palacios/src/palacios/svm.c

   1
   2 /*
   3  * This file is part of the Palacios Virtual Machine Monitor developed
   4  * by the V3VEE Project with funding from the United States National
   5  * Science Foundation and the Department of Energy.
   6  *
   7  * The V3VEE Project is a joint project between Northwestern University
   8  * and the University of New Mexico.  You can find out more at
   9  * http://www.v3vee.org
  10  *
  11  * Copyright (c) 2008, Jack Lange <jarusl@cs.northwestern.edu>
  12  * Copyright (c) 2008, The V3VEE Project <http://www.v3vee.org>
  13  * All rights reserved.
  14  *
  15  * Author: Jack Lange <jarusl@cs.northwestern.edu>
  16  *
  17  * This is free software.  You are permitted to use,
  18  * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
  19  */
  20
  21
  22 #include <palacios/svm.h>
  23 #include <palacios/vmm.h>
  24
  25 #include <palacios/vmcb.h>
  26 #include <palacios/vmm_mem.h>
  27 #include <palacios/vmm_paging.h>
  28 #include <palacios/svm_handler.h>
  29
  30 #include <palacios/vmm_debug.h>
  31 #include <palacios/vm_guest_mem.h>
  32
  33 #include <palacios/vmm_decoder.h>
  34 #include <palacios/vmm_string.h>
  35 #include <palacios/vmm_lowlevel.h>
  36 #include <palacios/svm_msr.h>
  37
  38 #include <palacios/vmm_rbtree.h>
  39
  40 #include <palacios/vmm_direct_paging.h>
  41
  42 #include <palacios/vmm_ctrl_regs.h>
  43 #include <palacios/svm_io.h>
  44
  45 #include <palacios/vmm_sprintf.h>
  46
  47
  48 #ifndef V3_CONFIG_DEBUG_SVM
  49 #undef PrintDebug
  50 #define PrintDebug(fmt, args...)
  51 #endif
  52
  53
  54 uint32_t v3_last_exit;
  55
  56 // This is a global pointer to the host's VMCB
  57 static addr_t host_vmcbs[V3_CONFIG_MAX_CPUS] = { [0 ... V3_CONFIG_MAX_CPUS - 1] = 0};
  58
  59
  60
  61 extern void v3_stgi();
  62 extern void v3_clgi();
  63 //extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, uint64_t * fs, uint64_t * gs);
  64 extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, vmcb_t * host_vmcb);
  65
  66
  67 static vmcb_t * Allocate_VMCB() {
  68     vmcb_t * vmcb_page = NULL;
  69     addr_t vmcb_pa = (addr_t)V3_AllocPages(1);
  70
  71     if ((void *)vmcb_pa == NULL) {
  72         PrintError("Error allocating VMCB\n");
  73         return NULL;
  74     }
  75
  76     vmcb_page = (vmcb_t *)V3_VAddr((void *)vmcb_pa);
  77
  78     memset(vmcb_page, 0, 4096);
  79
  80     return vmcb_page;
  81 }
  82
  83
  84
  85 static void Init_VMCB_BIOS(vmcb_t * vmcb, struct guest_info * core) {
  86     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
  87     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
  88     uint_t i;
  89
  90
  91     //
  92     ctrl_area->svm_instrs.VMRUN = 1;
  93     ctrl_area->svm_instrs.VMMCALL = 1;
  94     ctrl_area->svm_instrs.VMLOAD = 1;
  95     ctrl_area->svm_instrs.VMSAVE = 1;
  96     ctrl_area->svm_instrs.STGI = 1;
  97     ctrl_area->svm_instrs.CLGI = 1;
  98     ctrl_area->svm_instrs.SKINIT = 1;
  99     ctrl_area->svm_instrs.ICEBP = 1;
 100     ctrl_area->svm_instrs.WBINVD = 1;
 101     ctrl_area->svm_instrs.MONITOR = 1;
 102     ctrl_area->svm_instrs.MWAIT_always = 1;
 103     ctrl_area->svm_instrs.MWAIT_if_armed = 1;
 104     ctrl_area->instrs.INVLPGA = 1;
 105     ctrl_area->instrs.CPUID = 1;
 106
 107     ctrl_area->instrs.HLT = 1;
 108
 109 #ifdef V3_CONFIG_TIME_VIRTUALIZE_TSC
 110     ctrl_area->instrs.RDTSC = 1;
 111     ctrl_area->svm_instrs.RDTSCP = 1;
 112 #endif
 113
 114     // guest_state->cr0 = 0x00000001;    // PE
 115
 116     /*
 117       ctrl_area->exceptions.de = 1;
 118       ctrl_area->exceptions.df = 1;
 119
 120       ctrl_area->exceptions.ts = 1;
 121       ctrl_area->exceptions.ss = 1;
 122       ctrl_area->exceptions.ac = 1;
 123       ctrl_area->exceptions.mc = 1;
 124       ctrl_area->exceptions.gp = 1;
 125       ctrl_area->exceptions.ud = 1;
 126       ctrl_area->exceptions.np = 1;
 127       ctrl_area->exceptions.of = 1;
 128
 129       ctrl_area->exceptions.nmi = 1;
 130     */
 131
 132
 133     ctrl_area->instrs.NMI = 1;
 134     ctrl_area->instrs.SMI = 0; // allow SMIs to run in guest
 135     ctrl_area->instrs.INIT = 1;
 136     ctrl_area->instrs.PAUSE = 1;
 137     ctrl_area->instrs.shutdown_evts = 1;
 138
 139
 140     /* DEBUG FOR RETURN CODE */
 141     ctrl_area->exit_code = 1;
 142
 143
 144     /* Setup Guest Machine state */
 145
 146     core->vm_regs.rsp = 0x00;
 147     core->rip = 0xfff0;
 148
 149     core->vm_regs.rdx = 0x00000f00;
 150
 151
 152     core->cpl = 0;
 153
 154     core->ctrl_regs.rflags = 0x00000002; // The reserved bit is always 1
 155     core->ctrl_regs.cr0 = 0x60010010; // Set the WP flag so the memory hooks work in real-mode
 156     core->ctrl_regs.efer |= EFER_MSR_svm_enable;
 157
 158
 159
 160
 161
 162     core->segments.cs.selector = 0xf000;
 163     core->segments.cs.limit = 0xffff;
 164     core->segments.cs.base = 0x0000000f0000LL;
 165
 166     // (raw attributes = 0xf3)
 167     core->segments.cs.type = 0x3;
 168     core->segments.cs.system = 0x1;
 169     core->segments.cs.dpl = 0x3;
 170     core->segments.cs.present = 1;
 171
 172
 173
 174     struct v3_segment * segregs [] = {&(core->segments.ss), &(core->segments.ds),
 175                                       &(core->segments.es), &(core->segments.fs),
 176                                       &(core->segments.gs), NULL};
 177
 178     for ( i = 0; segregs[i] != NULL; i++) {
 179         struct v3_segment * seg = segregs[i];
 180
 181         seg->selector = 0x0000;
 182         //    seg->base = seg->selector << 4;
 183         seg->base = 0x00000000;
 184         seg->limit = ~0u;
 185
 186         // (raw attributes = 0xf3)
 187         seg->type = 0x3;
 188         seg->system = 0x1;
 189         seg->dpl = 0x3;
 190         seg->present = 1;
 191     }
 192
 193     core->segments.gdtr.limit = 0x0000ffff;
 194     core->segments.gdtr.base = 0x0000000000000000LL;
 195     core->segments.idtr.limit = 0x0000ffff;
 196     core->segments.idtr.base = 0x0000000000000000LL;
 197
 198     core->segments.ldtr.selector = 0x0000;
 199     core->segments.ldtr.limit = 0x0000ffff;
 200     core->segments.ldtr.base = 0x0000000000000000LL;
 201     core->segments.tr.selector = 0x0000;
 202     core->segments.tr.limit = 0x0000ffff;
 203     core->segments.tr.base = 0x0000000000000000LL;
 204
 205
 206     core->dbg_regs.dr6 = 0x00000000ffff0ff0LL;
 207     core->dbg_regs.dr7 = 0x0000000000000400LL;
 208
 209
 210     ctrl_area->IOPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->io_map.arch_data);
 211     ctrl_area->instrs.IOIO_PROT = 1;
 212
 213     ctrl_area->MSRPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->msr_map.arch_data);
 214     ctrl_area->instrs.MSR_PROT = 1;
 215
 216
 217     PrintDebug("Exiting on interrupts\n");
 218     ctrl_area->guest_ctrl.V_INTR_MASKING = 1;
 219     ctrl_area->instrs.INTR = 1;
 220
 221
 222     v3_hook_msr(core->vm_info, EFER_MSR,
 223                 &v3_handle_efer_read,
 224                 &v3_handle_efer_write,
 225                 core);
 226
 227     if (core->shdw_pg_mode == SHADOW_PAGING) {
 228         PrintDebug("Creating initial shadow page table\n");
 229
 230         /* JRL: This is a performance killer, and a simplistic solution */
 231         /* We need to fix this */
 232         ctrl_area->TLB_CONTROL = 1;
 233         ctrl_area->guest_ASID = 1;
 234
 235
 236         if (v3_init_passthrough_pts(core) == -1) {
 237             PrintError("Could not initialize passthrough page tables\n");
 238             return ;
 239         }
 240
 241
 242         core->shdw_pg_state.guest_cr0 = 0x0000000000000010LL;
 243         PrintDebug("Created\n");
 244
 245         core->ctrl_regs.cr0 |= 0x80000000;
 246         core->ctrl_regs.cr3 = core->direct_map_pt;
 247
 248         ctrl_area->cr_reads.cr0 = 1;
 249         ctrl_area->cr_writes.cr0 = 1;
 250         //ctrl_area->cr_reads.cr4 = 1;
 251         ctrl_area->cr_writes.cr4 = 1;
 252         ctrl_area->cr_reads.cr3 = 1;
 253         ctrl_area->cr_writes.cr3 = 1;
 254
 255
 256
 257         ctrl_area->instrs.INVLPG = 1;
 258
 259         ctrl_area->exceptions.pf = 1;
 260
 261         guest_state->g_pat = 0x7040600070406ULL;
 262
 263
 264
 265     } else if (core->shdw_pg_mode == NESTED_PAGING) {
 266         // Flush the TLB on entries/exits
 267         ctrl_area->TLB_CONTROL = 1;
 268         ctrl_area->guest_ASID = 1;
 269
 270         // Enable Nested Paging
 271         ctrl_area->NP_ENABLE = 1;
 272
 273         PrintDebug("NP_Enable at 0x%p\n", (void *)&(ctrl_area->NP_ENABLE));
 274
 275         // Set the Nested Page Table pointer
 276         if (v3_init_passthrough_pts(core) == -1) {
 277             PrintError("Could not initialize Nested page tables\n");
 278             return ;
 279         }
 280
 281         ctrl_area->N_CR3 = core->direct_map_pt;
 282
 283         guest_state->g_pat = 0x7040600070406ULL;
 284     }
 285
 286     /* tell the guest that we don't support SVM */
 287     v3_hook_msr(core->vm_info, SVM_VM_CR_MSR,
 288         &v3_handle_vm_cr_read,
 289         &v3_handle_vm_cr_write,
 290         core);
 291 }
 292
 293
 294 int v3_init_svm_vmcb(struct guest_info * core, v3_vm_class_t vm_class) {
 295
 296     PrintDebug("Allocating VMCB\n");
 297     core->vmm_data = (void *)Allocate_VMCB();
 298
 299     if (core->vmm_data == NULL) {
 300         PrintError("Could not allocate VMCB, Exiting...\n");
 301         return -1;
 302     }
 303
 304     if (vm_class == V3_PC_VM) {
 305         PrintDebug("Initializing VMCB (addr=%p)\n", (void *)core->vmm_data);
 306         Init_VMCB_BIOS((vmcb_t*)(core->vmm_data), core);
 307     } else {
 308         PrintError("Invalid VM class\n");
 309         return -1;
 310     }
 311
 312     return 0;
 313 }
 314
 315
 316 int v3_deinit_svm_vmcb(struct guest_info * core) {
 317     V3_FreePages(V3_PAddr(core->vmm_data), 1);
 318     return 0;
 319 }
 320
 321
 322 static int update_irq_exit_state(struct guest_info * info) {
 323     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 324
 325     // Fix for QEMU bug using EVENTINJ as an internal cache
 326     guest_ctrl->EVENTINJ.valid = 0;
 327
 328     if ((info->intr_core_state.irq_pending == 1) && (guest_ctrl->guest_ctrl.V_IRQ == 0)) {
 329
 330 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 331         PrintDebug("INTAK cycle completed for irq %d\n", info->intr_core_state.irq_vector);
 332 #endif
 333
 334         info->intr_core_state.irq_started = 1;
 335         info->intr_core_state.irq_pending = 0;
 336
 337         v3_injecting_intr(info, info->intr_core_state.irq_vector, V3_EXTERNAL_IRQ);
 338     }
 339
 340     if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 0)) {
 341 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 342         PrintDebug("Interrupt %d taken by guest\n", info->intr_core_state.irq_vector);
 343 #endif
 344
 345         // Interrupt was taken fully vectored
 346         info->intr_core_state.irq_started = 0;
 347
 348     } else if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 1)) {
 349 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 350         PrintDebug("EXIT INT INFO is set (vec=%d)\n", guest_ctrl->exit_int_info.vector);
 351 #endif
 352     }
 353
 354     return 0;
 355 }
 356
 357
 358 static int update_irq_entry_state(struct guest_info * info) {
 359     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 360
 361
 362     if (info->intr_core_state.irq_pending == 0) {
 363         guest_ctrl->guest_ctrl.V_IRQ = 0;
 364         guest_ctrl->guest_ctrl.V_INTR_VECTOR = 0;
 365     }
 366
 367     if (v3_excp_pending(info)) {
 368         uint_t excp = v3_get_excp_number(info);
 369
 370         guest_ctrl->EVENTINJ.type = SVM_INJECTION_EXCEPTION;
 371
 372         if (info->excp_state.excp_error_code_valid) {
 373             guest_ctrl->EVENTINJ.error_code = info->excp_state.excp_error_code;
 374             guest_ctrl->EVENTINJ.ev = 1;
 375 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 376             PrintDebug("Injecting exception %d with error code %x\n", excp, guest_ctrl->EVENTINJ.error_code);
 377 #endif
 378         }
 379
 380         guest_ctrl->EVENTINJ.vector = excp;
 381
 382         guest_ctrl->EVENTINJ.valid = 1;
 383
 384 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 385         PrintDebug("<%d> Injecting Exception %d (CR2=%p) (EIP=%p)\n",
 386                    (int)info->num_exits,
 387                    guest_ctrl->EVENTINJ.vector,
 388                    (void *)(addr_t)info->ctrl_regs.cr2,
 389                    (void *)(addr_t)info->rip);
 390 #endif
 391
 392         v3_injecting_excp(info, excp);
 393     } else if (info->intr_core_state.irq_started == 1) {
 394 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 395         PrintDebug("IRQ pending from previous injection\n");
 396 #endif
 397         guest_ctrl->guest_ctrl.V_IRQ = 1;
 398         guest_ctrl->guest_ctrl.V_INTR_VECTOR = info->intr_core_state.irq_vector;
 399         guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 400         guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 401
 402     } else {
 403         switch (v3_intr_pending(info)) {
 404             case V3_EXTERNAL_IRQ: {
 405                 uint32_t irq = v3_get_intr(info);
 406
 407                 guest_ctrl->guest_ctrl.V_IRQ = 1;
 408                 guest_ctrl->guest_ctrl.V_INTR_VECTOR = irq;
 409                 guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 410                 guest_ctrl->guest_ctrl.V_INTR_PRIO = 0xf;
 411
 412 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 413                 PrintDebug("Injecting Interrupt %d (EIP=%p)\n",
 414                            guest_ctrl->guest_ctrl.V_INTR_VECTOR,
 415                            (void *)(addr_t)info->rip);
 416 #endif
 417
 418                 info->intr_core_state.irq_pending = 1;
 419                 info->intr_core_state.irq_vector = irq;
 420
 421                 break;
 422             }
 423             case V3_NMI:
 424                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_NMI;
 425                 break;
 426             case V3_SOFTWARE_INTR:
 427                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_SOFT_INTR;
 428                 break;
 429             case V3_VIRTUAL_IRQ:
 430                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_IRQ;
 431                 break;
 432
 433             case V3_INVALID_INTR:
 434             default:
 435                 break;
 436         }
 437
 438     }
 439
 440     return 0;
 441 }
 442
 443
 444 /*
 445  * CAUTION and DANGER!!!
 446  *
 447  * The VMCB CANNOT(!!) be accessed outside of the clgi/stgi calls inside this function
 448  * When exectuing a symbiotic call, the VMCB WILL be overwritten, so any dependencies
 449  * on its contents will cause things to break. The contents at the time of the exit WILL
 450  * change before the exit handler is executed.
 451  */
 452 int v3_svm_enter(struct guest_info * info) {
 453     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 454     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 455     addr_t exit_code = 0, exit_info1 = 0, exit_info2 = 0;
 456
 457     // Conditionally yield the CPU if the timeslice has expired
 458     v3_yield_cond(info);
 459
 460     // Perform any additional yielding needed for time adjustment
 461     v3_adjust_time(info);
 462
 463     // disable global interrupts for vm state transition
 464     v3_clgi();
 465
 466     // Update timer devices prior to entering VM.
 467     v3_update_timers(info);
 468
 469     // Synchronize the guest state to the VMCB
 470     guest_state->cr0 = info->ctrl_regs.cr0;
 471     guest_state->cr2 = info->ctrl_regs.cr2;
 472     guest_state->cr3 = info->ctrl_regs.cr3;
 473     guest_state->cr4 = info->ctrl_regs.cr4;
 474     guest_state->dr6 = info->dbg_regs.dr6;
 475     guest_state->dr7 = info->dbg_regs.dr7;
 476     guest_ctrl->guest_ctrl.V_TPR = info->ctrl_regs.cr8 & 0xff;
 477     guest_state->rflags = info->ctrl_regs.rflags;
 478     guest_state->efer = info->ctrl_regs.efer;
 479
 480     guest_state->cpl = info->cpl;
 481
 482     v3_set_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 483
 484     guest_state->rax = info->vm_regs.rax;
 485     guest_state->rip = info->rip;
 486     guest_state->rsp = info->vm_regs.rsp;
 487
 488 #ifdef V3_CONFIG_SYMCALL
 489     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 490         update_irq_entry_state(info);
 491     }
 492 #else
 493     update_irq_entry_state(info);
 494 #endif
 495
 496
 497     /* ** */
 498
 499     /*
 500       PrintDebug("SVM Entry to CS=%p  rip=%p...\n",
 501       (void *)(addr_t)info->segments.cs.base,
 502       (void *)(addr_t)info->rip);
 503     */
 504
 505 #ifdef V3_CONFIG_SYMCALL
 506     if (info->sym_core_state.symcall_state.sym_call_active == 1) {
 507         if (guest_ctrl->guest_ctrl.V_IRQ == 1) {
 508             V3_Print("!!! Injecting Interrupt during Sym call !!!\n");
 509         }
 510     }
 511 #endif
 512
 513     v3_time_enter_vm(info);
 514     guest_ctrl->TSC_OFFSET = v3_tsc_host_offset(&info->time_state);
 515
 516     //V3_Print("Calling v3_svm_launch\n");
 517
 518     v3_svm_launch((vmcb_t *)V3_PAddr(info->vmm_data), &(info->vm_regs), (vmcb_t *)host_vmcbs[V3_Get_CPU()]);
 519
 520     //V3_Print("SVM Returned: Exit Code: %x, guest_rip=%lx\n", (uint32_t)(guest_ctrl->exit_code), (unsigned long)guest_state->rip);
 521
 522     v3_last_exit = (uint32_t)(guest_ctrl->exit_code);
 523
 524     // Immediate exit from VM time bookkeeping
 525     v3_time_exit_vm(info);
 526
 527     info->num_exits++;
 528
 529     // Save Guest state from VMCB
 530     info->rip = guest_state->rip;
 531     info->vm_regs.rsp = guest_state->rsp;
 532     info->vm_regs.rax = guest_state->rax;
 533
 534     info->cpl = guest_state->cpl;
 535
 536     info->ctrl_regs.cr0 = guest_state->cr0;
 537     info->ctrl_regs.cr2 = guest_state->cr2;
 538     info->ctrl_regs.cr3 = guest_state->cr3;
 539     info->ctrl_regs.cr4 = guest_state->cr4;
 540     info->dbg_regs.dr6 = guest_state->dr6;
 541     info->dbg_regs.dr7 = guest_state->dr7;
 542     info->ctrl_regs.cr8 = guest_ctrl->guest_ctrl.V_TPR;
 543     info->ctrl_regs.rflags = guest_state->rflags;
 544     info->ctrl_regs.efer = guest_state->efer;
 545
 546     v3_get_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 547     info->cpu_mode = v3_get_vm_cpu_mode(info);
 548     info->mem_mode = v3_get_vm_mem_mode(info);
 549     /* ** */
 550
 551
 552     // save exit info here
 553     exit_code = guest_ctrl->exit_code;
 554     exit_info1 = guest_ctrl->exit_info1;
 555     exit_info2 = guest_ctrl->exit_info2;
 556
 557
 558 #ifdef V3_CONFIG_SYMCALL
 559     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 560         update_irq_exit_state(info);
 561     }
 562 #else
 563     update_irq_exit_state(info);
 564 #endif
 565
 566
 567     // reenable global interrupts after vm exit
 568     v3_stgi();
 569
 570
 571     // Conditionally yield the CPU if the timeslice has expired
 572     v3_yield_cond(info);
 573
 574
 575     {
 576         int ret = v3_handle_svm_exit(info, exit_code, exit_info1, exit_info2);
 577
 578         if (ret != 0) {
 579             PrintError("Error in SVM exit handler (ret=%d)\n", ret);
 580             PrintError("  last Exit was %d (exit code=0x%llx)\n", v3_last_exit, (uint64_t) exit_code);
 581             return -1;
 582         }
 583     }
 584
 585
 586     return 0;
 587 }
 588
 589
 590 int v3_start_svm_guest(struct guest_info * info) {
 591     //    vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 592     //  vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 593
 594     PrintDebug("Starting SVM core %u (on logical core %u)\n", info->vcpu_id, info->pcpu_id);
 595
 596     if (info->vcpu_id == 0) {
 597         info->core_run_state = CORE_RUNNING;
 598         info->vm_info->run_state = VM_RUNNING;
 599     } else  {
 600         PrintDebug("SVM core %u (on %u): Waiting for core initialization\n", info->vcpu_id, info->pcpu_id);
 601
 602         while (info->core_run_state == CORE_STOPPED) {
 603             v3_yield(info);
 604             //PrintDebug("SVM core %u: still waiting for INIT\n", info->vcpu_id);
 605         }
 606
 607         PrintDebug("SVM core %u(on %u) initialized\n", info->vcpu_id, info->pcpu_id);
 608     }
 609
 610     PrintDebug("SVM core %u(on %u): I am starting at CS=0x%x (base=0x%p, limit=0x%x),  RIP=0x%p\n",
 611                info->vcpu_id, info->pcpu_id,
 612                info->segments.cs.selector, (void *)(info->segments.cs.base),
 613                info->segments.cs.limit, (void *)(info->rip));
 614
 615
 616
 617     PrintDebug("SVM core %u: Launching SVM VM (vmcb=%p) (on cpu %u)\n",
 618                info->vcpu_id, (void *)info->vmm_data, info->pcpu_id);
 619     //PrintDebugVMCB((vmcb_t*)(info->vmm_data));
 620
 621     v3_start_time(info);
 622
 623     while (1) {
 624
 625         if (info->vm_info->run_state == VM_STOPPED) {
 626             info->core_run_state = CORE_STOPPED;
 627             break;
 628         }
 629
 630         if (v3_svm_enter(info) == -1) {
 631             vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 632             addr_t host_addr;
 633             addr_t linear_addr = 0;
 634
 635             info->vm_info->run_state = VM_ERROR;
 636
 637             V3_Print("SVM core %u: SVM ERROR!!\n", info->vcpu_id);
 638
 639             v3_print_guest_state(info);
 640
 641             V3_Print("SVM core %u: SVM Exit Code: %p\n", info->vcpu_id, (void *)(addr_t)guest_ctrl->exit_code);
 642
 643             V3_Print("SVM core %u: exit_info1 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info1));
 644             V3_Print("SVM core %u: exit_info1 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info1)) + 4));
 645
 646             V3_Print("SVM core %u: exit_info2 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info2));
 647             V3_Print("SVM core %u: exit_info2 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info2)) + 4));
 648
 649             linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
 650
 651             if (info->mem_mode == PHYSICAL_MEM) {
 652                 v3_gpa_to_hva(info, linear_addr, &host_addr);
 653             } else if (info->mem_mode == VIRTUAL_MEM) {
 654                 v3_gva_to_hva(info, linear_addr, &host_addr);
 655             }
 656
 657             V3_Print("SVM core %u: Host Address of rip = 0x%p\n", info->vcpu_id, (void *)host_addr);
 658
 659             V3_Print("SVM core %u: Instr (15 bytes) at %p:\n", info->vcpu_id, (void *)host_addr);
 660             v3_dump_mem((uint8_t *)host_addr, 15);
 661
 662             v3_print_stack(info);
 663
 664             break;
 665         }
 666
 667
 668         if (info->vm_info->run_state == VM_STOPPED) {
 669             info->core_run_state = CORE_STOPPED;
 670             break;
 671         }
 672
 673
 674
 675 /*
 676         if ((info->num_exits % 50000) == 0) {
 677             V3_Print("SVM Exit number %d\n", (uint32_t)info->num_exits);
 678             v3_print_guest_state(info);
 679         }
 680 */
 681
 682     }
 683
 684     // Need to take down the other cores on error...
 685
 686     return 0;
 687 }
 688
 689
 690
 691
 692 int v3_reset_svm_vm_core(struct guest_info * core, addr_t rip) {
 693     // init vmcb_bios
 694
 695     // Write the RIP, CS, and descriptor
 696     // assume the rest is already good to go
 697     //
 698     // vector VV -> rip at 0
 699     //              CS = VV00
 700     //  This means we start executing at linear address VV000
 701     //
 702     // So the selector needs to be VV00
 703     // and the base needs to be VV000
 704     //
 705     core->rip = 0;
 706     core->segments.cs.selector = rip << 8;
 707     core->segments.cs.limit = 0xffff;
 708     core->segments.cs.base = rip << 12;
 709
 710     return 0;
 711 }
 712
 713
 714
 715
 716
 717
 718 /* Checks machine SVM capability */
 719 /* Implemented from: AMD Arch Manual 3, sect 15.4 */
 720 int v3_is_svm_capable() {
 721     uint_t vm_cr_low = 0, vm_cr_high = 0;
 722     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 723
 724     v3_cpuid(CPUID_EXT_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 725
 726     PrintDebug("CPUID_EXT_FEATURE_IDS_ecx=0x%x\n", ecx);
 727
 728     if ((ecx & CPUID_EXT_FEATURE_IDS_ecx_svm_avail) == 0) {
 729       V3_Print("SVM Not Available\n");
 730       return 0;
 731     }  else {
 732         v3_get_msr(SVM_VM_CR_MSR, &vm_cr_high, &vm_cr_low);
 733
 734         PrintDebug("SVM_VM_CR_MSR = 0x%x 0x%x\n", vm_cr_high, vm_cr_low);
 735
 736         if ((vm_cr_low & SVM_VM_CR_MSR_svmdis) == 1) {
 737             V3_Print("SVM is available but is disabled.\n");
 738
 739             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 740
 741             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 742
 743             if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_svml) == 0) {
 744                 V3_Print("SVM BIOS Disabled, not unlockable\n");
 745             } else {
 746                 V3_Print("SVM is locked with a key\n");
 747             }
 748             return 0;
 749
 750         } else {
 751             V3_Print("SVM is available and  enabled.\n");
 752
 753             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 754             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_eax=0x%x\n", eax);
 755             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ebx=0x%x\n", ebx);
 756             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_ecx=0x%x\n", ecx);
 757             PrintDebug("CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 758
 759             return 1;
 760         }
 761     }
 762 }
 763
 764 static int has_svm_nested_paging() {
 765     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 766
 767     v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 768
 769     //PrintDebug("CPUID_EXT_FEATURE_IDS_edx=0x%x\n", edx);
 770
 771     if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_np) == 0) {
 772         V3_Print("SVM Nested Paging not supported\n");
 773         return 0;
 774     } else {
 775         V3_Print("SVM Nested Paging supported\n");
 776         return 1;
 777     }
 778 }
 779
 780
 781
 782 void v3_init_svm_cpu(int cpu_id) {
 783     reg_ex_t msr;
 784     extern v3_cpu_arch_t v3_cpu_types[];
 785
 786     // Enable SVM on the CPU
 787     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 788     msr.e_reg.low |= EFER_MSR_svm_enable;
 789     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 790
 791     V3_Print("SVM Enabled\n");
 792
 793     // Setup the host state save area
 794     host_vmcbs[cpu_id] = (addr_t)V3_AllocPages(4);
 795
 796     /* 64-BIT-ISSUE */
 797     //  msr.e_reg.high = 0;
 798     //msr.e_reg.low = (uint_t)host_vmcb;
 799     msr.r_reg = host_vmcbs[cpu_id];
 800
 801     PrintDebug("Host State being saved at %p\n", (void *)host_vmcbs[cpu_id]);
 802     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 803
 804
 805     if (has_svm_nested_paging() == 1) {
 806         v3_cpu_types[cpu_id] = V3_SVM_REV3_CPU;
 807     } else {
 808         v3_cpu_types[cpu_id] = V3_SVM_CPU;
 809     }
 810 }
 811
 812
 813
 814 void v3_deinit_svm_cpu(int cpu_id) {
 815     reg_ex_t msr;
 816     extern v3_cpu_arch_t v3_cpu_types[];
 817
 818     // reset SVM_VM_HSAVE_PA_MSR
 819     // Does setting it to NULL disable??
 820     msr.r_reg = 0;
 821     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
 822
 823     // Disable SVM?
 824     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
 825     msr.e_reg.low &= ~EFER_MSR_svm_enable;
 826     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
 827
 828     v3_cpu_types[cpu_id] = V3_INVALID_CPU;
 829
 830     V3_FreePages((void *)host_vmcbs[cpu_id], 4);
 831
 832     V3_Print("Host CPU %d host area freed, and SVM disabled\n", cpu_id);
 833     return;
 834 }
 835
 836
 837
 838
 839
 840
 841
 842
 843
 844
 845
 846
 847
 848
 849
 850
 851
 852
 853
 854
 855
 856
 857
 858
 859
 860
 861
 862
 863
 864
 865
 866
 867
 868
 869
 870
 871
 872
 873
 874
 875
 876
 877
 878
 879
 880
 881
 882
 883
 884
 885 #if 0
 886 /*
 887  * Test VMSAVE/VMLOAD Latency
 888  */
 889 #define vmsave ".byte 0x0F,0x01,0xDB ; "
 890 #define vmload ".byte 0x0F,0x01,0xDA ; "
 891 {
 892     uint32_t start_lo, start_hi;
 893     uint32_t end_lo, end_hi;
 894     uint64_t start, end;
 895
 896     __asm__ __volatile__ (
 897                           "rdtsc ; "
 898                           "movl %%eax, %%esi ; "
 899                           "movl %%edx, %%edi ; "
 900                           "movq  %%rcx, %%rax ; "
 901                           vmsave
 902                           "rdtsc ; "
 903                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 904                           : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 905                           );
 906
 907     start = start_hi;
 908     start <<= 32;
 909     start += start_lo;
 910
 911     end = end_hi;
 912     end <<= 32;
 913     end += end_lo;
 914
 915     PrintDebug("VMSave Cycle Latency: %d\n", (uint32_t)(end - start));
 916
 917     __asm__ __volatile__ (
 918                           "rdtsc ; "
 919                           "movl %%eax, %%esi ; "
 920                           "movl %%edx, %%edi ; "
 921                           "movq  %%rcx, %%rax ; "
 922                           vmload
 923                           "rdtsc ; "
 924                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
 925                               : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
 926                               );
 927
 928         start = start_hi;
 929         start <<= 32;
 930         start += start_lo;
 931
 932         end = end_hi;
 933         end <<= 32;
 934         end += end_lo;
 935
 936
 937         PrintDebug("VMLoad Cycle Latency: %d\n", (uint32_t)(end - start));
 938     }
 939     /* End Latency Test */
 940
 941 #endif
 942
 943
 944
 945
 946
 947
 948
 949 #if 0
 950 void Init_VMCB_pe(vmcb_t *vmcb, struct guest_info vm_info) {
 951   vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
 952   vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
 953   uint_t i = 0;
 954
 955
 956   guest_state->rsp = vm_info.vm_regs.rsp;
 957   guest_state->rip = vm_info.rip;
 958
 959
 960   /* I pretty much just gutted this from TVMM */
 961   /* Note: That means its probably wrong */
 962
 963   // set the segment registers to mirror ours
 964   guest_state->cs.selector = 1<<3;
 965   guest_state->cs.attrib.fields.type = 0xa; // Code segment+read
 966   guest_state->cs.attrib.fields.S = 1;
 967   guest_state->cs.attrib.fields.P = 1;
 968   guest_state->cs.attrib.fields.db = 1;
 969   guest_state->cs.attrib.fields.G = 1;
 970   guest_state->cs.limit = 0xfffff;
 971   guest_state->cs.base = 0;
 972
 973   struct vmcb_selector *segregs [] = {&(guest_state->ss), &(guest_state->ds), &(guest_state->es), &(guest_state->fs), &(guest_state->gs), NULL};
 974   for ( i = 0; segregs[i] != NULL; i++) {
 975     struct vmcb_selector * seg = segregs[i];
 976
 977     seg->selector = 2<<3;
 978     seg->attrib.fields.type = 0x2; // Data Segment+read/write
 979     seg->attrib.fields.S = 1;
 980     seg->attrib.fields.P = 1;
 981     seg->attrib.fields.db = 1;
 982     seg->attrib.fields.G = 1;
 983     seg->limit = 0xfffff;
 984     seg->base = 0;
 985   }
 986
 987
 988   {
 989     /* JRL THIS HAS TO GO */
 990
 991     //    guest_state->tr.selector = GetTR_Selector();
 992     guest_state->tr.attrib.fields.type = 0x9;
 993     guest_state->tr.attrib.fields.P = 1;
 994     // guest_state->tr.limit = GetTR_Limit();
 995     //guest_state->tr.base = GetTR_Base();// - 0x2000;
 996     /* ** */
 997   }
 998
 999
1000   /* ** */
1001
1002
1003   guest_state->efer |= EFER_MSR_svm_enable;
1004   guest_state->rflags = 0x00000002; // The reserved bit is always 1
1005   ctrl_area->svm_instrs.VMRUN = 1;
1006   guest_state->cr0 = 0x00000001;    // PE
1007   ctrl_area->guest_ASID = 1;
1008
1009
1010   //  guest_state->cpl = 0;
1011
1012
1013
1014   // Setup exits
1015
1016   ctrl_area->cr_writes.cr4 = 1;
1017
1018   ctrl_area->exceptions.de = 1;
1019   ctrl_area->exceptions.df = 1;
1020   ctrl_area->exceptions.pf = 1;
1021   ctrl_area->exceptions.ts = 1;
1022   ctrl_area->exceptions.ss = 1;
1023   ctrl_area->exceptions.ac = 1;
1024   ctrl_area->exceptions.mc = 1;
1025   ctrl_area->exceptions.gp = 1;
1026   ctrl_area->exceptions.ud = 1;
1027   ctrl_area->exceptions.np = 1;
1028   ctrl_area->exceptions.of = 1;
1029   ctrl_area->exceptions.nmi = 1;
1030
1031
1032
1033   ctrl_area->instrs.IOIO_PROT = 1;
1034   ctrl_area->IOPM_BASE_PA = (uint_t)V3_AllocPages(3);
1035
1036   {
1037     reg_ex_t tmp_reg;
1038     tmp_reg.r_reg = ctrl_area->IOPM_BASE_PA;
1039     memset((void*)(tmp_reg.e_reg.low), 0xffffffff, PAGE_SIZE * 2);
1040   }
1041
1042   ctrl_area->instrs.INTR = 1;
1043
1044
1045   {
1046     char gdt_buf[6];
1047     char idt_buf[6];
1048
1049     memset(gdt_buf, 0, 6);
1050     memset(idt_buf, 0, 6);
1051
1052
1053     uint_t gdt_base, idt_base;
1054     ushort_t gdt_limit, idt_limit;
1055
1056     GetGDTR(gdt_buf);
1057     gdt_base = *(ulong_t*)((uchar_t*)gdt_buf + 2) & 0xffffffff;
1058     gdt_limit = *(ushort_t*)(gdt_buf) & 0xffff;
1059     PrintDebug("GDT: base: %x, limit: %x\n", gdt_base, gdt_limit);
1060
1061     GetIDTR(idt_buf);
1062     idt_base = *(ulong_t*)(idt_buf + 2) & 0xffffffff;
1063     idt_limit = *(ushort_t*)(idt_buf) & 0xffff;
1064     PrintDebug("IDT: base: %x, limit: %x\n",idt_base, idt_limit);
1065
1066
1067     // gdt_base -= 0x2000;
1068     //idt_base -= 0x2000;
1069
1070     guest_state->gdtr.base = gdt_base;
1071     guest_state->gdtr.limit = gdt_limit;
1072     guest_state->idtr.base = idt_base;
1073     guest_state->idtr.limit = idt_limit;
1074
1075
1076   }
1077
1078
1079   // also determine if CPU supports nested paging
1080   /*
1081   if (vm_info.page_tables) {
1082     //   if (0) {
1083     // Flush the TLB on entries/exits
1084     ctrl_area->TLB_CONTROL = 1;
1085
1086     // Enable Nested Paging
1087     ctrl_area->NP_ENABLE = 1;
1088
1089     PrintDebug("NP_Enable at 0x%x\n", &(ctrl_area->NP_ENABLE));
1090
1091         // Set the Nested Page Table pointer
1092     ctrl_area->N_CR3 |= ((addr_t)vm_info.page_tables & 0xfffff000);
1093
1094
1095     //   ctrl_area->N_CR3 = Get_CR3();
1096     // guest_state->cr3 |= (Get_CR3() & 0xfffff000);
1097
1098     guest_state->g_pat = 0x7040600070406ULL;
1099
1100     PrintDebug("Set Nested CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(ctrl_area->N_CR3)), (uint_t)*((unsigned char *)&(ctrl_area->N_CR3) + 4));
1101     PrintDebug("Set Guest CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(guest_state->cr3)), (uint_t)*((unsigned char *)&(guest_state->cr3) + 4));
1102     // Enable Paging
1103     //    guest_state->cr0 |= 0x80000000;
1104   }
1105   */
1106
1107 }
1108
1109
1110
1111
1112
1113 #endif
1114
1115