VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp@ 25837

Last change on this file since 25837 was 25483, checked in by vboxsync, 15 years ago

Fixed BT MMIO emulation
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 69.8 KB
Line 
1/* $Id: IOMAllMMIO.cpp 25483 2009-12-18 13:45:27Z vboxsync $ */
2/** @file
3 * IOM - Input / Output Monitor - Any Context, MMIO & String I/O.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_IOM
27#include <VBox/iom.h>
28#include <VBox/cpum.h>
29#include <VBox/pgm.h>
30#include <VBox/selm.h>
31#include <VBox/mm.h>
32#include <VBox/em.h>
33#include <VBox/pgm.h>
34#include <VBox/trpm.h>
35#include "IOMInternal.h"
36#include <VBox/vm.h>
37#include <VBox/vmm.h>
38#include <VBox/hwaccm.h>
39
40#include <VBox/dis.h>
41#include <VBox/disopcode.h>
42#include <VBox/param.h>
43#include <VBox/err.h>
44#include <iprt/assert.h>
45#include <VBox/log.h>
46#include <iprt/asm.h>
47#include <iprt/string.h>
48
49
50/*******************************************************************************
51* Global Variables *
52*******************************************************************************/
53
54/**
55 * Array for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
56 */
57static const unsigned g_aSize2Shift[] =
58{
59 ~0, /* 0 - invalid */
60 0, /* *1 == 2^0 */
61 1, /* *2 == 2^1 */
62 ~0, /* 3 - invalid */
63 2, /* *4 == 2^2 */
64 ~0, /* 5 - invalid */
65 ~0, /* 6 - invalid */
66 ~0, /* 7 - invalid */
67 3 /* *8 == 2^3 */
68};
69
70/**
71 * Macro for fast recode of the operand size (1/2/4/8 bytes) to bit shift value.
72 */
73#define SIZE_2_SHIFT(cb) (g_aSize2Shift[cb])
74
75
76/**
77 * Wrapper which does the write and updates range statistics when such are enabled.
78 * @warning RT_SUCCESS(rc=VINF_IOM_HC_MMIO_WRITE) is TRUE!
79 */
80DECLINLINE(int) iomMMIODoWrite(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cb)
81{
82#ifdef VBOX_WITH_STATISTICS
83 PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
84 Assert(pStats);
85#endif
86
87 int rc;
88 if (RT_LIKELY(pRange->CTX_SUFF(pfnWriteCallback)))
89 rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhysFault, (void *)pvData, cb); /* @todo fix const!! */
90 else
91 rc = VINF_SUCCESS;
92 if (rc != VINF_IOM_HC_MMIO_WRITE)
93 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Write));
94 return rc;
95}
96
97
98/**
99 * Wrapper which does the read and updates range statistics when such are enabled.
100 */
101DECLINLINE(int) iomMMIODoRead(PVM pVM, PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
102{
103#ifdef VBOX_WITH_STATISTICS
104 PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
105 Assert(pStats);
106#endif
107
108 int rc;
109 if (RT_LIKELY(pRange->CTX_SUFF(pfnReadCallback)))
110 rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pvValue, cbValue);
111 else
112 rc = VINF_IOM_MMIO_UNUSED_FF;
113 if (rc != VINF_SUCCESS)
114 {
115 switch (rc)
116 {
117 case VINF_IOM_MMIO_UNUSED_FF:
118 switch (cbValue)
119 {
120 case 1: *(uint8_t *)pvValue = UINT8_C(0xff); break;
121 case 2: *(uint16_t *)pvValue = UINT16_C(0xffff); break;
122 case 4: *(uint32_t *)pvValue = UINT32_C(0xffffffff); break;
123 case 8: *(uint64_t *)pvValue = UINT64_C(0xffffffffffffffff); break;
124 default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
125 }
126 rc = VINF_SUCCESS;
127 break;
128
129 case VINF_IOM_MMIO_UNUSED_00:
130 switch (cbValue)
131 {
132 case 1: *(uint8_t *)pvValue = UINT8_C(0x00); break;
133 case 2: *(uint16_t *)pvValue = UINT16_C(0x0000); break;
134 case 4: *(uint32_t *)pvValue = UINT32_C(0x00000000); break;
135 case 8: *(uint64_t *)pvValue = UINT64_C(0x0000000000000000); break;
136 default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
137 }
138 rc = VINF_SUCCESS;
139 break;
140 }
141 }
142 if (rc != VINF_IOM_HC_MMIO_READ)
143 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Read));
144 return rc;
145}
146
147
148/**
149 * Internal - statistics only.
150 */
151DECLINLINE(void) iomMMIOStatLength(PVM pVM, unsigned cb)
152{
153#ifdef VBOX_WITH_STATISTICS
154 switch (cb)
155 {
156 case 1:
157 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO1Byte);
158 break;
159 case 2:
160 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO2Bytes);
161 break;
162 case 4:
163 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO4Bytes);
164 break;
165 case 8:
166 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIO8Bytes);
167 break;
168 default:
169 /* No way. */
170 AssertMsgFailed(("Invalid data length %d\n", cb));
171 break;
172 }
173#else
174 NOREF(pVM); NOREF(cb);
175#endif
176}
177
178
179/**
180 * MOV reg, mem (read)
181 * MOVZX reg, mem (read)
182 * MOVSX reg, mem (read)
183 *
184 * @returns VBox status code.
185 *
186 * @param pVM The virtual machine.
187 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
188 * @param pCpu Disassembler CPU state.
189 * @param pRange Pointer MMIO range.
190 * @param GCPhysFault The GC physical address corresponding to pvFault.
191 */
192static int iomInterpretMOVxXRead(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
193{
194 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
195
196 /*
197 * Get the data size from parameter 2,
198 * and call the handler function to get the data.
199 */
200 unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
201 AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
202
203 uint64_t u64Data = 0;
204 int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &u64Data, cb);
205 if (rc == VINF_SUCCESS)
206 {
207 /*
208 * Do sign extension for MOVSX.
209 */
210 /** @todo checkup MOVSX implementation! */
211 if (pCpu->pCurInstr->opcode == OP_MOVSX)
212 {
213 if (cb == 1)
214 {
215 /* DWORD <- BYTE */
216 int64_t iData = (int8_t)u64Data;
217 u64Data = (uint64_t)iData;
218 }
219 else
220 {
221 /* DWORD <- WORD */
222 int64_t iData = (int16_t)u64Data;
223 u64Data = (uint64_t)iData;
224 }
225 }
226
227 /*
228 * Store the result to register (parameter 1).
229 */
230 bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, u64Data);
231 AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
232 }
233
234 if (rc == VINF_SUCCESS)
235 iomMMIOStatLength(pVM, cb);
236 return rc;
237}
238
239
240/**
241 * MOV mem, reg|imm (write)
242 *
243 * @returns VBox status code.
244 *
245 * @param pVM The virtual machine.
246 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
247 * @param pCpu Disassembler CPU state.
248 * @param pRange Pointer MMIO range.
249 * @param GCPhysFault The GC physical address corresponding to pvFault.
250 */
251static int iomInterpretMOVxXWrite(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault)
252{
253 Assert(pRange->CTX_SUFF(pfnWriteCallback) || !pRange->pfnWriteCallbackR3);
254
255 /*
256 * Get data to write from second parameter,
257 * and call the callback to write it.
258 */
259 unsigned cb = 0;
260 uint64_t u64Data = 0;
261 bool fRc = iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &u64Data, &cb);
262 AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
263
264 int rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &u64Data, cb);
265 if (rc == VINF_SUCCESS)
266 iomMMIOStatLength(pVM, cb);
267 return rc;
268}
269
270
271/** Wrapper for reading virtual memory. */
272DECLINLINE(int) iomRamRead(PVMCPU pVCpu, void *pDest, RTGCPTR GCSrc, uint32_t cb)
273{
274 /* Note: This will fail in R0 or RC if it hits an access handler. That
275 isn't a problem though since the operation can be restarted in REM. */
276#ifdef IN_RC
277 return MMGCRamReadNoTrapHandler(pDest, (void *)GCSrc, cb);
278#else
279 return PGMPhysReadGCPtr(pVCpu, pDest, GCSrc, cb);
280#endif
281}
282
283
284/** Wrapper for writing virtual memory. */
285DECLINLINE(int) iomRamWrite(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, void *pvSrc, uint32_t cb)
286{
287 /** @todo Need to update PGMVerifyAccess to take access handlers into account for Ring-0 and
288 * raw mode code. Some thought needs to be spent on theoretical concurrency issues as
289 * as well since we're not behind the pgm lock and handler may change between calls.
290 * MMGCRamWriteNoTrapHandler may also trap if the page isn't shadowed, or was kicked
291 * out from both the shadow pt (SMP or our changes) and TLB.
292 *
293 * Currently MMGCRamWriteNoTrapHandler may also fail when it hits a write access handler.
294 * PGMPhysInterpretedWriteNoHandlers/PGMPhysWriteGCPtr OTOH may mess up the state
295 * of some shadowed structure in R0. */
296#ifdef IN_RC
297 NOREF(pCtxCore);
298 return MMGCRamWriteNoTrapHandler((void *)GCPtrDst, pvSrc, cb);
299#elif IN_RING0
300 return PGMPhysInterpretedWriteNoHandlers(pVCpu, pCtxCore, GCPtrDst, pvSrc, cb, false /*fRaiseTrap*/);
301#else
302 NOREF(pCtxCore);
303 return PGMPhysWriteGCPtr(pVCpu, GCPtrDst, pvSrc, cb);
304#endif
305}
306
307
308#ifdef IOM_WITH_MOVS_SUPPORT
309/**
310 * [REP] MOVSB
311 * [REP] MOVSW
312 * [REP] MOVSD
313 *
314 * Restricted implementation.
315 *
316 *
317 * @returns VBox status code.
318 *
319 * @param pVM The virtual machine.
320 * @param uErrorCode CPU Error code.
321 * @param pRegFrame Trap register frame.
322 * @param GCPhysFault The GC physical address corresponding to pvFault.
323 * @param pCpu Disassembler CPU state.
324 * @param pRange Pointer MMIO range.
325 * @param ppStat Which sub-sample to attribute this call to.
326 */
327static int iomInterpretMOVS(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, PSTAMPROFILE *ppStat)
328{
329 /*
330 * We do not support segment prefixes or REPNE.
331 */
332 if (pCpu->prefix & (PREFIX_SEG | PREFIX_REPNE))
333 return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> interpret whatever. */
334
335 PVMCPU pVCpu = VMMGetCpu(pVM);
336
337 /*
338 * Get bytes/words/dwords/qword count to copy.
339 */
340 uint32_t cTransfers = 1;
341 if (pCpu->prefix & PREFIX_REP)
342 {
343#ifndef IN_RC
344 if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
345 && pRegFrame->rcx >= _4G)
346 return VINF_EM_RAW_EMULATE_INSTR;
347#endif
348
349 cTransfers = pRegFrame->ecx;
350 if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
351 cTransfers &= 0xffff;
352
353 if (!cTransfers)
354 return VINF_SUCCESS;
355 }
356
357 /* Get the current privilege level. */
358 uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
359
360 /*
361 * Get data size.
362 */
363 unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
364 AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
365 int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
366
367#ifdef VBOX_WITH_STATISTICS
368 if (pVM->iom.s.cMovsMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
369 pVM->iom.s.cMovsMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
370#endif
371
372/** @todo re-evaluate on page boundraries. */
373
374 RTGCPHYS Phys = GCPhysFault;
375 int rc;
376 if (uErrorCode & X86_TRAP_PF_RW)
377 {
378 /*
379 * Write operation: [Mem] -> [MMIO]
380 * ds:esi (Virt Src) -> es:edi (Phys Dst)
381 */
382 STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsToMMIO; });
383
384 /* Check callback. */
385 if (!pRange->CTX_SUFF(pfnWriteCallback))
386 return VINF_IOM_HC_MMIO_WRITE;
387
388 /* Convert source address ds:esi. */
389 RTGCUINTPTR pu8Virt;
390 rc = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, (RTGCPTR)pRegFrame->rsi,
391 SELMTOFLAT_FLAGS_HYPER | SELMTOFLAT_FLAGS_NO_PL,
392 (PRTGCPTR)&pu8Virt);
393 if (RT_SUCCESS(rc))
394 {
395
396 /* Access verification first; we currently can't recover properly from traps inside this instruction */
397 rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, (cpl == 3) ? X86_PTE_US : 0);
398 if (rc != VINF_SUCCESS)
399 {
400 Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
401 return VINF_EM_RAW_EMULATE_INSTR;
402 }
403
404#ifdef IN_RC
405 MMGCRamRegisterTrapHandler(pVM);
406#endif
407
408 /* copy loop. */
409 while (cTransfers)
410 {
411 uint32_t u32Data = 0;
412 rc = iomRamRead(pVCpu, &u32Data, (RTGCPTR)pu8Virt, cb);
413 if (rc != VINF_SUCCESS)
414 break;
415 rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
416 if (rc != VINF_SUCCESS)
417 break;
418
419 pu8Virt += offIncrement;
420 Phys += offIncrement;
421 pRegFrame->rsi += offIncrement;
422 pRegFrame->rdi += offIncrement;
423 cTransfers--;
424 }
425#ifdef IN_RC
426 MMGCRamDeregisterTrapHandler(pVM);
427#endif
428 /* Update ecx. */
429 if (pCpu->prefix & PREFIX_REP)
430 pRegFrame->ecx = cTransfers;
431 }
432 else
433 rc = VINF_IOM_HC_MMIO_READ_WRITE;
434 }
435 else
436 {
437 /*
438 * Read operation: [MMIO] -> [mem] or [MMIO] -> [MMIO]
439 * ds:[eSI] (Phys Src) -> es:[eDI] (Virt Dst)
440 */
441 STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsFromMMIO; });
442
443 /* Check callback. */
444 if (!pRange->CTX_SUFF(pfnReadCallback))
445 return VINF_IOM_HC_MMIO_READ;
446
447 /* Convert destination address. */
448 RTGCUINTPTR pu8Virt;
449 rc = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, (RTGCPTR)pRegFrame->rdi,
450 SELMTOFLAT_FLAGS_HYPER | SELMTOFLAT_FLAGS_NO_PL,
451 (RTGCPTR *)&pu8Virt);
452 if (RT_FAILURE(rc))
453 return VINF_IOM_HC_MMIO_READ;
454
455 /* Check if destination address is MMIO. */
456 PIOMMMIORANGE pMMIODst;
457 RTGCPHYS PhysDst;
458 rc = PGMGstGetPage(pVCpu, (RTGCPTR)pu8Virt, NULL, &PhysDst);
459 PhysDst |= (RTGCUINTPTR)pu8Virt & PAGE_OFFSET_MASK;
460 if ( RT_SUCCESS(rc)
461 && (pMMIODst = iomMMIOGetRange(&pVM->iom.s, PhysDst)))
462 {
463 /*
464 * Extra: [MMIO] -> [MMIO]
465 */
466 STAM_STATS({ *ppStat = &pVM->iom.s.StatRZInstMovsMMIO; });
467 if (!pMMIODst->CTX_SUFF(pfnWriteCallback) && pMMIODst->pfnWriteCallbackR3)
468 return VINF_IOM_HC_MMIO_READ_WRITE;
469
470 /* copy loop. */
471 while (cTransfers)
472 {
473 uint32_t u32Data;
474 rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
475 if (rc != VINF_SUCCESS)
476 break;
477 rc = iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb);
478 if (rc != VINF_SUCCESS)
479 break;
480
481 Phys += offIncrement;
482 PhysDst += offIncrement;
483 pRegFrame->rsi += offIncrement;
484 pRegFrame->rdi += offIncrement;
485 cTransfers--;
486 }
487 }
488 else
489 {
490 /*
491 * Normal: [MMIO] -> [Mem]
492 */
493 /* Access verification first; we currently can't recover properly from traps inside this instruction */
494 rc = PGMVerifyAccess(pVCpu, pu8Virt, cTransfers * cb, X86_PTE_RW | ((cpl == 3) ? X86_PTE_US : 0));
495 if (rc != VINF_SUCCESS)
496 {
497 Log(("MOVS will generate a trap -> recompiler, rc=%d\n", rc));
498 return VINF_EM_RAW_EMULATE_INSTR;
499 }
500
501 /* copy loop. */
502#ifdef IN_RC
503 MMGCRamRegisterTrapHandler(pVM);
504#endif
505 while (cTransfers)
506 {
507 uint32_t u32Data;
508 rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
509 if (rc != VINF_SUCCESS)
510 break;
511 rc = iomRamWrite(pVCpu, pRegFrame, (RTGCPTR)pu8Virt, &u32Data, cb);
512 if (rc != VINF_SUCCESS)
513 {
514 Log(("iomRamWrite %08X size=%d failed with %d\n", pu8Virt, cb, rc));
515 break;
516 }
517
518 pu8Virt += offIncrement;
519 Phys += offIncrement;
520 pRegFrame->rsi += offIncrement;
521 pRegFrame->rdi += offIncrement;
522 cTransfers--;
523 }
524#ifdef IN_RC
525 MMGCRamDeregisterTrapHandler(pVM);
526#endif
527 }
528
529 /* Update ecx on exit. */
530 if (pCpu->prefix & PREFIX_REP)
531 pRegFrame->ecx = cTransfers;
532 }
533
534 /* work statistics. */
535 if (rc == VINF_SUCCESS)
536 iomMMIOStatLength(pVM, cb);
537 NOREF(ppStat);
538 return rc;
539}
540#endif /* IOM_WITH_MOVS_SUPPORT */
541
542
543/**
544 * [REP] STOSB
545 * [REP] STOSW
546 * [REP] STOSD
547 *
548 * Restricted implementation.
549 *
550 *
551 * @returns VBox status code.
552 *
553 * @param pVM The virtual machine.
554 * @param pRegFrame Trap register frame.
555 * @param GCPhysFault The GC physical address corresponding to pvFault.
556 * @param pCpu Disassembler CPU state.
557 * @param pRange Pointer MMIO range.
558 */
559static int iomInterpretSTOS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
560{
561 /*
562 * We do not support segment prefixes or REPNE..
563 */
564 if (pCpu->prefix & (PREFIX_SEG | PREFIX_REPNE))
565 return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
566
567 /*
568 * Get bytes/words/dwords count to copy.
569 */
570 uint32_t cTransfers = 1;
571 if (pCpu->prefix & PREFIX_REP)
572 {
573#ifndef IN_RC
574 if ( CPUMIsGuestIn64BitCode(VMMGetCpu(pVM), pRegFrame)
575 && pRegFrame->rcx >= _4G)
576 return VINF_EM_RAW_EMULATE_INSTR;
577#endif
578
579 cTransfers = pRegFrame->ecx;
580 if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
581 cTransfers &= 0xffff;
582
583 if (!cTransfers)
584 return VINF_SUCCESS;
585 }
586
587/** @todo r=bird: bounds checks! */
588
589 /*
590 * Get data size.
591 */
592 unsigned cb = DISGetParamSize(pCpu, &pCpu->param1);
593 AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
594 int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
595
596#ifdef VBOX_WITH_STATISTICS
597 if (pVM->iom.s.cStosMaxBytes < (cTransfers << SIZE_2_SHIFT(cb)))
598 pVM->iom.s.cStosMaxBytes = cTransfers << SIZE_2_SHIFT(cb);
599#endif
600
601
602 RTGCPHYS Phys = GCPhysFault;
603 uint32_t u32Data = pRegFrame->eax;
604 int rc;
605 if (pRange->CTX_SUFF(pfnFillCallback))
606 {
607 /*
608 * Use the fill callback.
609 */
610 /** @todo pfnFillCallback must return number of bytes successfully written!!! */
611 if (offIncrement > 0)
612 {
613 /* addr++ variant. */
614 rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), Phys, u32Data, cb, cTransfers);
615 if (rc == VINF_SUCCESS)
616 {
617 /* Update registers. */
618 pRegFrame->rdi += cTransfers << SIZE_2_SHIFT(cb);
619 if (pCpu->prefix & PREFIX_REP)
620 pRegFrame->ecx = 0;
621 }
622 }
623 else
624 {
625 /* addr-- variant. */
626 rc = pRange->CTX_SUFF(pfnFillCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), (Phys - (cTransfers - 1)) << SIZE_2_SHIFT(cb), u32Data, cb, cTransfers);
627 if (rc == VINF_SUCCESS)
628 {
629 /* Update registers. */
630 pRegFrame->rdi -= cTransfers << SIZE_2_SHIFT(cb);
631 if (pCpu->prefix & PREFIX_REP)
632 pRegFrame->ecx = 0;
633 }
634 }
635 }
636 else
637 {
638 /*
639 * Use the write callback.
640 */
641 Assert(pRange->CTX_SUFF(pfnWriteCallback) || !pRange->pfnWriteCallbackR3);
642
643 /* fill loop. */
644 do
645 {
646 rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
647 if (rc != VINF_SUCCESS)
648 break;
649
650 Phys += offIncrement;
651 pRegFrame->rdi += offIncrement;
652 cTransfers--;
653 } while (cTransfers);
654
655 /* Update ecx on exit. */
656 if (pCpu->prefix & PREFIX_REP)
657 pRegFrame->ecx = cTransfers;
658 }
659
660 /*
661 * Work statistics and return.
662 */
663 if (rc == VINF_SUCCESS)
664 iomMMIOStatLength(pVM, cb);
665 return rc;
666}
667
668
669/**
670 * [REP] LODSB
671 * [REP] LODSW
672 * [REP] LODSD
673 *
674 * Restricted implementation.
675 *
676 *
677 * @returns VBox status code.
678 *
679 * @param pVM The virtual machine.
680 * @param pRegFrame Trap register frame.
681 * @param GCPhysFault The GC physical address corresponding to pvFault.
682 * @param pCpu Disassembler CPU state.
683 * @param pRange Pointer MMIO range.
684 */
685static int iomInterpretLODS(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
686{
687 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
688
689 /*
690 * We do not support segment prefixes or REP*.
691 */
692 if (pCpu->prefix & (PREFIX_SEG | PREFIX_REP | PREFIX_REPNE))
693 return VINF_IOM_HC_MMIO_READ_WRITE; /** @todo -> REM instead of HC */
694
695 /*
696 * Get data size.
697 */
698 unsigned cb = DISGetParamSize(pCpu, &pCpu->param2);
699 AssertMsg(cb > 0 && cb <= sizeof(uint64_t), ("cb=%d\n", cb));
700 int offIncrement = pRegFrame->eflags.Bits.u1DF ? -(signed)cb : (signed)cb;
701
702 /*
703 * Perform read.
704 */
705 int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &pRegFrame->rax, cb);
706 if (rc == VINF_SUCCESS)
707 pRegFrame->rsi += offIncrement;
708
709 /*
710 * Work statistics and return.
711 */
712 if (rc == VINF_SUCCESS)
713 iomMMIOStatLength(pVM, cb);
714 return rc;
715}
716
717
718/**
719 * CMP [MMIO], reg|imm
720 * CMP reg|imm, [MMIO]
721 *
722 * Restricted implementation.
723 *
724 *
725 * @returns VBox status code.
726 *
727 * @param pVM The virtual machine.
728 * @param pRegFrame Trap register frame.
729 * @param GCPhysFault The GC physical address corresponding to pvFault.
730 * @param pCpu Disassembler CPU state.
731 * @param pRange Pointer MMIO range.
732 */
733static int iomInterpretCMP(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
734{
735 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
736
737 /*
738 * Get the operands.
739 */
740 unsigned cb = 0;
741 uint64_t uData1 = 0;
742 uint64_t uData2 = 0;
743 int rc;
744 if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
745 /* cmp reg, [MMIO]. */
746 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
747 else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
748 /* cmp [MMIO], reg|imm. */
749 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
750 else
751 {
752 AssertMsgFailed(("Disassember CMP problem..\n"));
753 rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
754 }
755
756 if (rc == VINF_SUCCESS)
757 {
758 /* Emulate CMP and update guest flags. */
759 uint32_t eflags = EMEmulateCmp(uData1, uData2, cb);
760 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
761 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
762 iomMMIOStatLength(pVM, cb);
763 }
764
765 return rc;
766}
767
768
769/**
770 * AND [MMIO], reg|imm
771 * AND reg, [MMIO]
772 * OR [MMIO], reg|imm
773 * OR reg, [MMIO]
774 *
775 * Restricted implementation.
776 *
777 *
778 * @returns VBox status code.
779 *
780 * @param pVM The virtual machine.
781 * @param pRegFrame Trap register frame.
782 * @param GCPhysFault The GC physical address corresponding to pvFault.
783 * @param pCpu Disassembler CPU state.
784 * @param pRange Pointer MMIO range.
785 * @param pfnEmulate Instruction emulation function.
786 */
787static int iomInterpretOrXorAnd(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange, PFNEMULATEPARAM3 pfnEmulate)
788{
789 unsigned cb = 0;
790 uint64_t uData1 = 0;
791 uint64_t uData2 = 0;
792 bool fAndWrite;
793 int rc;
794
795#ifdef LOG_ENABLED
796 const char *pszInstr;
797
798 if (pCpu->pCurInstr->opcode == OP_XOR)
799 pszInstr = "Xor";
800 else if (pCpu->pCurInstr->opcode == OP_OR)
801 pszInstr = "Or";
802 else if (pCpu->pCurInstr->opcode == OP_AND)
803 pszInstr = "And";
804 else
805 pszInstr = "OrXorAnd??";
806#endif
807
808 if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
809 {
810 /* and reg, [MMIO]. */
811 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
812 fAndWrite = false;
813 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
814 }
815 else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
816 {
817 /* and [MMIO], reg|imm. */
818 fAndWrite = true;
819 if ( (pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3)
820 && (pRange->CTX_SUFF(pfnWriteCallback) || !pRange->pfnWriteCallbackR3))
821 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
822 else
823 rc = VINF_IOM_HC_MMIO_READ_WRITE;
824 }
825 else
826 {
827 AssertMsgFailed(("Disassember AND problem..\n"));
828 return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
829 }
830
831 if (rc == VINF_SUCCESS)
832 {
833 /* Emulate AND and update guest flags. */
834 uint32_t eflags = pfnEmulate((uint32_t *)&uData1, uData2, cb);
835
836 LogFlow(("iomInterpretOrXorAnd %s result %RX64\n", pszInstr, uData1));
837
838 if (fAndWrite)
839 /* Store result to MMIO. */
840 rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
841 else
842 {
843 /* Store result to register. */
844 bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData1);
845 AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
846 }
847 if (rc == VINF_SUCCESS)
848 {
849 /* Update guest's eflags and finish. */
850 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
851 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
852 iomMMIOStatLength(pVM, cb);
853 }
854 }
855
856 return rc;
857}
858
859
860/**
861 * TEST [MMIO], reg|imm
862 * TEST reg, [MMIO]
863 *
864 * Restricted implementation.
865 *
866 *
867 * @returns VBox status code.
868 *
869 * @param pVM The virtual machine.
870 * @param pRegFrame Trap register frame.
871 * @param GCPhysFault The GC physical address corresponding to pvFault.
872 * @param pCpu Disassembler CPU state.
873 * @param pRange Pointer MMIO range.
874 */
875static int iomInterpretTEST(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
876{
877 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
878
879 unsigned cb = 0;
880 uint64_t uData1 = 0;
881 uint64_t uData2 = 0;
882 int rc;
883
884 if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
885 {
886 /* and test, [MMIO]. */
887 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
888 }
889 else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
890 {
891 /* test [MMIO], reg|imm. */
892 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
893 }
894 else
895 {
896 AssertMsgFailed(("Disassember TEST problem..\n"));
897 return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
898 }
899
900 if (rc == VINF_SUCCESS)
901 {
902 /* Emulate TEST (=AND without write back) and update guest EFLAGS. */
903 uint32_t eflags = EMEmulateAnd((uint32_t *)&uData1, uData2, cb);
904 pRegFrame->eflags.u32 = (pRegFrame->eflags.u32 & ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF))
905 | (eflags & (X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF));
906 iomMMIOStatLength(pVM, cb);
907 }
908
909 return rc;
910}
911
912
913/**
914 * BT [MMIO], reg|imm
915 *
916 * Restricted implementation.
917 *
918 *
919 * @returns VBox status code.
920 *
921 * @param pVM The virtual machine.
922 * @param pRegFrame Trap register frame.
923 * @param GCPhysFault The GC physical address corresponding to pvFault.
924 * @param pCpu Disassembler CPU state.
925 * @param pRange Pointer MMIO range.
926 */
927static int iomInterpretBT(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
928{
929 Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
930
931 uint64_t uBit = 0;
932 uint64_t uData = 0;
933 unsigned cbIgnored;
934
935 if (!iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uBit, &cbIgnored))
936 {
937 AssertMsgFailed(("Disassember BT problem..\n"));
938 return VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
939 }
940 /* The size of the memory operand only matters here. */
941 unsigned cbData = DISGetParamSize(pCpu, &pCpu->param1);
942
943 /* bt [MMIO], reg|imm. */
944 int rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData, cbData);
945 if (rc == VINF_SUCCESS)
946 {
947 /* Find the bit inside the faulting address */
948 pRegFrame->eflags.Bits.u1CF = (uData >> uBit);
949 iomMMIOStatLength(pVM, cbData);
950 }
951
952 return rc;
953}
954
955/**
956 * XCHG [MMIO], reg
957 * XCHG reg, [MMIO]
958 *
959 * Restricted implementation.
960 *
961 *
962 * @returns VBox status code.
963 *
964 * @param pVM The virtual machine.
965 * @param pRegFrame Trap register frame.
966 * @param GCPhysFault The GC physical address corresponding to pvFault.
967 * @param pCpu Disassembler CPU state.
968 * @param pRange Pointer MMIO range.
969 */
970static int iomInterpretXCHG(PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPHYS GCPhysFault, PDISCPUSTATE pCpu, PIOMMMIORANGE pRange)
971{
972 /* Check for read & write handlers since IOMMMIOHandler doesn't cover this. */
973 if ( (!pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
974 || (!pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3))
975 return VINF_IOM_HC_MMIO_READ_WRITE;
976
977 int rc;
978 unsigned cb = 0;
979 uint64_t uData1 = 0;
980 uint64_t uData2 = 0;
981 if (iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &uData1, &cb))
982 {
983 /* xchg reg, [MMIO]. */
984 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData2, cb);
985 if (rc == VINF_SUCCESS)
986 {
987 /* Store result to MMIO. */
988 rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData1, cb);
989
990 if (rc == VINF_SUCCESS)
991 {
992 /* Store result to register. */
993 bool fRc = iomSaveDataToReg(pCpu, &pCpu->param1, pRegFrame, uData2);
994 AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
995 }
996 else
997 Assert(rc == VINF_IOM_HC_MMIO_WRITE || rc == VINF_PATM_HC_MMIO_PATCH_WRITE);
998 }
999 else
1000 Assert(rc == VINF_IOM_HC_MMIO_READ || rc == VINF_PATM_HC_MMIO_PATCH_READ);
1001 }
1002 else if (iomGetRegImmData(pCpu, &pCpu->param2, pRegFrame, &uData2, &cb))
1003 {
1004 /* xchg [MMIO], reg. */
1005 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, &uData1, cb);
1006 if (rc == VINF_SUCCESS)
1007 {
1008 /* Store result to MMIO. */
1009 rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, &uData2, cb);
1010 if (rc == VINF_SUCCESS)
1011 {
1012 /* Store result to register. */
1013 bool fRc = iomSaveDataToReg(pCpu, &pCpu->param2, pRegFrame, uData1);
1014 AssertMsg(fRc, ("Failed to store register value!\n")); NOREF(fRc);
1015 }
1016 else
1017 AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE || rc == VINF_IOM_HC_MMIO_WRITE || rc == VINF_PATM_HC_MMIO_PATCH_WRITE, ("rc=%Vrc\n", rc));
1018 }
1019 else
1020 AssertMsg(rc == VINF_IOM_HC_MMIO_READ_WRITE || rc == VINF_IOM_HC_MMIO_READ || rc == VINF_PATM_HC_MMIO_PATCH_READ, ("rc=%Vrc\n", rc));
1021 }
1022 else
1023 {
1024 AssertMsgFailed(("Disassember XCHG problem..\n"));
1025 rc = VERR_IOM_MMIO_HANDLER_DISASM_ERROR;
1026 }
1027 return rc;
1028}
1029
1030
1031/**
1032 * \#PF Handler callback for MMIO ranges.
1033 *
1034 * @returns VBox status code (appropriate for GC return).
1035 * @param pVM VM Handle.
1036 * @param uErrorCode CPU Error code.
1037 * @param pCtxCore Trap register frame.
1038 * @param GCPhysFault The GC physical address corresponding to pvFault.
1039 * @param pvUser Pointer to the MMIO ring-3 range entry.
1040 */
1041int iomMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault, void *pvUser)
1042{
1043 /* Take the IOM lock before performing any MMIO. */
1044 int rc = iomLock(pVM);
1045#ifndef IN_RING3
1046 if (rc == VERR_SEM_BUSY)
1047 return (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1048#endif
1049 AssertRC(rc);
1050
1051 STAM_PROFILE_START(&pVM->iom.s.StatRZMMIOHandler, a);
1052 Log(("iomMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
1053 GCPhysFault, (uint32_t)uErrorCode, (RTGCPTR)pCtxCore->rip));
1054
1055 PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1056 Assert(pRange);
1057 Assert(pRange == iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1058
1059#ifdef VBOX_WITH_STATISTICS
1060 /*
1061 * Locate the statistics, if > PAGE_SIZE we'll use the first byte for everything.
1062 */
1063 PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhysFault, pRange);
1064 if (!pStats)
1065 {
1066# ifdef IN_RING3
1067 iomUnlock(pVM);
1068 return VERR_NO_MEMORY;
1069# else
1070 STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1071 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1072 iomUnlock(pVM);
1073 return (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1074# endif
1075 }
1076#endif
1077
1078#ifndef IN_RING3
1079 /*
1080 * Should we defer the request right away?
1081 */
1082 if (uErrorCode & X86_TRAP_PF_RW
1083 ? !pRange->CTX_SUFF(pfnWriteCallback) && pRange->pfnWriteCallbackR3
1084 : !pRange->CTX_SUFF(pfnReadCallback) && pRange->pfnReadCallbackR3)
1085 {
1086# ifdef VBOX_WITH_STATISTICS
1087 if (uErrorCode & X86_TRAP_PF_RW)
1088 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1089 else
1090 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1091# endif
1092
1093 STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1094 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1095 iomUnlock(pVM);
1096 return (uErrorCode & X86_TRAP_PF_RW ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ);
1097 }
1098#endif /* !IN_RING3 */
1099
1100 /*
1101 * Disassemble the instruction and interpret it.
1102 */
1103 PVMCPU pVCpu = VMMGetCpu(pVM);
1104 PDISCPUSTATE pDis = &pVCpu->iom.s.DisState;
1105 unsigned cbOp;
1106 rc = EMInterpretDisasOne(pVM, pVCpu, pCtxCore, pDis, &cbOp);
1107 AssertRC(rc);
1108 if (RT_FAILURE(rc))
1109 {
1110 iomUnlock(pVM);
1111 return rc;
1112 }
1113 switch (pDis->pCurInstr->opcode)
1114 {
1115 case OP_MOV:
1116 case OP_MOVZX:
1117 case OP_MOVSX:
1118 {
1119 STAM_PROFILE_START(&pVM->iom.s.StatRZInstMov, b);
1120 if (uErrorCode & X86_TRAP_PF_RW)
1121 rc = iomInterpretMOVxXWrite(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1122 else
1123 rc = iomInterpretMOVxXRead(pVM, pCtxCore, pDis, pRange, GCPhysFault);
1124 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstMov, b);
1125 break;
1126 }
1127
1128
1129#ifdef IOM_WITH_MOVS_SUPPORT
1130 case OP_MOVSB:
1131 case OP_MOVSWD:
1132 {
1133 STAM_PROFILE_ADV_START(&pVM->iom.s.StatRZInstMovs, c);
1134 PSTAMPROFILE pStat = NULL;
1135 rc = iomInterpretMOVS(pVM, uErrorCode, pCtxCore, GCPhysFault, pDis, pRange, &pStat);
1136 STAM_PROFILE_ADV_STOP_EX(&pVM->iom.s.StatRZInstMovs, pStat, c);
1137 break;
1138 }
1139#endif
1140
1141 case OP_STOSB:
1142 case OP_STOSWD:
1143 Assert(uErrorCode & X86_TRAP_PF_RW);
1144 STAM_PROFILE_START(&pVM->iom.s.StatRZInstStos, d);
1145 rc = iomInterpretSTOS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1146 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstStos, d);
1147 break;
1148
1149 case OP_LODSB:
1150 case OP_LODSWD:
1151 Assert(!(uErrorCode & X86_TRAP_PF_RW));
1152 STAM_PROFILE_START(&pVM->iom.s.StatRZInstLods, e);
1153 rc = iomInterpretLODS(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1154 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstLods, e);
1155 break;
1156
1157 case OP_CMP:
1158 Assert(!(uErrorCode & X86_TRAP_PF_RW));
1159 STAM_PROFILE_START(&pVM->iom.s.StatRZInstCmp, f);
1160 rc = iomInterpretCMP(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1161 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstCmp, f);
1162 break;
1163
1164 case OP_AND:
1165 STAM_PROFILE_START(&pVM->iom.s.StatRZInstAnd, g);
1166 rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateAnd);
1167 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstAnd, g);
1168 break;
1169
1170 case OP_OR:
1171 STAM_PROFILE_START(&pVM->iom.s.StatRZInstOr, k);
1172 rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateOr);
1173 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstOr, k);
1174 break;
1175
1176 case OP_XOR:
1177 STAM_PROFILE_START(&pVM->iom.s.StatRZInstXor, m);
1178 rc = iomInterpretOrXorAnd(pVM, pCtxCore, GCPhysFault, pDis, pRange, EMEmulateXor);
1179 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXor, m);
1180 break;
1181
1182 case OP_TEST:
1183 Assert(!(uErrorCode & X86_TRAP_PF_RW));
1184 STAM_PROFILE_START(&pVM->iom.s.StatRZInstTest, h);
1185 rc = iomInterpretTEST(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1186 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstTest, h);
1187 break;
1188
1189 case OP_BT:
1190 Assert(!(uErrorCode & X86_TRAP_PF_RW));
1191 STAM_PROFILE_START(&pVM->iom.s.StatRZInstBt, l);
1192 rc = iomInterpretBT(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1193 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstBt, l);
1194 break;
1195
1196 case OP_XCHG:
1197 STAM_PROFILE_START(&pVM->iom.s.StatRZInstXchg, i);
1198 rc = iomInterpretXCHG(pVM, pCtxCore, GCPhysFault, pDis, pRange);
1199 STAM_PROFILE_STOP(&pVM->iom.s.StatRZInstXchg, i);
1200 break;
1201
1202
1203 /*
1204 * The instruction isn't supported. Hand it on to ring-3.
1205 */
1206 default:
1207 STAM_COUNTER_INC(&pVM->iom.s.StatRZInstOther);
1208 rc = (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1209 break;
1210 }
1211
1212 /*
1213 * On success advance EIP.
1214 */
1215 if (rc == VINF_SUCCESS)
1216 pCtxCore->rip += cbOp;
1217 else
1218 {
1219 STAM_COUNTER_INC(&pVM->iom.s.StatRZMMIOFailures);
1220#if defined(VBOX_WITH_STATISTICS) && !defined(IN_RING3)
1221 switch (rc)
1222 {
1223 case VINF_IOM_HC_MMIO_READ:
1224 case VINF_IOM_HC_MMIO_READ_WRITE:
1225 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1226 break;
1227 case VINF_IOM_HC_MMIO_WRITE:
1228 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1229 break;
1230 }
1231#endif
1232 }
1233
1234 STAM_PROFILE_STOP(&pVM->iom.s.StatRZMMIOHandler, a);
1235 iomUnlock(pVM);
1236 return rc;
1237}
1238
1239/**
1240 * \#PF Handler callback for MMIO ranges.
1241 *
1242 * @returns VBox status code (appropriate for GC return).
1243 * @param pVM VM Handle.
1244 * @param uErrorCode CPU Error code.
1245 * @param pCtxCore Trap register frame.
1246 * @param pvFault The fault address (cr2).
1247 * @param GCPhysFault The GC physical address corresponding to pvFault.
1248 * @param pvUser Pointer to the MMIO ring-3 range entry.
1249 */
1250VMMDECL(int) IOMMMIOHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
1251{
1252 LogFlow(("IOMMMIOHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
1253 GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip));
1254 VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, uErrorCode, pCtxCore, GCPhysFault, pvUser);
1255 return VBOXSTRICTRC_VAL(rcStrict);
1256}
1257
1258/**
1259 * Physical access handler for MMIO ranges.
1260 *
1261 * @returns VBox status code (appropriate for GC return).
1262 * @param pVM VM Handle.
1263 * @param uErrorCode CPU Error code.
1264 * @param pCtxCore Trap register frame.
1265 * @param GCPhysFault The GC physical address.
1266 */
1267VMMDECL(VBOXSTRICTRC) IOMMMIOPhysHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPHYS GCPhysFault)
1268{
1269 int rc2 = iomLock(pVM);
1270#ifndef IN_RING3
1271 if (rc2 == VERR_SEM_BUSY)
1272 return (uErrorCode & X86_TRAP_PF_RW) ? VINF_IOM_HC_MMIO_WRITE : VINF_IOM_HC_MMIO_READ;
1273#endif
1274 VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, uErrorCode, pCtxCore, GCPhysFault, iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1275 iomUnlock(pVM);
1276 return VBOXSTRICTRC_VAL(rcStrict);
1277}
1278
1279#ifdef IN_RING3
1280/**
1281 * \#PF Handler callback for MMIO ranges.
1282 *
1283 * @returns VINF_SUCCESS if the handler have carried out the operation.
1284 * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1285 * @param pVM VM Handle.
1286 * @param GCPhys The physical address the guest is writing to.
1287 * @param pvPhys The HC mapping of that address.
1288 * @param pvBuf What the guest is reading/writing.
1289 * @param cbBuf How much it's reading/writing.
1290 * @param enmAccessType The access type.
1291 * @param pvUser Pointer to the MMIO range entry.
1292 */
1293DECLCALLBACK(int) IOMR3MMIOHandler(PVM pVM, RTGCPHYS GCPhysFault, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
1294{
1295 PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
1296 STAM_COUNTER_INC(&pVM->iom.s.StatR3MMIOHandler);
1297
1298 /* Take the IOM lock before performing any MMIO. */
1299 int rc = iomLock(pVM);
1300 AssertRC(rc);
1301
1302 AssertMsg(cbBuf == 1 || cbBuf == 2 || cbBuf == 4 || cbBuf == 8, ("%zu\n", cbBuf));
1303
1304 Assert(pRange);
1305 Assert(pRange == iomMMIOGetRange(&pVM->iom.s, GCPhysFault));
1306
1307 if (enmAccessType == PGMACCESSTYPE_READ)
1308 rc = iomMMIODoRead(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1309 else
1310 rc = iomMMIODoWrite(pVM, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
1311
1312 AssertRC(rc);
1313 iomUnlock(pVM);
1314 return rc;
1315}
1316#endif /* IN_RING3 */
1317
1318/**
1319 * Reads a MMIO register.
1320 *
1321 * @returns VBox status code.
1322 *
1323 * @param pVM VM handle.
1324 * @param GCPhys The physical address to read.
1325 * @param pu32Value Where to store the value read.
1326 * @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1327 */
1328VMMDECL(VBOXSTRICTRC) IOMMMIORead(PVM pVM, RTGCPHYS GCPhys, uint32_t *pu32Value, size_t cbValue)
1329{
1330 /* Take the IOM lock before performing any MMIO. */
1331 int rc = iomLock(pVM);
1332#ifndef IN_RING3
1333 if (rc == VERR_SEM_BUSY)
1334 return VINF_IOM_HC_MMIO_WRITE;
1335#endif
1336 AssertRC(rc);
1337
1338 /*
1339 * Lookup the current context range node and statistics.
1340 */
1341 PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1342 AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1343 if (!pRange)
1344 {
1345 iomUnlock(pVM);
1346 return VERR_INTERNAL_ERROR;
1347 }
1348#ifdef VBOX_WITH_STATISTICS
1349 PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1350 if (!pStats)
1351 {
1352 iomUnlock(pVM);
1353# ifdef IN_RING3
1354 return VERR_NO_MEMORY;
1355# else
1356 return VINF_IOM_HC_MMIO_READ;
1357# endif
1358 }
1359#endif /* VBOX_WITH_STATISTICS */
1360 if (pRange->CTX_SUFF(pfnReadCallback))
1361 {
1362 /*
1363 * Perform the read and deal with the result.
1364 */
1365#ifdef VBOX_WITH_STATISTICS
1366 STAM_PROFILE_ADV_START(&pStats->CTX_SUFF_Z(ProfRead), a);
1367#endif
1368 rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pu32Value, (unsigned)cbValue);
1369#ifdef VBOX_WITH_STATISTICS
1370 STAM_PROFILE_ADV_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
1371 if (rc != VINF_IOM_HC_MMIO_READ)
1372 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Read));
1373#endif
1374 switch (rc)
1375 {
1376 case VINF_SUCCESS:
1377 default:
1378 Log4(("IOMMMIORead: GCPhys=%RGp *pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, *pu32Value, cbValue, rc));
1379 iomUnlock(pVM);
1380 return rc;
1381
1382 case VINF_IOM_MMIO_UNUSED_00:
1383 switch (cbValue)
1384 {
1385 case 1: *(uint8_t *)pu32Value = UINT8_C(0x00); break;
1386 case 2: *(uint16_t *)pu32Value = UINT16_C(0x0000); break;
1387 case 4: *(uint32_t *)pu32Value = UINT32_C(0x00000000); break;
1388 case 8: *(uint64_t *)pu32Value = UINT64_C(0x0000000000000000); break;
1389 default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1390 }
1391 Log4(("IOMMMIORead: GCPhys=%RGp *pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, *pu32Value, cbValue, rc));
1392 iomUnlock(pVM);
1393 return VINF_SUCCESS;
1394
1395 case VINF_IOM_MMIO_UNUSED_FF:
1396 switch (cbValue)
1397 {
1398 case 1: *(uint8_t *)pu32Value = UINT8_C(0xff); break;
1399 case 2: *(uint16_t *)pu32Value = UINT16_C(0xffff); break;
1400 case 4: *(uint32_t *)pu32Value = UINT32_C(0xffffffff); break;
1401 case 8: *(uint64_t *)pu32Value = UINT64_C(0xffffffffffffffff); break;
1402 default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1403 }
1404 Log4(("IOMMMIORead: GCPhys=%RGp *pu32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, *pu32Value, cbValue, rc));
1405 iomUnlock(pVM);
1406 return VINF_SUCCESS;
1407 }
1408 }
1409#ifndef IN_RING3
1410 if (pRange->pfnReadCallbackR3)
1411 {
1412 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Read,ToR3));
1413 iomUnlock(pVM);
1414 return VINF_IOM_HC_MMIO_READ;
1415 }
1416#endif
1417
1418 /*
1419 * Lookup the ring-3 range.
1420 */
1421#ifdef VBOX_WITH_STATISTICS
1422 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Read));
1423#endif
1424 /* Unassigned memory; this is actually not supposed to happen. */
1425 switch (cbValue)
1426 {
1427 case 1: *(uint8_t *)pu32Value = UINT8_C(0xff); break;
1428 case 2: *(uint16_t *)pu32Value = UINT16_C(0xffff); break;
1429 case 4: *(uint32_t *)pu32Value = UINT32_C(0xffffffff); break;
1430 case 8: *(uint64_t *)pu32Value = UINT64_C(0xffffffffffffffff); break;
1431 default: AssertReleaseMsgFailed(("cbValue=%d GCPhys=%RGp\n", cbValue, GCPhys)); break;
1432 }
1433 Log4(("IOMMMIORead: GCPhys=%RGp *pu32=%08RX32 cb=%d rc=VINF_SUCCESS\n", GCPhys, *pu32Value, cbValue));
1434 iomUnlock(pVM);
1435 return VINF_SUCCESS;
1436}
1437
1438
1439/**
1440 * Writes to a MMIO register.
1441 *
1442 * @returns VBox status code.
1443 *
1444 * @param pVM VM handle.
1445 * @param GCPhys The physical address to write to.
1446 * @param u32Value The value to write.
1447 * @param cbValue The size of the register to read in bytes. 1, 2 or 4 bytes.
1448 */
1449VMMDECL(VBOXSTRICTRC) IOMMMIOWrite(PVM pVM, RTGCPHYS GCPhys, uint32_t u32Value, size_t cbValue)
1450{
1451 /* Take the IOM lock before performing any MMIO. */
1452 int rc = iomLock(pVM);
1453#ifndef IN_RING3
1454 if (rc == VERR_SEM_BUSY)
1455 return VINF_IOM_HC_MMIO_WRITE;
1456#endif
1457 AssertRC(rc);
1458
1459 /*
1460 * Lookup the current context range node.
1461 */
1462 PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1463 AssertMsg(pRange, ("Handlers and page tables are out of sync or something! GCPhys=%RGp cbValue=%d\n", GCPhys, cbValue));
1464 if (!pRange)
1465 {
1466 iomUnlock(pVM);
1467 return VERR_INTERNAL_ERROR;
1468 }
1469#ifdef VBOX_WITH_STATISTICS
1470 PIOMMMIOSTATS pStats = iomMMIOGetStats(&pVM->iom.s, GCPhys, pRange);
1471 if (!pStats)
1472 {
1473 iomUnlock(pVM);
1474# ifdef IN_RING3
1475 return VERR_NO_MEMORY;
1476# else
1477 return VINF_IOM_HC_MMIO_WRITE;
1478# endif
1479 }
1480#endif /* VBOX_WITH_STATISTICS */
1481
1482 /*
1483 * Perform the write if there's a write handler. R0/GC may have
1484 * to defer it to ring-3.
1485 */
1486 if (pRange->CTX_SUFF(pfnWriteCallback))
1487 {
1488#ifdef VBOX_WITH_STATISTICS
1489 STAM_PROFILE_ADV_START(&pStats->CTX_SUFF_Z(ProfWrite), a);
1490#endif
1491 rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, &u32Value, (unsigned)cbValue);
1492#ifdef VBOX_WITH_STATISTICS
1493 STAM_PROFILE_ADV_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
1494 if (rc != VINF_IOM_HC_MMIO_WRITE)
1495 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Write));
1496#endif
1497 Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, rc));
1498 iomUnlock(pVM);
1499 return rc;
1500 }
1501#ifndef IN_RING3
1502 if (pRange->pfnWriteCallbackR3)
1503 {
1504 STAM_COUNTER_INC(&pStats->CTX_MID_Z(Write,ToR3));
1505 iomUnlock(pVM);
1506 return VINF_IOM_HC_MMIO_WRITE;
1507 }
1508#endif
1509
1510 /*
1511 * No write handler, nothing to do.
1512 */
1513#ifdef VBOX_WITH_STATISTICS
1514 STAM_COUNTER_INC(&pStats->CTX_SUFF_Z(Write));
1515#endif
1516 Log4(("IOMMMIOWrite: GCPhys=%RGp u32=%08RX32 cb=%d rc=%Rrc\n", GCPhys, u32Value, cbValue, VINF_SUCCESS));
1517 iomUnlock(pVM);
1518 return VINF_SUCCESS;
1519}
1520
1521/**
1522 * [REP*] INSB/INSW/INSD
1523 * ES:EDI,DX[,ECX]
1524 *
1525 * @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1526 *
1527 * @returns Strict VBox status code. Informational status codes other than the one documented
1528 * here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1529 * @retval VINF_SUCCESS Success.
1530 * @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1531 * status code must be passed on to EM.
1532 * @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1533 * @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1534 * @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1535 * @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1536 * @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1537 *
1538 * @param pVM The virtual machine.
1539 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1540 * @param uPort IO Port
1541 * @param uPrefix IO instruction prefix
1542 * @param cbTransfer Size of transfer unit
1543 */
1544VMMDECL(VBOXSTRICTRC) IOMInterpretINSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1545{
1546#ifdef VBOX_WITH_STATISTICS
1547 STAM_COUNTER_INC(&pVM->iom.s.StatInstIns);
1548#endif
1549
1550 /*
1551 * We do not support REPNE or decrementing destination
1552 * pointer. Segment prefixes are deliberately ignored, as per the instruction specification.
1553 */
1554 if ( (uPrefix & PREFIX_REPNE)
1555 || pRegFrame->eflags.Bits.u1DF)
1556 return VINF_EM_RAW_EMULATE_INSTR;
1557
1558 PVMCPU pVCpu = VMMGetCpu(pVM);
1559
1560 /*
1561 * Get bytes/words/dwords count to transfer.
1562 */
1563 RTGCUINTREG cTransfers = 1;
1564 if (uPrefix & PREFIX_REP)
1565 {
1566#ifndef IN_RC
1567 if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
1568 && pRegFrame->rcx >= _4G)
1569 return VINF_EM_RAW_EMULATE_INSTR;
1570#endif
1571 cTransfers = pRegFrame->ecx;
1572
1573 if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
1574 cTransfers &= 0xffff;
1575
1576 if (!cTransfers)
1577 return VINF_SUCCESS;
1578 }
1579
1580 /* Convert destination address es:edi. */
1581 RTGCPTR GCPtrDst;
1582 int rc2 = SELMToFlatEx(pVM, DIS_SELREG_ES, pRegFrame, (RTGCPTR)pRegFrame->rdi,
1583 SELMTOFLAT_FLAGS_HYPER | SELMTOFLAT_FLAGS_NO_PL,
1584 &GCPtrDst);
1585 if (RT_FAILURE(rc2))
1586 {
1587 Log(("INS destination address conversion failed -> fallback, rc2=%d\n", rc2));
1588 return VINF_EM_RAW_EMULATE_INSTR;
1589 }
1590
1591 /* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
1592 uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
1593
1594 rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrDst, cTransfers * cbTransfer,
1595 X86_PTE_RW | ((cpl == 3) ? X86_PTE_US : 0));
1596 if (rc2 != VINF_SUCCESS)
1597 {
1598 Log(("INS will generate a trap -> fallback, rc2=%d\n", rc2));
1599 return VINF_EM_RAW_EMULATE_INSTR;
1600 }
1601
1602 Log(("IOM: rep ins%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1603 VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1604 if (cTransfers > 1)
1605 {
1606 /* If the device supports string transfers, ask it to do as
1607 * much as it wants. The rest is done with single-word transfers. */
1608 const RTGCUINTREG cTransfersOrg = cTransfers;
1609 rcStrict = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbTransfer);
1610 AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
1611 pRegFrame->rdi += (cTransfersOrg - cTransfers) * cbTransfer;
1612 }
1613
1614#ifdef IN_RC
1615 MMGCRamRegisterTrapHandler(pVM);
1616#endif
1617 while (cTransfers && rcStrict == VINF_SUCCESS)
1618 {
1619 uint32_t u32Value;
1620 rcStrict = IOMIOPortRead(pVM, uPort, &u32Value, cbTransfer);
1621 if (!IOM_SUCCESS(rcStrict))
1622 break;
1623 rc2 = iomRamWrite(pVCpu, pRegFrame, GCPtrDst, &u32Value, cbTransfer);
1624 Assert(rc2 == VINF_SUCCESS); NOREF(rc2);
1625 GCPtrDst = (RTGCPTR)((RTGCUINTPTR)GCPtrDst + cbTransfer);
1626 pRegFrame->rdi += cbTransfer;
1627 cTransfers--;
1628 }
1629#ifdef IN_RC
1630 MMGCRamDeregisterTrapHandler(pVM);
1631#endif
1632
1633 /* Update ecx on exit. */
1634 if (uPrefix & PREFIX_REP)
1635 pRegFrame->ecx = cTransfers;
1636
1637 AssertMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_IOM_HC_IOPORT_READ || (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) || RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1638 return rcStrict;
1639}
1640
1641
1642/**
1643 * [REP*] INSB/INSW/INSD
1644 * ES:EDI,DX[,ECX]
1645 *
1646 * @returns Strict VBox status code. Informational status codes other than the one documented
1647 * here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1648 * @retval VINF_SUCCESS Success.
1649 * @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1650 * status code must be passed on to EM.
1651 * @retval VINF_IOM_HC_IOPORT_READ Defer the read to ring-3. (R0/GC only)
1652 * @retval VINF_EM_RAW_EMULATE_INSTR Defer the read to the REM.
1653 * @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1654 * @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1655 * @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1656 *
1657 * @param pVM The virtual machine.
1658 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1659 * @param pCpu Disassembler CPU state.
1660 */
1661VMMDECL(VBOXSTRICTRC) IOMInterpretINS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1662{
1663 /*
1664 * Get port number directly from the register (no need to bother the
1665 * disassembler). And get the I/O register size from the opcode / prefix.
1666 */
1667 RTIOPORT Port = pRegFrame->edx & 0xffff;
1668 unsigned cb = 0;
1669 if (pCpu->pCurInstr->opcode == OP_INSB)
1670 cb = 1;
1671 else
1672 cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
1673
1674 VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1675 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1676 {
1677 AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP || rcStrict == VINF_TRPM_XCPT_DISPATCHED || rcStrict == VINF_TRPM_XCPT_DISPATCHED || RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1678 return rcStrict;
1679 }
1680
1681 return IOMInterpretINSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1682}
1683
1684
1685/**
1686 * [REP*] OUTSB/OUTSW/OUTSD
1687 * DS:ESI,DX[,ECX]
1688 *
1689 * @remark Assumes caller checked the access privileges (IOMInterpretCheckPortIOAccess)
1690 *
1691 * @returns Strict VBox status code. Informational status codes other than the one documented
1692 * here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1693 * @retval VINF_SUCCESS Success.
1694 * @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1695 * status code must be passed on to EM.
1696 * @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1697 * @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1698 * @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1699 * @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1700 *
1701 * @param pVM The virtual machine.
1702 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1703 * @param uPort IO Port
1704 * @param uPrefix IO instruction prefix
1705 * @param cbTransfer Size of transfer unit
1706 */
1707VMMDECL(VBOXSTRICTRC) IOMInterpretOUTSEx(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uPort, uint32_t uPrefix, uint32_t cbTransfer)
1708{
1709#ifdef VBOX_WITH_STATISTICS
1710 STAM_COUNTER_INC(&pVM->iom.s.StatInstOuts);
1711#endif
1712
1713 /*
1714 * We do not support segment prefixes, REPNE or
1715 * decrementing source pointer.
1716 */
1717 if ( (uPrefix & (PREFIX_SEG | PREFIX_REPNE))
1718 || pRegFrame->eflags.Bits.u1DF)
1719 return VINF_EM_RAW_EMULATE_INSTR;
1720
1721 PVMCPU pVCpu = VMMGetCpu(pVM);
1722
1723 /*
1724 * Get bytes/words/dwords count to transfer.
1725 */
1726 RTGCUINTREG cTransfers = 1;
1727 if (uPrefix & PREFIX_REP)
1728 {
1729#ifndef IN_RC
1730 if ( CPUMIsGuestIn64BitCode(pVCpu, pRegFrame)
1731 && pRegFrame->rcx >= _4G)
1732 return VINF_EM_RAW_EMULATE_INSTR;
1733#endif
1734 cTransfers = pRegFrame->ecx;
1735 if (SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid) == CPUMODE_16BIT)
1736 cTransfers &= 0xffff;
1737
1738 if (!cTransfers)
1739 return VINF_SUCCESS;
1740 }
1741
1742 /* Convert source address ds:esi. */
1743 RTGCPTR GCPtrSrc;
1744 int rc2 = SELMToFlatEx(pVM, DIS_SELREG_DS, pRegFrame, (RTGCPTR)pRegFrame->rsi,
1745 SELMTOFLAT_FLAGS_HYPER | SELMTOFLAT_FLAGS_NO_PL,
1746 &GCPtrSrc);
1747 if (RT_FAILURE(rc2))
1748 {
1749 Log(("OUTS source address conversion failed -> fallback, rc2=%Rrc\n", rc2));
1750 return VINF_EM_RAW_EMULATE_INSTR;
1751 }
1752
1753 /* Access verification first; we currently can't recover properly from traps inside this instruction */
1754 uint32_t cpl = CPUMGetGuestCPL(pVCpu, pRegFrame);
1755 rc2 = PGMVerifyAccess(pVCpu, (RTGCUINTPTR)GCPtrSrc, cTransfers * cbTransfer,
1756 (cpl == 3) ? X86_PTE_US : 0);
1757 if (rc2 != VINF_SUCCESS)
1758 {
1759 Log(("OUTS will generate a trap -> fallback, rc2=%Rrc\n", rc2));
1760 return VINF_EM_RAW_EMULATE_INSTR;
1761 }
1762
1763 Log(("IOM: rep outs%d port %#x count %d\n", cbTransfer * 8, uPort, cTransfers));
1764 VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1765 if (cTransfers > 1)
1766 {
1767 /*
1768 * If the device supports string transfers, ask it to do as
1769 * much as it wants. The rest is done with single-word transfers.
1770 */
1771 const RTGCUINTREG cTransfersOrg = cTransfers;
1772 rcStrict = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbTransfer);
1773 AssertRC(VBOXSTRICTRC_VAL(rcStrict)); Assert(cTransfers <= cTransfersOrg);
1774 pRegFrame->rsi += (cTransfersOrg - cTransfers) * cbTransfer;
1775 }
1776
1777#ifdef IN_RC
1778 MMGCRamRegisterTrapHandler(pVM);
1779#endif
1780
1781 while (cTransfers && rcStrict == VINF_SUCCESS)
1782 {
1783 uint32_t u32Value = 0;
1784 rcStrict = iomRamRead(pVCpu, &u32Value, GCPtrSrc, cbTransfer);
1785 if (rcStrict != VINF_SUCCESS)
1786 break;
1787 rcStrict = IOMIOPortWrite(pVM, uPort, u32Value, cbTransfer);
1788 if (!IOM_SUCCESS(rcStrict))
1789 break;
1790 GCPtrSrc = (RTGCPTR)((RTUINTPTR)GCPtrSrc + cbTransfer);
1791 pRegFrame->rsi += cbTransfer;
1792 cTransfers--;
1793 }
1794
1795#ifdef IN_RC
1796 MMGCRamDeregisterTrapHandler(pVM);
1797#endif
1798
1799 /* Update ecx on exit. */
1800 if (uPrefix & PREFIX_REP)
1801 pRegFrame->ecx = cTransfers;
1802
1803 AssertMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_IOM_HC_IOPORT_WRITE || (rcStrict >= VINF_EM_FIRST && rcStrict <= VINF_EM_LAST) || RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1804 return rcStrict;
1805}
1806
1807
1808/**
1809 * [REP*] OUTSB/OUTSW/OUTSD
1810 * DS:ESI,DX[,ECX]
1811 *
1812 * @returns Strict VBox status code. Informational status codes other than the one documented
1813 * here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
1814 * @retval VINF_SUCCESS Success.
1815 * @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
1816 * status code must be passed on to EM.
1817 * @retval VINF_IOM_HC_IOPORT_WRITE Defer the write to ring-3. (R0/GC only)
1818 * @retval VINF_EM_RAW_EMULATE_INSTR Defer the write to the REM.
1819 * @retval VINF_EM_RAW_GUEST_TRAP The exception was left pending. (TRPMRaiseXcptErr)
1820 * @retval VINF_TRPM_XCPT_DISPATCHED The exception was raised and dispatched for raw-mode execution. (TRPMRaiseXcptErr)
1821 * @retval VINF_EM_RESCHEDULE_REM The exception was dispatched and cannot be executed in raw-mode. (TRPMRaiseXcptErr)
1822 *
1823 * @param pVM The virtual machine.
1824 * @param pRegFrame Pointer to CPUMCTXCORE guest registers structure.
1825 * @param pCpu Disassembler CPU state.
1826 */
1827VMMDECL(VBOXSTRICTRC) IOMInterpretOUTS(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
1828{
1829 /*
1830 * Get port number from the first parameter.
1831 * And get the I/O register size from the opcode / prefix.
1832 */
1833 uint64_t Port = 0;
1834 unsigned cb = 0;
1835 bool fRc = iomGetRegImmData(pCpu, &pCpu->param1, pRegFrame, &Port, &cb);
1836 AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
1837 if (pCpu->pCurInstr->opcode == OP_OUTSB)
1838 cb = 1;
1839 else
1840 cb = (pCpu->opmode == CPUMODE_16BIT) ? 2 : 4; /* dword in both 32 & 64 bits mode */
1841
1842 VBOXSTRICTRC rcStrict = IOMInterpretCheckPortIOAccess(pVM, pRegFrame, Port, cb);
1843 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1844 {
1845 AssertMsg(rcStrict == VINF_EM_RAW_GUEST_TRAP || rcStrict == VINF_TRPM_XCPT_DISPATCHED || rcStrict == VINF_TRPM_XCPT_DISPATCHED || RT_FAILURE(rcStrict), ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1846 return rcStrict;
1847 }
1848
1849 return IOMInterpretOUTSEx(pVM, pRegFrame, Port, pCpu->prefix, cb);
1850}
1851
1852
1853#ifndef IN_RC
1854/**
1855 * Mapping an MMIO2 page in place of an MMIO page for direct access.
1856 *
1857 * (This is a special optimization used by the VGA device.)
1858 *
1859 * @returns VBox status code.
1860 *
1861 * @param pVM The virtual machine.
1862 * @param GCPhys The address of the MMIO page to be changed.
1863 * @param GCPhysRemapped The address of the MMIO2 page.
1864 * @param fPageFlags Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
1865 * for the time being.
1866 */
1867VMMDECL(int) IOMMMIOMapMMIO2Page(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS GCPhysRemapped, uint64_t fPageFlags)
1868{
1869 /* Currently only called from the VGA device during MMIO. */
1870 Assert(IOMIsLockOwner(pVM));
1871 Log(("IOMMMIOMapMMIO2Page %RGp -> %RGp flags=%RX64\n", GCPhys, GCPhysRemapped, fPageFlags));
1872
1873 AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
1874
1875 PVMCPU pVCpu = VMMGetCpu(pVM);
1876
1877 /* This currently only works in real mode, protected mode without paging or with nested paging. */
1878 if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
1879 || ( CPUMIsGuestInPagedProtectedMode(pVCpu)
1880 && !HWACCMIsNestedPagingActive(pVM)))
1881 return VINF_SUCCESS; /* ignore */
1882
1883 /*
1884 * Lookup the context range node the page belongs to.
1885 */
1886 PIOMMMIORANGE pRange = iomMMIOGetRange(&pVM->iom.s, GCPhys);
1887 AssertMsgReturn(pRange,
1888 ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
1889
1890 Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
1891 Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
1892
1893 /*
1894 * Do the aliasing; page align the addresses since PGM is picky.
1895 */
1896 GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1897 GCPhysRemapped &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1898
1899 int rc = PGMHandlerPhysicalPageAlias(pVM, pRange->GCPhys, GCPhys, GCPhysRemapped);
1900 AssertRCReturn(rc, rc);
1901
1902 /*
1903 * Modify the shadow page table. Since it's an MMIO page it won't be present and we
1904 * can simply prefetch it.
1905 *
1906 * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1907 */
1908#if 0 /* The assertion is wrong for the PGM_SYNC_CLEAR_PGM_POOL and VINF_PGM_HANDLER_ALREADY_ALIASED cases. */
1909# ifdef VBOX_STRICT
1910 uint64_t fFlags;
1911 RTHCPHYS HCPhys;
1912 rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
1913 Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1914# endif
1915#endif
1916 rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1917 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1918 return VINF_SUCCESS;
1919}
1920
1921/**
1922 * Mapping a HC page in place of an MMIO page for direct access.
1923 *
1924 * (This is a special optimization used by the APIC in the VT-x case.)
1925 *
1926 * @returns VBox status code.
1927 *
1928 * @param pVM The virtual machine.
1929 * @param GCPhys The address of the MMIO page to be changed.
1930 * @param HCPhys The address of the host physical page.
1931 * @param fPageFlags Page flags to set. Must be (X86_PTE_RW | X86_PTE_P)
1932 * for the time being.
1933 */
1934VMMDECL(int) IOMMMIOMapMMIOHCPage(PVM pVM, RTGCPHYS GCPhys, RTHCPHYS HCPhys, uint64_t fPageFlags)
1935{
1936 /* Currently only called from VT-x code during a page fault. */
1937 Log(("IOMMMIOMapMMIOHCPage %RGp -> %RGp flags=%RX64\n", GCPhys, HCPhys, fPageFlags));
1938
1939 AssertReturn(fPageFlags == (X86_PTE_RW | X86_PTE_P), VERR_INVALID_PARAMETER);
1940 Assert(HWACCMIsEnabled(pVM));
1941
1942 PVMCPU pVCpu = VMMGetCpu(pVM);
1943
1944 /*
1945 * Lookup the context range node the page belongs to.
1946 */
1947#ifdef VBOX_STRICT
1948 /* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
1949 PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(&pVM->iom.s, GCPhys);
1950 AssertMsgReturn(pRange,
1951 ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
1952 Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
1953 Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
1954#endif
1955
1956 /*
1957 * Do the aliasing; page align the addresses since PGM is picky.
1958 */
1959 GCPhys &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
1960 HCPhys &= ~(RTHCPHYS)PAGE_OFFSET_MASK;
1961
1962 int rc = PGMHandlerPhysicalPageAliasHC(pVM, GCPhys, GCPhys, HCPhys);
1963 AssertRCReturn(rc, rc);
1964
1965 /*
1966 * Modify the shadow page table. Since it's an MMIO page it won't be present and we
1967 * can simply prefetch it.
1968 *
1969 * Note: This is a NOP in the EPT case; we'll just let it fault again to resync the page.
1970 */
1971 rc = PGMPrefetchPage(pVCpu, (RTGCPTR)GCPhys);
1972 Assert(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
1973 return VINF_SUCCESS;
1974}
1975
1976/**
1977 * Reset a previously modified MMIO region; restore the access flags.
1978 *
1979 * @returns VBox status code.
1980 *
1981 * @param pVM The virtual machine.
1982 * @param GCPhys Physical address that's part of the MMIO region to be reset.
1983 */
1984VMMDECL(int) IOMMMIOResetRegion(PVM pVM, RTGCPHYS GCPhys)
1985{
1986 Log(("IOMMMIOResetRegion %RGp\n", GCPhys));
1987
1988 PVMCPU pVCpu = VMMGetCpu(pVM);
1989
1990 /* This currently only works in real mode, protected mode without paging or with nested paging. */
1991 if ( !HWACCMIsEnabled(pVM) /* useless without VT-x/AMD-V */
1992 || ( CPUMIsGuestInPagedProtectedMode(pVCpu)
1993 && !HWACCMIsNestedPagingActive(pVM)))
1994 return VINF_SUCCESS; /* ignore */
1995
1996 /*
1997 * Lookup the context range node the page belongs to.
1998 */
1999#ifdef VBOX_STRICT
2000 /* Can't lock IOM here due to potential deadlocks in the VGA device; not safe to access. */
2001 PIOMMMIORANGE pRange = iomMMIOGetRangeUnsafe(&pVM->iom.s, GCPhys);
2002 AssertMsgReturn(pRange,
2003 ("Handlers and page tables are out of sync or something! GCPhys=%RGp\n", GCPhys), VERR_IOM_MMIO_RANGE_NOT_FOUND);
2004 Assert((pRange->GCPhys & PAGE_OFFSET_MASK) == 0);
2005 Assert((pRange->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
2006#endif
2007
2008 /*
2009 * Call PGM to do the job work.
2010 *
2011 * After the call, all the pages should be non-present... unless there is
2012 * a page pool flush pending (unlikely).
2013 */
2014 int rc = PGMHandlerPhysicalReset(pVM, GCPhys);
2015 AssertRC(rc);
2016
2017#ifdef VBOX_STRICT
2018 if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3))
2019 {
2020 uint32_t cb = pRange->cb;
2021 GCPhys = pRange->GCPhys;
2022 while (cb)
2023 {
2024 uint64_t fFlags;
2025 RTHCPHYS HCPhys;
2026 rc = PGMShwGetPage(pVCpu, (RTGCPTR)GCPhys, &fFlags, &HCPhys);
2027 Assert(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT);
2028 cb -= PAGE_SIZE;
2029 GCPhys += PAGE_SIZE;
2030 }
2031 }
2032#endif
2033 return rc;
2034}
2035#endif /* !IN_RC */
2036
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette