palacios/src/palacios/svm.c

   1
   2 /*
   3  * This file is part of the Palacios Virtual Machine Monitor developed
   4  * by the V3VEE Project with funding from the United States National
   5  * Science Foundation and the Department of Energy.
   6  *
   7  * The V3VEE Project is a joint project between Northwestern University
   8  * and the University of New Mexico.  You can find out more at
   9  * http://www.v3vee.org
  10  *
  11  * Copyright (c) 2008, Jack Lange <jarusl@cs.northwestern.edu>
  12  * Copyright (c) 2008, The V3VEE Project <http://www.v3vee.org>
  13  * All rights reserved.
  14  *
  15  * Author: Jack Lange <jarusl@cs.northwestern.edu>
  16  *
  17  * This is free software.  You are permitted to use,
  18  * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
  19  */
  20
  21
  22 #include <palacios/svm.h>
  23 #include <palacios/vmm.h>
  24
  25 #include <palacios/vmcb.h>
  26 #include <palacios/vmm_mem.h>
  27 #include <palacios/vmm_paging.h>
  28 #include <palacios/svm_handler.h>
  29
  30 #include <palacios/vmm_debug.h>
  31 #include <palacios/vm_guest_mem.h>
  32
  33 #include <palacios/vmm_decoder.h>
  34 #include <palacios/vmm_string.h>
  35 #include <palacios/vmm_lowlevel.h>
  36 #include <palacios/svm_msr.h>
  37
  38 #include <palacios/vmm_rbtree.h>
  39
  40 #include <palacios/vmm_direct_paging.h>
  41
  42 #include <palacios/vmm_ctrl_regs.h>
  43 #include <palacios/svm_io.h>
  44
  45 #include <palacios/vmm_sprintf.h>
  46
  47
  48 #ifndef V3_CONFIG_DEBUG_SVM
  49 #undef PrintDebug
  50 #define PrintDebug(fmt, args...)
  51 #endif
  52
  53
  54 uint32_t v3_last_exit;
  55
  56 // This is a global pointer to the host's VMCB
  57 static addr_t host_vmcbs[V3_CONFIG_MAX_CPUS] = { [0 ... V3_CONFIG_MAX_CPUS - 1] = 0};
  58
  59
  60
  61 extern void v3_stgi();
  62 extern void v3_clgi();
  63 //extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, uint64_t * fs, uint64_t * gs);
  64 extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, vmcb_t * host_vmcb);
  65
  66
  67 static vmcb_t * Allocate_VMCB() {
  68     vmcb_t * vmcb_page = NULL;
  69     addr_t vmcb_pa = (addr_t)V3_AllocPages(1);
  70
  71     if ((void *)vmcb_pa == NULL) {
  72         PrintError("Error allocating VMCB\n");
  73         return NULL;
  74     }
  75
  76     vmcb_page = (vmcb_t *)V3_VAddr((void *)vmcb_pa);
  77
  78     memset(vmcb_page, 0, 4096);
  79
  80     return vmcb_page;
  81 }
  82
  83
  84
  85 static void Init_VMCB_BIOS(vmcb_t * vmcb, struct guest_info * core) {
  86     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
  87     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
  88     uint_t i;
  89
  90
  91     //
  92     ctrl_area->svm_instrs.VMRUN = 1;
  93     ctrl_area->svm_instrs.VMMCALL = 1;
  94     ctrl_area->svm_instrs.VMLOAD = 1;
  95     ctrl_area->svm_instrs.VMSAVE = 1;
  96     ctrl_area->svm_instrs.STGI = 1;
  97     ctrl_area->svm_instrs.CLGI = 1;
  98     ctrl_area->svm_instrs.SKINIT = 1;
  99     ctrl_area->svm_instrs.ICEBP = 1;
 100     ctrl_area->svm_instrs.WBINVD = 1;
 101     ctrl_area->svm_instrs.MONITOR = 1;
 102     ctrl_area->svm_instrs.MWAIT_always = 1;
 103     ctrl_area->svm_instrs.MWAIT_if_armed = 1;
 104     ctrl_area->instrs.INVLPGA = 1;
 105     ctrl_area->instrs.CPUID = 1;
 106
 107     ctrl_area->instrs.HLT = 1;
 108
 109 #ifdef V3_CONFIG_TIME_VIRTUALIZE_TSC
 110     ctrl_area->instrs.RDTSC = 1;
 111     ctrl_area->svm_instrs.RDTSCP = 1;
 112 #endif
 113
 114     // guest_state->cr0 = 0x00000001;    // PE
 115
 116     /*
 117       ctrl_area->exceptions.de = 1;
 118       ctrl_area->exceptions.df = 1;
 119
 120       ctrl_area->exceptions.ts = 1;
 121       ctrl_area->exceptions.ss = 1;
 122       ctrl_area->exceptions.ac = 1;
 123       ctrl_area->exceptions.mc = 1;
 124       ctrl_area->exceptions.gp = 1;
 125       ctrl_area->exceptions.ud = 1;
 126       ctrl_area->exceptions.np = 1;
 127       ctrl_area->exceptions.of = 1;
 128
 129       ctrl_area->exceptions.nmi = 1;
 130     */
 131
 132
 133     ctrl_area->instrs.NMI = 1;
 134     ctrl_area->instrs.SMI = 0; // allow SMIs to run in guest
 135     ctrl_area->instrs.INIT = 1;
 136     ctrl_area->instrs.PAUSE = 1;
 137     ctrl_area->instrs.shutdown_evts = 1;
 138
 139
 140     /* DEBUG FOR RETURN CODE */
 141     ctrl_area->exit_code = 1;
 142
 143
 144     /* Setup Guest Machine state */
 145
 146     core->vm_regs.rsp = 0x00;
 147     core->rip = 0xfff0;
 148
 149     core->vm_regs.rdx = 0x00000f00;
 150
 151
 152     core->cpl = 0;
 153
 154     core->ctrl_regs.rflags = 0x00000002; // The reserved bit is always 1
 155     core->ctrl_regs.cr0 = 0x60010010; // Set the WP flag so the memory hooks work in real-mode
 156     core->ctrl_regs.efer |= EFER_MSR_svm_enable;
 157
 158
 159
 160
 161
 162     core->segments.cs.selector = 0xf000;
 163     core->segments.cs.limit = 0xffff;
 164     core->segments.cs.base = 0x0000000f0000LL;
 165
 166     // (raw attributes = 0xf3)
 167     core->segments.cs.type = 0x3;
 168     core->segments.cs.system = 0x1;
 169     core->segments.cs.dpl = 0x3;
 170     core->segments.cs.present = 1;
 171
 172
 173
 174     struct v3_segment * segregs [] = {&(core->segments.ss), &(core->segments.ds),
 175                                       &(core->segments.es), &(core->segments.fs),
 176                                       &(core->segments.gs), NULL};
 177
 178     for ( i = 0; segregs[i] != NULL; i++) {
 179         struct v3_segment * seg = segregs[i];
 180
 181         seg->selector = 0x0000;
 182         //    seg->base = seg->selector << 4;
 183         seg->base = 0x00000000;
 184         seg->limit = ~0u;
 185
 186         // (raw attributes = 0xf3)
 187         seg->type = 0x3;
 188         seg->system = 0x1;
 189         seg->dpl = 0x3;
 190         seg->present = 1;
 191     }
 192
 193     core->segments.gdtr.limit = 0x0000ffff;
 194     core->segments.gdtr.base = 0x0000000000000000LL;
 195     core->segments.idtr.limit = 0x0000ffff;
 196     core->segments.idtr.base = 0x0000000000000000LL;
 197
 198     core->segments.ldtr.selector = 0x0000;
 199     core->segments.ldtr.limit = 0x0000ffff;
 200     core->segments.ldtr.base = 0x0000000000000000LL;
 201     core->segments.tr.selector = 0x0000;
 202     core->segments.tr.limit = 0x0000ffff;
 203     core->segments.tr.base = 0x0000000000000000LL;
 204
 205
 206     core->dbg_regs.dr6 = 0x00000000ffff0ff0LL;
 207     core->dbg_regs.dr7 = 0x0000000000000400LL;
 208
 209
 210     ctrl_area->IOPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->io_map.arch_data);
 211     ctrl_area->instrs.IOIO_PROT = 1;
 212
 213     ctrl_area->MSRPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->msr_map.arch_data);
 214     ctrl_area->instrs.MSR_PROT = 1;
 215
 216
 217     PrintDebug("Exiting on interrupts\n");
 218     ctrl_area->guest_ctrl.V_INTR_MASKING = 1;
 219     ctrl_area->instrs.INTR = 1;
 220
 221
 222     v3_hook_msr(core->vm_info, EFER_MSR,
 223                 &v3_handle_efer_read,
 224                 &v3_handle_efer_write,
 225                 core);
 226
 227     if (core->shdw_pg_mode == SHADOW_PAGING) {
 228         PrintDebug("Creating initial shadow page table\n");
 229
 230         /* JRL: This is a performance killer, and a simplistic solution */
 231         /* We need to fix this */
 232         ctrl_area->TLB_CONTROL = 1;
 233         ctrl_area->guest_ASID = 1;
 234
 235
 236         if (v3_init_passthrough_pts(core) == -1) {
 237             PrintError("Could not initialize passthrough page tables\n");
 238             return ;
 239         }
 240
 241
 242         core->shdw_pg_state.guest_cr0 = 0x0000000000000010LL;
 243         PrintDebug("Created\n");
 244
 245         core->ctrl_regs.cr0 |= 0x80000000;
 246         core->ctrl_regs.cr3 = core->direct_map_pt;
 247
 248         ctrl_area->cr_reads.cr0 = 1;
 249         ctrl_area->cr_writes.cr0 = 1;
 250         //ctrl_area->cr_reads.cr4 = 1;
 251         ctrl_area->cr_writes.cr4 = 1;
 252         ctrl_area->cr_reads.cr3 = 1;
 253         ctrl_area->cr_writes.cr3 = 1;
 254
 255
 256
 257         ctrl_area->instrs.INVLPG = 1;
 258
 259         ctrl_area->exceptions.pf = 1;
 260
 261         guest_state->g_pat = 0x7040600070406ULL;
 262
 263
 264
 265     } else if (core->shdw_pg_mode == NESTED_PAGING) {
 266         // Flush the TLB on entries/exits
 267         ctrl_area->TLB_CONTROL = 1;
 268         ctrl_area->guest_ASID = 1;
 269
 270         // Enable Nested Paging
 271         ctrl_area->NP_ENABLE = 1;
 272
 273         PrintDebug("NP_Enable at 0x%p\n", (void *)&(ctrl_area->NP_ENABLE));
 274
 275         // Set the Nested Page Table pointer
 276         if (v3_init_passthrough_pts(core) == -1) {
 277             PrintError("Could not initialize Nested page tables\n");
 278             return ;
 279         }
 280
 281         ctrl_area->N_CR3 = core->direct_map_pt;
 282
 283         guest_state->g_pat = 0x7040600070406ULL;
 284     }
 285
 286     /* tell the guest that we don't support SVM */
 287     v3_hook_msr(core->vm_info, SVM_VM_CR_MSR,
 288         &v3_handle_vm_cr_read,
 289         &v3_handle_vm_cr_write,
 290         core);
 291 }
 292
 293
 294 int v3_init_svm_vmcb(struct guest_info * core, v3_vm_class_t vm_class) {
 295
 296     PrintDebug("Allocating VMCB\n");
 297     core->vmm_data = (void *)Allocate_VMCB();
 298
 299     if (core->vmm_data == NULL) {
 300         PrintError("Could not allocate VMCB, Exiting...\n");
 301         return -1;
 302     }
 303
 304     if (vm_class == V3_PC_VM) {
 305         PrintDebug("Initializing VMCB (addr=%p)\n", (void *)core->vmm_data);
 306         Init_VMCB_BIOS((vmcb_t*)(core->vmm_data), core);
 307     } else {
 308         PrintError("Invalid VM class\n");
 309         return -1;
 310     }
 311
 312     return 0;
 313 }
 314
 315
 316 int v3_deinit_svm_vmcb(struct guest_info * core) {
 317     V3_FreePages(V3_PAddr(core->vmm_data), 1);
 318     return 0;
 319 }
 320
 321
 322 static int update_irq_exit_state(struct guest_info * info) {
 323     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 324
 325     // Fix for QEMU bug using EVENTINJ as an internal cache
 326     guest_ctrl->EVENTINJ.valid = 0;
 327
 328     if ((info->intr_core_state.irq_pending == 1) && (guest_ctrl->guest_ctrl.V_IRQ == 0)) {
 329
 330 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 331         PrintDebug("INTAK cycle completed for irq %d\n", info->intr_core_state.irq_vector);
 332 #endif
 333
 334         info->intr_core_state.irq_started = 1;
 335         info->intr_core_state.irq_pending = 0;
 336
 337         v3_injecting_intr(info, info->intr_core_state.irq_vector, V3_EXTERNAL_IRQ);
 338     }
 339
 340     if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 0)) {
 341 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 342         PrintDebug("Interrupt %d taken by guest\n", info->intr_core_state.irq_vector);
 343 #endif
 344
 345         // Interrupt was taken fully vectored
 346         info->intr_core_state.irq_started = 0;
 347
 348     } else if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 1)) {
 349 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 350         PrintDebug("EXIT INT INFO is set (vec=%d)\n", guest_ctrl->exit_int_info.vector);
 351 #endif
 352     }
 353
 354     return 0;
 355 }
 356
 357
 358 static int update_irq_entry_state(struct guest_info * info) {
 359     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 360
 361
 362     if (info->intr_core_state.irq_pending == 0) {
 363         guest_ctrl->guest_ctrl.V_IRQ = 0;
 364         guest_ctrl->guest_ctrl.V_INTR_VECTOR = 0;
 365     }
 366
 367     if (v3_excp_pending(info)) {
 368         uint_t excp = v3_get_excp_number(info);
 369
 370         guest_ctrl->EVENTINJ.type = SVM_INJECTION_EXCEPTION;
 371
 372         if (info->excp_state.excp_error_code_valid) {
 373             guest_ctrl->EVENTINJ.error_code = info->excp_state.excp_error_code;
 374             guest_ctrl->EVENTINJ.ev = 1;
 375 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 376             PrintDebug("Injecting exception %d with error code %x\n", excp, guest_ctrl->EVENTINJ.error_code);
 377 #endif
 378         }
 379
 380         guest_ctrl->EVENTINJ.vector = excp;
 381
 382         guest_ctrl->EVENTINJ.valid = 1;
 383
 384 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 385         PrintDebug("<%d> Injecting Exception %d (CR2=%p) (EIP=%p)\n",
 386                    (int)info->num_exits,
 387                    guest_ctrl->EVENTINJ.vector,
 388                    (void *)(addr_t)info->ctrl_regs.cr2,
 389                    (void *)(addr_t)info->rip);
 390 #endif
 391
 392         v3_injecting_excp(info, excp);
 393     } else if (info->intr_core_state.irq_started == 1) {
 394 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 395         PrintDebug("IRQ pending from previous injection\n");
 396 #endif
 397         guest_ctrl->guest_ctrl.V_IRQ = 1;
 398         guest_ctrl->guest_ctrl.V_INTR_VECTOR = info->intr_core_state.irq_vector;
 399         guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 400         guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 401
 402     } else {
 403         switch (v3_intr_pending(info)) {
 404             case V3_EXTERNAL_IRQ: {
 405                 uint32_t irq = v3_get_intr(info);
 406
 407                 guest_ctrl->guest_ctrl.V_IRQ = 1;
 408                 guest_ctrl->guest_ctrl.V_INTR_VECTOR = irq;
 409                 guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 410                 guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 411
 412 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 413                 PrintDebug("Injecting Interrupt %d (EIP=%p)\n",
 414                            guest_ctrl->guest_ctrl.V_INTR_VECTOR,
 415                            (void *)(addr_t)info->rip);
 416 #endif
 417
 418                 info->intr_core_state.irq_pending = 1;
 419                 info->intr_core_state.irq_vector = irq;
 420
 421                 break;
 422             }
 423             case V3_NMI:
 424                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_NMI;
 425                 break;
 426             case V3_SOFTWARE_INTR:
 427                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_SOFT_INTR;
 428                 break;
 429             case V3_VIRTUAL_IRQ:
 430                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_IRQ;
 431                 break;
 432
 433             case V3_INVALID_INTR:
 434             default:
 435                 break;
 436         }
 437
 438     }
 439
 440     return 0;
 441 }
 442
 443
 444 /*
 445  * CAUTION and DANGER!!!
 446  *
 447  * The VMCB CANNOT(!!) be accessed outside of the clgi/stgi calls inside this function
 448  * When exectuing a symbiotic call, the VMCB WILL be overwritten, so any dependencies
 449  * on its contents will cause things to break. The contents at the time of the exit WILL
 450  * change before the exit handler is executed.
 451  */
 452 int v3_svm_enter(struct guest_info * info) {
 453     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 454     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 455     addr_t exit_code = 0, exit_info1 = 0, exit_info2 = 0;
 456
 457     // Conditionally yield the CPU if the timeslice has expired
 458     v3_yield_cond(info);
 459
 460     // Perform any additional yielding needed for time adjustment
 461     v3_adjust_time(info);
 462
 463     // disable global interrupts for vm state transition
 464     v3_clgi();
 465
 466     // Update timer devices right before entering the VM. Doing it
 467     // here makes sure the guest sees any timers that fired while
 468     // it was in the VMM
 469     v3_update_timers(info);
 470
 471     // Synchronize the guest state to the VMCB
 472     guest_state->cr0 = info->ctrl_regs.cr0;
 473     guest_state->cr2 = info->ctrl_regs.cr2;
 474     guest_state->cr3 = info->ctrl_regs.cr3;
 475     guest_state->cr4 = info->ctrl_regs.cr4;
 476     guest_state->dr6 = info->dbg_regs.dr6;
 477     guest_state->dr7 = info->dbg_regs.dr7;
 478     guest_ctrl->guest_ctrl.V_TPR = info->ctrl_regs.cr8 & 0xff;
 479     guest_state->rflags = info->ctrl_regs.rflags;
 480     guest_state->efer = info->ctrl_regs.efer;
 481
 482     guest_state->cpl = info->cpl;
 483
 484     v3_set_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 485
 486     guest_state->rax = info->vm_regs.rax;
 487     guest_state->rip = info->rip;
 488     guest_state->rsp = info->vm_regs.rsp;
 489
 490 #ifdef V3_CONFIG_SYMCALL
 491     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 492         update_irq_entry_state(info);
 493     }
 494 #else
 495     update_irq_entry_state(info);
 496 #endif
 497
 498
 499     /* ** */
 500
 501     /*
 502       PrintDebug("SVM Entry to CS=%p  rip=%p...\n",
 503       (void *)(addr_t)info->segments.cs.base,
 504       (void *)(addr_t)info->rip);
 505     */
 506
 507 #ifdef V3_CONFIG_SYMCALL
 508     if (info->sym_core_state.symcall_state.sym_call_active == 1) {
 509         if (guest_ctrl->guest_ctrl.V_IRQ == 1) {
 510             V3_Print("!!! Injecting Interrupt during Sym call !!!\n");
 511         }
 512     }
 513 #endif
 514
 515     v3_time_enter_vm(info);
 516     guest_ctrl->TSC_OFFSET = v3_tsc_host_offset(&info->time_state);
 517
 518     //V3_Print("Calling v3_svm_launch\n");
 519
 520     v3_svm_launch((vmcb_t *)V3_PAddr(info->vmm_data), &(info->vm_regs), (vmcb_t *)host_vmcbs[V3_Get_CPU()]);
 521
 522     //V3_Print("SVM Returned: Exit Code: %x, guest_rip=%lx\n", (uint32_t)(guest_ctrl->exit_code), (unsigned long)guest_state->rip);
 523
 524     v3_last_exit = (uint32_t)(guest_ctrl->exit_code);
 525
 526     // Immediate exit from VM time bookkeeping
 527     v3_time_exit_vm(info);
 528
 529     info->num_exits++;
 530
 531     // Save Guest state from VMCB
 532     info->rip = guest_state->rip;
 533     info->vm_regs.rsp = guest_state->rsp;
 534     info->vm_regs.rax = guest_state->rax;
 535
 536     info->cpl = guest_state->cpl;
 537
 538     info->ctrl_regs.cr0 = guest_state->cr0;
 539     info->ctrl_regs.cr2 = guest_state->cr2;
 540     info->ctrl_regs.cr3 = guest_state->cr3;
 541     info->ctrl_regs.cr4 = guest_state->cr4;
 542     info->dbg_regs.dr6 = guest_state->dr6;
 543     info->dbg_regs.dr7 = guest_state->dr7;
 544     info->ctrl_regs.cr8 = guest_ctrl->guest_ctrl.V_TPR;
 545     info->ctrl_regs.rflags = guest_state->rflags;
 546     info->ctrl_regs.efer = guest_state->efer;
 547
 548     v3_get_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 549     info->cpu_mode = v3_get_vm_cpu_mode(info);
 550     info->mem_mode = v3_get_vm_mem_mode(info);
 551     /* ** */
 552
 553
 554     // save exit info here
 555     exit_code = guest_ctrl->exit_code;
 556     exit_info1 = guest_ctrl->exit_info1;
 557     exit_info2 = guest_ctrl->exit_info2;
 558
 559
 560 #ifdef V3_CONFIG_SYMCALL
 561     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 562         update_irq_exit_state(info);
 563     }
 564 #else
 565     update_irq_exit_state(info);
 566 #endif
 567
 568
 569     // reenable global interrupts after vm exit
 570     v3_stgi();
 571
 572
 573     // Conditionally yield the CPU if the timeslice has expired
 574     v3_yield_cond(info);
 575
 576
 577
 578     if (v3_handle_svm_exit(info, exit_code, exit_info1, exit_info2) != 0) {
 579         PrintError("Error in SVM exit handler\n");
 580         PrintError("  last exit was %d\n", v3_last_exit);
 581         return -1;
 582     }
 583
 584
 585     return 0;
 586 }
 587
 588
 589 int v3_start_svm_guest(struct guest_info * info) {
 590     //    vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 591     //  vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 592
 593     PrintDebug("Starting SVM core %u (on logical core %u)\n", info->vcpu_id, info->pcpu_id);
 594
 595     if (info->vcpu_id == 0) {
 596         info->core_run_state = CORE_RUNNING;
 597         info->vm_info->run_state = VM_RUNNING;
 598     } else  {
 599         PrintDebug("SVM core %u (on %u): Waiting for core initialization\n", info->vcpu_id, info->pcpu_id);
 600
 601         while (info->core_run_state == CORE_STOPPED) {
 602             v3_yield(info);
 603             //PrintDebug("SVM core %u: still waiting for INIT\n", info->vcpu_id);
 604         }
 605
 606         PrintDebug("SVM core %u(on %u) initialized\n", info->vcpu_id, info->pcpu_id);
 607     }
 608
 609     PrintDebug("SVM core %u(on %u): I am starting at CS=0x%x (base=0x%p, limit=0x%x),  RIP=0x%p\n",
 610                info->vcpu_id, info->pcpu_id,
 611                info->segments.cs.selector, (void *)(info->segments.cs.base),
 612                info->segments.cs.limit, (void *)(info->rip));
 613
 614
 615
 616     PrintDebug("SVM core %u: Launching SVM VM (vmcb=%p) (on cpu %u)\n",
 617                info->vcpu_id, (void *)info->vmm_data, info->pcpu_id);
 618     //PrintDebugVMCB((vmcb_t*)(info->vmm_data));
 619
 620     v3_start_time(info);
 621
 622     while (1) {
 623
 624         if (info->vm_info->run_state == VM_STOPPED) {
 625             info->core_run_state = CORE_STOPPED;
 626             break;
 627         }
 628
 629         if (v3_svm_enter(info) == -1) {
 630             vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 631             addr_t host_addr;
 632             addr_t linear_addr = 0;
 633
 634             info->vm_info->run_state = VM_ERROR;
 635
 636             V3_Print("SVM core %u: SVM ERROR!!\n", info->vcpu_id);
 637
 638             v3_print_guest_state(info);
 639
 640             V3_Print("SVM core %u: SVM Exit Code: %p\n", info->vcpu_id, (void *)(addr_t)guest_ctrl->exit_code);
 641
 642             V3_Print("SVM core %u: exit_info1 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info1));
 643             V3_Print("SVM core %u: exit_info1 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info1)) + 4));
 644
 645             V3_Print("SVM core %u: exit_info2 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info2));
 646             V3_Print("SVM core %u: exit_info2 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info2)) + 4));
 647
 648             linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
 649
 650             if (info->mem_mode == PHYSICAL_MEM) {
 651                 v3_gpa_to_hva(info, linear_addr, &host_addr);
 652             } else if (info->mem_mode == VIRTUAL_MEM) {
 653                 v3_gva_to_hva(info, linear_addr, &host_addr);
 654             }
 655
 656             V3_Print("SVM core %u: Host Address of rip = 0x%p\n", info->vcpu_id, (void *)host_addr);
 657
 658             V3_Print("SVM core %u: Instr (15 bytes) at %p:\n", info->vcpu_id, (void *)host_addr);
 659             v3_dump_mem((uint8_t *)host_addr, 15);
 660
 661             v3_print_stack(info);
 662
 663             break;
 664         }
 665
 666
 667         if (info->vm_info->run_state == VM_STOPPED) {
 668             info->core_run_state = CORE_STOPPED;
 669             break;
 670         }
 671
 672
 673
 674 /*
 675         if ((info->num_exits % 50000) == 0) {
 676             V3_Print("SVM Exit number %d\n", (uint32_t)info->num_exits);
 677             v3_print_guest_state(info);
 678         }
 679 */
 680
 681     }
 682
 683     // Need to take down the other cores on error...
 684
 685     return 0;
 686 }
 687
 688
 689
 690
 691 int v3_reset_svm_vm_core(struct guest_info * core, addr_t rip) {
 692     // init vmcb_bios
 693
 694     // Write the RIP, CS, and descriptor
 695     // assume the rest is already good to go
 696     //
 697     // vector VV -> rip at 0
 698     //              CS = VV00
 699     //  This means we start executing at linear address VV000
 700     //
 701     // So the selector needs to be VV00
 702     // and the base needs to be VV000
 703     //
 704     core->rip = 0;
 705     core->segments.cs.selector = rip << 8;
 706     core->segments.cs.limit = 0xffff;
 707     core->segments.cs.base = rip << 12;
 708
 709     return 0;
 710 }
 711
 712
 713
 714
 715
 716
 717 /* Checks machine SVM capability */
 718 /* Implemented from: AMD Arch Manual 3, sect 15.4 */
 719 int v3_is_svm_capable() {
 720     uint_t vm_cr_low = 0, vm_cr_high = 0;
 721     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 722
 723     v3_cpuid(CPUID_EXT_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 724
 725     PrintDebug("CPUID_EXT_FEATURE_IDS_ecx=0x%x\n", ecx);
 726
 727     if ((ecx & CPUID_EXT_FEATURE_IDS_ecx_svm_avail) == 0) {
 728       V3_Print("SVM Not Available\n");
 729       return 0;
 730     }  else {
 731         v3_get_msr(SVM_VM_CR_MSR, &vm_cr_high, &vm_cr_low);
 732
 733         PrintDebug("SVM_VM_CR_MSR = 0x%x 0x%x\n", vm_cr_high, vm_cr_low);
 734
 735         if ((vm_cr_low & SVM_VM_CR_MSR_svmdis) == 1) {
 736             V3_Print("SVM is available but is disabled.\n");
 737
 738             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 739
 740             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 741
 742             if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_svml) == 0) {
 743                 V3_Print("SVM BIOS Disabled, not unlockable\n");
 744             } else {
 745                 V3_Print("SVM is locked with a key\n");
 746             }
 747             return 0;
 748
 749         } else {
 750             V3_Print("SVM is available and  enabled.\n");
 751
 752             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 753             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_eax=0x%x\n", eax);
 754             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ebx=0x%x\n", ebx);
 755             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ecx=0x%x\n", ecx);
 756             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 757
 758             return 1;
 759         }
 760     }
 761 }
 762
 763 static int has_svm_nested_paging() {
 764     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 765
 766     v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 767
 768     //PrintDebug("CPUID_EXT_FEATURE_IDS_edx=0x%x\n", edx);
 769
 770     if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_np) == 0) {
 771         V3_Print("SVM Nested Paging not supported\n");
 772         return 0;
 773     } else {
 774         V3_Print("SVM Nested Paging supported\n");
 775         return 1;
 776     }
 777 }
 778
 779
 780
 781 void v3_init_svm_cpu(int cpu_id) {
 782     reg_ex_t msr;
 783     extern v3_cpu_arch_t v3_cpu_types[];
 784
 785     // Enable SVM on the CPU
 786     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 787     msr.e_reg.low |= EFER_MSR_svm_enable;
 788     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 789
 790     V3_Print("SVM Enabled\n");
 791
 792     // Setup the host state save area
 793     host_vmcbs[cpu_id] = (addr_t)V3_AllocPages(4);
 794
 795     /* 64-BIT-ISSUE */
 796     //  msr.e_reg.high = 0;
 797     //msr.e_reg.low = (uint_t)host_vmcb;
 798     msr.r_reg = host_vmcbs[cpu_id];
 799
 800     PrintDebug("Host State being saved at %p\n", (void *)host_vmcbs[cpu_id]);
 801     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 802
 803
 804     if (has_svm_nested_paging() == 1) {
 805         v3_cpu_types[cpu_id] = V3_SVM_REV3_CPU;
 806     } else {
 807         v3_cpu_types[cpu_id] = V3_SVM_CPU;
 808     }
 809 }
 810
 811
 812
 813 void v3_deinit_svm_cpu(int cpu_id) {
 814     reg_ex_t msr;
 815     extern v3_cpu_arch_t v3_cpu_types[];
 816
 817     // reset SVM_VM_HSAVE_PA_MSR
 818     // Does setting it to NULL disable??
 819     msr.r_reg = 0;
 820     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 821
 822     // Disable SVM?
 823     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 824     msr.e_reg.low &= ~EFER_MSR_svm_enable;
 825     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 826
 827     v3_cpu_types[cpu_id] = V3_INVALID_CPU;
 828
 829     V3_FreePages((void *)host_vmcbs[cpu_id], 4);
 830
 831     V3_Print("Host CPU %d host area freed, and SVM disabled\n", cpu_id);
 832     return;
 833 }
 834
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853
 854
 855
 856
 857
 858
 859
 860
 861
 862
 863
 864
 865
 866
 867
 868
 869
 870
 871
 872
 873
 874
 875
 876
 877
 878
 879
 880
 881
 882
 883
 884 #if 0
 885 /*
 886  * Test VMSAVE/VMLOAD Latency
 887  */
 888 #define vmsave ".byte 0x0F,0x01,0xDB ; "
 889 #define vmload ".byte 0x0F,0x01,0xDA ; "
 890 {
 891     uint32_t start_lo, start_hi;
 892     uint32_t end_lo, end_hi;
 893     uint64_t start, end;
 894
 895     __asm__ __volatile__ (
 896                           "rdtsc ; "
 897                           "movl %%eax, %%esi ; "
 898                           "movl %%edx, %%edi ; "
 899                           "movq  %%rcx, %%rax ; "
 900                           vmsave
 901                           "rdtsc ; "
 902                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 903                           : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 904                           );
 905
 906     start = start_hi;
 907     start <<= 32;
 908     start += start_lo;
 909
 910     end = end_hi;
 911     end <<= 32;
 912     end += end_lo;
 913
 914     PrintDebug("VMSave Cycle Latency: %d\n", (uint32_t)(end - start));
 915
 916     __asm__ __volatile__ (
 917                           "rdtsc ; "
 918                           "movl %%eax, %%esi ; "
 919                           "movl %%edx, %%edi ; "
 920                           "movq  %%rcx, %%rax ; "
 921                           vmload
 922                           "rdtsc ; "
 923                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 924                               : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 925                               );
 926
 927         start = start_hi;
 928         start <<= 32;
 929         start += start_lo;
 930
 931         end = end_hi;
 932         end <<= 32;
 933         end += end_lo;
 934
 935
 936         PrintDebug("VMLoad Cycle Latency: %d\n", (uint32_t)(end - start));
 937     }
 938     /* End Latency Test */
 939
 940 #endif
 941
 942
 943
 944
 945
 946
 947
 948 #if 0
 949 void Init_VMCB_pe(vmcb_t *vmcb, struct guest_info vm_info) {
 950   vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
 951   vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
 952   uint_t i = 0;
 953
 954
 955   guest_state->rsp = vm_info.vm_regs.rsp;
 956   guest_state->rip = vm_info.rip;
 957
 958
 959   /* I pretty much just gutted this from TVMM */
 960   /* Note: That means its probably wrong */
 961
 962   // set the segment registers to mirror ours
 963   guest_state->cs.selector = 1<<3;
 964   guest_state->cs.attrib.fields.type = 0xa; // Code segment+read
 965   guest_state->cs.attrib.fields.S = 1;
 966   guest_state->cs.attrib.fields.P = 1;
 967   guest_state->cs.attrib.fields.db = 1;
 968   guest_state->cs.attrib.fields.G = 1;
 969   guest_state->cs.limit = 0xfffff;
 970   guest_state->cs.base = 0;
 971
 972   struct vmcb_selector *segregs [] = {&(guest_state->ss), &(guest_state->ds), &(guest_state->es), &(guest_state->fs), &(guest_state->gs), NULL};
 973   for ( i = 0; segregs[i] != NULL; i++) {
 974     struct vmcb_selector * seg = segregs[i];
 975
 976     seg->selector = 2<<3;
 977     seg->attrib.fields.type = 0x2; // Data Segment+read/write
 978     seg->attrib.fields.S = 1;
 979     seg->attrib.fields.P = 1;
 980     seg->attrib.fields.db = 1;
 981     seg->attrib.fields.G = 1;
 982     seg->limit = 0xfffff;
 983     seg->base = 0;
 984   }
 985
 986
 987   {
 988     /* JRL THIS HAS TO GO */
 989
 990     //    guest_state->tr.selector = GetTR_Selector();
 991     guest_state->tr.attrib.fields.type = 0x9;
 992     guest_state->tr.attrib.fields.P = 1;
 993     // guest_state->tr.limit = GetTR_Limit();
 994     //guest_state->tr.base = GetTR_Base();// - 0x2000;
 995     /* ** */
 996   }
 997
 998
 999   /* ** */
1000
1001
1002   guest_state->efer |= EFER_MSR_svm_enable;
1003   guest_state->rflags = 0x00000002; // The reserved bit is always 1
1004   ctrl_area->svm_instrs.VMRUN = 1;
1005   guest_state->cr0 = 0x00000001;    // PE
1006   ctrl_area->guest_ASID = 1;
1007
1008
1009   //  guest_state->cpl = 0;
1010
1011
1012
1013   // Setup exits
1014
1015   ctrl_area->cr_writes.cr4 = 1;
1016
1017   ctrl_area->exceptions.de = 1;
1018   ctrl_area->exceptions.df = 1;
1019   ctrl_area->exceptions.pf = 1;
1020   ctrl_area->exceptions.ts = 1;
1021   ctrl_area->exceptions.ss = 1;
1022   ctrl_area->exceptions.ac = 1;
1023   ctrl_area->exceptions.mc = 1;
1024   ctrl_area->exceptions.gp = 1;
1025   ctrl_area->exceptions.ud = 1;
1026   ctrl_area->exceptions.np = 1;
1027   ctrl_area->exceptions.of = 1;
1028   ctrl_area->exceptions.nmi = 1;
1029
1030
1031
1032   ctrl_area->instrs.IOIO_PROT = 1;
1033   ctrl_area->IOPM_BASE_PA = (uint_t)V3_AllocPages(3);
1034
1035   {
1036     reg_ex_t tmp_reg;
1037     tmp_reg.r_reg = ctrl_area->IOPM_BASE_PA;
1038     memset((void*)(tmp_reg.e_reg.low), 0xffffffff, PAGE_SIZE * 2);
1039   }
1040
1041   ctrl_area->instrs.INTR = 1;
1042
1043
1044   {
1045     char gdt_buf[6];
1046     char idt_buf[6];
1047
1048     memset(gdt_buf, 0, 6);
1049     memset(idt_buf, 0, 6);
1050
1051
1052     uint_t gdt_base, idt_base;
1053     ushort_t gdt_limit, idt_limit;
1054
1055     GetGDTR(gdt_buf);
1056     gdt_base = *(ulong_t*)((uchar_t*)gdt_buf + 2) & 0xffffffff;
1057     gdt_limit = *(ushort_t*)(gdt_buf) & 0xffff;
1058     PrintDebug("GDT: base: %x, limit: %x\n", gdt_base, gdt_limit);
1059
1060     GetIDTR(idt_buf);
1061     idt_base = *(ulong_t*)(idt_buf + 2) & 0xffffffff;
1062     idt_limit = *(ushort_t*)(idt_buf) & 0xffff;
1063     PrintDebug("IDT: base: %x, limit: %x\n",idt_base, idt_limit);
1064
1065
1066     // gdt_base -= 0x2000;
1067     //idt_base -= 0x2000;
1068
1069     guest_state->gdtr.base = gdt_base;
1070     guest_state->gdtr.limit = gdt_limit;
1071     guest_state->idtr.base = idt_base;
1072     guest_state->idtr.limit = idt_limit;
1073
1074
1075   }
1076
1077
1078   // also determine if CPU supports nested paging
1079   /*
1080   if (vm_info.page_tables) {
1081     //   if (0) {
1082     // Flush the TLB on entries/exits
1083     ctrl_area->TLB_CONTROL = 1;
1084
1085     // Enable Nested Paging
1086     ctrl_area->NP_ENABLE = 1;
1087
1088     PrintDebug("NP_Enable at 0x%x\n", &(ctrl_area->NP_ENABLE));
1089
1090         // Set the Nested Page Table pointer
1091     ctrl_area->N_CR3 |= ((addr_t)vm_info.page_tables & 0xfffff000);
1092
1093
1094     //   ctrl_area->N_CR3 = Get_CR3();
1095     // guest_state->cr3 |= (Get_CR3() & 0xfffff000);
1096
1097     guest_state->g_pat = 0x7040600070406ULL;
1098
1099     PrintDebug("Set Nested CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(ctrl_area->N_CR3)), (uint_t)*((unsigned char *)&(ctrl_area->N_CR3) + 4));
1100     PrintDebug("Set Guest CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(guest_state->cr3)), (uint_t)*((unsigned char *)&(guest_state->cr3) + 4));
1101     // Enable Paging
1102     //    guest_state->cr0 |= 0x80000000;
1103   }
1104   */
1105
1106 }
1107
1108
1109
1110
1111
1112 #endif
1113
1114