palacios/src/palacios/svm.c

   1 /*
   2  * This file is part of the Palacios Virtual Machine Monitor developed
   3  * by the V3VEE Project with funding from the United States National
   4  * Science Foundation and the Department of Energy.
   5  *
   6  * The V3VEE Project is a joint project between Northwestern University
   7  * and the University of New Mexico.  You can find out more at
   8  * http://www.v3vee.org
   9  *
  10  * Copyright (c) 2008, Jack Lange <jarusl@cs.northwestern.edu>
  11  * Copyright (c) 2008, The V3VEE Project <http://www.v3vee.org>
  12  * All rights reserved.
  13  *
  14  * Author: Jack Lange <jarusl@cs.northwestern.edu>
  15  *
  16  * This is free software.  You are permitted to use,
  17  * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
  18  */
  19
  20
  21
  22 #include <palacios/svm.h>
  23 #include <palacios/vmm.h>
  24
  25 #include <palacios/vmcb.h>
  26 #include <palacios/vmm_mem.h>
  27 #include <palacios/vmm_paging.h>
  28 #include <palacios/svm_handler.h>
  29
  30 #include <palacios/vmm_debug.h>
  31 #include <palacios/vm_guest_mem.h>
  32
  33 #include <palacios/vmm_decoder.h>
  34 #include <palacios/vmm_string.h>
  35 #include <palacios/vmm_lowlevel.h>
  36 #include <palacios/svm_msr.h>
  37
  38 #include <palacios/vmm_rbtree.h>
  39 #include <palacios/vmm_barrier.h>
  40 #include <palacios/vmm_debug.h>
  41
  42
  43
  44 #ifdef V3_CONFIG_CHECKPOINT
  45 #include <palacios/vmm_checkpoint.h>
  46 #endif
  47
  48 #include <palacios/vmm_direct_paging.h>
  49
  50 #include <palacios/vmm_ctrl_regs.h>
  51 #include <palacios/svm_io.h>
  52
  53 #include <palacios/vmm_sprintf.h>
  54
  55
  56 #ifndef V3_CONFIG_DEBUG_SVM
  57 #undef PrintDebug
  58 #define PrintDebug(fmt, args...)
  59 #endif
  60
  61
  62 uint32_t v3_last_exit;
  63
  64 // This is a global pointer to the host's VMCB
  65 static addr_t host_vmcbs[V3_CONFIG_MAX_CPUS] = { [0 ... V3_CONFIG_MAX_CPUS - 1] = 0};
  66
  67
  68
  69 extern void v3_stgi();
  70 extern void v3_clgi();
  71 //extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, uint64_t * fs, uint64_t * gs);
  72 extern int v3_svm_launch(vmcb_t * vmcb, struct v3_gprs * vm_regs, vmcb_t * host_vmcb);
  73
  74
  75 static vmcb_t * Allocate_VMCB() {
  76     vmcb_t * vmcb_page = NULL;
  77     addr_t vmcb_pa = (addr_t)V3_AllocPages(1);
  78
  79     if ((void *)vmcb_pa == NULL) {
  80       PrintError(VM_NONE, VCORE_NONE, "Error allocating VMCB\n");
  81         return NULL;
  82     }
  83
  84     vmcb_page = (vmcb_t *)V3_VAddr((void *)vmcb_pa);
  85
  86     memset(vmcb_page, 0, 4096);
  87
  88     return vmcb_page;
  89 }
  90
  91
  92 static int v3_svm_handle_efer_write(struct guest_info * core, uint_t msr, struct v3_msr src, void * priv_data)
  93 {
  94     int status;
  95
  96     // Call arch-independent handler
  97     if ((status = v3_handle_efer_write(core, msr, src, priv_data)) != 0) {
  98         return status;
  99     }
 100
 101     // SVM-specific code
 102     {
 103         // Ensure that hardware visible EFER.SVME bit is set (SVM Enable)
 104         struct efer_64 * hw_efer = (struct efer_64 *)&(core->ctrl_regs.efer);
 105         hw_efer->svme = 1;
 106     }
 107
 108     return 0;
 109 }
 110
 111
 112 static void Init_VMCB_BIOS(vmcb_t * vmcb, struct guest_info * core) {
 113     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
 114     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
 115     uint_t i;
 116
 117
 118     //
 119     ctrl_area->svm_instrs.VMRUN = 1;
 120     ctrl_area->svm_instrs.VMMCALL = 1;
 121     ctrl_area->svm_instrs.VMLOAD = 1;
 122     ctrl_area->svm_instrs.VMSAVE = 1;
 123     ctrl_area->svm_instrs.STGI = 1;
 124     ctrl_area->svm_instrs.CLGI = 1;
 125     ctrl_area->svm_instrs.SKINIT = 1;
 126     ctrl_area->svm_instrs.ICEBP = 1;
 127     ctrl_area->svm_instrs.WBINVD = 1;
 128     ctrl_area->svm_instrs.MONITOR = 1;
 129     ctrl_area->svm_instrs.MWAIT_always = 1;
 130     ctrl_area->svm_instrs.MWAIT_if_armed = 1;
 131     ctrl_area->instrs.INVLPGA = 1;
 132     ctrl_area->instrs.CPUID = 1;
 133
 134     ctrl_area->instrs.HLT = 1;
 135
 136     /* Set at VMM launch as needed */
 137     ctrl_area->instrs.RDTSC = 0;
 138     ctrl_area->svm_instrs.RDTSCP = 0;
 139
 140     // guest_state->cr0 = 0x00000001;    // PE
 141
 142     /*
 143       ctrl_area->exceptions.de = 1;
 144       ctrl_area->exceptions.df = 1;
 145
 146       ctrl_area->exceptions.ts = 1;
 147       ctrl_area->exceptions.ss = 1;
 148       ctrl_area->exceptions.ac = 1;
 149       ctrl_area->exceptions.mc = 1;
 150       ctrl_area->exceptions.gp = 1;
 151       ctrl_area->exceptions.ud = 1;
 152       ctrl_area->exceptions.np = 1;
 153       ctrl_area->exceptions.of = 1;
 154
 155       ctrl_area->exceptions.nmi = 1;
 156     */
 157
 158
 159     ctrl_area->instrs.NMI = 1;
 160     ctrl_area->instrs.SMI = 0; // allow SMIs to run in guest
 161     ctrl_area->instrs.INIT = 1;
 162     //    ctrl_area->instrs.PAUSE = 1;
 163     ctrl_area->instrs.shutdown_evts = 1;
 164
 165
 166     /* DEBUG FOR RETURN CODE */
 167     ctrl_area->exit_code = 1;
 168
 169
 170     /* Setup Guest Machine state */
 171
 172     core->vm_regs.rsp = 0x00;
 173     core->rip = 0xfff0;
 174
 175     core->vm_regs.rdx = 0x00000f00;
 176
 177
 178     core->cpl = 0;
 179
 180     core->ctrl_regs.rflags = 0x00000002; // The reserved bit is always 1
 181     core->ctrl_regs.cr0 = 0x60010010; // Set the WP flag so the memory hooks work in real-mode
 182     core->ctrl_regs.efer |= EFER_MSR_svm_enable;
 183
 184
 185
 186
 187
 188     core->segments.cs.selector = 0xf000;
 189     core->segments.cs.limit = 0xffff;
 190     core->segments.cs.base = 0x0000000f0000LL;
 191
 192     // (raw attributes = 0xf3)
 193     core->segments.cs.type = 0x3;
 194     core->segments.cs.system = 0x1;
 195     core->segments.cs.dpl = 0x3;
 196     core->segments.cs.present = 1;
 197
 198
 199
 200     struct v3_segment * segregs [] = {&(core->segments.ss), &(core->segments.ds),
 201                                       &(core->segments.es), &(core->segments.fs),
 202                                       &(core->segments.gs), NULL};
 203
 204     for ( i = 0; segregs[i] != NULL; i++) {
 205         struct v3_segment * seg = segregs[i];
 206
 207         seg->selector = 0x0000;
 208         //    seg->base = seg->selector << 4;
 209         seg->base = 0x00000000;
 210         seg->limit = ~0u;
 211
 212         // (raw attributes = 0xf3)
 213         seg->type = 0x3;
 214         seg->system = 0x1;
 215         seg->dpl = 0x3;
 216         seg->present = 1;
 217     }
 218
 219     core->segments.gdtr.limit = 0x0000ffff;
 220     core->segments.gdtr.base = 0x0000000000000000LL;
 221     core->segments.idtr.limit = 0x0000ffff;
 222     core->segments.idtr.base = 0x0000000000000000LL;
 223
 224     core->segments.ldtr.selector = 0x0000;
 225     core->segments.ldtr.limit = 0x0000ffff;
 226     core->segments.ldtr.base = 0x0000000000000000LL;
 227     core->segments.tr.selector = 0x0000;
 228     core->segments.tr.limit = 0x0000ffff;
 229     core->segments.tr.base = 0x0000000000000000LL;
 230
 231
 232     core->dbg_regs.dr6 = 0x00000000ffff0ff0LL;
 233     core->dbg_regs.dr7 = 0x0000000000000400LL;
 234
 235
 236     ctrl_area->IOPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->io_map.arch_data);
 237     ctrl_area->instrs.IOIO_PROT = 1;
 238
 239     ctrl_area->MSRPM_BASE_PA = (addr_t)V3_PAddr(core->vm_info->msr_map.arch_data);
 240     ctrl_area->instrs.MSR_PROT = 1;
 241
 242
 243     PrintDebug(core->vm_info, core, "Exiting on interrupts\n");
 244     ctrl_area->guest_ctrl.V_INTR_MASKING = 1;
 245     ctrl_area->instrs.INTR = 1;
 246     // The above also assures the TPR changes (CR8) are only virtual
 247
 248
 249     // However, we need to see TPR writes since they will
 250     // affect the virtual apic
 251     // we reflect out cr8 to ctrl_regs->apic_tpr
 252     ctrl_area->cr_reads.cr8 = 1;
 253     ctrl_area->cr_writes.cr8 = 1;
 254     // We will do all TPR comparisons in the virtual apic
 255     // We also do not want the V_TPR to be able to mask the PIC
 256     ctrl_area->guest_ctrl.V_IGN_TPR = 1;
 257
 258
 259
 260     v3_hook_msr(core->vm_info, EFER_MSR,
 261                 &v3_handle_efer_read,
 262                 &v3_svm_handle_efer_write,
 263                 core);
 264
 265     if (core->shdw_pg_mode == SHADOW_PAGING) {
 266         PrintDebug(core->vm_info, core, "Creating initial shadow page table\n");
 267
 268         /* JRL: This is a performance killer, and a simplistic solution */
 269         /* We need to fix this */
 270         ctrl_area->TLB_CONTROL = 1;
 271         ctrl_area->guest_ASID = 1;
 272
 273
 274         if (v3_init_passthrough_pts(core) == -1) {
 275             PrintError(core->vm_info, core, "Could not initialize passthrough page tables\n");
 276             return ;
 277         }
 278
 279
 280         core->shdw_pg_state.guest_cr0 = 0x0000000000000010LL;
 281         PrintDebug(core->vm_info, core, "Created\n");
 282
 283         core->ctrl_regs.cr0 |= 0x80000000;
 284         core->ctrl_regs.cr3 = core->direct_map_pt;
 285
 286         ctrl_area->cr_reads.cr0 = 1;
 287         ctrl_area->cr_writes.cr0 = 1;
 288         //ctrl_area->cr_reads.cr4 = 1;
 289         ctrl_area->cr_writes.cr4 = 1;
 290         ctrl_area->cr_reads.cr3 = 1;
 291         ctrl_area->cr_writes.cr3 = 1;
 292
 293
 294         ctrl_area->instrs.INVLPG = 1;
 295
 296         ctrl_area->exceptions.pf = 1;
 297
 298         guest_state->g_pat = 0x7040600070406ULL;
 299
 300
 301     } else if (core->shdw_pg_mode == NESTED_PAGING) {
 302         // Flush the TLB on entries/exits
 303         ctrl_area->TLB_CONTROL = 1;
 304         ctrl_area->guest_ASID = 1;
 305
 306         // Enable Nested Paging
 307         ctrl_area->NP_ENABLE = 1;
 308
 309         PrintDebug(core->vm_info, core, "NP_Enable at 0x%p\n", (void *)&(ctrl_area->NP_ENABLE));
 310
 311         // Set the Nested Page Table pointer
 312         if (v3_init_passthrough_pts(core) == -1) {
 313             PrintError(core->vm_info, core, "Could not initialize Nested page tables\n");
 314             return ;
 315         }
 316
 317         ctrl_area->N_CR3 = core->direct_map_pt;
 318
 319         guest_state->g_pat = 0x7040600070406ULL;
 320     }
 321
 322     /* tell the guest that we don't support SVM */
 323     v3_hook_msr(core->vm_info, SVM_VM_CR_MSR,
 324         &v3_handle_vm_cr_read,
 325         &v3_handle_vm_cr_write,
 326         core);
 327
 328
 329     {
 330 #define INT_PENDING_AMD_MSR             0xc0010055
 331
 332         v3_hook_msr(core->vm_info, IA32_STAR_MSR, NULL, NULL, NULL);
 333         v3_hook_msr(core->vm_info, IA32_LSTAR_MSR, NULL, NULL, NULL);
 334         v3_hook_msr(core->vm_info, IA32_FMASK_MSR, NULL, NULL, NULL);
 335         v3_hook_msr(core->vm_info, IA32_KERN_GS_BASE_MSR, NULL, NULL, NULL);
 336         v3_hook_msr(core->vm_info, IA32_CSTAR_MSR, NULL, NULL, NULL);
 337
 338         v3_hook_msr(core->vm_info, SYSENTER_CS_MSR, NULL, NULL, NULL);
 339         v3_hook_msr(core->vm_info, SYSENTER_ESP_MSR, NULL, NULL, NULL);
 340         v3_hook_msr(core->vm_info, SYSENTER_EIP_MSR, NULL, NULL, NULL);
 341
 342
 343         v3_hook_msr(core->vm_info, FS_BASE_MSR, NULL, NULL, NULL);
 344         v3_hook_msr(core->vm_info, GS_BASE_MSR, NULL, NULL, NULL);
 345
 346         // Passthrough read operations are ok.
 347         v3_hook_msr(core->vm_info, INT_PENDING_AMD_MSR, NULL, v3_msr_unhandled_write, NULL);
 348     }
 349 }
 350
 351
 352 int v3_init_svm_vmcb(struct guest_info * core, v3_vm_class_t vm_class) {
 353
 354     PrintDebug(core->vm_info, core, "Allocating VMCB\n");
 355     core->vmm_data = (void *)Allocate_VMCB();
 356
 357     if (core->vmm_data == NULL) {
 358         PrintError(core->vm_info, core, "Could not allocate VMCB, Exiting...\n");
 359         return -1;
 360     }
 361
 362     if (vm_class == V3_PC_VM) {
 363         PrintDebug(core->vm_info, core, "Initializing VMCB (addr=%p)\n", (void *)core->vmm_data);
 364         Init_VMCB_BIOS((vmcb_t*)(core->vmm_data), core);
 365     } else {
 366         PrintError(core->vm_info, core, "Invalid VM class\n");
 367         return -1;
 368     }
 369
 370     core->core_run_state = CORE_STOPPED;
 371
 372     return 0;
 373 }
 374
 375
 376 int v3_deinit_svm_vmcb(struct guest_info * core) {
 377     V3_FreePages(V3_PAddr(core->vmm_data), 1);
 378     return 0;
 379 }
 380
 381
 382 #ifdef V3_CONFIG_CHECKPOINT
 383 int v3_svm_save_core(struct guest_info * core, void * ctx){
 384
 385   vmcb_saved_state_t * guest_area = GET_VMCB_SAVE_STATE_AREA(core->vmm_data);
 386
 387   // Special case saves of data we need immediate access to
 388   // in some cases
 389   V3_CHKPT_SAVE(ctx, "CPL", core->cpl, failout);
 390   V3_CHKPT_SAVE(ctx,"STAR", guest_area->star, failout);
 391   V3_CHKPT_SAVE(ctx,"CSTAR", guest_area->cstar, failout);
 392   V3_CHKPT_SAVE(ctx,"LSTAR", guest_area->lstar, failout);
 393   V3_CHKPT_SAVE(ctx,"SFMASK", guest_area->sfmask, failout);
 394   V3_CHKPT_SAVE(ctx,"KERNELGSBASE", guest_area->KernelGsBase, failout);
 395   V3_CHKPT_SAVE(ctx,"SYSENTER_CS", guest_area->sysenter_cs, failout);
 396   V3_CHKPT_SAVE(ctx,"SYSENTER_ESP", guest_area->sysenter_esp, failout);
 397   V3_CHKPT_SAVE(ctx,"SYSENTER_EIP", guest_area->sysenter_eip, failout);
 398
 399 // and then we save the whole enchilada
 400   if (v3_chkpt_save(ctx, "VMCB_DATA", PAGE_SIZE, core->vmm_data)) {
 401     PrintError(core->vm_info, core, "Could not save SVM vmcb\n");
 402     goto failout;
 403   }
 404
 405   return 0;
 406
 407  failout:
 408   PrintError(core->vm_info, core, "Failed to save SVM state for core\n");
 409   return -1;
 410
 411 }
 412
 413 int v3_svm_load_core(struct guest_info * core, void * ctx){
 414
 415
 416   vmcb_saved_state_t * guest_area = GET_VMCB_SAVE_STATE_AREA(core->vmm_data);
 417
 418   // Reload what we special cased, which we will overwrite in a minute
 419   V3_CHKPT_LOAD(ctx, "CPL", core->cpl, failout);
 420   V3_CHKPT_LOAD(ctx,"STAR", guest_area->star, failout);
 421   V3_CHKPT_LOAD(ctx,"CSTAR", guest_area->cstar, failout);
 422   V3_CHKPT_LOAD(ctx,"LSTAR", guest_area->lstar, failout);
 423   V3_CHKPT_LOAD(ctx,"SFMASK", guest_area->sfmask, failout);
 424   V3_CHKPT_LOAD(ctx,"KERNELGSBASE", guest_area->KernelGsBase, failout);
 425   V3_CHKPT_LOAD(ctx,"SYSENTER_CS", guest_area->sysenter_cs, failout);
 426   V3_CHKPT_LOAD(ctx,"SYSENTER_ESP", guest_area->sysenter_esp, failout);
 427   V3_CHKPT_LOAD(ctx,"SYSENTER_EIP", guest_area->sysenter_eip, failout);
 428
 429   // and then we load the whole enchilada
 430   if (v3_chkpt_load(ctx, "VMCB_DATA", PAGE_SIZE, core->vmm_data)) {
 431     PrintError(core->vm_info, core, "Could not load SVM vmcb\n");
 432     goto failout;
 433   }
 434
 435   return 0;
 436
 437  failout:
 438   PrintError(core->vm_info, core, "Failed to save SVM state for core\n");
 439   return -1;
 440
 441 }
 442 #endif
 443
 444 static int update_irq_exit_state(struct guest_info * info) {
 445     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 446
 447     // Fix for QEMU bug using EVENTINJ as an internal cache
 448     guest_ctrl->EVENTINJ.valid = 0;
 449
 450     if ((info->intr_core_state.irq_pending == 1) && (guest_ctrl->guest_ctrl.V_IRQ == 0)) {
 451
 452 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 453         PrintDebug(info->vm_info, info, "INTAK cycle completed for irq %d\n", info->intr_core_state.irq_vector);
 454 #endif
 455
 456         info->intr_core_state.irq_started = 1;
 457         info->intr_core_state.irq_pending = 0;
 458
 459         v3_injecting_intr(info, info->intr_core_state.irq_vector, V3_EXTERNAL_IRQ);
 460     }
 461
 462     if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 0)) {
 463 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 464         PrintDebug(info->vm_info, info, "Interrupt %d taken by guest\n", info->intr_core_state.irq_vector);
 465 #endif
 466
 467         // Interrupt was taken fully vectored
 468         info->intr_core_state.irq_started = 0;
 469
 470     } else if ((info->intr_core_state.irq_started == 1) && (guest_ctrl->exit_int_info.valid == 1)) {
 471 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 472         PrintDebug(info->vm_info, info, "EXIT INT INFO is set (vec=%d)\n", guest_ctrl->exit_int_info.vector);
 473 #endif
 474     }
 475
 476     return 0;
 477 }
 478
 479
 480 static int update_irq_entry_state(struct guest_info * info) {
 481     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 482
 483
 484     if (info->intr_core_state.irq_pending == 0) {
 485         guest_ctrl->guest_ctrl.V_IRQ = 0;
 486         guest_ctrl->guest_ctrl.V_INTR_VECTOR = 0;
 487     }
 488
 489     if (v3_excp_pending(info)) {
 490         uint_t excp = v3_get_excp_number(info);
 491
 492         guest_ctrl->EVENTINJ.type = SVM_INJECTION_EXCEPTION;
 493
 494         if (info->excp_state.excp_error_code_valid) {
 495             guest_ctrl->EVENTINJ.error_code = info->excp_state.excp_error_code;
 496             guest_ctrl->EVENTINJ.ev = 1;
 497 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 498             PrintDebug(info->vm_info, info, "Injecting exception %d with error code %x\n", excp, guest_ctrl->EVENTINJ.error_code);
 499 #endif
 500         }
 501
 502         guest_ctrl->EVENTINJ.vector = excp;
 503
 504         guest_ctrl->EVENTINJ.valid = 1;
 505
 506 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 507         PrintDebug(info->vm_info, info, "<%d> Injecting Exception %d (CR2=%p) (EIP=%p)\n",
 508                    (int)info->num_exits,
 509                    guest_ctrl->EVENTINJ.vector,
 510                    (void *)(addr_t)info->ctrl_regs.cr2,
 511                    (void *)(addr_t)info->rip);
 512 #endif
 513
 514         v3_injecting_excp(info, excp);
 515     } else if (info->intr_core_state.irq_started == 1) {
 516 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 517         PrintDebug(info->vm_info, info, "IRQ pending from previous injection\n");
 518 #endif
 519         guest_ctrl->guest_ctrl.V_IRQ = 1;
 520         guest_ctrl->guest_ctrl.V_INTR_VECTOR = info->intr_core_state.irq_vector;
 521
 522         // We ignore the virtual TPR on this injection
 523         // TPR/PPR tests have already been done in the APIC.
 524         guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 525         guest_ctrl->guest_ctrl.V_INTR_PRIO = info->intr_core_state.irq_vector >> 4 ;  // 0xf;
 526
 527     } else {
 528         switch (v3_intr_pending(info)) {
 529             case V3_EXTERNAL_IRQ: {
 530                 uint32_t irq = v3_get_intr(info);
 531
 532                 guest_ctrl->guest_ctrl.V_IRQ = 1;
 533                 guest_ctrl->guest_ctrl.V_INTR_VECTOR = irq;
 534
 535                 // We ignore the virtual TPR on this injection
 536                 // TPR/PPR tests have already been done in the APIC.
 537                 guest_ctrl->guest_ctrl.V_IGN_TPR = 1;
 538                 guest_ctrl->guest_ctrl.V_INTR_PRIO = info->intr_core_state.irq_vector >> 4 ;  // 0xf;
 539
 540 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 541                 PrintDebug(info->vm_info, info, "Injecting Interrupt %d (EIP=%p)\n",
 542                            guest_ctrl->guest_ctrl.V_INTR_VECTOR,
 543                            (void *)(addr_t)info->rip);
 544 #endif
 545
 546                 info->intr_core_state.irq_pending = 1;
 547                 info->intr_core_state.irq_vector = irq;
 548
 549                 break;
 550             }
 551             case V3_NMI:
 552                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_NMI;
 553                 break;
 554             case V3_SOFTWARE_INTR:
 555                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_SOFT_INTR;
 556
 557 #ifdef V3_CONFIG_DEBUG_INTERRUPTS
 558                 PrintDebug(info->vm_info, info, "Injecting software interrupt --  type: %d, vector: %d\n",
 559                            SVM_INJECTION_SOFT_INTR, info->intr_core_state.swintr_vector);
 560 #endif
 561                 guest_ctrl->EVENTINJ.vector = info->intr_core_state.swintr_vector;
 562                 guest_ctrl->EVENTINJ.valid = 1;
 563
 564                 /* reset swintr state */
 565                 info->intr_core_state.swintr_posted = 0;
 566                 info->intr_core_state.swintr_vector = 0;
 567
 568                 break;
 569             case V3_VIRTUAL_IRQ:
 570                 guest_ctrl->EVENTINJ.type = SVM_INJECTION_IRQ;
 571                 break;
 572
 573             case V3_INVALID_INTR:
 574             default:
 575                 break;
 576         }
 577
 578     }
 579
 580     return 0;
 581 }
 582
 583 int
 584 v3_svm_config_tsc_virtualization(struct guest_info * info) {
 585     vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 586
 587
 588     if (info->time_state.flags & VM_TIME_TRAP_RDTSC) {
 589         ctrl_area->instrs.RDTSC = 1;
 590         ctrl_area->svm_instrs.RDTSCP = 1;
 591     } else {
 592         ctrl_area->instrs.RDTSC = 0;
 593         ctrl_area->svm_instrs.RDTSCP = 0;
 594
 595         if (info->time_state.flags & VM_TIME_TSC_PASSTHROUGH) {
 596                 ctrl_area->TSC_OFFSET = 0;
 597         } else {
 598                 ctrl_area->TSC_OFFSET = v3_tsc_host_offset(&info->time_state);
 599         }
 600     }
 601     return 0;
 602 }
 603
 604 /*
 605  * CAUTION and DANGER!!!
 606  *
 607  * The VMCB CANNOT(!!) be accessed outside of the clgi/stgi calls inside this function
 608  * When exectuing a symbiotic call, the VMCB WILL be overwritten, so any dependencies
 609  * on its contents will cause things to break. The contents at the time of the exit WILL
 610  * change before the exit handler is executed.
 611  */
 612 int v3_svm_enter(struct guest_info * info) {
 613     vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 614     vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 615     addr_t exit_code = 0, exit_info1 = 0, exit_info2 = 0;
 616     uint64_t guest_cycles = 0;
 617
 618     // Conditionally yield the CPU if the timeslice has expired
 619     v3_schedule(info);
 620
 621     // Update timer devices after being in the VM before doing
 622     // IRQ updates, so that any interrupts they raise get seen
 623     // immediately.
 624     v3_advance_time(info, NULL);
 625     v3_update_timers(info);
 626
 627     // disable global interrupts for vm state transition
 628     v3_clgi();
 629
 630     // Synchronize the guest state to the VMCB
 631     guest_state->cr0 = info->ctrl_regs.cr0;
 632     guest_state->cr2 = info->ctrl_regs.cr2;
 633     guest_state->cr3 = info->ctrl_regs.cr3;
 634     guest_state->cr4 = info->ctrl_regs.cr4;
 635     guest_state->dr6 = info->dbg_regs.dr6;
 636     guest_state->dr7 = info->dbg_regs.dr7;
 637
 638     // CR8 is now updated by read/writes and it contains the APIC TPR
 639     // the V_TPR should be just the class part of that.
 640     // This update is here just for completeness.  We currently
 641     // are ignoring V_TPR on all injections and doing the priority logivc
 642     // in the APIC.
 643     // guest_ctrl->guest_ctrl.V_TPR = ((info->ctrl_regs.apic_tpr) >> 4) & 0xf;
 644
 645     //guest_ctrl->guest_ctrl.V_TPR = info->ctrl_regs.cr8 & 0xff;
 646     //
 647
 648     guest_state->rflags = info->ctrl_regs.rflags;
 649     guest_state->efer = info->ctrl_regs.efer;
 650
 651     /* Synchronize MSRs */
 652     guest_state->star = info->msrs.star;
 653     guest_state->lstar = info->msrs.lstar;
 654     guest_state->sfmask = info->msrs.sfmask;
 655     guest_state->KernelGsBase = info->msrs.kern_gs_base;
 656
 657     guest_state->cpl = info->cpl;
 658
 659     v3_set_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 660
 661     guest_state->rax = info->vm_regs.rax;
 662     guest_state->rip = info->rip;
 663     guest_state->rsp = info->vm_regs.rsp;
 664
 665 #ifdef V3_CONFIG_SYMCALL
 666     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 667         update_irq_entry_state(info);
 668     }
 669 #else
 670     update_irq_entry_state(info);
 671 #endif
 672
 673
 674     /* ** */
 675
 676     /*
 677       PrintDebug(info->vm_info, info, "SVM Entry to CS=%p  rip=%p...\n",
 678       (void *)(addr_t)info->segments.cs.base,
 679       (void *)(addr_t)info->rip);
 680     */
 681
 682 #ifdef V3_CONFIG_SYMCALL
 683     if (info->sym_core_state.symcall_state.sym_call_active == 1) {
 684         if (guest_ctrl->guest_ctrl.V_IRQ == 1) {
 685             V3_Print(info->vm_info, info, "!!! Injecting Interrupt during Sym call !!!\n");
 686         }
 687     }
 688 #endif
 689
 690     v3_svm_config_tsc_virtualization(info);
 691
 692     //V3_Print(info->vm_info, info, "Calling v3_svm_launch\n");
 693     {
 694         uint64_t entry_tsc = 0;
 695         uint64_t exit_tsc = 0;
 696
 697 #ifdef V3_CONFIG_PWRSTAT_TELEMETRY
 698         v3_pwrstat_telemetry_enter(info);
 699 #endif
 700
 701 #ifdef V3_CONFIG_PMU_TELEMETRY
 702         v3_pmu_telemetry_enter(info);
 703 #endif
 704
 705
 706         rdtscll(entry_tsc);
 707
 708         v3_svm_launch((vmcb_t *)V3_PAddr(info->vmm_data), &(info->vm_regs), (vmcb_t *)host_vmcbs[V3_Get_CPU()]);
 709
 710         rdtscll(exit_tsc);
 711
 712 #ifdef V3_CONFIG_PMU_TELEMETRY
 713         v3_pmu_telemetry_exit(info);
 714 #endif
 715
 716 #ifdef V3_CONFIG_PWRSTAT_TELEMETRY
 717         v3_pwrstat_telemetry_exit(info);
 718 #endif
 719
 720         guest_cycles = exit_tsc - entry_tsc;
 721     }
 722
 723
 724     //V3_Print(info->vm_info, info, "SVM Returned: Exit Code: %x, guest_rip=%lx\n", (uint32_t)(guest_ctrl->exit_code), (unsigned long)guest_state->rip);
 725
 726     v3_last_exit = (uint32_t)(guest_ctrl->exit_code);
 727
 728     v3_advance_time(info, &guest_cycles);
 729
 730     info->num_exits++;
 731
 732     // Save Guest state from VMCB
 733     info->rip = guest_state->rip;
 734     info->vm_regs.rsp = guest_state->rsp;
 735     info->vm_regs.rax = guest_state->rax;
 736
 737     info->cpl = guest_state->cpl;
 738
 739     info->ctrl_regs.cr0 = guest_state->cr0;
 740     info->ctrl_regs.cr2 = guest_state->cr2;
 741     info->ctrl_regs.cr3 = guest_state->cr3;
 742     info->ctrl_regs.cr4 = guest_state->cr4;
 743     info->dbg_regs.dr6 = guest_state->dr6;
 744     info->dbg_regs.dr7 = guest_state->dr7;
 745     //
 746     // We do not track this anymore
 747     // V_TPR is ignored and we do the logic in the APIC
 748     //info->ctrl_regs.cr8 = guest_ctrl->guest_ctrl.V_TPR;
 749     //
 750     info->ctrl_regs.rflags = guest_state->rflags;
 751     info->ctrl_regs.efer = guest_state->efer;
 752
 753     /* Synchronize MSRs */
 754     info->msrs.star =  guest_state->star;
 755     info->msrs.lstar = guest_state->lstar;
 756     info->msrs.sfmask = guest_state->sfmask;
 757     info->msrs.kern_gs_base = guest_state->KernelGsBase;
 758
 759     v3_get_vmcb_segments((vmcb_t*)(info->vmm_data), &(info->segments));
 760     info->cpu_mode = v3_get_vm_cpu_mode(info);
 761     info->mem_mode = v3_get_vm_mem_mode(info);
 762     /* ** */
 763
 764     // save exit info here
 765     exit_code = guest_ctrl->exit_code;
 766     exit_info1 = guest_ctrl->exit_info1;
 767     exit_info2 = guest_ctrl->exit_info2;
 768
 769 #ifdef V3_CONFIG_SYMCALL
 770     if (info->sym_core_state.symcall_state.sym_call_active == 0) {
 771         update_irq_exit_state(info);
 772     }
 773 #else
 774     update_irq_exit_state(info);
 775 #endif
 776
 777     // reenable global interrupts after vm exit
 778     v3_stgi();
 779
 780     // Conditionally yield the CPU if the timeslice has expired
 781     v3_schedule(info);
 782
 783     // This update timers is for time-dependent handlers
 784     // if we're slaved to host time
 785     v3_advance_time(info, NULL);
 786     v3_update_timers(info);
 787
 788     {
 789         int ret = v3_handle_svm_exit(info, exit_code, exit_info1, exit_info2);
 790
 791         if (ret != 0) {
 792             PrintError(info->vm_info, info, "Error in SVM exit handler (ret=%d)\n", ret);
 793             PrintError(info->vm_info, info, "  last Exit was %d (exit code=0x%llx)\n", v3_last_exit, (uint64_t) exit_code);
 794             return -1;
 795         }
 796     }
 797
 798     if (info->timeouts.timeout_active) {
 799         /* Check to see if any timeouts have expired */
 800         v3_handle_timeouts(info, guest_cycles);
 801     }
 802
 803
 804     return 0;
 805 }
 806
 807
 808 int v3_start_svm_guest(struct guest_info * info) {
 809     //    vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA((vmcb_t*)(info->vmm_data));
 810     //  vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 811
 812     PrintDebug(info->vm_info, info, "Starting SVM core %u (on logical core %u)\n", info->vcpu_id, info->pcpu_id);
 813
 814     if (info->vcpu_id == 0) {
 815         info->core_run_state = CORE_RUNNING;
 816     } else  {
 817         PrintDebug(info->vm_info, info, "SVM core %u (on %u): Waiting for core initialization\n", info->vcpu_id, info->pcpu_id);
 818
 819         while (info->core_run_state == CORE_STOPPED) {
 820
 821             if (info->vm_info->run_state == VM_STOPPED) {
 822                 // The VM was stopped before this core was initialized.
 823                 return 0;
 824             }
 825
 826             v3_yield(info,-1);
 827             //PrintDebug(info->vm_info, info, "SVM core %u: still waiting for INIT\n", info->vcpu_id);
 828         }
 829
 830         PrintDebug(info->vm_info, info, "SVM core %u(on %u) initialized\n", info->vcpu_id, info->pcpu_id);
 831
 832         // We'll be paranoid about race conditions here
 833         v3_wait_at_barrier(info);
 834     }
 835
 836     PrintDebug(info->vm_info, info, "SVM core %u(on %u): I am starting at CS=0x%x (base=0x%p, limit=0x%x),  RIP=0x%p\n",
 837                info->vcpu_id, info->pcpu_id,
 838                info->segments.cs.selector, (void *)(info->segments.cs.base),
 839                info->segments.cs.limit, (void *)(info->rip));
 840
 841
 842
 843     PrintDebug(info->vm_info, info, "SVM core %u: Launching SVM VM (vmcb=%p) (on cpu %u)\n",
 844                info->vcpu_id, (void *)info->vmm_data, info->pcpu_id);
 845     //PrintDebugVMCB((vmcb_t*)(info->vmm_data));
 846
 847     v3_start_time(info);
 848
 849 #ifdef V3_CONFIG_PMU_TELEMETRY
 850     v3_pmu_telemetry_start(info);
 851 #endif
 852
 853 #ifdef V3_CONFIG_PWRSTAT_TELEMETRY
 854     v3_pwrstat_telemetry_start(info);
 855 #endif
 856
 857     while (1) {
 858
 859         if (info->vm_info->run_state == VM_STOPPED) {
 860             info->core_run_state = CORE_STOPPED;
 861             break;
 862         }
 863
 864         if (v3_svm_enter(info) == -1) {
 865             vmcb_ctrl_t * guest_ctrl = GET_VMCB_CTRL_AREA((vmcb_t*)(info->vmm_data));
 866             addr_t host_addr;
 867             addr_t linear_addr = 0;
 868
 869             info->vm_info->run_state = VM_ERROR;
 870
 871             V3_Print(info->vm_info, info, "SVM core %u: SVM ERROR!!\n", info->vcpu_id);
 872
 873             v3_print_guest_state(info);
 874
 875             V3_Print(info->vm_info, info, "SVM core %u: SVM Exit Code: %p\n", info->vcpu_id, (void *)(addr_t)guest_ctrl->exit_code);
 876
 877             V3_Print(info->vm_info, info, "SVM core %u: exit_info1 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info1));
 878             V3_Print(info->vm_info, info, "SVM core %u: exit_info1 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info1)) + 4));
 879
 880             V3_Print(info->vm_info, info, "SVM core %u: exit_info2 low = 0x%.8x\n", info->vcpu_id, *(uint_t*)&(guest_ctrl->exit_info2));
 881             V3_Print(info->vm_info, info, "SVM core %u: exit_info2 high = 0x%.8x\n", info->vcpu_id, *(uint_t *)(((uchar_t *)&(guest_ctrl->exit_info2)) + 4));
 882
 883             linear_addr = get_addr_linear(info, info->rip, &(info->segments.cs));
 884
 885             if (info->mem_mode == PHYSICAL_MEM) {
 886                 v3_gpa_to_hva(info, linear_addr, &host_addr);
 887             } else if (info->mem_mode == VIRTUAL_MEM) {
 888                 v3_gva_to_hva(info, linear_addr, &host_addr);
 889             }
 890
 891             V3_Print(info->vm_info, info, "SVM core %u: Host Address of rip = 0x%p\n", info->vcpu_id, (void *)host_addr);
 892
 893             V3_Print(info->vm_info, info, "SVM core %u: Instr (15 bytes) at %p:\n", info->vcpu_id, (void *)host_addr);
 894             v3_dump_mem((uint8_t *)host_addr, 15);
 895
 896             v3_print_stack(info);
 897
 898             break;
 899         }
 900
 901         v3_wait_at_barrier(info);
 902
 903
 904         if (info->vm_info->run_state == VM_STOPPED) {
 905             info->core_run_state = CORE_STOPPED;
 906             break;
 907         }
 908
 909
 910
 911 /*
 912         if ((info->num_exits % 50000) == 0) {
 913             V3_Print(info->vm_info, info, "SVM Exit number %d\n", (uint32_t)info->num_exits);
 914             v3_print_guest_state(info);
 915         }
 916 */
 917
 918     }
 919
 920 #ifdef V3_CONFIG_PMU_TELEMETRY
 921     v3_pmu_telemetry_end(info);
 922 #endif
 923
 924 #ifdef V3_CONFIG_PWRSTAT_TELEMETRY
 925     v3_pwrstat_telemetry_end(info);
 926 #endif
 927     // Need to take down the other cores on error...
 928
 929     return 0;
 930 }
 931
 932
 933
 934
 935 int v3_reset_svm_vm_core(struct guest_info * core, addr_t rip) {
 936     // init vmcb_bios
 937
 938     // Write the RIP, CS, and descriptor
 939     // assume the rest is already good to go
 940     //
 941     // vector VV -> rip at 0
 942     //              CS = VV00
 943     //  This means we start executing at linear address VV000
 944     //
 945     // So the selector needs to be VV00
 946     // and the base needs to be VV000
 947     //
 948     core->rip = 0;
 949     core->segments.cs.selector = rip << 8;
 950     core->segments.cs.limit = 0xffff;
 951     core->segments.cs.base = rip << 12;
 952
 953     return 0;
 954 }
 955
 956
 957
 958
 959
 960
 961 /* Checks machine SVM capability */
 962 /* Implemented from: AMD Arch Manual 3, sect 15.4 */
 963 int v3_is_svm_capable() {
 964     uint_t vm_cr_low = 0, vm_cr_high = 0;
 965     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
 966
 967     v3_cpuid(CPUID_EXT_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 968
 969     PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_EXT_FEATURE_IDS_ecx=0x%x\n", ecx);
 970
 971     if ((ecx & CPUID_EXT_FEATURE_IDS_ecx_svm_avail) == 0) {
 972       V3_Print(VM_NONE, VCORE_NONE,  "SVM Not Available\n");
 973       return 0;
 974     }  else {
 975         v3_get_msr(SVM_VM_CR_MSR, &vm_cr_high, &vm_cr_low);
 976
 977         PrintDebug(VM_NONE, VCORE_NONE, "SVM_VM_CR_MSR = 0x%x 0x%x\n", vm_cr_high, vm_cr_low);
 978
 979         if ((vm_cr_low & SVM_VM_CR_MSR_svmdis) == 1) {
 980             V3_Print(VM_NONE, VCORE_NONE, "SVM is available but is disabled.\n");
 981
 982             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 983
 984             PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
 985
 986             if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_svml) == 0) {
 987                 V3_Print(VM_NONE, VCORE_NONE,  "SVM BIOS Disabled, not unlockable\n");
 988             } else {
 989                 V3_Print(VM_NONE, VCORE_NONE,  "SVM is locked with a key\n");
 990             }
 991             return 0;
 992
 993         } else {
 994             V3_Print(VM_NONE, VCORE_NONE,  "SVM is available and  enabled.\n");
 995
 996             v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
 997             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_eax=0x%x\n", eax);
 998             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_ebx=0x%x\n", ebx);
 999             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_ecx=0x%x\n", ecx);
1000             PrintDebug(VM_NONE, VCORE_NONE, "CPUID_SVM_REV_AND_FEATURE_IDS_edx=0x%x\n", edx);
1001
1002             return 1;
1003         }
1004     }
1005 }
1006
1007 static int has_svm_nested_paging() {
1008     uint32_t eax = 0, ebx = 0, ecx = 0, edx = 0;
1009
1010     v3_cpuid(CPUID_SVM_REV_AND_FEATURE_IDS, &eax, &ebx, &ecx, &edx);
1011
1012     //PrintDebug(VM_NONE, VCORE_NONE,  "CPUID_EXT_FEATURE_IDS_edx=0x%x\n", edx);
1013
1014     if ((edx & CPUID_SVM_REV_AND_FEATURE_IDS_edx_np) == 0) {
1015         V3_Print(VM_NONE, VCORE_NONE, "SVM Nested Paging not supported\n");
1016         return 0;
1017     } else {
1018         V3_Print(VM_NONE, VCORE_NONE, "SVM Nested Paging supported\n");
1019         return 1;
1020     }
1021  }
1022
1023
1024
1025 void v3_init_svm_cpu(int cpu_id) {
1026     reg_ex_t msr;
1027     extern v3_cpu_arch_t v3_cpu_types[];
1028
1029     // Enable SVM on the CPU
1030     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
1031     msr.e_reg.low |= EFER_MSR_svm_enable;
1032     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
1033
1034     V3_Print(VM_NONE, VCORE_NONE,  "SVM Enabled\n");
1035
1036     // Setup the host state save area
1037     host_vmcbs[cpu_id] = (addr_t)V3_AllocPages(4);
1038
1039     if (!host_vmcbs[cpu_id]) {
1040         PrintError(VM_NONE, VCORE_NONE,  "Failed to allocate VMCB\n");
1041         return;
1042     }
1043
1044     /* 64-BIT-ISSUE */
1045     //  msr.e_reg.high = 0;
1046     //msr.e_reg.low = (uint_t)host_vmcb;
1047     msr.r_reg = host_vmcbs[cpu_id];
1048
1049     PrintDebug(VM_NONE, VCORE_NONE,  "Host State being saved at %p\n", (void *)host_vmcbs[cpu_id]);
1050     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
1051
1052
1053     if (has_svm_nested_paging() == 1) {
1054         v3_cpu_types[cpu_id] = V3_SVM_REV3_CPU;
1055     } else {
1056         v3_cpu_types[cpu_id] = V3_SVM_CPU;
1057     }
1058 }
1059
1060
1061
1062 void v3_deinit_svm_cpu(int cpu_id) {
1063     reg_ex_t msr;
1064     extern v3_cpu_arch_t v3_cpu_types[];
1065
1066     // reset SVM_VM_HSAVE_PA_MSR
1067     // Does setting it to NULL disable??
1068     msr.r_reg = 0;
1069     v3_set_msr(SVM_VM_HSAVE_PA_MSR, msr.e_reg.high, msr.e_reg.low);
1070
1071     // Disable SVM?
1072     v3_get_msr(EFER_MSR, &(msr.e_reg.high), &(msr.e_reg.low));
1073     msr.e_reg.low &= ~EFER_MSR_svm_enable;
1074     v3_set_msr(EFER_MSR, 0, msr.e_reg.low);
1075
1076     v3_cpu_types[cpu_id] = V3_INVALID_CPU;
1077
1078     V3_FreePages((void *)host_vmcbs[cpu_id], 4);
1079
1080     V3_Print(VM_NONE, VCORE_NONE,  "Host CPU %d host area freed, and SVM disabled\n", cpu_id);
1081     return;
1082 }
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133 #if 0
1134 /*
1135  * Test VMSAVE/VMLOAD Latency
1136  */
1137 #define vmsave ".byte 0x0F,0x01,0xDB ; "
1138 #define vmload ".byte 0x0F,0x01,0xDA ; "
1139 {
1140     uint32_t start_lo, start_hi;
1141     uint32_t end_lo, end_hi;
1142     uint64_t start, end;
1143
1144     __asm__ __volatile__ (
1145                           "rdtsc ; "
1146                           "movl %%eax, %%esi ; "
1147                           "movl %%edx, %%edi ; "
1148                           "movq  %%rcx, %%rax ; "
1149                           vmsave
1150                           "rdtsc ; "
1151                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
1152                           : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
1153                           );
1154
1155     start = start_hi;
1156     start <<= 32;
1157     start += start_lo;
1158
1159     end = end_hi;
1160     end <<= 32;
1161     end += end_lo;
1162
1163     PrintDebug(core->vm_info, core, "VMSave Cycle Latency: %d\n", (uint32_t)(end - start));
1164
1165     __asm__ __volatile__ (
1166                           "rdtsc ; "
1167                           "movl %%eax, %%esi ; "
1168                           "movl %%edx, %%edi ; "
1169                           "movq  %%rcx, %%rax ; "
1170                           vmload
1171                           "rdtsc ; "
1172                           : "=D"(start_hi), "=S"(start_lo), "=a"(end_lo),"=d"(end_hi)
1173                               : "c"(host_vmcb[cpu_id]), "0"(0), "1"(0), "2"(0), "3"(0)
1174                               );
1175
1176         start = start_hi;
1177         start <<= 32;
1178         start += start_lo;
1179
1180         end = end_hi;
1181         end <<= 32;
1182         end += end_lo;
1183
1184
1185         PrintDebug(core->vm_info, core, "VMLoad Cycle Latency: %d\n", (uint32_t)(end - start));
1186     }
1187     /* End Latency Test */
1188
1189 #endif
1190
1191
1192
1193
1194
1195
1196
1197 #if 0
1198 void Init_VMCB_pe(vmcb_t *vmcb, struct guest_info vm_info) {
1199   vmcb_ctrl_t * ctrl_area = GET_VMCB_CTRL_AREA(vmcb);
1200   vmcb_saved_state_t * guest_state = GET_VMCB_SAVE_STATE_AREA(vmcb);
1201   uint_t i = 0;
1202
1203
1204   guest_state->rsp = vm_info.vm_regs.rsp;
1205   guest_state->rip = vm_info.rip;
1206
1207
1208   /* I pretty much just gutted this from TVMM */
1209   /* Note: That means its probably wrong */
1210
1211   // set the segment registers to mirror ours
1212   guest_state->cs.selector = 1<<3;
1213   guest_state->cs.attrib.fields.type = 0xa; // Code segment+read
1214   guest_state->cs.attrib.fields.S = 1;
1215   guest_state->cs.attrib.fields.P = 1;
1216   guest_state->cs.attrib.fields.db = 1;
1217   guest_state->cs.attrib.fields.G = 1;
1218   guest_state->cs.limit = 0xfffff;
1219   guest_state->cs.base = 0;
1220
1221   struct vmcb_selector *segregs [] = {&(guest_state->ss), &(guest_state->ds), &(guest_state->es), &(guest_state->fs), &(guest_state->gs), NULL};
1222   for ( i = 0; segregs[i] != NULL; i++) {
1223     struct vmcb_selector * seg = segregs[i];
1224
1225     seg->selector = 2<<3;
1226     seg->attrib.fields.type = 0x2; // Data Segment+read/write
1227     seg->attrib.fields.S = 1;
1228     seg->attrib.fields.P = 1;
1229     seg->attrib.fields.db = 1;
1230     seg->attrib.fields.G = 1;
1231     seg->limit = 0xfffff;
1232     seg->base = 0;
1233   }
1234
1235
1236   {
1237     /* JRL THIS HAS TO GO */
1238
1239     //    guest_state->tr.selector = GetTR_Selector();
1240     guest_state->tr.attrib.fields.type = 0x9;
1241     guest_state->tr.attrib.fields.P = 1;
1242     // guest_state->tr.limit = GetTR_Limit();
1243     //guest_state->tr.base = GetTR_Base();// - 0x2000;
1244     /* ** */
1245   }
1246
1247
1248   /* ** */
1249
1250
1251   guest_state->efer |= EFER_MSR_svm_enable;
1252   guest_state->rflags = 0x00000002; // The reserved bit is always 1
1253   ctrl_area->svm_instrs.VMRUN = 1;
1254   guest_state->cr0 = 0x00000001;    // PE
1255   ctrl_area->guest_ASID = 1;
1256
1257
1258   //  guest_state->cpl = 0;
1259
1260
1261
1262   // Setup exits
1263
1264   ctrl_area->cr_writes.cr4 = 1;
1265
1266   ctrl_area->exceptions.de = 1;
1267   ctrl_area->exceptions.df = 1;
1268   ctrl_area->exceptions.pf = 1;
1269   ctrl_area->exceptions.ts = 1;
1270   ctrl_area->exceptions.ss = 1;
1271   ctrl_area->exceptions.ac = 1;
1272   ctrl_area->exceptions.mc = 1;
1273   ctrl_area->exceptions.gp = 1;
1274   ctrl_area->exceptions.ud = 1;
1275   ctrl_area->exceptions.np = 1;
1276   ctrl_area->exceptions.of = 1;
1277   ctrl_area->exceptions.nmi = 1;
1278
1279
1280
1281   ctrl_area->instrs.IOIO_PROT = 1;
1282   ctrl_area->IOPM_BASE_PA = (uint_t)V3_AllocPages(3);
1283
1284   if (!ctrl_area->IOPM_BASE_PA) {
1285       PrintError(core->vm_info, core, "Cannot allocate IO bitmap\n");
1286       return;
1287   }
1288
1289   {
1290     reg_ex_t tmp_reg;
1291     tmp_reg.r_reg = ctrl_area->IOPM_BASE_PA;
1292     memset((void*)(tmp_reg.e_reg.low), 0xffffffff, PAGE_SIZE * 2);
1293   }
1294
1295   ctrl_area->instrs.INTR = 1;
1296
1297
1298   {
1299     char gdt_buf[6];
1300     char idt_buf[6];
1301
1302     memset(gdt_buf, 0, 6);
1303     memset(idt_buf, 0, 6);
1304
1305
1306     uint_t gdt_base, idt_base;
1307     ushort_t gdt_limit, idt_limit;
1308
1309     GetGDTR(gdt_buf);
1310     gdt_base = *(ulong_t*)((uchar_t*)gdt_buf + 2) & 0xffffffff;
1311     gdt_limit = *(ushort_t*)(gdt_buf) & 0xffff;
1312     PrintDebug(core->vm_info, core, "GDT: base: %x, limit: %x\n", gdt_base, gdt_limit);
1313
1314     GetIDTR(idt_buf);
1315     idt_base = *(ulong_t*)(idt_buf + 2) & 0xffffffff;
1316     idt_limit = *(ushort_t*)(idt_buf) & 0xffff;
1317     PrintDebug(core->vm_info, core, "IDT: base: %x, limit: %x\n",idt_base, idt_limit);
1318
1319
1320     // gdt_base -= 0x2000;
1321     //idt_base -= 0x2000;
1322
1323     guest_state->gdtr.base = gdt_base;
1324     guest_state->gdtr.limit = gdt_limit;
1325     guest_state->idtr.base = idt_base;
1326     guest_state->idtr.limit = idt_limit;
1327
1328
1329   }
1330
1331
1332   // also determine if CPU supports nested paging
1333   /*
1334   if (vm_info.page_tables) {
1335     //   if (0) {
1336     // Flush the TLB on entries/exits
1337     ctrl_area->TLB_CONTROL = 1;
1338
1339     // Enable Nested Paging
1340     ctrl_area->NP_ENABLE = 1;
1341
1342     PrintDebug(core->vm_info, core, "NP_Enable at 0x%x\n", &(ctrl_area->NP_ENABLE));
1343
1344         // Set the Nested Page Table pointer
1345     ctrl_area->N_CR3 |= ((addr_t)vm_info.page_tables & 0xfffff000);
1346
1347
1348     //   ctrl_area->N_CR3 = Get_CR3();
1349     // guest_state->cr3 |= (Get_CR3() & 0xfffff000);
1350
1351     guest_state->g_pat = 0x7040600070406ULL;
1352
1353     PrintDebug(core->vm_info, core, "Set Nested CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(ctrl_area->N_CR3)), (uint_t)*((unsigned char *)&(ctrl_area->N_CR3) + 4));
1354     PrintDebug(core->vm_info, core, "Set Guest CR3: lo: 0x%x  hi: 0x%x\n", (uint_t)*(&(guest_state->cr3)), (uint_t)*((unsigned char *)&(guest_state->cr3) + 4));
1355     // Enable Paging
1356     //    guest_state->cr0 |= 0x80000000;
1357   }
1358   */
1359
1360 }
1361
1362
1363
1364
1365
1366 #endif
1367
1368