/* $Id: HMSVMAll.cpp 67529 2017-06-21 08:29:25Z vboxsync $ */ /** @file * HM SVM (AMD-V) - All contexts. */ /* * Copyright (C) 2017 Oracle Corporation * * This file is part of VirtualBox Open Source Edition (OSE), as * available from http://www.virtualbox.org. This file is free software; * you can redistribute it and/or modify it under the terms of the GNU * General Public License (GPL) as published by the Free Software * Foundation, in version 2 as it comes in the "COPYING" file of the * VirtualBox OSE distribution. VirtualBox OSE is distributed in the * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind. */ /********************************************************************************************************************************* * Header Files * *********************************************************************************************************************************/ #define LOG_GROUP LOG_GROUP_HM #define VMCPU_INCL_CPUM_GST_CTX #include "HMInternal.h" #include #include #include #include #include #include #ifndef IN_RC /** * Emulates a simple MOV TPR (CR8) instruction, used for TPR patching on 32-bit * guests. This simply looks up the patch record at EIP and does the required. * * This VMMCALL is used a fallback mechanism when mov to/from cr8 isn't exactly * like how we want it to be (e.g. not followed by shr 4 as is usually done for * TPR). See hmR3ReplaceTprInstr() for the details. * * @returns VBox status code. * @retval VINF_SUCCESS if the access was handled successfully. * @retval VERR_NOT_FOUND if no patch record for this RIP could be found. * @retval VERR_SVM_UNEXPECTED_PATCH_TYPE if the found patch type is invalid. * * @param pVCpu The cross context virtual CPU structure. * @param pCtx Pointer to the guest-CPU context. * @param pfUpdateRipAndRF Whether the guest RIP/EIP has been updated as * part of the TPR patch operation. */ static int hmSvmEmulateMovTpr(PVMCPU pVCpu, PCPUMCTX pCtx, bool *pfUpdateRipAndRF) { Log4(("Emulated VMMCall TPR access replacement at RIP=%RGv\n", pCtx->rip)); /* * We do this in a loop as we increment the RIP after a successful emulation * and the new RIP may be a patched instruction which needs emulation as well. */ bool fUpdateRipAndRF = false; bool fPatchFound = false; PVM pVM = pVCpu->CTX_SUFF(pVM); for (;;) { bool fPending; uint8_t u8Tpr; PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip); if (!pPatch) break; fPatchFound = true; switch (pPatch->enmType) { case HMTPRINSTR_READ: { int rc = APICGetTpr(pVCpu, &u8Tpr, &fPending, NULL /* pu8PendingIrq */); AssertRC(rc); rc = DISWriteReg32(CPUMCTX2CORE(pCtx), pPatch->uDstOperand, u8Tpr); AssertRC(rc); pCtx->rip += pPatch->cbOp; pCtx->eflags.Bits.u1RF = 0; fUpdateRipAndRF = true; break; } case HMTPRINSTR_WRITE_REG: case HMTPRINSTR_WRITE_IMM: { if (pPatch->enmType == HMTPRINSTR_WRITE_REG) { uint32_t u32Val; int rc = DISFetchReg32(CPUMCTX2CORE(pCtx), pPatch->uSrcOperand, &u32Val); AssertRC(rc); u8Tpr = u32Val; } else u8Tpr = (uint8_t)pPatch->uSrcOperand; int rc2 = APICSetTpr(pVCpu, u8Tpr); AssertRC(rc2); HMCPU_CF_SET(pVCpu, HM_CHANGED_SVM_GUEST_APIC_STATE); pCtx->rip += pPatch->cbOp; pCtx->eflags.Bits.u1RF = 0; fUpdateRipAndRF = true; break; } default: { AssertMsgFailed(("Unexpected patch type %d\n", pPatch->enmType)); pVCpu->hm.s.u32HMError = pPatch->enmType; *pfUpdateRipAndRF = fUpdateRipAndRF; return VERR_SVM_UNEXPECTED_PATCH_TYPE; } } } *pfUpdateRipAndRF = fUpdateRipAndRF; if (fPatchFound) return VINF_SUCCESS; return VERR_NOT_FOUND; } #endif /* !IN_RC */ /** * Performs the operations necessary that are part of the vmmcall instruction * execution in the guest. * * @returns Strict VBox status code (i.e. informational status codes too). * @retval VINF_SUCCESS on successful handling, no \#UD needs to be thrown, * update RIP and eflags.RF depending on @a pfUpdatedRipAndRF and * continue guest execution. * @retval VINF_GIM_HYPERCALL_CONTINUING continue hypercall without updating * RIP. * @retval VINF_GIM_R3_HYPERCALL re-start the hypercall from ring-3. * * @param pVCpu The cross context virtual CPU structure. * @param pCtx Pointer to the guest-CPU context. * @param pfUpdatedRipAndRF Whether the guest RIP/EIP has been updated as * part of handling the VMMCALL operation. */ VMM_INT_DECL(VBOXSTRICTRC) HMSvmVmmcall(PVMCPU pVCpu, PCPUMCTX pCtx, bool *pfUpdatedRipAndRF) { #ifndef IN_RC /* * TPR patched instruction emulation for 32-bit guests. */ PVM pVM = pVCpu->CTX_SUFF(pVM); if (pVM->hm.s.fTprPatchingAllowed) { int rc = hmSvmEmulateMovTpr(pVCpu, pCtx, pfUpdatedRipAndRF); if (RT_SUCCESS(rc)) return VINF_SUCCESS; if (rc != VERR_NOT_FOUND) { Log(("hmSvmExitVmmCall: hmSvmEmulateMovTpr returns %Rrc\n", rc)); return rc; } } #endif /* * Paravirtualized hypercalls. */ *pfUpdatedRipAndRF = false; if (pVCpu->hm.s.fHypercallsEnabled) return GIMHypercall(pVCpu, pCtx); return VERR_NOT_AVAILABLE; } /** * Converts an SVM event type to a TRPM event type. * * @returns The TRPM event type. * @retval TRPM_32BIT_HACK if the specified type of event isn't among the set * of recognized trap types. * * @param pEvent Pointer to the SVM event. */ VMM_INT_DECL(TRPMEVENT) HMSvmEventToTrpmEventType(PCSVMEVENT pEvent) { uint8_t const uType = pEvent->n.u3Type; switch (uType) { case SVM_EVENT_EXTERNAL_IRQ: return TRPM_HARDWARE_INT; case SVM_EVENT_SOFTWARE_INT: return TRPM_SOFTWARE_INT; case SVM_EVENT_EXCEPTION: case SVM_EVENT_NMI: return TRPM_TRAP; default: break; } AssertMsgFailed(("HMSvmEventToTrpmEvent: Invalid pending-event type %#x\n", uType)); return TRPM_32BIT_HACK; } /** * Gets the MSR permission bitmap byte and bit offset for the specified MSR. * * @returns VBox status code. * @param idMsr The MSR being requested. * @param pbOffMsrpm Where to store the byte offset in the MSR permission * bitmap for @a idMsr. * @param puMsrpmBit Where to store the bit offset starting at the byte * returned in @a pbOffMsrpm. */ VMM_INT_DECL(int) HMSvmGetMsrpmOffsetAndBit(uint32_t idMsr, uint16_t *pbOffMsrpm, uint32_t *puMsrpmBit) { Assert(pbOffMsrpm); Assert(puMsrpmBit); /* * MSRPM Layout: * Byte offset MSR range * 0x000 - 0x7ff 0x00000000 - 0x00001fff * 0x800 - 0xfff 0xc0000000 - 0xc0001fff * 0x1000 - 0x17ff 0xc0010000 - 0xc0011fff * 0x1800 - 0x1fff Reserved * * Each MSR is represented by 2 permission bits (read and write). */ if (idMsr <= 0x00001fff) { /* Pentium-compatible MSRs. */ *pbOffMsrpm = 0; *puMsrpmBit = idMsr << 1; return VINF_SUCCESS; } if ( idMsr >= 0xc0000000 && idMsr <= 0xc0001fff) { /* AMD Sixth Generation x86 Processor MSRs. */ *pbOffMsrpm = 0x800; *puMsrpmBit = (idMsr - 0xc0000000) << 1; return VINF_SUCCESS; } if ( idMsr >= 0xc0010000 && idMsr <= 0xc0011fff) { /* AMD Seventh and Eighth Generation Processor MSRs. */ *pbOffMsrpm += 0x1000; *puMsrpmBit = (idMsr - 0xc0001000) << 1; return VINF_SUCCESS; } *pbOffMsrpm = 0; *puMsrpmBit = 0; return VERR_OUT_OF_RANGE; }