IEMAllCImplStrInstr.cpp.h@ 105834

Last change on this file since 105834 was 105711, checked in by vboxsync, 3 months ago
VMM/IEM: Ensure that the required segment is up to date in CPUM when interpreting rep outs instructions (fixes assertion and out sync guest context with a Windows XP guest and the NEM/Hyper-V backend), bugref:9993
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 69.0 KB

Line
1	/* $Id: IEMAllCImplStrInstr.cpp.h 105711 2024-08-16 18:04:45Z vboxsync $ */
2	/** @file
3	* IEM - String Instruction Implementation Code Template.
4	*/
5
6	/*
7	* Copyright (C) 2011-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*******************************************************************************
30	* Defined Constants And Macros *
31	*******************************************************************************/
32	#if OP_SIZE == 8
33	# define OP_rAX al
34	#elif OP_SIZE == 16
35	# define OP_rAX ax
36	#elif OP_SIZE == 32
37	# define OP_rAX eax
38	#elif OP_SIZE == 64
39	# define OP_rAX rax
40	#else
41	# error "Bad OP_SIZE."
42	#endif
43	#define OP_TYPE RT_CONCAT3(uint,OP_SIZE,_t)
44
45	#if ADDR_SIZE == 16
46	# define ADDR_rDI di
47	# define ADDR_rSI si
48	# define ADDR_rCX cx
49	# define ADDR2_TYPE uint32_t
50	# define ADDR_VMXSTRIO 0
51	#elif ADDR_SIZE == 32
52	# define ADDR_rDI edi
53	# define ADDR_rSI esi
54	# define ADDR_rCX ecx
55	# define ADDR2_TYPE uint32_t
56	# define ADDR_VMXSTRIO 1
57	#elif ADDR_SIZE == 64
58	# define ADDR_rDI rdi
59	# define ADDR_rSI rsi
60	# define ADDR_rCX rcx
61	# define ADDR2_TYPE uint64_t
62	# define ADDR_VMXSTRIO 2
63	# define IS_64_BIT_CODE(a_pVCpu) (true)
64	#else
65	# error "Bad ADDR_SIZE."
66	#endif
67	#define ADDR_TYPE RT_CONCAT3(uint,ADDR_SIZE,_t)
68
69	#if ADDR_SIZE == 64 \|\| OP_SIZE == 64
70	# define IS_64_BIT_CODE(a_pVCpu) (true)
71	#elif ADDR_SIZE == 32
72	# define IS_64_BIT_CODE(a_pVCpu) IEM_IS_64BIT_CODE(a_pVCpu)
73	#else
74	# define IS_64_BIT_CODE(a_pVCpu) (false)
75	#endif
76
77	/** @def IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN
78	* Used in the outer (page-by-page) loop to check for reasons for returnning
79	* before completing the instruction. In raw-mode we temporarily enable
80	* interrupts to let the host interrupt us. We cannot let big string operations
81	* hog the CPU, especially not in raw-mode.
82	*/
83	#define IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fEflags) \
84	do { \
85	if (RT_LIKELY( !VMCPU_FF_IS_ANY_SET(a_pVCpu, (a_fEflags) & X86_EFL_IF ? VMCPU_FF_YIELD_REPSTR_MASK \
86	: VMCPU_FF_YIELD_REPSTR_NOINT_MASK) \
87	&& !VM_FF_IS_ANY_SET(a_pVM, VM_FF_YIELD_REPSTR_MASK) \
88	)) \
89	{ /* probable */ } \
90	else \
91	{ \
92	LogFlow(("%s: Leaving early (outer)! ffcpu=%#RX64 ffvm=%#x\n", \
93	__FUNCTION__, (uint64_t)(a_pVCpu)->fLocalForcedActions, (a_pVM)->fGlobalForcedActions)); \
94	return VINF_IEM_YIELD_PENDING_FF; \
95	} \
96	} while (0)
97
98	/** @def IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN
99	* This is used in some of the inner loops to make sure we respond immediately
100	* to VMCPU_FF_IOM as well as outside requests. Use this for expensive
101	* instructions. Use IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN for
102	* ones that are typically cheap. */
103	#define IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fExitExpr) \
104	do { \
105	if (RT_LIKELY( ( !VMCPU_FF_IS_ANY_SET(a_pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_REPSTR_MASK) \
106	&& !VM_FF_IS_ANY_SET(a_pVM, VM_FF_HIGH_PRIORITY_POST_REPSTR_MASK)) \
107	\|\| (a_fExitExpr) )) \
108	{ /* very likely */ } \
109	else \
110	{ \
111	LogFlow(("%s: Leaving early (inner)! ffcpu=%#RX64 ffvm=%#x\n", \
112	__FUNCTION__, (uint64_t)(a_pVCpu)->fLocalForcedActions, (a_pVM)->fGlobalForcedActions)); \
113	return VINF_IEM_YIELD_PENDING_FF; \
114	} \
115	} while (0)
116
117
118	/** @def IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN
119	* This is used in the inner loops where
120	* IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN isn't used. It only
121	* checks the CPU FFs so that we respond immediately to the pending IOM FF
122	* (status code is hidden in IEMCPU::rcPassUp by IEM memory commit code).
123	*/
124	#define IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fExitExpr) \
125	do { \
126	if (RT_LIKELY( !VMCPU_FF_IS_ANY_SET(a_pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_REPSTR_MASK) \
127	\|\| (a_fExitExpr) )) \
128	{ /* very likely */ } \
129	else \
130	{ \
131	LogFlow(("%s: Leaving early (inner)! ffcpu=%#RX64 (ffvm=%#x)\n", \
132	__FUNCTION__, (uint64_t)(a_pVCpu)->fLocalForcedActions, (a_pVM)->fGlobalForcedActions)); \
133	return VINF_IEM_YIELD_PENDING_FF; \
134	} \
135	} while (0)
136
137
138	/**
139	* Implements 'REPE CMPS'.
140	*/
141	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_repe_cmps_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
142	{
143	PVM pVM = pVCpu->CTX_SUFF(pVM);
144
145	/*
146	* Setup.
147	*/
148	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
149	if (uCounterReg == 0)
150	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
151
152	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iEffSeg) \| CPUMCTX_EXTRN_ES);
153
154	PCCPUMSELREGHID pSrc1Hid = iemSRegGetHid(pVCpu, iEffSeg);
155	uint64_t uSrc1Base = 0; /* gcc may not be used uninitialized */
156	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
157	if (rcStrict != VINF_SUCCESS)
158	return rcStrict;
159
160	uint64_t uSrc2Base = 0; /* gcc may not be used uninitialized */
161	rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uSrc2Base);
162	if (rcStrict != VINF_SUCCESS)
163	return rcStrict;
164
165	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
166	ADDR_TYPE uSrc1AddrReg = pVCpu->cpum.GstCtx.ADDR_rSI;
167	ADDR_TYPE uSrc2AddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
168	uint32_t uEFlags = pVCpu->cpum.GstCtx.eflags.u;
169
170	/*
171	* The loop.
172	*/
173	for (;;)
174	{
175	/*
176	* Do segmentation and virtual page stuff.
177	*/
178	ADDR2_TYPE uVirtSrc1Addr = uSrc1AddrReg + (ADDR2_TYPE)uSrc1Base;
179	ADDR2_TYPE uVirtSrc2Addr = uSrc2AddrReg + (ADDR2_TYPE)uSrc2Base;
180	uint32_t cLeftSrc1Page = (GUEST_PAGE_SIZE - (uVirtSrc1Addr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
181	if (cLeftSrc1Page > uCounterReg)
182	cLeftSrc1Page = uCounterReg;
183	uint32_t cLeftSrc2Page = (GUEST_PAGE_SIZE - (uVirtSrc2Addr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
184	uint32_t cLeftPage = RT_MIN(cLeftSrc1Page, cLeftSrc2Page);
185
186	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
187	&& cbIncr > 0 /** @todo Optimize reverse direction string ops. */
188	&& ( IS_64_BIT_CODE(pVCpu)
189	\|\| ( uSrc1AddrReg < pSrc1Hid->u32Limit
190	&& uSrc1AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrc1Hid->u32Limit
191	&& uSrc2AddrReg < pVCpu->cpum.GstCtx.es.u32Limit
192	&& uSrc2AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
193	)
194	)
195	{
196	RTGCPHYS GCPhysSrc1Mem;
197	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc1Addr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
198	if (rcStrict != VINF_SUCCESS)
199	return rcStrict;
200
201	RTGCPHYS GCPhysSrc2Mem;
202	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc2Addr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
203	if (rcStrict != VINF_SUCCESS)
204	return rcStrict;
205
206	/*
207	* If we can map the page without trouble, do a block processing
208	* until the end of the current page.
209	*/
210	PGMPAGEMAPLOCK PgLockSrc2Mem;
211	OP_TYPE const *puSrc2Mem;
212	rcStrict = iemMemPageMap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
213	if (rcStrict == VINF_SUCCESS)
214	{
215	PGMPAGEMAPLOCK PgLockSrc1Mem;
216	OP_TYPE const *puSrc1Mem;
217	rcStrict = iemMemPageMap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
218	if (rcStrict == VINF_SUCCESS)
219	{
220	if (!memcmp(puSrc2Mem, puSrc1Mem, cLeftPage * (OP_SIZE / 8)))
221	{
222	/* All matches, only compare the last itme to get the right eflags. */
223	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&puSrc1Mem[cLeftPage-1], puSrc2Mem[cLeftPage-1]);
224	uSrc1AddrReg += cLeftPage * cbIncr;
225	uSrc2AddrReg += cLeftPage * cbIncr;
226	uCounterReg -= cLeftPage;
227	}
228	else
229	{
230	/* Some mismatch, compare each item (and keep volatile
231	memory in mind). */
232	uint32_t off = 0;
233	do
234	{
235	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&puSrc1Mem[off], puSrc2Mem[off]);
236	off++;
237	} while ( off < cLeftPage
238	&& (uEFlags & X86_EFL_ZF));
239	uSrc1AddrReg += cbIncr * off;
240	uSrc2AddrReg += cbIncr * off;
241	uCounterReg -= off;
242	}
243
244	/* Update the registers before looping. */
245	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg;
246	pVCpu->cpum.GstCtx.ADDR_rSI = uSrc1AddrReg;
247	pVCpu->cpum.GstCtx.ADDR_rDI = uSrc2AddrReg;
248	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
249
250	iemMemPageUnmap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
251	iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
252	if ( uCounterReg == 0
253	\|\| !(uEFlags & X86_EFL_ZF))
254	break;
255	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
256	continue;
257	}
258	iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
259	}
260	}
261
262	/*
263	* Fallback - slow processing till the end of the current page.
264	* In the cross page boundrary case we will end up here with cLeftPage
265	* as 0, we execute one loop then.
266	*/
267	do
268	{
269	OP_TYPE uValue1;
270	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue1, iEffSeg, uSrc1AddrReg);
271	if (rcStrict != VINF_SUCCESS)
272	return rcStrict;
273	OP_TYPE uValue2;
274	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
275	if (rcStrict != VINF_SUCCESS)
276	return rcStrict;
277	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, &uValue1, uValue2);
278
279	pVCpu->cpum.GstCtx.ADDR_rSI = uSrc1AddrReg += cbIncr;
280	pVCpu->cpum.GstCtx.ADDR_rDI = uSrc2AddrReg += cbIncr;
281	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
282	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
283	cLeftPage--;
284	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 \|\| !(uEFlags & X86_EFL_ZF));
285	} while ( (int32_t)cLeftPage > 0
286	&& (uEFlags & X86_EFL_ZF));
287
288	/*
289	* Next page? Must check for interrupts and stuff here.
290	*/
291	if ( uCounterReg == 0
292	\|\| !(uEFlags & X86_EFL_ZF))
293	break;
294	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
295	}
296
297	/*
298	* Done.
299	*/
300	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
301	}
302
303
304	/**
305	* Implements 'REPNE CMPS'.
306	*/
307	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_repne_cmps_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
308	{
309	PVM pVM = pVCpu->CTX_SUFF(pVM);
310
311	/*
312	* Setup.
313	*/
314	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
315	if (uCounterReg == 0)
316	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
317
318	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iEffSeg) \| CPUMCTX_EXTRN_ES);
319
320	PCCPUMSELREGHID pSrc1Hid = iemSRegGetHid(pVCpu, iEffSeg);
321	uint64_t uSrc1Base = 0; /* gcc may not be used uninitialized */;
322	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
323	if (rcStrict != VINF_SUCCESS)
324	return rcStrict;
325
326	uint64_t uSrc2Base = 0; /* gcc may not be used uninitialized */
327	rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uSrc2Base);
328	if (rcStrict != VINF_SUCCESS)
329	return rcStrict;
330
331	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
332	ADDR_TYPE uSrc1AddrReg = pVCpu->cpum.GstCtx.ADDR_rSI;
333	ADDR_TYPE uSrc2AddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
334	uint32_t uEFlags = pVCpu->cpum.GstCtx.eflags.u;
335
336	/*
337	* The loop.
338	*/
339	for (;;)
340	{
341	/*
342	* Do segmentation and virtual page stuff.
343	*/
344	ADDR2_TYPE uVirtSrc1Addr = uSrc1AddrReg + (ADDR2_TYPE)uSrc1Base;
345	ADDR2_TYPE uVirtSrc2Addr = uSrc2AddrReg + (ADDR2_TYPE)uSrc2Base;
346	uint32_t cLeftSrc1Page = (GUEST_PAGE_SIZE - (uVirtSrc1Addr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
347	if (cLeftSrc1Page > uCounterReg)
348	cLeftSrc1Page = uCounterReg;
349	uint32_t cLeftSrc2Page = (GUEST_PAGE_SIZE - (uVirtSrc2Addr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
350	uint32_t cLeftPage = RT_MIN(cLeftSrc1Page, cLeftSrc2Page);
351
352	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
353	&& cbIncr > 0 /** @todo Optimize reverse direction string ops. */
354	&& ( IS_64_BIT_CODE(pVCpu)
355	\|\| ( uSrc1AddrReg < pSrc1Hid->u32Limit
356	&& uSrc1AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrc1Hid->u32Limit
357	&& uSrc2AddrReg < pVCpu->cpum.GstCtx.es.u32Limit
358	&& uSrc2AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
359	)
360	)
361	{
362	RTGCPHYS GCPhysSrc1Mem;
363	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc1Addr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
364	if (rcStrict != VINF_SUCCESS)
365	return rcStrict;
366
367	RTGCPHYS GCPhysSrc2Mem;
368	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc2Addr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
369	if (rcStrict != VINF_SUCCESS)
370	return rcStrict;
371
372	/*
373	* If we can map the page without trouble, do a block processing
374	* until the end of the current page.
375	*/
376	OP_TYPE const *puSrc2Mem;
377	PGMPAGEMAPLOCK PgLockSrc2Mem;
378	rcStrict = iemMemPageMap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
379	if (rcStrict == VINF_SUCCESS)
380	{
381	OP_TYPE const *puSrc1Mem;
382	PGMPAGEMAPLOCK PgLockSrc1Mem;
383	rcStrict = iemMemPageMap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
384	if (rcStrict == VINF_SUCCESS)
385	{
386	if (memcmp(puSrc2Mem, puSrc1Mem, cLeftPage * (OP_SIZE / 8)))
387	{
388	/* All matches, only compare the last item to get the right eflags. */
389	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&puSrc1Mem[cLeftPage-1], puSrc2Mem[cLeftPage-1]);
390	uSrc1AddrReg += cLeftPage * cbIncr;
391	uSrc2AddrReg += cLeftPage * cbIncr;
392	uCounterReg -= cLeftPage;
393	}
394	else
395	{
396	/* Some mismatch, compare each item (and keep volatile
397	memory in mind). */
398	uint32_t off = 0;
399	do
400	{
401	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&puSrc1Mem[off], puSrc2Mem[off]);
402	off++;
403	} while ( off < cLeftPage
404	&& !(uEFlags & X86_EFL_ZF));
405	uSrc1AddrReg += cbIncr * off;
406	uSrc2AddrReg += cbIncr * off;
407	uCounterReg -= off;
408	}
409
410	/* Update the registers before looping. */
411	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg;
412	pVCpu->cpum.GstCtx.ADDR_rSI = uSrc1AddrReg;
413	pVCpu->cpum.GstCtx.ADDR_rDI = uSrc2AddrReg;
414	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
415
416	iemMemPageUnmap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
417	iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
418	if ( uCounterReg == 0
419	\|\| (uEFlags & X86_EFL_ZF))
420	break;
421	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
422	continue;
423	}
424	iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
425	}
426	}
427
428	/*
429	* Fallback - slow processing till the end of the current page.
430	* In the cross page boundrary case we will end up here with cLeftPage
431	* as 0, we execute one loop then.
432	*/
433	do
434	{
435	OP_TYPE uValue1;
436	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue1, iEffSeg, uSrc1AddrReg);
437	if (rcStrict != VINF_SUCCESS)
438	return rcStrict;
439	OP_TYPE uValue2;
440	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
441	if (rcStrict != VINF_SUCCESS)
442	return rcStrict;
443	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, &uValue1, uValue2);
444
445	pVCpu->cpum.GstCtx.ADDR_rSI = uSrc1AddrReg += cbIncr;
446	pVCpu->cpum.GstCtx.ADDR_rDI = uSrc2AddrReg += cbIncr;
447	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
448	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
449	cLeftPage--;
450	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 \|\| (uEFlags & X86_EFL_ZF));
451	} while ( (int32_t)cLeftPage > 0
452	&& !(uEFlags & X86_EFL_ZF));
453
454	/*
455	* Next page? Must check for interrupts and stuff here.
456	*/
457	if ( uCounterReg == 0
458	\|\| (uEFlags & X86_EFL_ZF))
459	break;
460	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
461	}
462
463	/*
464	* Done.
465	*/
466	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
467	}
468
469
470	/**
471	* Implements 'REPE SCAS'.
472	*/
473	IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_repe_scas_,OP_rAX,_m,ADDR_SIZE))
474	{
475	PVM pVM = pVCpu->CTX_SUFF(pVM);
476
477	/*
478	* Setup.
479	*/
480	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
481	if (uCounterReg == 0)
482	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
483
484	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ES);
485	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
486	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uBaseAddr);
487	if (rcStrict != VINF_SUCCESS)
488	return rcStrict;
489
490	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
491	OP_TYPE const uValueReg = pVCpu->cpum.GstCtx.OP_rAX;
492	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
493	uint32_t uEFlags = pVCpu->cpum.GstCtx.eflags.u;
494
495	/*
496	* The loop.
497	*/
498	for (;;)
499	{
500	/*
501	* Do segmentation and virtual page stuff.
502	*/
503	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
504	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
505	if (cLeftPage > uCounterReg)
506	cLeftPage = uCounterReg;
507	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
508	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
509	&& ( IS_64_BIT_CODE(pVCpu)
510	\|\| ( uAddrReg < pVCpu->cpum.GstCtx.es.u32Limit
511	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
512	)
513	)
514	{
515	RTGCPHYS GCPhysMem;
516	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysMem);
517	if (rcStrict != VINF_SUCCESS)
518	return rcStrict;
519
520	/*
521	* If we can map the page without trouble, do a block processing
522	* until the end of the current page.
523	*/
524	PGMPAGEMAPLOCK PgLockMem;
525	OP_TYPE const *puMem;
526	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
527	if (rcStrict == VINF_SUCCESS)
528	{
529	/* Search till we find a mismatching item. */
530	OP_TYPE uTmpValue;
531	bool fQuit;
532	uint32_t i = 0;
533	do
534	{
535	uTmpValue = puMem[i++];
536	fQuit = uTmpValue != uValueReg;
537	} while (i < cLeftPage && !fQuit);
538
539	/* Update the regs. */
540	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&uValueReg, uTmpValue);
541	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= i;
542	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += i * cbIncr;
543	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
544	Assert(!(uEFlags & X86_EFL_ZF) == fQuit);
545	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
546	if ( fQuit
547	\|\| uCounterReg == 0)
548	break;
549
550	/* If unaligned, we drop thru and do the page crossing access
551	below. Otherwise, do the next page. */
552	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
553	{
554	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
555	continue;
556	}
557	cLeftPage = 0;
558	}
559	}
560
561	/*
562	* Fallback - slow processing till the end of the current page.
563	* In the cross page boundrary case we will end up here with cLeftPage
564	* as 0, we execute one loop then.
565	*/
566	do
567	{
568	OP_TYPE uTmpValue;
569	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
570	if (rcStrict != VINF_SUCCESS)
571	return rcStrict;
572	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&uValueReg, uTmpValue);
573
574	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cbIncr;
575	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
576	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
577	cLeftPage--;
578	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 \|\| !(uEFlags & X86_EFL_ZF));
579	} while ( (int32_t)cLeftPage > 0
580	&& (uEFlags & X86_EFL_ZF));
581
582	/*
583	* Next page? Must check for interrupts and stuff here.
584	*/
585	if ( uCounterReg == 0
586	\|\| !(uEFlags & X86_EFL_ZF))
587	break;
588	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
589	}
590
591	/*
592	* Done.
593	*/
594	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
595	}
596
597
598	/**
599	* Implements 'REPNE SCAS'.
600	*/
601	IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_repne_scas_,OP_rAX,_m,ADDR_SIZE))
602	{
603	PVM pVM = pVCpu->CTX_SUFF(pVM);
604
605	/*
606	* Setup.
607	*/
608	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
609	if (uCounterReg == 0)
610	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
611
612	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ES);
613	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
614	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uBaseAddr);
615	if (rcStrict != VINF_SUCCESS)
616	return rcStrict;
617
618	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
619	OP_TYPE const uValueReg = pVCpu->cpum.GstCtx.OP_rAX;
620	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
621	uint32_t uEFlags = pVCpu->cpum.GstCtx.eflags.u;
622
623	/*
624	* The loop.
625	*/
626	for (;;)
627	{
628	/*
629	* Do segmentation and virtual page stuff.
630	*/
631	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
632	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
633	if (cLeftPage > uCounterReg)
634	cLeftPage = uCounterReg;
635	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
636	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
637	&& ( IS_64_BIT_CODE(pVCpu)
638	\|\| ( uAddrReg < pVCpu->cpum.GstCtx.es.u32Limit
639	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
640	)
641	)
642	{
643	RTGCPHYS GCPhysMem;
644	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysMem);
645	if (rcStrict != VINF_SUCCESS)
646	return rcStrict;
647
648	/*
649	* If we can map the page without trouble, do a block processing
650	* until the end of the current page.
651	*/
652	PGMPAGEMAPLOCK PgLockMem;
653	OP_TYPE const *puMem;
654	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
655	if (rcStrict == VINF_SUCCESS)
656	{
657	/* Search till we find a mismatching item. */
658	OP_TYPE uTmpValue;
659	bool fQuit;
660	uint32_t i = 0;
661	do
662	{
663	uTmpValue = puMem[i++];
664	fQuit = uTmpValue == uValueReg;
665	} while (i < cLeftPage && !fQuit);
666
667	/* Update the regs. */
668	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&uValueReg, uTmpValue);
669	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= i;
670	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += i * cbIncr;
671	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
672	Assert(!!(uEFlags & X86_EFL_ZF) == fQuit);
673	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
674	if ( fQuit
675	\|\| uCounterReg == 0)
676	break;
677
678	/* If unaligned, we drop thru and do the page crossing access
679	below. Otherwise, do the next page. */
680	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
681	{
682	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
683	continue;
684	}
685	cLeftPage = 0;
686	}
687	}
688
689	/*
690	* Fallback - slow processing till the end of the current page.
691	* In the cross page boundrary case we will end up here with cLeftPage
692	* as 0, we execute one loop then.
693	*/
694	do
695	{
696	OP_TYPE uTmpValue;
697	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
698	if (rcStrict != VINF_SUCCESS)
699	return rcStrict;
700	uEFlags = RT_CONCAT(iemAImpl_cmp_u,OP_SIZE)(uEFlags, (OP_TYPE *)&uValueReg, uTmpValue);
701	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cbIncr;
702	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
703	pVCpu->cpum.GstCtx.eflags.u = uEFlags;
704	cLeftPage--;
705	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 \|\| (uEFlags & X86_EFL_ZF));
706	} while ( (int32_t)cLeftPage > 0
707	&& !(uEFlags & X86_EFL_ZF));
708
709	/*
710	* Next page? Must check for interrupts and stuff here.
711	*/
712	if ( uCounterReg == 0
713	\|\| (uEFlags & X86_EFL_ZF))
714	break;
715	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
716	}
717
718	/*
719	* Done.
720	*/
721	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
722	}
723
724
725
726
727	/**
728	* Implements 'REP MOVS'.
729	*/
730	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_rep_movs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
731	{
732	PVM pVM = pVCpu->CTX_SUFF(pVM);
733
734	/*
735	* Setup.
736	*/
737	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
738	if (uCounterReg == 0)
739	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
740
741	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iEffSeg) \| CPUMCTX_EXTRN_ES);
742
743	PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pVCpu, iEffSeg);
744	uint64_t uSrcBase = 0; /* gcc may not be used uninitialized */
745	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrcHid, iEffSeg, &uSrcBase);
746	if (rcStrict != VINF_SUCCESS)
747	return rcStrict;
748
749	uint64_t uDstBase = 0; /* gcc may not be used uninitialized */
750	rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uDstBase);
751	if (rcStrict != VINF_SUCCESS)
752	return rcStrict;
753
754	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
755	ADDR_TYPE uSrcAddrReg = pVCpu->cpum.GstCtx.ADDR_rSI;
756	ADDR_TYPE uDstAddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
757
758	/*
759	* Be careful with handle bypassing.
760	*/
761	if (pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS)
762	{
763	Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
764	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
765	}
766
767	/*
768	* The loop.
769	*/
770	for (;;)
771	{
772	/*
773	* Do segmentation and virtual page stuff.
774	*/
775	ADDR2_TYPE uVirtSrcAddr = uSrcAddrReg + (ADDR2_TYPE)uSrcBase;
776	ADDR2_TYPE uVirtDstAddr = uDstAddrReg + (ADDR2_TYPE)uDstBase;
777	uint32_t cLeftSrcPage = (GUEST_PAGE_SIZE - (uVirtSrcAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
778	if (cLeftSrcPage > uCounterReg)
779	cLeftSrcPage = uCounterReg;
780	uint32_t cLeftDstPage = (GUEST_PAGE_SIZE - (uVirtDstAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
781	uint32_t cLeftPage = RT_MIN(cLeftSrcPage, cLeftDstPage);
782
783	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
784	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
785	&& ( IS_64_BIT_CODE(pVCpu)
786	\|\| ( uSrcAddrReg < pSrcHid->u32Limit
787	&& uSrcAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrcHid->u32Limit
788	&& uDstAddrReg < pVCpu->cpum.GstCtx.es.u32Limit
789	&& uDstAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
790	)
791	)
792	{
793	RTGCPHYS GCPhysSrcMem;
794	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrcAddr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysSrcMem);
795	if (rcStrict != VINF_SUCCESS)
796	return rcStrict;
797
798	RTGCPHYS GCPhysDstMem;
799	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtDstAddr, OP_SIZE / 8, IEM_ACCESS_DATA_W, &GCPhysDstMem);
800	if (rcStrict != VINF_SUCCESS)
801	return rcStrict;
802
803	/*
804	* If we can map the page without trouble, do a block processing
805	* until the end of the current page.
806	*/
807	PGMPAGEMAPLOCK PgLockDstMem;
808	OP_TYPE *puDstMem;
809	rcStrict = iemMemPageMap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, (void **)&puDstMem, &PgLockDstMem);
810	if (rcStrict == VINF_SUCCESS)
811	{
812	PGMPAGEMAPLOCK PgLockSrcMem;
813	OP_TYPE const *puSrcMem;
814	rcStrict = iemMemPageMap(pVCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, (void **)&puSrcMem, &PgLockSrcMem);
815	if (rcStrict == VINF_SUCCESS)
816	{
817	Assert( (GCPhysSrcMem >> GUEST_PAGE_SHIFT) != (GCPhysDstMem >> GUEST_PAGE_SHIFT)
818	\|\| ((uintptr_t)puSrcMem >> GUEST_PAGE_SHIFT) == ((uintptr_t)puDstMem >> GUEST_PAGE_SHIFT));
819
820	/* Perform the operation exactly (don't use memcpy to avoid
821	having to consider how its implementation would affect
822	any overlapping source and destination area). */
823	OP_TYPE const *puSrcCur = puSrcMem;
824	OP_TYPE *puDstCur = puDstMem;
825	uint32_t cTodo = cLeftPage;
826	while (cTodo-- > 0)
827	puDstCur++ = puSrcCur++;
828
829	/* Update the registers. */
830	pVCpu->cpum.GstCtx.ADDR_rSI = uSrcAddrReg += cLeftPage * cbIncr;
831	pVCpu->cpum.GstCtx.ADDR_rDI = uDstAddrReg += cLeftPage * cbIncr;
832	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cLeftPage;
833
834	iemMemPageUnmap(pVCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, puSrcMem, &PgLockSrcMem);
835	iemMemPageUnmap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
836
837	if (uCounterReg == 0)
838	break;
839	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
840	continue;
841	}
842	iemMemPageUnmap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
843	}
844	}
845
846	/*
847	* Fallback - slow processing till the end of the current page.
848	* In the cross page boundrary case we will end up here with cLeftPage
849	* as 0, we execute one loop then.
850	*/
851	do
852	{
853	OP_TYPE uValue;
854	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, uSrcAddrReg);
855	if (rcStrict != VINF_SUCCESS)
856	return rcStrict;
857	rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pVCpu, X86_SREG_ES, uDstAddrReg, uValue);
858	if (rcStrict != VINF_SUCCESS)
859	return rcStrict;
860
861	pVCpu->cpum.GstCtx.ADDR_rSI = uSrcAddrReg += cbIncr;
862	pVCpu->cpum.GstCtx.ADDR_rDI = uDstAddrReg += cbIncr;
863	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
864	cLeftPage--;
865	IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
866	} while ((int32_t)cLeftPage > 0);
867
868	/*
869	* Next page. Must check for interrupts and stuff here.
870	*/
871	if (uCounterReg == 0)
872	break;
873	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
874	}
875
876	/*
877	* Done.
878	*/
879	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
880	}
881
882
883	/**
884	* Implements 'REP STOS'.
885	*/
886	IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_stos_,OP_rAX,_m,ADDR_SIZE))
887	{
888	PVM pVM = pVCpu->CTX_SUFF(pVM);
889
890	/*
891	* Setup.
892	*/
893	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
894	if (uCounterReg == 0)
895	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
896
897	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ES);
898
899	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
900	VBOXSTRICTRC rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uBaseAddr);
901	if (rcStrict != VINF_SUCCESS)
902	return rcStrict;
903
904	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
905	OP_TYPE const uValue = pVCpu->cpum.GstCtx.OP_rAX;
906	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
907
908	/*
909	* Be careful with handle bypassing.
910	*/
911	/** @todo Permit doing a page if correctly aligned. */
912	if (pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS)
913	{
914	Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
915	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
916	}
917
918	/*
919	* The loop.
920	*/
921	for (;;)
922	{
923	/*
924	* Do segmentation and virtual page stuff.
925	*/
926	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
927	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
928	if (cLeftPage > uCounterReg)
929	cLeftPage = uCounterReg;
930	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
931	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
932	&& ( IS_64_BIT_CODE(pVCpu)
933	\|\| ( uAddrReg < pVCpu->cpum.GstCtx.es.u32Limit
934	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
935	)
936	)
937	{
938	RTGCPHYS GCPhysMem;
939	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_W, &GCPhysMem);
940	if (rcStrict != VINF_SUCCESS)
941	return rcStrict;
942
943	/*
944	* If we can map the page without trouble, do a block processing
945	* until the end of the current page.
946	*/
947	PGMPAGEMAPLOCK PgLockMem;
948	OP_TYPE *puMem;
949	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
950	if (rcStrict == VINF_SUCCESS)
951	{
952	/* Update the regs first so we can loop on cLeftPage. */
953	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cLeftPage;
954	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cLeftPage * cbIncr;
955
956	/* Do the memsetting. */
957	#if OP_SIZE == 8
958	memset(puMem, uValue, cLeftPage);
959	/*#elif OP_SIZE == 32
960	ASMMemFill32(puMem, cLeftPage * (OP_SIZE / 8), uValue);*/
961	#else
962	while (cLeftPage-- > 0)
963	*puMem++ = uValue;
964	#endif
965
966	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
967
968	if (uCounterReg == 0)
969	break;
970
971	/* If unaligned, we drop thru and do the page crossing access
972	below. Otherwise, do the next page. */
973	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
974	{
975	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
976	continue;
977	}
978	cLeftPage = 0;
979	}
980	/* If we got an invalid physical address in the page table, just skip
981	ahead to the next page or the counter reaches zero. This crazy
982	optimization is for a buggy EFI firmware that's driving me nuts. */
983	else if (rcStrict == VERR_PGM_PHYS_TLB_UNASSIGNED)
984	{
985	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cLeftPage;
986	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cLeftPage * cbIncr;
987	if (uCounterReg == 0)
988	break;
989	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
990	{
991	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
992	continue;
993	}
994	}
995	}
996
997	/*
998	* Fallback - slow processing till the end of the current page.
999	* In the cross page boundrary case we will end up here with cLeftPage
1000	* as 0, we execute one loop then.
1001	*/
1002	do
1003	{
1004	rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pVCpu, X86_SREG_ES, uAddrReg, uValue);
1005	if (rcStrict != VINF_SUCCESS)
1006	return rcStrict;
1007	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cbIncr;
1008	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
1009	cLeftPage--;
1010	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
1011	} while ((int32_t)cLeftPage > 0);
1012
1013	/*
1014	* Next page. Must check for interrupts and stuff here.
1015	*/
1016	if (uCounterReg == 0)
1017	break;
1018	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1019	}
1020
1021	/*
1022	* Done.
1023	*/
1024	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1025	}
1026
1027
1028	/**
1029	* Implements 'REP LODS'.
1030	*/
1031	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_lods_,OP_rAX,_m,ADDR_SIZE), int8_t, iEffSeg)
1032	{
1033	PVM pVM = pVCpu->CTX_SUFF(pVM);
1034
1035	/*
1036	* Setup.
1037	*/
1038	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
1039	if (uCounterReg == 0)
1040	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1041
1042	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iEffSeg));
1043	PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pVCpu, iEffSeg);
1044	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
1045	VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrcHid, iEffSeg, &uBaseAddr);
1046	if (rcStrict != VINF_SUCCESS)
1047	return rcStrict;
1048
1049	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
1050	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rSI;
1051
1052	/*
1053	* The loop.
1054	*/
1055	for (;;)
1056	{
1057	/*
1058	* Do segmentation and virtual page stuff.
1059	*/
1060	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
1061	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
1062	if (cLeftPage > uCounterReg)
1063	cLeftPage = uCounterReg;
1064	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
1065	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
1066	&& ( IS_64_BIT_CODE(pVCpu)
1067	\|\| ( uAddrReg < pSrcHid->u32Limit
1068	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrcHid->u32Limit)
1069	)
1070	)
1071	{
1072	RTGCPHYS GCPhysMem;
1073	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysMem);
1074	if (rcStrict != VINF_SUCCESS)
1075	return rcStrict;
1076
1077	/*
1078	* If we can map the page without trouble, we can get away with
1079	* just reading the last value on the page.
1080	*/
1081	PGMPAGEMAPLOCK PgLockMem;
1082	OP_TYPE const *puMem;
1083	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
1084	if (rcStrict == VINF_SUCCESS)
1085	{
1086	/* Only get the last byte, the rest doesn't matter in direct access mode. */
1087	#if OP_SIZE == 32
1088	pVCpu->cpum.GstCtx.rax = puMem[cLeftPage - 1];
1089	#else
1090	pVCpu->cpum.GstCtx.OP_rAX = puMem[cLeftPage - 1];
1091	#endif
1092	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cLeftPage;
1093	pVCpu->cpum.GstCtx.ADDR_rSI = uAddrReg += cLeftPage * cbIncr;
1094	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
1095
1096	if (uCounterReg == 0)
1097	break;
1098
1099	/* If unaligned, we drop thru and do the page crossing access
1100	below. Otherwise, do the next page. */
1101	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
1102	{
1103	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1104	continue;
1105	}
1106	cLeftPage = 0;
1107	}
1108	}
1109
1110	/*
1111	* Fallback - slow processing till the end of the current page.
1112	* In the cross page boundrary case we will end up here with cLeftPage
1113	* as 0, we execute one loop then.
1114	*/
1115	do
1116	{
1117	OP_TYPE uTmpValue;
1118	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, iEffSeg, uAddrReg);
1119	if (rcStrict != VINF_SUCCESS)
1120	return rcStrict;
1121	#if OP_SIZE == 32
1122	pVCpu->cpum.GstCtx.rax = uTmpValue;
1123	#else
1124	pVCpu->cpum.GstCtx.OP_rAX = uTmpValue;
1125	#endif
1126	pVCpu->cpum.GstCtx.ADDR_rSI = uAddrReg += cbIncr;
1127	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
1128	cLeftPage--;
1129	IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
1130	} while ((int32_t)cLeftPage > 0);
1131
1132	/*
1133	* Next page. Must check for interrupts and stuff here.
1134	*/
1135	if (uCounterReg == 0)
1136	break;
1137	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1138	}
1139
1140	/*
1141	* Done.
1142	*/
1143	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1144	}
1145
1146
1147	#if OP_SIZE != 64
1148
1149	/**
1150	* Implements 'INS' (no rep)
1151	*/
1152	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_ins_op,OP_SIZE,_addr,ADDR_SIZE), bool, fIoChecked)
1153	{
1154	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1155	VBOXSTRICTRC rcStrict;
1156
1157	/*
1158	* Be careful with handle bypassing.
1159	*/
1160	if (pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS)
1161	{
1162	Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
1163	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1164	}
1165
1166	/*
1167	* ASSUMES the #GP for I/O permission is taken first, then any #GP for
1168	* segmentation and finally any #PF due to virtual address translation.
1169	* ASSUMES nothing is read from the I/O port before traps are taken.
1170	*/
1171	if (!fIoChecked)
1172	{
1173	rcStrict = iemHlpCheckPortIOPermission(pVCpu, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8);
1174	if (rcStrict != VINF_SUCCESS)
1175	return rcStrict;
1176	}
1177
1178	/*
1179	* Check nested-guest I/O intercepts.
1180	*/
1181	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1182	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
1183	{
1184	VMXEXITINSTRINFO ExitInstrInfo;
1185	ExitInstrInfo.u = 0;
1186	ExitInstrInfo.StrIo.u3AddrSize = ADDR_VMXSTRIO;
1187	ExitInstrInfo.StrIo.iSegReg = X86_SREG_ES;
1188	rcStrict = iemVmxVmexitInstrStrIo(pVCpu, VMXINSTRID_IO_INS, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8, false /* fRep */,
1189	ExitInstrInfo, cbInstr);
1190	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
1191	return rcStrict;
1192	}
1193	#endif
1194
1195	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1196	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
1197	{
1198	rcStrict = iemSvmHandleIOIntercept(pVCpu, pVCpu->cpum.GstCtx.dx, SVMIOIOTYPE_IN, OP_SIZE / 8, ADDR_SIZE, X86_SREG_ES,
1199	false /* fRep /, true / fStrIo */, cbInstr);
1200	if (rcStrict == VINF_SVM_VMEXIT)
1201	return VINF_SUCCESS;
1202	if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
1203	{
1204	Log(("iemCImpl_ins_op: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", pVCpu->cpum.GstCtx.dx,
1205	OP_SIZE / 8, VBOXSTRICTRC_VAL(rcStrict)));
1206	return rcStrict;
1207	}
1208	}
1209	#endif
1210
1211	uint8_t bUnmapInfo;
1212	OP_TYPE *puMem;
1213	rcStrict = iemMemMap(pVCpu, (void **)&puMem, &bUnmapInfo, OP_SIZE / 8, X86_SREG_ES, pVCpu->cpum.GstCtx.ADDR_rDI,
1214	IEM_ACCESS_DATA_W, OP_SIZE / 8 - 1);
1215	if (rcStrict != VINF_SUCCESS)
1216	return rcStrict;
1217
1218	uint32_t u32Value = 0;
1219	rcStrict = IOMIOPortRead(pVM, pVCpu, pVCpu->cpum.GstCtx.dx, &u32Value, OP_SIZE / 8);
1220	if (IOM_SUCCESS(rcStrict))
1221	{
1222	/**
1223	* @todo I/O breakpoint support for INS
1224	*/
1225	*puMem = (OP_TYPE)u32Value;
1226	# ifdef IN_RING3
1227	VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1228	# else
1229	VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, bUnmapInfo);
1230	# endif
1231	if (RT_LIKELY(rcStrict2 == VINF_SUCCESS))
1232	{
1233	if (!pVCpu->cpum.GstCtx.eflags.Bits.u1DF)
1234	pVCpu->cpum.GstCtx.ADDR_rDI += OP_SIZE / 8;
1235	else
1236	pVCpu->cpum.GstCtx.ADDR_rDI -= OP_SIZE / 8;
1237
1238	/** @todo finish: work out how this should work wrt status codes. Not sure we
1239	* can use iemSetPassUpStatus here, but it depends on what
1240	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1241	rcStrict2 = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1242	if (rcStrict2 != VINF_SUCCESS)
1243	{
1244	iemSetPassUpStatus(pVCpu, rcStrict);
1245	rcStrict = rcStrict2;
1246	}
1247	pVCpu->iem.s.cPotentialExits++;
1248	}
1249	else
1250	AssertLogRelMsgFailedReturn(("rcStrict2=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)), RT_FAILURE_NP(rcStrict2) ? rcStrict2 : VERR_IEM_IPE_1);
1251	}
1252	return rcStrict;
1253	}
1254
1255
1256	/**
1257	* Implements 'REP INS'.
1258	*/
1259	IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_rep_ins_op,OP_SIZE,_addr,ADDR_SIZE), bool, fIoChecked)
1260	{
1261	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1262
1263	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ES \| CPUMCTX_EXTRN_TR);
1264
1265	/*
1266	* Setup.
1267	*/
1268	uint16_t const u16Port = pVCpu->cpum.GstCtx.dx;
1269	VBOXSTRICTRC rcStrict;
1270	if (!fIoChecked)
1271	{
1272	/** @todo check if this is too early for ecx=0. */
1273	rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, OP_SIZE / 8);
1274	if (rcStrict != VINF_SUCCESS)
1275	return rcStrict;
1276	}
1277
1278	/*
1279	* Check nested-guest I/O intercepts.
1280	*/
1281	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1282	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
1283	{
1284	VMXEXITINSTRINFO ExitInstrInfo;
1285	ExitInstrInfo.u = 0;
1286	ExitInstrInfo.StrIo.u3AddrSize = ADDR_VMXSTRIO;
1287	ExitInstrInfo.StrIo.iSegReg = X86_SREG_ES;
1288	rcStrict = iemVmxVmexitInstrStrIo(pVCpu, VMXINSTRID_IO_INS, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8, true /* fRep */,
1289	ExitInstrInfo, cbInstr);
1290	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
1291	return rcStrict;
1292	}
1293	#endif
1294
1295	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1296	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
1297	{
1298	rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, OP_SIZE / 8, ADDR_SIZE, X86_SREG_ES, true /* fRep */,
1299	true /* fStrIo */, cbInstr);
1300	if (rcStrict == VINF_SVM_VMEXIT)
1301	return VINF_SUCCESS;
1302	if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
1303	{
1304	Log(("iemCImpl_rep_ins_op: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, OP_SIZE / 8,
1305	VBOXSTRICTRC_VAL(rcStrict)));
1306	return rcStrict;
1307	}
1308	}
1309	#endif
1310
1311	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
1312	if (uCounterReg == 0)
1313	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1314
1315	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
1316	rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pVCpu->cpum.GstCtx.es), X86_SREG_ES, &uBaseAddr);
1317	if (rcStrict != VINF_SUCCESS)
1318	return rcStrict;
1319
1320	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
1321	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rDI;
1322
1323	/*
1324	* Be careful with handle bypassing.
1325	*/
1326	if (pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS)
1327	{
1328	Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
1329	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1330	}
1331
1332	/*
1333	* The loop.
1334	*/
1335	for (;;)
1336	{
1337	/*
1338	* Do segmentation and virtual page stuff.
1339	*/
1340	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
1341	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
1342	if (cLeftPage > uCounterReg)
1343	cLeftPage = uCounterReg;
1344	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
1345	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
1346	&& ( IS_64_BIT_CODE(pVCpu)
1347	\|\| ( uAddrReg < pVCpu->cpum.GstCtx.es.u32Limit
1348	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pVCpu->cpum.GstCtx.es.u32Limit)
1349	)
1350	)
1351	{
1352	RTGCPHYS GCPhysMem;
1353	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_W, &GCPhysMem);
1354	if (rcStrict != VINF_SUCCESS)
1355	return rcStrict;
1356
1357	/*
1358	* If we can map the page without trouble, use the IOM
1359	* string I/O interface to do the work.
1360	*/
1361	PGMPAGEMAPLOCK PgLockMem;
1362	OP_TYPE *puMem;
1363	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
1364	if (rcStrict == VINF_SUCCESS)
1365	{
1366	uint32_t cTransfers = cLeftPage;
1367	rcStrict = IOMIOPortReadString(pVM, pVCpu, u16Port, puMem, &cTransfers, OP_SIZE / 8);
1368
1369	uint32_t cActualTransfers = cLeftPage - cTransfers;
1370	Assert(cActualTransfers <= cLeftPage);
1371	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cbIncr * cActualTransfers;
1372	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cActualTransfers;
1373	puMem += cActualTransfers;
1374
1375	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
1376
1377	if (rcStrict != VINF_SUCCESS)
1378	{
1379	if (IOM_SUCCESS(rcStrict))
1380	{
1381	/** @todo finish: work out how this should work wrt status codes. Not sure we
1382	* can use iemSetPassUpStatus here, but it depends on what
1383	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1384	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
1385	if (uCounterReg == 0)
1386	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1387	pVCpu->iem.s.cPotentialExits++;
1388	}
1389	return rcStrict;
1390	}
1391
1392	/* If unaligned, we drop thru and do the page crossing access
1393	below. Otherwise, do the next page. */
1394	if (uCounterReg == 0)
1395	break;
1396	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
1397	{
1398	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1399	continue;
1400	}
1401	cLeftPage = 0;
1402	}
1403	}
1404
1405	/*
1406	* Fallback - slow processing till the end of the current page.
1407	* In the cross page boundrary case we will end up here with cLeftPage
1408	* as 0, we execute one loop then.
1409	*
1410	* Note! We ASSUME the CPU will raise #PF or #GP before access the
1411	* I/O port, otherwise it wouldn't really be restartable.
1412	*/
1413	/** @todo investigate what the CPU actually does with \#PF/\#GP
1414	* during INS. */
1415	do
1416	{
1417	uint8_t bUnmapInfo;
1418	OP_TYPE *puMem;
1419	rcStrict = iemMemMap(pVCpu, (void **)&puMem, &bUnmapInfo, OP_SIZE / 8, X86_SREG_ES, uAddrReg,
1420	IEM_ACCESS_DATA_W, OP_SIZE / 8 - 1);
1421	if (rcStrict != VINF_SUCCESS)
1422	return rcStrict;
1423
1424	uint32_t u32Value = 0;
1425	rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, OP_SIZE / 8);
1426	if (!IOM_SUCCESS(rcStrict))
1427	{
1428	iemMemRollback(pVCpu);
1429	return rcStrict;
1430	}
1431
1432	*puMem = (OP_TYPE)u32Value;
1433	# ifdef IN_RING3
1434	VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
1435	# else
1436	VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, bUnmapInfo);
1437	# endif
1438	if (rcStrict2 == VINF_SUCCESS)
1439	{ /* likely */ }
1440	else
1441	AssertLogRelMsgFailedReturn(("rcStrict2=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)),
1442	RT_FAILURE(rcStrict2) ? rcStrict2 : VERR_IEM_IPE_1);
1443
1444	pVCpu->cpum.GstCtx.ADDR_rDI = uAddrReg += cbIncr;
1445	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
1446
1447	cLeftPage--;
1448	if (rcStrict != VINF_SUCCESS)
1449	{
1450	/** @todo finish: work out how this should work wrt status codes. Not sure we
1451	* can use iemSetPassUpStatus here, but it depends on what
1452	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1453	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
1454	if (uCounterReg == 0)
1455	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1456	pVCpu->iem.s.cPotentialExits++;
1457	return rcStrict;
1458	}
1459
1460	IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
1461	} while ((int32_t)cLeftPage > 0);
1462
1463
1464	/*
1465	* Next page. Must check for interrupts and stuff here.
1466	*/
1467	if (uCounterReg == 0)
1468	break;
1469	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1470	}
1471
1472	/*
1473	* Done.
1474	*/
1475	pVCpu->iem.s.cPotentialExits++;
1476	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1477	}
1478
1479
1480	/**
1481	* Implements 'OUTS' (no rep)
1482	*/
1483	IEM_CIMPL_DEF_2(RT_CONCAT4(iemCImpl_outs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg, bool, fIoChecked)
1484	{
1485	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1486	VBOXSTRICTRC rcStrict;
1487
1488	/*
1489	* ASSUMES the #GP for I/O permission is taken first, then any #GP for
1490	* segmentation and finally any #PF due to virtual address translation.
1491	* ASSUMES nothing is read from the I/O port before traps are taken.
1492	*/
1493	if (!fIoChecked)
1494	{
1495	rcStrict = iemHlpCheckPortIOPermission(pVCpu, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8);
1496	if (rcStrict != VINF_SUCCESS)
1497	return rcStrict;
1498	}
1499
1500	/*
1501	* Check nested-guest I/O intercepts.
1502	*/
1503	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1504	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
1505	{
1506	VMXEXITINSTRINFO ExitInstrInfo;
1507	ExitInstrInfo.u = 0;
1508	ExitInstrInfo.StrIo.u3AddrSize = ADDR_VMXSTRIO;
1509	ExitInstrInfo.StrIo.iSegReg = iEffSeg;
1510	rcStrict = iemVmxVmexitInstrStrIo(pVCpu, VMXINSTRID_IO_OUTS, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8, false /* fRep */,
1511	ExitInstrInfo, cbInstr);
1512	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
1513	return rcStrict;
1514	}
1515	#endif
1516
1517	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1518	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
1519	{
1520	rcStrict = iemSvmHandleIOIntercept(pVCpu, pVCpu->cpum.GstCtx.dx, SVMIOIOTYPE_OUT, OP_SIZE / 8, ADDR_SIZE, iEffSeg,
1521	false /* fRep /, true / fStrIo */, cbInstr);
1522	if (rcStrict == VINF_SVM_VMEXIT)
1523	return VINF_SUCCESS;
1524	if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
1525	{
1526	Log(("iemCImpl_outs_op: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", pVCpu->cpum.GstCtx.dx,
1527	OP_SIZE / 8, VBOXSTRICTRC_VAL(rcStrict)));
1528	return rcStrict;
1529	}
1530	}
1531	#endif
1532
1533	OP_TYPE uValue;
1534	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, pVCpu->cpum.GstCtx.ADDR_rSI);
1535	if (rcStrict == VINF_SUCCESS)
1536	{
1537	rcStrict = IOMIOPortWrite(pVM, pVCpu, pVCpu->cpum.GstCtx.dx, uValue, OP_SIZE / 8);
1538	if (IOM_SUCCESS(rcStrict))
1539	{
1540	if (!pVCpu->cpum.GstCtx.eflags.Bits.u1DF)
1541	pVCpu->cpum.GstCtx.ADDR_rSI += OP_SIZE / 8;
1542	else
1543	pVCpu->cpum.GstCtx.ADDR_rSI -= OP_SIZE / 8;
1544	/** @todo finish: work out how this should work wrt status codes. Not sure we
1545	* can use iemSetPassUpStatus here, but it depends on what
1546	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1547	if (rcStrict != VINF_SUCCESS)
1548	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
1549	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1550	pVCpu->iem.s.cPotentialExits++;
1551	}
1552	}
1553	return rcStrict;
1554	}
1555
1556
1557	/**
1558	* Implements 'REP OUTS'.
1559	*/
1560	IEM_CIMPL_DEF_2(RT_CONCAT4(iemCImpl_rep_outs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg, bool, fIoChecked)
1561	{
1562	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1563
1564	/*
1565	* Setup.
1566	*/
1567	uint16_t const u16Port = pVCpu->cpum.GstCtx.dx;
1568	VBOXSTRICTRC rcStrict;
1569	if (!fIoChecked)
1570	{
1571	/** @todo check if this is too early for ecx=0. */
1572	rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, OP_SIZE / 8);
1573	if (rcStrict != VINF_SUCCESS)
1574	return rcStrict;
1575	}
1576
1577	/*
1578	* Check nested-guest I/O intercepts.
1579	*/
1580	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1581	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
1582	{
1583	VMXEXITINSTRINFO ExitInstrInfo;
1584	ExitInstrInfo.u = 0;
1585	ExitInstrInfo.StrIo.u3AddrSize = ADDR_VMXSTRIO;
1586	ExitInstrInfo.StrIo.iSegReg = iEffSeg;
1587	rcStrict = iemVmxVmexitInstrStrIo(pVCpu, VMXINSTRID_IO_OUTS, pVCpu->cpum.GstCtx.dx, OP_SIZE / 8, true /* fRep */,
1588	ExitInstrInfo, cbInstr);
1589	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
1590	return rcStrict;
1591	}
1592	#endif
1593
1594	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1595	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
1596	{
1597	rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, OP_SIZE / 8, ADDR_SIZE, iEffSeg, true /* fRep */,
1598	true /* fStrIo */, cbInstr);
1599	if (rcStrict == VINF_SVM_VMEXIT)
1600	return VINF_SUCCESS;
1601	if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
1602	{
1603	Log(("iemCImpl_rep_outs_op: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, OP_SIZE / 8,
1604	VBOXSTRICTRC_VAL(rcStrict)));
1605	return rcStrict;
1606	}
1607	}
1608	#endif
1609
1610	ADDR_TYPE uCounterReg = pVCpu->cpum.GstCtx.ADDR_rCX;
1611	if (uCounterReg == 0)
1612	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1613
1614	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iEffSeg) \| CPUMCTX_EXTRN_ES);
1615	PCCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iEffSeg);
1616	uint64_t uBaseAddr = 0; /* gcc may not be used uninitialized */
1617	rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pHid, iEffSeg, &uBaseAddr);
1618	if (rcStrict != VINF_SUCCESS)
1619	return rcStrict;
1620
1621	int8_t const cbIncr = pVCpu->cpum.GstCtx.eflags.Bits.u1DF ? -(OP_SIZE / 8) : (OP_SIZE / 8);
1622	ADDR_TYPE uAddrReg = pVCpu->cpum.GstCtx.ADDR_rSI;
1623
1624	/*
1625	* The loop.
1626	*/
1627	for (;;)
1628	{
1629	/*
1630	* Do segmentation and virtual page stuff.
1631	*/
1632	ADDR2_TYPE uVirtAddr = uAddrReg + (ADDR2_TYPE)uBaseAddr;
1633	uint32_t cLeftPage = (GUEST_PAGE_SIZE - (uVirtAddr & GUEST_PAGE_OFFSET_MASK)) / (OP_SIZE / 8);
1634	if (cLeftPage > uCounterReg)
1635	cLeftPage = uCounterReg;
1636	if ( cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
1637	&& cbIncr > 0 /** @todo Implement reverse direction string ops. */
1638	&& ( IS_64_BIT_CODE(pVCpu)
1639	\|\| ( uAddrReg < pHid->u32Limit
1640	&& uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pHid->u32Limit)
1641	)
1642	)
1643	{
1644	RTGCPHYS GCPhysMem;
1645	rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, OP_SIZE / 8, IEM_ACCESS_DATA_R, &GCPhysMem);
1646	if (rcStrict != VINF_SUCCESS)
1647	return rcStrict;
1648
1649	/*
1650	* If we can map the page without trouble, we use the IOM
1651	* string I/O interface to do the job.
1652	*/
1653	PGMPAGEMAPLOCK PgLockMem;
1654	OP_TYPE const *puMem;
1655	rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
1656	if (rcStrict == VINF_SUCCESS)
1657	{
1658	uint32_t cTransfers = cLeftPage;
1659	rcStrict = IOMIOPortWriteString(pVM, pVCpu, u16Port, puMem, &cTransfers, OP_SIZE / 8);
1660
1661	uint32_t cActualTransfers = cLeftPage - cTransfers;
1662	Assert(cActualTransfers <= cLeftPage);
1663	pVCpu->cpum.GstCtx.ADDR_rSI = uAddrReg += cbIncr * cActualTransfers;
1664	pVCpu->cpum.GstCtx.ADDR_rCX = uCounterReg -= cActualTransfers;
1665	puMem += cActualTransfers;
1666
1667	iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
1668
1669	if (rcStrict != VINF_SUCCESS)
1670	{
1671	if (IOM_SUCCESS(rcStrict))
1672	{
1673	/** @todo finish: work out how this should work wrt status codes. Not sure we
1674	* can use iemSetPassUpStatus here, but it depends on what
1675	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1676	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
1677	if (uCounterReg == 0)
1678	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1679	pVCpu->iem.s.cPotentialExits++;
1680	}
1681	return rcStrict;
1682	}
1683
1684	if (uCounterReg == 0)
1685	break;
1686
1687	/* If unaligned, we drop thru and do the page crossing access
1688	below. Otherwise, do the next page. */
1689	if (!(uVirtAddr & (OP_SIZE / 8 - 1)))
1690	{
1691	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1692	continue;
1693	}
1694	cLeftPage = 0;
1695	}
1696	}
1697
1698	/*
1699	* Fallback - slow processing till the end of the current page.
1700	* In the cross page boundrary case we will end up here with cLeftPage
1701	* as 0, we execute one loop then.
1702	*
1703	* Note! We ASSUME the CPU will raise #PF or #GP before access the
1704	* I/O port, otherwise it wouldn't really be restartable.
1705	*/
1706	/** @todo investigate what the CPU actually does with \#PF/\#GP
1707	* during INS. */
1708	do
1709	{
1710	OP_TYPE uValue;
1711	rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, uAddrReg);
1712	if (rcStrict != VINF_SUCCESS)
1713	return rcStrict;
1714
1715	rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, uValue, OP_SIZE / 8);
1716	if (IOM_SUCCESS(rcStrict))
1717	{
1718	pVCpu->cpum.GstCtx.ADDR_rSI = uAddrReg += cbIncr;
1719	pVCpu->cpum.GstCtx.ADDR_rCX = --uCounterReg;
1720	cLeftPage--;
1721	}
1722	if (rcStrict != VINF_SUCCESS)
1723	{
1724	if (IOM_SUCCESS(rcStrict))
1725	{
1726	/** @todo finish: work out how this should work wrt status codes. Not sure we
1727	* can use iemSetPassUpStatus here, but it depends on what
1728	* iemRegAddToRipAndFinishingClearingRF may eventually return (if anything)... */
1729	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
1730	if (uCounterReg == 0)
1731	iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1732	pVCpu->iem.s.cPotentialExits++;
1733	}
1734	return rcStrict;
1735	}
1736	IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
1737	} while ((int32_t)cLeftPage > 0);
1738
1739
1740	/*
1741	* Next page. Must check for interrupts and stuff here.
1742	*/
1743	if (uCounterReg == 0)
1744	break;
1745	IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pVCpu->cpum.GstCtx.eflags.u);
1746	}
1747
1748	/*
1749	* Done.
1750	*/
1751	pVCpu->iem.s.cPotentialExits++;
1752	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1753	}
1754
1755	#endif /* OP_SIZE != 64-bit */
1756
1757
1758	#undef OP_rAX
1759	#undef OP_SIZE
1760	#undef ADDR_SIZE
1761	#undef ADDR_rDI
1762	#undef ADDR_rSI
1763	#undef ADDR_rCX
1764	#undef ADDR_rIP
1765	#undef ADDR2_TYPE
1766	#undef ADDR_TYPE
1767	#undef ADDR2_TYPE
1768	#undef ADDR_VMXSTRIO
1769	#undef IS_64_BIT_CODE
1770	#undef IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN
1771	#undef IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN
1772	#undef IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN
1773

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplStrInstr.cpp.h@ 105834

Download in other formats: