Changeset 104516 in vbox

Timestamp:

May 4, 2024 1:53:42 AM (7 months ago)

Author:

vboxsync

Message:

VMM/GCM,IEM,HM: Integrate GCM with IEM, extending it to cover the mesa drv situation and valid ring-0 IN instructions to same port. Untested. TODO: NEM. bugref:9735 bugref:10683

Location:

trunk

Files:

• include/VBox/err.h (modified) (1 diff)
• include/VBox/vmm/cpum-common.h (modified) (1 diff)
• include/VBox/vmm/gcm.h (modified) (1 diff)
• src/VBox/Main/src-client/ConsoleImplConfigX86.cpp (modified) (2 diffs)
• src/VBox/VMM/VMMAll/GCMAll.cpp (modified) (2 diffs)
• src/VBox/VMM/VMMAll/IEMAll.cpp (modified) (2 diffs)
• src/VBox/VMM/VMMAll/IEMAllCImpl.cpp (modified) (2 diffs)
• src/VBox/VMM/VMMAll/VMXAllTemplate.cpp.h (modified) (1 diff)
• src/VBox/VMM/VMMR0/HMSVMR0.cpp (modified) (2 diffs)
• src/VBox/VMM/VMMR3/GCM.cpp (modified) (1 diff)
• src/VBox/VMM/include/GCMInternal.h (modified) (1 diff)

trunk/include/VBox/err.h

@@ -3272 +3272 @@
 /** @} */
 
+/** @name Guest Compatibility Manage Status Codes.
+ * @{
+ */
+/** The intercepted situation was completely handled, continue execution. */
+#define VINF_GCM_HANDLED                            (7600)
+/** The intercepted instruction handled, advance RIP and continue execution. */
+#define VINF_GCM_HANDLED_ADVANCE_RIP                (7601)
+/** The intercepted operation was not handled, take default action. */
+#define VERR_GCM_NOT_HANDLED                        (-7602)
+/** @} */
+
 /* SED-END */
 

trunk/include/VBox/vmm/cpum-common.h

@@ -124 +124 @@
     } while (0)
 
+/** @def CPUM_IMPORT_EXTRN_WITH_CTX_RET
+ * Macro for making sure the state specified by @a fExtrnImport is present,
+ * calling CPUMImportGuestStateOnDemand() to get it if necessary.
+ *
+ * Will return if CPUMImportGuestStateOnDemand() fails.
+ *
+ * @param   a_pVCpu         The cross context virtual CPU structure of the calling EMT.
+ * @param   a_pCtx          Pointer to the CPU context (CPUMCTX).
+ * @param   a_fExtrnImport  Mask of CPUMCTX_EXTRN_XXX bits to get.
+ * @thread  EMT(a_pVCpu)
+ */
+#define CPUM_IMPORT_EXTRN_WITH_CTX_RET(a_pVCpu, a_pCtx, a_fExtrnImport) \
+    do { \
+        if (!((a_pCtx)->fExtrn & (a_fExtrnImport))) \
+        { /* already present, consider this likely */ } \
+        else \
+        { \
+            int rcCpumImport = CPUMImportGuestStateOnDemand(a_pVCpu, a_fExtrnImport); \
+            AssertRCReturn(rcCpumImport, rcCpumImport); \
+        } \
+    } while (0)
+
 VMM_INT_DECL(int) CPUMImportGuestStateOnDemand(PVMCPUCC pVCpu, uint64_t fExtrnImport);
 /** @} */

trunk/include/VBox/vmm/gcm.h

@@ -61 +61 @@
 VMM_INT_DECL(bool)          GCMIsInterceptingXcptDE(PVMCPUCC pVCpu);
 VMM_INT_DECL(int)           GCMXcptDE(PVMCPUCC pVCpu, PCPUMCTX pCtx);
+
+VMM_INT_DECL(bool)          GCMIsInterceptingXcptGP(PVMCPUCC pVCpu);
+VMM_INT_DECL(int)           GCMXcptGP(PVMCPUCC pVCpu, PCPUMCTX pCtx);
+
+VMM_INT_DECL(VBOXSTRICTRC)  GCMInterceptedIOPortRead(PVMCPUCC pVCpu, PCPUMCTX pCtx, uint16_t u16Port, uint8_t cbReg);
+VMM_INT_DECL(bool)          GCMIsInterceptingIOPortReadSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg);
+
+/**
+ * Checks if the given IN instruction is intercepted.
+ */
+DECLINLINE(bool) GCMIsInterceptingIOPortRead(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    return u16Port == 0x5658 /* vmware hypervisor port */
+        && cbReg == 4
+        && GCMIsInterceptingIOPortReadSlow(pVCpu, u16Port, cbReg);
+}
+
+#if 0 /* If we need to deal with high speed vmware hypervisor calls */
+VMM_INT_DECL(bool)          GCMIsInterceptingIOPortReadStringSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg);
+VMM_INT_DECL(bool)          GCMIsInterceptingIOPortWriteStringSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg);
+
+/**
+ * Checks if the given INS instruction is intercepted.
+ */
+DECLINLINE(bool) GCMIsInterceptingIOPortReadString(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    return u16Port == 0x5659 /* new vmware hypervisor port */
+        && cbReg == 1
+        && GCMIsInterceptingIOPortReadStringSlow(pVCpu, u16Port, cbReg);
+}
+
+/**
+ * Checks if the given OUTS instruction is intercepted.
+ */
+DECLINLINE(bool) GCMIsInterceptingIOPortWriteString(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    return u16Port == 0x5659 /* new vmware hypervisor port */
+        && cbReg == 1
+        && GCMIsInterceptingIOPortWriteStringSlow(pVCpu, u16Port, cbReg);
+}
+#endif
+
 /** @} */
 

trunk/src/VBox/Main/src-client/ConsoleImplConfigX86.cpp

@@ -1078 +1078 @@
         if (fW9xGuest)
             InsertConfigInteger(pGcmNode, "DivByZeroWin9x", 1);
+        /* MesaVmsvgaDrv (formerly LovelyMesaDrvWorkaround) is set futher down. */
 
         /*
@@ -1407 +1408 @@
 #ifdef VBOX_WITH_VMSVGA
             case GraphicsControllerType_VMSVGA:
-                InsertConfigInteger(pHM, "LovelyMesaDrvWorkaround", 1); /* hits someone else logging backdoor. */
-                InsertConfigInteger(pNEM, "LovelyMesaDrvWorkaround", 1); /* hits someone else logging backdoor. */
+                InsertConfigInteger(pHM, "LovelyMesaDrvWorkaround", 1);  /* hits someone else's logging backdoor. */
+                InsertConfigInteger(pNEM, "LovelyMesaDrvWorkaround", 1); /* hits someone else's logging backdoor. */
+                InsertConfigInteger(pGcmNode, "MesaVmsvgaDrv", 1);       /* hits someone else's logging backdoor. */
                 RT_FALL_THROUGH();
             case GraphicsControllerType_VBoxSVGA:

trunk/src/VBox/VMM/VMMAll/GCMAll.cpp

@@ -35 +35 @@
 
 #include <VBox/dis.h>       /* For DISSTATE */
-#include <iprt/errcore.h>
+#include <VBox/err.h>
 #include <iprt/string.h>
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+#define VMWARE_HYPERVISOR_PORT                  UINT16_C(0x5658)
+#define VMWARE_HYPERVISOR_PORT_HB               UINT16_C(0x5659)
+#define VMWARE_HYPERVISOR_MAGIC                 UINT32_C(0x564d5868)    /**< eax value */
+
+#define VMWARE_HYPERVISOR_CMD_MSG               0x001e
+#define VMWARE_HYPERVISOR_CMD_HB_MSG            0x0000
+#define VMWARE_HYPERVISOR_CMD_OPEN_CHANNEL      RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 0) /**< ecx */
+#define VMWARE_OC_RPCI_PROTOCOL_NUM                 UINT32_C(0x49435052) /**< VMWARE_HYPERVISOR_CMD_OPEN_CHANNEL: ebx[30:0] */
+#define VMWARE_OC_GUESTMSG_FLAG_COOKIE              UINT32_C(0x80000000) /**< VMWARE_HYPERVISOR_CMD_OPEN_CHANNEL: ebx bit 31 */
+#define VMWARE_HYPERVISOR_CMD_SEND_SIZE         RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 1) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_SEND_PAYLOAD      RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 2) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_RECV_SIZE         RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 3) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_RECV_PAYLOAD      RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 4) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_RECV_STATUS       RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 5) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_CLOSE_CHANNEL     RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MSG, 6) /**< ecx */
+
+#define VMWARE_HYPERVISOR_CMD_MKS_GUEST_STATS   0x0055
+#define VMWARE_HYPERVISOR_CMD_MKSGS_RESET       RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MKS_GUEST_STATS, 0) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_MKSGS_ADD_PPN     RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MKS_GUEST_STATS, 1) /**< ecx */
+#define VMWARE_HYPERVISOR_CMD_MKSGS_REMOVE_PPN  RT_MAKE_U32(VMWARE_HYPERVISOR_CMD_MKS_GUEST_STATS, 2) /**< ecx */
+
+/** @name Message status return flags (ecx).
+ * @{ */
+#define VMWARE_MSG_STATUS_F_SUCCESS             UINT32_C(0x00010000)
+#define VMWARE_MSG_STATUS_F_DO_RECV             UINT32_C(0x00020000)
+#define VMWARE_MSG_STATUS_F_CPT                 UINT32_C(0x00100000)
+#define VMWARE_MSG_STATUS_F_HB                  UINT32_C(0x00800000)
+/** @} */
 
 
@@ -198 +231 @@
 }
 
+
+#if 0
+/**
+ * Whether \#GP exceptions in the guest should be intercepted by GCM and
+ * possibly fixed up.
+ *
+ * @returns true if needed, false otherwise.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ */
+VMM_INT_DECL(bool) GCMIsInterceptingXcptGP(PVMCPUCC pVCpu)
+{
+    /* See if the enabled fixers require #GP interception. */
+    PVM const  pVM  = pVCpu->CTX_SUFF(pVM);
+    bool const fRet = (pVM->gcm.s.fFixerSet & GCMFIXER_MESA_VMSVGA_DRV) != 0;
+    LogFlow(("GCMIsInterceptingXcptDE: returns %d\n", fRet));
+    return fRet;
+}
+
+
+/**
+ * Exception handler for \#GP when registered by GCM.
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS retry the instruction and continue.
+ * @retval  VERR_NOT_FOUND deliver exception to guest.
+ *
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   pCtx        Pointer to the guest-CPU context.
+ *
+ * @thread  EMT(pVCpu).
+ */
+VMM_INT_DECL(int) GCMXcptGP(PVMCPUCC pVCpu, PCPUMCTX pCtx)
+{
+
+}
+#endif
+
+
+/**
+ * Checks if I/O port reads for the given port need GCM attention.
+ *
+ * @returns true if needed, false otherwise.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   u16Port     The port being accessed. UINT16_MAX and cbReg ==
+ *                      UINT8_MAX for any port.
+ * @param   cbReg       The access size. UINT8_MAX and u16Port == UINT16_MAX for
+ *                      any size.
+ */
+VMM_INT_DECL(bool) GCMIsInterceptingIOPortReadSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    PVM const  pVM  = pVCpu->CTX_SUFF(pVM);
+    bool const fRet = (pVM->gcm.s.fFixerSet & GCMFIXER_MESA_VMSVGA_DRV) != 0
+                   && (   (u16Port == VMWARE_HYPERVISOR_PORT && cbReg == 4)
+                       || (u16Port == UINT16_MAX && cbReg == UINT8_MAX) );
+    LogFlow(("GCMIsInterceptingIOPortReadSlow(,%#x,%#x): returns %d\n", u16Port, cbReg, fRet));
+    return fRet;
+}
+
+
+/**
+ * Processes an intercepted IO port read instruction.
+ *
+ * @returns Strict VBox status code. Only two informational status codes
+ *          are returned VINF_GCM_HANDLED and VINF_GCM_HANDLED_ADVANCE_RIP.
+ * @retval  VINF_GCM_HANDLED
+ * @retval  VINF_GCM_HANDLED_ADVANCE_RIP
+ * @retval  VERR_GCM_NOT_HANDLED
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   pCtx        The CPU context.
+ * @param   u16Port     The port being accessed.
+ * @param   cbReg       The size of the access.
+ */
+VMM_INT_DECL(VBOXSTRICTRC) GCMInterceptedIOPortRead(PVMCPUCC pVCpu, PCPUMCTX pCtx, uint16_t u16Port, uint8_t cbReg)
+{
+    Assert((pVCpu->CTX_SUFF(pVM)->gcm.s.fFixerSet & GCMFIXER_MESA_VMSVGA_DRV) != 0);
+    if (u16Port == VMWARE_HYPERVISOR_PORT && cbReg == 4)
+    {
+        CPUM_IMPORT_EXTRN_WITH_CTX_RET(pVCpu, pCtx,
+                                         CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX
+                                       | CPUMCTX_EXTRN_RBX | CPUMCTX_EXTRN_RSI | CPUMCTX_EXTRN_RDI);
+        if (pCtx->rax == VMWARE_HYPERVISOR_MAGIC)
+        {
+            switch (pCtx->rcx)
+            {
+                case VMWARE_HYPERVISOR_CMD_OPEN_CHANNEL:
+                    Log(("GCMInterceptedIOPortRead: vmware open channel: protocol=%#RX64\n", pCtx->rbx));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_SEND_SIZE:
+                    Log(("GCMInterceptedIOPortRead: vmware send size\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_SEND_PAYLOAD:
+                    Log(("GCMInterceptedIOPortRead: vmware send payload\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_RECV_SIZE:
+                    Log(("GCMInterceptedIOPortRead: vmware recv size\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_RECV_PAYLOAD:
+                    Log(("GCMInterceptedIOPortRead: vmware recv payload\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_RECV_STATUS:
+                    Log(("GCMInterceptedIOPortRead: vmware recv status\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_CLOSE_CHANNEL:
+                    Log(("GCMInterceptedIOPortRead: vmware close channel\n"));
+                    break;
+
+                case VMWARE_HYPERVISOR_CMD_MKSGS_RESET:
+                    Log(("GCMInterceptedIOPortRead: vmware mks guest stats reset\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_MKSGS_ADD_PPN:
+                    Log(("GCMInterceptedIOPortRead: vmware mks guest stats add ppn\n"));
+                    break;
+                case VMWARE_HYPERVISOR_CMD_MKSGS_REMOVE_PPN:
+                    Log(("GCMInterceptedIOPortRead: vmware mks guest stats remove ppn\n"));
+                    break;
+
+                default:
+                    LogRelMax(64, ("GCMInterceptedIOPortRead: Unknown vmware hypervisor call: rcx=%#RX64 (cmd), rbx=%#RX64 (len/whatever), rsi=%#RX64 (input), rdi=%#RX64 (input), rdx=%#RX64 (flags + chid) at %04x:%08RX64\n",
+                                   pCtx->rcx, pCtx->rbx, pCtx->rsi, pCtx->rdi, pCtx->rdx, pCtx->cs.Sel, pCtx->rip));
+                    return VERR_GCM_NOT_HANDLED;
+            }
+
+            /* Just fail the command. */
+            pCtx->ecx &= ~VMWARE_MSG_STATUS_F_SUCCESS;
+            return VINF_GCM_HANDLED_ADVANCE_RIP;
+        }
+    }
+    return VERR_GCM_NOT_HANDLED;
+}
+
+
+#if 0 /* If we need to deal with high speed vmware hypervisor calls */
+
+/**
+ * Checks if I/O port string reads for the given port need GCM attention.
+ *
+ * @returns true if needed, false otherwise.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   u16Port     The port being accessed. UINT16_MAX and cbReg ==
+ *                      UINT8_MAX for any port.
+ * @param   cbReg       The access size. UINT8_MAX and u16Port == UINT16_MAX for
+ *                      any size.
+ */
+VMM_INT_DECL(bool) GCMIsInterceptingIOPortReadStringSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    PVM const  pVM  = pVCpu->CTX_SUFF(pVM);
+    bool const fRet = (pVM->gcm.s.fFixerSet & GCMFIXER_MESA_VMSVGA_DRV) != 0
+                   && (   (u16Port == VMWARE_HYPERVISOR_PORT_HB && cbReg == 1)
+                       || (u16Port == UINT16_MAX && cbReg == UINT8_MAX) );
+    LogFlow(("GCMIsInterceptingIOPortReadStringSlow(,%#x,%#x): returns %d\n", u16Port, cbReg, fRet));
+    return fRet;
+}
+
+
+/**
+ * Checks if I/O port string writes for the given port need GCM attention.
+ *
+ * @returns true if needed, false otherwise.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   u16Port     The port being accessed. UINT16_MAX and cbReg ==
+ *                      UINT8_MAX for any port.
+ * @param   cbReg       The access size. UINT8_MAX and u16Port == UINT16_MAX for
+ *                      any size.
+ */
+VMM_INT_DECL(bool) GCMIsInterceptingIOPortWriteStringSlow(PVMCPUCC pVCpu, uint16_t u16Port, uint8_t cbReg)
+{
+    PVM const  pVM  = pVCpu->CTX_SUFF(pVM);
+    bool const fRet = (pVM->gcm.s.fFixerSet & GCMFIXER_MESA_VMSVGA_DRV) != 0
+                   && (   (u16Port == VMWARE_HYPERVISOR_PORT_HB && cbReg == 1)
+                       || (u16Port == UINT16_MAX && cbReg == UINT8_MAX) );
+    LogFlow(("GCMIsInterceptingIOPortWriteStringSlow(,%#x,%#x): returns %d\n", u16Port, cbReg, fRet));
+    return fRet;
+}
+
+#endif
+

trunk/src/VBox/VMM/VMMAll/IEMAll.cpp

@@ -131 +131 @@
 #include <VBox/vmm/hm.h>
 #include <VBox/vmm/nem.h>
+#include <VBox/vmm/gcm.h>
 #include <VBox/vmm/gim.h>
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
@@ -4197 +4198 @@
 VBOXSTRICTRC iemRaiseDivideError(PVMCPUCC pVCpu) RT_NOEXCEPT
 {
+    if (GCMIsInterceptingXcptDE(pVCpu))
+    {
+        int rc = GCMXcptDE(pVCpu, &pVCpu->cpum.GstCtx);
+        if (rc == VINF_SUCCESS)
+        {
+            Log(("iemRaiseDivideError: Restarting instruction because of GCMXcptDE\n"));
+            return VINF_IEM_RAISED_XCPT; /* must return non-zero status here to cause a instruction restart */
+        }
+    }
     return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_DE, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }

trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp

@@ -43 +43 @@
 #include <VBox/vmm/nem.h>
 #include <VBox/vmm/gim.h>
+#include <VBox/vmm/gcm.h>
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
 # include <VBox/vmm/em.h>
@@ -7294 +7295 @@
 IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg, uint8_t, bImmAndEffAddrMode)
 {
+    /*
+     * GCM intercept.
+     *
+     * This must be placed before the IOPL check as the mesa driver intercept
+     * would otherwise trigger a #GP(0).
+     */
+    if (!IEM_IS_IN_GUEST(pVCpu) && GCMIsInterceptingIOPortRead(pVCpu, u16Port, cbReg))
+    {
+        VBOXSTRICTRC rcStrict = GCMInterceptedIOPortRead(pVCpu, &pVCpu->cpum.GstCtx, u16Port, cbReg);
+        if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP || rcStrict == VINF_GCM_HANDLED)
+        {
+            Log(("iemCImpl_in: u16Port=%#x cbReg=%d was handled by GCMIOPortRead (%d)\n", u16Port, cbReg, VBOXSTRICTRC_VAL(rcStrict)));
+            if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP)
+                rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
+            else
+                rcStrict = VINF_SUCCESS;
+            return rcStrict;
+        }
+        Assert(rcStrict == VERR_GCM_NOT_HANDLED);
+    }
+
     /*
      * CPL check

trunk/src/VBox/VMM/VMMAll/VMXAllTemplate.cpp.h

@@ -9003 +9003 @@
             else
             {
-                uint32_t u32Result = 0;
-                rcStrict = IOMIOPortRead(pVM, pVCpu, uIOPort, &u32Result, cbValue);
-                if (IOM_SUCCESS(rcStrict))
+                rcStrict = VERR_GCM_NOT_HANDLED;
+                if (GCMIsInterceptingIOPortRead(pVCpu, uIOPort, cbValue))
                 {
-                    /* Save result of I/O IN instr. in AL/AX/EAX. */
-                    pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Result & uAndVal);
+                    rcStrict = GCMInterceptedIOPortRead(pVCpu, pCtx, uIOPort, cbValue);
+                    if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP || rcStrict == VINF_GCM_HANDLED)
+                    {
+                        /* ASSUMES we don't need to update fCtxChanged when regular GPRs change here. */
+                        fUpdateRipAlready = rcStrict == VINF_GCM_HANDLED;
+                        if (rcStrict == VINF_GCM_HANDLED)
+                            ASMAtomicUoOrU64(&VCPU_2_VMXSTATE(pVCpu).fCtxChanged, HM_CHANGED_GUEST_RIP);
+                        rcStrict = VINF_SUCCESS;
+                    }
+                    else
+                        Assert(rcStrict == VERR_GCM_NOT_HANDLED);
                 }
+
+                if (rcStrict == VERR_GCM_NOT_HANDLED)
+                {
+                    uint32_t u32Result = 0;
+                    rcStrict = IOMIOPortRead(pVM, pVCpu, uIOPort, &u32Result, cbValue);
+                    if (IOM_SUCCESS(rcStrict))
+                    {
+                        /* Save result of I/O IN instr. in AL/AX/EAX. */
+                        /** @todo r=bird: 32-bit op size should clear high bits of rax! */
+                        pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Result & uAndVal);
+                    }
 #ifndef IN_NEM_DARWIN
-                if (    rcStrict == VINF_IOM_R3_IOPORT_READ
-                    && !pCtx->eflags.Bits.u1TF)
-                    rcStrict = EMRZSetPendingIoPortRead(pVCpu, uIOPort, cbInstr, cbValue);
-#endif
+                    if (    rcStrict == VINF_IOM_R3_IOPORT_READ
+                        && !pCtx->eflags.Bits.u1TF)
+                        rcStrict = EMRZSetPendingIoPortRead(pVCpu, uIOPort, cbInstr, cbValue);
+#endif
+                }
                 STAM_COUNTER_INC(&VCPU_2_VMXSTATS(pVCpu).StatExitIORead);
             }

trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp

@@ -7634 +7634 @@
     static uint32_t const s_aIOOpAnd[8] = { 0, 0xff, 0xffff, 0, 0xffffffff, 0, 0, 0 };  /* AND masks for saving
                                                                                            the result (in AL/AX/EAX). */
-    PVMCC      pVM   = pVCpu->CTX_SUFF(pVM);
+    PVMCC    pVM   = pVCpu->CTX_SUFF(pVM);
     PCPUMCTX pCtx  = &pVCpu->cpum.GstCtx;
     PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu);
@@ -7752 +7752 @@
             else
             {
-                uint32_t u32Val = 0;
-                rcStrict = IOMIOPortRead(pVM, pVCpu, IoExitInfo.n.u16Port, &u32Val, cbValue);
-                if (IOM_SUCCESS(rcStrict))
+                rcStrict = VERR_GCM_NOT_HANDLED;
+                if (GCMIsInterceptingIOPortRead(pVCpu, IoExitInfo.n.u16Port, cbValue))
                 {
-                    /* Save result of I/O IN instr. in AL/AX/EAX. */
-                    /** @todo r=bird: 32-bit op size should clear high bits of rax! */
-                    pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
+                    rcStrict = GCMInterceptedIOPortRead(pVCpu, pCtx, IoExitInfo.n.u16Port, cbValue);
+                    if (rcStrict == VINF_GCM_HANDLED_ADVANCE_RIP || rcStrict == VINF_GCM_HANDLED)
+                    {
+                        fUpdateRipAlready = rcStrict != VINF_GCM_HANDLED_ADVANCE_RIP;
+                        rcStrict = VINF_SUCCESS;
+                    }
+                    else
+                        Assert(rcStrict == VERR_GCM_NOT_HANDLED);
                 }
-                else if (    rcStrict == VINF_IOM_R3_IOPORT_READ
-                         && !pCtx->eflags.Bits.u1TF)
-                    rcStrict = EMRZSetPendingIoPortRead(pVCpu, IoExitInfo.n.u16Port, cbInstr, cbValue);
+
+                if (RT_LIKELY(rcStrict == VERR_GCM_NOT_HANDLED))
+                {
+                    uint32_t u32Val = 0;
+                    rcStrict = IOMIOPortRead(pVM, pVCpu, IoExitInfo.n.u16Port, &u32Val, cbValue);
+                    if (IOM_SUCCESS(rcStrict))
+                    {
+                        /* Save result of I/O IN instr. in AL/AX/EAX. */
+                        /** @todo r=bird: 32-bit op size should clear high bits of rax! */
+                        pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
+                    }
+                    else if (    rcStrict == VINF_IOM_R3_IOPORT_READ
+                             && !pCtx->eflags.Bits.u1TF)
+                        rcStrict = EMRZSetPendingIoPortRead(pVCpu, IoExitInfo.n.u16Port, cbInstr, cbValue);
+                }
 
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);

trunk/src/VBox/VMM/VMMR3/GCM.cpp

@@ -115 +115 @@
         { RT_STR_TUPLE("DivByZeroOS2"),       GCMFIXER_DBZ_OS2 },
         { RT_STR_TUPLE("DivByZeroWin9x"),     GCMFIXER_DBZ_WIN9X },
+        { RT_STR_TUPLE("MesaVmsvgaDrv"),      GCMFIXER_MESA_VMSVGA_DRV },
     };
 

trunk/src/VBox/VMM/include/GCMInternal.h

@@ -56 +56 @@
 /** Windows 9x division by zero. */
 #define GCMFIXER_DBZ_WIN9X          RT_BIT_32(2)
+/** Workaround for the Mesa vmsvga driver using a IN/OUT backdoor. */
+#define GCMFIXER_MESA_VMSVGA_DRV    RT_BIT_32(3)
 /** @} */