->rcx & fAddrMask;
914	if (!cTransfers)
915	return VINF_SUCCESS;
916	}
917
918	/** @todo r=bird: bounds checks! */
919
920	/*
921	* Get data size.
922	*/
923	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
924	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
925	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
926
927	#ifdef VBOX_WITH_STATISTICS
928	if (pVM->iom.s.cStosMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
929	pVM->iom.s.cStosMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
930	#endif
931
932
933	RTGCPHYS Phys = GCPhysFault;
934	int rc;
935	if ( pRange->CTX_SUFF(pfnFillCallback)
936	&& cb <= 4 /* can only fill 32-bit values */)
937	{
938	/*
939	* Use the fill callback.
940	*/
941	/** @todo pfnFillCallback must return number of bytes successfully written!!! */
942	if (offIncrement > 0)
943	{
944	/* addr++ variant. */
945	rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), Phys,
946	pRegFrame->eax, cb, cTransfers);
947	if (rc == VINF_SUCCESS)
948	{
949	/* Update registers. */
950	pRegFrame->rdi = ((pRegFrame->rdi + (cTransfers << SIZE_2_SHIFT(cb))) & fAddrMask)
951	\| (pRegFrame->rdi & ~fAddrMask);
952	if (pCpu->prefix & PREFIX_REP)
953	pRegFrame->rcx &= ~fAddrMask;
954	}
955	}
956	else
957	{
958	/* addr-- variant. */
959	rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
960	Phys - ((cTransfers - 1) << SIZE_2_SHIFT(cb)),
961	pRegFrame->eax, cb, cTransfers);
962	if (rc == VINF_SUCCESS)
963	{
964	/* Update registers. */
965	pRegFrame->rdi = ((pRegFrame->rdi - (cTransfers << SIZE_2_SHIFT(cb))) & fAddrMask)
966	\| (pRegFrame->rdi & ~fAddrMask);
967	if (pCpu->prefix & PREFIX_REP)
968	pRegFrame->rcx &= ~fAddrMask;
969	}
970	}
971	}
972	else
973	{
974	/*
975	* Use the write callback.
976	*/
977	Assert(pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
978	uint64_t u64Data = pRegFrame->rax;
979
980	/* fill loop. */
981	do
982	{
983	rc = iomMMIODoWrite(pVM, pRange, Phys, &u64Data, cb);
984	if (rc != VINF_SUCCESS)
985	break;
986
987	Phys += offIncrement;
988	pRegFrame->rdi = ((pRegFrame->rdi + offIncrement) & fAddrMask)
989	\| (pRegFrame->rdi & ~fAddrMask);
990	cTransfers--;
991	} while (cTransfers);
992
993	/* Update rcx on exit. */
994	if (pCpu->prefix & PREFIX_REP)
995	pRegFrame->rcx = (cTransfers & fAddrMask)
996	\| (pRegFrame->rcx & ~fAddrMask);
997	}
998
999	/*
1000	* Work statistics and return.
1001	*/
1002	if (rc == VINF_SUCCESS)
1003	iomMMIOStatLength(pVM, cb);
1004	return rc;
1005	}
1006
1007
1008	/**
1009	* [REP] LODSB
1010	* [REP] LODSW
1011	* [REP] LODSD
1012	*
1013	* Restricted implementation.
1014	*
1015	*
1016	* @returns VBox status code.
1017	*
1018	* @param pVM The virtual machine.
1019	* @param pRegFrame Trap register frame.
1020	* @param GCPhysFault The GC physical address corresponding to pvFault.
1021	* @param pCpu Disassembler CPU state.
1022	* @param pRange Pointer MMIO range.
1023	*/
1024	static int iomInterpretLODS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
1025	{
1026	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
1027
1028	/*
1029	* We do not support segment prefixes or REP*.
1030	*/
1031	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REP \| PREFIX_REPNE))
1032	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
1033
1034	/*
1035	* Get data size.
1036	*/
1037	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
1038	AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
1039	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
1040
1041	/*
1042	* Perform read.
1043	*/
1044	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &pRegFrame->rax, cb);
1045	if (rc == VINF_SUCCESS)
1046	{
1047	uint64_t const fAddrMask = iomDisModeToMask(pCpu->addrmode);
1048	pRegFrame->rsi = ((pRegFrame->rsi + offIncrement) & fAddrMask)
1049	\| (pRegFrame->rsi & ~fAddrMask);
1050	}
1051
1052	/*
1053	* Work statistics and return.
1054	*/
1055	if (rc == VINF_SUCCESS)
1056	iomMMIOStatLength(pVM, cb);
1057	return rc;
1058	}
1059
1060
1061	/**
1062	* CMP [MMIO], reg\|imm
1063	* CMP reg\|imm, [MMIO]
1064	*
1065	* Restricted implementation.
1066	*
1067	*
1068	* @returns VBox status code.
1069	*
1070	* @param pVM The virtual machine.
1071	* @param pRegFrame Trap register frame.
1072	* @param GCPhysFault The GC physical address corresponding to pvFault.
1073	* @param pCpu Disassembler CPU state.
1074	* @param pRange Pointer MMIO range.
1075	*/
1076	static int iomInterpretCMP(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
1077	{
1078	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
1079
1080	/*
1081	* Get the operands.
1082	*/
1083	unsigned cb = 0;
1084	uint64_t uData1 = 0;
1085	uint64_t uData2 = 0;
1086	int rc;
1087	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
1088	/* cmp reg, [MMIO]. */
1089	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
1090	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
1091	/* cmp [MMIO], reg\|imm. */
1092	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1093	else
1094	{
1095	AssertMsgFailed(("Disassember CMP problem..\n"));
1096	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1097	}
1098
1099	if (rc == VINF_SUCCESS)
1100	{
1101	#if HC_ARCH_BITS == 32
1102	/* Can't deal with 8 byte operands in our 32-bit emulation code. */
1103	if (cb > 4)
1104	return VINF_IOM_HC_MMIO_READ_WRITE;
1105	#endif
1106	/* Emulate CMP and update guest flags. */
1107	uint32_t eflags = EMEmulateCmp(uData1, uData2, cb);
1108	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1109	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1110	iomMMIOStatLength(pVM, cb);
1111	}
1112
1113	return rc;
1114	}
1115
1116
1117	/**
1118	* AND [MMIO], reg\|imm
1119	* AND reg, [MMIO]
1120	* OR [MMIO], reg\|imm
1121	* OR reg, [MMIO]
1122	*
1123	* Restricted implementation.
1124	*
1125	*
1126	* @returns VBox status code.
1127	*
1128	* @param pVM The virtual machine.
1129	* @param pRegFrame Trap register frame.
1130	* @param GCPhysFault The GC physical address corresponding to pvFault.
1131	* @param pCpu Disassembler CPU state.
1132	* @param pRange Pointer MMIO range.
1133	* @param pfnEmulate Instruction emulation function.
1134	*/
1135	static int iomInterpretOrXorAnd(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, PFNEMULATEPARAM3 pfnEmulate)
1136	{
1137	unsigned cb = 0;
1138	uint64_t uData1 = 0;
1139	uint64_t uData2 = 0;
1140	bool fAndWrite;
1141	int rc;
1142
1143	#ifdef LOG_ENABLED
1144	const char *pszInstr;
1145
1146	if (pCpu->pCurInstr->opcode == OP_XOR)
1147	pszInstr = "Xor";
1148	else if (pCpu->pCurInstr->opcode == OP_OR)
1149	pszInstr = "Or";
1150	else if (pCpu->pCurInstr->opcode == OP_AND)
1151	pszInstr = "And";
1152	else
1153	pszInstr = "OrXorAnd??";
1154	#endif
1155
1156	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
1157	{
1158	#if HC_ARCH_BITS == 32
1159	/* Can't deal with 8 byte operands in our 32-bit emulation code. */
1160	if (cb > 4)
1161	return VINF_IOM_HC_MMIO_READ_WRITE;
1162	#endif
1163	/* and reg, [MMIO]. */
1164	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
1165	fAndWrite = false;
1166	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
1167	}
1168	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
1169	{
1170	#if HC_ARCH_BITS == 32
1171	/* Can't deal with 8 byte operands in our 32-bit emulation code. */
1172	if (cb > 4)
1173	return VINF_IOM_HC_MMIO_READ_WRITE;
1174	#endif
1175	/* and [MMIO], reg\|imm. */
1176	fAndWrite = true;
1177	if ( (pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3)
1178	&& (pRange->CTX_SUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3))
1179	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1180	else
1181	rc = VINF_IOM_HC_MMIO_READ_WRITE;
1182	}
1183	else
1184	{
1185	AssertMsgFailed(("Disassember AND problem..\n"));
1186	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1187	}
1188
1189	if (rc == VINF_SUCCESS)
1190	{
1191	/* Emulate AND and update guest flags. */
1192	uint32_t eflags = pfnEmulate((uint32_t *)&uData1, uData2, cb);
1193
1194	LogFlow(("iomInterpretOrXorAnd %s result %RX64\n", pszInstr, uData1));
1195
1196	if (fAndWrite)
1197	/* Store result to MMIO. */
1198	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
1199	else
1200	{
1201	/* Store result to register. */
1202	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData1);
1203	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1204	}
1205	if (rc == VINF_SUCCESS)
1206	{
1207	/* Update guest's eflags and finish. */
1208	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1209	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1210	iomMMIOStatLength(pVM, cb);
1211	}
1212	}
1213
1214	return rc;
1215	}
1216
1217
1218	/**
1219	* TEST [MMIO], reg\|imm
1220	* TEST reg, [MMIO]
1221	*
1222	* Restricted implementation.
1223	*
1224	*
1225	* @returns VBox status code.
1226	*
1227	* @param pVM The virtual machine.
1228	* @param pRegFrame Trap register frame.
1229	* @param GCPhysFault The GC physical address corresponding to pvFault.
1230	* @param pCpu Disassembler CPU state.
1231	* @param pRange Pointer MMIO range.
1232	*/
1233	static int iomInterpretTEST(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
1234	{
1235	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
1236
1237	unsigned cb = 0;
1238	uint64_t uData1 = 0;
1239	uint64_t uData2 = 0;
1240	int rc;
1241
1242	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
1243	{
1244	/* and test, [MMIO]. */
1245	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
1246	}
1247	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
1248	{
1249	/* test [MMIO], reg\|imm. */
1250	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1251	}
1252	else
1253	{
1254	AssertMsgFailed(("Disassember TEST problem..\n"));
1255	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1256	}
1257
1258	if (rc == VINF_SUCCESS)
1259	{
1260	#if HC_ARCH_BITS == 32
1261	/* Can't deal with 8 byte operands in our 32-bit emulation code. */
1262	if (cb > 4)
1263	return VINF_IOM_HC_MMIO_READ_WRITE;
1264	#endif
1265
1266	/* Emulate TEST (=AND without write back) and update guest EFLAGS. */
1267	uint32_t eflags = EMEmulateAnd((uint32_t *)&uData1, uData2, cb);
1268	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1269	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1270	iomMMIOStatLength(pVM, cb);
1271	}
1272
1273	return rc;
1274	}
1275
1276
1277	/**
1278	* BT [MMIO], reg\|imm
1279	*
1280	* Restricted implementation.
1281	*
1282	*
1283	* @returns VBox status code.
1284	*
1285	* @param pVM The virtual machine.
1286	* @param pRegFrame Trap register frame.
1287	* @param GCPhysFault The GC physical address corresponding to pvFault.
1288	* @param pCpu Disassembler CPU state.
1289	* @param pRange Pointer MMIO range.
1290	*/
1291	static int iomInterpretBT(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
1292	{
1293	Assert(pRange->CTX_SUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
1294
1295	uint64_t uBit = 0;
1296	uint64_t uData = 0;
1297	unsigned cbIgnored;
1298
1299	if (!iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uBit, &cbIgnored))
1300	{
1301	AssertMsgFailed(("Disassember BT problem..\n"));
1302	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1303	}
1304	/* The size of the memory operand only matters here. */
1305	unsigned cbData = DISGetParamSize(pCpu, &pCpu->param1);
1306
1307	/* bt [MMIO], reg\|imm. */
1308	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData, cbData);
1309	if (rc == VINF_SUCCESS)
1310	{
1311	/* Find the bit inside the faulting address */
1312	pRegFrame->eflags.Bits.u1CF = (uData >> uBit);
1313	iomMMIOStatLength(pVM, cbData);
1314	}
1315
1316	return rc;
1317	}
1318
1319	/**
1320	* XCHG [MMIO], reg
1321	* XCHG reg, [MMIO]
1322	*
1323	* Restricted implementation.
1324	*
1325	*
1326	* @returns VBox status code.
1327	*
1328	* @param pVM The virtual machine.
1329	* @param pRegFrame Trap register frame.
1330	* @param GCPhysFault The GC physical address corresponding to pvFault.
1331	* @param pCpu Disassembler CPU state.
1332	* @param pRange Pointer MMIO range.
1333	*/
1334	static int iomInterpretXCHG(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
1335	{
1336	/* Check for read & write handlers since IOMMMIOHandler doesn't cover this. */
1337	if ( (!pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
1338	\|\| (!pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3))
1339	return VINF_IOM_HC_MMIO_READ_WRITE;
1340
1341	int rc;
1342	unsigned cb = 0;
1343	uint64_t uData1 = 0;
1344	uint64_t uData2 = 0;
1345	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
1346	{
1347	/* xchg reg, [MMIO]. */
1348	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
1349	if (rc == VINF_SUCCESS)
1350	{
1351	/* Store result to MMIO. */
1352	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
1353
1354	if (rc == VINF_SUCCESS)
1355	{
1356	/* Store result to register. */
1357	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData2);
1358	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1359	}
1360	else
1361	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
1362	}
1363	else
1364	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
1365	}
1366	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
1367	{
1368	/* xchg [MMIO], reg. */
1369	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1370	if (rc == VINF_SUCCESS)
1371	{
1372	/* Store result to MMIO. */
1373	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData2, cb);
1374	if (rc == VINF_SUCCESS)
1375	{
1376	/* Store result to register. */
1377	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param2, pRegFrame, uData1);
1378	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1379	}
1380	else
1381	AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE \|\| rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE, ("rc=%Rrc\n", rc));
1382	}
1383	else
1384	AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE \|\| rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ, ("rc=%Rrc\n", rc));
1385	}
1386	else
1387	{
1388	AssertMsgFailed(("Disassember XCHG problem..\n"));
1389	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1390	}
1391	return rc;
1392	}
1393
1394
1395	/**
1396	* \#PF Handler callback for MMIO ranges.
1397	*
1398	* @returns VBox status code (appropriate for GC return).
1399	* @param pVM VM Handle.
1400	* @param uErrorCode CPU Error code. This is UINT32_MAX when we don't have
1401	* any error code (the EPT misconfig hack).
1402	* @param pCtxCore Trap register frame.
1403	* @param GCPhysFault The GC physical address corresponding to pvFault.
1404	* @param pvUser Pointer to the MMIO ring-3 range entry.
1405	*/
1406	static int iomMMIOHandler(PVM pVM, uint32_t uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault, void *pvUser)
1407	{
1408	/* Take the IOM lock before performing any MMIO. */
1409	int rc = IOM_LOCK(pVM);
1410	#ifndef IN_RING3
1411	if (rc == VERR_SEM_BUSY)
1412	return VINF_IOM_HC_MMIO_READ_WRITE;
1413	#endif
1414	AssertRC(rc);
1415
1416	STAM_PROFILE_START(&pVM->iom.s.StatRZMMIOHandler, a);
1417	Log(("iomMMIOHandler: GCPhys=%RGp uErr=%#x rip=%RGv\n",
1418	GCPhysFault, uErrorCode, (RTGCPTR)pCtxCore->rip));
1419
1420	PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1421	Assert(pRange);
1422	Assert(pRange == iomMmioGetRange(pVM, GCPhysFault));
1423
1424	#ifdef VBOX_WITH_STATISTICS
1425	/*
1426	* Locate the statistics, if > PAGE_SIZE we'll use the first byte for everything.
1427	*/
1428	PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, GCPhysFault, pRange);
1429	if (!pStats)
1430	{
1431	# ifdef IN_RING3
1432	IOM_UNLOCK(pVM);
1433	return VERR_NO_MEMORY;
1434	# else
1435	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1436	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1437	IOM_UNLOCK(pVM);
1438	return VINF_IOM_HC_MMIO_READ_WRITE;
1439	# endif
1440	}
1441	#endif
1442
1443	#ifndef IN_RING3
1444	/*
1445	* Should we defer the request right away? This isn't usually the case, so
1446	* do the simple test first and the try deal with uErrorCode being N/A.
1447	*/
1448	if (RT_UNLIKELY( ( !pRange->CTX_SUFF(pfnWriteCallback)
1449	\|\| !pRange->CTX_SUFF(pfnReadCallback))
1450	&& ( uErrorCode == UINT32_MAX
1451	? pRange->pfnWriteCallbackR3 \|\| pRange->pfnReadCallbackR3
1452	: uErrorCode & X86_TRAP_PF_RW
1453	? !pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3
1454	: !pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3
1455	)
1456	)
1457	)
1458	{
1459	if (uErrorCode & X86_TRAP_PF_RW)
1460	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1461	else
1462	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1463
1464	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1465	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1466	IOM_UNLOCK(pVM);
1467	return VINF_IOM_HC_MMIO_READ_WRITE;
1468	}
1469	#endif /* !IN_RING3 */
1470
1471	/*
1472	* Retain the range and do locking.
1473	*/
1474	iomMmioRetainRange(pRange);
1475	PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
1476	IOM_UNLOCK(pVM);
1477	rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_HC_MMIO_READ_WRITE);
1478	if (rc != VINF_SUCCESS)
1479	{
1480	iomMmioReleaseRange(pVM, pRange);
1481	return rc;
1482	}
1483
1484	/*
1485	* Disassemble the instruction and interpret it.
1486	*/
1487	PVMCPU pVCpu = VMMGetCpu(pVM);
1488	PDISCPUSTATE pDis = &pVCpu->iom.s.DisState;
1489	unsigned cbOp;
1490	rc = EMInterpretDisasOne(pVM, pVCpu, pCtxCore, pDis, &cbOp);
1491	AssertRC(rc);
1492	if (RT_FAILURE(rc))
1493	{
1494	iomMmioReleaseRange(pVM, pRange);
1495	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1496	return rc;
1497	}
1498	switch (pDis->pCurInstr->opcode)
1499	{
1500	case OP_MOV:
1501	case OP_MOVZX:
1502	case OP_MOVSX:
1503	{
1504	STAM_PROFILE_START(&pVM->iom.s.StatRZInstMov, b);
1505	AssertMsg(uErrorCode == UINT32_MAX \|\| DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags) == !!(uErrorCode & X86_TRAP_PF_RW), ("flags1=%#llx/%RTbool flags2=%#llx/%RTbool ErrCd=%#x\n", pDis->param1.flags, DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags), pDis->param2.flags, DIS_IS_EFFECTIVE_ADDR(pDis->param2.flags), uErrorCode));
1506	if (uErrorCode != UINT32_MAX /* EPT+MMIO optimization */
1507	? uErrorCode & X86_TRAP_PF_RW
1508	: DIS_IS_EFFECTIVE_ADDR(pDis->param1.flags))
1509	rc = iomInterpretMOVxXWrite(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1510	else
1511	rc = iomInterpretMOVxXRead(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1512	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstMov, b);
1513	break;
1514	}
1515
1516
1517	#ifdef IOM_WITH_MOVS_SUPPORT
1518	case OP_MOVSB:
1519	case OP_MOVSWD:
1520	{
1521	if (uErrorCode == UINT32_MAX)
1522	rc = VINF_IOM_HC_MMIO_READ_WRITE;
1523	else
1524	{
1525	STAM_PROFILE_ADV_START(&pVM->iom.s.StatRZInstMovs, c);
1526	PSTAMPROFILE pStat = NULL;
1527	rc = iomInterpretMOVS(pVM, !!(uErrorCode & X86_TRAP_PF_RW), pCtxCore, GCPhysFault, pDis, pRange, &pStat);
1528	STAM_PROFILE_ADV_STOP_EX(&pVM->iom.s.StatRZInstMovs, pStat, c);
1529	}
1530	break;
1531	}
1532	#endif
1533
1534	case OP_STOSB:
1535	case OP_STOSWD:
1536	Assert(uErrorCode & X86_TRAP_PF_RW);
1537	STAM_PROFILE_START(&pVM->iom.s.StatRZInstStos, d);
1538	rc = iomInterpretSTOS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1539	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstStos, d);
1540	break;
1541
1542	case OP_LODSB:
1543	case OP_LODSWD:
1544	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1545	STAM_PROFILE_START(&pVM->iom.s.StatRZInstLods, e);
1546	rc = iomInterpretLODS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1547	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstLods, e);
1548	break;
1549
1550	case OP_CMP:
1551	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1552	STAM_PROFILE_START(&pVM->iom.s.StatRZInstCmp, f);
1553	rc = iomInterpretCMP(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1554	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstCmp, f);
1555	break;
1556
1557	case OP_AND:
1558	STAM_PROFILE_START(&pVM->iom.s.StatRZInstAnd, g);
1559	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateAnd);
1560	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstAnd, g);
1561	break;
1562
1563	case OP_OR:
1564	STAM_PROFILE_START(&pVM->iom.s.StatRZInstOr, k);
1565	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateOr);
1566	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstOr, k);
1567	break;
1568
1569	case OP_XOR:
1570	STAM_PROFILE_START(&pVM->iom.s.StatRZInstXor, m);
1571	rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateXor);
1572	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXor, m);
1573	break;
1574
1575	case OP_TEST:
1576	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1577	STAM_PROFILE_START(&pVM->iom.s.StatRZInstTest, h);
1578	rc = iomInterpretTEST(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1579	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstTest, h);
1580	break;
1581
1582	case OP_BT:
1583	Assert(!(uErrorCode & X86_TRAP_PF_RW) \|\| uErrorCode == UINT32_MAX);
1584	STAM_PROFILE_START(&pVM->iom.s.StatRZInstBt, l);
1585	rc = iomInterpretBT(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1586	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstBt, l);
1587	break;
1588
1589	case OP_XCHG:
1590	STAM_PROFILE_START(&pVM->iom.s.StatRZInstXchg, i);
1591	rc = iomInterpretXCHG(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1592	STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXchg, i);
1593	break;
1594
1595
1596	/*
1597	* The instruction isn't supported. Hand it on to ring-3.
