palacios/src/palacios/svm.c

   1 /*
   2  * This file is part of the Palacios Virtual Machine Monitor developed
   3  * by the V3VEE Project with funding from the United States National
   4  * Science Foundation and the Department of Energy.
   5  *
   6  * The V3VEE Project is a joint project between Northwestern University
   7  * and the University of New Mexico.  You can find out more at
   8  * http://www.v3vee.org
   9  *
  10  * Copyright (c) 2008, Jack Lange <jarusl@cs.northwestern.edu>
  11  * Copyright (c) 2008, The V3VEE Project <http://www.v3vee.org>
  12  * All rights reserved.
  13  *
  14  * Author: Jack Lange <jarusl@cs.northwestern.edu>
  15  *
  16  * This is free software.  You are permitted to use,
  17  * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
  18  */
  19
  20
  21
  22 #include <palacios/svm.h>
  23 #include <palacios/vmm.h>
  24
  25 #include <palacios/vmcb.h>
  26 #include <palacios/vmm_mem.h>
  27 #include <palacios/vmm_paging.h>
  28 #include <palacios/svm_handler.h>
  29
  30 #include <palacios/vmm_debug.h>
  31 #include <palacios/vm_guest_mem.h>
  32
  33 #include <palacios/vmm_decoder.h>
  34 #include <palacios/vmm_string.h>
  35 #include <palacios/vmm_lowlevel.h>
  36 #include <palacios/svm_msr.h>
  37
  38 #include <palacios/vmm_rbtree.h>
  39 #include <palacios/vmm_barrier.h>
  40 #include <palacios/vmm_debug.h>
  41
  42
  43
  44 #ifdef V3_CONFIG_CHECKPOINT
  45 #include <palacios/vmm_checkpoint.h>
  46 #endif
  47
  48 #include <palacios/vmm_direct_paging.h>
  49
  50 #include <palacios/vmm_ctrl_regs.h>
  51 #include <palacios/svm_io.h>
  52
  53 #include <palacios/vmm_sprintf.h>
  54
  55
  56 #ifndef V3_CONFIG_DEBUG_SVM
  57 #undef PrintDebug
  58 #define PrintDebug(fmt, args...)
  59 #endif
  60
  61
  62 uint32_t v3_last_exit;
  63
  64 // This is a global pointer to the host's VMCB
  65 static addr_t host_vmcbs[V3_CONFIG_MAX_CPUS] = { [0 ... V3_CONFIG_MAX_CPUS - 1] = 0};
  66
  67
  68
  69 extern void v3_stgi();
  70 extern void v3_clgi();
  71 //extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, uint64_t * fs, uint64_t * gs);
  72 extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, vmcb_t * host_vmcb);
  73
  74
  75 static vmcb_t * Allocate_VMCB() {
  76     vmcb_t * vmcb_page = NULL;
  77     addr_t vmcb_pa = (addr_t)V3_AllocPages(1);
  78
  79     if ((void *)vmcb_pa == NULL) {
  80       PrintError(VM_NONE, VCORE_NONE, "Error allocating VMCB\n");
  81         return NULL;
  82     }
  83
  84     vmcb_page = (vmcb_t *)V3_VAddr((void *)vmcb_pa);
  85
  86     memset(vmcb_page, 0, 4096);
  87
  88     return vmcb_page;
  89 }
  90
  91
  92 static int v3_svm_handle_efer_write(struct guest_info * core, uint_t msr, struct v3_msr src, void * priv_data)
  93 {
  94     int status;
  95
  96     // Call arch-independent handler
  97     if ((status = v3_handle_efer_write(core, msr, src, priv_data)) != 0) {
  98         return status;
  99     }
 100
 101     // SVM-specific code
 102     {
 103         // Ensure that hardware visible EFER.SVME bit is set (SVM Enable)
 104         struct efer_64 * hw_efer = (struct efer_64 *)&(core->ctrl_regs.efer);
 105         hw_efer->svme = 1;
 106     }
 107
 108     return 0;
 109 }
 110
 111
 112 static void Init_VMCB_BIOS(vmcb_t * vmcb, struct guest_info * core) {
 113     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
 114     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
 115     uint_t i;
 116
 117
 118     //
 119     ctrl_area->svm_instrs.VMRUN = 1;
 120     ctrl_area->svm_instrs.VMMCALL = 1;
 121     ctrl_area->svm_instrs.VMLOAD = 1;
 122     ctrl_area->svm_instrs.VMSAVE = 1;
 123     ctrl_area->svm_instrs.STGI = 1;
 124     ctrl_area->svm_instrs.CLGI = 1;
 125     ctrl_area->svm_instrs.SKINIT = 1;
 126     ctrl_area->svm_instrs.ICEBP = 1;
 127     ctrl_area->svm_instrs.WBINVD = 1;
 128     ctrl_area->svm_instrs.MONITOR = 1;
 129     ctrl_area->svm_instrs.MWAIT_always = 1;
 130     ctrl_area->svm_instrs.MWAIT_if_armed = 1;
 131     ctrl_area->instrs.INVLPGA = 1;
 132     ctrl_area->instrs.CPUID = 1;
 133
 134     ctrl_area->instrs.HLT = 1;
 135
 136     /* Set at VMM launch as needed */
 137     ctrl_area->instrs.RDTSC = 0;
 138     ctrl_area->svm_instrs.RDTSCP = 0;
 139
 140     // guest_state->cr0 = 0x00000001;    // PE
 141
 142     /*
 143       ctrl_area->exceptions.de = 1;
 144       ctrl_area->exceptions.df = 1;
 145
 146       ctrl_area->exceptions.ts = 1;
 147       ctrl_area->exceptions.ss = 1;
 148       ctrl_area->exceptions.ac = 1;
 149       ctrl_area->exceptions.mc = 1;
 150       ctrl_area->exceptions.gp = 1;
 151       ctrl_area->exceptions.ud = 1;
 152       ctrl_area->exceptions.np = 1;
 153       ctrl_area->exceptions.of = 1;
 154
 155       ctrl_area->exceptions.nmi = 1;
 156     */
 157
 158
 159     ctrl_area->instrs.NMI = 1;
 160     ctrl_area->instrs.SMI = 0; // allow SMIs to run in guest
 161     ctrl_area->instrs.INIT = 1;
 162     //    ctrl_area->instrs.PAUSE = 1;
 163     ctrl_area->instrs.shutdown_evts = 1;
 164
 165
 166     /* DEBUG FOR RETURN CODE */
 167     ctrl_area->exit_code = 1;
 168
 169
 170     /* Setup Guest Machine state */
 171
 172     core->vm_regs.rsp = 0x00;
 173     core->rip = 0xfff0;
 174
 175     core->vm_regs.rdx = 0x00000f00;
 176
 177
 178     core->cpl = 0;
 179
 180     core->ctrl_regs.rflags = 0x00000002; // The reserved bit is always 1
 181     core->ctrl_regs.cr0 = 0x60010010; // Set the WP flag so the memory hooks work in real-mode
 182     core->ctrl_regs.efer |= EFER_MSR_svm_enable;
 183
 184
 185
 186
 187
 188     core->segments.cs.selector = 0xf000;
 189     core->segments.cs.limit = 0xffff;
 190     core->segments.cs.base = 0x0000000f0000LL;
 191
 192     // (raw attributes = 0xf3)
 193     core->segments.cs.type = 0x3;
 194     core->segments.cs.system = 0x1;
 195     core->segments.cs.dpl = 0x3;
 196     core->segments.cs.present = 1;
 197
 198
 199
 200     struct v3_segment * segregs [] = {&(core->segments.ss), &(core->segments.ds),
 201                                       &(core->segments.es), &(core->segments.fs),
 202                                       &(core->segments.gs), NULL};
 203
 204     for ( i = 0; segregs[i] != NULL; i++) {
 205         struct v3_segment * seg = segregs[i];
 206
 207         seg->selector = 0x0000;
 208         //    seg->base = seg->selector << 4;
 209         seg->base = 0x00000000;
 210         seg->limit = ~0u;
 211
 212         // (raw attributes = 0xf3)
 213         seg->type = 0x3;
 214         seg->system = 0x1;
 215         seg->dpl = 0x3;
 216         seg->present = 1;
 217     }
 218
 219     core->segments.gdtr.limit = 0x0000ffff;
 220     core->segments.gdtr.base = 0x0000000000000000LL;
 221     core->segments.idtr.limit = 0x0000ffff;
 222     core->segments.idtr.base = 0x0000000000000000LL;
 223
 224     core->segments.ldtr.selector = 0x0000;
 225     core->segments.ldtr.limit = 0x0000ffff;
 226     core->segments.ldtr.base = 0x0000000000000000LL;
 227     core->segments.tr.selector = 0x0000;
 228     core->segments.tr.limit = 0x0000ffff;
 229     core->segments.tr.base = 0x0000000000000000LL;
 230
 231
 232     core->dbg_regs.dr6 = 0x00000000ffff0ff0LL;
 233     core->dbg_regs.dr7 = 0x0000000000000400LL;
 234
 235
 236     ctrl_area->IOPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->io_map.arch_data);
 237     ctrl_area->instrs.IOIO_PROT = 1;
 238
 239     ctrl_area->MSRPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->msr_map.arch_data);
 240     ctrl_area->instrs.MSR_PROT = 1;
 241
 242
 243     PrintDebug(core->vm_info, core, "Exiting on interrupts\n");
 244     ctrl_area->guest_ctrl.V_INTR_MASKING = 1;
 245     ctrl_area->instrs.INTR = 1;
 246     // The above also assures the TPR changes (CR8) are only virtual
 247
 248
 249     // However, we need to see TPR writes since they will
 250     // affect the virtual apic
 251     // we reflect out cr8 to ctrl_regs->apic_tpr
 252     ctrl_area->cr_reads.cr8 = 1;
 253     ctrl_area->cr_writes.cr8 = 1;
 254     // We will do all TPR comparisons in the virtual apic
 255     // We also do not want the V_TPR to be able to mask the PIC
 256     ctrl_area->guest_ctrl.V_IGN_TPR = 1;
 257
 258
 259
 260     v3_hook_msr(core->vm_info, EFER_MSR,
 261                 &v3_handle_efer_read,
 262                 &v3_svm_handle_efer_write,
 263                 core);
 264
 265     if (core->shdw_pg_mode == SHADOW_PAGING) {
 266         PrintDebug(core->vm_info, core, "Creating initial shadow page table\n");
 267
 268         /* JRL: This is a performance killer, and a simplistic solution */
 269         /* We need to fix this */
 270         ctrl_area->TLB_CONTROL = 1;
 271         ctrl_area->guest_ASID = 1;
 272
 273
 274         if (v3_init_passthrough_pts(core) == -1) {
 275             PrintError(core->vm_info, core, "Could not initialize passthrough page tables\n");
 276             return ;
 277         }
 278
 279
 280         core->shdw_pg_state.guest_cr0 = 0x0000000000000010LL;
 281         PrintDebug(core->vm_info, core, "Created\n");
 282
 283         core->ctrl_regs.cr0 |= 0x80000000;
 284         core->ctrl_regs.cr3 = core->direct_map_pt;
 285
 286         ctrl_area->cr_reads.cr0 = 1;
 287         ctrl_area->cr_writes.cr0 = 1;
 288         //ctrl_area->cr_reads.cr4 = 1;
 289         ctrl_area->cr_writes.cr4 = 1;
 290         ctrl_area->cr_reads.cr3 = 1;
 291         ctrl_area->cr_writes.cr3 = 1;
 292
 293
 294         ctrl_area->instrs.INVLPG = 1;
 295
 296         ctrl_area->exceptions.pf = 1;
 297
 298         guest_state->g_pat = 0x7040600070406ULL;
 299
 300
 301     } else if (core->shdw_pg_mode == NESTED_PAGING) {
 302         // Flush the TLB on entries/exits
 303         ctrl_area->TLB_CONTROL = 1;
 304         ctrl_area->guest_ASID = 1;
 305
 306         // Enable Nested Paging
 307         ctrl_area->NP_ENABLE = 1;
 308
 309         PrintDebug(core->vm_info, core, "NP_Enable at 0x%p\n", (void *)&(ctrl_area->NP_ENABLE));
 310
 311         // Set the Nested Page Table pointer
 312         if (v3_init_passthrough_pts(core) == -1) {
 313             PrintError(core->vm_info, core, "Could not initialize Nested page tables\n");
 314             return ;
 315         }
 316
 317         ctrl_area->N_CR3 = core->direct_map_pt;
 318
 319         guest_state->g_pat = 0x7040600070406ULL;
 320     }
 321
 322     /* tell the guest that we don't support SVM */
 323     v3_hook_msr(core->vm_info, SVM_VM_CR_MSR,
 324         &v3_handle_vm_cr_read,
 325         &v3_handle_vm_cr_write,
 326         core);
 327
 328
 329     {
 330 #define INT_PENDING_AMD_MSR             0xc0010055
 331
 332         v3_hook_msr(core->vm_info, IA32_STAR_MSR, NULL, NULL, NULL);
 333         v3_hook_msr(core->vm_info, IA32_LSTAR_MSR, NULL, NULL, NULL);
 334         v3_hook_msr(core->vm_info, IA32_FMASK_MSR, NULL, NULL, NULL);
 335         v3_hook_msr(core->vm_info, IA32_KERN_GS_BASE_MSR, NULL, NULL, NULL);
 336         v3_hook_msr(core->vm_info, IA32_CSTAR_MSR, NULL, NULL, NULL);
 337
 338         v3_hook_msr(core->vm_info, SYSENTER_CS_MSR, NULL, NULL, NULL);
 339         v3_hook_msr(core->vm_info, SYSENTER_ESP_MSR, NULL, NULL, NULL);
 340         v3_hook_msr(core->vm_info, SYSENTER_EIP_MSR, NULL, NULL, NULL);
 341
 342
 343         v3_hook_msr(core->vm_info, FS_BASE_MSR, NULL, NULL, NULL);
 344         v3_hook_msr(core->vm_info, GS_BASE_MSR, NULL, NULL, NULL);
 345
 346         // Passthrough read operations are ok.
 347         v3_hook_msr(core->vm_info, INT_PENDING_AMD_MSR, NULL, v3_msr_unhandled_write, NULL);
 348     }
 349 }
 350
 351
 352 int v3_init_svm_vmcb(struct guest_info * core, v3_vm_class_t vm_class) {
 353
 354     PrintDebug(core->vm_info, core, "Allocating VMCB\n");
 355     core->vmm_data = (void *)Allocate_VMCB();
 356
 357     if (core->vmm_data == NULL) {
 358         PrintError(core->vm_info, core, "Could not allocate VMCB, Exiting...\n");
 359         return -1;
 360     }
 361
 362     if (vm_class == V3_PC_VM) {
 363         PrintDebug(core->vm_info, core, "Initializing VMCB (addr=%p)\n", (void *)core->vmm_data);
 364         Init_VMCB_BIOS((vmcb_t*)(core->vmm_data), core);
 365     } else {
 366         PrintError(core->vm_info, core, "Invalid VM class\n");
 367         return -1;
 368     }
 369
 370     core->core_run_state = CORE_STOPPED;
 371
 372     return 0;
 373 }
 374
 375
 376 int v3_deinit_svm_vmcb(struct guest_info * core) {
 377     V3_FreePages(V3_PAddr(core->vmm_data), 1);
 378     return 0;
 379 }
 380
 381
 382 #ifdef V3_CONFIG_CHECKPOINT
 383 int v3_svm_save_core(struct guest_info * core, void * ctx){
 384
 385   vmcb_saved_state_t * guest_area = GET_VMCB_SAVE_STATE_AREA(core->vmm_data);
 386
 387   // Special case saves of data we need immediate access to
 388   // in some cases
 389   V3_CHKPT_SAVE(ctx, "CPL", core->cpl, failout);
 390   V3_CHKPT_SAVE(ctx,"STAR", guest_area->star, failout);
 391   V3_CHKPT_SAVE(ctx,"CSTAR", guest_area->cstar, failout);
 392   V3_CHKPT_SAVE(ctx,"LSTAR", guest_area->lstar, failout);
 393   V3_CHKPT_SAVE(ctx,"SFMASK", guest_area->sfmask, failout);
 394   V3_CHKPT_SAVE(ctx,"KERNELGSBASE", guest_area->KernelGsBase, failout);
 395   V3_CHKPT_SAVE(ctx,"SYSENTER_CS", guest_area->sysenter_cs, failout);
 396   V3_CHKPT_SAVE(ctx,"SYSENTER_ESP", guest_area->sysenter_esp, failout);
 397   V3_CHKPT_SAVE(ctx,"SYSENTER_EIP", guest_area->sysenter_eip, failout);
 398
 399 // and then we save the whole enchilada
 400   if (v3_chkpt_save(ctx, "VMCB_DATA", PAGE_SIZE, core->vmm_data)) {
 401     PrintError(core->vm_info, core, "Could not save SVM vmcb\n");
 402     goto failout;
 403   }
 404
 405   return 0;
 406
 407  failout:
 408   PrintError(core->vm_info, core, "Failed to save SVM state for core\n");
 409   return -1;
 410
 411 }
 412
 413 int v3_svm_load_core(struct guest_info * core, void * ctx){
 414
 415
 416   vmcb_saved_state_t * guest_area = GET_VMCB_SAVE_STATE_AREA(core->vmm_data);
 417
 418   // Reload what we special cased, which we will overwrite in a minute
 419   V3_CHKPT_LOAD(ctx, "CPL", core->cpl, failout);
 420   V3_CHKPT_LOAD(ctx,"STAR", guest_area->star, failout);
 421   V3_CHKPT_LOAD(ctx,"CSTAR", guest_area->cstar, failout);
 422   V3_CHKPT_LOAD(ctx,"LSTAR", guest_area->lstar, failout);
 423   V3_CHKPT_LOAD(ctx,"SFMASK", guest_area->sfmask, failout);
 424   V3_CHKPT_LOAD(ctx,"KERNELGSBASE", guest_area->KernelGsBase, failout);
 425   V3_CHKPT_LOAD(ctx,"SYSENTER_CS", guest_area->sysenter_cs, failout);
 426   V3_CHKPT_LOAD(ctx,"SYSENTER_ESP", guest_area->sysenter_esp, failout);
 427   V3_CHKPT_LOAD(ctx,"SYSENTER_EIP", guest_area->sysenter_eip, failout);
 428
 429   // and then we load the whole enchilada
 430   if (v3_chkpt_load(ctx, "VMCB_DATA", PAGE_SIZE, core->vmm_data)) {
 431     PrintError(core->vm_info, core, "Could not load SVM vmcb\n");
 432     goto failout;
 433   }
 434
 435   return 0;
 436
 437  failout:
 438   PrintError(core->vm_info, core, "Failed to save SVM state for core\n");
 439   return -1;
 440
 441 }
 442 #endif
 443
 444 static int update_irq_exit_state(struct guest_info * info) {
 445     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 446
 447     // Fix for QEMU bug using EVENTINJ as an internal cache
 448     guest_ctrl->EVENTINJ.valid = 0;
 449
 450     if ((info->intr_core_state.irq_pending == 1) && (guest_ctrl->guest_ctrl.V_IRQ == 0)) {
 451
 452 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 453         PrintDebug(info->vm_info, info, "INTAK cycle completed for irq %d\n", info->intr_core_state.irq_vector);
 454 #endif
 455
 456         info->intr_core_state.irq_started = 1;
 457         info->intr_core_state.irq_pending = 0;
 458
 459         v3_injecting_intr(info, info->intr_core_state.irq_vector, V3_EXTERNAL_IRQ);
 460     }
 461
 462     if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 0)) {
 463 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 464         PrintDebug(info->vm_info, info, "Interrupt %d taken by guest\n", info->intr_core_state.irq_vector);
 465 #endif
 466
 467         // Interrupt was taken fully vectored
 468         info->intr_core_state.irq_started = 0;
 469
 470     } else if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 1)) {
 471 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 472         PrintDebug(info->vm_info, info, "EXIT INT INFO is set (vec=%d)\n", guest_ctrl->exit_int_info.vector);
 473 #endif
 474     }
 475
 476     return 0;
 477 }
 478
 479
 480 static int update_irq_entry_state(struct guest_info * info) {
 481     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 482
 483
 484     if (info->intr_core_state.irq_pending == 0) {
 485         guest_ctrl->guest_ctrl.V_IRQ = 0;
 486         guest_ctrl->guest_ctrl.V_INTR_VECTOR = 0;
 487     }
 488
 489     if (v3_excp_pending(info)) {
 490         uint_t excp = v3_get_excp_number(info);
 491
 492         guest_ctrl->EVENTINJ.type = SVM_INJECTION_EXCEPTION;
 493
 494         if (info->excp_state.excp_error_code_valid) {
 495             guest_ctrl->EVENTINJ.error_code = info->excp_state.excp_error_code;
 496             guest_ctrl->EVENTINJ.ev = 1;
 497 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 498             PrintDebug(info->vm_info, info, "Injecting exception %d with error code %x\n", excp, guest_ctrl->EVENTINJ.error_code);
 499 #endif
 500         }
 501
 502         guest_ctrl->EVENTINJ.vector = excp;
 503
 504         guest_ctrl->EVENTINJ.valid = 1;
 505
 506 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 507         PrintDebug(info->vm_info, info, "<%d> Injecting Exception %d (CR2=%p) (EIP=%p)\n",
 508                    (int)info->num_exits,
 509                    guest_ctrl->EVENTINJ.vector,
 510                    (void *)(addr_t)info->ctrl_regs.cr2,
 511                    (void *)(addr_t)info->rip);
 512 #endif
 513
 514         v3_injecting_excp(info, excp);
 515     } else if (info->intr_core_state.irq_started == 1) {
 516 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 517         PrintDebug(info->vm_info, info, "IRQ pending from previous injection\n");
 518 #endif
 519         guest_ctrl->guest_ctrl.V_IRQ = 1;
 520         guest_ctrl->guest_ctrl.V_INTR_VECTOR = info->intr_core_state.irq_vector;
 521
 522         // We ignore the virtual TPR on this injection
 523         // TPR/PPR tests have already been done in the APIC.
 524         guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 525         guest_ctrl->guest_ctrl.V_INTR_PRIO = info->intr_core_state.irq_vector >> 4 ;  // 0xf;
 526
 527     } else {
 528         switch (v3_intr_pending(info)) {
 529             case V3_EXTERNAL_IRQ: {
 530                 uint32_t irq = v3_get_intr(info);
 531
 532                 guest_ctrl->guest_ctrl.V_IRQ = 1;
 533                 guest_ctrl->guest_ctrl.V_INTR_VECTOR = irq;
 534
 535                 // We ignore the virtual TPR on this injection
 536                 // TPR/PPR tests have already been done in the APIC.
 537                 guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 538                 guest_ctrl->guest_ctrl.V_INTR_PRIO = info->intr_core_state.irq_vector >> 4 ;  // 0xf;
 539
 540 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 541                 PrintDebug(info->vm_info, info, "Injecting Interrupt %d (EIP=%p)\n",
 542                            guest_ctrl->guest_ctrl.V_INTR_VECTOR,
 543                            (void *)(addr_t)info->rip);
 544 #endif
 545
 546                 info->intr_core_state.irq_pending = 1;
 547                 info->intr_core_state.irq_vector = irq;
 548
 549                 break;
 550             }
 551             case V3_NMI:
 552                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_NMI;
 553                 break;
 554             case V3_SOFTWARE_INTR:
 555                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_SOFT_INTR;
 556
 557 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 558                 PrintDebug(info->vm_info, info, "Injecting software interrupt --  type: %d, vector: %d\n",
 559                            SVM_INJECTION_SOFT_INTR, info->intr_core_state.swintr_vector);
 560 #endif
 561                 guest_ctrl->EVENTINJ.vector = info->intr_core_state.swintr_vector;
 562                 guest_ctrl->EVENTINJ.valid = 1;
 563
 564                 /* reset swintr state */
 565                 info->intr_core_state.swintr_posted = 0;
 566                 info->intr_core_state.swintr_vector = 0;
 567
 568                 break;
 569             case V3_VIRTUAL_IRQ:
 570                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_IRQ;
 571                 break;
 572
 573             case V3_INVALID_INTR:
 574             default:
 575                 break;
 576         }
 577
 578     }
 579
 580     return 0;
 581 }
 582
 583 int
 584 v3_svm_config_tsc_virtualization(struct guest_info * info) {
 585     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 586
 587
 588     if (info->time_state.flags & VM_TIME_TRAP_RDTSC) {
 589         ctrl_area->instrs.RDTSC = 1;
 590         ctrl_area->svm_instrs.RDTSCP = 1;
 591     } else {
 592         ctrl_area->instrs.RDTSC = 0;
 593         ctrl_area->svm_instrs.RDTSCP = 0;
 594
 595         if (info->time_state.flags & VM_TIME_TSC_PASSTHROUGH) {
 596                 ctrl_area->TSC_OFFSET = 0;
 597         } else {
 598                 ctrl_area->TSC_OFFSET = v3_tsc_host_offset(&info->time_state);
 599         }
 600     }
 601     return 0;
 602 }
 603
 604 /*
 605  * CAUTION and DANGER!!!
 606  *
 607  * The VMCB CANNOT(!!) be accessed outside of the clgi/stgi calls inside this function
 608  * When exectuing a symbiotic call, the VMCB WILL be overwritten, so any dependencies
 609  * on its contents will cause things to break. The contents at the time of the exit WILL
 610  * change before the exit handler is executed.
 611  */
 612 int v3_svm_enter(struct guest_info * info) {
 613     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 614     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 615     addr_t exit_code = 0, exit_info1 = 0, exit_info2 = 0;
 616     uint64_t guest_cycles = 0;
 617
 618     // Conditionally yield the CPU if the timeslice has expired
 619     v3_schedule(info);
 620
 621     // Update timer devices after being in the VM before doing
 622     // IRQ updates, so that any interrupts they raise get seen
 623     // immediately.
 624     v3_advance_time(info, NULL);
 625     v3_update_timers(info);
 626
 627     // disable global interrupts for vm state transition
 628     v3_clgi();
 629
 630     // Synchronize the guest state to the VMCB
 631     guest_state->cr0 = info->ctrl_regs.cr0;
 632     guest_state->cr2 = info->ctrl_regs.cr2;
 633     guest_state->cr3 = info->ctrl_regs.cr3;
 634     guest_state->cr4 = info->ctrl_regs.cr4;
 635     guest_state->dr6 = info->dbg_regs.dr6;
 636     guest_state->dr7 = info->dbg_regs.dr7;
 637
 638     // CR8 is now updated by read/writes and it contains the APIC TPR
 639     // the V_TPR should be just the class part of that.
 640     // This update is here just for completeness.  We currently
 641     // are ignoring V_TPR on all injections and doing the priority logivc
 642     // in the APIC.
 643     // guest_ctrl->guest_ctrl.V_TPR = ((info->ctrl_regs.apic_tpr) >> 4) & 0xf;
 644
 645     //guest_ctrl->guest_ctrl.V_TPR = info->ctrl_regs.cr8 & 0xff;
 646     //
 647
 648     guest_state->rflags = info->ctrl_regs.rflags;
 649     guest_state->efer = info->ctrl_regs.efer;
 650
 651     /* Synchronize MSRs */
 652     guest_state->star = info->msrs.star;
 653     guest_state->lstar = info->msrs.lstar;
 654     guest_state->sfmask = info->msrs.sfmask;
 655     guest_state->KernelGsBase = info->msrs.kern_gs_base;
 656
 657     guest_state->cpl = info->cpl;
 658
 659     v3_set_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 660
 661     guest_state->rax = info->vm_regs.rax;
 662     guest_state->rip = info->rip;
 663     guest_state->rsp = info->vm_regs.rsp;
 664
 665 #ifdef V3_CONFIG_SYMCALL
 666     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 667         update_irq_entry_state(info);
 668     }
 669 #else
 670     update_irq_entry_state(info);
 671 #endif
 672
 673
 674     /* ** */
 675
 676     /*
 677       PrintDebug(info->vm_info, info, "SVM Entry to CS=%p  rip=%p...\n",
 678       (void *)(addr_t)info->segments.cs.base,
 679       (void *)(addr_t)info->rip);
 680     */
 681
 682 #ifdef V3_CONFIG_SYMCALL
 683     if (info->sym_core_state.symcall_state.sym_call_active == 1) {
 684         if (guest_ctrl->guest_ctrl.V_IRQ == 1) {
 685             V3_Print(info->vm_info, info, "!!! Injecting Interrupt during Sym call !!!\n");
 686         }
 687     }
 688 #endif
 689
 690     v3_svm_config_tsc_virtualization(info);
 691
 692     //V3_Print(info->vm_info, info, "Calling v3_svm_launch\n");
 693     {
 694         uint64_t entry_tsc = 0;
 695         uint64_t exit_tsc = 0;
 696
 697         rdtscll(entry_tsc);
 698
 699         v3_svm_launch((vmcb_t *)V3_PAddr(info->vmm_data), &(info->vm_regs), (vmcb_t *)host_vmcbs[V3_Get_CPU()]);
 700
 701         rdtscll(exit_tsc);
 702
 703         guest_cycles = exit_tsc - entry_tsc;
 704     }
 705
 706
 707     //V3_Print(info->vm_info, info, "SVM Returned: Exit Code: %x, guest_rip=%lx\n", (uint32_t)(guest_ctrl->exit_code), (unsigned long)guest_state->rip);
 708
 709     v3_last_exit = (uint32_t)(guest_ctrl->exit_code);
 710
 711     v3_advance_time(info, &guest_cycles);
 712
 713     info->num_exits++;
 714
 715     // Save Guest state from VMCB
 716     info->rip = guest_state->rip;
 717     info->vm_regs.rsp = guest_state->rsp;
 718     info->vm_regs.rax = guest_state->rax;
 719
 720     info->cpl = guest_state->cpl;
 721
 722     info->ctrl_regs.cr0 = guest_state->cr0;
 723     info->ctrl_regs.cr2 = guest_state->cr2;
 724     info->ctrl_regs.cr3 = guest_state->cr3;
 725     info->ctrl_regs.cr4 = guest_state->cr4;
 726     info->dbg_regs.dr6 = guest_state->dr6;
 727     info->dbg_regs.dr7 = guest_state->dr7;
 728     //
 729     // We do not track this anymore
 730     // V_TPR is ignored and we do the logic in the APIC
 731     //info->ctrl_regs.cr8 = guest_ctrl->guest_ctrl.V_TPR;
 732     //
 733     info->ctrl_regs.rflags = guest_state->rflags;
 734     info->ctrl_regs.efer = guest_state->efer;
 735
 736     /* Synchronize MSRs */
 737     info->msrs.star =  guest_state->star;
 738     info->msrs.lstar = guest_state->lstar;
 739     info->msrs.sfmask = guest_state->sfmask;
 740     info->msrs.kern_gs_base = guest_state->KernelGsBase;
 741
 742     v3_get_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 743     info->cpu_mode = v3_get_vm_cpu_mode(info);
 744     info->mem_mode = v3_get_vm_mem_mode(info);
 745     /* ** */
 746
 747     // save exit info here
 748     exit_code = guest_ctrl->exit_code;
 749     exit_info1 = guest_ctrl->exit_info1;
 750     exit_info2 = guest_ctrl->exit_info2;
 751
 752 #ifdef V3_CONFIG_SYMCALL
 753     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 754         update_irq_exit_state(info);
 755     }
 756 #else
 757     update_irq_exit_state(info);
 758 #endif
 759
 760     // reenable global interrupts after vm exit
 761     v3_stgi();
 762
 763     // Conditionally yield the CPU if the timeslice has expired
 764     v3_schedule(info);
 765
 766     // This update timers is for time-dependent handlers
 767     // if we're slaved to host time
 768     v3_advance_time(info, NULL);
 769     v3_update_timers(info);
 770
 771     {
 772         int ret = v3_handle_svm_exit(info, exit_code, exit_info1, exit_info2);
 773
 774         if (ret != 0) {
 775             PrintError(info->vm_info, info, "Error in SVM exit handler (ret=%d)\n", ret);
 776             PrintError(info->vm_info, info, "  last Exit was %d (exit code=0x%llx)\n", v3_last_exit, (uint64_t) exit_code);
 777             return -1;
 778         }
 779     }
 780
 781     if (info->timeouts.timeout_active) {
 782         /* Check to see if any timeouts have expired */
 783         v3_handle_timeouts(info, guest_cycles);
 784     }
 785
 786
 787     return 0;
 788 }
 789
 790
 791 int v3_start_svm_guest(struct guest_info * info) {
 792     //    vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 793     //  vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 794
 795     PrintDebug(info->vm_info, info, "Starting SVM core %u (on logical core %u)\n", info->vcpu_id, info->pcpu_id);
 796
 797     if (info->vcpu_id == 0) {
 798         info->core_run_state = CORE_RUNNING;
 799     } else  {
 800         PrintDebug(info->vm_info, info, "SVM core %u (on %u): Waiting for core initialization\n", info->vcpu_id, info->pcpu_id);
 801
 802         while (info->core_run_state == CORE_STOPPED) {
 803
 804             if (info->vm_info->run_state == VM_STOPPED) {
 805                 // The VM was stopped before this core was initialized.
 806                 return 0;
 807             }
 808
 809             v3_yield(info,-1);
 810             //PrintDebug(info->vm_info, info, "SVM core %u: still waiting for INIT\n", info->vcpu_id);
 811         }
 812
 813         PrintDebug(info->vm_info, info, "SVM core %u(on %u) initialized\n", info->vcpu_id, info->pcpu_id);
 814
 815         // We'll be paranoid about race conditions here
 816         v3_wait_at_barrier(info);
 817     }
 818
 819     PrintDebug(info->vm_info, info, "SVM core %u(on %u): I am starting at CS=0x%x (base=0x%p, limit=0x%x),  RIP=0x%p\n",
 820                info->vcpu_id, info->pcpu_id,
 821                info->segments.cs.selector, (void *)(info->segments.cs.base),
 822                info->segments.cs.limit, (void *)(info->rip));
 823
 824
 825
 826     PrintDebug(info->vm_info, info, "SVM core %u: Launching SVM VM (vmcb=%p) (on cpu %u)\n",
 827                info->vcpu_id, (void *)info->vmm_data, info->pcpu_id);
 828     //PrintDebugVMCB((vmcb_t*)(info->vmm_data));
 829
 830     v3_start_time(info);
 831
 832     while (1) {
 833
 834         if (info->vm_info->run_state == VM_STOPPED) {
 835             info->core_run_state = CORE_STOPPED;
 836             break;
 837         }
 838
 839         if (v3_svm_enter(info) == -1) {
 840             vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 841             addr_t host_addr;
 842             addr_t linear_addr = 0;
 843
 844             info->vm_info->run_state = VM_ERROR;
 845
 846             V3_Print(info->vm_info, info, "SVM core %u: SVM ERROR!!\n", info->vcpu_id);
 847
 848             v3_print_guest_state(info);
 849
 850             V3_Print(info->vm_info, info, "SVM core %u: SVM Exit Code: %p\n", info->vcpu_id, (void *)(addr_t)guest_ctrl->exit_code);
 851
 852             V3_Print(info->vm_info, info, "SVM core %u: exit_info1 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info1));
 853             V3_Print(info->vm_info, info, "SVM core %u: exit_info1 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info1)) + 4));
 854
 855             V3_Print(info->vm_info, info, "SVM core %u: exit_info2 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info2));
 856             V3_Print(info->vm_info, info, "SVM core %u: exit_info2 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info2)) + 4));
 857
 858             linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
 859
 860             if (info->mem_mode == PHYSICAL_MEM) {
 861                 v3_gpa_to_hva(info, linear_addr, &host_addr);
 862             } else if (info->mem_mode == VIRTUAL_MEM) {
 863                 v3_gva_to_hva(info, linear_addr, &host_addr);
 864             }
 865
 866             V3_Print(info->vm_info, info, "SVM core %u: Host Address of rip = 0x%p\n", info->vcpu_id, (void *)host_addr);
 867
 868             V3_Print(info->vm_info, info, "SVM core %u: Instr (15 bytes) at %p:\n", info->vcpu_id, (void *)host_addr);
 869             v3_dump_mem((uint8_t *)host_addr, 15);
 870
 871             v3_print_stack(info);
 872
 873             break;
 874         }
 875
 876         v3_wait_at_barrier(info);
 877
 878
 879         if (info->vm_info->run_state == VM_STOPPED) {
 880             info->core_run_state = CORE_STOPPED;
 881             break;
 882         }
 883
 884
 885
 886 /*
 887         if ((info->num_exits % 50000) == 0) {
 888             V3_Print(info->vm_info, info, "SVM Exit number %d\n", (uint32_t)info->num_exits);
 889             v3_print_guest_state(info);
 890         }
 891 */
 892
 893     }
 894
 895     // Need to take down the other cores on error...
 896
 897     return 0;
 898 }
 899
 900
 901
 902
 903 int v3_reset_svm_vm_core(struct guest_info * core, addr_t rip) {
 904     // init vmcb_bios
 905
 906     // Write the RIP, CS, and descriptor
 907     // assume the rest is already good to go
 908     //
 909     // vector VV -> rip at 0
 910     //              CS = VV00
 911     //  This means we start executing at linear address VV000
 912     //
 913     // So the selector needs to be VV00
 914     // and the base needs to be VV000
 915     //
 916     core->rip = 0;
 917     core->segments.cs.selector = rip << 8;
 918     core->segments.cs.limit = 0xffff;
 919     core->segments.cs.base = rip << 12;
 920
 921     return 0;
 922 }
 923
 924
 925
 926
 927
 928
 929 /* Checks machine SVM capability */
 930 /* Implemented from: AMD Arch Manual 3, sect 15.4 */
 931 int v3_is_svm_capable() {
 932     uint_t vm_cr_low = 0, vm_cr_high = 0;
 933     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 934
 935     v3_cpuid(CPUID_EXT_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 936
 937     PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_EXT_FEATURE_IDS_ecx=0x%x\n", ecx);
 938
 939     if ((ecx & CPUID_EXT_FEATURE_IDS_ecx_svm_avail) == 0) {
 940       V3_Print(VM_NONE, VCORE_NONE,  "SVM Not Available\n");
 941       return 0;
 942     }  else {
 943         v3_get_msr(SVM_VM_CR_MSR, &vm_cr_high, &vm_cr_low);
 944
 945         PrintDebug(VM_NONE, VCORE_NONE, "SVM_VM_CR_MSR = 0x%x 0x%x\n", vm_cr_high, vm_cr_low);
 946
 947         if ((vm_cr_low & SVM_VM_CR_MSR_svmdis) == 1) {
 948             V3_Print(VM_NONE, VCORE_NONE, "SVM is available but is disabled.\n");
 949
 950             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 951
 952             PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 953
 954             if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_svml) == 0) {
 955                 V3_Print(VM_NONE, VCORE_NONE,  "SVM BIOS Disabled, not unlockable\n");
 956             } else {
 957                 V3_Print(VM_NONE, VCORE_NONE,  "SVM is locked with a key\n");
 958             }
 959             return 0;
 960
 961         } else {
 962             V3_Print(VM_NONE, VCORE_NONE,  "SVM is available and  enabled.\n");
 963
 964             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 965             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_eax=0x%x\n", eax);
 966             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_ebx=0x%x\n", ebx);
 967             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_ecx=0x%x\n", ecx);
 968             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 969
 970             return 1;
 971         }
 972     }
 973 }
 974
 975 static int has_svm_nested_paging() {
 976     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 977
 978     v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 979
 980     //PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_EXT_FEATURE_IDS_edx=0x%x\n", edx);
 981
 982     if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_np) == 0) {
 983         V3_Print(VM_NONE, VCORE_NONE, "SVM Nested Paging not supported\n");
 984         return 0;
 985     } else {
 986         V3_Print(VM_NONE, VCORE_NONE, "SVM Nested Paging supported\n");
 987         return 1;
 988     }
 989  }
 990
 991
 992
 993 void v3_init_svm_cpu(int cpu_id) {
 994     reg_ex_t msr;
 995     extern v3_cpu_arch_t v3_cpu_types[];
 996
 997     // Enable SVM on the CPU
 998     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 999     msr.e_reg.low |= EFER_MSR_svm_enable;
1000     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
1001
1002     V3_Print(VM_NONE, VCORE_NONE,  "SVM Enabled\n");
1003
1004     // Setup the host state save area
1005     host_vmcbs[cpu_id] = (addr_t)V3_AllocPages(4);
1006
1007     if (!host_vmcbs[cpu_id]) {
1008         PrintError(VM_NONE, VCORE_NONE,  "Failed to allocate VMCB\n");
1009         return;
1010     }
1011
1012     /* 64-BIT-ISSUE */
1013     //  msr.e_reg.high = 0;
1014     //msr.e_reg.low = (uint_t)host_vmcb;
1015     msr.r_reg = host_vmcbs[cpu_id];
1016
1017     PrintDebug(VM_NONE, VCORE_NONE,  "Host State being saved at %p\n", (void *)host_vmcbs[cpu_id]);
1018     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
1019
1020
1021     if (has_svm_nested_paging() == 1) {
1022         v3_cpu_types[cpu_id] = V3_SVM_REV3_CPU;
1023     } else {
1024         v3_cpu_types[cpu_id] = V3_SVM_CPU;
1025     }
1026 }
1027
1028
1029
1030 void v3_deinit_svm_cpu(int cpu_id) {
1031     reg_ex_t msr;
1032     extern v3_cpu_arch_t v3_cpu_types[];
1033
1034     // reset SVM_VM_HSAVE_PA_MSR
1035     // Does setting it to NULL disable??
1036     msr.r_reg = 0;
1037     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
1038
1039     // Disable SVM?
1040     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
1041     msr.e_reg.low &= ~EFER_MSR_svm_enable;
1042     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
1043
1044     v3_cpu_types[cpu_id] = V3_INVALID_CPU;
1045
1046     V3_FreePages((void *)host_vmcbs[cpu_id], 4);
1047
1048     V3_Print(VM_NONE, VCORE_NONE,  "Host CPU %d host area freed, and SVM disabled\n", cpu_id);
1049     return;
1050 }
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101 #if 0
1102 /*
1103  * Test VMSAVE/VMLOAD Latency
1104  */
1105 #define vmsave ".byte 0x0F,0x01,0xDB ; "
1106 #define vmload ".byte 0x0F,0x01,0xDA ; "
1107 {
1108     uint32_t start_lo, start_hi;
1109     uint32_t end_lo, end_hi;
1110     uint64_t start, end;
1111
1112     __asm__ __volatile__ (
1113                           "rdtsc ; "
1114                           "movl %%eax, %%esi ; "
1115                           "movl %%edx, %%edi ; "
1116                           "movq  %%rcx, %%rax ; "
1117                           vmsave
1118                           "rdtsc ; "
1119                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
1120                           : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
1121                           );
1122
1123     start = start_hi;
1124     start <<= 32;
1125     start += start_lo;
1126
1127     end = end_hi;
1128     end <<= 32;
1129     end += end_lo;
1130
1131     PrintDebug(core->vm_info, core, "VMSave Cycle Latency: %d\n", (uint32_t)(end - start));
1132
1133     __asm__ __volatile__ (
1134                           "rdtsc ; "
1135                           "movl %%eax, %%esi ; "
1136                           "movl %%edx, %%edi ; "
1137                           "movq  %%rcx, %%rax ; "
1138                           vmload
1139                           "rdtsc ; "
1140                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
1141                               : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
1142                               );
1143
1144         start = start_hi;
1145         start <<= 32;
1146         start += start_lo;
1147
1148         end = end_hi;
1149         end <<= 32;
1150         end += end_lo;
1151
1152
1153         PrintDebug(core->vm_info, core, "VMLoad Cycle Latency: %d\n", (uint32_t)(end - start));
1154     }
1155     /* End Latency Test */
1156
1157 #endif
1158
1159
1160
1161
1162
1163
1164
1165 #if 0
1166 void Init_VMCB_pe(vmcb_t *vmcb, struct guest_info vm_info) {
1167   vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
1168   vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
1169   uint_t i = 0;
1170
1171
1172   guest_state->rsp = vm_info.vm_regs.rsp;
1173   guest_state->rip = vm_info.rip;
1174
1175
1176   /* I pretty much just gutted this from TVMM */
1177   /* Note: That means its probably wrong */
1178
1179   // set the segment registers to mirror ours
1180   guest_state->cs.selector = 1<<3;
1181   guest_state->cs.attrib.fields.type = 0xa; // Code segment+read
1182   guest_state->cs.attrib.fields.S = 1;
1183   guest_state->cs.attrib.fields.P = 1;
1184   guest_state->cs.attrib.fields.db = 1;
1185   guest_state->cs.attrib.fields.G = 1;
1186   guest_state->cs.limit = 0xfffff;
1187   guest_state->cs.base = 0;
1188
1189   struct vmcb_selector *segregs [] = {&(guest_state->ss), &(guest_state->ds), &(guest_state->es), &(guest_state->fs), &(guest_state->gs), NULL};
1190   for ( i = 0; segregs[i] != NULL; i++) {
1191     struct vmcb_selector * seg = segregs[i];
1192
1193     seg->selector = 2<<3;
1194     seg->attrib.fields.type = 0x2; // Data Segment+read/write
1195     seg->attrib.fields.S = 1;
1196     seg->attrib.fields.P = 1;
1197     seg->attrib.fields.db = 1;
1198     seg->attrib.fields.G = 1;
1199     seg->limit = 0xfffff;
1200     seg->base = 0;
1201   }
1202
1203
1204   {
1205     /* JRL THIS HAS TO GO */
1206
1207     //    guest_state->tr.selector = GetTR_Selector();
1208     guest_state->tr.attrib.fields.type = 0x9;
1209     guest_state->tr.attrib.fields.P = 1;
1210     // guest_state->tr.limit = GetTR_Limit();
1211     //guest_state->tr.base = GetTR_Base();// - 0x2000;
1212     /* ** */
1213   }
1214
1215
1216   /* ** */
1217
1218
1219   guest_state->efer |= EFER_MSR_svm_enable;
1220   guest_state->rflags = 0x00000002; // The reserved bit is always 1
1221   ctrl_area->svm_instrs.VMRUN = 1;
1222   guest_state->cr0 = 0x00000001;    // PE
1223   ctrl_area->guest_ASID = 1;
1224
1225
1226   //  guest_state->cpl = 0;
1227
1228
1229
1230   // Setup exits
1231
1232   ctrl_area->cr_writes.cr4 = 1;
1233
1234   ctrl_area->exceptions.de = 1;
1235   ctrl_area->exceptions.df = 1;
1236   ctrl_area->exceptions.pf = 1;
1237   ctrl_area->exceptions.ts = 1;
1238   ctrl_area->exceptions.ss = 1;
1239   ctrl_area->exceptions.ac = 1;
1240   ctrl_area->exceptions.mc = 1;
1241   ctrl_area->exceptions.gp = 1;
1242   ctrl_area->exceptions.ud = 1;
1243   ctrl_area->exceptions.np = 1;
1244   ctrl_area->exceptions.of = 1;
1245   ctrl_area->exceptions.nmi = 1;
1246
1247
1248
1249   ctrl_area->instrs.IOIO_PROT = 1;
1250   ctrl_area->IOPM_BASE_PA = (uint_t)V3_AllocPages(3);
1251
1252   if (!ctrl_area->IOPM_BASE_PA) {
1253       PrintError(core->vm_info, core, "Cannot allocate IO bitmap\n");
1254       return;
1255   }
1256
1257   {
1258     reg_ex_t tmp_reg;
1259     tmp_reg.r_reg = ctrl_area->IOPM_BASE_PA;
1260     memset((void*)(tmp_reg.e_reg.low), 0xffffffff, PAGE_SIZE * 2);
1261   }
1262
1263   ctrl_area->instrs.INTR = 1;
1264
1265
1266   {
1267     char gdt_buf[6];
1268     char idt_buf[6];
1269
1270     memset(gdt_buf, 0, 6);
1271     memset(idt_buf, 0, 6);
1272
1273
1274     uint_t gdt_base, idt_base;
1275     ushort_t gdt_limit, idt_limit;
1276
1277     GetGDTR(gdt_buf);
1278     gdt_base = *(ulong_t*)((uchar_t*)gdt_buf + 2) & 0xffffffff;
1279     gdt_limit = *(ushort_t*)(gdt_buf) & 0xffff;
1280     PrintDebug(core->vm_info, core, "GDT: base: %x, limit: %x\n", gdt_base, gdt_limit);
1281
1282     GetIDTR(idt_buf);
1283     idt_base = *(ulong_t*)(idt_buf + 2) & 0xffffffff;
1284     idt_limit = *(ushort_t*)(idt_buf) & 0xffff;
1285     PrintDebug(core->vm_info, core, "IDT: base: %x, limit: %x\n",idt_base, idt_limit);
1286
1287
1288     // gdt_base -= 0x2000;
1289     //idt_base -= 0x2000;
1290
1291     guest_state->gdtr.base = gdt_base;
1292     guest_state->gdtr.limit = gdt_limit;
1293     guest_state->idtr.base = idt_base;
1294     guest_state->idtr.limit = idt_limit;
1295
1296
1297   }
1298
1299
1300   // also determine if CPU supports nested paging
1301   /*
1302   if (vm_info.page_tables) {
1303     //   if (0) {
1304     // Flush the TLB on entries/exits
1305     ctrl_area->TLB_CONTROL = 1;
1306
1307     // Enable Nested Paging
1308     ctrl_area->NP_ENABLE = 1;
1309
1310     PrintDebug(core->vm_info, core, "NP_Enable at 0x%x\n", &(ctrl_area->NP_ENABLE));
1311
1312         // Set the Nested Page Table pointer
1313     ctrl_area->N_CR3 |= ((addr_t)vm_info.page_tables & 0xfffff000);
1314
1315
1316     //   ctrl_area->N_CR3 = Get_CR3();
1317     // guest_state->cr3 |= (Get_CR3() & 0xfffff000);
1318
1319     guest_state->g_pat = 0x7040600070406ULL;
1320
1321     PrintDebug(core->vm_info, core, "Set Nested CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(ctrl_area->N_CR3)), (uint_t)*((unsigned char *)&(ctrl_area->N_CR3) + 4));
1322     PrintDebug(core->vm_info, core, "Set Guest CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(guest_state->cr3)), (uint_t)*((unsigned char *)&(guest_state->cr3) + 4));
1323     // Enable Paging
1324     //    guest_state->cr0 |= 0x80000000;
1325   }
1326   */
1327
1328 }
1329
1330
1331
1332
1333
1334 #endif
1335
1336