palacios/src/palacios/svm.c

   1
   2 /*
   3  * This file is part of the Palacios Virtual Machine Monitor developed
   4  * by the V3VEE Project with funding from the United States National
   5  * Science Foundation and the Department of Energy.
   6  *
   7  * The V3VEE Project is a joint project between Northwestern University
   8  * and the University of New Mexico.  You can find out more at
   9  * http://www.v3vee.org
  10  *
  11  * Copyright (c) 2008, Jack Lange <jarusl@cs.northwestern.edu>
  12  * Copyright (c) 2008, The V3VEE Project <http://www.v3vee.org>
  13  * All rights reserved.
  14  *
  15  * Author: Jack Lange <jarusl@cs.northwestern.edu>
  16  *
  17  * This is free software.  You are permitted to use,
  18  * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
  19  */
  20
  21
  22 #include <palacios/svm.h>
  23 #include <palacios/vmm.h>
  24
  25 #include <palacios/vmcb.h>
  26 #include <palacios/vmm_mem.h>
  27 #include <palacios/vmm_paging.h>
  28 #include <palacios/svm_handler.h>
  29
  30 #include <palacios/vmm_debug.h>
  31 #include <palacios/vm_guest_mem.h>
  32
  33 #include <palacios/vmm_decoder.h>
  34 #include <palacios/vmm_string.h>
  35 #include <palacios/vmm_lowlevel.h>
  36 #include <palacios/svm_msr.h>
  37
  38 #include <palacios/vmm_rbtree.h>
  39
  40 #include <palacios/vmm_direct_paging.h>
  41
  42 #include <palacios/vmm_ctrl_regs.h>
  43 #include <palacios/svm_io.h>
  44
  45 #include <palacios/vmm_sprintf.h>
  46
  47
  48 #ifndef V3_CONFIG_DEBUG_SVM
  49 #undef PrintDebug
  50 #define PrintDebug(fmt, args...)
  51 #endif
  52
  53
  54 uint32_t v3_last_exit;
  55
  56 // This is a global pointer to the host's VMCB
  57 static addr_t host_vmcbs[V3_CONFIG_MAX_CPUS] = { [0 ... V3_CONFIG_MAX_CPUS - 1] = 0};
  58
  59
  60
  61 extern void v3_stgi();
  62 extern void v3_clgi();
  63 //extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, uint64_t * fs, uint64_t * gs);
  64 extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, vmcb_t * host_vmcb);
  65
  66
  67 static vmcb_t * Allocate_VMCB() {
  68     vmcb_t * vmcb_page = NULL;
  69     addr_t vmcb_pa = (addr_t)V3_AllocPages(1);
  70
  71     if ((void *)vmcb_pa == NULL) {
  72         PrintError("Error allocating VMCB\n");
  73         return NULL;
  74     }
  75
  76     vmcb_page = (vmcb_t *)V3_VAddr((void *)vmcb_pa);
  77
  78     memset(vmcb_page, 0, 4096);
  79
  80     return vmcb_page;
  81 }
  82
  83
  84
  85 static void Init_VMCB_BIOS(vmcb_t * vmcb, struct guest_info * core) {
  86     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
  87     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
  88     uint_t i;
  89
  90
  91     //
  92     ctrl_area->svm_instrs.VMRUN = 1;
  93     ctrl_area->svm_instrs.VMMCALL = 1;
  94     ctrl_area->svm_instrs.VMLOAD = 1;
  95     ctrl_area->svm_instrs.VMSAVE = 1;
  96     ctrl_area->svm_instrs.STGI = 1;
  97     ctrl_area->svm_instrs.CLGI = 1;
  98     ctrl_area->svm_instrs.SKINIT = 1;
  99     ctrl_area->svm_instrs.ICEBP = 1;
 100     ctrl_area->svm_instrs.WBINVD = 1;
 101     ctrl_area->svm_instrs.MONITOR = 1;
 102     ctrl_area->svm_instrs.MWAIT_always = 1;
 103     ctrl_area->svm_instrs.MWAIT_if_armed = 1;
 104     ctrl_area->instrs.INVLPGA = 1;
 105     ctrl_area->instrs.CPUID = 1;
 106
 107     ctrl_area->instrs.HLT = 1;
 108
 109 #ifdef V3_CONFIG_TIME_VIRTUALIZE_TSC
 110     ctrl_area->instrs.RDTSC = 1;
 111     ctrl_area->svm_instrs.RDTSCP = 1;
 112 #endif
 113
 114     // guest_state->cr0 = 0x00000001;    // PE
 115
 116     /*
 117       ctrl_area->exceptions.de = 1;
 118       ctrl_area->exceptions.df = 1;
 119
 120       ctrl_area->exceptions.ts = 1;
 121       ctrl_area->exceptions.ss = 1;
 122       ctrl_area->exceptions.ac = 1;
 123       ctrl_area->exceptions.mc = 1;
 124       ctrl_area->exceptions.gp = 1;
 125       ctrl_area->exceptions.ud = 1;
 126       ctrl_area->exceptions.np = 1;
 127       ctrl_area->exceptions.of = 1;
 128
 129       ctrl_area->exceptions.nmi = 1;
 130     */
 131
 132
 133     ctrl_area->instrs.NMI = 1;
 134     ctrl_area->instrs.SMI = 0; // allow SMIs to run in guest
 135     ctrl_area->instrs.INIT = 1;
 136     ctrl_area->instrs.PAUSE = 1;
 137     ctrl_area->instrs.shutdown_evts = 1;
 138
 139
 140     /* DEBUG FOR RETURN CODE */
 141     ctrl_area->exit_code = 1;
 142
 143
 144     /* Setup Guest Machine state */
 145
 146     core->vm_regs.rsp = 0x00;
 147     core->rip = 0xfff0;
 148
 149     core->vm_regs.rdx = 0x00000f00;
 150
 151
 152     core->cpl = 0;
 153
 154     core->ctrl_regs.rflags = 0x00000002; // The reserved bit is always 1
 155     core->ctrl_regs.cr0 = 0x60010010; // Set the WP flag so the memory hooks work in real-mode
 156     core->ctrl_regs.efer |= EFER_MSR_svm_enable;
 157
 158
 159
 160
 161
 162     core->segments.cs.selector = 0xf000;
 163     core->segments.cs.limit = 0xffff;
 164     core->segments.cs.base = 0x0000000f0000LL;
 165
 166     // (raw attributes = 0xf3)
 167     core->segments.cs.type = 0x3;
 168     core->segments.cs.system = 0x1;
 169     core->segments.cs.dpl = 0x3;
 170     core->segments.cs.present = 1;
 171
 172
 173
 174     struct v3_segment * segregs [] = {&(core->segments.ss), &(core->segments.ds),
 175                                       &(core->segments.es), &(core->segments.fs),
 176                                       &(core->segments.gs), NULL};
 177
 178     for ( i = 0; segregs[i] != NULL; i++) {
 179         struct v3_segment * seg = segregs[i];
 180
 181         seg->selector = 0x0000;
 182         //    seg->base = seg->selector << 4;
 183         seg->base = 0x00000000;
 184         seg->limit = ~0u;
 185
 186         // (raw attributes = 0xf3)
 187         seg->type = 0x3;
 188         seg->system = 0x1;
 189         seg->dpl = 0x3;
 190         seg->present = 1;
 191     }
 192
 193     core->segments.gdtr.limit = 0x0000ffff;
 194     core->segments.gdtr.base = 0x0000000000000000LL;
 195     core->segments.idtr.limit = 0x0000ffff;
 196     core->segments.idtr.base = 0x0000000000000000LL;
 197
 198     core->segments.ldtr.selector = 0x0000;
 199     core->segments.ldtr.limit = 0x0000ffff;
 200     core->segments.ldtr.base = 0x0000000000000000LL;
 201     core->segments.tr.selector = 0x0000;
 202     core->segments.tr.limit = 0x0000ffff;
 203     core->segments.tr.base = 0x0000000000000000LL;
 204
 205
 206     core->dbg_regs.dr6 = 0x00000000ffff0ff0LL;
 207     core->dbg_regs.dr7 = 0x0000000000000400LL;
 208
 209
 210     ctrl_area->IOPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->io_map.arch_data);
 211     ctrl_area->instrs.IOIO_PROT = 1;
 212
 213     ctrl_area->MSRPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->msr_map.arch_data);
 214     ctrl_area->instrs.MSR_PROT = 1;
 215
 216
 217     PrintDebug("Exiting on interrupts\n");
 218     ctrl_area->guest_ctrl.V_INTR_MASKING = 1;
 219     ctrl_area->instrs.INTR = 1;
 220
 221
 222     v3_hook_msr(core->vm_info, EFER_MSR,
 223                 &v3_handle_efer_read,
 224                 &v3_handle_efer_write,
 225                 core);
 226
 227     if (core->shdw_pg_mode == SHADOW_PAGING) {
 228         PrintDebug("Creating initial shadow page table\n");
 229
 230         /* JRL: This is a performance killer, and a simplistic solution */
 231         /* We need to fix this */
 232         ctrl_area->TLB_CONTROL = 1;
 233         ctrl_area->guest_ASID = 1;
 234
 235
 236         if (v3_init_passthrough_pts(core) == -1) {
 237             PrintError("Could not initialize passthrough page tables\n");
 238             return ;
 239         }
 240
 241
 242         core->shdw_pg_state.guest_cr0 = 0x0000000000000010LL;
 243         PrintDebug("Created\n");
 244
 245         core->ctrl_regs.cr0 |= 0x80000000;
 246         core->ctrl_regs.cr3 = core->direct_map_pt;
 247
 248         ctrl_area->cr_reads.cr0 = 1;
 249         ctrl_area->cr_writes.cr0 = 1;
 250         //ctrl_area->cr_reads.cr4 = 1;
 251         ctrl_area->cr_writes.cr4 = 1;
 252         ctrl_area->cr_reads.cr3 = 1;
 253         ctrl_area->cr_writes.cr3 = 1;
 254
 255
 256
 257         ctrl_area->instrs.INVLPG = 1;
 258
 259         ctrl_area->exceptions.pf = 1;
 260
 261         guest_state->g_pat = 0x7040600070406ULL;
 262
 263
 264
 265     } else if (core->shdw_pg_mode == NESTED_PAGING) {
 266         // Flush the TLB on entries/exits
 267         ctrl_area->TLB_CONTROL = 1;
 268         ctrl_area->guest_ASID = 1;
 269
 270         // Enable Nested Paging
 271         ctrl_area->NP_ENABLE = 1;
 272
 273         PrintDebug("NP_Enable at 0x%p\n", (void *)&(ctrl_area->NP_ENABLE));
 274
 275         // Set the Nested Page Table pointer
 276         if (v3_init_passthrough_pts(core) == -1) {
 277             PrintError("Could not initialize Nested page tables\n");
 278             return ;
 279         }
 280
 281         ctrl_area->N_CR3 = core->direct_map_pt;
 282
 283         guest_state->g_pat = 0x7040600070406ULL;
 284     }
 285
 286     /* tell the guest that we don't support SVM */
 287     v3_hook_msr(core->vm_info, SVM_VM_CR_MSR,
 288         &v3_handle_vm_cr_read,
 289         &v3_handle_vm_cr_write,
 290         core);
 291 }
 292
 293
 294 int v3_init_svm_vmcb(struct guest_info * core, v3_vm_class_t vm_class) {
 295
 296     PrintDebug("Allocating VMCB\n");
 297     core->vmm_data = (void *)Allocate_VMCB();
 298
 299     if (core->vmm_data == NULL) {
 300         PrintError("Could not allocate VMCB, Exiting...\n");
 301         return -1;
 302     }
 303
 304     if (vm_class == V3_PC_VM) {
 305         PrintDebug("Initializing VMCB (addr=%p)\n", (void *)core->vmm_data);
 306         Init_VMCB_BIOS((vmcb_t*)(core->vmm_data), core);
 307     } else {
 308         PrintError("Invalid VM class\n");
 309         return -1;
 310     }
 311
 312     return 0;
 313 }
 314
 315
 316 int v3_deinit_svm_vmcb(struct guest_info * core) {
 317     V3_FreePages(V3_PAddr(core->vmm_data), 1);
 318     return 0;
 319 }
 320
 321
 322 static int update_irq_exit_state(struct guest_info * info) {
 323     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 324
 325     // Fix for QEMU bug using EVENTINJ as an internal cache
 326     guest_ctrl->EVENTINJ.valid = 0;
 327
 328     if ((info->intr_core_state.irq_pending == 1) && (guest_ctrl->guest_ctrl.V_IRQ == 0)) {
 329
 330 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 331         PrintDebug("INTAK cycle completed for irq %d\n", info->intr_core_state.irq_vector);
 332 #endif
 333
 334         info->intr_core_state.irq_started = 1;
 335         info->intr_core_state.irq_pending = 0;
 336
 337         v3_injecting_intr(info, info->intr_core_state.irq_vector, V3_EXTERNAL_IRQ);
 338     }
 339
 340     if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 0)) {
 341 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 342         PrintDebug("Interrupt %d taken by guest\n", info->intr_core_state.irq_vector);
 343 #endif
 344
 345         // Interrupt was taken fully vectored
 346         info->intr_core_state.irq_started = 0;
 347
 348     } else if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 1)) {
 349 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 350         PrintDebug("EXIT INT INFO is set (vec=%d)\n", guest_ctrl->exit_int_info.vector);
 351 #endif
 352     }
 353
 354     return 0;
 355 }
 356
 357
 358 static int update_irq_entry_state(struct guest_info * info) {
 359     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 360
 361
 362     if (info->intr_core_state.irq_pending == 0) {
 363         guest_ctrl->guest_ctrl.V_IRQ = 0;
 364         guest_ctrl->guest_ctrl.V_INTR_VECTOR = 0;
 365     }
 366
 367     if (v3_excp_pending(info)) {
 368         uint_t excp = v3_get_excp_number(info);
 369
 370         guest_ctrl->EVENTINJ.type = SVM_INJECTION_EXCEPTION;
 371
 372         if (info->excp_state.excp_error_code_valid) {
 373             guest_ctrl->EVENTINJ.error_code = info->excp_state.excp_error_code;
 374             guest_ctrl->EVENTINJ.ev = 1;
 375 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 376             PrintDebug("Injecting exception %d with error code %x\n", excp, guest_ctrl->EVENTINJ.error_code);
 377 #endif
 378         }
 379
 380         guest_ctrl->EVENTINJ.vector = excp;
 381
 382         guest_ctrl->EVENTINJ.valid = 1;
 383
 384 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 385         PrintDebug("<%d> Injecting Exception %d (CR2=%p) (EIP=%p)\n",
 386                    (int)info->num_exits,
 387                    guest_ctrl->EVENTINJ.vector,
 388                    (void *)(addr_t)info->ctrl_regs.cr2,
 389                    (void *)(addr_t)info->rip);
 390 #endif
 391
 392         v3_injecting_excp(info, excp);
 393     } else if (info->intr_core_state.irq_started == 1) {
 394 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 395         PrintDebug("IRQ pending from previous injection\n");
 396 #endif
 397         guest_ctrl->guest_ctrl.V_IRQ = 1;
 398         guest_ctrl->guest_ctrl.V_INTR_VECTOR = info->intr_core_state.irq_vector;
 399         guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 400         guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 401
 402     } else {
 403         switch (v3_intr_pending(info)) {
 404             case V3_EXTERNAL_IRQ: {
 405                 uint32_t irq = v3_get_intr(info);
 406
 407                 guest_ctrl->guest_ctrl.V_IRQ = 1;
 408                 guest_ctrl->guest_ctrl.V_INTR_VECTOR = irq;
 409                 guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 410                 guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 411
 412 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 413                 PrintDebug("Injecting Interrupt %d (EIP=%p)\n",
 414                            guest_ctrl->guest_ctrl.V_INTR_VECTOR,
 415                            (void *)(addr_t)info->rip);
 416 #endif
 417
 418                 info->intr_core_state.irq_pending = 1;
 419                 info->intr_core_state.irq_vector = irq;
 420
 421                 break;
 422             }
 423             case V3_NMI:
 424                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_NMI;
 425                 break;
 426             case V3_SOFTWARE_INTR:
 427                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_SOFT_INTR;
 428                 break;
 429             case V3_VIRTUAL_IRQ:
 430                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_IRQ;
 431                 break;
 432
 433             case V3_INVALID_INTR:
 434             default:
 435                 break;
 436         }
 437
 438     }
 439
 440     return 0;
 441 }
 442
 443
 444 /*
 445  * CAUTION and DANGER!!!
 446  *
 447  * The VMCB CANNOT(!!) be accessed outside of the clgi/stgi calls inside this function
 448  * When exectuing a symbiotic call, the VMCB WILL be overwritten, so any dependencies
 449  * on its contents will cause things to break. The contents at the time of the exit WILL
 450  * change before the exit handler is executed.
 451  */
 452 int v3_svm_enter(struct guest_info * info) {
 453     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 454     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 455     addr_t exit_code = 0, exit_info1 = 0, exit_info2 = 0;
 456
 457     // Conditionally yield the CPU if the timeslice has expired
 458     v3_yield_cond(info);
 459
 460     // Perform any additional yielding needed for time adjustment
 461     v3_adjust_time(info);
 462
 463     // disable global interrupts for vm state transition
 464     v3_clgi();
 465
 466     // Update timer devices prior to entering VM.
 467     v3_update_timers(info);
 468
 469     // Synchronize the guest state to the VMCB
 470     guest_state->cr0 = info->ctrl_regs.cr0;
 471     guest_state->cr2 = info->ctrl_regs.cr2;
 472     guest_state->cr3 = info->ctrl_regs.cr3;
 473     guest_state->cr4 = info->ctrl_regs.cr4;
 474     guest_state->dr6 = info->dbg_regs.dr6;
 475     guest_state->dr7 = info->dbg_regs.dr7;
 476     guest_ctrl->guest_ctrl.V_TPR = info->ctrl_regs.cr8 & 0xff;
 477     guest_state->rflags = info->ctrl_regs.rflags;
 478     guest_state->efer = info->ctrl_regs.efer;
 479
 480     guest_state->cpl = info->cpl;
 481
 482     v3_set_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 483
 484     guest_state->rax = info->vm_regs.rax;
 485     guest_state->rip = info->rip;
 486     guest_state->rsp = info->vm_regs.rsp;
 487
 488 #ifdef V3_CONFIG_SYMCALL
 489     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 490         update_irq_entry_state(info);
 491     }
 492 #else
 493     update_irq_entry_state(info);
 494 #endif
 495
 496
 497     /* ** */
 498
 499     /*
 500       PrintDebug("SVM Entry to CS=%p  rip=%p...\n",
 501       (void *)(addr_t)info->segments.cs.base,
 502       (void *)(addr_t)info->rip);
 503     */
 504
 505 #ifdef V3_CONFIG_SYMCALL
 506     if (info->sym_core_state.symcall_state.sym_call_active == 1) {
 507         if (guest_ctrl->guest_ctrl.V_IRQ == 1) {
 508             V3_Print("!!! Injecting Interrupt during Sym call !!!\n");
 509         }
 510     }
 511 #endif
 512
 513     v3_time_enter_vm(info);
 514     guest_ctrl->TSC_OFFSET = v3_tsc_host_offset(&info->time_state);
 515
 516     //V3_Print("Calling v3_svm_launch\n");
 517
 518     v3_svm_launch((vmcb_t *)V3_PAddr(info->vmm_data), &(info->vm_regs), (vmcb_t *)host_vmcbs[V3_Get_CPU()]);
 519
 520     //V3_Print("SVM Returned: Exit Code: %x, guest_rip=%lx\n", (uint32_t)(guest_ctrl->exit_code), (unsigned long)guest_state->rip);
 521
 522     v3_last_exit = (uint32_t)(guest_ctrl->exit_code);
 523
 524     // Immediate exit from VM time bookkeeping
 525     v3_time_exit_vm(info);
 526
 527     info->num_exits++;
 528
 529     // Save Guest state from VMCB
 530     info->rip = guest_state->rip;
 531     info->vm_regs.rsp = guest_state->rsp;
 532     info->vm_regs.rax = guest_state->rax;
 533
 534     info->cpl = guest_state->cpl;
 535
 536     info->ctrl_regs.cr0 = guest_state->cr0;
 537     info->ctrl_regs.cr2 = guest_state->cr2;
 538     info->ctrl_regs.cr3 = guest_state->cr3;
 539     info->ctrl_regs.cr4 = guest_state->cr4;
 540     info->dbg_regs.dr6 = guest_state->dr6;
 541     info->dbg_regs.dr7 = guest_state->dr7;
 542     info->ctrl_regs.cr8 = guest_ctrl->guest_ctrl.V_TPR;
 543     info->ctrl_regs.rflags = guest_state->rflags;
 544     info->ctrl_regs.efer = guest_state->efer;
 545
 546     v3_get_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 547     info->cpu_mode = v3_get_vm_cpu_mode(info);
 548     info->mem_mode = v3_get_vm_mem_mode(info);
 549     /* ** */
 550
 551
 552     // save exit info here
 553     exit_code = guest_ctrl->exit_code;
 554     exit_info1 = guest_ctrl->exit_info1;
 555     exit_info2 = guest_ctrl->exit_info2;
 556
 557
 558 #ifdef V3_CONFIG_SYMCALL
 559     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 560         update_irq_exit_state(info);
 561     }
 562 #else
 563     update_irq_exit_state(info);
 564 #endif
 565
 566
 567     // reenable global interrupts after vm exit
 568     v3_stgi();
 569
 570
 571     // Conditionally yield the CPU if the timeslice has expired
 572     v3_yield_cond(info);
 573
 574
 575
 576     if (v3_handle_svm_exit(info, exit_code, exit_info1, exit_info2) != 0) {
 577         PrintError("Error in SVM exit handler\n");
 578         PrintError("  last exit was %d\n", v3_last_exit);
 579         return -1;
 580     }
 581
 582
 583     return 0;
 584 }
 585
 586
 587 int v3_start_svm_guest(struct guest_info * info) {
 588     //    vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 589     //  vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 590
 591     PrintDebug("Starting SVM core %u (on logical core %u)\n", info->vcpu_id, info->pcpu_id);
 592
 593     if (info->vcpu_id == 0) {
 594         info->core_run_state = CORE_RUNNING;
 595         info->vm_info->run_state = VM_RUNNING;
 596     } else  {
 597         PrintDebug("SVM core %u (on %u): Waiting for core initialization\n", info->vcpu_id, info->pcpu_id);
 598
 599         while (info->core_run_state == CORE_STOPPED) {
 600             v3_yield(info);
 601             //PrintDebug("SVM core %u: still waiting for INIT\n", info->vcpu_id);
 602         }
 603
 604         PrintDebug("SVM core %u(on %u) initialized\n", info->vcpu_id, info->pcpu_id);
 605     }
 606
 607     PrintDebug("SVM core %u(on %u): I am starting at CS=0x%x (base=0x%p, limit=0x%x),  RIP=0x%p\n",
 608                info->vcpu_id, info->pcpu_id,
 609                info->segments.cs.selector, (void *)(info->segments.cs.base),
 610                info->segments.cs.limit, (void *)(info->rip));
 611
 612
 613
 614     PrintDebug("SVM core %u: Launching SVM VM (vmcb=%p) (on cpu %u)\n",
 615                info->vcpu_id, (void *)info->vmm_data, info->pcpu_id);
 616     //PrintDebugVMCB((vmcb_t*)(info->vmm_data));
 617
 618     v3_start_time(info);
 619
 620     while (1) {
 621
 622         if (info->vm_info->run_state == VM_STOPPED) {
 623             info->core_run_state = CORE_STOPPED;
 624             break;
 625         }
 626
 627         if (v3_svm_enter(info) == -1) {
 628             vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 629             addr_t host_addr;
 630             addr_t linear_addr = 0;
 631
 632             info->vm_info->run_state = VM_ERROR;
 633
 634             V3_Print("SVM core %u: SVM ERROR!!\n", info->vcpu_id);
 635
 636             v3_print_guest_state(info);
 637
 638             V3_Print("SVM core %u: SVM Exit Code: %p\n", info->vcpu_id, (void *)(addr_t)guest_ctrl->exit_code);
 639
 640             V3_Print("SVM core %u: exit_info1 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info1));
 641             V3_Print("SVM core %u: exit_info1 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info1)) + 4));
 642
 643             V3_Print("SVM core %u: exit_info2 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info2));
 644             V3_Print("SVM core %u: exit_info2 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info2)) + 4));
 645
 646             linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
 647
 648             if (info->mem_mode == PHYSICAL_MEM) {
 649                 v3_gpa_to_hva(info, linear_addr, &host_addr);
 650             } else if (info->mem_mode == VIRTUAL_MEM) {
 651                 v3_gva_to_hva(info, linear_addr, &host_addr);
 652             }
 653
 654             V3_Print("SVM core %u: Host Address of rip = 0x%p\n", info->vcpu_id, (void *)host_addr);
 655
 656             V3_Print("SVM core %u: Instr (15 bytes) at %p:\n", info->vcpu_id, (void *)host_addr);
 657             v3_dump_mem((uint8_t *)host_addr, 15);
 658
 659             v3_print_stack(info);
 660
 661             break;
 662         }
 663
 664
 665         if (info->vm_info->run_state == VM_STOPPED) {
 666             info->core_run_state = CORE_STOPPED;
 667             break;
 668         }
 669
 670
 671
 672 /*
 673         if ((info->num_exits % 50000) == 0) {
 674             V3_Print("SVM Exit number %d\n", (uint32_t)info->num_exits);
 675             v3_print_guest_state(info);
 676         }
 677 */
 678
 679     }
 680
 681     // Need to take down the other cores on error...
 682
 683     return 0;
 684 }
 685
 686
 687
 688
 689 int v3_reset_svm_vm_core(struct guest_info * core, addr_t rip) {
 690     // init vmcb_bios
 691
 692     // Write the RIP, CS, and descriptor
 693     // assume the rest is already good to go
 694     //
 695     // vector VV -> rip at 0
 696     //              CS = VV00
 697     //  This means we start executing at linear address VV000
 698     //
 699     // So the selector needs to be VV00
 700     // and the base needs to be VV000
 701     //
 702     core->rip = 0;
 703     core->segments.cs.selector = rip << 8;
 704     core->segments.cs.limit = 0xffff;
 705     core->segments.cs.base = rip << 12;
 706
 707     return 0;
 708 }
 709
 710
 711
 712
 713
 714
 715 /* Checks machine SVM capability */
 716 /* Implemented from: AMD Arch Manual 3, sect 15.4 */
 717 int v3_is_svm_capable() {
 718     uint_t vm_cr_low = 0, vm_cr_high = 0;
 719     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 720
 721     v3_cpuid(CPUID_EXT_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 722
 723     PrintDebug("CPUID_EXT_FEATURE_IDS_ecx=0x%x\n", ecx);
 724
 725     if ((ecx & CPUID_EXT_FEATURE_IDS_ecx_svm_avail) == 0) {
 726       V3_Print("SVM Not Available\n");
 727       return 0;
 728     }  else {
 729         v3_get_msr(SVM_VM_CR_MSR, &vm_cr_high, &vm_cr_low);
 730
 731         PrintDebug("SVM_VM_CR_MSR = 0x%x 0x%x\n", vm_cr_high, vm_cr_low);
 732
 733         if ((vm_cr_low & SVM_VM_CR_MSR_svmdis) == 1) {
 734             V3_Print("SVM is available but is disabled.\n");
 735
 736             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 737
 738             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 739
 740             if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_svml) == 0) {
 741                 V3_Print("SVM BIOS Disabled, not unlockable\n");
 742             } else {
 743                 V3_Print("SVM is locked with a key\n");
 744             }
 745             return 0;
 746
 747         } else {
 748             V3_Print("SVM is available and  enabled.\n");
 749
 750             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 751             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_eax=0x%x\n", eax);
 752             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ebx=0x%x\n", ebx);
 753             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ecx=0x%x\n", ecx);
 754             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 755
 756             return 1;
 757         }
 758     }
 759 }
 760
 761 static int has_svm_nested_paging() {
 762     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 763
 764     v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 765
 766     //PrintDebug("CPUID_EXT_FEATURE_IDS_edx=0x%x\n", edx);
 767
 768     if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_np) == 0) {
 769         V3_Print("SVM Nested Paging not supported\n");
 770         return 0;
 771     } else {
 772         V3_Print("SVM Nested Paging supported\n");
 773         return 1;
 774     }
 775 }
 776
 777
 778
 779 void v3_init_svm_cpu(int cpu_id) {
 780     reg_ex_t msr;
 781     extern v3_cpu_arch_t v3_cpu_types[];
 782
 783     // Enable SVM on the CPU
 784     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 785     msr.e_reg.low |= EFER_MSR_svm_enable;
 786     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 787
 788     V3_Print("SVM Enabled\n");
 789
 790     // Setup the host state save area
 791     host_vmcbs[cpu_id] = (addr_t)V3_AllocPages(4);
 792
 793     /* 64-BIT-ISSUE */
 794     //  msr.e_reg.high = 0;
 795     //msr.e_reg.low = (uint_t)host_vmcb;
 796     msr.r_reg = host_vmcbs[cpu_id];
 797
 798     PrintDebug("Host State being saved at %p\n", (void *)host_vmcbs[cpu_id]);
 799     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 800
 801
 802     if (has_svm_nested_paging() == 1) {
 803         v3_cpu_types[cpu_id] = V3_SVM_REV3_CPU;
 804     } else {
 805         v3_cpu_types[cpu_id] = V3_SVM_CPU;
 806     }
 807 }
 808
 809
 810
 811 void v3_deinit_svm_cpu(int cpu_id) {
 812     reg_ex_t msr;
 813     extern v3_cpu_arch_t v3_cpu_types[];
 814
 815     // reset SVM_VM_HSAVE_PA_MSR
 816     // Does setting it to NULL disable??
 817     msr.r_reg = 0;
 818     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 819
 820     // Disable SVM?
 821     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 822     msr.e_reg.low &= ~EFER_MSR_svm_enable;
 823     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 824
 825     v3_cpu_types[cpu_id] = V3_INVALID_CPU;
 826
 827     V3_FreePages((void *)host_vmcbs[cpu_id], 4);
 828
 829     V3_Print("Host CPU %d host area freed, and SVM disabled\n", cpu_id);
 830     return;
 831 }
 832
 833
 834
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853
 854
 855
 856
 857
 858
 859
 860
 861
 862
 863
 864
 865
 866
 867
 868
 869
 870
 871
 872
 873
 874
 875
 876
 877
 878
 879
 880
 881
 882 #if 0
 883 /*
 884  * Test VMSAVE/VMLOAD Latency
 885  */
 886 #define vmsave ".byte 0x0F,0x01,0xDB ; "
 887 #define vmload ".byte 0x0F,0x01,0xDA ; "
 888 {
 889     uint32_t start_lo, start_hi;
 890     uint32_t end_lo, end_hi;
 891     uint64_t start, end;
 892
 893     __asm__ __volatile__ (
 894                           "rdtsc ; "
 895                           "movl %%eax, %%esi ; "
 896                           "movl %%edx, %%edi ; "
 897                           "movq  %%rcx, %%rax ; "
 898                           vmsave
 899                           "rdtsc ; "
 900                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 901                           : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 902                           );
 903
 904     start = start_hi;
 905     start <<= 32;
 906     start += start_lo;
 907
 908     end = end_hi;
 909     end <<= 32;
 910     end += end_lo;
 911
 912     PrintDebug("VMSave Cycle Latency: %d\n", (uint32_t)(end - start));
 913
 914     __asm__ __volatile__ (
 915                           "rdtsc ; "
 916                           "movl %%eax, %%esi ; "
 917                           "movl %%edx, %%edi ; "
 918                           "movq  %%rcx, %%rax ; "
 919                           vmload
 920                           "rdtsc ; "
 921                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 922                               : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 923                               );
 924
 925         start = start_hi;
 926         start <<= 32;
 927         start += start_lo;
 928
 929         end = end_hi;
 930         end <<= 32;
 931         end += end_lo;
 932
 933
 934         PrintDebug("VMLoad Cycle Latency: %d\n", (uint32_t)(end - start));
 935     }
 936     /* End Latency Test */
 937
 938 #endif
 939
 940
 941
 942
 943
 944
 945
 946 #if 0
 947 void Init_VMCB_pe(vmcb_t *vmcb, struct guest_info vm_info) {
 948   vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
 949   vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
 950   uint_t i = 0;
 951
 952
 953   guest_state->rsp = vm_info.vm_regs.rsp;
 954   guest_state->rip = vm_info.rip;
 955
 956
 957   /* I pretty much just gutted this from TVMM */
 958   /* Note: That means its probably wrong */
 959
 960   // set the segment registers to mirror ours
 961   guest_state->cs.selector = 1<<3;
 962   guest_state->cs.attrib.fields.type = 0xa; // Code segment+read
 963   guest_state->cs.attrib.fields.S = 1;
 964   guest_state->cs.attrib.fields.P = 1;
 965   guest_state->cs.attrib.fields.db = 1;
 966   guest_state->cs.attrib.fields.G = 1;
 967   guest_state->cs.limit = 0xfffff;
 968   guest_state->cs.base = 0;
 969
 970   struct vmcb_selector *segregs [] = {&(guest_state->ss), &(guest_state->ds), &(guest_state->es), &(guest_state->fs), &(guest_state->gs), NULL};
 971   for ( i = 0; segregs[i] != NULL; i++) {
 972     struct vmcb_selector * seg = segregs[i];
 973
 974     seg->selector = 2<<3;
 975     seg->attrib.fields.type = 0x2; // Data Segment+read/write
 976     seg->attrib.fields.S = 1;
 977     seg->attrib.fields.P = 1;
 978     seg->attrib.fields.db = 1;
 979     seg->attrib.fields.G = 1;
 980     seg->limit = 0xfffff;
 981     seg->base = 0;
 982   }
 983
 984
 985   {
 986     /* JRL THIS HAS TO GO */
 987
 988     //    guest_state->tr.selector = GetTR_Selector();
 989     guest_state->tr.attrib.fields.type = 0x9;
 990     guest_state->tr.attrib.fields.P = 1;
 991     // guest_state->tr.limit = GetTR_Limit();
 992     //guest_state->tr.base = GetTR_Base();// - 0x2000;
 993     /* ** */
 994   }
 995
 996
 997   /* ** */
 998
 999
1000   guest_state->efer |= EFER_MSR_svm_enable;
1001   guest_state->rflags = 0x00000002; // The reserved bit is always 1
1002   ctrl_area->svm_instrs.VMRUN = 1;
1003   guest_state->cr0 = 0x00000001;    // PE
1004   ctrl_area->guest_ASID = 1;
1005
1006
1007   //  guest_state->cpl = 0;
1008
1009
1010
1011   // Setup exits
1012
1013   ctrl_area->cr_writes.cr4 = 1;
1014
1015   ctrl_area->exceptions.de = 1;
1016   ctrl_area->exceptions.df = 1;
1017   ctrl_area->exceptions.pf = 1;
1018   ctrl_area->exceptions.ts = 1;
1019   ctrl_area->exceptions.ss = 1;
1020   ctrl_area->exceptions.ac = 1;
1021   ctrl_area->exceptions.mc = 1;
1022   ctrl_area->exceptions.gp = 1;
1023   ctrl_area->exceptions.ud = 1;
1024   ctrl_area->exceptions.np = 1;
1025   ctrl_area->exceptions.of = 1;
1026   ctrl_area->exceptions.nmi = 1;
1027
1028
1029
1030   ctrl_area->instrs.IOIO_PROT = 1;
1031   ctrl_area->IOPM_BASE_PA = (uint_t)V3_AllocPages(3);
1032
1033   {
1034     reg_ex_t tmp_reg;
1035     tmp_reg.r_reg = ctrl_area->IOPM_BASE_PA;
1036     memset((void*)(tmp_reg.e_reg.low), 0xffffffff, PAGE_SIZE * 2);
1037   }
1038
1039   ctrl_area->instrs.INTR = 1;
1040
1041
1042   {
1043     char gdt_buf[6];
1044     char idt_buf[6];
1045
1046     memset(gdt_buf, 0, 6);
1047     memset(idt_buf, 0, 6);
1048
1049
1050     uint_t gdt_base, idt_base;
1051     ushort_t gdt_limit, idt_limit;
1052
1053     GetGDTR(gdt_buf);
1054     gdt_base = *(ulong_t*)((uchar_t*)gdt_buf + 2) & 0xffffffff;
1055     gdt_limit = *(ushort_t*)(gdt_buf) & 0xffff;
1056     PrintDebug("GDT: base: %x, limit: %x\n", gdt_base, gdt_limit);
1057
1058     GetIDTR(idt_buf);
1059     idt_base = *(ulong_t*)(idt_buf + 2) & 0xffffffff;
1060     idt_limit = *(ushort_t*)(idt_buf) & 0xffff;
1061     PrintDebug("IDT: base: %x, limit: %x\n",idt_base, idt_limit);
1062
1063
1064     // gdt_base -= 0x2000;
1065     //idt_base -= 0x2000;
1066
1067     guest_state->gdtr.base = gdt_base;
1068     guest_state->gdtr.limit = gdt_limit;
1069     guest_state->idtr.base = idt_base;
1070     guest_state->idtr.limit = idt_limit;
1071
1072
1073   }
1074
1075
1076   // also determine if CPU supports nested paging
1077   /*
1078   if (vm_info.page_tables) {
1079     //   if (0) {
1080     // Flush the TLB on entries/exits
1081     ctrl_area->TLB_CONTROL = 1;
1082
1083     // Enable Nested Paging
1084     ctrl_area->NP_ENABLE = 1;
1085
1086     PrintDebug("NP_Enable at 0x%x\n", &(ctrl_area->NP_ENABLE));
1087
1088         // Set the Nested Page Table pointer
1089     ctrl_area->N_CR3 |= ((addr_t)vm_info.page_tables & 0xfffff000);
1090
1091
1092     //   ctrl_area->N_CR3 = Get_CR3();
1093     // guest_state->cr3 |= (Get_CR3() & 0xfffff000);
1094
1095     guest_state->g_pat = 0x7040600070406ULL;
1096
1097     PrintDebug("Set Nested CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(ctrl_area->N_CR3)), (uint_t)*((unsigned char *)&(ctrl_area->N_CR3) + 4));
1098     PrintDebug("Set Guest CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(guest_state->cr3)), (uint_t)*((unsigned char *)&(guest_state->cr3) + 4));
1099     // Enable Paging
1100     //    guest_state->cr0 |= 0x80000000;
1101   }
1102   */
1103
1104 }
1105
1106
1107
1108
1109
1110 #endif
1111
1112