1598	*/
1599	default:
1600	STAM_COUNTER_INC(&pVM->iom.s.StatRZInstOther);
1601	rc = VINF_IOM_HC_MMIO_READ_WRITE;
1602	break;
1603	}
1604
1605	/*
1606	* On success advance EIP.
1607	*/
1608	if (rc == VINF_SUCCESS)
1609	pCtxCore->rip += cbOp;
1610	else
1611	{
1612	STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1613	#if defined(VBOX_WITH_STATISTICS) && !defined(IN_RING3)
1614	switch (rc)
1615	{
1616	case VINF_IOM_HC_MMIO_READ:
1617	case VINF_IOM_HC_MMIO_READ_WRITE:
1618	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1619	break;
1620	case VINF_IOM_HC_MMIO_WRITE:
1621	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1622	break;
1623	}
1624	#endif
1625	}
1626
1627	STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1628	iomMmioReleaseRange(pVM, pRange);
1629	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1630	return rc;
1631	}
1632
1633	/**
1634	* \#PF Handler callback for MMIO ranges.
1635	*
1636	* @returns VBox status code (appropriate for GC return).
1637	* @param pVM VM Handle.
1638	* @param uErrorCode CPU Error code.
1639	* @param pCtxCore Trap register frame.
1640	* @param pvFault The fault address (cr2).
1641	* @param GCPhysFault The GC physical address corresponding to pvFault.
1642	* @param pvUser Pointer to the MMIO ring-3 range entry.
1643	*/
1644	VMMDECL(int) IOMMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
1645	{
1646	LogFlow(("IOMMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
1647	GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip));
1648	VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, pvUser);
1649	return VBOXSTRICTRC_VAL(rcStrict);
1650	}
1651
1652	/**
1653	* Physical access handler for MMIO ranges.
1654	*
1655	* @returns VBox status code (appropriate for GC return).
1656	* @param pVM VM Handle.
1657	* @param uErrorCode CPU Error code.
1658	* @param pCtxCore Trap register frame.
1659	* @param GCPhysFault The GC physical address.
1660	*/
1661	VMMDECL(VBOXSTRICTRC) IOMMMIOPhysHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault)
1662	{
1663	int rc2 = IOM_LOCK(pVM); NOREF(rc2);
1664	#ifndef IN_RING3
1665	if (rc2 == VERR_SEM_BUSY)
1666	return VINF_IOM_HC_MMIO_READ_WRITE;
1667	#endif
1668	VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, iomMmioGetRange(pVM, GCPhysFault));
1669	IOM_UNLOCK(pVM);
1670	return VBOXSTRICTRC_VAL(rcStrict);
1671	}
1672
1673
1674	#ifdef IN_RING3
1675	/**
1676	* \#PF Handler callback for MMIO ranges.
1677	*
1678	* @returns VINF_SUCCESS if the handler have carried out the operation.
1679	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1680	* @param pVM VM Handle.
1681	* @param GCPhys The physical address the guest is writing to.
1682	* @param pvPhys The HC mapping of that address.
1683	* @param pvBuf What the guest is reading/writing.
1684	* @param cbBuf How much it's reading/writing.
1685	* @param enmAccessType The access type.
1686	* @param pvUser Pointer to the MMIO range entry.
1687	*/
1688	DECLCALLBACK(int) IOMR3MMIOHandler(PVM pVM, RTGCPHYS GCPhysFault, void pvPhys, void pvBuf, size_t cbBuf,
1689	PGMACCESSTYPE enmAccessType, void *pvUser)
1690	{
1691	PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1692	STAM_COUNTER_INC(&pVM->iom.s.StatR3MMIOHandler);
1693
1694	AssertMsg(cbBuf == 1 \|\| cbBuf == 2 \|\| cbBuf == 4 \|\| cbBuf == 8, ("%zu\n", cbBuf));
1695	AssertPtr(pRange);
1696	NOREF(pvPhys);
1697
1698	/*
1699	* Validate the range.
1700	*/
1701	int rc = IOM_LOCK(pVM);
1702	AssertRC(rc);
1703	Assert(pRange == iomMmioGetRange(pVM, GCPhysFault));
1704
1705	/*
1706	* Perform locking.
1707	*/
1708	iomMmioRetainRange(pRange);
1709	PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
1710	IOM_UNLOCK(pVM);
1711	rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_HC_MMIO_READ_WRITE);
1712	if (rc != VINF_SUCCESS)
1713	{
1714	iomMmioReleaseRange(pVM, pRange);
1715	return rc;
1716	}
1717
1718	/*
1719	* Perform the access.
1720	*/
1721	if (enmAccessType == PGMACCESSTYPE_READ)
1722	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1723	else
1724	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1725
1726	AssertRC(rc);
1727	iomMmioReleaseRange(pVM, pRange);
1728	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1729	return rc;
1730	}
1731	#endif /* IN_RING3 */
1732
1733
1734	/**
1735	* Reads a MMIO register.
1736	*
1737	* @returns VBox status code.
1738	*
1739	* @param pVM VM handle.
1740	* @param GCPhys The physical address to read.
1741	* @param pu32Value Where to store the value read.
1742	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1743	*/
1744	VMMDECL(VBOXSTRICTRC) IOMMMIORead(PVM pVM, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue)
1745	{
1746	/* Take the IOM lock before performing any MMIO. */
1747	VBOXSTRICTRC rc = IOM_LOCK(pVM);
1748	#ifndef IN_RING3
1749	if (rc == VERR_SEM_BUSY)
1750	return VINF_IOM_HC_MMIO_WRITE;
1751	#endif
1752	AssertRC(VBOXSTRICTRC_VAL(rc));
1753	#if defined(IEM_VERIFICATION_MODE) && defined(IN_RING3)
1754	IEMNotifyMMIORead(pVM, GCPhys, cbValue);
1755	#endif
1756
1757	/*
1758	* Lookup the current context range node and statistics.
1759	*/
1760	PIOMMMIORANGE pRange = iomMmioGetRange(pVM, GCPhys);
1761	AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1762	if (!pRange)
1763	{
1764	IOM_UNLOCK(pVM);
1765	return VERR_INTERNAL_ERROR;
1766	}
1767	#ifdef VBOX_WITH_STATISTICS
1768	PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, GCPhys, pRange);
1769	if (!pStats)
1770	{
1771	IOM_UNLOCK(pVM);
1772	# ifdef IN_RING3
1773	return VERR_NO_MEMORY;
1774	# else
1775	return VINF_IOM_HC_MMIO_READ;
1776	# endif
1777	}
1778	STAM_COUNTER_INC(&pStats->Accesses);
1779	#endif /* VBOX_WITH_STATISTICS */
1780
1781	if (pRange->CTX_SUFF(pfnReadCallback))
1782	{
1783	/*
1784	* Perform locking.
1785	*/
1786	iomMmioRetainRange(pRange);
1787	PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
1788	IOM_UNLOCK(pVM);
1789	rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_HC_MMIO_WRITE);
1790	if (rc != VINF_SUCCESS)
1791	{
1792	iomMmioReleaseRange(pVM, pRange);
1793	return rc;
1794	}
1795
1796	/*
1797	* Perform the read and deal with the result.
1798	*/
1799	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a);
1800	if ( (cbValue == 4 && !(GCPhys & 3))
1801	\|\| (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_PASSTHRU
1802	\|\| (cbValue == 8 && !(GCPhys & 7)) )
1803	rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys,
1804	pu32Value, (unsigned)cbValue);
1805	else
1806	rc = iomMMIODoComplicatedRead(pRange, GCPhys, pu32Value, (unsigned)cbValue);
1807	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
1808	switch (VBOXSTRICTRC_VAL(rc))
1809	{
1810	case VINF_SUCCESS:
1811	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1812	iomMmioReleaseRange(pVM, pRange);
1813	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1814	return rc;
1815	#ifndef IN_RING3
1816	case VINF_IOM_HC_MMIO_READ:
1817	case VINF_IOM_HC_MMIO_READ_WRITE:
1818	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1819	#endif
1820	default:
1821	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, VBOXSTRICTRC_VAL(rc)));
1822	iomMmioReleaseRange(pVM, pRange);
1823	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1824	return rc;
1825
1826	case VINF_IOM_MMIO_UNUSED_00:
1827	iomMMIODoRead00s(pu32Value, cbValue);
1828	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, VBOXSTRICTRC_VAL(rc)));
1829	iomMmioReleaseRange(pVM, pRange);
1830	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1831	return VINF_SUCCESS;
1832
1833	case VINF_IOM_MMIO_UNUSED_FF:
1834	iomMMIODoReadFFs(pu32Value, cbValue);
1835	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, pu32Value, cbValue, VBOXSTRICTRC_VAL(rc)));
1836	iomMmioReleaseRange(pVM, pRange);
1837	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1838	return VINF_SUCCESS;
1839	}
1840	/* not reached */
1841	}
1842	#ifndef IN_RING3
1843	if (pRange->pfnReadCallbackR3)
1844	{
1845	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1846	IOM_UNLOCK(pVM);
1847	return VINF_IOM_HC_MMIO_READ;
1848	}
1849	#endif
1850
1851	/*
1852	* Unassigned memory - this is actually not supposed t happen...
1853	*/
1854	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfRead), a); /** @todo STAM_PROFILE_ADD_ZERO_PERIOD */
1855	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
1856	iomMMIODoReadFFs(pu32Value, cbValue);
1857	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1858	IOM_UNLOCK(pVM);
1859	return VINF_SUCCESS;
1860	}
1861
1862
1863	/**
1864	* Writes to a MMIO register.
1865	*
1866	* @returns VBox status code.
1867	*
1868	* @param pVM VM handle.
1869	* @param GCPhys The physical address to write to.
1870	* @param u32Value The value to write.
1871	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1872	*/
1873	VMMDECL(VBOXSTRICTRC) IOMMMIOWrite(PVM pVM, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue)
1874	{
1875	/* Take the IOM lock before performing any MMIO. */
1876	VBOXSTRICTRC rc = IOM_LOCK(pVM);
1877	#ifndef IN_RING3
1878	if (rc == VERR_SEM_BUSY)
1879	return VINF_IOM_HC_MMIO_WRITE;
1880	#endif
1881	AssertRC(VBOXSTRICTRC_VAL(rc));
1882	#if defined(IEM_VERIFICATION_MODE) && defined(IN_RING3)
1883	IEMNotifyMMIOWrite(pVM, GCPhys, u32Value, cbValue);
1884	#endif
1885
1886	/*
1887	* Lookup the current context range node.
1888	*/
1889	PIOMMMIORANGE pRange = iomMmioGetRange(pVM, GCPhys);
1890	AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1891	if (!pRange)
1892	{
1893	IOM_UNLOCK(pVM);
1894	return VERR_INTERNAL_ERROR;
1895	}
1896	#ifdef VBOX_WITH_STATISTICS
1897	PIOMMMIOSTATS pStats = iomMmioGetStats(pVM, GCPhys, pRange);
1898	if (!pStats)
1899	{
1900	IOM_UNLOCK(pVM);
1901	# ifdef IN_RING3
1902	return VERR_NO_MEMORY;
1903	# else
1904	return VINF_IOM_HC_MMIO_WRITE;
1905	# endif
1906	}
1907	STAM_COUNTER_INC(&pStats->Accesses);
1908	#endif /* VBOX_WITH_STATISTICS */
1909
1910	if (pRange->CTX_SUFF(pfnWriteCallback))
1911	{
1912	/*
1913	* Perform locking.
1914	*/
1915	iomMmioRetainRange(pRange);
1916	PPDMDEVINS pDevIns = pRange->CTX_SUFF(pDevIns);
1917	IOM_UNLOCK(pVM);
1918	rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_HC_MMIO_READ);
1919	if (rc != VINF_SUCCESS)
1920	{
1921	iomMmioReleaseRange(pVM, pRange);
1922	return rc;
1923	}
1924
1925	/*
1926	* Perform the write.
1927	*/
1928	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
1929	if ( (cbValue == 4 && !(GCPhys & 3))
1930	\|\| (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_PASSTHRU
1931	\|\| (cbValue == 8 && !(GCPhys & 7)) )
1932	rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
1933	GCPhys, &u32Value, (unsigned)cbValue);
1934	else
1935	rc = iomMMIODoComplicatedWrite(pRange, GCPhys, &u32Value, (unsigned)cbValue);
1936	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
1937	#ifndef IN_RING3
1938	if ( rc == VINF_IOM_HC_MMIO_WRITE
1939	\|\| rc == VINF_IOM_HC_MMIO_READ_WRITE)
1940	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1941	#endif
1942	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, VBOXSTRICTRC_VAL(rc)));
1943	iomMmioReleaseRange(pVM, pRange);
1944	PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
1945	return rc;
1946	}
1947	#ifndef IN_RING3
1948	if (pRange->pfnWriteCallbackR3)
1949	{
1950	STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1951	IOM_UNLOCK(pVM);
1952	return VINF_IOM_HC_MMIO_WRITE;
1953	}
1954	#endif
1955
1956	/*
1957	* No write handler, nothing to do.
1958	*/
1959	STAM_PROFILE_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
1960	STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
1961	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, VINF_SUCCESS));
1962	IOM_UNLOCK(pVM);
1963	return VINF_SUCCESS;
1964	}
1965
1966
1967	/**
1968	* [REP*] INSB/INSW/INSD
1969	* ES:EDI,DX[,ECX]
1970	*
1971	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1972	*
1973	* @returns Strict VBox status code. Informational status codes other than the one documented
1974	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1975	* @retval VINF_SUCCESS Success.
1976	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1977	* status code must be passed on to EM.
1978	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1979	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1980	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1981	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1982	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1983	*
1984	* @param pVM The virtual machine.
1985	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1986	* @param uPort IO Port
1987	* @param uPrefix IO instruction prefix
1988	* @param enmAddrMode The address mode.
1989	* @param cbTransfer Size of transfer unit
1990	*/
1991	VMMDECL(VBOXSTRICTRC) IOMInterpretINSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix,
1992	DISCPUMODE enmAddrMode, uint32_t cbTransfer)
1993	{
1994	STAM_COUNTER_INC(&pVM->iom.s.StatInstIns);
1995
1996	/*
1997	* We do not support REPNE or decrementing destination
1998	* pointer. Segment prefixes are deliberately ignored, as per the instruction specification.
1999	*/
2000	if ( (uPrefix & PREFIX_REPNE)
2001	\|\| pRegFrame->eflags.Bits.u1DF)
2002	return VINF_EM_RAW_EMULATE_INSTR;
2003
2004	PVMCPU pVCpu = VMMGetCpu(pVM);
2005
2006	/*
2007	* Get bytes/words/dwords count to transfer.
2008	*/
2009	uint64_t const fAddrMask = iomDisModeToMask(enmAddrMode);
2010	RTGCUINTREG cTransfers = 1;
2011	if (uPrefix & PREFIX_REP)
2012	{
2013	#ifndef IN_RC
2014	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
2015	&& pRegFrame->rcx >= _4G)
2016	return VINF_EM_RAW_EMULATE_INSTR;
2017	#endif
2018	cTransfers = pRegFrame->rcx & fAddrMask;
2019	if (!cTransfers)
2020	return VINF_SUCCESS;
2021	}
2022
2023	/* Convert destination address es:edi. */
2024	RTGCPTR GCPtrDst;
2025	int rc2 = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, pRegFrame->rdi & fAddrMask,
2026	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
2027	&GCPtrDst);
2028	if (RT_FAILURE(rc2))
2029	{
2030	Log(("INS destination address conversion failed -> fallback, rc2=%d\n", rc2));
2031	return VINF_EM_RAW_EMULATE_INSTR;
2032	}
2033
2034	/* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
2035	uint32_t const cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2036	rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrDst, cTransfers * cbTransfer,
2037	X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
2038	if (rc2 != VINF_SUCCESS)
2039	{
2040	Log(("INS will generate a trap -> fallback, rc2=%d\n", rc2));
2041	return VINF_EM_RAW_EMULATE_INSTR;
2042	}
2043
2044	Log(("IOM: rep ins%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
2045	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
2046	if (cTransfers > 1)
2047	{
2048	/* If the device supports string transfers, ask it to do as
2049	* much as it wants. The rest is done with single-word transfers. */
2050	const RTGCUINTREG cTransfersOrg = cTransfers;
2051	rcStrict = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbTransfer);
2052	AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
2053	pRegFrame->rdi = ((pRegFrame->rdi + (cTransfersOrg - cTransfers) * cbTransfer) & fAddrMask)
2054	\| (pRegFrame->rdi & ~fAddrMask);
2055	}
2056
2057	#ifdef IN_RC
2058	MMGCRamRegisterTrapHandler(pVM);
2059	#endif
2060	while (cTransfers && rcStrict == VINF_SUCCESS)
2061	{
2062	uint32_t u32Value;
2063	rcStrict = IOMIOPortRead(pVM, uPort, &u32Value, cbTransfer);
2064	if (!IOM_SUCCESS(rcStrict))
2065	break;
2066	rc2 = iomRamWrite(pVCpu, pRegFrame, GCPtrDst, &u32Value, cbTransfer);
2067	Assert(rc2 == VINF_SUCCESS); NOREF(rc2);
2068	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbTransfer);
2069	pRegFrame->rdi = ((pRegFrame->rdi + cbTransfer) & fAddrMask)
2070	\| (pRegFrame->rdi & ~fAddrMask);
2071	cTransfers--;
2072	}
2073	#ifdef IN_RC
2074	MMGCRamDeregisterTrapHandler(pVM);
2075	#endif
2076
2077	/* Update rcx on exit. */
2078	if (uPrefix & PREFIX_REP)
2079	pRegFrame->rcx = (cTransfers & fAddrMask)
2080	\| (pRegFrame->rcx & ~fAddrMask);
2081
2082	AssertMsg(rcStrict == VINF_SUCCESS \|\| rcStrict == VINF_IOM_HC_IOPORT_READ \|\| (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
2083	return rcStrict;
2084	}
2085
2086
2087	/**
2088	* [REP*] INSB/INSW/INSD
2089	* ES:EDI,DX[,ECX]
2090	*
2091	* @returns Strict VBox status code. Informational status codes other than the one documented
2092	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
2093	* @retval VINF_SUCCESS Success.
2094	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
2095	* status code must be passed on to EM.
2096	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
2097	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
2098	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
2099	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
2100	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
2101	*
2102	* @param pVM The virtual machine.
2103	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
2104	* @param pCpu Disassembler CPU state.
2105	*/
2106	VMMDECL(VBOXSTRICTRC) IOMInterpretINS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
2107	{
2108	/*
2109	* Get port number directly from the register (no need to bother the
2110	* disassembler). And get the I/O register size from the opcode / prefix.
2111	*/
2112	RTIOPORT Port = pRegFrame->edx & 0xffff;
2113	unsigned cb = 0;
2114	if (pCpu->pCurInstr->opcode == OP_INSB)
2115	cb = 1;
2116	else
2117	cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
2118
2119	VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
2120	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
2121	{
2122	AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
2123	return rcStrict;
2124	}
2125
2126	return IOMInterpretINSEx(pVM, pRegFrame, Port, pCpu->prefix, pCpu->addrmode, cb);
2127	}
2128
2129
2130	/**
2131	* [REP*] OUTSB/OUTSW/OUTSD
2132	* DS:ESI,DX[,ECX]
2133	*
2134	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
2135	*
2136	* @returns Strict VBox status code. Informational status codes other than the one documented
2137	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
2138	* @retval VINF_SUCCESS Success.
2139	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
2140	* status code must be passed on to EM.
2141	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
2142	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
2143	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
2144	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
2145	*
2146	* @param pVM The virtual machine.
2147	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
2148	* @param uPort IO Port
2149	* @param uPrefix IO instruction prefix
2150	* @param enmAddrMode The address mode.
2151	* @param cbTransfer Size of transfer unit
2152	*/
2153	VMMDECL(VBOXSTRICTRC) IOMInterpretOUTSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix,
2154	DISCPUMODE enmAddrMode, uint32_t cbTransfer)
2155	{
2156	STAM_COUNTER_INC(&pVM->iom.s.StatInstOuts);
2157
2158	/*
2159	* We do not support segment prefixes, REPNE or
2160	* decrementing source pointer.
2161	*/
2162	if ( (uPrefix & (PREFIX_SEG \| PREFIX_REPNE))
2163	\|\| pRegFrame->eflags.Bits.u1DF)
2164	return VINF_EM_RAW_EMULATE_INSTR;
2165
2166	PVMCPU pVCpu = VMMGetCpu(pVM);
2167
2168	/*
2169	* Get bytes/words/dwords count to transfer.
2170	*/
2171	uint64_t const fAddrMask = iomDisModeToMask(enmAddrMode);
2172	RTGCUINTREG cTransfers = 1;
2173	if (uPrefix & PREFIX_REP)
2174	{
2175	#ifndef IN_RC
2176	if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
2177	&& pRegFrame->rcx >= _4G)
2178	return VINF_EM_RAW_EMULATE_INSTR;
2179	#endif
2180	cTransfers = pRegFrame->rcx & fAddrMask;
2181	if (!cTransfers)
2182	return VINF_SUCCESS;
2183	}
2184
2185	/* Convert source address ds:esi. */
2186	RTGCPTR GCPtrSrc;
2187	int rc2 = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, pRegFrame->rsi & fAddrMask,
2188	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
2189	&GCPtrSrc);
2190	if (RT_FAILURE(rc2))
2191	{
2192	Log(("OUTS source address conversion failed -> fallback, rc2=%Rrc\n", rc2));
2193	return VINF_EM_RAW_EMULATE_INSTR;
2194	}
2195
2196	/* Access verification first; we currently can't recover properly from traps inside this instruction */
2197	uint32_t const cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
2198	rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrSrc, cTransfers * cbTransfer,
2199	(cpl == 3) ? X86_PTE_US : 0);
2200	if (rc2 != VINF_SUCCESS)
2201	{
2202	Log(("OUTS will generate a trap -> fallback, rc2=%Rrc\n", rc2));
2203	return VINF_EM_RAW_EMULATE_INSTR;
2204	}
2205
2206	Log(("IOM: rep outs%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
2207	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
2208	if (cTransfers > 1)
2209	{
2210	/*
2211	* If the device supports string transfers, ask it to do as
2212	* much as it wants. The rest is done with single-word transfers.
2213	*/
2214	const RTGCUINTREG cTransfersOrg = cTransfers;
2215	rcStrict = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbTransfer);
2216	AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
2217	pRegFrame->rsi = ((pRegFrame->rsi + (cTransfersOrg - cTransfers) * cbTransfer) & fAddrMask)
2218	\| (pRegFrame->rsi & ~fAddrMask);
2219	}
2220
2221	#ifdef IN_RC
2222	MMGCRamRegisterTrapHandler(pVM);
2223	#endif
2224
2225	while (cTransfers && rcStrict == VINF_SUCCESS)
2226	{
2227	uint32_t u32Value = 0;
2228	rcStrict = iomRamRead(pVCpu, &u32Value, GCPtrSrc, cbTransfer);
2229	if (rcStrict != VINF_SUCCESS)
2230	break;
2231	rcStrict = IOMIOPortWrite(pVM, uPort, u32Value, cbTransfer);
2232	if (!IOM_SUCCESS(rcStrict))
2233	break;
2234	GCPtrSrc = (RTGCPTR)((RTUINTPTR)GCPtrSrc + cbTransfer);
2235	pRegFrame->rsi = ((pRegFrame->rsi + cbTransfer) & fAddrMask)
2236	\| (pRegFrame->rsi & ~fAddrMask);
2237	cTransfers--;
2238	}
2239
2240	#ifdef IN_RC
2241	MMGCRamDeregisterTrapHandler(pVM);
2242	#endif
2243
2244	/* Update rcx on exit. */
2245	if (uPrefix & PREFIX_REP)
2246	pRegFrame->rcx = (cTransfers & fAddrMask)
2247	\| (pRegFrame->rcx & ~fAddrMask);
2248
2249	AssertMsg(rcStrict == VINF_SUCCESS \|\| rcStrict == VINF_IOM_HC_IOPORT_WRITE \|\| (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
2250	return rcStrict;
2251	}
2252
2253
2254	/**
2255	* [REP*] OUTSB/OUTSW/OUTSD
2256	* DS:ESI,DX[,ECX]
2257	*
2258	* @returns Strict VBox status code. Informational status codes other than the one documented
2259	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
2260	* @retval VINF_SUCCESS Success.
2261	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
2262	* status code must be passed on to EM.
2263	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
2264	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the write to the REM.
2265	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
2266	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
2267	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
2268	*
2269	* @param pVM The virtual machine.
2270	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
2271	* @param pCpu Disassembler CPU state.
2272	*/
2273	VMMDECL(VBOXSTRICTRC) IOMInterpretOUTS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
2274	{
2275	/*
2276	* Get port number from the first parameter.
2277	* And get the I/O register size from the opcode / prefix.
2278	*/
2279	uint64_t Port = 0;
2280	unsigned cb = 0;
2281	bool fRc = iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &Port, &cb);
2282	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
2283	if (pCpu->pCurInstr->opcode == OP_OUTSB)
2284	cb = 1;
2285	else
2286	cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
2287
2288	VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
2289	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
2290	{
2291	AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| rcStrict == VINF_TRPM_XCPT_DISPATCHED \|\| RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
2292	return rcStrict;
2293	}
2294
2295	return IOMInterpretOUTSEx(pVM, pRegFrame, Port, pCpu->prefix, pCpu->addrmode, cb);
2296	}
2297
2298	#ifndef IN_RC
2299
2300	/**
2301	* Mapping an MMIO2 page in place of an MMIO page for direct access.
2302	*
2303	* (This is a special optimization used by the VGA device.)
2304	*
2305	* @returns VBox status code.
2306	*
2307	* @param pVM The virtual machine.
2308	* @param GCPhys The address of the MMIO page to be changed.
2309	* @param GCPhysRemapped The address of the MMIO2 page.
2310	* @param fPageFlags Page flags to set. Must be (X86_PTE_RW \| X86_PTE_P)
2311	* for the time being.
2312	*/
2313	VMMDECL(int) IOMMMIOMapMMIO2Page(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysRemapped, uint64_t fPageFlags)
2314	{
2315	/* Currently only called from the VGA device during MMIO. */
2316	Log(("IOMMMIOMapMMIO2Page %RGp -> %RGp flags=%RX64\n", GCPhys, GCPhysRemapped, fPageFlags));
2317	AssertReturn(fPageFlags == (X86_PTE_RW \| X86_PTE_P), VERR_INVALID_PARAMETER);
2318	PVMCPU pVCpu = VMMGetCpu(pVM);
2319
2320	/* This currently only works in real mode, protected mode without paging or with nested paging. */
2321	if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
2322	\|\| ( CPUMIsGuestInPagedProtectedMode(pVCpu)
2323	&& !HWACCMIsNestedPagingActive(pVM)))
2324	return VINF_SUCCESS; /* ignore */
2325
2326	IOM_LOCK(pVM);
2327
2328	/*
2329	* Lookup the context range node the page belongs to.
2330	*/
2331	PIOMMMIORANGE pRange = iomMmioGetRange(pVM, GCPhys);
2332	AssertMsgReturn(pRange,
2333	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
2334
2335	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
2336	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2337
2338	/*
2339	* Do the aliasing; page align the addresses since PGM is picky.
2340	*/
2341	GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
2342	GCPhysRemapped &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
2343
2344	int rc = PGMHandlerPhysicalPageAlias(pVM, pRange->GCPhys, GCPhys, GCPhysRemapped);
2345
2346	IOM_UNLOCK(pVM);
2347	AssertRCReturn(rc, rc);
2348
2349	/*
2350	* Modify the shadow page table. Since it's an MMIO page it won't be present and we
2351	* can simply prefetch it.
2352	*
2353	* Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
2354	*/
2355	#if 0 /* The assertion is wrong for the PGM_SYNC_CLEAR_PGM_POOL and VINF_PGM_HANDLER_ALREADY_ALIASED cases. */
2356	# ifdef VBOX_STRICT
2357	uint64_t fFlags;
2358	RTHCPHYS HCPhys;
2359	rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
2360	Assert(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2361	# endif
2362	#endif
2363	rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
2364	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2365	return VINF_SUCCESS;
2366	}
2367
2368
2369	/**
2370	* Mapping a HC page in place of an MMIO page for direct access.
2371	*
2372	* (This is a special optimization used by the APIC in the VT-x case.)
2373	*
2374	* @returns VBox status code.
2375	*
2376	* @param pVM The virtual machine.
2377	* @param GCPhys The address of the MMIO page to be changed.
2378	* @param HCPhys The address of the host physical page.
2379	* @param fPageFlags Page flags to set. Must be (X86_PTE_RW \| X86_PTE_P)
2380	* for the time being.
2381	*/
2382	VMMDECL(int) IOMMMIOMapMMIOHCPage(PVM pVM, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags)
2383	{
2384	/* Currently only called from VT-x code during a page fault. */
2385	Log(("IOMMMIOMapMMIOHCPage %RGp -> %RGp flags=%RX64\n", GCPhys, HCPhys, fPageFlags));
2386
2387	AssertReturn(fPageFlags == (X86_PTE_RW \| X86_PTE_P), VERR_INVALID_PARAMETER);
2388	Assert(HWACCMIsEnabled(pVM));
2389
2390	PVMCPU pVCpu = VMMGetCpu(pVM);
2391
2392	/*
2393	* Lookup the context range node the page belongs to.
2394	*/
2395	#ifdef VBOX_STRICT
2396	/* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
2397	PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(pVM, GCPhys);
2398	AssertMsgReturn(pRange,
2399	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
2400	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
2401	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2402	#endif
2403
2404	/*
2405	* Do the aliasing; page align the addresses since PGM is picky.
2406	*/
2407	GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
2408	HCPhys &= ~(RTHCPHYS)PAGE_OFFSET_MASK;
2409
2410	int rc = PGMHandlerPhysicalPageAliasHC(pVM, GCPhys, GCPhys, HCPhys);
2411	AssertRCReturn(rc, rc);
2412
2413	/*
2414	* Modify the shadow page table. Since it's an MMIO page it won't be present and we
2415	* can simply prefetch it.
2416	*
2417	* Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
2418	*/
2419	rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
2420	Assert(rc == VINF_SUCCESS \|\| rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2421	return VINF_SUCCESS;
2422	}
2423
2424
2425	/**
2426	* Reset a previously modified MMIO region; restore the access flags.
2427	*
2428	* @returns VBox status code.
2429	*
2430	* @param pVM The virtual machine.
2431	* @param GCPhys Physical address that's part of the MMIO region to be reset.
2432	*/
2433	VMMDECL(int) IOMMMIOResetRegion(PVM pVM, RTGCPHYS GCPhys)
2434	{
2435	Log(("IOMMMIOResetRegion %RGp\n", GCPhys));
2436
2437	PVMCPU pVCpu = VMMGetCpu(pVM);
2438
2439	/* This currently only works in real mode, protected mode without paging or with nested paging. */
2440	if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
2441	\|\| ( CPUMIsGuestInPagedProtectedMode(pVCpu)
2442	&& !HWACCMIsNestedPagingActive(pVM)))
2443	return VINF_SUCCESS; /* ignore */
2444
2445	/*
2446	* Lookup the context range node the page belongs to.
2447	*/
2448	#ifdef VBOX_STRICT
2449	/* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
2450	PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(pVM, GCPhys);
2451	AssertMsgReturn(pRange,
2452	("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
2453	Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
2454	Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2455	#endif
2456
2457	/*
2458	* Call PGM to do the job work.
2459	*
2460	* After the call, all the pages should be non-present... unless there is
2461	* a page pool flush pending (unlikely).
2462	*/
2463	int rc = PGMHandlerPhysicalReset(pVM, GCPhys);
2464	AssertRC(rc);
2465
2466	#ifdef VBOX_STRICT
2467	if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
2468	{
2469	uint32_t cb = pRange->cb;
2470	GCPhys = pRange->GCPhys;
2471	while (cb)
2472	{
2473	uint64_t fFlags;
2474	RTHCPHYS HCPhys;
2475	rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
2476	Assert(rc == VERR_PAGE_NOT_PRESENT \|\| rc == VERR_PAGE_TABLE_NOT_PRESENT);
2477	cb -= PAGE_SIZE;
2478	GCPhys += PAGE_SIZE;
2479	}
2480	}
2481	#endif
2482	return rc;
2483	}
2484
2485	#endif /* !IN_RC */
2486

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp@ 39111

Download in other formats: