VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp@ 83349

Last change on this file since 83349 was 82968, checked in by vboxsync, 5 years ago

Copyright year updates by scm.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 50.5 KB
Line 
1/* $Id: IOMAllMmioNew.cpp 82968 2020-02-04 10:35:17Z vboxsync $ */
2/** @file
3 * IOM - Input / Output Monitor - Any Context, MMIO & String I/O.
4 */
5
6/*
7 * Copyright (C) 2006-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_IOM_MMIO
23#define VMCPU_INCL_CPUM_GST_CTX
24#include <VBox/vmm/iom.h>
25#include <VBox/vmm/cpum.h>
26#include <VBox/vmm/pgm.h>
27#include <VBox/vmm/selm.h>
28#include <VBox/vmm/mm.h>
29#include <VBox/vmm/em.h>
30#include <VBox/vmm/pgm.h>
31#include <VBox/vmm/trpm.h>
32#include <VBox/vmm/iem.h>
33#include "IOMInternal.h"
34#include <VBox/vmm/vmcc.h>
35#include <VBox/vmm/vmm.h>
36#include <VBox/vmm/hm.h>
37#include "IOMInline.h"
38
39#include <VBox/dis.h>
40#include <VBox/disopcode.h>
41#include <VBox/vmm/pdmdev.h>
42#include <VBox/param.h>
43#include <VBox/err.h>
44#include <iprt/assert.h>
45#include <VBox/log.h>
46#include <iprt/asm.h>
47#include <iprt/string.h>
48
49
50/*********************************************************************************************************************************
51* Defined Constants And Macros *
52*********************************************************************************************************************************/
53/** @def IOM_MMIO_STATS_COMMA_DECL
54 * Parameter list declaration for statistics entry pointer. */
55/** @def IOM_MMIO_STATS_COMMA_ARG
56 * Statistics entry pointer argument. */
57#if defined(VBOX_WITH_STATISTICS) || defined(DOXYGEN_RUNNING)
58# define IOM_MMIO_STATS_COMMA_DECL , PIOMMMIOSTATSENTRY pStats
59# define IOM_MMIO_STATS_COMMA_ARG , pStats
60#else
61# define IOM_MMIO_STATS_COMMA_DECL
62# define IOM_MMIO_STATS_COMMA_ARG
63#endif
64
65
66
67#ifndef IN_RING3
68/**
69 * Defers a pending MMIO write to ring-3.
70 *
71 * @returns VINF_IOM_R3_MMIO_COMMIT_WRITE
72 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
73 * @param GCPhys The write address.
74 * @param pvBuf The bytes being written.
75 * @param cbBuf How many bytes.
76 * @param idxRegEntry The MMIO registration index (handle) if available,
77 * otherwise UINT32_MAX.
78 */
79static VBOXSTRICTRC iomMmioRing3WritePending(PVMCPU pVCpu, RTGCPHYS GCPhys, void const *pvBuf, size_t cbBuf,
80 uint32_t idxRegEntry)
81{
82 Log5(("iomMmioRing3WritePending: %RGp LB %#x (idx=%#x)\n", GCPhys, cbBuf, idxRegEntry));
83 if (pVCpu->iom.s.PendingMmioWrite.cbValue == 0)
84 {
85 pVCpu->iom.s.PendingMmioWrite.GCPhys = GCPhys;
86 AssertReturn(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue), VERR_IOM_MMIO_IPE_2);
87 pVCpu->iom.s.PendingMmioWrite.cbValue = (uint32_t)cbBuf;
88 pVCpu->iom.s.PendingMmioWrite.idxMmioRegionHint = idxRegEntry;
89 memcpy(pVCpu->iom.s.PendingMmioWrite.abValue, pvBuf, cbBuf);
90 }
91 else
92 {
93 /*
94 * Join with pending if adjecent.
95 *
96 * This may happen if the stack overflows into MMIO territory and RSP/ESP/SP
97 * isn't aligned. IEM will bounce buffer the access and do one write for each
98 * page. We get here when the 2nd page part is written.
99 */
100 uint32_t const cbOldValue = pVCpu->iom.s.PendingMmioWrite.cbValue;
101 AssertMsgReturn(GCPhys == pVCpu->iom.s.PendingMmioWrite.GCPhys + cbOldValue,
102 ("pending %RGp LB %#x; incoming %RGp LB %#x\n",
103 pVCpu->iom.s.PendingMmioWrite.GCPhys, cbOldValue, GCPhys, cbBuf),
104 VERR_IOM_MMIO_IPE_1);
105 AssertReturn(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue) - cbOldValue, VERR_IOM_MMIO_IPE_2);
106 pVCpu->iom.s.PendingMmioWrite.cbValue = cbOldValue + (uint32_t)cbBuf;
107 memcpy(&pVCpu->iom.s.PendingMmioWrite.abValue[cbOldValue], pvBuf, cbBuf);
108 }
109
110 VMCPU_FF_SET(pVCpu, VMCPU_FF_IOM);
111 return VINF_IOM_R3_MMIO_COMMIT_WRITE;
112}
113#endif
114
115
116/**
117 * Deals with complicated MMIO writes.
118 *
119 * Complicated means unaligned or non-dword/qword sized accesses depending on
120 * the MMIO region's access mode flags.
121 *
122 * @returns Strict VBox status code. Any EM scheduling status code,
123 * VINF_IOM_R3_MMIO_WRITE, VINF_IOM_R3_MMIO_READ_WRITE or
124 * VINF_IOM_R3_MMIO_READ may be returned.
125 *
126 * @param pVM The cross context VM structure.
127 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
128 * @param pRegEntry The MMIO entry for the current context.
129 * @param GCPhys The physical address to start writing.
130 * @param offRegion MMIO region offset corresponding to @a GCPhys.
131 * @param pvValue Where to store the value.
132 * @param cbValue The size of the value to write.
133 * @param pStats Pointer to the statistics (never NULL).
134 */
135static VBOXSTRICTRC iomMmioDoComplicatedWrite(PVM pVM, PVMCPU pVCpu, CTX_SUFF(PIOMMMIOENTRY) pRegEntry,
136 RTGCPHYS GCPhys, RTGCPHYS offRegion,
137 void const *pvValue, unsigned cbValue IOM_MMIO_STATS_COMMA_DECL)
138{
139 AssertReturn( (pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) != IOMMMIO_FLAGS_WRITE_PASSTHRU
140 && (pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) <= IOMMMIO_FLAGS_WRITE_DWORD_QWORD_READ_MISSING,
141 VERR_IOM_MMIO_IPE_1);
142 AssertReturn(cbValue != 0 && cbValue <= 16, VERR_IOM_MMIO_IPE_2);
143 RTGCPHYS const GCPhysStart = GCPhys; NOREF(GCPhysStart);
144 bool const fReadMissing = (pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_DWORD_READ_MISSING
145 || (pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_DWORD_QWORD_READ_MISSING;
146 RT_NOREF_PV(pVCpu); /* ring-3 */
147
148 /*
149 * Do debug stop if requested.
150 */
151 VBOXSTRICTRC rc = VINF_SUCCESS; NOREF(pVM);
152#ifdef VBOX_STRICT
153 if (!(pRegEntry->fFlags & IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_WRITE))
154 { /* likely */ }
155 else
156 {
157# ifdef IN_RING3
158 LogRel(("IOM: Complicated write %#x byte at %RGp to %s, initiating debugger intervention\n", cbValue, GCPhys,
159 R3STRING(pRegEntry->pszDesc)));
160 rc = DBGFR3EventSrc(pVM, DBGFEVENT_DEV_STOP, RT_SRC_POS,
161 "Complicated write %#x byte at %RGp to %s\n", cbValue, GCPhys, pRegEntry->pszDesc);
162 if (rc == VERR_DBGF_NOT_ATTACHED)
163 rc = VINF_SUCCESS;
164# else
165 return VINF_IOM_R3_MMIO_WRITE;
166# endif
167 }
168#endif
169
170 STAM_COUNTER_INC(&pStats->ComplicatedWrites);
171
172 /*
173 * Check if we should ignore the write.
174 */
175 if ((pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_ONLY_DWORD)
176 {
177 Assert(cbValue != 4 || (GCPhys & 3));
178 return VINF_SUCCESS;
179 }
180 if ((pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_ONLY_DWORD_QWORD)
181 {
182 Assert((cbValue != 4 && cbValue != 8) || (GCPhys & (cbValue - 1)));
183 return VINF_SUCCESS;
184 }
185
186 /*
187 * Split and conquer.
188 */
189 for (;;)
190 {
191 unsigned const offAccess = GCPhys & 3;
192 unsigned cbThisPart = 4 - offAccess;
193 if (cbThisPart > cbValue)
194 cbThisPart = cbValue;
195
196 /*
197 * Get the missing bits (if any).
198 */
199 uint32_t u32MissingValue = 0;
200 if (fReadMissing && cbThisPart != 4)
201 {
202 VBOXSTRICTRC rc2 = pRegEntry->pfnReadCallback(pRegEntry->pDevIns, pRegEntry->pvUser,
203 !(pRegEntry->fFlags & IOMMMIO_FLAGS_ABS)
204 ? offRegion & ~(RTGCPHYS)3 : (GCPhys & ~(RTGCPHYS)3),
205 &u32MissingValue, sizeof(u32MissingValue));
206 switch (VBOXSTRICTRC_VAL(rc2))
207 {
208 case VINF_SUCCESS:
209 break;
210 case VINF_IOM_MMIO_UNUSED_FF:
211 STAM_COUNTER_INC(&pStats->FFor00Reads);
212 u32MissingValue = UINT32_C(0xffffffff);
213 break;
214 case VINF_IOM_MMIO_UNUSED_00:
215 STAM_COUNTER_INC(&pStats->FFor00Reads);
216 u32MissingValue = 0;
217 break;
218#ifndef IN_RING3
219 case VINF_IOM_R3_MMIO_READ:
220 case VINF_IOM_R3_MMIO_READ_WRITE:
221 case VINF_IOM_R3_MMIO_WRITE:
222 LogFlow(("iomMmioDoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rc2)));
223 rc2 = iomMmioRing3WritePending(pVCpu, GCPhys, pvValue, cbValue, pRegEntry->idxSelf);
224 if (rc == VINF_SUCCESS || rc2 < rc)
225 rc = rc2;
226 return rc;
227#endif
228 default:
229 if (RT_FAILURE(rc2))
230 {
231 Log(("iomMmioDoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [read]\n", GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rc2)));
232 return rc2;
233 }
234 AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", VBOXSTRICTRC_VAL(rc2)), VERR_IPE_UNEXPECTED_INFO_STATUS);
235 if (rc == VINF_SUCCESS || rc2 < rc)
236 rc = rc2;
237 break;
238 }
239 }
240
241 /*
242 * Merge missing and given bits.
243 */
244 uint32_t u32GivenMask;
245 uint32_t u32GivenValue;
246 switch (cbThisPart)
247 {
248 case 1:
249 u32GivenValue = *(uint8_t const *)pvValue;
250 u32GivenMask = UINT32_C(0x000000ff);
251 break;
252 case 2:
253 u32GivenValue = *(uint16_t const *)pvValue;
254 u32GivenMask = UINT32_C(0x0000ffff);
255 break;
256 case 3:
257 u32GivenValue = RT_MAKE_U32_FROM_U8(((uint8_t const *)pvValue)[0], ((uint8_t const *)pvValue)[1],
258 ((uint8_t const *)pvValue)[2], 0);
259 u32GivenMask = UINT32_C(0x00ffffff);
260 break;
261 case 4:
262 u32GivenValue = *(uint32_t const *)pvValue;
263 u32GivenMask = UINT32_C(0xffffffff);
264 break;
265 default:
266 AssertFailedReturn(VERR_IOM_MMIO_IPE_3);
267 }
268 if (offAccess)
269 {
270 u32GivenValue <<= offAccess * 8;
271 u32GivenMask <<= offAccess * 8;
272 }
273
274 uint32_t u32Value = (u32MissingValue & ~u32GivenMask)
275 | (u32GivenValue & u32GivenMask);
276
277 /*
278 * Do DWORD write to the device.
279 */
280 VBOXSTRICTRC rc2 = pRegEntry->pfnWriteCallback(pRegEntry->pDevIns, pRegEntry->pvUser,
281 !(pRegEntry->fFlags & IOMMMIO_FLAGS_ABS)
282 ? offRegion & ~(RTGCPHYS)3 : GCPhys & ~(RTGCPHYS)3,
283 &u32Value, sizeof(u32Value));
284 switch (VBOXSTRICTRC_VAL(rc2))
285 {
286 case VINF_SUCCESS:
287 break;
288#ifndef IN_RING3
289 case VINF_IOM_R3_MMIO_READ:
290 case VINF_IOM_R3_MMIO_READ_WRITE:
291 case VINF_IOM_R3_MMIO_WRITE:
292 Log3(("iomMmioDoComplicatedWrite: deferring GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rc2)));
293 AssertReturn(pVCpu->iom.s.PendingMmioWrite.cbValue == 0, VERR_IOM_MMIO_IPE_1);
294 AssertReturn(cbValue + (GCPhys & 3) <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue), VERR_IOM_MMIO_IPE_2);
295 pVCpu->iom.s.PendingMmioWrite.GCPhys = GCPhys & ~(RTGCPHYS)3;
296 pVCpu->iom.s.PendingMmioWrite.cbValue = cbValue + (GCPhys & 3);
297 *(uint32_t *)pVCpu->iom.s.PendingMmioWrite.abValue = u32Value;
298 if (cbValue > cbThisPart)
299 memcpy(&pVCpu->iom.s.PendingMmioWrite.abValue[4],
300 (uint8_t const *)pvValue + cbThisPart, cbValue - cbThisPart);
301 VMCPU_FF_SET(pVCpu, VMCPU_FF_IOM);
302 if (rc == VINF_SUCCESS)
303 rc = VINF_IOM_R3_MMIO_COMMIT_WRITE;
304 return rc;
305#endif
306 default:
307 if (RT_FAILURE(rc2))
308 {
309 Log(("iomMmioDoComplicatedWrite: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rc=%Rrc [write]\n", GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rc2)));
310 return rc2;
311 }
312 AssertMsgReturn(rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST, ("%Rrc\n", VBOXSTRICTRC_VAL(rc2)), VERR_IPE_UNEXPECTED_INFO_STATUS);
313 if (rc == VINF_SUCCESS || rc2 < rc)
314 rc = rc2;
315 break;
316 }
317
318 /*
319 * Advance.
320 */
321 cbValue -= cbThisPart;
322 if (!cbValue)
323 break;
324 GCPhys += cbThisPart;
325 offRegion += cbThisPart;
326 pvValue = (uint8_t const *)pvValue + cbThisPart;
327 }
328
329 return rc;
330}
331
332
333
334
335/**
336 * Wrapper which does the write.
337 */
338DECLINLINE(VBOXSTRICTRC) iomMmioDoWrite(PVMCC pVM, PVMCPU pVCpu, CTX_SUFF(PIOMMMIOENTRY) pRegEntry,
339 RTGCPHYS GCPhys, RTGCPHYS offRegion,
340 const void *pvData, uint32_t cb IOM_MMIO_STATS_COMMA_DECL)
341{
342 VBOXSTRICTRC rcStrict;
343 if (RT_LIKELY(pRegEntry->pfnWriteCallback))
344 {
345 if ( (cb == 4 && !(GCPhys & 3))
346 || (pRegEntry->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_PASSTHRU
347 || (cb == 8 && !(GCPhys & 7) && IOMMMIO_DOES_WRITE_MODE_ALLOW_QWORD(pRegEntry->fFlags)) )
348 rcStrict = pRegEntry->pfnWriteCallback(pRegEntry->pDevIns, pRegEntry->pvUser,
349 !(pRegEntry->fFlags & IOMMMIO_FLAGS_ABS) ? offRegion : GCPhys, pvData, cb);
350 else
351 rcStrict = iomMmioDoComplicatedWrite(pVM, pVCpu, pRegEntry, GCPhys, offRegion, pvData, cb IOM_MMIO_STATS_COMMA_ARG);
352 }
353 else
354 rcStrict = VINF_SUCCESS;
355 return rcStrict;
356}
357
358
359#ifdef IN_RING3
360/**
361 * Helper for IOMR3ProcessForceFlag() that lives here to utilize iomMmioDoWrite et al.
362 */
363VBOXSTRICTRC iomR3MmioCommitWorker(PVM pVM, PVMCPU pVCpu, PIOMMMIOENTRYR3 pRegEntry, RTGCPHYS offRegion)
364{
365# ifdef VBOX_WITH_STATISTICS
366 STAM_PROFILE_START(UnusedMacroArg, Prf);
367 PIOMMMIOSTATSENTRY const pStats = iomMmioGetStats(pVM, pRegEntry);
368# endif
369 PPDMDEVINS const pDevIns = pRegEntry->pDevIns;
370 int rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VERR_IGNORED);
371 AssertRCReturn(rc, rc);
372
373 VBOXSTRICTRC rcStrict = iomMmioDoWrite(pVM, pVCpu, pRegEntry, pVCpu->iom.s.PendingMmioWrite.GCPhys, offRegion,
374 pVCpu->iom.s.PendingMmioWrite.abValue, pVCpu->iom.s.PendingMmioWrite.cbValue
375 IOM_MMIO_STATS_COMMA_ARG);
376
377 PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
378 STAM_PROFILE_STOP(&pStats->ProfWriteR3, Prf);
379 return rcStrict;
380}
381#endif /* IN_RING3 */
382
383
384/**
385 * Deals with complicated MMIO reads.
386 *
387 * Complicated means unaligned or non-dword/qword sized accesses depending on
388 * the MMIO region's access mode flags.
389 *
390 * @returns Strict VBox status code. Any EM scheduling status code,
391 * VINF_IOM_R3_MMIO_READ, VINF_IOM_R3_MMIO_READ_WRITE or
392 * VINF_IOM_R3_MMIO_WRITE may be returned.
393 *
394 * @param pVM The cross context VM structure.
395 * @param pRegEntry The MMIO entry for the current context.
396 * @param GCPhys The physical address to start reading.
397 * @param offRegion MMIO region offset corresponding to @a GCPhys.
398 * @param pvValue Where to store the value.
399 * @param cbValue The size of the value to read.
400 * @param pStats Pointer to the statistics (never NULL).
401 */
402static VBOXSTRICTRC iomMMIODoComplicatedRead(PVM pVM, CTX_SUFF(PIOMMMIOENTRY) pRegEntry, RTGCPHYS GCPhys, RTGCPHYS offRegion,
403 void *pvValue, unsigned cbValue IOM_MMIO_STATS_COMMA_DECL)
404{
405 AssertReturn( (pRegEntry->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD
406 || (pRegEntry->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD,
407 VERR_IOM_MMIO_IPE_1);
408 AssertReturn(cbValue != 0 && cbValue <= 16, VERR_IOM_MMIO_IPE_2);
409#ifdef LOG_ENABLED
410 RTGCPHYS const GCPhysStart = GCPhys;
411#endif
412
413 /*
414 * Do debug stop if requested.
415 */
416 VBOXSTRICTRC rc = VINF_SUCCESS; NOREF(pVM);
417#ifdef VBOX_STRICT
418 if (pRegEntry->fFlags & IOMMMIO_FLAGS_DBGSTOP_ON_COMPLICATED_READ)
419 {
420# ifdef IN_RING3
421 rc = DBGFR3EventSrc(pVM, DBGFEVENT_DEV_STOP, RT_SRC_POS,
422 "Complicated read %#x byte at %RGp to %s\n", cbValue, GCPhys, R3STRING(pRegEntry->pszDesc));
423 if (rc == VERR_DBGF_NOT_ATTACHED)
424 rc = VINF_SUCCESS;
425# else
426 return VINF_IOM_R3_MMIO_READ;
427# endif
428 }
429#endif
430
431 STAM_COUNTER_INC(&pStats->ComplicatedReads);
432
433 /*
434 * Split and conquer.
435 */
436 for (;;)
437 {
438 /*
439 * Do DWORD read from the device.
440 */
441 uint32_t u32Value;
442 VBOXSTRICTRC rcStrict2 = pRegEntry->pfnReadCallback(pRegEntry->pDevIns, pRegEntry->pvUser,
443 !(pRegEntry->fFlags & IOMMMIO_FLAGS_ABS)
444 ? offRegion & ~(RTGCPHYS)3 : GCPhys & ~(RTGCPHYS)3,
445 &u32Value, sizeof(u32Value));
446 switch (VBOXSTRICTRC_VAL(rcStrict2))
447 {
448 case VINF_SUCCESS:
449 break;
450 case VINF_IOM_MMIO_UNUSED_FF:
451 STAM_COUNTER_INC(&pStats->FFor00Reads);
452 u32Value = UINT32_C(0xffffffff);
453 break;
454 case VINF_IOM_MMIO_UNUSED_00:
455 STAM_COUNTER_INC(&pStats->FFor00Reads);
456 u32Value = 0;
457 break;
458 case VINF_IOM_R3_MMIO_READ:
459 case VINF_IOM_R3_MMIO_READ_WRITE:
460 case VINF_IOM_R3_MMIO_WRITE:
461 /** @todo What if we've split a transfer and already read
462 * something? Since reads can have sideeffects we could be
463 * kind of screwed here... */
464 LogFlow(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rcStrict2=%Rrc\n",
465 GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rcStrict2)));
466 return rcStrict2;
467 default:
468 if (RT_FAILURE(rcStrict2))
469 {
470 Log(("iomMMIODoComplicatedRead: GCPhys=%RGp GCPhysStart=%RGp cbValue=%u rcStrict2=%Rrc\n",
471 GCPhys, GCPhysStart, cbValue, VBOXSTRICTRC_VAL(rcStrict2)));
472 return rcStrict2;
473 }
474 AssertMsgReturn(rcStrict2 >= VINF_EM_FIRST && rcStrict2 <= VINF_EM_LAST, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)),
475 VERR_IPE_UNEXPECTED_INFO_STATUS);
476 if (rc == VINF_SUCCESS || rcStrict2 < rc)
477 rc = rcStrict2;
478 break;
479 }
480 u32Value >>= (GCPhys & 3) * 8;
481
482 /*
483 * Write what we've read.
484 */
485 unsigned cbThisPart = 4 - (GCPhys & 3);
486 if (cbThisPart > cbValue)
487 cbThisPart = cbValue;
488
489 switch (cbThisPart)
490 {
491 case 1:
492 *(uint8_t *)pvValue = (uint8_t)u32Value;
493 break;
494 case 2:
495 *(uint16_t *)pvValue = (uint16_t)u32Value;
496 break;
497 case 3:
498 ((uint8_t *)pvValue)[0] = RT_BYTE1(u32Value);
499 ((uint8_t *)pvValue)[1] = RT_BYTE2(u32Value);
500 ((uint8_t *)pvValue)[2] = RT_BYTE3(u32Value);
501 break;
502 case 4:
503 *(uint32_t *)pvValue = u32Value;
504 break;
505 }
506
507 /*
508 * Advance.
509 */
510 cbValue -= cbThisPart;
511 if (!cbValue)
512 break;
513 GCPhys += cbThisPart;
514 offRegion += cbThisPart;
515 pvValue = (uint8_t *)pvValue + cbThisPart;
516 }
517
518 return rc;
519}
520
521
522/**
523 * Implements VINF_IOM_MMIO_UNUSED_FF.
524 *
525 * @returns VINF_SUCCESS.
526 * @param pvValue Where to store the zeros.
527 * @param cbValue How many bytes to read.
528 * @param pStats Pointer to the statistics (never NULL).
529 */
530static int iomMMIODoReadFFs(void *pvValue, size_t cbValue IOM_MMIO_STATS_COMMA_DECL)
531{
532 switch (cbValue)
533 {
534 case 1: *(uint8_t *)pvValue = UINT8_C(0xff); break;
535 case 2: *(uint16_t *)pvValue = UINT16_C(0xffff); break;
536 case 4: *(uint32_t *)pvValue = UINT32_C(0xffffffff); break;
537 case 8: *(uint64_t *)pvValue = UINT64_C(0xffffffffffffffff); break;
538 default:
539 {
540 uint8_t *pb = (uint8_t *)pvValue;
541 while (cbValue--)
542 *pb++ = UINT8_C(0xff);
543 break;
544 }
545 }
546 STAM_COUNTER_INC(&pStats->FFor00Reads);
547 return VINF_SUCCESS;
548}
549
550
551/**
552 * Implements VINF_IOM_MMIO_UNUSED_00.
553 *
554 * @returns VINF_SUCCESS.
555 * @param pvValue Where to store the zeros.
556 * @param cbValue How many bytes to read.
557 * @param pStats Pointer to the statistics (never NULL).
558 */
559static int iomMMIODoRead00s(void *pvValue, size_t cbValue IOM_MMIO_STATS_COMMA_DECL)
560{
561 switch (cbValue)
562 {
563 case 1: *(uint8_t *)pvValue = UINT8_C(0x00); break;
564 case 2: *(uint16_t *)pvValue = UINT16_C(0x0000); break;
565 case 4: *(uint32_t *)pvValue = UINT32_C(0x00000000); break;
566 case 8: *(uint64_t *)pvValue = UINT64_C(0x0000000000000000); break;
567 default:
568 {
569 uint8_t *pb = (uint8_t *)pvValue;
570 while (cbValue--)
571 *pb++ = UINT8_C(0x00);
572 break;
573 }
574 }
575 STAM_COUNTER_INC(&pStats->FFor00Reads);
576 return VINF_SUCCESS;
577}
578
579
580/**
581 * Wrapper which does the read.
582 */
583DECLINLINE(VBOXSTRICTRC) iomMmioDoRead(PVMCC pVM, CTX_SUFF(PIOMMMIOENTRY) pRegEntry, RTGCPHYS GCPhys, RTGCPHYS offRegion,
584 void *pvValue, uint32_t cbValue IOM_MMIO_STATS_COMMA_DECL)
585{
586 VBOXSTRICTRC rcStrict;
587 if (RT_LIKELY(pRegEntry->pfnReadCallback))
588 {
589 if ( ( cbValue == 4
590 && !(GCPhys & 3))
591 || (pRegEntry->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_PASSTHRU
592 || ( cbValue == 8
593 && !(GCPhys & 7)
594 && (pRegEntry->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD ) )
595 rcStrict = pRegEntry->pfnReadCallback(pRegEntry->pDevIns, pRegEntry->pvUser,
596 !(pRegEntry->fFlags & IOMMMIO_FLAGS_ABS) ? offRegion : GCPhys, pvValue, cbValue);
597 else
598 rcStrict = iomMMIODoComplicatedRead(pVM, pRegEntry, GCPhys, offRegion, pvValue, cbValue IOM_MMIO_STATS_COMMA_ARG);
599 }
600 else
601 rcStrict = VINF_IOM_MMIO_UNUSED_FF;
602 if (rcStrict != VINF_SUCCESS)
603 {
604 switch (VBOXSTRICTRC_VAL(rcStrict))
605 {
606 case VINF_IOM_MMIO_UNUSED_FF: rcStrict = iomMMIODoReadFFs(pvValue, cbValue IOM_MMIO_STATS_COMMA_ARG); break;
607 case VINF_IOM_MMIO_UNUSED_00: rcStrict = iomMMIODoRead00s(pvValue, cbValue IOM_MMIO_STATS_COMMA_ARG); break;
608 }
609 }
610 return rcStrict;
611}
612
613#ifndef IN_RING3
614
615/**
616 * Checks if we can handle an MMIO \#PF in R0/RC.
617 */
618DECLINLINE(bool) iomMmioCanHandlePfInRZ(PVMCC pVM, uint32_t uErrorCode, CTX_SUFF(PIOMMMIOENTRY) pRegEntry)
619{
620 if (pRegEntry->cbRegion > 0)
621 {
622 if ( pRegEntry->pfnWriteCallback
623 && pRegEntry->pfnReadCallback)
624 return true;
625
626 PIOMMMIOENTRYR3 const pRegEntryR3 = &pVM->iomr0.s.paMmioRing3Regs[pRegEntry->idxSelf];
627 if ( uErrorCode == UINT32_MAX
628 ? pRegEntryR3->pfnWriteCallback || pRegEntryR3->pfnReadCallback
629 : uErrorCode & X86_TRAP_PF_RW
630 ? !pRegEntry->pfnWriteCallback && pRegEntryR3->pfnWriteCallback
631 : !pRegEntry->pfnReadCallback && pRegEntryR3->pfnReadCallback)
632 return false;
633
634 return true;
635 }
636 return false;
637}
638
639
640/**
641 * Common worker for the \#PF handler and IOMMMIOPhysHandler (APIC+VT-x).
642 *
643 * @returns VBox status code (appropriate for GC return).
644 * @param pVM The cross context VM structure.
645 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
646 * @param uErrorCode CPU Error code. This is UINT32_MAX when we don't have
647 * any error code (the EPT misconfig hack).
648 * @param GCPhysFault The GC physical address corresponding to pvFault.
649 * @param pRegEntry The MMIO entry for the current context.
650 */
651DECLINLINE(VBOXSTRICTRC) iomMmioCommonPfHandlerNew(PVMCC pVM, PVMCPUCC pVCpu, uint32_t uErrorCode,
652 RTGCPHYS GCPhysFault, CTX_SUFF(PIOMMMIOENTRY) pRegEntry)
653{
654 Log(("iomMmioCommonPfHandler: GCPhysFault=%RGp uErr=%#x rip=%RGv\n", GCPhysFault, uErrorCode, CPUMGetGuestRIP(pVCpu) ));
655 RT_NOREF(GCPhysFault, uErrorCode);
656
657 VBOXSTRICTRC rcStrict;
658
659#ifndef IN_RING3
660 /*
661 * Should we defer the request right away? This isn't usually the case, so
662 * do the simple test first and the try deal with uErrorCode being N/A.
663 */
664 PPDMDEVINS const pDevIns = pRegEntry->pDevIns;
665 if (RT_LIKELY( pDevIns
666 && iomMmioCanHandlePfInRZ(pVM, uErrorCode, pRegEntry)))
667 {
668 /*
669 * Enter the device critsect prior to engaging IOM in case of lock contention.
670 * Note! Perhaps not a good move?
671 */
672 rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE);
673 if (rcStrict == VINF_SUCCESS)
674 {
675#endif /* !IN_RING3 */
676
677 /*
678 * Let IEM call us back via iomMmioHandler.
679 */
680 rcStrict = IEMExecOne(pVCpu);
681
682#ifndef IN_RING3
683 PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
684#endif
685 if (RT_SUCCESS(rcStrict))
686 { /* likely */ }
687 else if ( rcStrict == VERR_IEM_ASPECT_NOT_IMPLEMENTED
688 || rcStrict == VERR_IEM_INSTR_NOT_IMPLEMENTED)
689 {
690 Log(("IOM: Hit unsupported IEM feature!\n"));
691 rcStrict = VINF_EM_RAW_EMULATE_INSTR;
692 }
693#ifndef IN_RING3
694 return rcStrict;
695 }
696 STAM_COUNTER_INC(&pVM->iom.s.StatMmioDevLockContentionR0);
697 }
698 else
699 rcStrict = VINF_IOM_R3_MMIO_READ_WRITE;
700
701# ifdef VBOX_WITH_STATISTICS
702 if (rcStrict == VINF_IOM_R3_MMIO_READ_WRITE)
703 {
704 PIOMMMIOSTATSENTRY const pStats = iomMmioGetStats(pVM, pRegEntry);
705 if (uErrorCode & X86_TRAP_PF_RW)
706 {
707 STAM_COUNTER_INC(&pStats->WriteRZToR3);
708 STAM_COUNTER_INC(&pVM->iom.s.StatMmioWritesR0ToR3);
709 }
710 else
711 {
712 STAM_COUNTER_INC(&pStats->ReadRZToR3);
713 STAM_COUNTER_INC(&pVM->iom.s.StatMmioReadsR0ToR3);
714 }
715 }
716# endif
717#else /* IN_RING3 */
718 RT_NOREF(pVM, pRegEntry);
719#endif /* IN_RING3 */
720 return rcStrict;
721}
722
723
724/**
725 * @callback_method_impl{FNPGMRZPHYSPFHANDLER,
726 * \#PF access handler callback for MMIO pages.}
727 *
728 * @remarks The @a pvUser argument is the MMIO handle.
729 */
730DECLEXPORT(VBOXSTRICTRC) iomMmioPfHandlerNew(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore,
731 RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
732{
733 STAM_PROFILE_START(&pVM->iom.s.StatMmioPfHandler, Prf);
734 LogFlow(("iomMmioPfHandlerNew: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
735 GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip));
736 RT_NOREF(pvFault, pCtxCore);
737
738 /* Translate the MMIO handle to a registration entry for the current context. */
739 AssertReturn((uintptr_t)pvUser < RT_MIN(pVM->iom.s.cMmioRegs, pVM->iom.s.cMmioAlloc), VERR_IOM_INVALID_MMIO_HANDLE);
740# ifdef IN_RING0
741 AssertReturn((uintptr_t)pvUser < pVM->iomr0.s.cMmioAlloc, VERR_IOM_INVALID_MMIO_HANDLE);
742 CTX_SUFF(PIOMMMIOENTRY) pRegEntry = &pVM->iomr0.s.paMmioRegs[(uintptr_t)pvUser];
743# else
744 CTX_SUFF(PIOMMMIOENTRY) pRegEntry = &pVM->iom.s.paMmioRegs[(uintptr_t)pvUser];
745# endif
746
747 VBOXSTRICTRC rcStrict = iomMmioCommonPfHandlerNew(pVM, pVCpu, (uint32_t)uErrorCode, GCPhysFault, pRegEntry);
748
749 STAM_PROFILE_STOP(&pVM->iom.s.StatMmioPfHandler, Prf);
750 return rcStrict;
751}
752
753#endif /* !IN_RING3 */
754
755#ifdef IN_RING0
756/**
757 * Physical access handler for MMIO ranges.
758 *
759 * This is actually only used by VT-x for APIC page accesses.
760 *
761 * @returns VBox status code (appropriate for GC return).
762 * @param pVM The cross context VM structure.
763 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
764 * @param uErrorCode CPU Error code.
765 * @param GCPhysFault The GC physical address.
766 */
767VMM_INT_DECL(VBOXSTRICTRC) IOMR0MmioPhysHandler(PVMCC pVM, PVMCPUCC pVCpu, uint32_t uErrorCode, RTGCPHYS GCPhysFault)
768{
769 STAM_PROFILE_START(&pVM->iom.s.StatMmioPhysHandler, Prf);
770
771 /*
772 * We don't have a range here, so look it up before calling the common function.
773 */
774 VBOXSTRICTRC rcStrict = IOM_LOCK_SHARED(pVM);
775 if (RT_SUCCESS(rcStrict))
776 {
777 RTGCPHYS offRegion;
778 CTX_SUFF(PIOMMMIOENTRY) pRegEntry = iomMmioGetEntry(pVM, GCPhysFault, &offRegion, &pVCpu->iom.s.idxMmioLastPhysHandler);
779 IOM_UNLOCK_SHARED(pVM);
780 if (RT_LIKELY(pRegEntry))
781 rcStrict = iomMmioCommonPfHandlerNew(pVM, pVCpu, (uint32_t)uErrorCode, GCPhysFault, pRegEntry);
782 else
783 rcStrict = VERR_IOM_MMIO_RANGE_NOT_FOUND;
784 }
785 else if (rcStrict == VERR_SEM_BUSY)
786 rcStrict = VINF_IOM_R3_MMIO_READ_WRITE;
787
788 STAM_PROFILE_STOP(&pVM->iom.s.StatMmioPhysHandler, Prf);
789 return rcStrict;
790}
791#endif /* IN_RING0 */
792
793
794/**
795 * @callback_method_impl{FNPGMPHYSHANDLER, MMIO page accesses}
796 *
797 * @remarks The @a pvUser argument is the MMIO handle.
798 */
799PGM_ALL_CB2_DECL(VBOXSTRICTRC) iomMmioHandlerNew(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhysFault, void *pvPhys, void *pvBuf,
800 size_t cbBuf, PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
801{
802 STAM_PROFILE_START(UnusedMacroArg, Prf);
803 STAM_COUNTER_INC(&pVM->iom.s.CTX_SUFF(StatMmioHandler));
804 Log4(("iomMmioHandlerNew: GCPhysFault=%RGp cbBuf=%#x enmAccessType=%d enmOrigin=%d pvUser=%p\n", GCPhysFault, cbBuf, enmAccessType, enmOrigin, pvUser));
805
806 Assert(enmAccessType == PGMACCESSTYPE_READ || enmAccessType == PGMACCESSTYPE_WRITE);
807 AssertMsg(cbBuf >= 1, ("%zu\n", cbBuf));
808 NOREF(pvPhys); NOREF(enmOrigin);
809
810#ifdef IN_RING3
811 int const rcToRing3 = VERR_IOM_MMIO_IPE_3;
812#else
813 int const rcToRing3 = enmAccessType == PGMACCESSTYPE_READ ? VINF_IOM_R3_MMIO_READ : VINF_IOM_R3_MMIO_WRITE;
814#endif
815
816 /*
817 * Translate pvUser to an MMIO registration table entry. We can do this
818 * without any locking as the data is static after VM creation.
819 */
820 AssertReturn((uintptr_t)pvUser < RT_MIN(pVM->iom.s.cMmioRegs, pVM->iom.s.cMmioAlloc), VERR_IOM_INVALID_MMIO_HANDLE);
821#ifdef IN_RING0
822 AssertReturn((uintptr_t)pvUser < pVM->iomr0.s.cMmioAlloc, VERR_IOM_INVALID_MMIO_HANDLE);
823 CTX_SUFF(PIOMMMIOENTRY) const pRegEntry = &pVM->iomr0.s.paMmioRegs[(uintptr_t)pvUser];
824 PIOMMMIOENTRYR3 const pRegEntryR3 = &pVM->iomr0.s.paMmioRing3Regs[(uintptr_t)pvUser];
825#else
826 CTX_SUFF(PIOMMMIOENTRY) const pRegEntry = &pVM->iom.s.paMmioRegs[(uintptr_t)pvUser];
827#endif
828#ifdef VBOX_WITH_STATISTICS
829 PIOMMMIOSTATSENTRY const pStats = iomMmioGetStats(pVM, pRegEntry); /* (Works even without ring-0 device setup.) */
830#endif
831 PPDMDEVINS const pDevIns = pRegEntry->pDevIns;
832
833#ifdef VBOX_STRICT
834 /*
835 * Assert the right entry in strict builds. This may yield a false positive
836 * for SMP VMs if we're unlucky and the guest isn't well behaved.
837 */
838# ifdef IN_RING0
839 Assert(pRegEntry && (GCPhysFault - pRegEntryR3->GCPhysMapping < pRegEntryR3->cbRegion || !pRegEntryR3->fMapped));
840# else
841 Assert(pRegEntry && (GCPhysFault - pRegEntry->GCPhysMapping < pRegEntry->cbRegion || !pRegEntry->fMapped));
842# endif
843#endif
844
845#ifndef IN_RING3
846 /*
847 * If someone is doing FXSAVE, FXRSTOR, XSAVE, XRSTOR or other stuff dealing with
848 * large amounts of data, just go to ring-3 where we don't need to deal with partial
849 * successes. No chance any of these will be problematic read-modify-write stuff.
850 *
851 * Also drop back if the ring-0 registration entry isn't actually used.
852 */
853 if ( RT_LIKELY(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue))
854 && pRegEntry->cbRegion != 0
855 && ( enmAccessType == PGMACCESSTYPE_READ
856 ? pRegEntry->pfnReadCallback != NULL || pVM->iomr0.s.paMmioRing3Regs[(uintptr_t)pvUser].pfnReadCallback == NULL
857 : pRegEntry->pfnWriteCallback != NULL || pVM->iomr0.s.paMmioRing3Regs[(uintptr_t)pvUser].pfnWriteCallback == NULL)
858 && pDevIns )
859 { /* likely */ }
860 else
861 {
862 Log4(("iomMmioHandlerNew: to ring-3: to-big=%RTbool zero-size=%RTbool no-callback=%RTbool pDevIns=%p hRegion=%p\n",
863 !(cbBuf <= sizeof(pVCpu->iom.s.PendingMmioWrite.abValue)), !(pRegEntry->cbRegion != 0),
864 !( enmAccessType == PGMACCESSTYPE_READ
865 ? pRegEntry->pfnReadCallback != NULL || pVM->iomr0.s.paMmioRing3Regs[(uintptr_t)pvUser].pfnReadCallback == NULL
866 : pRegEntry->pfnWriteCallback != NULL || pVM->iomr0.s.paMmioRing3Regs[(uintptr_t)pvUser].pfnWriteCallback == NULL),
867 pDevIns, pvUser));
868 STAM_COUNTER_INC(enmAccessType == PGMACCESSTYPE_READ ? &pStats->ReadRZToR3 : &pStats->WriteRZToR3);
869 STAM_COUNTER_INC(enmAccessType == PGMACCESSTYPE_READ ? &pVM->iom.s.StatMmioReadsR0ToR3 : &pVM->iom.s.StatMmioWritesR0ToR3);
870 return rcToRing3;
871 }
872#endif /* !IN_RING3 */
873
874 /*
875 * If we've got an offset that's outside the region, defer to ring-3 if we
876 * can, or pretend there is nothing there. This shouldn't happen, but can
877 * if we're unlucky with an SMP VM and the guest isn't behaving very well.
878 */
879#ifdef IN_RING0
880 RTGCPHYS const GCPhysMapping = pRegEntryR3->GCPhysMapping;
881#else
882 RTGCPHYS const GCPhysMapping = pRegEntry->GCPhysMapping;
883#endif
884 RTGCPHYS const offRegion = GCPhysFault - GCPhysMapping;
885 if (RT_LIKELY(offRegion < pRegEntry->cbRegion && GCPhysMapping != NIL_RTGCPHYS))
886 { /* likely */ }
887 else
888 {
889 STAM_REL_COUNTER_INC(&pVM->iom.s.StatMmioStaleMappings);
890 LogRelMax(64, ("iomMmioHandlerNew: Stale access at %#RGp to range #%#x currently residing at %RGp LB %RGp\n",
891 GCPhysFault, pRegEntry->idxSelf, GCPhysMapping, pRegEntry->cbRegion));
892#ifdef IN_RING3
893 if (enmAccessType == PGMACCESSTYPE_READ)
894 iomMMIODoReadFFs(pvBuf, cbBuf IOM_MMIO_STATS_COMMA_ARG);
895 return VINF_SUCCESS;
896#else
897 STAM_COUNTER_INC(enmAccessType == PGMACCESSTYPE_READ ? &pStats->ReadRZToR3 : &pStats->WriteRZToR3);
898 STAM_COUNTER_INC(enmAccessType == PGMACCESSTYPE_READ ? &pVM->iom.s.StatMmioReadsR0ToR3 : &pVM->iom.s.StatMmioWritesR0ToR3);
899 return rcToRing3;
900#endif
901 }
902
903 /*
904 * Perform locking and the access.
905 *
906 * Writes requiring a return to ring-3 are buffered by IOM so IEM can
907 * commit the instruction.
908 *
909 * Note! We may end up locking the device even when the relevant callback is
910 * NULL. This is supposed to be an unlikely case, so not optimized yet.
911 */
912 VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), rcToRing3);
913 if (rcStrict == VINF_SUCCESS)
914 {
915 if (enmAccessType == PGMACCESSTYPE_READ)
916 {
917 /*
918 * Read.
919 */
920 rcStrict = iomMmioDoRead(pVM, pRegEntry, GCPhysFault, offRegion, pvBuf, (uint32_t)cbBuf IOM_MMIO_STATS_COMMA_ARG);
921
922 PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
923#ifndef IN_RING3
924 if (rcStrict == VINF_IOM_R3_MMIO_READ)
925 {
926 STAM_COUNTER_INC(&pStats->ReadRZToR3);
927 STAM_COUNTER_INC(&pVM->iom.s.StatMmioReadsR0ToR3);
928 }
929 else
930#endif
931 STAM_COUNTER_INC(&pStats->Reads);
932 STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), Prf);
933 }
934 else
935 {
936 /*
937 * Write.
938 */
939 rcStrict = iomMmioDoWrite(pVM, pVCpu, pRegEntry, GCPhysFault, offRegion, pvBuf, (uint32_t)cbBuf IOM_MMIO_STATS_COMMA_ARG);
940 PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
941#ifndef IN_RING3
942 if (rcStrict == VINF_IOM_R3_MMIO_WRITE)
943 rcStrict = iomMmioRing3WritePending(pVCpu, GCPhysFault, pvBuf, cbBuf, pRegEntry->idxSelf);
944 if (rcStrict == VINF_IOM_R3_MMIO_WRITE)
945 {
946 STAM_COUNTER_INC(&pStats->WriteRZToR3);
947 STAM_COUNTER_INC(&pVM->iom.s.StatMmioWritesR0ToR3);
948 }
949 else if (rcStrict == VINF_IOM_R3_MMIO_COMMIT_WRITE)
950 {
951 STAM_COUNTER_INC(&pStats->CommitRZToR3);
952 STAM_COUNTER_INC(&pVM->iom.s.StatMmioCommitsR0ToR3);
953 }
954 else
955#endif
956 STAM_COUNTER_INC(&pStats->Writes);
957 STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), Prf);
958 }
959
960 /*
961 * Check the return code.
962 */
963#ifdef IN_RING3
964 AssertMsg(rcStrict == VINF_SUCCESS, ("%Rrc - Access type %d - %RGp - %s\n",
965 VBOXSTRICTRC_VAL(rcStrict), enmAccessType, GCPhysFault, pRegEntry->pszDesc));
966#else
967 AssertMsg( rcStrict == VINF_SUCCESS
968 || rcStrict == rcToRing3
969 || (rcStrict == VINF_IOM_R3_MMIO_COMMIT_WRITE && enmAccessType == PGMACCESSTYPE_WRITE)
970 || rcStrict == VINF_EM_DBG_STOP
971 || rcStrict == VINF_EM_DBG_EVENT
972 || rcStrict == VINF_EM_DBG_BREAKPOINT
973 || rcStrict == VINF_EM_OFF
974 || rcStrict == VINF_EM_SUSPEND
975 || rcStrict == VINF_EM_RESET
976 //|| rcStrict == VINF_EM_HALT /* ?? */
977 //|| rcStrict == VINF_EM_NO_MEMORY /* ?? */
978 , ("%Rrc - Access type %d - %RGp - %s #%u\n",
979 VBOXSTRICTRC_VAL(rcStrict), enmAccessType, GCPhysFault, pDevIns->pReg->szName, pDevIns->iInstance));
980#endif
981 }
982 /*
983 * Deal with enter-critsect failures.
984 */
985#ifndef IN_RING3
986 else if (rcStrict == VINF_IOM_R3_MMIO_WRITE)
987 {
988 Assert(enmAccessType == PGMACCESSTYPE_WRITE);
989 rcStrict = iomMmioRing3WritePending(pVCpu, GCPhysFault, pvBuf, cbBuf, pRegEntry->idxSelf);
990 if (rcStrict == VINF_IOM_R3_MMIO_COMMIT_WRITE)
991 {
992 STAM_COUNTER_INC(&pStats->CommitRZToR3);
993 STAM_COUNTER_INC(&pVM->iom.s.StatMmioCommitsR0ToR3);
994 }
995 else
996 {
997 STAM_COUNTER_INC(&pStats->WriteRZToR3);
998 STAM_COUNTER_INC(&pVM->iom.s.StatMmioWritesR0ToR3);
999 }
1000 STAM_COUNTER_INC(&pVM->iom.s.StatMmioDevLockContentionR0);
1001 }
1002 else if (rcStrict == VINF_IOM_R3_MMIO_READ)
1003 {
1004 Assert(enmAccessType == PGMACCESSTYPE_READ);
1005 STAM_COUNTER_INC(&pStats->ReadRZToR3);
1006 STAM_COUNTER_INC(&pVM->iom.s.StatMmioDevLockContentionR0);
1007 }
1008#endif
1009 else
1010 AssertMsg(RT_FAILURE_NP(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1011 return rcStrict;
1012}
1013
1014
1015/**
1016 * Mapping an MMIO2 page in place of an MMIO page for direct access.
1017 *
1018 * This is a special optimization used by the VGA device. Call
1019 * IOMMmioResetRegion() to undo the mapping.
1020 *
1021 * @returns VBox status code. This API may return VINF_SUCCESS even if no
1022 * remapping is made.
1023 *
1024 * @param pVM The cross context VM structure.
1025 * @param pDevIns The device instance @a hRegion and @a hMmio2 are
1026 * associated with.
1027 * @param hRegion The handle to the MMIO region.
1028 * @param offRegion The offset into @a hRegion of the page to be
1029 * remapped.
1030 * @param hMmio2 The MMIO2 handle.
1031 * @param offMmio2 Offset into @a hMmio2 of the page to be use for the
1032 * mapping.
1033 * @param fPageFlags Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
1034 * for the time being.
1035 */
1036VMMDECL(int) IOMMmioMapMmio2Page(PVMCC pVM, PPDMDEVINS pDevIns, IOMMMIOHANDLE hRegion, RTGCPHYS offRegion,
1037 uint64_t hMmio2, RTGCPHYS offMmio2, uint64_t fPageFlags)
1038{
1039 /* Currently only called from the VGA device during MMIO. */
1040 Log(("IOMMmioMapMmio2Page %#RX64/%RGp -> %#RX64/%RGp flags=%RX64\n", hRegion, offRegion, hMmio2, offMmio2, fPageFlags));
1041 AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
1042 AssertReturn(pDevIns, VERR_INVALID_POINTER);
1043
1044/** @todo Why is this restricted to protected mode??? Try it in all modes! */
1045 PVMCPUCC pVCpu = VMMGetCpu(pVM);
1046
1047 /* This currently only works in real mode, protected mode without paging or with nested paging. */
1048 /** @todo NEM: MMIO page aliasing. */
1049 if ( !HMIsEnabled(pVM) /* useless without VT-x/AMD-V */
1050 || ( CPUMIsGuestInPagedProtectedMode(pVCpu)
1051 && !HMIsNestedPagingActive(pVM)))
1052 return VINF_SUCCESS; /* ignore */ /** @todo return some indicator if we fail here */
1053
1054 /*
1055 * Translate the handle into an entry and check the region offset.
1056 */
1057 AssertReturn(hRegion < RT_MIN(pVM->iom.s.cMmioRegs, pVM->iom.s.cMmioAlloc), VERR_IOM_INVALID_MMIO_HANDLE);
1058#ifdef IN_RING0
1059 AssertReturn(hRegion < pVM->iomr0.s.cMmioAlloc, VERR_IOM_INVALID_MMIO_HANDLE);
1060 PIOMMMIOENTRYR3 const pRegEntry = &pVM->iomr0.s.paMmioRing3Regs[hRegion];
1061 AssertReturn(pRegEntry->cbRegion > 0, VERR_IOM_INVALID_MMIO_HANDLE);
1062 AssertReturn(offRegion < pVM->iomr0.s.paMmioRegs[hRegion].cbRegion, VERR_OUT_OF_RANGE);
1063 AssertReturn( pVM->iomr0.s.paMmioRegs[hRegion].pDevIns == pDevIns
1064 || ( pVM->iomr0.s.paMmioRegs[hRegion].pDevIns == NULL
1065 && pRegEntry->pDevIns == pDevIns->pDevInsForR3), VERR_ACCESS_DENIED);
1066#else
1067 PIOMMMIOENTRYR3 const pRegEntry = &pVM->iom.s.paMmioRegs[hRegion];
1068 AssertReturn(pRegEntry->cbRegion > 0, VERR_IOM_INVALID_MMIO_HANDLE);
1069 AssertReturn(pRegEntry->pDevIns == pDevIns, VERR_ACCESS_DENIED);
1070#endif
1071 AssertReturn(offRegion < pRegEntry->cbRegion, VERR_OUT_OF_RANGE);
1072 Assert((pRegEntry->cbRegion & PAGE_OFFSET_MASK) == 0);
1073
1074 /*
1075 * When getting and using the mapping address, we must sit on the IOM lock
1076 * to prevent remapping. Shared suffices as we change nothing.
1077 */
1078 int rc = IOM_LOCK_SHARED(pVM);
1079 if (rc == VINF_SUCCESS)
1080 {
1081 RTGCPHYS const GCPhys = pRegEntry->fMapped ? pRegEntry->GCPhysMapping : NIL_RTGCPHYS;
1082 if (GCPhys != NIL_RTGCPHYS)
1083 {
1084 Assert(!(GCPhys & PAGE_OFFSET_MASK));
1085
1086 /*
1087 * Do the aliasing; page align the addresses since PGM is picky.
1088 */
1089 rc = PGMHandlerPhysicalPageAliasMmio2(pVM, GCPhys, GCPhys + (offRegion & ~(RTGCPHYS)PAGE_OFFSET_MASK),
1090 pDevIns, hMmio2, offMmio2);
1091 }
1092 else
1093 AssertFailedStmt(rc = VERR_IOM_MMIO_REGION_NOT_MAPPED);
1094
1095 IOM_UNLOCK_SHARED(pVM);
1096 }
1097
1098/** @todo either ditch this or replace it with something that works in the
1099 * nested case, since we really only care about nested paging! */
1100#if 0
1101 /*
1102 * Modify the shadow page table. Since it's an MMIO page it won't be present and we
1103 * can simply prefetch it.
1104 *
1105 * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1106 */
1107# if 0 /* The assertion is wrong for the PGM_SYNC_CLEAR_PGM_POOL and VINF_PGM_HANDLER_ALREADY_ALIASED cases. */
1108# ifdef VBOX_STRICT
1109 uint64_t fFlags;
1110 RTHCPHYS HCPhys;
1111 rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
1112 Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1113# endif
1114# endif
1115 rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1116 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1117#endif
1118 return rc;
1119}
1120
1121
1122#ifdef IN_RING0 /* VT-x ring-0 only, move to IOMR0Mmio.cpp later. */
1123/**
1124 * Mapping a HC page in place of an MMIO page for direct access.
1125 *
1126 * This is a special optimization used by the APIC in the VT-x case. This VT-x
1127 * code uses PGMHandlerPhysicalReset rather than IOMMmioResetRegion() to undo
1128 * the effects here.
1129 *
1130 * @todo Make VT-x usage more consistent.
1131 *
1132 * @returns VBox status code.
1133 *
1134 * @param pVM The cross context VM structure.
1135 * @param pVCpu The cross context virtual CPU structure.
1136 * @param GCPhys The address of the MMIO page to be changed.
1137 * @param HCPhys The address of the host physical page.
1138 * @param fPageFlags Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
1139 * for the time being.
1140 */
1141VMMR0_INT_DECL(int) IOMR0MmioMapMmioHCPage(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags)
1142{
1143 /* Currently only called from VT-x code during a page fault. */
1144 Log(("IOMR0MmioMapMmioHCPage %RGp -> %RGp flags=%RX64\n", GCPhys, HCPhys, fPageFlags));
1145
1146 AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
1147 /** @todo NEM: MMIO page aliasing?? */
1148 Assert(HMIsEnabled(pVM));
1149
1150# ifdef VBOX_STRICT
1151 /*
1152 * Check input address (it's HM calling, not the device, so no region handle).
1153 */
1154 int rcSem = IOM_LOCK_SHARED(pVM);
1155 if (rcSem == VINF_SUCCESS)
1156 {
1157 RTGCPHYS offIgn;
1158 uint16_t idxIgn = UINT16_MAX;
1159 PIOMMMIOENTRYR0 pRegEntry = iomMmioGetEntry(pVM, GCPhys, &offIgn, &idxIgn);
1160 IOM_UNLOCK_SHARED(pVM);
1161 Assert(pRegEntry);
1162 Assert(pRegEntry && !(pRegEntry->cbRegion & PAGE_OFFSET_MASK));
1163 }
1164# endif
1165
1166 /*
1167 * Do the aliasing; page align the addresses since PGM is picky.
1168 */
1169 GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1170 HCPhys &= ~(RTHCPHYS)PAGE_OFFSET_MASK;
1171
1172 int rc = PGMHandlerPhysicalPageAliasHC(pVM, GCPhys, GCPhys, HCPhys);
1173 AssertRCReturn(rc, rc);
1174
1175/** @todo either ditch this or replace it with something that works in the
1176 * nested case, since we really only care about nested paging! */
1177
1178 /*
1179 * Modify the shadow page table. Since it's an MMIO page it won't be present and we
1180 * can simply prefetch it.
1181 *
1182 * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1183 */
1184 rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1185 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1186 return VINF_SUCCESS;
1187}
1188#endif
1189
1190
1191/**
1192 * Reset a previously modified MMIO region; restore the access flags.
1193 *
1194 * This undoes the effects of IOMMmioMapMmio2Page() and is currently only
1195 * intended for some ancient VGA hack. However, it would be great to extend it
1196 * beyond VT-x and/or nested-paging.
1197 *
1198 * @returns VBox status code.
1199 *
1200 * @param pVM The cross context VM structure.
1201 * @param pDevIns The device instance @a hRegion is associated with.
1202 * @param hRegion The handle to the MMIO region.
1203 */
1204VMMDECL(int) IOMMmioResetRegion(PVMCC pVM, PPDMDEVINS pDevIns, IOMMMIOHANDLE hRegion)
1205{
1206 Log(("IOMMMIOResetRegion %#RX64\n", hRegion));
1207 AssertReturn(pDevIns, VERR_INVALID_POINTER);
1208
1209/** @todo Get rid of this this real/protected or nested paging restriction,
1210 * it probably shouldn't be here and would be nasty when the CPU
1211 * changes mode while we have the hack enabled... */
1212 PVMCPUCC pVCpu = VMMGetCpu(pVM);
1213
1214 /* This currently only works in real mode, protected mode without paging or with nested paging. */
1215 /** @todo NEM: MMIO page aliasing. */
1216 if ( !HMIsEnabled(pVM) /* useless without VT-x/AMD-V */
1217 || ( CPUMIsGuestInPagedProtectedMode(pVCpu)
1218 && !HMIsNestedPagingActive(pVM)))
1219 return VINF_SUCCESS; /* ignore */
1220
1221 /*
1222 * Translate the handle into an entry and mapping address for PGM.
1223 * We have to take the lock to safely access the mapping address here.
1224 */
1225 AssertReturn(hRegion < RT_MIN(pVM->iom.s.cMmioRegs, pVM->iom.s.cMmioAlloc), VERR_IOM_INVALID_MMIO_HANDLE);
1226#ifdef IN_RING0
1227 AssertReturn(hRegion < pVM->iomr0.s.cMmioAlloc, VERR_IOM_INVALID_MMIO_HANDLE);
1228 PIOMMMIOENTRYR3 const pRegEntry = &pVM->iomr0.s.paMmioRing3Regs[hRegion];
1229 AssertReturn(pRegEntry->cbRegion > 0, VERR_IOM_INVALID_MMIO_HANDLE);
1230 AssertReturn( pVM->iomr0.s.paMmioRegs[hRegion].pDevIns == pDevIns
1231 || ( pVM->iomr0.s.paMmioRegs[hRegion].pDevIns == NULL
1232 && pRegEntry->pDevIns == pDevIns->pDevInsForR3), VERR_ACCESS_DENIED);
1233#else
1234 PIOMMMIOENTRYR3 const pRegEntry = &pVM->iom.s.paMmioRegs[hRegion];
1235 AssertReturn(pRegEntry->cbRegion > 0, VERR_IOM_INVALID_MMIO_HANDLE);
1236 AssertReturn(pRegEntry->pDevIns == pDevIns, VERR_ACCESS_DENIED);
1237#endif
1238 Assert((pRegEntry->cbRegion & PAGE_OFFSET_MASK) == 0);
1239
1240 int rcSem = IOM_LOCK_SHARED(pVM);
1241 RTGCPHYS GCPhys = pRegEntry->fMapped ? pRegEntry->GCPhysMapping : NIL_RTGCPHYS;
1242 if (rcSem == VINF_SUCCESS)
1243 IOM_UNLOCK_SHARED(pVM);
1244
1245 Assert(!(GCPhys & PAGE_OFFSET_MASK));
1246 Assert(!(pRegEntry->cbRegion & PAGE_OFFSET_MASK));
1247
1248 /*
1249 * Call PGM to do the job work.
1250 *
1251 * After the call, all the pages should be non-present, unless there is
1252 * a page pool flush pending (unlikely).
1253 */
1254 int rc = PGMHandlerPhysicalReset(pVM, GCPhys);
1255 AssertRC(rc);
1256
1257# ifdef VBOX_STRICT
1258 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
1259 {
1260 RTGCPHYS cb = pRegEntry->cbRegion;
1261 while (cb)
1262 {
1263 uint64_t fFlags;
1264 RTHCPHYS HCPhys;
1265 rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
1266 Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1267 cb -= PAGE_SIZE;
1268 GCPhys += PAGE_SIZE;
1269 }
1270 }
1271# endif
1272 return rc;
1273}
1274
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette