X-Git-Url: http://v3vee.org/palacios/gitweb/gitweb.cgi?a=blobdiff_plain;f=palacios%2Fsrc%2Fgeekos%2Fsvm_ctrl_regs.c;h=084becb66c1cd37f94bc6d6d58a93bff16f1933c;hb=b85f79b8030114370851ed3422c078debe630570;hp=1ae1ccf82daef0309dcc2fcaa61481fe25baff6b;hpb=89d5928385ff776aaaf9c0957734a611c9f9880c;p=palacios.git diff --git a/palacios/src/geekos/svm_ctrl_regs.c b/palacios/src/geekos/svm_ctrl_regs.c index 1ae1ccf..084becb 100644 --- a/palacios/src/geekos/svm_ctrl_regs.c +++ b/palacios/src/geekos/svm_ctrl_regs.c @@ -19,7 +19,7 @@ int handle_cr0_write(struct guest_info * info) { // The real rip address is actually a combination of the rip + CS base ret = read_guest_pa_memory(info, (addr_t)guest_state->rip, 15, instr); - if (ret != 0) { + if (ret != 15) { // I think we should inject a GPF into the guest PrintDebug("Could not read instruction (ret=%d)\n", ret); return -1; @@ -37,26 +37,42 @@ int handle_cr0_write(struct guest_info * info) { addr_t second_operand; struct cr0_real *old_cr0; struct cr0_real *new_cr0; - + operand_type_t addr_type; + char new_cr0_val = 0; // LMSW // decode mod/RM index += 2; old_cr0 = (struct cr0_real*)&(guest_state->cr0); - if (decode_operands16(&(info->vm_regs), instr + index, &first_operand, &second_operand, REG16) != 0) { + + addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG16); + + + if (addr_type == REG_OPERAND) { + new_cr0 = (struct cr0_real *)first_operand; + } else if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand, &host_addr) == -1) { + // gpf the guest + return -1; + } + + new_cr0 = (struct cr0_real *)host_addr; + } else { // error... don't know what to do return -1; } - - index += 3; - - new_cr0 = (struct cr0_real *)first_operand; - + if ((new_cr0->pe == 1) && (old_cr0->pe == 0)) { info->cpu_mode = PROTECTED; + } else if ((new_cr0->pe == 0) && (old_cr0->pe == 1)) { + info->cpu_mode = REAL; } + new_cr0_val = *(char*)(new_cr0) & 0x0f; + if (info->page_mode == SHADOW_PAGING) { struct cr0_real * virt_cr0 = (struct cr0_real*)&(info->shdw_pg_state.guest_cr0); @@ -64,11 +80,15 @@ int handle_cr0_write(struct guest_info * info) { /* struct cr0_real is only 4 bits wide, * so we can overwrite the old_cr0 without worrying about the shadow fields */ - *old_cr0 = *new_cr0; - *virt_cr0 = *new_cr0; + *(char*)old_cr0 &= 0xf0; + *(char*)old_cr0 |= new_cr0_val; + + *(char*)virt_cr0 &= 0xf0; + *(char*)virt_cr0 |= new_cr0_val; } else { // for now we just pass through.... - *old_cr0 = *new_cr0; + *(char*)old_cr0 &= 0xf0; + *(char*)old_cr0 |= new_cr0_val; } PrintDebug("index = %d, rip = %x\n", index, (ulong_t)(info->rip)); @@ -84,8 +104,75 @@ int handle_cr0_write(struct guest_info * info) { } else if (info->cpu_mode == PROTECTED) { + int index = 0; + int ret; + PrintDebug("Protected Mode write to CR0\n"); - while(1); + + // The real rip address is actually a combination of the rip + CS base + ret = read_guest_pa_memory(info, (addr_t)guest_state->rip, 15, instr); + if (ret != 0) { + // I think we should inject a GPF into the guest + PrintDebug("Could not read instruction (ret=%d)\n", ret); + return -1; + } + + while (is_prefix_byte(instr[index])) { + index++; + } + + if ((instr[index] == cr_access_byte) && + (instr[index + 1] == mov_to_cr_byte)) { + + addr_t first_operand; + addr_t second_operand; + struct cr0_32 *old_cr0; + struct cr0_32 *new_cr0; + operand_type_t addr_type; + + index += 2; + + old_cr0 = (struct cr0_32*)&(guest_state->cr0); + + addr_type = decode_operands32(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32); + + + if (addr_type == REG_OPERAND) { + new_cr0 = (struct cr0_32 *)first_operand; + } else if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand, &host_addr) == -1) { + // gpf the guest + return -1; + } + + new_cr0 = (struct cr0_32 *)host_addr; + } else { + // error... don't know what to do + return -1; + } + + + if (info->page_mode == SHADOW_PAGING) { + struct cr0_32 * virt_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0); + + if ((new_cr0->pg == 1) && (virt_cr0->pg == 0)){ + info->cpu_mode = PROTECTED_PG; + + // Activate Shadow Paging + } + + *virt_cr0 = *new_cr0; + *old_cr0 = *new_cr0; + } else { + // fill in + } + + info->rip += index; + + } + } else { PrintDebug("Unknown Mode write to CR0\n"); while(1); @@ -94,3 +181,70 @@ int handle_cr0_write(struct guest_info * info) { } +int handle_cr0_read(struct guest_info * info) { + //vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA((vmcb_t *)(info->vmm_data)); + vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data)); + char instr[15]; + + if (info->cpu_mode == REAL) { + int index = 0; + int ret; + + // The real rip address is actually a combination of the rip + CS base + ret = read_guest_pa_memory(info, (addr_t)guest_state->rip, 15, instr); + if (ret != 15) { + // I think we should inject a GPF into the guest + PrintDebug("Could not read instruction (ret=%d)\n", ret); + return -1; + } + + while (is_prefix_byte(instr[index])) { + index++; + } + + if ((instr[index] == cr_access_byte) && + (instr[index + 1] == smsw_byte) && + (MODRM_REG(instr[index + 2]) == smsw_reg_byte)) { + + addr_t first_operand; + addr_t second_operand; + struct cr0_real *cr0; + operand_type_t addr_type; + char cr0_val = 0; + + index += 2; + + cr0 = (struct cr0_real*)&(guest_state->cr0); + + + addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG16); + + if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand, &host_addr) == -1) { + // gpf the guest + return -1; + } + + first_operand = host_addr; + } else { + // error... don't know what to do + return -1; + } + + cr0_val = *(char*)cr0 & 0x0f; + + + *(char *)first_operand &= 0xf0; + *(char *)first_operand |= cr0_val; + + info->rip += index; + + } + + } + + + return 0; +}