X-Git-Url: http://v3vee.org/palacios/gitweb/gitweb.cgi?a=blobdiff_plain;f=palacios%2Fsrc%2Fgeekos%2Fsvm_ctrl_regs.c;h=75e133f74cce18094e5b087e0e2d0bb3f7acd232;hb=c7e3f043b6458083162e23e1a8adb7703fd06559;hp=3929222ec31f5f28c6e17f527b8d28be6e556bcf;hpb=9be2a31f574121ab4aa0289b7714eefe070b0db0;p=palacios.git diff --git a/palacios/src/geekos/svm_ctrl_regs.c b/palacios/src/geekos/svm_ctrl_regs.c index 3929222..75e133f 100644 --- a/palacios/src/geekos/svm_ctrl_regs.c +++ b/palacios/src/geekos/svm_ctrl_regs.c @@ -7,32 +7,34 @@ #include +/* Segmentation is a problem here... + * + * When we get a memory operand, presumably we use the default segment (which is?) + * unless an alternate segment was specfied in the prefix... + */ + + int handle_cr0_write(struct guest_info * info) { //vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA((vmcb_t *)(info->vmm_data)); vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data)); char instr[15]; - - if (info->cpu_mode == REAL) { int index = 0; int ret; // The real rip address is actually a combination of the rip + CS base - ret = read_guest_pa_memory(info, (addr_t)guest_state->rip, 15, instr); - if (ret != 0) { + ret = read_guest_pa_memory(info, get_addr_linear(info, guest_state->rip, guest_state->cs.base), 15, instr); + if (ret != 15) { // I think we should inject a GPF into the guest PrintDebug("Could not read instruction (ret=%d)\n", ret); return -1; } while (is_prefix_byte(instr[index])) { - PrintDebug("instr(%d): 0x%x\n", index, instr[index]); index++; } - PrintDebug("instr(%d): 0x%x\n", index, instr[index]); - PrintDebug("instr(%d): 0x%x\n", index+1, instr[index + 1]); if ((instr[index] == cr_access_byte) && (instr[index + 1] == lmsw_byte) && @@ -42,26 +44,42 @@ int handle_cr0_write(struct guest_info * info) { addr_t second_operand; struct cr0_real *old_cr0; struct cr0_real *new_cr0; - + operand_type_t addr_type; + char new_cr0_val = 0; // LMSW // decode mod/RM index += 2; old_cr0 = (struct cr0_real*)&(guest_state->cr0); - if (decode_operands16(&(info->vm_regs), instr + index, &first_operand, &second_operand, REG16) != 0) { + + addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG16); + + + if (addr_type == REG_OPERAND) { + new_cr0 = (struct cr0_real *)first_operand; + } else if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand + (guest_state->ds.base << 4), &host_addr) == -1) { + // gpf the guest + return -1; + } + + new_cr0 = (struct cr0_real *)host_addr; + } else { // error... don't know what to do return -1; } - - index += 3; - - new_cr0 = (struct cr0_real *)first_operand; - + if ((new_cr0->pe == 1) && (old_cr0->pe == 0)) { info->cpu_mode = PROTECTED; + } else if ((new_cr0->pe == 0) && (old_cr0->pe == 1)) { + info->cpu_mode = REAL; } + new_cr0_val = *(char*)(new_cr0) & 0x0f; + if (info->page_mode == SHADOW_PAGING) { struct cr0_real * virt_cr0 = (struct cr0_real*)&(info->shdw_pg_state.guest_cr0); @@ -69,11 +87,15 @@ int handle_cr0_write(struct guest_info * info) { /* struct cr0_real is only 4 bits wide, * so we can overwrite the old_cr0 without worrying about the shadow fields */ - *old_cr0 = *new_cr0; - *virt_cr0 = *new_cr0; + *(char*)old_cr0 &= 0xf0; + *(char*)old_cr0 |= new_cr0_val; + + *(char*)virt_cr0 &= 0xf0; + *(char*)virt_cr0 |= new_cr0_val; } else { // for now we just pass through.... - *old_cr0 = *new_cr0; + *(char*)old_cr0 &= 0xf0; + *(char*)old_cr0 |= new_cr0_val; } PrintDebug("index = %d, rip = %x\n", index, (ulong_t)(info->rip)); @@ -89,8 +111,77 @@ int handle_cr0_write(struct guest_info * info) { } else if (info->cpu_mode == PROTECTED) { + int index = 0; + int ret; + PrintDebug("Protected Mode write to CR0\n"); - while(1); + + // The real rip address is actually a combination of the rip + CS base + ret = read_guest_pa_memory(info, get_addr_linear(info, guest_state->rip, guest_state->cs.base), 15, instr); + if (ret != 0) { + // I think we should inject a GPF into the guest + PrintDebug("Could not read instruction (ret=%d)\n", ret); + return -1; + } + + while (is_prefix_byte(instr[index])) { + index++; + } + + + /* CHECK IF MOV_TO_CR CAN TAKE MEMORY OPERANDS... */ + if ((instr[index] == cr_access_byte) && + (instr[index + 1] == mov_to_cr_byte)) { + + addr_t first_operand; + addr_t second_operand; + struct cr0_32 *old_cr0; + struct cr0_32 *new_cr0; + operand_type_t addr_type; + + index += 2; + + old_cr0 = (struct cr0_32*)&(guest_state->cr0); + + addr_type = decode_operands32(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG32); + + + if (addr_type == REG_OPERAND) { + new_cr0 = (struct cr0_32 *)first_operand; + } else if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand + guest_state->ds.base, &host_addr) == -1) { + // gpf the guest + return -1; + } + + new_cr0 = (struct cr0_32 *)host_addr; + } else { + // error... don't know what to do + return -1; + } + + + if (info->page_mode == SHADOW_PAGING) { + struct cr0_32 * virt_cr0 = (struct cr0_32 *)&(info->shdw_pg_state.guest_cr0); + + if ((new_cr0->pg == 1) && (virt_cr0->pg == 0)){ + info->cpu_mode = PROTECTED_PG; + + // Activate Shadow Paging + } + + *virt_cr0 = *new_cr0; + *old_cr0 = *new_cr0; + } else { + // fill in + } + + info->rip += index; + + } + } else { PrintDebug("Unknown Mode write to CR0\n"); while(1); @@ -99,3 +190,87 @@ int handle_cr0_write(struct guest_info * info) { } +int handle_cr0_read(struct guest_info * info) { + //vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA((vmcb_t *)(info->vmm_data)); + vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data)); + char instr[15]; + + if (info->cpu_mode == REAL) { + int index = 0; + int ret; + + // The real rip address is actually a combination of the rip + CS base + ret = read_guest_pa_memory(info, get_addr_linear(info, guest_state->rip, guest_state->cs.base), 15, instr); + if (ret != 15) { + // I think we should inject a GPF into the guest + PrintDebug("Could not read instruction (ret=%d)\n", ret); + return -1; + } + + while (is_prefix_byte(instr[index])) { + index++; + } + + if ((instr[index] == cr_access_byte) && + (instr[index + 1] == smsw_byte) && + (MODRM_REG(instr[index + 2]) == smsw_reg_byte)) { + + addr_t first_operand; + addr_t second_operand; + struct cr0_real *cr0; + operand_type_t addr_type; + char cr0_val = 0; + + index += 2; + + cr0 = (struct cr0_real*)&(guest_state->cr0); + + + addr_type = decode_operands16(&(info->vm_regs), instr + index, &index, &first_operand, &second_operand, REG16); + + if (addr_type == MEM_OPERAND) { + addr_t host_addr; + + if (guest_pa_to_host_va(info, first_operand + (guest_state->ds.base << 4), &host_addr) == -1) { + // gpf the guest + return -1; + } + + first_operand = host_addr; + } else { + // error... don't know what to do + return -1; + } + + cr0_val = *(char*)cr0 & 0x0f; + + + *(char *)first_operand &= 0xf0; + *(char *)first_operand |= cr0_val; + + info->rip += index; + + } + + } else if (info->cpu_mode == PROTECTED) { + int index = 0; + int ret; + + // The real rip address is actually a combination of the rip + CS base + ret = read_guest_pa_memory(info, get_addr_linear(info, guest_state->rip, guest_state->cs.base), 15, instr); + if (ret != 15) { + // I think we should inject a GPF into the guest + PrintDebug("Could not read instruction (ret=%d)\n", ret); + return -1; + } + + while (is_prefix_byte(instr[index])) { + index++; + } + + + } + + + return 0; +}