IOMAllMMIO.cpp@ 9248

Last change on this file since 9248 was 9212, checked in by vboxsync, 17 years ago

Major changes for sizeof(RTGCPTR) == uint64_t.
Introduced RCPTRTYPE for pointers valid in raw mode only (RTGCPTR32).

Disabled by default. Enable by adding VBOX_WITH_64_BITS_GUESTS to your LocalConfig.kmk.

Property svn:eol-style set to native
Property svn:keywords set to Id

File size: 52.9 KB

Line
1	/* $Id: IOMAllMMIO.cpp 9212 2008-05-29 09:38:38Z vboxsync $ */
2	/** @file
3	* IOM - Input / Output Monitor - Guest Context.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_IOM
27	#include <VBox/iom.h>
28	#include <VBox/cpum.h>
29	#include <VBox/pgm.h>
30	#include <VBox/selm.h>
31	#include <VBox/mm.h>
32	#include <VBox/em.h>
33	#include <VBox/pgm.h>
34	#include <VBox/trpm.h>
35	#include "IOMInternal.h"
36	#include <VBox/vm.h>
37
38	#include <VBox/dis.h>
39	#include <VBox/disopcode.h>
40	#include <VBox/param.h>
41	#include <VBox/err.h>
42	#include <iprt/assert.h>
43	#include <VBox/log.h>
44	#include <iprt/asm.h>
45	#include <iprt/string.h>
46
47
48
49	/*******************************************************************************
50	* Global Variables *
51	*******************************************************************************/
52
53	/**
54	* Array for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
55	*/
56	static const unsigned g_aSize2Shift[] =
57	{
58	~0, /* 0 - invalid */
59	0, /* 1 == 2^0 /
60	1, /* 2 == 2^1 /
61	~0, /* 3 - invalid */
62	2, /* 4 == 2^2 /
63	~0, /* 5 - invalid */
64	~0, /* 6 - invalid */
65	~0, /* 7 - invalid */
66	3 /* 8 == 2^3 /
67	};
68
69	/**
70	* Macro for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
71	*/
72	#define SIZE_2_SHIFT(cb) (g_aSize2Shift[cb])
73
74
75	/**
76	* Wrapper which does the write and updates range statistics when such are enabled.
77	* @warning VBOX_SUCCESS(rc=VINF_IOM_HC_MMIO_WRITE) is TRUE!
78	*/
79	DECLINLINE(int) iomMMIODoWrite(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cb)
80	{
81	#ifdef VBOX_WITH_STATISTICS
82	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
83	Assert(pStats);
84	#endif
85
86	int rc;
87	if (RT_LIKELY(pRange->CTXALLSUFF(pfnWriteCallback)))
88	rc = pRange->CTXALLSUFF(pfnWriteCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), GCPhysFault, (void )pvData, cb); / @todo fix const!! */
89	else
90	rc = VINF_SUCCESS;
91	if (rc != VINF_IOM_HC_MMIO_WRITE)
92	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Write));
93	return rc;
94	}
95
96	/**
97	* Wrapper which does the read and updates range statistics when such are enabled.
98	*/
99	DECLINLINE(int) iomMMIODoRead(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, void *pvData, unsigned cb)
100	{
101	#ifdef VBOX_WITH_STATISTICS
102	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
103	Assert(pStats);
104	#endif
105
106	int rc;
107	if (RT_LIKELY(pRange->CTXALLSUFF(pfnReadCallback)))
108	rc = pRange->CTXALLSUFF(pfnReadCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), GCPhysFault, pvData, cb);
109	else
110	{
111	switch (cb)
112	{
113	case 1: (uint8_t )pvData = 0; break;
114	case 2: (uint16_t )pvData = 0; break;
115	case 4: (uint32_t )pvData = 0; break;
116	case 8: (uint64_t )pvData = 0; break;
117	default:
118	memset(pvData, 0, cb);
119	break;
120	}
121	rc = VINF_SUCCESS;
122	}
123	if (rc != VINF_IOM_HC_MMIO_READ)
124	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Read));
125	return rc;
126	}
127
128	/*
129	* Internal - statistics only.
130	*/
131	DECLINLINE(void) iomMMIOStatLength(PVM pVM, unsigned cb)
132	{
133	#ifdef VBOX_WITH_STATISTICS
134	switch (cb)
135	{
136	case 1:
137	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO1Byte);
138	break;
139	case 2:
140	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO2Bytes);
141	break;
142	case 4:
143	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO4Bytes);
144	break;
145	default:
146	/* No way. */
147	AssertMsgFailed(("Invalid data length %d\n", cb));
148	break;
149	}
150	#else
151	NOREF(pVM); NOREF(cb);
152	#endif
153	}
154
155
156	/**
157	* MOV reg, mem (read)
158	* MOVZX reg, mem (read)
159	* MOVSX reg, mem (read)
160	*
161	* @returns VBox status code.
162	*
163	* @param pVM The virtual machine (GC pointer ofcourse).
164	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
165	* @param pCpu Disassembler CPU state.
166	* @param pRange Pointer MMIO range.
167	* @param GCPhysFault The GC physical address corresponding to pvFault.
168	*/
169	static int iomInterpretMOVxXRead(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
170	{
171	Assert(pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
172
173	/*
174	* Get the data size from parameter 2,
175	* and call the handler function to get the data.
176	*/
177	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
178	AssertMsg(cb > 0 && cb <= sizeof(uint32_t), ("cb=%d\n", cb));
179
180	uint32_t u32Data = 0;
181	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &u32Data, cb);
182	if (rc == VINF_SUCCESS)
183	{
184	/*
185	* Do sign extension for MOVSX.
186	*/
187	/** @todo checkup MOVSX implementation! */
188	if (pCpu->pCurInstr->opcode == OP_MOVSX)
189	{
190	if (cb == 1)
191	{
192	/* DWORD <- BYTE */
193	int32_t iData = (int8_t)u32Data;
194	u32Data = (uint32_t)iData;
195	}
196	else
197	{
198	/* DWORD <- WORD */
199	int32_t iData = (int16_t)u32Data;
200	u32Data = (uint32_t)iData;
201	}
202	}
203
204	/*
205	* Store the result to register (parameter 1).
206	*/
207	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, u32Data);
208	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
209	}
210
211	if (rc == VINF_SUCCESS)
212	iomMMIOStatLength(pVM, cb);
213	return rc;
214	}
215
216
217	/**
218	* MOV mem, reg\|imm (write)
219	*
220	* @returns VBox status code.
221	*
222	* @param pVM The virtual machine (GC pointer ofcourse).
223	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
224	* @param pCpu Disassembler CPU state.
225	* @param pRange Pointer MMIO range.
226	* @param GCPhysFault The GC physical address corresponding to pvFault.
227	*/
228	static int iomInterpretMOVxXWrite(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
229	{
230	Assert(pRange->CTXALLSUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
231
232	/*
233	* Get data to write from second parameter,
234	* and call the callback to write it.
235	*/
236	unsigned cb = 0;
237	uint32_t u32Data = 0;
238	bool fRc = iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &u32Data, &cb);
239	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
240
241	int rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &u32Data, cb);
242	if (rc == VINF_SUCCESS)
243	iomMMIOStatLength(pVM, cb);
244	return rc;
245	}
246
247
248	/** Wrapper for reading virtual memory. */
249	DECLINLINE(int) iomRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
250	{
251	#ifdef IN_GC
252	return MMGCRamReadNoTrapHandler(pDest, (void *)GCSrc, cb);
253	#else
254	return PGMPhysReadGCPtrSafe(pVM, pDest, GCSrc, cb);
255	#endif
256	}
257
258
259	/** Wrapper for writing virtual memory. */
260	DECLINLINE(int) iomRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
261	{
262	#ifdef IN_GC
263	return MMGCRamWriteNoTrapHandler((void *)GCDest, pSrc, cb);
264	#else
265	return PGMPhysWriteGCPtrSafe(pVM, GCDest, pSrc, cb);
266	#endif
267	}
268
269
270	#ifdef iom_MOVS_SUPPORT
271	/**
272	* [REP] MOVSB
273	* [REP] MOVSW
274	* [REP] MOVSD
275	*
276	* Restricted implementation.
277	*
278	*
279	* @returns VBox status code.
280	*
281	* @param pVM The virtual machine (GC pointer ofcourse).
282	* @param uErrorCode CPU Error code.
283	* @param pRegFrame Trap register frame.
284	* @param GCPhysFault The GC physical address corresponding to pvFault.
285	* @param pCpu Disassembler CPU state.
286	* @param pRange Pointer MMIO range.
287	*/
288	static int iomInterpretMOVS(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
289	{
290	/*
291	* We do not support segment prefixes or REPNE.
292	*/
293	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
294	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> interpret whatever. */
295
296
297	/*
298	* Get bytes/words/dwords count to copy.
299	*/
300	uint32_t cTransfers = 1;
301	if (pCpu->prefix & PREFIX_REP)
302	{
303	cTransfers = pRegFrame->ecx;
304	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
305	cTransfers &= 0xffff;
306
307	if (!cTransfers)
308	return VINF_SUCCESS;
309	}
310
311	/* Get the current privilege level. */
312	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
313
314	/*
315	* Get data size.
316	*/
317	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
318	Assert(cb);
319	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
320
321	#ifdef VBOX_WITH_STATISTICS
322	if (pVM->iom.s.cMovsMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
323	pVM->iom.s.cMovsMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
324	#endif
325
326	/** @todo re-evaluate on page boundraries. */
327
328	RTGCPHYS Phys = GCPhysFault;
329	int rc;
330	if (uErrorCode & X86_TRAP_PF_RW)
331	{
332	/*
333	* Write operation: [Mem] -> [MMIO]
334	* ds:esi (Virt Src) -> es:edi (Phys Dst)
335	*/
336	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
337
338	/* Check callback. */
339	if (!pRange->CTXALLSUFF(pfnWriteCallback))
340	{
341	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
342	return VINF_IOM_HC_MMIO_WRITE;
343	}
344
345	/* Convert source address ds:esi. */
346	RTGCUINTPTR pu8Virt;
347	rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->ds, (RTGCPTR)pRegFrame->esi, &pRegFrame->dsHid,
348	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
349	(PRTGCPTR)&pu8Virt, NULL);
350	if (VBOX_SUCCESS(rc))
351	{
352
353	/* Access verification first; we currently can't recover properly from traps inside this instruction */
354	rc = PGMVerifyAccess(pVM, pu8Virt, cTransfers * cb, (cpl == 3) ? X86_PTE_US : 0);
355	if (rc != VINF_SUCCESS)
356	{
357	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
358	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
359	return VINF_EM_RAW_EMULATE_INSTR;
360	}
361
362	#ifdef IN_GC
363	MMGCRamRegisterTrapHandler(pVM);
364	#endif
365
366	/* copy loop. */
367	while (cTransfers)
368	{
369	uint32_t u32Data = 0;
370	rc = iomRamRead(pVM, &u32Data, (RTGCPTR)pu8Virt, cb);
371	if (rc != VINF_SUCCESS)
372	break;
373	rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
374	if (rc != VINF_SUCCESS)
375	break;
376
377	pu8Virt += offIncrement;
378	Phys += offIncrement;
379	pRegFrame->esi += offIncrement;
380	pRegFrame->edi += offIncrement;
381	cTransfers--;
382	}
383	#ifdef IN_GC
384	MMGCRamDeregisterTrapHandler(pVM);
385	#endif
386	/* Update ecx. */
387	if (pCpu->prefix & PREFIX_REP)
388	pRegFrame->ecx = cTransfers;
389	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
390	}
391	else
392	rc = VINF_IOM_HC_MMIO_READ_WRITE;
393	}
394	else
395	{
396	/*
397	* Read operation: [MMIO] -> [mem] or [MMIO] -> [MMIO]
398	* ds:[eSI] (Phys Src) -> es:[eDI] (Virt Dst)
399	*/
400	/* Check callback. */
401	if (!pRange->pfnReadCallback)
402	return VINF_IOM_HC_MMIO_READ;
403
404	/* Convert destination address. */
405	RTGCUINTPTR pu8Virt;
406	rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->es, (RTGCPTR)pRegFrame->edi, &pRegFrame->esHid,
407	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
408	(RTGCPTR *)&pu8Virt, NULL);
409	if (VBOX_FAILURE(rc))
410	return VINF_EM_RAW_GUEST_TRAP;
411
412	/* Check if destination address is MMIO. */
413	PIOMMMIORANGE pMMIODst;
414	RTGCPHYS PhysDst;
415	rc = PGMGstGetPage(pVM, (RTGCPTR)pu8Virt, NULL, &PhysDst);
416	PhysDst \|= (RTGCUINTPTR)pu8Virt & PAGE_OFFSET_MASK;
417	if ( VBOX_SUCCESS(rc)
418	&& (pMMIODst = iomMMIOGetRange(&pVM->iom.s, PhysDst)))
419	{
420	/*
421	* Extra: [MMIO] -> [MMIO]
422	*/
423	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsMMIO, d);
424	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
425
426	if (!pMMIODst->CTXALLSUFF(pfnWriteCallback) && pMMIODst->pfnWriteCallbackR3)
427	{
428	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsMMIO, d);
429	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
430	return VINF_IOM_HC_MMIO_READ_WRITE;
431	}
432
433	/* copy loop. */
434	while (cTransfers)
435	{
436	uint32_t u32Data;
437	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
438	if (rc != VINF_SUCCESS)
439	break;
440	rc = iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb);
441	if (rc != VINF_SUCCESS)
442	break;
443
444	Phys += offIncrement;
445	PhysDst += offIncrement;
446	pRegFrame->esi += offIncrement;
447	pRegFrame->edi += offIncrement;
448	cTransfers--;
449	}
450	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsMMIO, d);
451	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
452	}
453	else
454	{
455	/*
456	* Normal: [MMIO] -> [Mem]
457	*/
458	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
459
460	/* Access verification first; we currently can't recover properly from traps inside this instruction */
461	rc = PGMVerifyAccess(pVM, pu8Virt, cTransfers * cb, X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
462	if (rc != VINF_SUCCESS)
463	{
464	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
465	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
466	return VINF_EM_RAW_EMULATE_INSTR;
467	}
468
469	/* copy loop. */
470	#ifdef IN_GC
471	MMGCRamRegisterTrapHandler(pVM);
472	#endif
473	while (cTransfers)
474	{
475	uint32_t u32Data;
476	rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
477	if (rc != VINF_SUCCESS)
478	break;
479	rc = iomRamWrite(pVM, (RTGCPTR)pu8Virt, &u32Data, cb);
480	if (rc != VINF_SUCCESS)
481	{
482	Log(("iomRamWrite %08X size=%d failed with %d\n", pu8Virt, cb, rc));
483	break;
484	}
485
486	pu8Virt += offIncrement;
487	Phys += offIncrement;
488	pRegFrame->esi += offIncrement;
489	pRegFrame->edi += offIncrement;
490	cTransfers--;
491	}
492	#ifdef IN_GC
493	MMGCRamDeregisterTrapHandler(pVM);
494	#endif
495	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
496	}
497
498	/* Update ecx on exit. */
499	if (pCpu->prefix & PREFIX_REP)
500	pRegFrame->ecx = cTransfers;
501	}
502
503	/* work statistics. */
504	if (rc == VINF_SUCCESS)
505	{
506	iomMMIOStatLength(pVM, cb);
507	}
508	return rc;
509	}
510	#endif
511
512
513
514	/**
515	* [REP] STOSB
516	* [REP] STOSW
517	* [REP] STOSD
518	*
519	* Restricted implementation.
520	*
521	*
522	* @returns VBox status code.
523	*
524	* @param pVM The virtual machine (GC pointer ofcourse).
525	* @param pRegFrame Trap register frame.
526	* @param GCPhysFault The GC physical address corresponding to pvFault.
527	* @param pCpu Disassembler CPU state.
528	* @param pRange Pointer MMIO range.
529	*/
530	static int iomInterpretSTOS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
531	{
532	/*
533	* We do not support segment prefixes or REPNE..
534	*/
535	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
536	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
537
538	/*
539	* Get bytes/words/dwords count to copy.
540	*/
541	uint32_t cTransfers = 1;
542	if (pCpu->prefix & PREFIX_REP)
543	{
544	cTransfers = pRegFrame->ecx;
545	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
546	cTransfers &= 0xffff;
547
548	if (!cTransfers)
549	return VINF_SUCCESS;
550	}
551
552	/*
553	* Get data size.
554	*/
555	unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
556	Assert(cb);
557	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
558
559	#ifdef VBOX_WITH_STATISTICS
560	if (pVM->iom.s.cStosMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
561	pVM->iom.s.cStosMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
562	#endif
563
564
565	RTGCPHYS Phys = GCPhysFault;
566	uint32_t u32Data = pRegFrame->eax;
567	int rc;
568	if (pRange->CTXALLSUFF(pfnFillCallback))
569	{
570	/*
571	* Use the fill callback.
572	*/
573	/** @todo pfnFillCallback must return number of bytes successfully written!!! */
574	if (offIncrement > 0)
575	{
576	/* addr++ variant. */
577	rc = pRange->CTXALLSUFF(pfnFillCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), Phys, u32Data, cb, cTransfers);
578	if (rc == VINF_SUCCESS)
579	{
580	/* Update registers. */
581	pRegFrame->edi += cTransfers << SIZE_2_SHIFT(cb);
582	if (pCpu->prefix & PREFIX_REP)
583	pRegFrame->ecx = 0;
584	}
585	}
586	else
587	{
588	/* addr-- variant. */
589	rc = pRange->CTXALLSUFF(pfnFillCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), (Phys - (cTransfers - 1)) << SIZE_2_SHIFT(cb), u32Data, cb, cTransfers);
590	if (rc == VINF_SUCCESS)
591	{
592	/* Update registers. */
593	pRegFrame->edi -= cTransfers << SIZE_2_SHIFT(cb);
594	if (pCpu->prefix & PREFIX_REP)
595	pRegFrame->ecx = 0;
596	}
597	}
598	}
599	else
600	{
601	/*
602	* Use the write callback.
603	*/
604	Assert(pRange->CTXALLSUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3);
605
606	/* fill loop. */
607	do
608	{
609	rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
610	if (rc != VINF_SUCCESS)
611	break;
612
613	Phys += offIncrement;
614	pRegFrame->edi += offIncrement;
615	cTransfers--;
616	} while (cTransfers);
617
618	/* Update ecx on exit. */
619	if (pCpu->prefix & PREFIX_REP)
620	pRegFrame->ecx = cTransfers;
621	}
622
623	/*
624	* Work statistics and return.
625	*/
626	if (rc == VINF_SUCCESS)
627	iomMMIOStatLength(pVM, cb);
628	return rc;
629	}
630
631
632	/**
633	* [REP] LODSB
634	* [REP] LODSW
635	* [REP] LODSD
636	*
637	* Restricted implementation.
638	*
639	*
640	* @returns VBox status code.
641	*
642	* @param pVM The virtual machine (GC pointer ofcourse).
643	* @param pRegFrame Trap register frame.
644	* @param GCPhysFault The GC physical address corresponding to pvFault.
645	* @param pCpu Disassembler CPU state.
646	* @param pRange Pointer MMIO range.
647	*/
648	static int iomInterpretLODS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
649	{
650	Assert(pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
651
652	/*
653	* We do not support segment prefixes or REP*.
654	*/
655	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REP \| PREFIX_REPNE))
656	return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
657
658	/*
659	* Get data size.
660	*/
661	unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
662	Assert(cb);
663	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
664
665	/*
666	* Perform read.
667	*/
668	int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &pRegFrame->eax, cb);
669	if (rc == VINF_SUCCESS)
670	pRegFrame->esi += offIncrement;
671
672	/*
673	* Work statistics and return.
674	*/
675	if (rc == VINF_SUCCESS)
676	iomMMIOStatLength(pVM, cb);
677	return rc;
678	}
679
680
681	/**
682	* CMP [MMIO], reg\|imm
683	* CMP reg\|imm, [MMIO]
684	*
685	* Restricted implementation.
686	*
687	*
688	* @returns VBox status code.
689	*
690	* @param pVM The virtual machine (GC pointer ofcourse).
691	* @param pRegFrame Trap register frame.
692	* @param GCPhysFault The GC physical address corresponding to pvFault.
693	* @param pCpu Disassembler CPU state.
694	* @param pRange Pointer MMIO range.
695	*/
696	static int iomInterpretCMP(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
697	{
698	Assert(pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
699
700	/*
701	* Get the operands.
702	*/
703	unsigned cb = 0;
704	uint32_t uData1;
705	uint32_t uData2;
706	int rc;
707	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
708	/* cmp reg, [MMIO]. */
709	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
710	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
711	/* cmp [MMIO], reg\|imm. */
712	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
713	else
714	{
715	AssertMsgFailed(("Disassember CMP problem..\n"));
716	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
717	}
718
719	if (rc == VINF_SUCCESS)
720	{
721	/* Emulate CMP and update guest flags. */
722	uint32_t eflags = EMEmulateCmp(uData1, uData2, cb);
723	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
724	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
725	iomMMIOStatLength(pVM, cb);
726	}
727
728	return rc;
729	}
730
731
732	/**
733	* AND [MMIO], reg\|imm
734	* AND reg, [MMIO]
735	*
736	* Restricted implementation.
737	*
738	*
739	* @returns VBox status code.
740	*
741	* @param pVM The virtual machine (GC pointer ofcourse).
742	* @param pRegFrame Trap register frame.
743	* @param GCPhysFault The GC physical address corresponding to pvFault.
744	* @param pCpu Disassembler CPU state.
745	* @param pRange Pointer MMIO range.
746	*/
747	static int iomInterpretAND(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
748	{
749	unsigned cb = 0;
750	uint32_t uData1;
751	uint32_t uData2;
752	bool fAndWrite;
753	int rc;
754	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
755	{
756	/* and reg, [MMIO]. */
757	Assert(pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
758	fAndWrite = false;
759	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
760	}
761	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
762	{
763	/* and [MMIO], reg\|imm. */
764	fAndWrite = true;
765	if ( (pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3)
766	&& (pRange->CTXALLSUFF(pfnWriteCallback) \|\| !pRange->pfnWriteCallbackR3))
767	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
768	else
769	rc = VINF_IOM_HC_MMIO_READ_WRITE;
770	}
771	else
772	{
773	AssertMsgFailed(("Disassember AND problem..\n"));
774	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
775	}
776
777	if (rc == VINF_SUCCESS)
778	{
779	/* Emulate AND and update guest flags. */
780	uint32_t eflags = EMEmulateAnd(&uData1, uData2, cb);
781	if (fAndWrite)
782	/* Store result to MMIO. */
783	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
784	else
785	{
786	/* Store result to register. */
787	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData1);
788	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
789	}
790	if (rc == VINF_SUCCESS)
791	{
792	/* Update guest's eflags and finish. */
793	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
794	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
795	iomMMIOStatLength(pVM, cb);
796	}
797	}
798
799	return rc;
800	}
801
802
803
804	/**
805	* TEST [MMIO], reg\|imm
806	* TEST reg, [MMIO]
807	*
808	* Restricted implementation.
809	*
810	*
811	* @returns VBox status code.
812	*
813	* @param pVM The virtual machine (GC pointer ofcourse).
814	* @param pRegFrame Trap register frame.
815	* @param GCPhysFault The GC physical address corresponding to pvFault.
816	* @param pCpu Disassembler CPU state.
817	* @param pRange Pointer MMIO range.
818	*/
819	static int iomInterpretTEST(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
820	{
821	Assert(pRange->CTXALLSUFF(pfnReadCallback) \|\| !pRange->pfnReadCallbackR3);
822
823	unsigned cb = 0;
824	uint32_t uData1;
825	uint32_t uData2;
826	int rc;
827
828	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
829	{
830	/* and test, [MMIO]. */
831	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
832	}
833	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
834	{
835	/* test [MMIO], reg\|imm. */
836	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
837	}
838	else
839	{
840	AssertMsgFailed(("Disassember TEST problem..\n"));
841	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
842	}
843
844	if (rc == VINF_SUCCESS)
845	{
846	/* Emulate TEST (=AND without write back) and update guest EFLAGS. */
847	uint32_t eflags = EMEmulateAnd(&uData1, uData2, cb);
848	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
849	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
850	iomMMIOStatLength(pVM, cb);
851	}
852
853	return rc;
854	}
855
856	/**
857	* XCHG [MMIO], reg
858	* XCHG reg, [MMIO]
859	*
860	* Restricted implementation.
861	*
862	*
863	* @returns VBox status code.
864	*
865	* @param pVM The virtual machine (GC pointer ofcourse).
866	* @param pRegFrame Trap register frame.
867	* @param GCPhysFault The GC physical address corresponding to pvFault.
868	* @param pCpu Disassembler CPU state.
869	* @param pRange Pointer MMIO range.
870	*/
871	static int iomInterpretXCHG(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
872	{
873	/* Check for read & write handlers since IOMMMIOHandler doesn't cover this. */
874	if ( (!pRange->CTXALLSUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
875	\|\| (!pRange->CTXALLSUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3))
876	return VINF_IOM_HC_MMIO_READ_WRITE;
877
878	int rc;
879	unsigned cb = 0;
880	uint32_t uData1;
881	uint32_t uData2;
882	if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
883	{
884	/* xchg reg, [MMIO]. */
885	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
886	if (rc == VINF_SUCCESS)
887	{
888	/* Store result to MMIO. */
889	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
890
891	if (rc == VINF_SUCCESS)
892	{
893	/* Store result to register. */
894	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData2);
895	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
896	}
897	else
898	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
899	}
900	else
901	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
902	}
903	else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
904	{
905	/* xchg [MMIO], reg. */
906	rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
907	if (rc == VINF_SUCCESS)
908	{
909	/* Store result to MMIO. */
910	rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData2, cb);
911	if (rc == VINF_SUCCESS)
912	{
913	/* Store result to register. */
914	bool fRc = iomSaveDataToReg(pCpu, &pCpu->param2, pRegFrame, uData1);
915	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
916	}
917	else
918	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
919	}
920	else
921	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
922	}
923	else
924	{
925	AssertMsgFailed(("Disassember XCHG problem..\n"));
926	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
927	}
928	return rc;
929	}
930
931
932	/**
933	* \#PF Handler callback for MMIO ranges.
934	* Note: we are on ring0 in Hypervisor and interrupts are disabled.
935	*
936	* @returns VBox status code (appropriate for GC return).
937	* @param pVM VM Handle.
938	* @param uErrorCode CPU Error code.
939	* @param pCtxCore Trap register frame.
940	* @param pvFault The fault address (cr2).
941	* @param GCPhysFault The GC physical address corresponding to pvFault.
942	* @param pvUser Pointer to the MMIO ring-3 range entry.
943	*/
944	IOMDECL(int) IOMMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, void pvFault, RTGCPHYS GCPhysFault, void pvUser)
945	{
946	STAM_PROFILE_START(&pVM->iom.s.StatGCMMIOHandler, a);
947	Log3(("IOMMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%p eip=%RGv\n",
948	GCPhysFault, uErrorCode, pvFault, pCtxCore->eip));
949
950	PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
951	Assert(pRange);
952	Assert(pRange == iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
953
954	#ifdef VBOX_WITH_STATISTICS
955	/*
956	* Locate the statistics, if > PAGE_SIZE we'll use the first byte for everything.
957	*/
958	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
959	if (!pStats)
960	{
961	# ifdef IN_RING3
962	return VERR_NO_MEMORY;
963	# else
964	STAM_PROFILE_STOP(&pVM->iom.s.StatGCMMIOHandler, a);
965	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIOFailures);
966	return uErrorCode & X86_TRAP_PF_RW ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
967	# endif
968	}
969	#endif
970
971	#ifndef IN_RING3
972	/*
973	* Should we defer the request right away?
974	*/
975	if (uErrorCode & X86_TRAP_PF_RW
976	? !pRange->CTXALLSUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3
977	: !pRange->CTXALLSUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
978	{
979	# ifdef VBOX_WITH_STATISTICS
980	if (uErrorCode & X86_TRAP_PF_RW)
981	STAM_COUNTER_INC(&pStats->CTXALLMID(Write,ToR3));
982	else
983	STAM_COUNTER_INC(&pStats->CTXALLMID(Read,ToR3));
984	# endif
985
986	STAM_PROFILE_STOP(&pVM->iom.s.StatGCMMIOHandler, a);
987	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIOFailures);
988	return uErrorCode & X86_TRAP_PF_RW ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
989	}
990	#endif /* !IN_RING3 */
991
992	/*
993	* Disassemble the instruction and interprete it.
994	*/
995	DISCPUSTATE Cpu;
996	unsigned cbOp;
997	int rc = EMInterpretDisasOne(pVM, pCtxCore, &Cpu, &cbOp);
998	AssertRCReturn(rc, rc);
999	switch (Cpu.pCurInstr->opcode)
1000	{
1001	case OP_MOV:
1002	case OP_MOVZX:
1003	case OP_MOVSX:
1004	{
1005	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMov, b);
1006	if (uErrorCode & X86_TRAP_PF_RW)
1007	rc = iomInterpretMOVxXWrite(pVM, pCtxCore, &Cpu, pRange, GCPhysFault);
1008	else
1009	rc = iomInterpretMOVxXRead(pVM, pCtxCore, &Cpu, pRange, GCPhysFault);
1010	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMov, b);
1011	break;
1012	}
1013
1014
1015	#ifdef iom_MOVS_SUPPORT
1016	case OP_MOVSB:
1017	case OP_MOVSWD:
1018	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovs, c);
1019	rc = iomInterpretMOVS(pVM, uErrorCode, pCtxCore, GCPhysFault, &Cpu, pRange);
1020	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovs, c);
1021	break;
1022	#endif
1023
1024	case OP_STOSB:
1025	case OP_STOSWD:
1026	Assert(uErrorCode & X86_TRAP_PF_RW);
1027	STAM_PROFILE_START(&pVM->iom.s.StatGCInstStos, d);
1028	rc = iomInterpretSTOS(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1029	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstStos, d);
1030	break;
1031
1032	case OP_LODSB:
1033	case OP_LODSWD:
1034	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1035	STAM_PROFILE_START(&pVM->iom.s.StatGCInstLods, e);
1036	rc = iomInterpretLODS(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1037	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstLods, e);
1038	break;
1039
1040	case OP_CMP:
1041	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1042	STAM_PROFILE_START(&pVM->iom.s.StatGCInstCmp, f);
1043	rc = iomInterpretCMP(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1044	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstCmp, f);
1045	break;
1046
1047	case OP_AND:
1048	STAM_PROFILE_START(&pVM->iom.s.StatGCInstAnd, g);
1049	rc = iomInterpretAND(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1050	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstAnd, g);
1051	break;
1052
1053	case OP_TEST:
1054	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1055	STAM_PROFILE_START(&pVM->iom.s.StatGCInstTest, h);
1056	rc = iomInterpretTEST(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1057	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstTest, h);
1058	break;
1059
1060	case OP_XCHG:
1061	STAM_PROFILE_START(&pVM->iom.s.StatGCInstXchg, i);
1062	rc = iomInterpretXCHG(pVM, pCtxCore, GCPhysFault, &Cpu, pRange);
1063	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstXchg, i);
1064	break;
1065
1066
1067	/*
1068	* The instruction isn't supported. Hand it on to ring-3.
1069	*/
1070	default:
1071	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstOther);
1072	rc = (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1073	break;
1074	}
1075
1076	/*
1077	* On success advance EIP.
1078	*/
1079	if (rc == VINF_SUCCESS)
1080	pCtxCore->eip += cbOp;
1081	else
1082	{
1083	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIOFailures);
1084	#if defined(VBOX_WITH_STATISTICS) && !defined(IN_RING3)
1085	switch (rc)
1086	{
1087	case VINF_IOM_HC_MMIO_READ:
1088	case VINF_IOM_HC_MMIO_READ_WRITE:
1089	STAM_COUNTER_INC(&pStats->CTXALLMID(Read,ToR3));
1090	break;
1091	case VINF_IOM_HC_MMIO_WRITE:
1092	STAM_COUNTER_INC(&pStats->CTXALLMID(Write,ToR3));
1093	break;
1094	}
1095	#endif
1096	}
1097
1098	STAM_PROFILE_STOP(&pVM->iom.s.StatGCMMIOHandler, a);
1099	return rc;
1100	}
1101
1102
1103	/**
1104	* Reads a MMIO register.
1105	*
1106	* @returns VBox status code.
1107	*
1108	* @param pVM VM handle.
1109	* @param GCPhys The physical address to read.
1110	* @param pu32Value Where to store the value read.
1111	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1112	*/
1113	IOMDECL(int) IOMMMIORead(PVM pVM, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue)
1114	{
1115	/*
1116	* Lookup the current context range node and statistics.
1117	*/
1118	PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1119	AssertMsgReturn(pRange,
1120	("Handlers and page tables are out of sync or something! GCPhys=%VGp cbValue=%d\n", GCPhys, cbValue),
1121	VERR_INTERNAL_ERROR);
1122	#ifdef VBOX_WITH_STATISTICS
1123	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1124	if (!pStats)
1125	# ifdef IN_RING3
1126	return VERR_NO_MEMORY;
1127	# else
1128	return VINF_IOM_HC_MMIO_READ;
1129	# endif
1130	#endif /* VBOX_WITH_STATISTICS */
1131	if (pRange->CTXALLSUFF(pfnReadCallback))
1132	{
1133	/*
1134	* Perform the read and deal with the result.
1135	*/
1136	#ifdef VBOX_WITH_STATISTICS
1137	if (pStats)
1138	STAM_PROFILE_ADV_START(&pStats->CTXALLSUFF(ProfRead), a);
1139	#endif
1140	int rc = pRange->CTXALLSUFF(pfnReadCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), GCPhys, pu32Value, cbValue);
1141	#ifdef VBOX_WITH_STATISTICS
1142	if (pStats)
1143	STAM_PROFILE_ADV_STOP(&pStats->CTXALLSUFF(ProfRead), a);
1144	if (pStats && rc != VINF_IOM_HC_MMIO_READ)
1145	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Read));
1146	#endif
1147	switch (rc)
1148	{
1149	case VINF_SUCCESS:
1150	default:
1151	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1152	return rc;
1153
1154	case VINF_IOM_MMIO_UNUSED_00:
1155	switch (cbValue)
1156	{
1157	case 1: (uint8_t )pu32Value = 0x00; break;
1158	case 2: (uint16_t )pu32Value = 0x0000; break;
1159	case 4: (uint32_t )pu32Value = 0x00000000; break;
1160	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%VGp\n", cbValue, GCPhys)); break;
1161	}
1162	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1163	return VINF_SUCCESS;
1164
1165	case VINF_IOM_MMIO_UNUSED_FF:
1166	switch (cbValue)
1167	{
1168	case 1: (uint8_t )pu32Value = 0xff; break;
1169	case 2: (uint16_t )pu32Value = 0xffff; break;
1170	case 4: (uint32_t )pu32Value = 0xffffffff; break;
1171	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%VGp\n", cbValue, GCPhys)); break;
1172	}
1173	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1174	return VINF_SUCCESS;
1175	}
1176	}
1177	#ifndef IN_RING3
1178	if (pRange->pfnReadCallbackR3)
1179	{
1180	STAM_COUNTER_INC(&pStats->CTXALLMID(Read,ToR3));
1181	return VINF_IOM_HC_MMIO_READ;
1182	}
1183	#endif
1184
1185	/*
1186	* Lookup the ring-3 range.
1187	*/
1188	#ifdef VBOX_WITH_STATISTICS
1189	if (pStats)
1190	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Read));
1191	#endif
1192	*pu32Value = 0;
1193	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1194	return VINF_SUCCESS;
1195	}
1196
1197
1198	/**
1199	* Writes to a MMIO register.
1200	*
1201	* @returns VBox status code.
1202	*
1203	* @param pVM VM handle.
1204	* @param GCPhys The physical address to write to.
1205	* @param u32Value The value to write.
1206	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1207	*/
1208	IOMDECL(int) IOMMMIOWrite(PVM pVM, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue)
1209	{
1210	/*
1211	* Lookup the current context range node.
1212	*/
1213	PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1214	AssertMsgReturn(pRange,
1215	("Handlers and page tables are out of sync or something! GCPhys=%VGp cbValue=%d\n", GCPhys, cbValue),
1216	VERR_INTERNAL_ERROR);
1217	#ifdef VBOX_WITH_STATISTICS
1218	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1219	if (!pStats)
1220	# ifdef IN_RING3
1221	return VERR_NO_MEMORY;
1222	# else
1223	return VINF_IOM_HC_MMIO_WRITE;
1224	# endif
1225	#endif /* VBOX_WITH_STATISTICS */
1226
1227	/*
1228	* Perform the write if there's a write handler. R0/GC may have
1229	* to defer it to ring-3.
1230	*/
1231	if (pRange->CTXALLSUFF(pfnWriteCallback))
1232	{
1233	#ifdef VBOX_WITH_STATISTICS
1234	if (pStats)
1235	STAM_PROFILE_ADV_START(&pStats->CTXALLSUFF(ProfWrite), a);
1236	#endif
1237	int rc = pRange->CTXALLSUFF(pfnWriteCallback)(pRange->CTXALLSUFF(pDevIns), pRange->CTXALLSUFF(pvUser), GCPhys, &u32Value, cbValue);
1238	#ifdef VBOX_WITH_STATISTICS
1239	if (pStats)
1240	STAM_PROFILE_ADV_STOP(&pStats->CTXALLSUFF(ProfWrite), a);
1241	if (pStats && rc != VINF_IOM_HC_MMIO_WRITE)
1242	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Write));
1243	#endif
1244	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, u32Value, cbValue, rc));
1245	return rc;
1246	}
1247	#ifndef IN_RING3
1248	if (pRange->pfnWriteCallbackR3)
1249	{
1250	STAM_COUNTER_INC(&pStats->CTXALLMID(Write,ToR3));
1251	return VINF_IOM_HC_MMIO_WRITE;
1252	}
1253	#endif
1254
1255	/*
1256	* No write handler, nothing to do.
1257	*/
1258	#ifdef VBOX_WITH_STATISTICS
1259	if (pStats)
1260	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Write));
1261	#endif
1262	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, u32Value, cbValue, VINF_SUCCESS));
1263	return VINF_SUCCESS;
1264	}
1265
1266
1267	/**
1268	* [REP*] INSB/INSW/INSD
1269	* ES:EDI,DX[,ECX]
1270	*
1271	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1272	*
1273	* @returns Strict VBox status code. Informational status codes other than the one documented
1274	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1275	* @retval VINF_SUCCESS Success.
1276	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1277	* status code must be passed on to EM.
1278	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1279	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1280	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1281	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1282	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1283	*
1284	* @param pVM The virtual machine (GC pointer ofcourse).
1285	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1286	* @param uPort IO Port
1287	* @param uPrefix IO instruction prefix
1288	* @param cbTransfer Size of transfer unit
1289	*/
1290	IOMDECL(int) IOMInterpretINSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1291	{
1292	#ifdef VBOX_WITH_STATISTICS
1293	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstIns);
1294	#endif
1295
1296	/*
1297	* We do not support REPNE or decrementing destination
1298	* pointer. Segment prefixes are deliberately ignored, as per the instruction specification.
1299	*/
1300	if ( (uPrefix & PREFIX_REPNE)
1301	\|\| pRegFrame->eflags.Bits.u1DF)
1302	return VINF_EM_RAW_EMULATE_INSTR;
1303
1304	/*
1305	* Get bytes/words/dwords count to transfer.
1306	*/
1307	RTGCUINTREG cTransfers = 1;
1308	if (uPrefix & PREFIX_REP)
1309	{
1310	cTransfers = pRegFrame->ecx;
1311
1312	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
1313	cTransfers &= 0xffff;
1314
1315	if (!cTransfers)
1316	return VINF_SUCCESS;
1317	}
1318
1319	/* Convert destination address es:edi. */
1320	RTGCPTR GCPtrDst;
1321	int rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->es, (RTGCPTR)pRegFrame->edi, &pRegFrame->esHid,
1322	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1323	&GCPtrDst, NULL);
1324	if (VBOX_FAILURE(rc))
1325	{
1326	Log(("INS destination address conversion failed -> fallback, rc=%d\n", rc));
1327	return VINF_EM_RAW_EMULATE_INSTR;
1328	}
1329
1330	/* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
1331	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1332
1333	rc = PGMVerifyAccess(pVM, (RTGCUINTPTR)GCPtrDst, cTransfers * cbTransfer,
1334	X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
1335	if (rc != VINF_SUCCESS)
1336	{
1337	Log(("INS will generate a trap -> fallback, rc=%d\n", rc));
1338	return VINF_EM_RAW_EMULATE_INSTR;
1339	}
1340
1341	Log(("IOM: rep ins%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1342	if (cTransfers > 1)
1343	{
1344	/* If the device supports string transfers, ask it to do as
1345	* much as it wants. The rest is done with single-word transfers. */
1346	const RTGCUINTREG cTransfersOrg = cTransfers;
1347	rc = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbTransfer);
1348	AssertRC(rc); Assert(cTransfers <= cTransfersOrg);
1349	pRegFrame->edi += (cTransfersOrg - cTransfers) * cbTransfer;
1350	}
1351
1352	#ifdef IN_GC
1353	MMGCRamRegisterTrapHandler(pVM);
1354	#endif
1355
1356	while (cTransfers && rc == VINF_SUCCESS)
1357	{
1358	uint32_t u32Value;
1359	rc = IOMIOPortRead(pVM, uPort, &u32Value, cbTransfer);
1360	if (!IOM_SUCCESS(rc))
1361	break;
1362	int rc2 = iomRamWrite(pVM, GCPtrDst, &u32Value, cbTransfer);
1363	Assert(rc2 == VINF_SUCCESS); NOREF(rc2);
1364	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbTransfer);
1365	pRegFrame->edi += cbTransfer;
1366	cTransfers--;
1367	}
1368	#ifdef IN_GC
1369	MMGCRamDeregisterTrapHandler(pVM);
1370	#endif
1371
1372	/* Update ecx on exit. */
1373	if (uPrefix & PREFIX_REP)
1374	pRegFrame->ecx = cTransfers;
1375
1376	AssertMsg(rc == VINF_SUCCESS \|\| rc == VINF_IOM_HC_IOPORT_READ \|\| (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST) \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1377	return rc;
1378	}
1379
1380
1381	/**
1382	* [REP*] INSB/INSW/INSD
1383	* ES:EDI,DX[,ECX]
1384	*
1385	* @returns Strict VBox status code. Informational status codes other than the one documented
1386	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1387	* @retval VINF_SUCCESS Success.
1388	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1389	* status code must be passed on to EM.
1390	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1391	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1392	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1393	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1394	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1395	*
1396	* @param pVM The virtual machine (GC pointer ofcourse).
1397	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1398	* @param pCpu Disassembler CPU state.
1399	*/
1400	IOMDECL(int) IOMInterpretINS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1401	{
1402	/*
1403	* Get port number directly from the register (no need to bother the
1404	* disassembler). And get the I/O register size from the opcode / prefix.
1405	*/
1406	RTIOPORT Port = pRegFrame->edx & 0xffff;
1407	unsigned cb = 0;
1408	if (pCpu->pCurInstr->opcode == OP_INSB)
1409	cb = 1;
1410	else
1411	cb = pCpu->opmode == CPUMODE_32BIT ? 4 : 2;
1412
1413	int rc = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1414	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1415	{
1416	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1417	return rc;
1418	}
1419
1420	return IOMInterpretINSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1421	}
1422
1423
1424	/**
1425	* [REP*] OUTSB/OUTSW/OUTSD
1426	* DS:ESI,DX[,ECX]
1427	*
1428	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1429	*
1430	* @returns Strict VBox status code. Informational status codes other than the one documented
1431	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1432	* @retval VINF_SUCCESS Success.
1433	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1434	* status code must be passed on to EM.
1435	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1436	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1437	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1438	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1439	*
1440	* @param pVM The virtual machine (GC pointer ofcourse).
1441	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1442	* @param uPort IO Port
1443	* @param uPrefix IO instruction prefix
1444	* @param cbTransfer Size of transfer unit
1445	*/
1446	IOMDECL(int) IOMInterpretOUTSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1447	{
1448	#ifdef VBOX_WITH_STATISTICS
1449	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstOuts);
1450	#endif
1451
1452	/*
1453	* We do not support segment prefixes, REPNE or
1454	* decrementing source pointer.
1455	*/
1456	if ( (uPrefix & (PREFIX_SEG \| PREFIX_REPNE))
1457	\|\| pRegFrame->eflags.Bits.u1DF)
1458	return VINF_EM_RAW_EMULATE_INSTR;
1459
1460	/*
1461	* Get bytes/words/dwords count to transfer.
1462	*/
1463	RTGCUINTREG cTransfers = 1;
1464	if (uPrefix & PREFIX_REP)
1465	{
1466	cTransfers = pRegFrame->ecx;
1467	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
1468	cTransfers &= 0xffff;
1469
1470	if (!cTransfers)
1471	return VINF_SUCCESS;
1472	}
1473
1474	/* Convert source address ds:esi. */
1475	RTGCPTR GCPtrSrc;
1476	int rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->ds, (RTGCPTR)pRegFrame->esi, &pRegFrame->dsHid,
1477	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1478	&GCPtrSrc, NULL);
1479	if (VBOX_FAILURE(rc))
1480	{
1481	Log(("OUTS source address conversion failed -> fallback, rc=%Vrc\n", rc));
1482	return VINF_EM_RAW_EMULATE_INSTR;
1483	}
1484
1485	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1486	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1487	rc = PGMVerifyAccess(pVM, (RTGCUINTPTR)GCPtrSrc, cTransfers * cbTransfer,
1488	(cpl == 3) ? X86_PTE_US : 0);
1489	if (rc != VINF_SUCCESS)
1490	{
1491	Log(("OUTS will generate a trap -> fallback, rc=%Vrc\n", rc));
1492	return VINF_EM_RAW_EMULATE_INSTR;
1493	}
1494
1495	Log(("IOM: rep outs%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1496	if (cTransfers > 1)
1497	{
1498	/*
1499	* If the device supports string transfers, ask it to do as
1500	* much as it wants. The rest is done with single-word transfers.
1501	*/
1502	const RTGCUINTREG cTransfersOrg = cTransfers;
1503	rc = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbTransfer);
1504	AssertRC(rc); Assert(cTransfers <= cTransfersOrg);
1505	pRegFrame->esi += (cTransfersOrg - cTransfers) * cbTransfer;
1506	}
1507
1508	#ifdef IN_GC
1509	MMGCRamRegisterTrapHandler(pVM);
1510	#endif
1511
1512	while (cTransfers && rc == VINF_SUCCESS)
1513	{
1514	uint32_t u32Value;
1515	rc = iomRamRead(pVM, &u32Value, GCPtrSrc, cbTransfer);
1516	if (rc != VINF_SUCCESS)
1517	break;
1518	rc = IOMIOPortWrite(pVM, uPort, u32Value, cbTransfer);
1519	if (!IOM_SUCCESS(rc))
1520	break;
1521	GCPtrSrc = (RTGCPTR)((RTUINTPTR)GCPtrSrc + cbTransfer);
1522	pRegFrame->esi += cbTransfer;
1523	cTransfers--;
1524	}
1525
1526	#ifdef IN_GC
1527	MMGCRamDeregisterTrapHandler(pVM);
1528	#endif
1529
1530	/* Update ecx on exit. */
1531	if (uPrefix & PREFIX_REP)
1532	pRegFrame->ecx = cTransfers;
1533
1534	AssertMsg(rc == VINF_SUCCESS \|\| rc == VINF_IOM_HC_IOPORT_WRITE \|\| (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST) \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1535	return rc;
1536	}
1537
1538
1539	/**
1540	* [REP*] OUTSB/OUTSW/OUTSD
1541	* DS:ESI,DX[,ECX]
1542	*
1543	* @returns Strict VBox status code. Informational status codes other than the one documented
1544	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1545	* @retval VINF_SUCCESS Success.
1546	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1547	* status code must be passed on to EM.
1548	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1549	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the write to the REM.
1550	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1551	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1552	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1553	*
1554	* @param pVM The virtual machine (GC pointer ofcourse).
1555	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1556	* @param pCpu Disassembler CPU state.
1557	*/
1558	IOMDECL(int) IOMInterpretOUTS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1559	{
1560	/*
1561	* Get port number from the first parameter.
1562	* And get the I/O register size from the opcode / prefix.
1563	*/
1564	uint32_t Port = 0;
1565	unsigned cb = 0;
1566	bool fRc = iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &Port, &cb);
1567	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
1568	if (pCpu->pCurInstr->opcode == OP_OUTSB)
1569	cb = 1;
1570	else
1571	cb = (pCpu->opmode == CPUMODE_32BIT) ? 4 : 2;
1572
1573	int rc = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1574	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1575	{
1576	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1577	return rc;
1578	}
1579
1580	return IOMInterpretOUTSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1581	}
1582

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp@ 9248

Download in other formats: