X-Git-Url: http://v3vee.org/palacios/gitweb/gitweb.cgi?a=blobdiff_plain;f=palacios%2Fsrc%2Fpalacios%2Fvmx.c;h=445c416ba34496a759dacec9f49d999f74e9eb9b;hb=52a58bb7bdf06ca22ad6883f8095f8aa5ca4b8a4;hp=841f5dc29896db98be0c92a67be99a3ba23f3399;hpb=a1d3e2f36e9ef64ca62c611c4f0aa050726e186b;p=palacios.git diff --git a/palacios/src/palacios/vmx.c b/palacios/src/palacios/vmx.c index 841f5dc..445c416 100644 --- a/palacios/src/palacios/vmx.c +++ b/palacios/src/palacios/vmx.c @@ -27,337 +27,101 @@ #include #include #include +#include +#include +#include +#include +static addr_t vmxon_ptr_phys; +extern int v3_vmx_exit_handler(); +extern int v3_vmx_vmlaunch(struct v3_gprs * vm_regs, struct guest_info * info); -// -// -// CRUFT -// -// - -#if 0 - -#include -#include -#include - - - -extern int Launch_VM(ullong_t vmcsPtr, uint_t eip); - -#define NUMPORTS 65536 - - -#define VMXASSIST_INFO_PORT 0x0e9 -#define ROMBIOS_PANIC_PORT 0x400 -#define ROMBIOS_PANIC_PORT2 0x401 -#define ROMBIOS_INFO_PORT 0x402 -#define ROMBIOS_DEBUG_PORT 0x403 - - - -static uint_t GetLinearIP(struct VM * vm) { - if (vm->state == VM_VMXASSIST_V8086_BIOS || vm->state == VM_VMXASSIST_V8086) { - return vm->vmcs.guestStateArea.cs.baseAddr + vm->vmcs.guestStateArea.rip; - } else { - return vm->vmcs.guestStateArea.rip; - } -} - - - - -#define MAX_CODE 512 -#define INSTR_OFFSET_START 17 -#define NOP_SEQ_LEN 10 -#define INSTR_OFFSET_END (INSTR_OFFSET_START + NOP_SEQ_LEN - 1) -#define TEMPLATE_CODE_LEN 35 - -uint_t oldesp = 0; -uint_t myregs = 0; - - - - - -extern uint_t VMCS_LAUNCH(); -extern uint_t Init_VMCS_HostState(); -extern uint_t Init_VMCS_GuestState(); - - - - -extern int Get_CR2(); -extern int vmRunning; - - - - - -void DecodeCurrentInstruction(struct VM *vm, struct Instruction *inst) +static int inline check_vmcs_write(vmcs_field_t field, addr_t val) { - // this is a gruesome hack - uint_t address = GetLinearIP(vm); - uint_t length = vm->vmcs.exitInfoFields.instrLength; - unsigned char *t = (unsigned char *) address; + int ret = 0; + ret = vmcs_write(field,val); + if (ret != VMX_SUCCESS) { + PrintError("VMWRITE error on %s!: %d\n", v3_vmcs_field_to_str(field), ret); + return 1; + } - - PrintTrace("DecodeCurrentInstruction: instruction is\n"); - PrintTraceMemDump(t,length); - - if (length==3 && t[0]==0x0f && t[1]==0x22 && t[2]==0xc0) { - // mov from eax to cr0 - // usually used to signal - inst->type=VM_MOV_TO_CR0; - inst->address=address; - inst->size=length; - inst->input1=vm->registers.eax; - inst->input2=vm->vmcs.guestStateArea.cr0; - inst->output=vm->registers.eax; - PrintTrace("MOV FROM EAX TO CR0\n"); - } else { - inst->type=VM_UNKNOWN_INST; - } + return 0; } - - -static void ConfigureExits(struct VM *vm) +static void inline translate_segment_access(struct v3_segment * v3_seg, + struct vmcs_segment_access * access) { - CopyOutVMCSExecCtrlFields(&(vm->vmcs.execCtrlFields)); - - vm->vmcs.execCtrlFields.pinCtrls |= 0 - // EXTERNAL_INTERRUPT_EXITING - | NMI_EXITING; - vm->vmcs.execCtrlFields.procCtrls |= 0 - // INTERRUPT_WINDOWS_EXIT - | USE_TSC_OFFSETTING - | HLT_EXITING - | INVLPG_EXITING - | MWAIT_EXITING - | RDPMC_EXITING - | RDTSC_EXITING - | MOVDR_EXITING - | UNCONDITION_IO_EXITING - | MONITOR_EXITING - | PAUSE_EXITING ; - - CopyInVMCSExecCtrlFields(&(vm->vmcs.execCtrlFields)); - - CopyOutVMCSExitCtrlFields(&(vm->vmcs.exitCtrlFields)); - - vm->vmcs.exitCtrlFields.exitCtrls |= ACK_IRQ_ON_EXIT; - - CopyInVMCSExitCtrlFields(&(vm->vmcs.exitCtrlFields)); - - -/* VMCS_READ(VM_EXIT_CTRLS, &flags); */ -/* flags |= ACK_IRQ_ON_EXIT; */ -/* VMCS_WRITE(VM_EXIT_CTRLS, &flags); */ + access->type = v3_seg->type; + access->desc_type = v3_seg->system; + access->dpl = v3_seg->dpl; + access->present = v3_seg->present; + access->avail = v3_seg->avail; + access->long_mode = v3_seg->long_mode; + access->db = v3_seg->db; + access->granularity = v3_seg->granularity; } +static int update_vmcs_ctrl_fields(struct guest_info * info) { + int vmx_ret = 0; + struct vmx_data * arch_data = (struct vmx_data *)(info->vmm_data); -extern int RunVMM(); -extern int SAFE_VM_LAUNCH(); - -int MyLaunch(struct VM *vm) -{ - ullong_t vmcs = (ullong_t)((uint_t) (vm->vmcsregion)); - uint_t entry_eip = vm->descriptor.entry_ip; - uint_t exit_eip = vm->descriptor.exit_eip; - uint_t guest_esp = vm->descriptor.guest_esp; - uint_t f = 0xffffffff; - uint_t tmpReg = 0; - int ret; - int vmm_ret = 0; - - PrintTrace("Guest ESP: 0x%x (%u)\n", guest_esp, guest_esp); + vmx_ret |= check_vmcs_write(VMCS_PIN_CTRLS, arch_data->pinbased_ctrls); + vmx_ret |= check_vmcs_write(VMCS_PROC_CTRLS, arch_data->pri_procbased_ctrls); - exit_eip = (uint_t)RunVMM; - - PrintTrace("Clear\n"); - VMCS_CLEAR(vmcs); - PrintTrace("Load\n"); - VMCS_LOAD(vmcs); - - - PrintTrace("VMCS_LINK_PTR\n"); - VMCS_WRITE(VMCS_LINK_PTR, &f); - PrintTrace("VMCS_LINK_PTR_HIGH\n"); - VMCS_WRITE(VMCS_LINK_PTR_HIGH, &f); - - - SetCtrlBitsCorrectly(IA32_VMX_PINBASED_CTLS_MSR, PIN_VM_EXEC_CTRLS); - SetCtrlBitsCorrectly(IA32_VMX_PROCBASED_CTLS_MSR, PROC_VM_EXEC_CTRLS); - SetCtrlBitsCorrectly(IA32_VMX_EXIT_CTLS_MSR, VM_EXIT_CTRLS); - SetCtrlBitsCorrectly(IA32_VMX_ENTRY_CTLS_MSR, VM_ENTRY_CTRLS); - - // - // - //SetCtrlBitsCorrectly(IA32_something,GUEST_IA32_DEBUGCTL); - //SetCtrlBitsCorrectly(IA32_something,GUEST_IA32_DEBUGCTL_HIGH); - - - /* Host state */ - PrintTrace("Setting up host state\n"); - SetCRBitsCorrectly(IA32_VMX_CR0_FIXED0_MSR, IA32_VMX_CR0_FIXED1_MSR, HOST_CR0); - SetCRBitsCorrectly(IA32_VMX_CR4_FIXED0_MSR, IA32_VMX_CR4_FIXED1_MSR, HOST_CR4); - ret = Init_VMCS_HostState(); - - if (ret != VMX_SUCCESS) { - if (ret == VMX_FAIL_VALID) { - PrintTrace("Init Host state: VMCS FAILED WITH ERROR\n"); - } else { - PrintTrace("Init Host state: Invalid VMCS\n"); - } - return ret; - } - - // PrintTrace("HOST_RIP: %x (%u)\n", exit_eip, exit_eip); - VMCS_WRITE(HOST_RIP, &exit_eip); - - /* Guest state */ - PrintTrace("Setting up guest state\n"); - PrintTrace("GUEST_RIP: %x (%u)\n", entry_eip, entry_eip); - VMCS_WRITE(GUEST_RIP, &entry_eip); - - SetCRBitsCorrectly(IA32_VMX_CR0_FIXED0_MSR, IA32_VMX_CR0_FIXED1_MSR, GUEST_CR0); - SetCRBitsCorrectly(IA32_VMX_CR4_FIXED0_MSR, IA32_VMX_CR4_FIXED1_MSR, GUEST_CR4); - ret = Init_VMCS_GuestState(); - - PrintTrace("InitGuestState returned\n"); - - if (ret != VMX_SUCCESS) { - if (ret == VMX_FAIL_VALID) { - PrintTrace("Init Guest state: VMCS FAILED WITH ERROR\n"); - } else { - PrintTrace("Init Guest state: Invalid VMCS\n"); + if(arch_data->pri_procbased_ctrls & ACTIVE_SEC_CTRLS) { + vmx_ret |= check_vmcs_write(VMCS_SEC_PROC_CTRLS, arch_data->sec_procbased_ctrls); } - return ret; - } - PrintTrace("GUEST_RSP: %x (%u)\n", guest_esp, (uint_t)guest_esp); - VMCS_WRITE(GUEST_RSP, &guest_esp); - - // tmpReg = 0x4100; - tmpReg = 0xffffffff; - if (VMCS_WRITE(EXCEPTION_BITMAP, &tmpReg) != VMX_SUCCESS) { - PrintInfo("Bitmap error\n"); - } - - ConfigureExits(vm); - PrintTrace("VMCS_LAUNCH\n"); + vmx_ret |= check_vmcs_write(VMCS_EXIT_CTRLS, arch_data->exit_ctrls); + vmx_ret |= check_vmcs_write(VMCS_ENTRY_CTRLS, arch_data->entry_ctrls); + vmx_ret |= check_vmcs_write(VMCS_EXCP_BITMAP, arch_data->excp_bitmap); - vm->state=VM_VMXASSIST_STARTUP; - - vmm_ret = SAFE_VM_LAUNCH(); - - PrintTrace("VMM error %d\n", vmm_ret); - - return vmm_ret; + return vmx_ret; } - - - -int VMLaunch(struct VMDescriptor *vm) -{ - VMCS * vmcs = CreateVMCS(); - int rc; - - ullong_t vmcs_ptr = (ullong_t)((uint_t)vmcs); - uint_t top = (vmcs_ptr >> 32) & 0xffffffff; - uint_t bottom = (vmcs_ptr) & 0xffffffff; - - theVM.vmcsregion = vmcs; - theVM.descriptor = *vm; - - PrintTrace("vmcs_ptr_top=%x vmcs_ptr_bottom=%x, eip=%x\n", top, bottom, vm->entry_ip); - rc = MyLaunch(&theVM); // vmcs_ptr, vm->entry_ip, vm->exit_eip, vm->guest_esp); - PrintTrace("Returned from MyLaunch();\n"); - return rc; -} - - - - -// -// -// END CRUFT -// -// - -#endif - static int update_vmcs_host_state(struct guest_info * info) { + int vmx_ret = 0; addr_t tmp; - - struct { - uint16_t limit; - addr_t base; - } __attribute__((packed)) tmp_seg; - - + struct vmx_data * arch_data = (struct vmx_data *)(info->vmm_data); struct v3_msr tmp_msr; __asm__ __volatile__ ( "movq %%cr0, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_CR0, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_CR0, tmp); __asm__ __volatile__ ( "movq %%cr3, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_CR3, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_CR3, tmp); __asm__ __volatile__ ( "movq %%cr4, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_CR4, tmp); - + vmx_ret |= check_vmcs_write(VMCS_HOST_CR4, tmp); - __asm__ __volatile__ ("sgdt (%0); " - : - :"q"(&tmp_seg) - : "memory" - ); - vmcs_write(VMCS_HOST_GDTR_BASE, tmp_seg.base); - - - __asm__ __volatile__ ("sidt (%0); " - : - :"q"(&tmp_seg) - : "memory" - ); - vmcs_write(VMCS_HOST_IDTR_BASE, tmp_seg.base); - - /* How do we handle this...? - __asm__ __volatile__ ("str (%0); " - : - :"q"(&tmp_seg) - : "memory" - ); - vmcs_write(VMCS_HOST_TR_BASE, tmp_seg.base); - */ + vmx_ret |= check_vmcs_write(VMCS_HOST_GDTR_BASE, arch_data->host_state.gdtr.base); + vmx_ret |= check_vmcs_write(VMCS_HOST_IDTR_BASE, arch_data->host_state.idtr.base); + vmx_ret |= check_vmcs_write(VMCS_HOST_TR_BASE, arch_data->host_state.tr.base); #define FS_BASE_MSR 0xc0000100 #define GS_BASE_MSR 0xc0000101 // FS.BASE MSR v3_get_msr(FS_BASE_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); - vmcs_write(VMCS_HOST_FS_BASE, tmp_msr.value); + vmx_ret |= check_vmcs_write(VMCS_HOST_FS_BASE, tmp_msr.value); // GS.BASE MSR v3_get_msr(GS_BASE_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); - vmcs_write(VMCS_HOST_GS_BASE, tmp_msr.value); + vmx_ret |= check_vmcs_write(VMCS_HOST_GS_BASE, tmp_msr.value); @@ -365,43 +129,39 @@ static int update_vmcs_host_state(struct guest_info * info) { : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_CS_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_CS_SELECTOR, tmp); __asm__ __volatile__ ( "movq %%ss, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_SS_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_SS_SELECTOR, tmp); __asm__ __volatile__ ( "movq %%ds, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_DS_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_DS_SELECTOR, tmp); __asm__ __volatile__ ( "movq %%es, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_ES_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_ES_SELECTOR, tmp); __asm__ __volatile__ ( "movq %%fs, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_FS_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_FS_SELECTOR, tmp); __asm__ __volatile__ ( "movq %%gs, %0; " : "=q"(tmp) : ); - vmcs_write(VMCS_HOST_GS_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_GS_SELECTOR, tmp); - __asm__ __volatile__ ( "str %0; " - : "=q"(tmp) - : - ); - vmcs_write(VMCS_HOST_TR_SELECTOR, tmp); + vmx_ret |= check_vmcs_write(VMCS_HOST_TR_SELECTOR, arch_data->host_state.tr.selector); #define SYSENTER_CS_MSR 0x00000174 @@ -410,28 +170,128 @@ static int update_vmcs_host_state(struct guest_info * info) { // SYSENTER CS MSR v3_get_msr(SYSENTER_CS_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); - vmcs_write(VMCS_HOST_SYSENTER_CS, tmp_msr.value); + vmx_ret |= check_vmcs_write(VMCS_HOST_SYSENTER_CS, tmp_msr.lo); // SYSENTER_ESP MSR v3_get_msr(SYSENTER_ESP_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); - vmcs_write(VMCS_HOST_SYSENTER_ESP, tmp_msr.value); + vmx_ret |= check_vmcs_write(VMCS_HOST_SYSENTER_ESP, tmp_msr.value); // SYSENTER_EIP MSR v3_get_msr(SYSENTER_EIP_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); - vmcs_write(VMCS_HOST_SYSENTER_EIP, tmp_msr.value); + vmx_ret |= check_vmcs_write(VMCS_HOST_SYSENTER_EIP, tmp_msr.value); + return vmx_ret; +} - // RIP - // RSP - return 0; -} +static int inline update_vmcs_guest_state(struct guest_info * info) +{ + struct v3_msr tmp_msr; + int vmx_ret = 0; + vmx_ret |= check_vmcs_write(VMCS_GUEST_RIP, info->rip); + vmx_ret |= check_vmcs_write(VMCS_GUEST_RSP, info->vm_regs.rsp); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_CR0, info->ctrl_regs.cr0); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CR3, info->ctrl_regs.cr3); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CR4, info->ctrl_regs.cr4); + vmx_ret |= check_vmcs_write(VMCS_GUEST_RFLAGS, info->ctrl_regs.rflags); +#define DEBUGCTL_MSR 0x1d9 + + v3_get_msr(DEBUGCTL_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DBG_CTL, tmp_msr.value); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_DR7, 0x400); + + vmx_ret |= check_vmcs_write(VMCS_LINK_PTR, 0xffffffffffffffff); + + + /*** Write VMCS Segments ***/ + struct vmcs_segment_access access; + + memset(&access, 0, sizeof(access)); + + /* CS Segment */ + translate_segment_access(&(info->segments.cs), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_CS_BASE, info->segments.cs.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CS_SELECTOR, info->segments.cs.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CS_LIMIT, info->segments.cs.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CS_ACCESS, access.value); + + /* SS Segment */ + translate_segment_access(&(info->segments.ss), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_SS_BASE, info->segments.ss.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_SS_SELECTOR, info->segments.ss.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_SS_LIMIT, info->segments.ss.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_SS_ACCESS, access.value); + + /* DS Segment */ + translate_segment_access(&(info->segments.ds), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_DS_BASE, info->segments.ds.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DS_SELECTOR, info->segments.ds.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DS_LIMIT, info->segments.ds.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DS_ACCESS, access.value); + + + /* ES Segment */ + translate_segment_access(&(info->segments.es), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_ES_BASE, info->segments.es.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_ES_SELECTOR, info->segments.es.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_ES_LIMIT, info->segments.es.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_ES_ACCESS, access.value); + + /* FS Segment */ + translate_segment_access(&(info->segments.fs), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_FS_BASE, info->segments.fs.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_FS_SELECTOR, info->segments.fs.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_FS_LIMIT, info->segments.fs.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_FS_ACCESS, access.value); + + /* GS Segment */ + translate_segment_access(&(info->segments.gs), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_GS_BASE, info->segments.gs.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_GS_SELECTOR, info->segments.gs.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_GS_LIMIT, info->segments.gs.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_GS_ACCESS, access.value); + + /* LDTR segment */ + translate_segment_access(&(info->segments.ldtr), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_LDTR_BASE, info->segments.ldtr.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_LDTR_SELECTOR, info->segments.ldtr.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_LDTR_LIMIT, info->segments.ldtr.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_LDTR_ACCESS, access.value); + + /* TR Segment */ + translate_segment_access(&(info->segments.tr), &access); + + vmx_ret |= check_vmcs_write(VMCS_GUEST_TR_BASE, info->segments.tr.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_TR_SELECTOR, info->segments.tr.selector); + vmx_ret |= check_vmcs_write(VMCS_GUEST_TR_LIMIT, info->segments.tr.limit); + vmx_ret |= check_vmcs_write(VMCS_GUEST_TR_ACCESS, access.value); + + /* GDTR Segment */ + + vmx_ret |= check_vmcs_write(VMCS_GUEST_GDTR_BASE, info->segments.gdtr.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_GDTR_LIMIT, info->segments.gdtr.limit); + + /* IDTR Segment*/ + vmx_ret |= check_vmcs_write(VMCS_GUEST_IDTR_BASE, info->segments.idtr.base); + vmx_ret |= check_vmcs_write(VMCS_GUEST_IDTR_LIMIT, info->segments.idtr.limit); + + return vmx_ret; + +} -static addr_t vmxon_ptr_phys; #if 0 @@ -446,8 +306,8 @@ static uint32_t sanitize_bits1(uint32_t msr_num, uint32_t val) { PrintDebug("MSR %x = %x : %x \n", msr_num, mask_msr.hi, mask_msr.lo); - val &= mask_msr.lo; - val &= mask_msr.hi; + val |= mask_msr.lo; + val |= mask_msr.hi; return val; } @@ -469,32 +329,51 @@ static addr_t sanitize_bits2(uint32_t msr_num0, uint32_t msr_num1, addr_t val) { PrintDebug("MSR %x = %p, %x = %p \n", msr_num0, (void*)msr0_val, msr_num1, (void*)msr1_val); - val &= msr0_val; - val &= msr1_val; + val |= msr0_val; + val |= msr1_val; return val; } -static int setup_base_host_state() { - - // vmwrite(HOST_IDTR_BASE, +#endif -} +static addr_t allocate_vmcs() +{ + reg_ex_t msr; + PrintDebug("Allocating page\n"); + struct vmcs_data * vmcs_page = (struct vmcs_data *)V3_VAddr(V3_AllocPages(1)); -#endif + memset(vmcs_page, 0, 4096); + + v3_get_msr(VMX_BASIC_MSR, &(msr.e_reg.high), &(msr.e_reg.low)); + + vmcs_page->revision = ((struct vmx_basic_msr*)&msr)->revision; + PrintDebug("VMX Revision: 0x%x\n",vmcs_page->revision); + + return (addr_t)V3_PAddr((void *)vmcs_page); +} -static void setup_v8086_mode_for_boot(struct guest_info* vm_info) +#if 0 +static void setup_v8086_mode_for_boot(struct guest_info * vm_info) { ((struct vmx_data *)vm_info->vmm_data)->state = VMXASSIST_V8086_BIOS; - ((struct rflags *)&(vm_info->ctrl_regs.rflags))->vm = 1; - ((struct rflags *)&(vm_info->ctrl_regs.rflags))->iopl = 3; - - vm_info->rip = 0xfff0; + struct rflags * flags = (struct rflags *)&(vm_info->ctrl_regs.rflags); + flags->rsvd1 = 1; + flags->vm = 1; + flags->iopl = 3; + +#define GUEST_CR0_MASK 0x80000021 +#define GUEST_CR4_MASK 0x00002000 + vm_info->ctrl_regs.cr0 = GUEST_CR0_MASK; + vm_info->ctrl_regs.cr4 = GUEST_CR4_MASK; + + vm_info->rip = 0xd0000; + vm_info->vm_regs.rsp = 0x80000; vm_info->segments.cs.selector = 0xf000; vm_info->segments.cs.base = 0xf000 << 4; @@ -512,195 +391,351 @@ static void setup_v8086_mode_for_boot(struct guest_info* vm_info) for(i = 1; i < 6 ; i++) { seg_ptr[i].selector = 0x0000; seg_ptr[i].base = 0x00000; - seg_ptr[i].type = 3; - seg_ptr[i].system = 1; - seg_ptr[i].dpl = 3; - seg_ptr[i].present = 1; - seg_ptr[i].granularity = 0; + seg_ptr[i].limit = 0xffff; + } + + for(i = 6; i < 10; i++) { + seg_ptr[i].base = 0x0; + seg_ptr[i].limit = 0xffff; } -} + vm_info->segments.ldtr.selector = 0x0; + vm_info->segments.ldtr.type = 2; + vm_info->segments.ldtr.system = 0; + vm_info->segments.ldtr.present = 1; + vm_info->segments.ldtr.granularity = 0; + + vm_info->segments.tr.selector = 0x0; + vm_info->segments.tr.type = 3; + vm_info->segments.tr.system = 0; + vm_info->segments.tr.present = 1; + vm_info->segments.tr.granularity = 0; +} +#endif -static addr_t allocate_vmcs() +#if 0 +static int init_vmcs_bios(struct guest_info * vm_info) { - reg_ex_t msr; - PrintDebug("Allocating page\n"); - struct vmcs_data * vmcs_page = (struct vmcs_data *)V3_VAddr(V3_AllocPages(1)); +#if 0 + setup_v8086_mode_for_boot(vm_info); - memset(vmcs_page, 0, 4096); - v3_get_msr(VMX_BASIC_MSR, &(msr.e_reg.high), &(msr.e_reg.low)); + // Setup guest state + // TODO: This is not 32-bit safe! + vmx_ret |= check_vmcs_write(VMCS_GUEST_RIP, vm_info->rip); + vmx_ret |= check_vmcs_write(VMCS_GUEST_RSP, vm_info->vm_regs.rsp); - vmcs_page->revision = ((struct vmx_basic_msr*)&msr)->revision; - PrintDebug("VMX Revision: 0x%x\n",vmcs_page->revision); - return (addr_t)V3_PAddr((void*)vmcs_page); -} + vmx_ret |= check_vmcs_write(VMCS_GUEST_CR0, vm_info->ctrl_regs.cr0); + vmx_ret |= check_vmcs_write(VMCS_GUEST_CR4, vm_info->ctrl_regs.cr4); + vmx_ret |= vmcs_write_guest_segments(vm_info); + vmx_ret |= check_vmcs_write(VMCS_GUEST_RFLAGS, vm_info->ctrl_regs.rflags); +#define DEBUGCTL_MSR 0x1d9 -static void init_vmcs_bios(struct guest_info * vm_info) -{ + v3_get_msr(DEBUGCTL_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DBG_CTL, tmp_msr.value); - setup_v8086_mode_for_boot(vm_info); + vmx_ret |= check_vmcs_write(VMCS_GUEST_DR7, 0x400); - // TODO: Fix vmcs fields so they're 32-bit - -} + vmx_ret |= check_vmcs_write(VMCS_LINK_PTR, 0xffffffffffffffff); + if (vmx_ret != 0) { + PrintError("Could not initialize VMCS segments\n"); + return -1; + } +#endif + return 0; +} +#endif static int init_vmx_guest(struct guest_info * info, struct v3_vm_config * config_ptr) { - PrintDebug("Entering init_vmx_guest\n"); v3_pre_config_guest(info, config_ptr); - struct vmx_data* data; + struct vmx_data * vmx_data = NULL; + + vmx_data = (struct vmx_data *)V3_Malloc(sizeof(struct vmx_data)); - data = (struct vmx_data*)V3_Malloc(sizeof(struct vmx_data)); - PrintDebug("vmx_data pointer: %p\n",(void*)data); + PrintDebug("vmx_data pointer: %p\n", (void *)vmx_data); PrintDebug("Allocating VMCS\n"); - data->vmcs_ptr_phys = allocate_vmcs(); - PrintDebug("VMCS pointer: %p\n",(void*)data->vmcs_ptr_phys); + vmx_data->vmcs_ptr_phys = allocate_vmcs(); - info->vmm_data = (void *)data; + PrintDebug("VMCS pointer: %p\n", (void *)(vmx_data->vmcs_ptr_phys)); - PrintDebug("Initializing VMCS (addr=%p)\n", info->vmm_data); - init_vmcs_bios(info); + info->vmm_data = vmx_data; - // v3_post_config_guest(info, config_ptr); + PrintDebug("Initializing VMCS (addr=%p)\n", info->vmm_data); + + // TODO: Fix vmcs fields so they're 32-bit + int vmx_ret = 0; - return 0; -} + PrintDebug("Clearing VMCS: %p\n",(void*)vmx_data->vmcs_ptr_phys); + vmx_ret = vmcs_clear(vmx_data->vmcs_ptr_phys); + if (vmx_ret != VMX_SUCCESS) { + PrintError("VMCLEAR failed\n"); + return -1; + } -static int inline check_vmcs_write(vmcs_field_t field, addr_t val) -{ - int ret = 0; - ret = vmcs_write(field,val); + PrintDebug("Loading VMCS\n"); + vmx_ret = vmcs_load(vmx_data->vmcs_ptr_phys); - if (ret != VMX_SUCCESS) { - PrintError("VMWRITE error on %s!: %d\n", v3_vmcs_field_to_str(field), ret); - return 1; + if (vmx_ret != VMX_SUCCESS) { + PrintError("VMPTRLD failed\n"); + return -1; } - return 0; -} -static void inline translate_segment_access(struct v3_segment * v3_seg, - struct vmcs_segment_access * access) -{ - access->type = v3_seg->type; - access->desc_type = v3_seg->system; - access->dpl = v3_seg->dpl; - access->present = v3_seg->present; - access->avail = v3_seg->avail; - access->long_mode = v3_seg->long_mode; - access->db = v3_seg->db; - access->granularity = v3_seg->granularity; -} -static int inline vmcs_write_guest_segments(struct guest_info* info) -{ - int ret = 0; - struct vmcs_segment_access access; + /******* Setup Host State **********/ - /* CS Segment */ - translate_segment_access(&(info->segments.cs), &access); + /* Cache GDTR, IDTR, and TR in host struct */ + addr_t gdtr_base; + struct { + uint16_t selector; + addr_t base; + } __attribute__((packed)) tmp_seg; + - ret &= check_vmcs_write(VMCS_GUEST_CS_BASE, info->segments.cs.base); - ret &= check_vmcs_write(VMCS_GUEST_CS_SELECTOR, info->segments.cs.selector); - ret &= check_vmcs_write(VMCS_GUEST_CS_LIMIT, info->segments.cs.limit); - ret &= check_vmcs_write(VMCS_GUEST_CS_ACCESS, access.value); + __asm__ __volatile__( + "sgdt (%0);" + : + : "q"(&tmp_seg) + : "memory" + ); + gdtr_base = tmp_seg.base; + vmx_data->host_state.gdtr.base = gdtr_base; + + __asm__ __volatile__( + "sidt (%0);" + : + : "q"(&tmp_seg) + : "memory" + ); + vmx_data->host_state.idtr.base = tmp_seg.base; + + __asm__ __volatile__( + "str (%0);" + : + : "q"(&tmp_seg) + : "memory" + ); + vmx_data->host_state.tr.selector = tmp_seg.selector; + + /* The GDTR *index* is bits 3-15 of the selector. */ + struct tss_descriptor * desc = (struct tss_descriptor *) + (gdtr_base + 8*(tmp_seg.selector>>3)); + + tmp_seg.base = ( + (desc->base1) | + (desc->base2 << 16) | + (desc->base3 << 24) | +#ifdef __V3_64BIT__ + ((uint64_t)desc->base4 << 32) +#else + (0) +#endif + ); - /* SS Segment */ - translate_segment_access(&(info->segments.ss), &access); + vmx_data->host_state.tr.base = tmp_seg.base; - ret &= check_vmcs_write(VMCS_GUEST_SS_BASE, info->segments.ss.base); - ret &= check_vmcs_write(VMCS_GUEST_SS_SELECTOR, info->segments.ss.selector); - ret &= check_vmcs_write(VMCS_GUEST_SS_LIMIT, info->segments.ss.limit); - ret &= check_vmcs_write(VMCS_GUEST_SS_ACCESS, access.value); + - /* DS Segment */ - translate_segment_access(&(info->segments.ds), &access); + /********** Setup and VMX Control Fields from MSR ***********/ + struct v3_msr tmp_msr; - ret &= check_vmcs_write(VMCS_GUEST_DS_BASE, info->segments.ds.base); - ret &= check_vmcs_write(VMCS_GUEST_DS_SELECTOR, info->segments.ds.selector); - ret &= check_vmcs_write(VMCS_GUEST_DS_LIMIT, info->segments.ds.limit); - ret &= check_vmcs_write(VMCS_GUEST_DS_ACCESS, access.value); + v3_get_msr(VMX_PINBASED_CTLS_MSR,&(tmp_msr.hi),&(tmp_msr.lo)); + /* Add NMI exiting */ + vmx_data->pinbased_ctrls = tmp_msr.lo | NMI_EXIT; + v3_get_msr(VMX_PROCBASED_CTLS_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + vmx_data->pri_procbased_ctrls = tmp_msr.lo; - /* ES Segment */ - translate_segment_access(&(info->segments.es), &access); + v3_get_msr(VMX_EXIT_CTLS_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + vmx_data->exit_ctrls = tmp_msr.lo | HOST_ADDR_SPACE_SIZE; - ret &= check_vmcs_write(VMCS_GUEST_ES_BASE, info->segments.es.base); - ret &= check_vmcs_write(VMCS_GUEST_ES_SELECTOR, info->segments.es.selector); - ret &= check_vmcs_write(VMCS_GUEST_ES_LIMIT, info->segments.es.limit); - ret &= check_vmcs_write(VMCS_GUEST_ES_ACCESS, access.value); + v3_get_msr(VMX_ENTRY_CTLS_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + vmx_data->entry_ctrls = tmp_msr.lo; - /* FS Segment */ - translate_segment_access(&(info->segments.fs), &access); + vmx_data->excp_bitmap = 0xffffffff; - ret &= check_vmcs_write(VMCS_GUEST_FS_BASE, info->segments.fs.base); - ret &= check_vmcs_write(VMCS_GUEST_FS_SELECTOR, info->segments.fs.selector); - ret &= check_vmcs_write(VMCS_GUEST_FS_LIMIT, info->segments.fs.limit); - ret &= check_vmcs_write(VMCS_GUEST_FS_ACCESS, access.value); - /* GS Segment */ - translate_segment_access(&(info->segments.gs), &access); - ret &= check_vmcs_write(VMCS_GUEST_GS_BASE, info->segments.gs.base); - ret &= check_vmcs_write(VMCS_GUEST_GS_SELECTOR, info->segments.gs.selector); - ret &= check_vmcs_write(VMCS_GUEST_GS_LIMIT, info->segments.gs.limit); - ret &= check_vmcs_write(VMCS_GUEST_GS_ACCESS, access.value); + /******* Setup VMXAssist guest state ***********/ - return ret; -} + info->rip = 0xd0000; + info->vm_regs.rsp = 0x80000; -static int start_vmx_guest(struct guest_info* info) { - struct vmx_data * vmx_data = (struct vmx_data *)info->vmm_data; - int vmx_ret; + struct rflags * flags = (struct rflags *)&(info->ctrl_regs.rflags); + flags->rsvd1 = 1; - // Have to do a whole lot of flag setting here - PrintDebug("Clearing VMCS\n"); - vmx_ret = vmcs_clear(vmx_data->vmcs_ptr_phys); + /* Print Control MSRs */ + v3_get_msr(VMX_CR0_FIXED0_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + PrintDebug("CR0 MSR: %p\n", (void*)tmp_msr.value); + v3_get_msr(VMX_CR4_FIXED0_MSR, &(tmp_msr.hi), &(tmp_msr.lo)); + PrintDebug("CR4 MSR: %p\n", (void*)tmp_msr.value); - if (vmx_ret != VMX_SUCCESS) { - PrintError("VMCLEAR failed\n"); - return -1; + +#define GUEST_CR0 0x80000031 +#define GUEST_CR4 0x00002000 + info->ctrl_regs.cr0 = GUEST_CR0; + info->ctrl_regs.cr4 = GUEST_CR4; + + /* Setup paging */ + if(info->shdw_pg_mode == SHADOW_PAGING) { + PrintDebug("Creating initial shadow page table\n"); + + if(v3_init_passthrough_pts(info) == -1) { + PrintError("Could not initialize passthrough page tables\n"); + return -1; + } + + info->shdw_pg_state.guest_cr0 = 0x10LL; + PrintDebug("Created\n"); + + vmx_ret |= check_vmcs_write(VMCS_CR0_MASK, 0xffffffffffffffffLL); + vmx_ret |= check_vmcs_write(VMCS_CR4_MASK, 0xffffffffffffffffLL); + + info->ctrl_regs.cr3 = info->direct_map_pt; + + /* Add unconditional I/O and CR exits */ + vmx_data->pri_procbased_ctrls |= UNCOND_IO_EXIT | + CR3_LOAD_EXIT | + CR3_STORE_EXIT; + } - PrintDebug("Loading VMCS\n"); - vmx_ret = vmcs_load(vmx_data->vmcs_ptr_phys); + struct v3_segment * seg_reg = (struct v3_segment *)&(info->segments); - if (vmx_ret != VMX_SUCCESS) { - PrintError("VMPTRLD failed\n"); - return -1; + int i; + for(i=0; i < 10; i++) + { + seg_reg[i].selector = 3<<3; + seg_reg[i].limit = 0xffff; + seg_reg[i].base = 0x0; } + info->segments.cs.selector = 2<<3; + + /* Set only the segment registers */ + for(i=0; i < 6; i++) { + seg_reg[i].limit = 0xfffff; + seg_reg[i].granularity = 1; + seg_reg[i].type = 3; + seg_reg[i].system = 1; + seg_reg[i].dpl = 0; + seg_reg[i].present = 1; + seg_reg[i].db = 1; + } + info->segments.cs.type = 0xb; + info->segments.ldtr.selector = 0x20; + info->segments.ldtr.type = 2; + info->segments.ldtr.system = 0; + info->segments.ldtr.present = 1; + info->segments.ldtr.granularity = 0; + + /* Setup IO map */ + (void) v3_init_vmx_io_map(info); + (void) v3_init_vmx_msr_map(info); + + /************* Map in GDT and vmxassist *************/ + + uint64_t gdt[] __attribute__ ((aligned(32))) = { + 0x0000000000000000ULL, /* 0x00: reserved */ + 0x0000830000000000ULL, /* 0x08: 32-bit TSS */ + // 0x0000890000000000ULL, /* 0x08: 32-bit TSS */ + 0x00CF9b000000FFFFULL, /* 0x10: CS 32-bit */ + 0x00CF93000000FFFFULL, /* 0x18: DS 32-bit */ + 0x000082000000FFFFULL, /* 0x20: LDTR 32-bit */ + }; + +#define VMXASSIST_GDT 0x10000 + addr_t vmxassist_gdt = 0; + if(guest_pa_to_host_va(info, VMXASSIST_GDT, &vmxassist_gdt) == -1) { + PrintError("Could not find VMXASSIST GDT destination\n"); + return -1; + } + memcpy((void*)vmxassist_gdt, gdt, sizeof(uint64_t) * 5); + + info->segments.gdtr.base = VMXASSIST_GDT; + +#define VMXASSIST_TSS 0x40000 + addr_t vmxassist_tss = VMXASSIST_TSS; + gdt[0x08 / sizeof(gdt[0])] |= + ((vmxassist_tss & 0xFF000000) << (56-24)) | + ((vmxassist_tss & 0x00FF0000) << (32-16)) | + ((vmxassist_tss & 0x0000FFFF) << (16)) | + (8392 - 1); + + info->segments.tr.selector = 0x08; + info->segments.tr.base = vmxassist_tss; + + // info->segments.tr.type = 0x9; + info->segments.tr.type = 0x3; + info->segments.tr.system = 0; + info->segments.tr.present = 1; + info->segments.tr.granularity = 0; - update_vmcs_host_state(info); + +#define VMXASSIST_START 0x000d0000 + extern uint8_t vmxassist_start[]; + extern uint8_t vmxassist_end[]; - // Setup guest state - // TODO: This is not 32-bit safe! - vmx_ret &= check_vmcs_write(VMCS_GUEST_RIP, info->rip); + addr_t vmxassist_dst = 0; + if(guest_pa_to_host_va(info, VMXASSIST_START, &vmxassist_dst) == -1) { + PrintError("Could not find VMXASSIST destination\n"); + return -1; + } + memcpy((void*)vmxassist_dst, vmxassist_start, vmxassist_end-vmxassist_start); + + /*** Write all the info to the VMCS ***/ + if(update_vmcs_ctrl_fields(info)) { + PrintError("Could not write control fields!\n"); + return -1; + } + + if(update_vmcs_host_state(info)) { + PrintError("Could not write host state\n"); + return -1; + } - vmx_ret &= vmcs_write_guest_segments(info); - if (vmx_ret != 0) { - PrintError("Could not initialize VMCS segments\n"); + if(update_vmcs_guest_state(info) != VMX_SUCCESS) { + PrintError("Writing guest state failed!\n"); return -1; } - v3_print_vmcs_guest_state(); + v3_print_vmcs(); - return -1; + + v3_post_config_guest(info, config_ptr); + + return 0; } +static int start_vmx_guest(struct guest_info* info) { + uint32_t error = 0; + int ret = 0; + + PrintDebug("Attempting VMLAUNCH\n"); + + ret = v3_vmx_vmlaunch(&(info->vm_regs), info); + if (ret != VMX_SUCCESS) { + vmcs_read(VMCS_INSTR_ERR, &error); + PrintError("VMLAUNCH failed: %d\n", error); + v3_print_vmcs(); + } + PrintDebug("Returned from VMLAUNCH ret=%d(0x%x)\n", ret, ret); + + return -1; +} int v3_is_vmx_capable() { @@ -738,27 +773,41 @@ static int has_vmx_nested_paging() { void v3_init_vmx(struct v3_ctrl_ops * vm_ops) { extern v3_cpu_arch_t v3_cpu_type; + struct v3_msr tmp_msr; + uint64_t ret=0; + + v3_get_msr(VMX_CR4_FIXED0_MSR,&(tmp_msr.hi),&(tmp_msr.lo)); __asm__ __volatile__ ( - "movq %%cr4, %%rbx; " - "orq $0x00002000,%%rbx; " - "movq %%rbx, %%cr4;" - : - : - : "%rbx" + "movq %%cr4, %%rbx;" + "orq $0x00002000, %%rbx;" + "movq %%rbx, %0;" + : "=m"(ret) + : + : "%rbx" ); - - + if((~ret & tmp_msr.value) == 0) { + __asm__ __volatile__ ( + "movq %0, %%cr4;" + : + : "q"(ret) + ); + } else { + PrintError("Invalid CR4 Settings!\n"); + return; + } + __asm__ __volatile__ ( + "movq %%cr0, %%rbx; " + "orq $0x00000020,%%rbx; " + "movq %%rbx, %%cr0;" + : + : + : "%rbx" + ); + // // Should check and return Error here.... - __asm__ __volatile__ ( - "movq %%cr0, %%rbx; " - "orq $0x00000020,%%rbx; " - "movq %%rbx, %%cr0;" - : - : - : "%rbx" - ); + // Setup VMXON Region vmxon_ptr_phys = allocate_vmcs(); @@ -784,3 +833,4 @@ void v3_init_vmx(struct v3_ctrl_ops * vm_ops) { vm_ops->has_nested_paging = &has_vmx_nested_paging; } +