IOMAllMMIO.cpp@ 3254

Last change on this file since 3254 was 3184, checked in by vboxsync, 17 years ago
return VINF_EM_RAW_EMULATE_INSTR instead of VINF_EM_RESCHEDULE_REM when the emulation of string I/O encounters difficult bits.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 63.3 KB

Line
1	/* $Id: IOMAllMMIO.cpp 3184 2007-06-20 13:40:16Z vboxsync $ */
2	/** @file
3	* IOM - Input / Output Monitor - Guest Context.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 innotek GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_IOM
27	#include <VBox/iom.h>
28	#include <VBox/cpum.h>
29	#include <VBox/pgm.h>
30	#include <VBox/selm.h>
31	#include <VBox/mm.h>
32	#include <VBox/em.h>
33	#include <VBox/pgm.h>
34	#include <VBox/trpm.h>
35	#include "IOMInternal.h"
36	#include <VBox/vm.h>
37
38	#include <VBox/dis.h>
39	#include <VBox/disopcode.h>
40	#include <VBox/param.h>
41	#include <VBox/err.h>
42	#include <iprt/assert.h>
43	#include <VBox/log.h>
44	#include <iprt/asm.h>
45	#include <iprt/string.h>
46
47	/*******************************************************************************
48	* Internal Functions *
49	*******************************************************************************/
50	static bool iomGCGetRegImmData(PDISCPUSTATE pCpu, PCOP_PARAMETER pParam, PCPUMCTXCORE pRegFrame, uint32_t pu32Data, unsigned pcbSize);
51	static bool iomGCSaveDataToReg(PDISCPUSTATE pCpu, PCOP_PARAMETER pParam, PCPUMCTXCORE pRegFrame, uint32_t u32Data);
52
53
54	/*******************************************************************************
55	* Global Variables *
56	*******************************************************************************/
57	/**
58	* Array for accessing 32-bit general registers in VMMREGFRAME structure
59	* by register's index from disasm.
60	*/
61	static unsigned g_aReg32Index[] =
62	{
63	RT_OFFSETOF(CPUMCTXCORE, eax), /* USE_REG_EAX */
64	RT_OFFSETOF(CPUMCTXCORE, ecx), /* USE_REG_ECX */
65	RT_OFFSETOF(CPUMCTXCORE, edx), /* USE_REG_EDX */
66	RT_OFFSETOF(CPUMCTXCORE, ebx), /* USE_REG_EBX */
67	RT_OFFSETOF(CPUMCTXCORE, esp), /* USE_REG_ESP */
68	RT_OFFSETOF(CPUMCTXCORE, ebp), /* USE_REG_EBP */
69	RT_OFFSETOF(CPUMCTXCORE, esi), /* USE_REG_ESI */
70	RT_OFFSETOF(CPUMCTXCORE, edi) /* USE_REG_EDI */
71	};
72
73	/**
74	* Macro for accessing 32-bit general purpose registers in CPUMCTXCORE structure.
75	*/
76	#define ACCESS_REG32(p, idx) (((uint32_t )((char *)(p) + g_aReg32Index[idx])))
77
78	/**
79	* Array for accessing 16-bit general registers in CPUMCTXCORE structure
80	* by register's index from disasm.
81	*/
82	static unsigned g_aReg16Index[] =
83	{
84	RT_OFFSETOF(CPUMCTXCORE, eax), /* USE_REG_AX */
85	RT_OFFSETOF(CPUMCTXCORE, ecx), /* USE_REG_CX */
86	RT_OFFSETOF(CPUMCTXCORE, edx), /* USE_REG_DX */
87	RT_OFFSETOF(CPUMCTXCORE, ebx), /* USE_REG_BX */
88	RT_OFFSETOF(CPUMCTXCORE, esp), /* USE_REG_SP */
89	RT_OFFSETOF(CPUMCTXCORE, ebp), /* USE_REG_BP */
90	RT_OFFSETOF(CPUMCTXCORE, esi), /* USE_REG_SI */
91	RT_OFFSETOF(CPUMCTXCORE, edi) /* USE_REG_DI */
92	};
93
94	/**
95	* Macro for accessing 16-bit general purpose registers in CPUMCTXCORE structure.
96	*/
97	#define ACCESS_REG16(p, idx) (((uint16_t )((char *)(p) + g_aReg16Index[idx])))
98
99	/**
100	* Array for accessing 8-bit general registers in CPUMCTXCORE structure
101	* by register's index from disasm.
102	*/
103	static unsigned g_aReg8Index[] =
104	{
105	RT_OFFSETOF(CPUMCTXCORE, eax), /* USE_REG_AL */
106	RT_OFFSETOF(CPUMCTXCORE, ecx), /* USE_REG_CL */
107	RT_OFFSETOF(CPUMCTXCORE, edx), /* USE_REG_DL */
108	RT_OFFSETOF(CPUMCTXCORE, ebx), /* USE_REG_BL */
109	RT_OFFSETOF(CPUMCTXCORE, eax) + 1, /* USE_REG_AH */
110	RT_OFFSETOF(CPUMCTXCORE, ecx) + 1, /* USE_REG_CH */
111	RT_OFFSETOF(CPUMCTXCORE, edx) + 1, /* USE_REG_DH */
112	RT_OFFSETOF(CPUMCTXCORE, ebx) + 1 /* USE_REG_BH */
113	};
114
115	/**
116	* Macro for accessing 8-bit general purpose registers in CPUMCTXCORE structure.
117	*/
118	#define ACCESS_REG8(p, idx) (((uint8_t )((char *)(p) + g_aReg8Index[idx])))
119
120	/**
121	* Array for accessing segment registers in CPUMCTXCORE structure
122	* by register's index from disasm.
123	*/
124	static unsigned g_aRegSegIndex[] =
125	{
126	RT_OFFSETOF(CPUMCTXCORE, es), /* USE_REG_ES */
127	RT_OFFSETOF(CPUMCTXCORE, cs), /* USE_REG_CS */
128	RT_OFFSETOF(CPUMCTXCORE, ss), /* USE_REG_SS */
129	RT_OFFSETOF(CPUMCTXCORE, ds), /* USE_REG_DS */
130	RT_OFFSETOF(CPUMCTXCORE, fs), /* USE_REG_FS */
131	RT_OFFSETOF(CPUMCTXCORE, gs) /* USE_REG_GS */
132	};
133
134	/**
135	* Macro for accessing segment registers in CPUMCTXCORE structure.
136	*/
137	#define ACCESS_REGSEG(p, idx) (((uint16_t )((char *)(p) + g_aRegSegIndex[idx])))
138
139	/**
140	* Array for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
141	*/
142	static const unsigned g_aSize2Shift[] =
143	{
144	~0, /* 0 - invalid */
145	0, /* 1 == 2^0 /
146	1, /* 2 == 2^1 /
147	~0, /* 3 - invalid */
148	2, /* 4 == 2^2 /
149	~0, /* 5 - invalid */
150	~0, /* 6 - invalid */
151	~0, /* 7 - invalid */
152	3 /* 8 == 2^3 /
153	};
154
155	/**
156	* Macro for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
157	*/
158	#define SIZE2SHIFT(cb) (g_aSize2Shift[cb])
159
160
161	/**
162	* Wrapper which does the write and updates range statistics when such are enabled.
163	* @warning VBOX_SUCCESS(rc=VINF_IOM_HC_MMIO_WRITE) is TRUE!
164	*/
165	inline int iomGCMMIODoWrite(PVM pVM, CTXALLSUFF(PIOMMMIORANGE) pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cbSize)
166	{
167	#ifdef VBOX_WITH_STATISTICS
168	if (pRange->cbSize <= PAGE_SIZE)
169	{
170	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault);
171	if (!pStats)
172	return VINF_IOM_HC_MMIO_WRITE;
173
174	int rc = pRange->pfnWriteCallback(pRange->pDevIns, pRange->pvUser, GCPhysFault, (void )pvData, cbSize); / @todo fix const!! */
175	if (rc != VINF_IOM_HC_MMIO_WRITE)
176	STAM_COUNTER_INC(&pStats->WriteGC);
177	return rc;
178	}
179	#endif
180	return pRange->pfnWriteCallback(pRange->pDevIns, pRange->pvUser, GCPhysFault, (void *)pvData, cbSize);
181	}
182
183	/**
184	* Wrapper which does the read and updates range statistics when such are enabled.
185	*/
186	inline int iomGCMMIODoRead(PVM pVM, CTXALLSUFF(PIOMMMIORANGE) pRange, RTGCPHYS GCPhysFault, void *pvData, unsigned cbSize)
187	{
188	#ifdef VBOX_WITH_STATISTICS
189	if (pRange->cbSize <= PAGE_SIZE)
190	{
191	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault);
192	if (!pStats)
193	return VINF_IOM_HC_MMIO_READ;
194
195	int rc = pRange->pfnReadCallback(pRange->pDevIns, pRange->pvUser, GCPhysFault, pvData, cbSize);
196	if (rc != VINF_IOM_HC_MMIO_READ)
197	STAM_COUNTER_INC(&pStats->ReadGC);
198	return rc;
199	}
200	#endif
201	return pRange->pfnReadCallback(pRange->pDevIns, pRange->pvUser, GCPhysFault, pvData, cbSize);
202	}
203
204
205	/**
206	* Returns the contents of register or immediate data of instruction's parameter.
207	*
208	* @returns true on success.
209	*
210	* @param pCpu Pointer to current disassembler context.
211	* @param pParam Pointer to parameter of instruction to proccess.
212	* @param pRegFrame Pointer to CPUMCTXCORE guest structure.
213	* @param pu32Data Where to store retrieved data.
214	* @param pcbSize Where to store the size of data (1, 2, 4).
215	*/
216	static bool iomGCGetRegImmData(PDISCPUSTATE pCpu, PCOP_PARAMETER pParam, PCPUMCTXCORE pRegFrame, uint32_t pu32Data, unsigned pcbSize)
217	{
218	if (pParam->flags & (USE_BASE \| USE_INDEX \| USE_SCALE \| USE_DISPLACEMENT8 \| USE_DISPLACEMENT16 \| USE_DISPLACEMENT32))
219	{
220	*pcbSize = 0;
221	*pu32Data = 0;
222	return false;
223	}
224
225	if (pParam->flags & USE_REG_GEN32)
226	{
227	*pcbSize = 4;
228	*pu32Data = ACCESS_REG32(pRegFrame, pParam->base.reg_gen32);
229	return true;
230	}
231
232	if (pParam->flags & USE_REG_GEN16)
233	{
234	*pcbSize = 2;
235	*pu32Data = ACCESS_REG16(pRegFrame, pParam->base.reg_gen16);
236	return true;
237	}
238
239	if (pParam->flags & USE_REG_GEN8)
240	{
241	*pcbSize = 1;
242	*pu32Data = ACCESS_REG8(pRegFrame, pParam->base.reg_gen8);
243	return true;
244	}
245
246	if (pParam->flags & (USE_IMMEDIATE32\|USE_IMMEDIATE32_SX8))
247	{
248	*pcbSize = 4;
249	*pu32Data = (uint32_t)pParam->parval;
250	return true;
251	}
252
253	if (pParam->flags & (USE_IMMEDIATE16\|USE_IMMEDIATE16_SX8))
254	{
255	*pcbSize = 2;
256	*pu32Data = (uint16_t)pParam->parval;
257	return true;
258	}
259
260	if (pParam->flags & USE_IMMEDIATE8)
261	{
262	*pcbSize = 1;
263	*pu32Data = (uint8_t)pParam->parval;
264	return true;
265	}
266
267	if (pParam->flags & USE_REG_SEG)
268	{
269	*pcbSize = 2;
270	*pu32Data = ACCESS_REGSEG(pRegFrame, pParam->base.reg_seg);
271	return true;
272	} /* Else - error. */
273
274	*pcbSize = 0;
275	*pu32Data = 0;
276	return false;
277	}
278
279
280	/**
281	* Saves data to 8/16/32 general purpose or segment register defined by
282	* instruction's parameter.
283	*
284	* @returns true on success.
285	* @param pCpu Pointer to current disassembler context.
286	* @param pParam Pointer to parameter of instruction to proccess.
287	* @param pRegFrame Pointer to CPUMCTXCORE guest structure.
288	* @param u32Data 8/16/32 bit data to store.
289	*/
290	static bool iomGCSaveDataToReg(PDISCPUSTATE pCpu, PCOP_PARAMETER pParam, PCPUMCTXCORE pRegFrame, unsigned u32Data)
291	{
292	if (pParam->flags & (USE_BASE \| USE_INDEX \| USE_SCALE \| USE_DISPLACEMENT8 \| USE_DISPLACEMENT16 \| USE_DISPLACEMENT32 \| USE_IMMEDIATE8 \| USE_IMMEDIATE16 \| USE_IMMEDIATE32 \| USE_IMMEDIATE32_SX8 \| USE_IMMEDIATE16_SX8))
293	{
294	return false;
295	}
296
297	if (pParam->flags & USE_REG_GEN32)
298	{
299	ACCESS_REG32(pRegFrame, pParam->base.reg_gen32) = u32Data;
300	return true;
301	}
302
303	if (pParam->flags & USE_REG_GEN16)
304	{
305	ACCESS_REG16(pRegFrame, pParam->base.reg_gen16) = (uint16_t)u32Data;
306	return true;
307	}
308
309	if (pParam->flags & USE_REG_GEN8)
310	{
311	ACCESS_REG8(pRegFrame, pParam->base.reg_gen8) = (uint8_t)u32Data;
312	return true;
313	}
314
315	if (pParam->flags & USE_REG_SEG)
316	{
317	ACCESS_REGSEG(pRegFrame, pParam->base.reg_seg) = (uint16_t)u32Data;
318	return true;
319	}
320
321	/* Else - error. */
322	return false;
323	}
324
325
326	/*
327	* Internal - statistics only.
328	*/
329	inline void iomGCMMIOStatLength(PVM pVM, unsigned cb)
330	{
331	#ifdef VBOX_WITH_STATISTICS
332	switch (cb)
333	{
334	case 1:
335	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO1Byte);
336	break;
337	case 2:
338	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO2Bytes);
339	break;
340	case 4:
341	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIO4Bytes);
342	break;
343	default:
344	/* No way. */
345	AssertMsgFailed(("Invalid data length %d\n", cb));
346	break;
347	}
348	#else
349	NOREF(pVM); NOREF(cb);
350	#endif
351	}
352
353
354	/**
355	* MOV reg, mem (read)
356	* MOVZX reg, mem (read)
357	* MOVSX reg, mem (read)
358	*
359	* @returns VBox status code.
360	*
361	* @param pVM The virtual machine (GC pointer ofcourse).
362	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
363	* @param pCpu Disassembler CPU state.
364	* @param pRange Pointer MMIO range.
365	* @param GCPhysFault The GC physical address corresponding to pvFault.
366	*/
367	static int iomGCInterpretMOVxXRead(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange, RTGCPHYS GCPhysFault)
368	{
369	/*
370	* If no read handler then go to ring-3 and handle it there.
371	*/
372	if (!pRange->pfnReadCallback)
373	return VINF_IOM_HC_MMIO_READ;
374
375	/*
376	* Get the data size from parameter 2,
377	* and call the handler function to get the data.
378	*/
379	unsigned cbSize = DISGetParamSize(pCpu, &pCpu->param2);
380	AssertMsg(cbSize > 0 && cbSize <= sizeof(uint32_t), ("cbSize=%d\n", cbSize));
381
382	uint32_t u32Data = 0;
383	int rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &u32Data, cbSize);
384	if (rc == VINF_SUCCESS)
385	{
386	/*
387	* Do sign extension for MOVSX.
388	*/
389	/** @todo checkup MOVSX implementation! */
390	if (pCpu->pCurInstr->opcode == OP_MOVSX)
391	{
392	if (cbSize == 1)
393	{
394	/* DWORD <- BYTE */
395	int32_t iData = (int8_t)u32Data;
396	u32Data = (uint32_t)iData;
397	}
398	else
399	{
400	/* DWORD <- WORD */
401	int32_t iData = (int16_t)u32Data;
402	u32Data = (uint32_t)iData;
403	}
404	}
405
406	/*
407	* Store the result to register (parameter 1).
408	*/
409	bool fRc = iomGCSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, u32Data);
410	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
411	}
412
413	if (rc == VINF_SUCCESS)
414	iomGCMMIOStatLength(pVM, cbSize);
415	return rc;
416	}
417
418
419	/**
420	* MOV mem, reg\|imm (write)
421	*
422	* @returns VBox status code.
423	*
424	* @param pVM The virtual machine (GC pointer ofcourse).
425	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
426	* @param pCpu Disassembler CPU state.
427	* @param pRange Pointer MMIO range.
428	* @param GCPhysFault The GC physical address corresponding to pvFault.
429	*/
430	static int iomGCInterpretMOVxXWrite(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange, RTGCPHYS GCPhysFault)
431	{
432	/*
433	* If no write handler then go to ring-3 and handle it there.
434	*/
435	if (!pRange->pfnWriteCallback)
436	return VINF_IOM_HC_MMIO_WRITE;
437
438	/*
439	* Get data to write from second parameter,
440	* and call the callback to write it.
441	*/
442	unsigned cbSize = 0;
443	uint32_t u32Data = 0;
444	bool fRc = iomGCGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &u32Data, &cbSize);
445	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
446
447	int rc = iomGCMMIODoWrite(pVM, pRange, GCPhysFault, &u32Data, cbSize);
448	if (rc == VINF_SUCCESS)
449	iomGCMMIOStatLength(pVM, cbSize);
450	return rc;
451	}
452
453
454	/** @todo All the string MMIO stuff can do terrible things since physical contiguous mappings are
455	* assumed all over the place! This must be addressed in a general way, like for example let EM do
456	* all the interpretation and checking of selectors and addresses.
457	*
458	* -> I don't see the problem here. MMIO ranges are by definition linear ranges. The virtual source or destination is read/written properly.
459	*/
460
461
462	DECLINLINE(int) iomRamRead(PVM pVM, void *pDest, RTGCPTR GCSrc, uint32_t cb)
463	{
464	#ifdef IN_GC
465	return MMGCRamReadNoTrapHandler(pDest, GCSrc, cb);
466	#else
467	int rc;
468	RTGCPHYS GCPhys;
469	RTGCUINTPTR offset;
470
471	offset = GCSrc & PAGE_OFFSET_MASK;
472
473	/** @todo optimize the loop; no need to convert the address all the time */
474	rc = PGMPhysGCPtr2GCPhys(pVM, GCSrc, &GCPhys);
475	AssertRCReturn(rc, rc);
476	PGMPhysRead(pVM, GCPhys + offset, pDest, cb);
477	return VINF_SUCCESS;
478	#endif
479	}
480
481	DECLINLINE(int) iomRamWrite(PVM pVM, RTGCPTR GCDest, void *pSrc, uint32_t cb)
482	{
483	#ifdef IN_GC
484	return MMGCRamWriteNoTrapHandler(GCDest, pSrc, cb);
485	#else
486	int rc;
487	RTGCPHYS GCPhys;
488	RTGCUINTPTR offset;
489
490	/** @todo optimize the loop; no need to convert the address all the time */
491	offset = GCDest & PAGE_OFFSET_MASK;
492	rc = PGMPhysGCPtr2GCPhys(pVM, GCDest, &GCPhys);
493	AssertRCReturn(rc, rc);
494	PGMPhysWrite(pVM, GCPhys + offset, pSrc, cb);
495	return VINF_SUCCESS;
496	#endif
497	}
498
499	/**
500	* [REP] MOVSB
501	* [REP] MOVSW
502	* [REP] MOVSD
503	*
504	* Restricted implementation.
505	*
506	*
507	* @returns VBox status code.
508	*
509	* @param pVM The virtual machine (GC pointer ofcourse).
510	* @param uErrorCode CPU Error code.
511	* @param pRegFrame Trap register frame.
512	* @param GCPhysFault The GC physical address corresponding to pvFault.
513	* @param pCpu Disassembler CPU state.
514	* @param pRange Pointer MMIO range.
515	*/
516	#ifdef IOMGC_MOVS_SUPPORT
517	static int iomGCInterpretMOVS(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
518	{
519	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovs, a);
520
521	/*
522	* We do not support segment prefixes or REPNE.
523	*/
524	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
525	return VINF_IOM_HC_MMIO_READ_WRITE;
526
527
528	/*
529	* Get bytes/words/dwords count to copy.
530	*/
531	uint32_t cTransfers = 1;
532	if (pCpu->prefix & PREFIX_REP)
533	{
534	cTransfers = pRegFrame->ecx;
535	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
536	cTransfers &= 0xffff;
537
538	if (!cTransfers)
539	return VINF_SUCCESS;
540	}
541
542	/* Get the current privilege level. */
543	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
544
545	/*
546	* Get data size.
547	*/
548	unsigned cbSize = DISGetParamSize(pCpu, &pCpu->param1);
549	Assert(cbSize);
550	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
551
552	#ifdef VBOX_WITH_STATISTICS
553	if (pVM->iom.s.cMovsMaxBytes < (cTransfers << SIZE2SHIFT(cbSize)))
554	pVM->iom.s.cMovsMaxBytes = cTransfers << SIZE2SHIFT(cbSize);
555	#endif
556
557	RTGCPHYS Phys = GCPhysFault;
558	int rc;
559	if (uErrorCode & X86_TRAP_PF_RW)
560	{
561	/*
562	* Write operation: [Mem] -> [MMIO]
563	* ds:esi (Virt Src) -> es:edi (Phys Dst)
564	*/
565	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
566
567	/* Check callback. */
568	if (!pRange->pfnWriteCallback)
569	{
570	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
571	return VINF_IOM_HC_MMIO_WRITE;
572	}
573
574	/* Convert source address ds:esi. */
575	RTGCUINTPTR pu8Virt;
576	rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->ds, (RTGCPTR)pRegFrame->esi, &pRegFrame->dsHid,
577	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
578	(PRTGCPTR)&pu8Virt, NULL);
579	if (VBOX_SUCCESS(rc))
580	{
581
582	/* Access verification first; we currently can't recover properly from traps inside this instruction */
583	rc = PGMVerifyAccess(pVM, pu8Virt, cTransfers * cbSize, (cpl == 3) ? X86_PTE_US : 0);
584	if (rc != VINF_SUCCESS)
585	{
586	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
587	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
588	return VINF_EM_RAW_EMULATE_INSTR;
589	}
590
591	#ifdef IN_GC
592	MMGCRamRegisterTrapHandler(pVM);
593	#endif
594
595	/* copy loop. */
596	while (cTransfers)
597	{
598	uint32_t u32Data = 0;
599	rc = iomRamRead(pVM, &u32Data, (RTGCPTR)pu8Virt, cbSize);
600	if (rc != VINF_SUCCESS)
601	break;
602	rc = iomGCMMIODoWrite(pVM, pRange, Phys, &u32Data, cbSize);
603	if (rc != VINF_SUCCESS)
604	break;
605
606	pu8Virt += offIncrement;
607	Phys += offIncrement;
608	pRegFrame->esi += offIncrement;
609	pRegFrame->edi += offIncrement;
610	cTransfers--;
611	}
612	#ifdef IN_GC
613	MMGCRamDeregisterTrapHandler(pVM);
614	#endif
615	/* Update ecx. */
616	if (pCpu->prefix & PREFIX_REP)
617	pRegFrame->ecx = cTransfers;
618	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsToMMIO, a2);
619	}
620	else
621	rc = VINF_IOM_HC_MMIO_READ_WRITE;
622	}
623	else
624	{
625	/*
626	* Read operation: [MMIO] -> [mem] or [MMIO] -> [MMIO]
627	* ds:[eSI] (Phys Src) -> es:[eDI] (Virt Dst)
628	*/
629	/* Check callback. */
630	if (!pRange->pfnReadCallback)
631	return VINF_IOM_HC_MMIO_READ;
632
633	/* Convert destination address. */
634	RTGCUINTPTR pu8Virt;
635	rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->es, (RTGCPTR)pRegFrame->edi, &pRegFrame->esHid,
636	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
637	(RTGCPTR *)&pu8Virt, NULL);
638	if (VBOX_FAILURE(rc))
639	return VINF_EM_RAW_GUEST_TRAP;
640
641	/* Check if destination address is MMIO. */
642	RTGCPHYS PhysDst;
643	rc = PGMGstGetPage(pVM, (RTGCPTR)pu8Virt, NULL, &PhysDst);
644	if ( VBOX_SUCCESS(rc)
645	&& iomMMIOGetRangeHC(&pVM->iom.s, PhysDst))
646	{
647	/*
648	* Extra: [MMIO] -> [MMIO]
649	*/
650	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsMMIO, d);
651	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
652
653	PhysDst \|= (RTGCUINTPTR)pu8Virt & PAGE_OFFSET_MASK;
654	CTXALLSUFF(PIOMMMIORANGE) pMMIODst = iomMMIOGetRange(&pVM->iom.s, PhysDst);
655	if ( !pMMIODst
656	\|\| !pMMIODst->pfnWriteCallback)
657	{
658	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsMMIO, d);
659	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
660	return VINF_IOM_HC_MMIO_READ_WRITE;
661	}
662
663	/* copy loop. */
664	while (cTransfers)
665	{
666	uint32_t u32Data;
667	rc = iomGCMMIODoRead(pVM, pRange, Phys, &u32Data, cbSize);
668	if (rc != VINF_SUCCESS)
669	break;
670	rc = iomGCMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cbSize);
671	if (rc != VINF_SUCCESS)
672	break;
673
674	Phys += offIncrement;
675	PhysDst += offIncrement;
676	pRegFrame->esi += offIncrement;
677	pRegFrame->edi += offIncrement;
678	cTransfers--;
679	}
680	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsMMIO, d);
681	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
682	}
683	else
684	{
685	/*
686	* Normal: [MMIO] -> [Mem]
687	*/
688	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
689
690	/* Access verification first; we currently can't recover properly from traps inside this instruction */
691	rc = PGMVerifyAccess(pVM, pu8Virt, cTransfers * cbSize, X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
692	if (rc != VINF_SUCCESS)
693	{
694	Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
695	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
696	return VINF_EM_RAW_EMULATE_INSTR;
697	}
698
699	/* copy loop. */
700	#ifdef IN_GC
701	MMGCRamRegisterTrapHandler(pVM);
702	#endif
703	while (cTransfers)
704	{
705	uint32_t u32Data;
706	rc = iomGCMMIODoRead(pVM, pRange, Phys, &u32Data, cbSize);
707	if (rc != VINF_SUCCESS)
708	break;
709	rc = iomRamWrite(pVM, (RTGCPTR)pu8Virt, &u32Data, cbSize);
710	if (rc != VINF_SUCCESS)
711	{
712	Log(("iomRamWrite %08X size=%d failed with %d\n", pu8Virt, cbSize, rc));
713	break;
714	}
715
716	pu8Virt += offIncrement;
717	Phys += offIncrement;
718	pRegFrame->esi += offIncrement;
719	pRegFrame->edi += offIncrement;
720	cTransfers--;
721	}
722	#ifdef IN_GC
723	MMGCRamDeregisterTrapHandler(pVM);
724	#endif
725	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovsFromMMIO, c);
726	}
727
728	/* Update ecx on exit. */
729	if (pCpu->prefix & PREFIX_REP)
730	pRegFrame->ecx = cTransfers;
731	}
732
733	/* work statistics. */
734	if (rc == VINF_SUCCESS)
735	{
736	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMovs, a);
737	iomGCMMIOStatLength(pVM, cbSize);
738	}
739	return rc;
740	}
741	#endif
742
743
744
745	/**
746	* [REP] STOSB
747	* [REP] STOSW
748	* [REP] STOSD
749	*
750	* Restricted implementation.
751	*
752	*
753	* @returns VBox status code.
754	*
755	* @param pVM The virtual machine (GC pointer ofcourse).
756	* @param pRegFrame Trap register frame.
757	* @param GCPhysFault The GC physical address corresponding to pvFault.
758	* @param pCpu Disassembler CPU state.
759	* @param pRange Pointer MMIO range.
760	*/
761	static int iomGCInterpretSTOS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
762	{
763	STAM_PROFILE_START(&pVM->iom.s.StatGCInstStos, a);
764
765	/*
766	* We do not support segment prefixes or REPNE..
767	*/
768	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REPNE))
769	return VINF_IOM_HC_MMIO_READ_WRITE;
770
771	/*
772	* Get bytes/words/dwords count to copy.
773	*/
774	uint32_t cTransfers = 1;
775	if (pCpu->prefix & PREFIX_REP)
776	{
777	cTransfers = pRegFrame->ecx;
778	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
779	cTransfers &= 0xffff;
780
781	if (!cTransfers)
782	return VINF_SUCCESS;
783	}
784
785	/*
786	* Get data size.
787	*/
788	unsigned cbSize = DISGetParamSize(pCpu, &pCpu->param1);
789	Assert(cbSize);
790	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
791
792	#ifdef VBOX_WITH_STATISTICS
793	if (pVM->iom.s.cStosMaxBytes < (cTransfers << SIZE2SHIFT(cbSize)))
794	pVM->iom.s.cStosMaxBytes = cTransfers << SIZE2SHIFT(cbSize);
795	#endif
796
797
798	RTGCPHYS Phys = GCPhysFault;
799	uint32_t u32Data = pRegFrame->eax;
800	int rc;
801	if (pRange->pfnFillCallback)
802	{
803	/*
804	* Use the fill callback.
805	*/
806	/** @todo pfnFillCallback must return number of bytes successfully written!!! */
807	if (offIncrement > 0)
808	{
809	/* addr++ variant. */
810	rc = pRange->pfnFillCallback(pRange->pDevIns, pRange->pvUser, Phys, u32Data, cbSize, cTransfers);
811	if (rc == VINF_SUCCESS)
812	{
813	/* Update registers. */
814	pRegFrame->edi += cTransfers << SIZE2SHIFT(cbSize);
815	if (pCpu->prefix & PREFIX_REP)
816	pRegFrame->ecx = 0;
817	}
818	}
819	else
820	{
821	/* addr-- variant. */
822	rc = pRange->pfnFillCallback(pRange->pDevIns, pRange->pvUser, (Phys - (cTransfers - 1)) << SIZE2SHIFT(cbSize), u32Data, cbSize, cTransfers);
823	if (rc == VINF_SUCCESS)
824	{
825	/* Update registers. */
826	pRegFrame->edi -= cTransfers << SIZE2SHIFT(cbSize);
827	if (pCpu->prefix & PREFIX_REP)
828	pRegFrame->ecx = 0;
829	}
830	}
831	}
832	else
833	{
834	/*
835	* Use the write callback.
836	*/
837	/* Check write callback. */
838	if (!pRange->pfnWriteCallback)
839	return VINF_IOM_HC_MMIO_WRITE;
840
841	/* fill loop. */
842	do
843	{
844	rc = iomGCMMIODoWrite(pVM, pRange, Phys, &u32Data, cbSize);
845	if (rc != VINF_SUCCESS)
846	break;
847
848	Phys += offIncrement;
849	pRegFrame->edi += offIncrement;
850	cTransfers--;
851	} while (cTransfers);
852
853	/* Update ecx on exit. */
854	if (pCpu->prefix & PREFIX_REP)
855	pRegFrame->ecx = cTransfers;
856	}
857
858	/*
859	* Work statistics and return.
860	*/
861	if (rc == VINF_SUCCESS)
862	{
863	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstStos, a);
864	iomGCMMIOStatLength(pVM, cbSize);
865	}
866	return rc;
867	}
868
869
870	/**
871	* [REP] LODSB
872	* [REP] LODSW
873	* [REP] LODSD
874	*
875	* Restricted implementation.
876	*
877	*
878	* @returns VBox status code.
879	*
880	* @param pVM The virtual machine (GC pointer ofcourse).
881	* @param pRegFrame Trap register frame.
882	* @param GCPhysFault The GC physical address corresponding to pvFault.
883	* @param pCpu Disassembler CPU state.
884	* @param pRange Pointer MMIO range.
885	*/
886	static int iomGCInterpretLODS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
887	{
888	STAM_PROFILE_START(&pVM->iom.s.StatGCInstLods, a1);
889
890	/*
891	* We do not support segment prefixes or REP*.
892	*/
893	if (pCpu->prefix & (PREFIX_SEG \| PREFIX_REP \| PREFIX_REPNE))
894	return VINF_IOM_HC_MMIO_READ_WRITE;
895
896	/* Check that we can handle it. */
897	if (!pRange->pfnReadCallback)
898	return VINF_IOM_HC_MMIO_READ;
899
900	/*
901	* Get data size.
902	*/
903	unsigned cbSize = DISGetParamSize(pCpu, &pCpu->param2);
904	Assert(cbSize);
905	int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cbSize : (signed)cbSize;
906
907	/*
908	* Perform read.
909	*/
910	int rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &pRegFrame->eax, cbSize);
911	if (rc == VINF_SUCCESS)
912	pRegFrame->esi += offIncrement;
913
914	/*
915	* Work statistics and return.
916	*/
917	if (rc == VINF_SUCCESS)
918	{
919	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstLods, a1);
920	iomGCMMIOStatLength(pVM, cbSize);
921	}
922	return rc;
923	}
924
925
926	/**
927	* CMP [MMIO], reg\|imm
928	* CMP reg\|imm, [MMIO]
929	*
930	* Restricted implementation.
931	*
932	*
933	* @returns VBox status code.
934	*
935	* @param pVM The virtual machine (GC pointer ofcourse).
936	* @param pRegFrame Trap register frame.
937	* @param GCPhysFault The GC physical address corresponding to pvFault.
938	* @param pCpu Disassembler CPU state.
939	* @param pRange Pointer MMIO range.
940	*/
941	static int iomGCInterpretCMP(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
942	{
943	STAM_PROFILE_START(&pVM->iom.s.StatGCInstCmp, a1);
944
945	/* Check read callback. */
946	if (!pRange->pfnReadCallback)
947	return VINF_EM_RAW_GUEST_TRAP;
948
949	/*
950	* Get the operands.
951	*/
952	unsigned cbSize = 0;
953	uint32_t uData1;
954	uint32_t uData2;
955	int rc;
956	if (iomGCGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cbSize))
957	/* cmp reg, [MMIO]. */
958	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cbSize);
959	else if (iomGCGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cbSize))
960	/* cmp [MMIO], reg\|imm. */
961	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cbSize);
962	else
963	{
964	AssertMsgFailed(("Disassember CMP problem..\n"));
965	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
966	}
967
968	if (rc == VINF_SUCCESS)
969	{
970	/* Emulate CMP and update guest flags. */
971	uint32_t eflags = EMEmulateCmp(uData1, uData2, cbSize);
972	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
973	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
974
975	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstCmp, a1);
976	iomGCMMIOStatLength(pVM, cbSize);
977	}
978
979	return rc;
980	}
981
982
983	/**
984	* AND [MMIO], reg\|imm
985	* AND reg, [MMIO]
986	*
987	* Restricted implementation.
988	*
989	*
990	* @returns VBox status code.
991	*
992	* @param pVM The virtual machine (GC pointer ofcourse).
993	* @param pRegFrame Trap register frame.
994	* @param GCPhysFault The GC physical address corresponding to pvFault.
995	* @param pCpu Disassembler CPU state.
996	* @param pRange Pointer MMIO range.
997	*/
998	static int iomGCInterpretAND(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
999	{
1000	STAM_PROFILE_START(&pVM->iom.s.StatGCInstAnd, a1);
1001
1002	/* Check read callback. */
1003
1004	unsigned cbSize = 0;
1005	uint32_t uData1;
1006	uint32_t uData2;
1007	bool fAndWrite;
1008	int rc;
1009	if (iomGCGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cbSize))
1010	{
1011	/* and reg, [MMIO]. */
1012	fAndWrite = false;
1013	if (pRange->pfnReadCallback)
1014	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cbSize);
1015	else
1016	rc = VINF_IOM_HC_MMIO_READ;
1017	}
1018	else if (iomGCGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cbSize))
1019	{
1020	/* and [MMIO], reg\|imm. */
1021	fAndWrite = true;
1022	if (pRange->pfnReadCallback && pRange->pfnWriteCallback)
1023	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cbSize);
1024	else
1025	rc = VINF_IOM_HC_MMIO_READ_WRITE;
1026	}
1027	else
1028	{
1029	AssertMsgFailed(("Disassember AND problem..\n"));
1030	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1031	}
1032
1033	if (rc == VINF_SUCCESS)
1034	{
1035	/* Emulate AND and update guest flags. */
1036	uint32_t eflags = EMEmulateAnd(&uData1, uData2, cbSize);
1037	if (fAndWrite)
1038	/* Store result to MMIO. */
1039	rc = iomGCMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cbSize);
1040	else
1041	{
1042	/* Store result to register. */
1043	bool fRc = iomGCSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData1);
1044	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1045	}
1046	if (rc == VINF_SUCCESS)
1047	{
1048	/* Update guest's eflags and finish. */
1049	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1050	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1051	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstAnd, a1);
1052	iomGCMMIOStatLength(pVM, cbSize);
1053	}
1054	}
1055
1056	return rc;
1057	}
1058
1059
1060
1061	/**
1062	* TEST [MMIO], reg\|imm
1063	* TEST reg, [MMIO]
1064	*
1065	* Restricted implementation.
1066	*
1067	*
1068	* @returns VBox status code.
1069	*
1070	* @param pVM The virtual machine (GC pointer ofcourse).
1071	* @param pRegFrame Trap register frame.
1072	* @param GCPhysFault The GC physical address corresponding to pvFault.
1073	* @param pCpu Disassembler CPU state.
1074	* @param pRange Pointer MMIO range.
1075	*/
1076	static int iomGCInterpretTEST(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
1077	{
1078	STAM_PROFILE_START(&pVM->iom.s.StatGCInstTest, a1);
1079
1080	/* Check read callback. */
1081
1082	unsigned cbSize = 0;
1083	uint32_t uData1;
1084	uint32_t uData2;
1085	int rc;
1086
1087	if (iomGCGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cbSize))
1088	{
1089	/* and test, [MMIO]. */
1090	if (pRange->pfnReadCallback)
1091	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cbSize);
1092	else
1093	rc = VINF_IOM_HC_MMIO_READ;
1094	}
1095	else if (iomGCGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cbSize))
1096	{
1097	/* test [MMIO], reg\|imm. */
1098	if (pRange->pfnReadCallback)
1099	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cbSize);
1100	else
1101	rc = VINF_IOM_HC_MMIO_READ;
1102	}
1103	else
1104	{
1105	AssertMsgFailed(("Disassember TEST problem..\n"));
1106	return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1107	}
1108
1109	if (rc == VINF_SUCCESS)
1110	{
1111	/* Emulate TEST (=AND without write back) and update guest EFLAGS. */
1112	uint32_t eflags = EMEmulateAnd(&uData1, uData2, cbSize);
1113	pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF))
1114	\| (eflags & (X86_EFL_CF \| X86_EFL_PF \| X86_EFL_AF \| X86_EFL_ZF \| X86_EFL_SF \| X86_EFL_OF));
1115	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstTest, a1);
1116	iomGCMMIOStatLength(pVM, cbSize);
1117	}
1118
1119	return rc;
1120	}
1121
1122	/**
1123	* XCHG [MMIO], reg
1124	* XCHG reg, [MMIO]
1125	*
1126	* Restricted implementation.
1127	*
1128	*
1129	* @returns VBox status code.
1130	*
1131	* @param pVM The virtual machine (GC pointer ofcourse).
1132	* @param pRegFrame Trap register frame.
1133	* @param GCPhysFault The GC physical address corresponding to pvFault.
1134	* @param pCpu Disassembler CPU state.
1135	* @param pRange Pointer MMIO range.
1136	*/
1137	static int iomGCInterpretXCHG(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, CTXALLSUFF(PIOMMMIORANGE) pRange)
1138	{
1139	STAM_PROFILE_START(&pVM->iom.s.StatGCInstTest, a1);
1140
1141	/* Check read callback. */
1142	unsigned cbSize = 0;
1143	uint32_t uData1;
1144	uint32_t uData2;
1145	int rc;
1146
1147	if (!pRange->pfnReadCallback \|\| !pRange->pfnWriteCallback)
1148	{
1149	rc = VINF_IOM_HC_MMIO_READ;
1150	goto end;
1151	}
1152
1153	if (iomGCGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cbSize))
1154	{
1155	/* xchg reg, [MMIO]. */
1156	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cbSize);
1157	if (rc == VINF_SUCCESS)
1158	{
1159	/* Store result to MMIO. */
1160	rc = iomGCMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cbSize);
1161
1162	if (rc == VINF_SUCCESS)
1163	{
1164	/* Store result to register. */
1165	bool fRc = iomGCSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData2);
1166	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1167	}
1168	else
1169	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
1170	}
1171	else
1172	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
1173	}
1174	else
1175	if (iomGCGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cbSize))
1176	{
1177	/* xchg [MMIO], reg. */
1178	rc = iomGCMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cbSize);
1179	if (rc == VINF_SUCCESS)
1180	{
1181	/* Store result to MMIO. */
1182	rc = iomGCMMIODoWrite(pVM, pRange, GCPhysFault, &uData2, cbSize);
1183
1184	if (rc == VINF_SUCCESS)
1185	{
1186	/* Store result to register. */
1187	bool fRc = iomGCSaveDataToReg(pCpu, &pCpu->param2, pRegFrame, uData1);
1188	AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1189	}
1190	else
1191	Assert(rc == VINF_IOM_HC_MMIO_WRITE \|\| rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
1192	}
1193	else
1194	Assert(rc == VINF_IOM_HC_MMIO_READ \|\| rc == VINF_PATM_HC_MMIO_PATCH_READ);
1195	}
1196	else
1197	{
1198	AssertMsgFailed(("Disassember XCHG problem..\n"));
1199	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1200	goto end;
1201	}
1202
1203	end:
1204	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstTest, a1);
1205	return rc;
1206	}
1207
1208
1209	#ifdef IN_RING0
1210
1211	/**
1212	* Read callback for disassembly function; supports reading bytes that cross a page boundary
1213	*
1214	* @returns VBox status code.
1215	* @param pSrc GC source pointer
1216	* @param pDest HC destination pointer
1217	* @param size Number of bytes to read
1218	* @param dwUserdata Callback specific user data (pCpu)
1219	*
1220	*/
1221	DECLCALLBACK(int32_t) iomReadBytes(RTHCUINTPTR pSrc, uint8_t *pDest, uint32_t size, RTHCUINTPTR dwUserdata)
1222	{
1223	DISCPUSTATE pCpu = (DISCPUSTATE )dwUserdata;
1224	PVM pVM = (PVM)pCpu->dwUserData[0];
1225
1226	int rc = PGMPhysReadGCPtr(pVM, pDest, pSrc, size);
1227	AssertRC(rc);
1228	return rc;
1229	}
1230
1231	inline bool iomDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
1232	{
1233	return VBOX_SUCCESS(DISCoreOneEx(InstrGC, pCpu->mode, iomReadBytes, pVM, pCpu, pOpsize));
1234	}
1235	#else
1236	inline bool iomDisCoreOne(PVM pVM, DISCPUSTATE pCpu, RTGCUINTPTR InstrGC, uint32_t pOpsize)
1237	{
1238	return DISCoreOne(pCpu, InstrGC, pOpsize);
1239	}
1240
1241	#endif
1242
1243	/**
1244	* \#PF Handler callback for MMIO ranges.
1245	* Note: we are on ring0 in Hypervisor and interrupts are disabled.
1246	*
1247	* @returns VBox status code (appropriate for GC return).
1248	* @param pVM VM Handle.
1249	* @param uErrorCode CPU Error code.
1250	* @param pRegFrame Trap register frame.
1251	* @param pvFault The fault address (cr2).
1252	* @param GCPhysFault The GC physical address corresponding to pvFault.
1253	* @param pvUser Pointer to the MMIO ring-3 range entry.
1254	*/
1255	IOMDECL(int) IOMMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void pvFault, RTGCPHYS GCPhysFault, void pvUser)
1256	{
1257	STAM_PROFILE_START(&pVM->iom.s.StatGCMMIOHandler, a);
1258	NOREF(pvUser); /** @todo implement pvUser usage! */
1259	Log3(("IOMMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%p eip=%RGv\n",
1260	GCPhysFault, uErrorCode, pvFault, pRegFrame->eip));
1261
1262	/*
1263	* Find the corresponding MMIO range.
1264	*/
1265	CTXALLSUFF(PIOMMMIORANGE) pRange = iomMMIOGetRange(&pVM->iom.s, GCPhysFault);
1266	if (!pRange)
1267	{
1268	#ifdef VBOX_WITH_STATISTICS
1269	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault);
1270	if (pStats)
1271	{
1272	if (uErrorCode & X86_TRAP_PF_RW)
1273	STAM_COUNTER_INC(&pStats->WriteGCToR3);
1274	else
1275	STAM_COUNTER_INC(&pStats->ReadGCToR3);
1276	}
1277	#endif
1278	PIOMMMIORANGER3 pRangeR3 = iomMMIOGetRangeHC(&pVM->iom.s, GCPhysFault);
1279	if (pRangeR3)
1280	{
1281	STAM_PROFILE_START(&pVM->iom.s.StatGCMMIOHandler, a);
1282	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIOFailures);
1283	return (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1284	}
1285
1286	/*
1287	* Now, why are we here...
1288	*/
1289	AssertMsgFailed(("Internal error! GCPhysFault=%x\n", GCPhysFault));
1290	return VERR_IOM_MMIO_HANDLER_BOGUS_CALL;
1291	}
1292
1293	/*
1294	* Convert CS:EIP to linear address and initialize the disassembler.
1295	*/
1296	DISCPUSTATE cpu;
1297	cpu.mode = SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) ? CPUMODE_32BIT : CPUMODE_16BIT;
1298
1299	RTGCPTR pvCode;
1300	int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)(cpu.mode == CPUMODE_32BIT ? pRegFrame->eip : pRegFrame->eip & 0xffff), &pvCode);
1301	if (VBOX_FAILURE(rc))
1302	{
1303	AssertMsgFailed(("Internal error! cs:eip=%04x:%08x rc=%Vrc\n", pRegFrame->cs, pRegFrame->eip, rc));
1304	return VERR_IOM_MMIO_HANDLER_BOGUS_CALL;
1305	}
1306
1307	/*
1308	* Disassemble the instruction and interprete it.
1309	*/
1310	unsigned cbOp;
1311	if (iomDisCoreOne(pVM, &cpu, (RTGCUINTPTR)pvCode, &cbOp))
1312	{
1313	switch (cpu.pCurInstr->opcode)
1314	{
1315	case OP_MOV:
1316	case OP_MOVZX:
1317	case OP_MOVSX:
1318	{
1319	STAM_PROFILE_START(&pVM->iom.s.StatGCInstMov, b);
1320	if (uErrorCode & X86_TRAP_PF_RW)
1321	rc = iomGCInterpretMOVxXWrite(pVM, pRegFrame, &cpu, pRange, GCPhysFault);
1322	else
1323	rc = iomGCInterpretMOVxXRead(pVM, pRegFrame, &cpu, pRange, GCPhysFault);
1324	if (rc == VINF_SUCCESS)
1325	STAM_PROFILE_STOP(&pVM->iom.s.StatGCInstMov, b);
1326	break;
1327	}
1328
1329
1330	#ifdef IOMGC_MOVS_SUPPORT
1331	case OP_MOVSB:
1332	case OP_MOVSWD:
1333	rc = iomGCInterpretMOVS(pVM, uErrorCode, pRegFrame, GCPhysFault, &cpu, pRange);
1334	break;
1335	#endif
1336
1337	case OP_STOSB:
1338	case OP_STOSWD:
1339	Assert(uErrorCode & X86_TRAP_PF_RW);
1340	rc = iomGCInterpretSTOS(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1341	break;
1342
1343	case OP_LODSB:
1344	case OP_LODSWD:
1345	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1346	rc = iomGCInterpretLODS(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1347	break;
1348
1349
1350	case OP_CMP:
1351	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1352	rc = iomGCInterpretCMP(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1353	break;
1354
1355	case OP_AND:
1356	rc = iomGCInterpretAND(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1357	break;
1358
1359	case OP_TEST:
1360	Assert(!(uErrorCode & X86_TRAP_PF_RW));
1361	rc = iomGCInterpretTEST(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1362	break;
1363
1364	case OP_XCHG:
1365	rc = iomGCInterpretXCHG(pVM, pRegFrame, GCPhysFault, &cpu, pRange);
1366	break;
1367
1368
1369	/*
1370	* The instruction isn't supported. Hand it on to ring-3.
1371	*/
1372	default:
1373	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstOther);
1374	rc = (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1375	break;
1376	}
1377	}
1378	else
1379	{
1380	AssertMsgFailed(("Disassembler freaked out!\n"));
1381	rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1382	}
1383
1384	/*
1385	* On success advance EIP.
1386	*/
1387	if (rc == VINF_SUCCESS)
1388	pRegFrame->eip += cbOp;
1389	else
1390	{
1391	STAM_COUNTER_INC(&pVM->iom.s.StatGCMMIOFailures);
1392	#ifdef VBOX_WITH_STATISTICS
1393	switch (rc)
1394	{
1395	case VINF_IOM_HC_MMIO_READ:
1396	case VINF_IOM_HC_MMIO_WRITE:
1397	case VINF_IOM_HC_MMIO_READ_WRITE:
1398	{
1399	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault);
1400	if (pStats)
1401	{
1402	if (uErrorCode & X86_TRAP_PF_RW)
1403	STAM_COUNTER_INC(&pStats->WriteGCToR3);
1404	else
1405	STAM_COUNTER_INC(&pStats->ReadGCToR3);
1406	}
1407	}
1408	break;
1409	}
1410	#endif
1411	}
1412	STAM_PROFILE_STOP(&pVM->iom.s.StatGCMMIOHandler, a);
1413	return rc;
1414	}
1415
1416
1417	/**
1418	* Reads a MMIO register.
1419	*
1420	* @returns VBox status code.
1421	*
1422	* @param pVM VM handle.
1423	* @param GCPhys The physical address to read.
1424	* @param pu32Value Where to store the value read.
1425	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1426	*/
1427	IOMDECL(int) IOMMMIORead(PVM pVM, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue)
1428	{
1429	/** @todo add return to ring-3 statistics when this function is used in GC! */
1430
1431	/*
1432	* Lookup the current context range node and statistics.
1433	*/
1434	CTXALLSUFF(PIOMMMIORANGE) pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1435	#ifdef VBOX_WITH_STATISTICS
1436	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys);
1437	if (!pStats && (!pRange \|\| pRange->cbSize <= PAGE_SIZE))
1438	# ifdef IN_RING3
1439	pStats = iomR3MMIOStatsCreate(pVM, GCPhys, pRange ? pRange->pszDesc : NULL);
1440	# else
1441	return VINF_IOM_HC_MMIO_READ;
1442	# endif
1443	#endif /* VBOX_WITH_STATISTICS */
1444	#ifdef IN_RING3
1445	if (pRange)
1446	#else /* !IN_RING3 */
1447	if (pRange && pRange->pfnReadCallback)
1448	#endif /* !IN_RING3 */
1449	{
1450	/*
1451	* Perform the read and deal with the result.
1452	*/
1453	#ifdef VBOX_WITH_STATISTICS
1454	if (pStats)
1455	STAM_PROFILE_ADV_START(&pStats->CTXALLSUFF(ProfRead), a);
1456	#endif
1457	int rc = pRange->pfnReadCallback(pRange->pDevIns, pRange->pvUser, GCPhys, pu32Value, cbValue);
1458	#ifdef VBOX_WITH_STATISTICS
1459	if (pStats)
1460	STAM_PROFILE_ADV_STOP(&pStats->CTXALLSUFF(ProfRead), a);
1461	if (pStats && rc != VINF_IOM_HC_MMIO_READ)
1462	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Read));
1463	#endif
1464	switch (rc)
1465	{
1466	case VINF_SUCCESS:
1467	default:
1468	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1469	return rc;
1470
1471	case VINF_IOM_MMIO_UNUSED_00:
1472	switch (cbValue)
1473	{
1474	case 1: (uint8_t )pu32Value = 0x00; break;
1475	case 2: (uint16_t )pu32Value = 0x0000; break;
1476	case 4: (uint32_t )pu32Value = 0x00000000; break;
1477	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%VGp\n", cbValue, GCPhys)); break;
1478	}
1479	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1480	return VINF_SUCCESS;
1481
1482	case VINF_IOM_MMIO_UNUSED_FF:
1483	switch (cbValue)
1484	{
1485	case 1: (uint8_t )pu32Value = 0xff; break;
1486	case 2: (uint16_t )pu32Value = 0xffff; break;
1487	case 4: (uint32_t )pu32Value = 0xffffffff; break;
1488	default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%VGp\n", cbValue, GCPhys)); break;
1489	}
1490	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, pu32Value, cbValue, rc));
1491	return VINF_SUCCESS;
1492	}
1493	}
1494
1495	#ifndef IN_RING3
1496	/*
1497	* Lookup the ring-3 range.
1498	*/
1499	PIOMMMIORANGER3 pRangeR3 = iomMMIOGetRangeHC(&pVM->iom.s, GCPhys);
1500	if (pRangeR3)
1501	{
1502	if (pRangeR3->pfnReadCallback)
1503	return VINF_IOM_HC_MMIO_READ;
1504	# ifdef VBOX_WITH_STATISTICS
1505	if (pStats)
1506	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Read));
1507	# endif
1508	*pu32Value = 0;
1509	Log4(("IOMMMIORead: GCPhys=%RGp pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, pu32Value, cbValue));
1510	return VINF_SUCCESS;
1511	}
1512	#endif
1513
1514	AssertMsgFailed(("Handlers and page tables are out of sync or something! GCPhys=%VGp cbValue=%d\n", GCPhys, cbValue));
1515	return VERR_INTERNAL_ERROR;
1516	}
1517
1518
1519	/**
1520	* Writes to a MMIO register.
1521	*
1522	* @returns VBox status code.
1523	*
1524	* @param pVM VM handle.
1525	* @param GCPhys The physical address to write to.
1526	* @param u32Value The value to write.
1527	* @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1528	*/
1529	IOMDECL(int) IOMMMIOWrite(PVM pVM, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue)
1530	{
1531	/** @todo add return to ring-3 statistics when this function is used in GC! */
1532	/*
1533	* Lookup the current context range node.
1534	*/
1535	CTXALLSUFF(PIOMMMIORANGE) pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1536	#ifdef VBOX_WITH_STATISTICS
1537	PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys);
1538	if (!pStats && (!pRange \|\| pRange->cbSize <= PAGE_SIZE))
1539	# ifdef IN_RING3
1540	pStats = iomR3MMIOStatsCreate(pVM, GCPhys, pRange ? pRange->pszDesc : NULL);
1541	# else
1542	return VINF_IOM_HC_MMIO_WRITE;
1543	# endif
1544	#endif /* VBOX_WITH_STATISTICS */
1545
1546	/*
1547	* Perform the write if we found a range.
1548	*/
1549	#ifdef IN_RING3
1550	if (pRange)
1551	#else /* !IN_RING3 */
1552	if (pRange && pRange->pfnWriteCallback)
1553	#endif /* !IN_RING3 */
1554	{
1555	#ifdef VBOX_WITH_STATISTICS
1556	if (pStats)
1557	STAM_PROFILE_ADV_START(&pStats->CTXALLSUFF(ProfWrite), a);
1558	#endif
1559	int rc = pRange->pfnWriteCallback(pRange->pDevIns, pRange->pvUser, GCPhys, &u32Value, cbValue);
1560	#ifdef VBOX_WITH_STATISTICS
1561	if (pStats)
1562	STAM_PROFILE_ADV_STOP(&pStats->CTXALLSUFF(ProfWrite), a);
1563	if (pStats && rc != VINF_IOM_HC_MMIO_WRITE)
1564	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Write));
1565	#endif
1566	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, u32Value, cbValue, rc));
1567	return rc;
1568	}
1569
1570	#ifndef IN_RING3
1571	/*
1572	* Lookup the ring-3 range.
1573	*/
1574	PIOMMMIORANGER3 pRangeR3 = iomMMIOGetRangeHC(&pVM->iom.s, GCPhys);
1575	if (pRangeR3)
1576	{
1577	if (pRangeR3->pfnWriteCallback)
1578	return VINF_IOM_HC_MMIO_WRITE;
1579	# ifdef VBOX_WITH_STATISTICS
1580	if (pStats)
1581	STAM_COUNTER_INC(&pStats->CTXALLSUFF(Write));
1582	# endif
1583	Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Vrc\n", GCPhys, u32Value, cbValue));
1584	return VINF_SUCCESS;
1585	}
1586	#endif
1587
1588	AssertMsgFailed(("Handlers and page tables are out of sync or something! GCPhys=%VGp cbValue=%d\n", GCPhys, cbValue));
1589	return VERR_INTERNAL_ERROR;
1590	}
1591
1592
1593	/**
1594	* [REP*] INSB/INSW/INSD
1595	* ES:EDI,DX[,ECX]
1596	*
1597	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1598	*
1599	* @returns Strict VBox status code. Informational status codes other than the one documented
1600	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1601	* @retval VINF_SUCCESS Success.
1602	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1603	* status code must be passed on to EM.
1604	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1605	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1606	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1607	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1608	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1609	*
1610	* @param pVM The virtual machine (GC pointer ofcourse).
1611	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1612	* @param uPort IO Port
1613	* @param uPrefix IO instruction prefix
1614	* @param cbTransfer Size of transfer unit
1615	*/
1616	IOMDECL(int) IOMInterpretINSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1617	{
1618	#ifdef VBOX_WITH_STATISTICS
1619	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstIns);
1620	#endif
1621
1622	/*
1623	* We do not support REPNE or decrementing destination
1624	* pointer. Segment prefixes are deliberately ignored, as per the instruction specification.
1625	*/
1626	if ( (uPrefix & PREFIX_REPNE)
1627	\|\| pRegFrame->eflags.Bits.u1DF)
1628	return VINF_EM_RAW_EMULATE_INSTR;
1629
1630	/*
1631	* Get bytes/words/dwords count to transfer.
1632	*/
1633	RTGCUINTREG cTransfers = 1;
1634	if (uPrefix & PREFIX_REP)
1635	{
1636	cTransfers = pRegFrame->ecx;
1637
1638	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
1639	cTransfers &= 0xffff;
1640
1641	if (!cTransfers)
1642	return VINF_SUCCESS;
1643	}
1644
1645	/* Convert destination address es:edi. */
1646	RTGCPTR GCPtrDst;
1647	int rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->es, (RTGCPTR)pRegFrame->edi, &pRegFrame->esHid,
1648	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1649	&GCPtrDst, NULL);
1650	if (VBOX_FAILURE(rc))
1651	{
1652	Log(("INS destination address conversion failed -> fallback, rc=%d\n", rc));
1653	return VINF_EM_RAW_EMULATE_INSTR;
1654	}
1655
1656	/* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
1657	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1658
1659	rc = PGMVerifyAccess(pVM, (RTGCUINTPTR)GCPtrDst, cTransfers * cbTransfer,
1660	X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
1661	if (rc != VINF_SUCCESS)
1662	{
1663	Log(("INS will generate a trap -> fallback, rc=%d\n", rc));
1664	return VINF_EM_RAW_EMULATE_INSTR;
1665	}
1666
1667	Log(("IOM: rep ins%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1668	if (cTransfers > 1)
1669	{
1670	/* If the device supports string transfers, ask it to do as
1671	* much as it wants. The rest is done with single-word transfers. */
1672	const RTGCUINTREG cTransfersOrg = cTransfers;
1673	rc = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbTransfer);
1674	AssertRC(rc); Assert(cTransfers <= cTransfersOrg);
1675	pRegFrame->edi += (cTransfersOrg - cTransfers) * cbTransfer;
1676	}
1677
1678	#ifdef IN_GC
1679	MMGCRamRegisterTrapHandler(pVM);
1680	#endif
1681
1682	while (cTransfers && rc == VINF_SUCCESS)
1683	{
1684	uint32_t u32Value;
1685	rc = IOMIOPortRead(pVM, uPort, &u32Value, cbTransfer);
1686	if (!IOM_SUCCESS(rc))
1687	break;
1688	int rc2 = iomRamWrite(pVM, GCPtrDst, &u32Value, cbTransfer);
1689	Assert(rc2 == VINF_SUCCESS); NOREF(rc2);
1690	GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbTransfer);
1691	pRegFrame->edi += cbTransfer;
1692	cTransfers--;
1693	}
1694	#ifdef IN_GC
1695	MMGCRamDeregisterTrapHandler(pVM);
1696	#endif
1697
1698	/* Update ecx on exit. */
1699	if (uPrefix & PREFIX_REP)
1700	pRegFrame->ecx = cTransfers;
1701
1702	AssertMsg(rc == VINF_SUCCESS \|\| rc == VINF_IOM_HC_IOPORT_READ \|\| (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST) \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1703	return rc;
1704	}
1705
1706
1707	/**
1708	* [REP*] INSB/INSW/INSD
1709	* ES:EDI,DX[,ECX]
1710	*
1711	* @returns Strict VBox status code. Informational status codes other than the one documented
1712	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1713	* @retval VINF_SUCCESS Success.
1714	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1715	* status code must be passed on to EM.
1716	* @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1717	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1718	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1719	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1720	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1721	*
1722	* @param pVM The virtual machine (GC pointer ofcourse).
1723	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1724	* @param pCpu Disassembler CPU state.
1725	*/
1726	IOMDECL(int) IOMInterpretINS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1727	{
1728	/*
1729	* Get port number directly from the register (no need to bother the
1730	* disassembler). And get the I/O register size from the opcode / prefix.
1731	*/
1732	uint32_t uPort = pRegFrame->edx & 0xffff;
1733	unsigned cbSize = 0;
1734	if (pCpu->pCurInstr->opcode == OP_INSB)
1735	cbSize = 1;
1736	else
1737	cbSize = pCpu->opmode == CPUMODE_32BIT ? 4 : 2;
1738
1739	int rc = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, uPort, cbSize);
1740	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1741	{
1742	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1743	return rc;
1744	}
1745
1746	return IOMInterpretINSEx(pVM, pRegFrame, uPort, pCpu->prefix, cbSize);
1747	}
1748
1749
1750	/**
1751	* [REP*] OUTSB/OUTSW/OUTSD
1752	* DS:ESI,DX[,ECX]
1753	*
1754	* @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1755	*
1756	* @returns Strict VBox status code. Informational status codes other than the one documented
1757	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1758	* @retval VINF_SUCCESS Success.
1759	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1760	* status code must be passed on to EM.
1761	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1762	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1763	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1764	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1765	*
1766	* @param pVM The virtual machine (GC pointer ofcourse).
1767	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1768	* @param uPort IO Port
1769	* @param uPrefix IO instruction prefix
1770	* @param cbTransfer Size of transfer unit
1771	*/
1772	IOMDECL(int) IOMInterpretOUTSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1773	{
1774	#ifdef VBOX_WITH_STATISTICS
1775	STAM_COUNTER_INC(&pVM->iom.s.StatGCInstOuts);
1776	#endif
1777
1778	/*
1779	* We do not support segment prefixes, REPNE or
1780	* decrementing source pointer.
1781	*/
1782	if ( (uPrefix & (PREFIX_SEG \| PREFIX_REPNE))
1783	\|\| pRegFrame->eflags.Bits.u1DF)
1784	return VINF_EM_RAW_EMULATE_INSTR;
1785
1786	/*
1787	* Get bytes/words/dwords count to transfer.
1788	*/
1789	RTGCUINTREG cTransfers = 1;
1790	if (uPrefix & PREFIX_REP)
1791	{
1792	cTransfers = pRegFrame->ecx;
1793	if (!SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
1794	cTransfers &= 0xffff;
1795
1796	if (!cTransfers)
1797	return VINF_SUCCESS;
1798	}
1799
1800	/* Convert source address ds:esi. */
1801	RTGCPTR GCPtrSrc;
1802	int rc = SELMToFlatEx(pVM, pRegFrame->eflags, pRegFrame->ds, (RTGCPTR)pRegFrame->esi, &pRegFrame->dsHid,
1803	SELMTOFLAT_FLAGS_HYPER \| SELMTOFLAT_FLAGS_NO_PL,
1804	&GCPtrSrc, NULL);
1805	if (VBOX_FAILURE(rc))
1806	{
1807	Log(("OUTS source address conversion failed -> fallback, rc=%Vrc\n", rc));
1808	return VINF_EM_RAW_EMULATE_INSTR;
1809	}
1810
1811	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1812	uint32_t cpl = CPUMGetGuestCPL(pVM, pRegFrame);
1813	rc = PGMVerifyAccess(pVM, (RTGCUINTPTR)GCPtrSrc, cTransfers * cbTransfer,
1814	(cpl == 3) ? X86_PTE_US : 0);
1815	if (rc != VINF_SUCCESS)
1816	{
1817	Log(("OUTS will generate a trap -> fallback, rc=%Vrc\n", rc));
1818	return VINF_EM_RAW_EMULATE_INSTR;
1819	}
1820
1821	Log(("IOM: rep outs%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1822	if (cTransfers > 1)
1823	{
1824	/*
1825	* If the device supports string transfers, ask it to do as
1826	* much as it wants. The rest is done with single-word transfers.
1827	*/
1828	const RTGCUINTREG cTransfersOrg = cTransfers;
1829	rc = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbTransfer);
1830	AssertRC(rc); Assert(cTransfers <= cTransfersOrg);
1831	pRegFrame->esi += (cTransfersOrg - cTransfers) * cbTransfer;
1832	}
1833
1834	#ifdef IN_GC
1835	MMGCRamRegisterTrapHandler(pVM);
1836	#endif
1837
1838	while (cTransfers && rc == VINF_SUCCESS)
1839	{
1840	uint32_t u32Value;
1841	rc = iomRamRead(pVM, &u32Value, GCPtrSrc, cbTransfer);
1842	if (rc != VINF_SUCCESS)
1843	break;
1844	rc = IOMIOPortWrite(pVM, uPort, u32Value, cbTransfer);
1845	if (!IOM_SUCCESS(rc))
1846	break;
1847	GCPtrSrc = (RTGCPTR)((RTUINTPTR)GCPtrSrc + cbTransfer);
1848	pRegFrame->esi += cbTransfer;
1849	cTransfers--;
1850	}
1851
1852	#ifdef IN_GC
1853	MMGCRamDeregisterTrapHandler(pVM);
1854	#endif
1855
1856	/* Update ecx on exit. */
1857	if (uPrefix & PREFIX_REP)
1858	pRegFrame->ecx = cTransfers;
1859
1860	AssertMsg(rc == VINF_SUCCESS \|\| rc == VINF_IOM_HC_IOPORT_WRITE \|\| (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST) \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1861	return rc;
1862	}
1863
1864
1865	/**
1866	* [REP*] OUTSB/OUTSW/OUTSD
1867	* DS:ESI,DX[,ECX]
1868	*
1869	* @returns Strict VBox status code. Informational status codes other than the one documented
1870	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1871	* @retval VINF_SUCCESS Success.
1872	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1873	* status code must be passed on to EM.
1874	* @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1875	* @retval VINF_EM_RAW_EMULATE_INSTR Defer the write to the REM.
1876	* @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1877	* @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1878	* @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1879	*
1880	* @param pVM The virtual machine (GC pointer ofcourse).
1881	* @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1882	* @param pCpu Disassembler CPU state.
1883	*/
1884	IOMDECL(int) IOMInterpretOUTS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1885	{
1886	/*
1887	* Get port number from the first parameter.
1888	* And get the I/O register size from the opcode / prefix.
1889	*/
1890	uint32_t uPort = 0;
1891	unsigned cbSize = 0;
1892	bool fRc = iomGCGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uPort, &cbSize);
1893	AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
1894	if (pCpu->pCurInstr->opcode == OP_OUTSB)
1895	cbSize = 1;
1896	else
1897	cbSize = (pCpu->opmode == CPUMODE_32BIT) ? 4 : 2;
1898
1899	int rc = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, uPort, cbSize);
1900	if (RT_UNLIKELY(rc != VINF_SUCCESS))
1901	{
1902	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| rc == VINF_TRPM_XCPT_DISPATCHED \|\| VBOX_FAILURE(rc), ("%Vrc\n", rc));
1903	return rc;
1904	}
1905
1906	return IOMInterpretOUTSEx(pVM, pRegFrame, uPort, pCpu->prefix, cbSize);
1907	}
1908

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp@ 3254

Download in other formats: