NEMR3Native-win.cpp@ 71612

Last change on this file since 71612 was 71297, checked in by vboxsync, 7 years ago
NEM: Some more 17115 fixes and noted down an issue (possibly not at all new). bugref:9044
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 118.0 KB

Line
1	/* $Id: NEMR3Native-win.cpp 71297 2018-03-10 06:02:02Z vboxsync $ */
2	/** @file
3	* NEM - Native execution manager, native ring-3 Windows backend.
4	*
5	* Log group 2: Exit logging.
6	* Log group 3: Log context on exit.
7	* Log group 5: Ring-3 memory management
8	* Log group 6: Ring-0 memory management
9	* Log group 12: API intercepts.
10	*/
11
12	/*
13	* Copyright (C) 2018 Oracle Corporation
14	*
15	* This file is part of VirtualBox Open Source Edition (OSE), as
16	* available from http://www.virtualbox.org. This file is free software;
17	* you can redistribute it and/or modify it under the terms of the GNU
18	* General Public License (GPL) as published by the Free Software
19	* Foundation, in version 2 as it comes in the "COPYING" file of the
20	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
21	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
22	*/
23
24
25	/*********************************************************************************************************************************
26	* Header Files *
27	*********************************************************************************************************************************/
28	#define LOG_GROUP LOG_GROUP_NEM
29	#include <iprt/nt/nt-and-windows.h>
30	#include <iprt/nt/hyperv.h>
31	#include <iprt/nt/vid.h>
32	#include <WinHvPlatform.h>
33
34	#ifndef _WIN32_WINNT_WIN10
35	# error "Missing _WIN32_WINNT_WIN10"
36	#endif
37	#ifndef _WIN32_WINNT_WIN10_RS1 /* Missing define, causing trouble for us. */
38	# define _WIN32_WINNT_WIN10_RS1 (_WIN32_WINNT_WIN10 + 1)
39	#endif
40	#include <sysinfoapi.h>
41	#include <debugapi.h>
42	#include <errhandlingapi.h>
43	#include <fileapi.h>
44	#include <winerror.h> /* no api header for this. */
45
46	#include <VBox/vmm/nem.h>
47	#include <VBox/vmm/iem.h>
48	#include <VBox/vmm/em.h>
49	#include <VBox/vmm/apic.h>
50	#include "NEMInternal.h"
51	#include <VBox/vmm/vm.h>
52
53	#include <iprt/ldr.h>
54	#include <iprt/path.h>
55	#include <iprt/string.h>
56	#include <iprt/system.h>
57
58
59	/*********************************************************************************************************************************
60	* Defined Constants And Macros *
61	*********************************************************************************************************************************/
62	#ifdef LOG_ENABLED
63	# define NEM_WIN_INTERCEPT_NT_IO_CTLS
64	#endif
65
66	/** VID I/O control detection: Fake partition handle input. */
67	#define NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE ((HANDLE)(uintptr_t)38479125)
68	/** VID I/O control detection: Fake partition ID return. */
69	#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID UINT64_C(0xfa1e000042424242)
70	/** VID I/O control detection: Fake CPU index input. */
71	#define NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX UINT32_C(42)
72	/** VID I/O control detection: Fake timeout input. */
73	#define NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT UINT32_C(0x00080286)
74
75
76	/*********************************************************************************************************************************
77	* Structures and Typedefs *
78	*********************************************************************************************************************************/
79	#ifndef NEM_WIN_USE_17110_PLUS_WDK
80	typedef HRESULT (WINAPI PFNWHVGETCAPABILITY_17110)(WHV_CAPABILITY_CODE, void , uint32_t, uint32_t *);
81	typedef HRESULT (WINAPI PFNWHVSETPARTITIONPROPERTY_17110)(WHV_PARTITION_HANDLE, WHV_PARTITION_PROPERTY_CODE, void , uint32_t);
82	#endif
83
84
85	/*********************************************************************************************************************************
86	* Global Variables *
87	*********************************************************************************************************************************/
88	/** @name APIs imported from WinHvPlatform.dll
89	* @{ */
90	static decltype(WHvGetCapability) * g_pfnWHvGetCapability;
91	static decltype(WHvCreatePartition) * g_pfnWHvCreatePartition;
92	static decltype(WHvSetupPartition) * g_pfnWHvSetupPartition;
93	static decltype(WHvDeletePartition) * g_pfnWHvDeletePartition;
94	static decltype(WHvGetPartitionProperty) * g_pfnWHvGetPartitionProperty;
95	static decltype(WHvSetPartitionProperty) * g_pfnWHvSetPartitionProperty;
96	static decltype(WHvMapGpaRange) * g_pfnWHvMapGpaRange;
97	static decltype(WHvUnmapGpaRange) * g_pfnWHvUnmapGpaRange;
98	static decltype(WHvTranslateGva) * g_pfnWHvTranslateGva;
99	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
100	static decltype(WHvCreateVirtualProcessor) * g_pfnWHvCreateVirtualProcessor;
101	static decltype(WHvDeleteVirtualProcessor) * g_pfnWHvDeleteVirtualProcessor;
102	static decltype(WHvRunVirtualProcessor) * g_pfnWHvRunVirtualProcessor;
103	static decltype(WHvCancelRunVirtualProcessor) * g_pfnWHvCancelRunVirtualProcessor;
104	static decltype(WHvGetVirtualProcessorRegisters) * g_pfnWHvGetVirtualProcessorRegisters;
105	static decltype(WHvSetVirtualProcessorRegisters) * g_pfnWHvSetVirtualProcessorRegisters;
106	#endif
107	/** @} */
108
109	/** @name APIs imported from Vid.dll
110	* @{ */
111	static decltype(VidGetHvPartitionId) *g_pfnVidGetHvPartitionId;
112	static decltype(VidStartVirtualProcessor) *g_pfnVidStartVirtualProcessor;
113	static decltype(VidStopVirtualProcessor) *g_pfnVidStopVirtualProcessor;
114	static decltype(VidMessageSlotMap) *g_pfnVidMessageSlotMap;
115	static decltype(VidMessageSlotHandleAndGetNext) *g_pfnVidMessageSlotHandleAndGetNext;
116	#ifdef LOG_ENABLED
117	static decltype(VidGetVirtualProcessorState) *g_pfnVidGetVirtualProcessorState;
118	static decltype(VidSetVirtualProcessorState) *g_pfnVidSetVirtualProcessorState;
119	static decltype(VidGetVirtualProcessorRunningStatus) *g_pfnVidGetVirtualProcessorRunningStatus;
120	#endif
121	/** @} */
122
123	/** The Windows build number. */
124	static uint32_t g_uBuildNo = 17110;
125
126
127
128	/**
129	* Import instructions.
130	*/
131	static const struct
132	{
133	uint8_t idxDll; /*< 0 for WinHvPlatform.dll, 1 for vid.dll. /
134	bool fOptional; /*< Set if import is optional. /
135	PFNRT ppfn; /< The function pointer variable. /
136	const char pszName; /< The function name. /
137	} g_aImports[] =
138	{
139	#define NEM_WIN_IMPORT(a_idxDll, a_fOptional, a_Name) { (a_idxDll), (a_fOptional), (PFNRT *)&RT_CONCAT(g_pfn,a_Name), #a_Name }
140	NEM_WIN_IMPORT(0, false, WHvGetCapability),
141	NEM_WIN_IMPORT(0, false, WHvCreatePartition),
142	NEM_WIN_IMPORT(0, false, WHvSetupPartition),
143	NEM_WIN_IMPORT(0, false, WHvDeletePartition),
144	NEM_WIN_IMPORT(0, false, WHvGetPartitionProperty),
145	NEM_WIN_IMPORT(0, false, WHvSetPartitionProperty),
146	NEM_WIN_IMPORT(0, false, WHvMapGpaRange),
147	NEM_WIN_IMPORT(0, false, WHvUnmapGpaRange),
148	NEM_WIN_IMPORT(0, false, WHvTranslateGva),
149	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
150	NEM_WIN_IMPORT(0, false, WHvCreateVirtualProcessor),
151	NEM_WIN_IMPORT(0, false, WHvDeleteVirtualProcessor),
152	NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
153	NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
154	NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
155	NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
156	#endif
157	NEM_WIN_IMPORT(1, false, VidGetHvPartitionId),
158	NEM_WIN_IMPORT(1, false, VidMessageSlotMap),
159	NEM_WIN_IMPORT(1, false, VidMessageSlotHandleAndGetNext),
160	NEM_WIN_IMPORT(1, false, VidStartVirtualProcessor),
161	NEM_WIN_IMPORT(1, false, VidStopVirtualProcessor),
162	#ifdef LOG_ENABLED
163	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorState),
164	NEM_WIN_IMPORT(1, false, VidSetVirtualProcessorState),
165	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorRunningStatus),
166	#endif
167	#undef NEM_WIN_IMPORT
168	};
169
170
171	/** The real NtDeviceIoControlFile API in NTDLL. */
172	static decltype(NtDeviceIoControlFile) *g_pfnNtDeviceIoControlFile;
173	/** Pointer to the NtDeviceIoControlFile import table entry. */
174	static decltype(NtDeviceIoControlFile) **g_ppfnVidNtDeviceIoControlFile;
175	/** Info about the VidGetHvPartitionId I/O control interface. */
176	static NEMWINIOCTL g_IoCtlGetHvPartitionId;
177	/** Info about the VidStartVirtualProcessor I/O control interface. */
178	static NEMWINIOCTL g_IoCtlStartVirtualProcessor;
179	/** Info about the VidStopVirtualProcessor I/O control interface. */
180	static NEMWINIOCTL g_IoCtlStopVirtualProcessor;
181	/** Info about the VidMessageSlotHandleAndGetNext I/O control interface. */
182	static NEMWINIOCTL g_IoCtlMessageSlotHandleAndGetNext;
183	#ifdef LOG_ENABLED
184	/** Info about the VidMessageSlotMap I/O control interface - for logging. */
185	static NEMWINIOCTL g_IoCtlMessageSlotMap;
186	/* Info about the VidGetVirtualProcessorState I/O control interface - for logging. */
187	static NEMWINIOCTL g_IoCtlGetVirtualProcessorState;
188	/* Info about the VidSetVirtualProcessorState I/O control interface - for logging. */
189	static NEMWINIOCTL g_IoCtlSetVirtualProcessorState;
190	/** Pointer to what nemR3WinIoctlDetector_ForLogging should fill in. */
191	static NEMWINIOCTL *g_pIoCtlDetectForLogging;
192	#endif
193
194	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
195	/** Mapping slot for CPU #0.
196	* @{ */
197	static VID_MESSAGE_MAPPING_HEADER *g_pMsgSlotMapping = NULL;
198	static const HV_MESSAGE_HEADER *g_pHvMsgHdr;
199	static const HV_X64_INTERCEPT_MESSAGE_HEADER *g_pX64MsgHdr;
200	/** @} */
201	#endif
202
203
204	/*
205	* Let the preprocessor alias the APIs to import variables for better autocompletion.
206	*/
207	#ifndef IN_SLICKEDIT
208	# define WHvGetCapability g_pfnWHvGetCapability
209	# define WHvCreatePartition g_pfnWHvCreatePartition
210	# define WHvSetupPartition g_pfnWHvSetupPartition
211	# define WHvDeletePartition g_pfnWHvDeletePartition
212	# define WHvGetPartitionProperty g_pfnWHvGetPartitionProperty
213	# define WHvSetPartitionProperty g_pfnWHvSetPartitionProperty
214	# define WHvMapGpaRange g_pfnWHvMapGpaRange
215	# define WHvUnmapGpaRange g_pfnWHvUnmapGpaRange
216	# define WHvTranslateGva g_pfnWHvTranslateGva
217	# define WHvCreateVirtualProcessor g_pfnWHvCreateVirtualProcessor
218	# define WHvDeleteVirtualProcessor g_pfnWHvDeleteVirtualProcessor
219	# define WHvRunVirtualProcessor g_pfnWHvRunVirtualProcessor
220	# define WHvGetRunExitContextSize g_pfnWHvGetRunExitContextSize
221	# define WHvCancelRunVirtualProcessor g_pfnWHvCancelRunVirtualProcessor
222	# define WHvGetVirtualProcessorRegisters g_pfnWHvGetVirtualProcessorRegisters
223	# define WHvSetVirtualProcessorRegisters g_pfnWHvSetVirtualProcessorRegisters
224
225	# define VidMessageSlotHandleAndGetNext g_pfnVidMessageSlotHandleAndGetNext
226	# define VidStartVirtualProcessor g_pfnVidStartVirtualProcessor
227	# define VidStopVirtualProcessor g_pfnVidStopVirtualProcessor
228
229	#endif
230
231	/** WHV_MEMORY_ACCESS_TYPE names */
232	static const char * const g_apszWHvMemAccesstypes[4] = { "read", "write", "exec", "!undefined!" };
233
234
235	/*********************************************************************************************************************************
236	* Internal Functions *
237	*********************************************************************************************************************************/
238
239	/*
240	* Instantate the code we share with ring-0.
241	*/
242	#include "../VMMAll/NEMAllNativeTemplate-win.cpp.h"
243
244
245
246	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
247	/**
248	* Wrapper that logs the call from VID.DLL.
249	*
250	* This is very handy for figuring out why an API call fails.
251	*/
252	static NTSTATUS WINAPI
253	nemR3WinLogWrapper_NtDeviceIoControlFile(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
254	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
255	PVOID pvOutput, ULONG cbOutput)
256	{
257
258	char szFunction[32];
259	const char *pszFunction;
260	if (uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction)
261	pszFunction = "VidMessageSlotHandleAndGetNext";
262	else if (uFunction == g_IoCtlStartVirtualProcessor.uFunction)
263	pszFunction = "VidStartVirtualProcessor";
264	else if (uFunction == g_IoCtlStopVirtualProcessor.uFunction)
265	pszFunction = "VidStopVirtualProcessor";
266	else if (uFunction == g_IoCtlMessageSlotMap.uFunction)
267	pszFunction = "VidMessageSlotMap";
268	else if (uFunction == g_IoCtlGetVirtualProcessorState.uFunction)
269	pszFunction = "VidGetVirtualProcessorState";
270	else if (uFunction == g_IoCtlSetVirtualProcessorState.uFunction)
271	pszFunction = "VidSetVirtualProcessorState";
272	else
273	{
274	RTStrPrintf(szFunction, sizeof(szFunction), "%#x", uFunction);
275	pszFunction = szFunction;
276	}
277
278	if (cbInput > 0 && pvInput)
279	Log12(("VID!NtDeviceIoControlFile: %s/input: %.*Rhxs\n", pszFunction, RT_MIN(cbInput, 32), pvInput));
280	NTSTATUS rcNt = g_pfnNtDeviceIoControlFile(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, uFunction,
281	pvInput, cbInput, pvOutput, cbOutput);
282	if (!hEvt && !pfnApcCallback && !pvApcCtx)
283	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
284	hFile, pIos, pIos->Status, pIos->Information, pszFunction, pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
285	else
286	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx hEvt=%#zx Apc=%p/%p pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
287	hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pIos->Status, pIos->Information, pszFunction,
288	pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
289	if (cbOutput > 0 && pvOutput)
290	{
291	Log12(("VID!NtDeviceIoControlFile: %s/output: %.*Rhxs\n", pszFunction, RT_MIN(cbOutput, 32), pvOutput));
292	if (uFunction == 0x2210cc && g_pMsgSlotMapping == NULL && cbOutput >= sizeof(void *))
293	{
294	g_pMsgSlotMapping = (VID_MESSAGE_MAPPING_HEADER *)pvOutput;
295	g_pHvMsgHdr = (const HV_MESSAGE_HEADER *)(g_pMsgSlotMapping + 1);
296	g_pX64MsgHdr = (const HV_X64_INTERCEPT_MESSAGE_HEADER *)(g_pHvMsgHdr + 1);
297	Log12(("VID!NtDeviceIoControlFile: Message slot mapping: %p\n", g_pMsgSlotMapping));
298	}
299	}
300	if ( g_pMsgSlotMapping
301	&& ( uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction
302	\|\| uFunction == g_IoCtlStopVirtualProcessor.uFunction
303	\|\| uFunction == g_IoCtlMessageSlotMap.uFunction
304	))
305	Log12(("VID!NtDeviceIoControlFile: enmVidMsgType=%#x cb=%#x msg=%#x payload=%u cs:rip=%04x:%08RX64 (%s)\n",
306	g_pMsgSlotMapping->enmVidMsgType, g_pMsgSlotMapping->cbMessage,
307	g_pHvMsgHdr->MessageType, g_pHvMsgHdr->PayloadSize,
308	g_pX64MsgHdr->CsSegment.Selector, g_pX64MsgHdr->Rip, pszFunction));
309
310	return rcNt;
311	}
312	#endif /* NEM_WIN_INTERCEPT_NT_IO_CTLS */
313
314
315	/**
316	* Patches the call table of VID.DLL so we can intercept NtDeviceIoControlFile.
317	*
318	* This is for used to figure out the I/O control codes and in logging builds
319	* for logging API calls that WinHvPlatform.dll does.
320	*
321	* @returns VBox status code.
322	* @param hLdrModVid The VID module handle.
323	* @param pErrInfo Where to return additional error information.
324	*/
325	static int nemR3WinInitVidIntercepts(RTLDRMOD hLdrModVid, PRTERRINFO pErrInfo)
326	{
327	/*
328	* Locate the real API.
329	*/
330	g_pfnNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) *)RTLdrGetSystemSymbol("NTDLL.DLL", "NtDeviceIoControlFile");
331	AssertReturn(g_pfnNtDeviceIoControlFile != NULL,
332	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to resolve NtDeviceIoControlFile from NTDLL.DLL"));
333
334	/*
335	* Locate the PE header and get what we need from it.
336	*/
337	uint8_t const pbImage = (uint8_t const )RTLdrGetNativeHandle(hLdrModVid);
338	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbImage;
339	AssertReturn(pMzHdr->e_magic == IMAGE_DOS_SIGNATURE,
340	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL mapping doesn't start with MZ signature: %#x", pMzHdr->e_magic));
341	IMAGE_NT_HEADERS const pNtHdrs = (IMAGE_NT_HEADERS const )&pbImage[pMzHdr->e_lfanew];
342	AssertReturn(pNtHdrs->Signature == IMAGE_NT_SIGNATURE,
343	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL has invalid PE signaturre: %#x @%#x",
344	pNtHdrs->Signature, pMzHdr->e_lfanew));
345
346	uint32_t const cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
347	IMAGE_DATA_DIRECTORY const ImportDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
348
349	/*
350	* Walk the import descriptor table looking for NTDLL.DLL.
351	*/
352	AssertReturn( ImportDir.Size > 0
353	&& ImportDir.Size < cbImage,
354	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory size: %#x", ImportDir.Size));
355	AssertReturn( ImportDir.VirtualAddress > 0
356	&& ImportDir.VirtualAddress <= cbImage - ImportDir.Size,
357	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory RVA: %#x", ImportDir.VirtualAddress));
358
359	for (PIMAGE_IMPORT_DESCRIPTOR pImps = (PIMAGE_IMPORT_DESCRIPTOR)&pbImage[ImportDir.VirtualAddress];
360	pImps->Name != 0 && pImps->FirstThunk != 0;
361	pImps++)
362	{
363	AssertReturn(pImps->Name < cbImage,
364	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory entry name: %#x", pImps->Name));
365	const char pszModName = (const char )&pbImage[pImps->Name];
366	if (RTStrICmpAscii(pszModName, "ntdll.dll"))
367	continue;
368	AssertReturn(pImps->FirstThunk < cbImage,
369	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
370	AssertReturn(pImps->OriginalFirstThunk < cbImage,
371	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
372
373	/*
374	* Walk the thunks table(s) looking for NtDeviceIoControlFile.
375	*/
376	PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]; /* update this. */
377	PIMAGE_THUNK_DATA pThunk = pImps->OriginalFirstThunk == 0 /* read from this. */
378	? (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]
379	: (PIMAGE_THUNK_DATA)&pbImage[pImps->OriginalFirstThunk];
380	while (pThunk->u1.Ordinal != 0)
381	{
382	if (!(pThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32))
383	{
384	AssertReturn(pThunk->u1.Ordinal > 0 && pThunk->u1.Ordinal < cbImage,
385	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
386
387	const char pszSymbol = (const char )&pbImage[(uintptr_t)pThunk->u1.AddressOfData + 2];
388	if (strcmp(pszSymbol, "NtDeviceIoControlFile") == 0)
389	{
390	DWORD fOldProt = PAGE_READONLY;
391	VirtualProtect(&pFirstThunk->u1.Function, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &fOldProt);
392	g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)&pFirstThunk->u1.Function;
393	/* Don't restore the protection here, so we modify the NtDeviceIoControlFile pointer later. */
394	}
395	}
396
397	pThunk++;
398	pFirstThunk++;
399	}
400	}
401
402	if (*g_ppfnVidNtDeviceIoControlFile)
403	{
404	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
405	*g_ppfnVidNtDeviceIoControlFile = nemR3WinLogWrapper_NtDeviceIoControlFile;
406	#endif
407	return VINF_SUCCESS;
408	}
409	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to patch NtDeviceIoControlFile import in VID.DLL!");
410	}
411
412
413	/**
414	* Worker for nemR3NativeInit that probes and load the native API.
415	*
416	* @returns VBox status code.
417	* @param fForced Whether the HMForced flag is set and we should
418	* fail if we cannot initialize.
419	* @param pErrInfo Where to always return error info.
420	*/
421	static int nemR3WinInitProbeAndLoad(bool fForced, PRTERRINFO pErrInfo)
422	{
423	/*
424	* Check that the DLL files we need are present, but without loading them.
425	* We'd like to avoid loading them unnecessarily.
426	*/
427	WCHAR wszPath[MAX_PATH + 64];
428	UINT cwcPath = GetSystemDirectoryW(wszPath, MAX_PATH);
429	if (cwcPath >= MAX_PATH \|\| cwcPath < 2)
430	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "GetSystemDirectoryW failed (%#x / %u)", cwcPath, GetLastError());
431
432	if (wszPath[cwcPath - 1] != '\\' \|\| wszPath[cwcPath - 1] != '/')
433	wszPath[cwcPath++] = '\\';
434	RTUtf16CopyAscii(&wszPath[cwcPath], RT_ELEMENTS(wszPath) - cwcPath, "WinHvPlatform.dll");
435	if (GetFileAttributesW(wszPath) == INVALID_FILE_ATTRIBUTES)
436	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "The native API dll was not found (%ls)", wszPath);
437
438	/*
439	* Check that we're in a VM and that the hypervisor identifies itself as Hyper-V.
440	*/
441	if (!ASMHasCpuId())
442	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID support");
443	if (!ASMIsValidStdRange(ASMCpuId_EAX(0)))
444	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID leaf #1");
445	if (!(ASMCpuId_ECX(1) & X86_CPUID_FEATURE_ECX_HVP))
446	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Not in a hypervisor partition (HVP=0)");
447
448	uint32_t cMaxHyperLeaf = 0;
449	uint32_t uEbx = 0;
450	uint32_t uEcx = 0;
451	uint32_t uEdx = 0;
452	ASMCpuIdExSlow(0x40000000, 0, 0, 0, &cMaxHyperLeaf, &uEbx, &uEcx, &uEdx);
453	if (!ASMIsValidHypervisorRange(cMaxHyperLeaf))
454	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Invalid hypervisor CPUID range (%#x %#x %#x %#x)",
455	cMaxHyperLeaf, uEbx, uEcx, uEdx);
456	if ( uEbx != UINT32_C(0x7263694d) /* Micr */
457	\|\| uEcx != UINT32_C(0x666f736f) /* osof */
458	\|\| uEdx != UINT32_C(0x76482074) /* t Hv */)
459	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
460	"Not Hyper-V CPUID signature: %#x %#x %#x (expected %#x %#x %#x)",
461	uEbx, uEcx, uEdx, UINT32_C(0x7263694d), UINT32_C(0x666f736f), UINT32_C(0x76482074));
462	if (cMaxHyperLeaf < UINT32_C(0x40000005))
463	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Too narrow hypervisor CPUID range (%#x)", cMaxHyperLeaf);
464
465	/** @todo would be great if we could recognize a root partition from the
466	* CPUID info, but I currently don't dare do that. */
467
468	/*
469	* Now try load the DLLs and resolve the APIs.
470	*/
471	static const char * const s_apszDllNames[2] = { "WinHvPlatform.dll", "vid.dll" };
472	RTLDRMOD ahMods[2] = { NIL_RTLDRMOD, NIL_RTLDRMOD };
473	int rc = VINF_SUCCESS;
474	for (unsigned i = 0; i < RT_ELEMENTS(s_apszDllNames); i++)
475	{
476	int rc2 = RTLdrLoadSystem(s_apszDllNames[i], true /fNoUnload/, &ahMods[i]);
477	if (RT_FAILURE(rc2))
478	{
479	if (!RTErrInfoIsSet(pErrInfo))
480	RTErrInfoSetF(pErrInfo, rc2, "Failed to load API DLL: %s: %Rrc", s_apszDllNames[i], rc2);
481	else
482	RTErrInfoAddF(pErrInfo, rc2, "; %s: %Rrc", s_apszDllNames[i], rc2);
483	ahMods[i] = NIL_RTLDRMOD;
484	rc = VERR_NEM_INIT_FAILED;
485	}
486	}
487	if (RT_SUCCESS(rc))
488	rc = nemR3WinInitVidIntercepts(ahMods[1], pErrInfo);
489	if (RT_SUCCESS(rc))
490	{
491	for (unsigned i = 0; i < RT_ELEMENTS(g_aImports); i++)
492	{
493	int rc2 = RTLdrGetSymbol(ahMods[g_aImports[i].idxDll], g_aImports[i].pszName, (void **)g_aImports[i].ppfn);
494	if (RT_FAILURE(rc2))
495	{
496	*g_aImports[i].ppfn = NULL;
497
498	LogRel(("NEM: %s: Failed to import %s!%s: %Rrc",
499	g_aImports[i].fOptional ? "info" : fForced ? "fatal" : "error",
500	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName, rc2));
501	if (!g_aImports[i].fOptional)
502	{
503	if (RTErrInfoIsSet(pErrInfo))
504	RTErrInfoAddF(pErrInfo, rc2, ", %s!%s",
505	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
506	else
507	rc = RTErrInfoSetF(pErrInfo, rc2, "Failed to import: %s!%s",
508	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
509	Assert(RT_FAILURE(rc));
510	}
511	}
512	}
513	if (RT_SUCCESS(rc))
514	{
515	Assert(!RTErrInfoIsSet(pErrInfo));
516	}
517	}
518
519	for (unsigned i = 0; i < RT_ELEMENTS(ahMods); i++)
520	RTLdrClose(ahMods[i]);
521	return rc;
522	}
523
524
525	/**
526	* Wrapper for different WHvGetCapability signatures.
527	*/
528	DECLINLINE(HRESULT) WHvGetCapabilityWrapper(WHV_CAPABILITY_CODE enmCap, WHV_CAPABILITY *pOutput, uint32_t cbOutput)
529	{
530	#ifdef NEM_WIN_USE_17110_PLUS_WDK
531	return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput, NULL);
532	#else
533	if (g_uBuildNo >= 17110)
534	{
535	PFNWHVGETCAPABILITY_17110 pfnNewVersion = (PFNWHVGETCAPABILITY_17110)g_pfnWHvGetCapability;
536	return pfnNewVersion(enmCap, &pOutput->HypervisorPresent, cbOutput - RT_OFFSETOF(WHV_CAPABILITY, HypervisorPresent), NULL);
537	}
538	return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput);
539	#endif
540	}
541
542
543	/**
544	* Worker for nemR3NativeInit that gets the hypervisor capabilities.
545	*
546	* @returns VBox status code.
547	* @param pVM The cross context VM structure.
548	* @param pErrInfo Where to always return error info.
549	*/
550	static int nemR3WinInitCheckCapabilities(PVM pVM, PRTERRINFO pErrInfo)
551	{
552	#define NEM_LOG_REL_CAP_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %-38s= " a_szFmt "\n", a_szField, a_Value))
553	#define NEM_LOG_REL_CAP_SUB_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %36s: " a_szFmt "\n", a_szField, a_Value))
554	#define NEM_LOG_REL_CAP_SUB(a_szField, a_Value) NEM_LOG_REL_CAP_SUB_EX(a_szField, "%d", a_Value)
555
556	/*
557	* Is the hypervisor present with the desired capability?
558	*
559	* In build 17083 this translates into:
560	* - CPUID[0x00000001].HVP is set
561	* - CPUID[0x40000000] == "Microsoft Hv"
562	* - CPUID[0x40000001].eax == "Hv#1"
563	* - CPUID[0x40000003].ebx[12] is set.
564	* - VidGetExoPartitionProperty(INVALID_HANDLE_VALUE, 0x60000, &Ignored) returns
565	* a non-zero value.
566	*/
567	/**
568	* @todo Someone at Microsoft please explain weird API design:
569	* 1. Pointless CapabilityCode duplication int the output;
570	* 2. No output size.
571	*/
572	WHV_CAPABILITY Caps;
573	RT_ZERO(Caps);
574	SetLastError(0);
575	HRESULT hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeHypervisorPresent, &Caps, sizeof(Caps));
576	DWORD rcWin = GetLastError();
577	if (FAILED(hrc))
578	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
579	"WHvGetCapability/WHvCapabilityCodeHypervisorPresent failed: %Rhrc (Last=%#x/%u)",
580	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
581	if (!Caps.HypervisorPresent)
582	{
583	if (!RTPathExists(RTPATH_NT_PASSTHRU_PREFIX "Device\\VidExo"))
584	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
585	"WHvCapabilityCodeHypervisorPresent is FALSE! Make sure you have enabled the 'Windows Hypervisor Platform' feature.");
586	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "WHvCapabilityCodeHypervisorPresent is FALSE! (%u)", rcWin);
587	}
588	LogRel(("NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...\n"));
589
590
591	/*
592	* Check what extended VM exits are supported.
593	*/
594	RT_ZERO(Caps);
595	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExtendedVmExits, &Caps, sizeof(Caps));
596	if (FAILED(hrc))
597	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
598	"WHvGetCapability/WHvCapabilityCodeExtendedVmExits failed: %Rhrc (Last=%#x/%u)",
599	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
600	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeExtendedVmExits", "%'#018RX64", Caps.ExtendedVmExits.AsUINT64);
601	pVM->nem.s.fExtendedMsrExit = RT_BOOL(Caps.ExtendedVmExits.X64MsrExit);
602	pVM->nem.s.fExtendedCpuIdExit = RT_BOOL(Caps.ExtendedVmExits.X64CpuidExit);
603	pVM->nem.s.fExtendedXcptExit = RT_BOOL(Caps.ExtendedVmExits.ExceptionExit);
604	NEM_LOG_REL_CAP_SUB("fExtendedMsrExit", pVM->nem.s.fExtendedMsrExit);
605	NEM_LOG_REL_CAP_SUB("fExtendedCpuIdExit", pVM->nem.s.fExtendedCpuIdExit);
606	NEM_LOG_REL_CAP_SUB("fExtendedXcptExit", pVM->nem.s.fExtendedXcptExit);
607	if (Caps.ExtendedVmExits.AsUINT64 & ~(uint64_t)7)
608	LogRel(("NEM: Warning! Unknown VM exit definitions: %#RX64\n", Caps.ExtendedVmExits.AsUINT64));
609	/** @todo RECHECK: WHV_EXTENDED_VM_EXITS typedef. */
610
611	/*
612	* Check features in case they end up defining any.
613	*/
614	RT_ZERO(Caps);
615	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeFeatures, &Caps, sizeof(Caps));
616	if (FAILED(hrc))
617	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
618	"WHvGetCapability/WHvCapabilityCodeFeatures failed: %Rhrc (Last=%#x/%u)",
619	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
620	if (Caps.Features.AsUINT64 & ~(uint64_t)0)
621	LogRel(("NEM: Warning! Unknown feature definitions: %#RX64\n", Caps.Features.AsUINT64));
622	/** @todo RECHECK: WHV_CAPABILITY_FEATURES typedef. */
623
624	/*
625	* Check that the CPU vendor is supported.
626	*/
627	RT_ZERO(Caps);
628	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorVendor, &Caps, sizeof(Caps));
629	if (FAILED(hrc))
630	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
631	"WHvGetCapability/WHvCapabilityCodeProcessorVendor failed: %Rhrc (Last=%#x/%u)",
632	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
633	switch (Caps.ProcessorVendor)
634	{
635	/** @todo RECHECK: WHV_PROCESSOR_VENDOR typedef. */
636	case WHvProcessorVendorIntel:
637	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - Intel", Caps.ProcessorVendor);
638	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_INTEL;
639	break;
640	case WHvProcessorVendorAmd:
641	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - AMD", Caps.ProcessorVendor);
642	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_AMD;
643	break;
644	default:
645	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d", Caps.ProcessorVendor);
646	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unknown processor vendor: %d", Caps.ProcessorVendor);
647	}
648
649	/*
650	* CPU features, guessing these are virtual CPU features?
651	*/
652	RT_ZERO(Caps);
653	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorFeatures, &Caps, sizeof(Caps));
654	if (FAILED(hrc))
655	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
656	"WHvGetCapability/WHvCapabilityCodeProcessorFeatures failed: %Rhrc (Last=%#x/%u)",
657	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
658	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorFeatures", "%'#018RX64", Caps.ProcessorFeatures.AsUINT64);
659	#define NEM_LOG_REL_CPU_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ProcessorFeatures.a_Field)
660	NEM_LOG_REL_CPU_FEATURE(Sse3Support);
661	NEM_LOG_REL_CPU_FEATURE(LahfSahfSupport);
662	NEM_LOG_REL_CPU_FEATURE(Ssse3Support);
663	NEM_LOG_REL_CPU_FEATURE(Sse4_1Support);
664	NEM_LOG_REL_CPU_FEATURE(Sse4_2Support);
665	NEM_LOG_REL_CPU_FEATURE(Sse4aSupport);
666	NEM_LOG_REL_CPU_FEATURE(XopSupport);
667	NEM_LOG_REL_CPU_FEATURE(PopCntSupport);
668	NEM_LOG_REL_CPU_FEATURE(Cmpxchg16bSupport);
669	NEM_LOG_REL_CPU_FEATURE(Altmovcr8Support);
670	NEM_LOG_REL_CPU_FEATURE(LzcntSupport);
671	NEM_LOG_REL_CPU_FEATURE(MisAlignSseSupport);
672	NEM_LOG_REL_CPU_FEATURE(MmxExtSupport);
673	NEM_LOG_REL_CPU_FEATURE(Amd3DNowSupport);
674	NEM_LOG_REL_CPU_FEATURE(ExtendedAmd3DNowSupport);
675	NEM_LOG_REL_CPU_FEATURE(Page1GbSupport);
676	NEM_LOG_REL_CPU_FEATURE(AesSupport);
677	NEM_LOG_REL_CPU_FEATURE(PclmulqdqSupport);
678	NEM_LOG_REL_CPU_FEATURE(PcidSupport);
679	NEM_LOG_REL_CPU_FEATURE(Fma4Support);
680	NEM_LOG_REL_CPU_FEATURE(F16CSupport);
681	NEM_LOG_REL_CPU_FEATURE(RdRandSupport);
682	NEM_LOG_REL_CPU_FEATURE(RdWrFsGsSupport);
683	NEM_LOG_REL_CPU_FEATURE(SmepSupport);
684	NEM_LOG_REL_CPU_FEATURE(EnhancedFastStringSupport);
685	NEM_LOG_REL_CPU_FEATURE(Bmi1Support);
686	NEM_LOG_REL_CPU_FEATURE(Bmi2Support);
687	/* two reserved bits here, see below */
688	NEM_LOG_REL_CPU_FEATURE(MovbeSupport);
689	NEM_LOG_REL_CPU_FEATURE(Npiep1Support);
690	NEM_LOG_REL_CPU_FEATURE(DepX87FPUSaveSupport);
691	NEM_LOG_REL_CPU_FEATURE(RdSeedSupport);
692	NEM_LOG_REL_CPU_FEATURE(AdxSupport);
693	NEM_LOG_REL_CPU_FEATURE(IntelPrefetchSupport);
694	NEM_LOG_REL_CPU_FEATURE(SmapSupport);
695	NEM_LOG_REL_CPU_FEATURE(HleSupport);
696	NEM_LOG_REL_CPU_FEATURE(RtmSupport);
697	NEM_LOG_REL_CPU_FEATURE(RdtscpSupport);
698	NEM_LOG_REL_CPU_FEATURE(ClflushoptSupport);
699	NEM_LOG_REL_CPU_FEATURE(ClwbSupport);
700	NEM_LOG_REL_CPU_FEATURE(ShaSupport);
701	NEM_LOG_REL_CPU_FEATURE(X87PointersSavedSupport);
702	#undef NEM_LOG_REL_CPU_FEATURE
703	if (Caps.ProcessorFeatures.AsUINT64 & (~(RT_BIT_64(43) - 1) \| RT_BIT_64(27) \| RT_BIT_64(28)))
704	LogRel(("NEM: Warning! Unknown CPU features: %#RX64\n", Caps.ProcessorFeatures.AsUINT64));
705	pVM->nem.s.uCpuFeatures.u64 = Caps.ProcessorFeatures.AsUINT64;
706	/** @todo RECHECK: WHV_PROCESSOR_FEATURES typedef. */
707
708	/*
709	* The cache line flush size.
710	*/
711	RT_ZERO(Caps);
712	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorClFlushSize, &Caps, sizeof(Caps));
713	if (FAILED(hrc))
714	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
715	"WHvGetCapability/WHvCapabilityCodeProcessorClFlushSize failed: %Rhrc (Last=%#x/%u)",
716	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
717	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorClFlushSize", "2^%u", Caps.ProcessorClFlushSize);
718	if (Caps.ProcessorClFlushSize < 8 && Caps.ProcessorClFlushSize > 9)
719	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unsupported cache line flush size: %u", Caps.ProcessorClFlushSize);
720	pVM->nem.s.cCacheLineFlushShift = Caps.ProcessorClFlushSize;
721
722	/*
723	* See if they've added more properties that we're not aware of.
724	*/
725	/** @todo RECHECK: WHV_CAPABILITY_CODE typedef. */
726	if (!IsDebuggerPresent()) /* Too noisy when in debugger, so skip. */
727	{
728	static const struct
729	{
730	uint32_t iMin, iMax; } s_aUnknowns[] =
731	{
732	{ 0x0003, 0x000f },
733	{ 0x1003, 0x100f },
734	{ 0x2000, 0x200f },
735	{ 0x3000, 0x300f },
736	{ 0x4000, 0x400f },
737	};
738	for (uint32_t j = 0; j < RT_ELEMENTS(s_aUnknowns); j++)
739	for (uint32_t i = s_aUnknowns[j].iMin; i <= s_aUnknowns[j].iMax; i++)
740	{
741	RT_ZERO(Caps);
742	hrc = WHvGetCapabilityWrapper((WHV_CAPABILITY_CODE)i, &Caps, sizeof(Caps));
743	if (SUCCEEDED(hrc))
744	LogRel(("NEM: Warning! Unknown capability %#x returning: %.*Rhxs\n", i, sizeof(Caps), &Caps));
745	}
746	}
747
748	#undef NEM_LOG_REL_CAP_EX
749	#undef NEM_LOG_REL_CAP_SUB_EX
750	#undef NEM_LOG_REL_CAP_SUB
751	return VINF_SUCCESS;
752	}
753
754
755	/**
756	* Used to fill in g_IoCtlGetHvPartitionId.
757	*/
758	static NTSTATUS WINAPI
759	nemR3WinIoctlDetector_GetHvPartitionId(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
760	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
761	PVOID pvOutput, ULONG cbOutput)
762	{
763	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
764	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
765	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
766	AssertLogRelMsgReturn(cbInput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
767	RT_NOREF(pvInput);
768
769	AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
770	AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_ID), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
771	(HV_PARTITION_ID )pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID;
772
773	g_IoCtlGetHvPartitionId.cbInput = cbInput;
774	g_IoCtlGetHvPartitionId.cbOutput = cbOutput;
775	g_IoCtlGetHvPartitionId.uFunction = uFunction;
776
777	return STATUS_SUCCESS;
778	}
779
780
781	/**
782	* Used to fill in g_IoCtlStartVirtualProcessor.
783	*/
784	static NTSTATUS WINAPI
785	nemR3WinIoctlDetector_StartVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
786	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
787	PVOID pvOutput, ULONG cbOutput)
788	{
789	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
790	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
791	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
792	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
793	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
794	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
795	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
796	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
797	RT_NOREF(pvOutput);
798
799	g_IoCtlStartVirtualProcessor.cbInput = cbInput;
800	g_IoCtlStartVirtualProcessor.cbOutput = cbOutput;
801	g_IoCtlStartVirtualProcessor.uFunction = uFunction;
802
803	return STATUS_SUCCESS;
804	}
805
806
807	/**
808	* Used to fill in g_IoCtlStartVirtualProcessor.
809	*/
810	static NTSTATUS WINAPI
811	nemR3WinIoctlDetector_StopVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
812	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
813	PVOID pvOutput, ULONG cbOutput)
814	{
815	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
816	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
817	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
818	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
819	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
820	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
821	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
822	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
823	RT_NOREF(pvOutput);
824
825	g_IoCtlStopVirtualProcessor.cbInput = cbInput;
826	g_IoCtlStopVirtualProcessor.cbOutput = cbOutput;
827	g_IoCtlStopVirtualProcessor.uFunction = uFunction;
828
829	return STATUS_SUCCESS;
830	}
831
832
833	/**
834	* Used to fill in g_IoCtlMessageSlotHandleAndGetNext
835	*/
836	static NTSTATUS WINAPI
837	nemR3WinIoctlDetector_MessageSlotHandleAndGetNext(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
838	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
839	PVOID pvOutput, ULONG cbOutput)
840	{
841	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
842	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
843	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
844
845	AssertLogRelMsgReturn(cbInput == sizeof(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT), ("cbInput=%#x\n", cbInput),
846	STATUS_INVALID_PARAMETER_8);
847	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
848	PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
849	AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
850	&& pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE
851	&& pVidIn->cMillies == NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT,
852	("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
853	STATUS_INVALID_PARAMETER_9);
854	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
855	RT_NOREF(pvOutput);
856
857	g_IoCtlMessageSlotHandleAndGetNext.cbInput = cbInput;
858	g_IoCtlMessageSlotHandleAndGetNext.cbOutput = cbOutput;
859	g_IoCtlMessageSlotHandleAndGetNext.uFunction = uFunction;
860
861	return STATUS_SUCCESS;
862	}
863
864
865	#ifdef LOG_ENABLED
866	/**
867	* Used to fill in what g_pIoCtlDetectForLogging points to.
868	*/
869	static NTSTATUS WINAPI nemR3WinIoctlDetector_ForLogging(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
870	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
871	PVOID pvOutput, ULONG cbOutput)
872	{
873	RT_NOREF(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pvInput, pvOutput);
874
875	g_pIoCtlDetectForLogging->cbInput = cbInput;
876	g_pIoCtlDetectForLogging->cbOutput = cbOutput;
877	g_pIoCtlDetectForLogging->uFunction = uFunction;
878
879	return STATUS_SUCCESS;
880	}
881	#endif
882
883
884	/**
885	* Worker for nemR3NativeInit that detect I/O control function numbers for VID.
886	*
887	* We use the function numbers directly in ring-0 and to name functions when
888	* logging NtDeviceIoControlFile calls.
889	*
890	* @note We could alternatively do this by disassembling the respective
891	* functions, but hooking NtDeviceIoControlFile and making fake calls
892	* more easily provides the desired information.
893	*
894	* @returns VBox status code.
895	* @param pVM The cross context VM structure. Will set I/O
896	* control info members.
897	* @param pErrInfo Where to always return error info.
898	*/
899	static int nemR3WinInitDiscoverIoControlProperties(PVM pVM, PRTERRINFO pErrInfo)
900	{
901	/*
902	* Probe the I/O control information for select VID APIs so we can use
903	* them directly from ring-0 and better log them.
904	*
905	*/
906	decltype(NtDeviceIoControlFile) * const pfnOrg = *g_ppfnVidNtDeviceIoControlFile;
907
908	/* VidGetHvPartitionId */
909	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetHvPartitionId;
910	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
911	BOOL fRet = g_pfnVidGetHvPartitionId(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &idHvPartition);
912	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
913	AssertReturn(fRet && idHvPartition == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID && g_IoCtlGetHvPartitionId.uFunction != 0,
914	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
915	"Problem figuring out VidGetHvPartitionId: fRet=%u idHvPartition=%#x dwErr=%u",
916	fRet, idHvPartition, GetLastError()) );
917	LogRel(("NEM: VidGetHvPartitionId -> fun:%#x in:%#x out:%#x\n",
918	g_IoCtlGetHvPartitionId.uFunction, g_IoCtlGetHvPartitionId.cbInput, g_IoCtlGetHvPartitionId.cbOutput));
919
920	/* VidStartVirtualProcessor */
921	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StartVirtualProcessor;
922	fRet = g_pfnVidStartVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
923	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
924	AssertReturn(fRet && g_IoCtlStartVirtualProcessor.uFunction != 0,
925	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
926	"Problem figuring out VidStartVirtualProcessor: fRet=%u dwErr=%u",
927	fRet, GetLastError()) );
928	LogRel(("NEM: VidStartVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStartVirtualProcessor.uFunction,
929	g_IoCtlStartVirtualProcessor.cbInput, g_IoCtlStartVirtualProcessor.cbOutput));
930
931	/* VidStopVirtualProcessor */
932	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StopVirtualProcessor;
933	fRet = g_pfnVidStopVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
934	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
935	AssertReturn(fRet && g_IoCtlStopVirtualProcessor.uFunction != 0,
936	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
937	"Problem figuring out VidStopVirtualProcessor: fRet=%u dwErr=%u",
938	fRet, GetLastError()) );
939	LogRel(("NEM: VidStopVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStopVirtualProcessor.uFunction,
940	g_IoCtlStopVirtualProcessor.cbInput, g_IoCtlStopVirtualProcessor.cbOutput));
941
942	/* VidMessageSlotHandleAndGetNext */
943	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_MessageSlotHandleAndGetNext;
944	fRet = g_pfnVidMessageSlotHandleAndGetNext(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE,
945	NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX, VID_MSHAGN_F_HANDLE_MESSAGE,
946	NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT);
947	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
948	AssertReturn(fRet && g_IoCtlMessageSlotHandleAndGetNext.uFunction != 0,
949	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
950	"Problem figuring out VidMessageSlotHandleAndGetNext: fRet=%u dwErr=%u",
951	fRet, GetLastError()) );
952	LogRel(("NEM: VidMessageSlotHandleAndGetNext -> fun:%#x in:%#x out:%#x\n",
953	g_IoCtlMessageSlotHandleAndGetNext.uFunction, g_IoCtlMessageSlotHandleAndGetNext.cbInput,
954	g_IoCtlMessageSlotHandleAndGetNext.cbOutput));
955
956	#ifdef LOG_ENABLED
957	/* The following are only for logging: */
958	union
959	{
960	VID_MAPPED_MESSAGE_SLOT MapSlot;
961	HV_REGISTER_NAME Name;
962	HV_REGISTER_VALUE Value;
963	} uBuf;
964
965	/* VidMessageSlotMap */
966	g_pIoCtlDetectForLogging = &g_IoCtlMessageSlotMap;
967	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
968	fRet = g_pfnVidMessageSlotMap(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &uBuf.MapSlot, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
969	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
970	Assert(fRet);
971	LogRel(("NEM: VidMessageSlotMap -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
972	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
973
974	/* VidGetVirtualProcessorState */
975	uBuf.Name = HvRegisterExplicitSuspend;
976	g_pIoCtlDetectForLogging = &g_IoCtlGetVirtualProcessorState;
977	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
978	fRet = g_pfnVidGetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
979	&uBuf.Name, 1, &uBuf.Value);
980	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
981	Assert(fRet);
982	LogRel(("NEM: VidGetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
983	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
984
985	/* VidSetVirtualProcessorState */
986	uBuf.Name = HvRegisterExplicitSuspend;
987	g_pIoCtlDetectForLogging = &g_IoCtlSetVirtualProcessorState;
988	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
989	fRet = g_pfnVidSetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
990	&uBuf.Name, 1, &uBuf.Value);
991	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
992	Assert(fRet);
993	LogRel(("NEM: VidSetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
994	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
995
996	g_pIoCtlDetectForLogging = NULL;
997	#endif
998
999	/* Done. */
1000	pVM->nem.s.IoCtlGetHvPartitionId = g_IoCtlGetHvPartitionId;
1001	pVM->nem.s.IoCtlStartVirtualProcessor = g_IoCtlStartVirtualProcessor;
1002	pVM->nem.s.IoCtlStopVirtualProcessor = g_IoCtlStopVirtualProcessor;
1003	pVM->nem.s.IoCtlMessageSlotHandleAndGetNext = g_IoCtlMessageSlotHandleAndGetNext;
1004	return VINF_SUCCESS;
1005	}
1006
1007
1008	/**
1009	* Wrapper for different WHvSetPartitionProperty signatures.
1010	*/
1011	DECLINLINE(HRESULT) WHvSetPartitionPropertyWrapper(WHV_PARTITION_HANDLE hPartition, WHV_PARTITION_PROPERTY_CODE enmProp,
1012	WHV_PARTITION_PROPERTY *pInput, uint32_t cbInput)
1013	{
1014	#ifdef NEM_WIN_USE_17110_PLUS_WDK
1015	return g_pfnWHvSetPartitionProperty(hPartition, enmProp, pInput, cbInput, NULL);
1016	#else
1017	pInput->PropertyCode = enmProp;
1018	if (g_uBuildNo >= 17110)
1019	{
1020	PFNWHVSETPARTITIONPROPERTY_17110 pfnNewVersion = (PFNWHVSETPARTITIONPROPERTY_17110)g_pfnWHvSetPartitionProperty;
1021	return pfnNewVersion(hPartition, enmProp, &pInput->ExtendedVmExits,
1022	cbInput - RT_UOFFSETOF(WHV_PARTITION_PROPERTY, ExtendedVmExits));
1023	}
1024	return g_pfnWHvSetPartitionProperty(hPartition, pInput, cbInput);
1025	#endif
1026	}
1027
1028
1029	/**
1030	* Creates and sets up a Hyper-V (exo) partition.
1031	*
1032	* @returns VBox status code.
1033	* @param pVM The cross context VM structure.
1034	* @param pErrInfo Where to always return error info.
1035	*/
1036	static int nemR3WinInitCreatePartition(PVM pVM, PRTERRINFO pErrInfo)
1037	{
1038	AssertReturn(!pVM->nem.s.hPartition, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1039	AssertReturn(!pVM->nem.s.hPartitionDevice, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1040
1041	/*
1042	* Create the partition.
1043	*/
1044	WHV_PARTITION_HANDLE hPartition;
1045	HRESULT hrc = WHvCreatePartition(&hPartition);
1046	if (FAILED(hrc))
1047	return RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED, "WHvCreatePartition failed with %Rhrc (Last=%#x/%u)",
1048	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1049
1050	int rc;
1051
1052	/*
1053	* Set partition properties, most importantly the CPU count.
1054	*/
1055	/**
1056	* @todo Someone at Microsoft please explain another weird API:
1057	* - Why this API doesn't take the WHV_PARTITION_PROPERTY_CODE value as an
1058	* argument rather than as part of the struct. That is so weird if you've
1059	* used any other NT or windows API, including WHvGetCapability().
1060	* - Why use PVOID when WHV_PARTITION_PROPERTY is what's expected. We
1061	* technically only need 9 bytes for setting/getting
1062	* WHVPartitionPropertyCodeProcessorClFlushSize, but the API insists on 16. */
1063	WHV_PARTITION_PROPERTY Property;
1064	RT_ZERO(Property);
1065	Property.ProcessorCount = pVM->cCpus;
1066	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorCount, &Property, sizeof(Property));
1067	if (SUCCEEDED(hrc))
1068	{
1069	RT_ZERO(Property);
1070	#if 0
1071	Property.ExtendedVmExits.X64CpuidExit = pVM->nem.s.fExtendedCpuIdExit;
1072	Property.ExtendedVmExits.X64MsrExit = pVM->nem.s.fExtendedMsrExit;
1073	Property.ExtendedVmExits.ExceptionExit = pVM->nem.s.fExtendedXcptExit;
1074	#endif
1075	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeExtendedVmExits, &Property, sizeof(Property));
1076	if (SUCCEEDED(hrc))
1077	{
1078	/*
1079	* We'll continue setup in nemR3NativeInitAfterCPUM.
1080	*/
1081	pVM->nem.s.fCreatedEmts = false;
1082	pVM->nem.s.hPartition = hPartition;
1083	LogRel(("NEM: Created partition %p.\n", hPartition));
1084	return VINF_SUCCESS;
1085	}
1086
1087	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1088	"Failed setting WHvPartitionPropertyCodeExtendedVmExits to %'#RX64: %Rhrc",
1089	Property.ExtendedVmExits.AsUINT64, hrc);
1090	}
1091	else
1092	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1093	"Failed setting WHvPartitionPropertyCodeProcessorCount to %u: %Rhrc (Last=%#x/%u)",
1094	pVM->cCpus, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1095	WHvDeletePartition(hPartition);
1096
1097	Assert(!pVM->nem.s.hPartitionDevice);
1098	Assert(!pVM->nem.s.hPartition);
1099	return rc;
1100	}
1101
1102
1103	/**
1104	* Try initialize the native API.
1105	*
1106	* This may only do part of the job, more can be done in
1107	* nemR3NativeInitAfterCPUM() and nemR3NativeInitCompleted().
1108	*
1109	* @returns VBox status code.
1110	* @param pVM The cross context VM structure.
1111	* @param fFallback Whether we're in fallback mode or use-NEM mode. In
1112	* the latter we'll fail if we cannot initialize.
1113	* @param fForced Whether the HMForced flag is set and we should
1114	* fail if we cannot initialize.
1115	*/
1116	int nemR3NativeInit(PVM pVM, bool fFallback, bool fForced)
1117	{
1118	g_uBuildNo = RTSystemGetNtBuildNo();
1119
1120	/*
1121	* Error state.
1122	* The error message will be non-empty on failure and 'rc' will be set too.
1123	*/
1124	RTERRINFOSTATIC ErrInfo;
1125	PRTERRINFO pErrInfo = RTErrInfoInitStatic(&ErrInfo);
1126	int rc = nemR3WinInitProbeAndLoad(fForced, pErrInfo);
1127	if (RT_SUCCESS(rc))
1128	{
1129	/*
1130	* Check the capabilties of the hypervisor, starting with whether it's present.
1131	*/
1132	rc = nemR3WinInitCheckCapabilities(pVM, pErrInfo);
1133	if (RT_SUCCESS(rc))
1134	{
1135	/*
1136	* Discover the VID I/O control function numbers we need.
1137	*/
1138	rc = nemR3WinInitDiscoverIoControlProperties(pVM, pErrInfo);
1139	if (RT_SUCCESS(rc))
1140	{
1141	/*
1142	* Check out our ring-0 capabilities.
1143	*/
1144	rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /idCpu/, VMMR0_DO_NEM_INIT_VM, 0, NULL);
1145	if (RT_SUCCESS(rc))
1146	{
1147	/*
1148	* Create and initialize a partition.
1149	*/
1150	rc = nemR3WinInitCreatePartition(pVM, pErrInfo);
1151	if (RT_SUCCESS(rc))
1152	{
1153	VM_SET_MAIN_EXECUTION_ENGINE(pVM, VM_EXEC_ENGINE_NATIVE_API);
1154	Log(("NEM: Marked active!\n"));
1155
1156	/* Register release statistics */
1157	for (VMCPUID iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1158	{
1159	PNEMCPU pNemCpu = &pVM->aCpus[iCpu].nem.s;
1160	STAMR3RegisterF(pVM, &pNemCpu->StatExitPortIo, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of port I/O exits", "/NEM/CPU%u/ExitPortIo", iCpu);
1161	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemUnmapped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unmapped memory exits", "/NEM/CPU%u/ExitMemUnmapped", iCpu);
1162	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemIntercept, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of intercepted memory exits", "/NEM/CPU%u/ExitMemIntercept", iCpu);
1163	STAMR3RegisterF(pVM, &pNemCpu->StatExitHalt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitHalt", iCpu);
1164	STAMR3RegisterF(pVM, &pNemCpu->StatGetMsgTimeout, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of get message timeouts/alerts", "/NEM/CPU%u/GetMsgTimeout", iCpu);
1165	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuSuccess, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of successful CPU stops", "/NEM/CPU%u/StopCpuSuccess", iCpu);
1166	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPending, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stops", "/NEM/CPU%u/StopCpuPending", iCpu);
1167	STAMR3RegisterF(pVM, &pNemCpu->StatCancelChangedState, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel changed state", "/NEM/CPU%u/CancelChangedState", iCpu);
1168	STAMR3RegisterF(pVM, &pNemCpu->StatCancelAlertedThread, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel alerted EMT", "/NEM/CPU%u/CancelAlertedEMT", iCpu);
1169	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPre, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pre execution FF breaks", "/NEM/CPU%u/BreakOnFFPre", iCpu);
1170	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPost, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of post execution FF breaks", "/NEM/CPU%u/BreakOnFFPost", iCpu);
1171	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnCancel, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel execution breaks", "/NEM/CPU%u/BreakOnCancel", iCpu);
1172	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnStatus, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of status code breaks", "/NEM/CPU%u/BreakOnStatus", iCpu);
1173	}
1174	}
1175	}
1176	}
1177	}
1178	}
1179
1180	/*
1181	* We only fail if in forced mode, otherwise just log the complaint and return.
1182	*/
1183	Assert(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API \|\| RTErrInfoIsSet(pErrInfo));
1184	if ( (fForced \|\| !fFallback)
1185	&& pVM->bMainExecutionEngine != VM_EXEC_ENGINE_NATIVE_API)
1186	return VMSetError(pVM, RT_SUCCESS_NP(rc) ? VERR_NEM_NOT_AVAILABLE : rc, RT_SRC_POS, "%s", pErrInfo->pszMsg);
1187
1188	if (RTErrInfoIsSet(pErrInfo))
1189	LogRel(("NEM: Not available: %s\n", pErrInfo->pszMsg));
1190	return VINF_SUCCESS;
1191	}
1192
1193
1194	/**
1195	* This is called after CPUMR3Init is done.
1196	*
1197	* @returns VBox status code.
1198	* @param pVM The VM handle..
1199	*/
1200	int nemR3NativeInitAfterCPUM(PVM pVM)
1201	{
1202	/*
1203	* Validate sanity.
1204	*/
1205	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1206	AssertReturn(hPartition != NULL, VERR_WRONG_ORDER);
1207	AssertReturn(!pVM->nem.s.hPartitionDevice, VERR_WRONG_ORDER);
1208	AssertReturn(!pVM->nem.s.fCreatedEmts, VERR_WRONG_ORDER);
1209	AssertReturn(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API, VERR_WRONG_ORDER);
1210
1211	/*
1212	* Continue setting up the partition now that we've got most of the CPUID feature stuff.
1213	*/
1214	WHV_PARTITION_PROPERTY Property;
1215	HRESULT hrc;
1216
1217	#if 0
1218	/* Not sure if we really need to set the vendor.
1219	Update: Apparently we don't. WHvPartitionPropertyCodeProcessorVendor was removed in 17110. */
1220	RT_ZERO(Property);
1221	Property.ProcessorVendor = pVM->nem.s.enmCpuVendor == CPUMCPUVENDOR_AMD ? WHvProcessorVendorAmd
1222	: WHvProcessorVendorIntel;
1223	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorVendor, &Property, sizeof(Property));
1224	if (FAILED(hrc))
1225	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1226	"Failed to set WHvPartitionPropertyCodeProcessorVendor to %u: %Rhrc (Last=%#x/%u)",
1227	Property.ProcessorVendor, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1228	#endif
1229
1230	/* Not sure if we really need to set the cache line flush size. */
1231	RT_ZERO(Property);
1232	Property.ProcessorClFlushSize = pVM->nem.s.cCacheLineFlushShift;
1233	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorClFlushSize, &Property, sizeof(Property));
1234	if (FAILED(hrc))
1235	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1236	"Failed to set WHvPartitionPropertyCodeProcessorClFlushSize to %u: %Rhrc (Last=%#x/%u)",
1237	pVM->nem.s.cCacheLineFlushShift, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1238
1239	/*
1240	* Sync CPU features with CPUM.
1241	*/
1242	/** @todo sync CPU features with CPUM. */
1243
1244	/* Set the partition property. */
1245	RT_ZERO(Property);
1246	Property.ProcessorFeatures.AsUINT64 = pVM->nem.s.uCpuFeatures.u64;
1247	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorFeatures, &Property, sizeof(Property));
1248	if (FAILED(hrc))
1249	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1250	"Failed to set WHvPartitionPropertyCodeProcessorFeatures to %'#RX64: %Rhrc (Last=%#x/%u)",
1251	pVM->nem.s.uCpuFeatures.u64, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1252
1253	/*
1254	* Set up the partition and create EMTs.
1255	*
1256	* Seems like this is where the partition is actually instantiated and we get
1257	* a handle to it.
1258	*/
1259	hrc = WHvSetupPartition(hPartition);
1260	if (FAILED(hrc))
1261	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1262	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)",
1263	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1264
1265	/* Get the handle. */
1266	HANDLE hPartitionDevice;
1267	__try
1268	{
1269	hPartitionDevice = ((HANDLE *)hPartition)[1];
1270	}
1271	__except(EXCEPTION_EXECUTE_HANDLER)
1272	{
1273	hrc = GetExceptionCode();
1274	hPartitionDevice = NULL;
1275	}
1276	if ( hPartitionDevice == NULL
1277	\|\| hPartitionDevice == (HANDLE)(intptr_t)-1)
1278	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1279	"Failed to get device handle for partition %p: %Rhrc", hPartition, hrc);
1280
1281	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1282	if (!g_pfnVidGetHvPartitionId(hPartitionDevice, &idHvPartition))
1283	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1284	"Failed to get device handle and/or partition ID for %p (hPartitionDevice=%p, Last=%#x/%u)",
1285	hPartition, hPartitionDevice, RTNtLastStatusValue(), RTNtLastErrorValue());
1286	pVM->nem.s.hPartitionDevice = hPartitionDevice;
1287	pVM->nem.s.idHvPartition = idHvPartition;
1288
1289	/*
1290	* Setup the EMTs.
1291	*/
1292	VMCPUID iCpu;
1293	for (iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1294	{
1295	PVMCPU pVCpu = &pVM->aCpus[iCpu];
1296
1297	pVCpu->nem.s.hNativeThreadHandle = (RTR3PTR)RTThreadGetNativeHandle(VMR3GetThreadHandle(pVCpu->pUVCpu));
1298	Assert((HANDLE)pVCpu->nem.s.hNativeThreadHandle != INVALID_HANDLE_VALUE);
1299
1300	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1301	VID_MAPPED_MESSAGE_SLOT MappedMsgSlot = { NULL, UINT32_MAX, UINT32_MAX };
1302	if (g_pfnVidMessageSlotMap(hPartitionDevice, &MappedMsgSlot, iCpu))
1303	{
1304	AssertLogRelMsg(MappedMsgSlot.iCpu == iCpu && MappedMsgSlot.uParentAdvisory == UINT32_MAX,
1305	("%#x %#x (iCpu=%#x)\n", MappedMsgSlot.iCpu, MappedMsgSlot.uParentAdvisory, iCpu));
1306	pVCpu->nem.s.pvMsgSlotMapping = MappedMsgSlot.pMsgBlock;
1307	}
1308	else
1309	{
1310	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1311	DWORD const dwErrLast = RTNtLastErrorValue();
1312	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1313	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1314	}
1315	#else
1316	hrc = WHvCreateVirtualProcessor(hPartition, iCpu, 0 /fFlags/);
1317	if (FAILED(hrc))
1318	{
1319	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1320	DWORD const dwErrLast = RTNtLastErrorValue();
1321	while (iCpu-- > 0)
1322	{
1323	HRESULT hrc2 = WHvDeleteVirtualProcessor(hPartition, iCpu);
1324	AssertLogRelMsg(SUCCEEDED(hrc2), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1325	hPartition, iCpu, hrc2, RTNtLastStatusValue(),
1326	RTNtLastErrorValue()));
1327	}
1328	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1329	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1330	}
1331	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
1332	}
1333	pVM->nem.s.fCreatedEmts = true;
1334
1335	/*
1336	* Do some more ring-0 initialization now that we've got the partition handle.
1337	*/
1338	int rc = VMMR3CallR0Emt(pVM, &pVM->aCpus[0], VMMR0_DO_NEM_INIT_VM_PART_2, 0, NULL);
1339	if (RT_SUCCESS(rc))
1340	{
1341	LogRel(("NEM: Successfully set up partition (device handle %p, partition ID %#llx)\n", hPartitionDevice, idHvPartition));
1342	return VINF_SUCCESS;
1343	}
1344	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS, "Call to NEMR0InitVMPart2 failed: %Rrc", rc);
1345	}
1346
1347
1348	int nemR3NativeInitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
1349	{
1350	//BOOL fRet = SetThreadPriority(GetCurrentThread(), 0);
1351	//AssertLogRel(fRet);
1352
1353	NOREF(pVM); NOREF(enmWhat);
1354	return VINF_SUCCESS;
1355	}
1356
1357
1358	int nemR3NativeTerm(PVM pVM)
1359	{
1360	/*
1361	* Delete the partition.
1362	*/
1363	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1364	pVM->nem.s.hPartition = NULL;
1365	pVM->nem.s.hPartitionDevice = NULL;
1366	if (hPartition != NULL)
1367	{
1368	VMCPUID iCpu = pVM->nem.s.fCreatedEmts ? pVM->cCpus : 0;
1369	LogRel(("NEM: Destroying partition %p with its %u VCpus...\n", hPartition, iCpu));
1370	while (iCpu-- > 0)
1371	{
1372	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1373	pVM->aCpus[iCpu].nem.s.pvMsgSlotMapping = NULL;
1374	#else
1375	HRESULT hrc = WHvDeleteVirtualProcessor(hPartition, iCpu);
1376	AssertLogRelMsg(SUCCEEDED(hrc), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1377	hPartition, iCpu, hrc, RTNtLastStatusValue(),
1378	RTNtLastErrorValue()));
1379	#endif
1380	}
1381	WHvDeletePartition(hPartition);
1382	}
1383	pVM->nem.s.fCreatedEmts = false;
1384	return VINF_SUCCESS;
1385	}
1386
1387
1388	/**
1389	* VM reset notification.
1390	*
1391	* @param pVM The cross context VM structure.
1392	*/
1393	void nemR3NativeReset(PVM pVM)
1394	{
1395	/* Unfix the A20 gate. */
1396	pVM->nem.s.fA20Fixed = false;
1397	}
1398
1399
1400	/**
1401	* Reset CPU due to INIT IPI or hot (un)plugging.
1402	*
1403	* @param pVCpu The cross context virtual CPU structure of the CPU being
1404	* reset.
1405	* @param fInitIpi Whether this is the INIT IPI or hot (un)plugging case.
1406	*/
1407	void nemR3NativeResetCpu(PVMCPU pVCpu, bool fInitIpi)
1408	{
1409	/* Lock the A20 gate if INIT IPI, make sure it's enabled. */
1410	if (fInitIpi && pVCpu->idCpu > 0)
1411	{
1412	PVM pVM = pVCpu->CTX_SUFF(pVM);
1413	if (!pVM->nem.s.fA20Enabled)
1414	nemR3NativeNotifySetA20(pVCpu, true);
1415	pVM->nem.s.fA20Enabled = true;
1416	pVM->nem.s.fA20Fixed = true;
1417	}
1418	}
1419
1420	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
1421
1422	# ifdef LOG_ENABLED
1423	/**
1424	* Log the full details of an exit reason.
1425	*
1426	* @param pExitReason The exit reason to log.
1427	*/
1428	static void nemR3WinLogWHvExitReason(WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1429	{
1430	bool fExitCtx = false;
1431	bool fExitInstr = false;
1432	switch (pExitReason->ExitReason)
1433	{
1434	case WHvRunVpExitReasonMemoryAccess:
1435	Log2(("Exit: Memory access: GCPhys=%RGp GCVirt=%RGv %s %s %s\n",
1436	pExitReason->MemoryAccess.Gpa, pExitReason->MemoryAccess.Gva,
1437	g_apszWHvMemAccesstypes[pExitReason->MemoryAccess.AccessInfo.AccessType],
1438	pExitReason->MemoryAccess.AccessInfo.GpaUnmapped ? "unmapped" : "mapped",
1439	pExitReason->MemoryAccess.AccessInfo.GvaValid ? "" : "invalid-gc-virt"));
1440	AssertMsg(!(pExitReason->MemoryAccess.AccessInfo.AsUINT32 & ~UINT32_C(0xf)),
1441	("MemoryAccess.AccessInfo=%#x\n", pExitReason->MemoryAccess.AccessInfo.AsUINT32));
1442	fExitCtx = fExitInstr = true;
1443	break;
1444
1445	case WHvRunVpExitReasonX64IoPortAccess:
1446	Log2(("Exit: I/O port access: IoPort=%#x LB %u %s%s%s rax=%#RX64 rcx=%#RX64 rsi=%#RX64 rdi=%#RX64\n",
1447	pExitReason->IoPortAccess.PortNumber,
1448	pExitReason->IoPortAccess.AccessInfo.AccessSize,
1449	pExitReason->IoPortAccess.AccessInfo.IsWrite ? "out" : "in",
1450	pExitReason->IoPortAccess.AccessInfo.StringOp ? " string" : "",
1451	pExitReason->IoPortAccess.AccessInfo.RepPrefix ? " rep" : "",
1452	pExitReason->IoPortAccess.Rax,
1453	pExitReason->IoPortAccess.Rcx,
1454	pExitReason->IoPortAccess.Rsi,
1455	pExitReason->IoPortAccess.Rdi));
1456	Log2(("Exit: + ds=%#x:{%#RX64 LB %#RX32, %#x} es=%#x:{%#RX64 LB %#RX32, %#x}\n",
1457	pExitReason->IoPortAccess.Ds.Selector,
1458	pExitReason->IoPortAccess.Ds.Base,
1459	pExitReason->IoPortAccess.Ds.Limit,
1460	pExitReason->IoPortAccess.Ds.Attributes,
1461	pExitReason->IoPortAccess.Es.Selector,
1462	pExitReason->IoPortAccess.Es.Base,
1463	pExitReason->IoPortAccess.Es.Limit,
1464	pExitReason->IoPortAccess.Es.Attributes ));
1465
1466	AssertMsg( pExitReason->IoPortAccess.AccessInfo.AccessSize == 1
1467	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 2
1468	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 4,
1469	("IoPortAccess.AccessInfo.AccessSize=%d\n", pExitReason->IoPortAccess.AccessInfo.AccessSize));
1470	AssertMsg(!(pExitReason->IoPortAccess.AccessInfo.AsUINT32 & ~UINT32_C(0x3f)),
1471	("IoPortAccess.AccessInfo=%#x\n", pExitReason->IoPortAccess.AccessInfo.AsUINT32));
1472	fExitCtx = fExitInstr = true;
1473	break;
1474
1475	# if 0
1476	case WHvRunVpExitReasonUnrecoverableException:
1477	case WHvRunVpExitReasonInvalidVpRegisterValue:
1478	case WHvRunVpExitReasonUnsupportedFeature:
1479	case WHvRunVpExitReasonX64InterruptWindow:
1480	case WHvRunVpExitReasonX64Halt:
1481	case WHvRunVpExitReasonX64MsrAccess:
1482	case WHvRunVpExitReasonX64Cpuid:
1483	case WHvRunVpExitReasonException:
1484	case WHvRunVpExitReasonCanceled:
1485	case WHvRunVpExitReasonAlerted:
1486	WHV_X64_MSR_ACCESS_CONTEXT MsrAccess;
1487	WHV_X64_CPUID_ACCESS_CONTEXT CpuidAccess;
1488	WHV_VP_EXCEPTION_CONTEXT VpException;
1489	WHV_X64_INTERRUPTION_DELIVERABLE_CONTEXT InterruptWindow;
1490	WHV_UNRECOVERABLE_EXCEPTION_CONTEXT UnrecoverableException;
1491	WHV_X64_UNSUPPORTED_FEATURE_CONTEXT UnsupportedFeature;
1492	WHV_RUN_VP_CANCELED_CONTEXT CancelReason;
1493	# endif
1494
1495	case WHvRunVpExitReasonNone:
1496	Log2(("Exit: No reason\n"));
1497	AssertFailed();
1498	break;
1499
1500	default:
1501	Log(("Exit: %#x\n", pExitReason->ExitReason));
1502	break;
1503	}
1504
1505	/*
1506	* Context and maybe instruction details.
1507	*/
1508	if (fExitCtx)
1509	{
1510	const WHV_VP_EXIT_CONTEXT *pVpCtx = &pExitReason->IoPortAccess.VpContext;
1511	Log2(("Exit: + CS:RIP=%04x:%08RX64 RFLAGS=%06RX64 cbInstr=%u CS={%RX64 L %#RX32, %#x}\n",
1512	pVpCtx->Cs.Selector,
1513	pVpCtx->Rip,
1514	pVpCtx->Rflags,
1515	pVpCtx->InstructionLength,
1516	pVpCtx->Cs.Base, pVpCtx->Cs.Limit, pVpCtx->Cs.Attributes));
1517	Log2(("Exit: + cpl=%d CR0.PE=%d CR0.AM=%d EFER.LMA=%d DebugActive=%d InterruptionPending=%d InterruptShadow=%d\n",
1518	pVpCtx->ExecutionState.Cpl,
1519	pVpCtx->ExecutionState.Cr0Pe,
1520	pVpCtx->ExecutionState.Cr0Am,
1521	pVpCtx->ExecutionState.EferLma,
1522	pVpCtx->ExecutionState.DebugActive,
1523	pVpCtx->ExecutionState.InterruptionPending,
1524	pVpCtx->ExecutionState.InterruptShadow));
1525	AssertMsg(!(pVpCtx->ExecutionState.AsUINT16 & ~UINT16_C(0x107f)),
1526	("ExecutionState.AsUINT16=%#x\n", pVpCtx->ExecutionState.AsUINT16));
1527
1528	/** @todo Someone at Microsoft please explain why the InstructionBytes fields
1529	* are 16 bytes long, when 15 would've been sufficent and saved 3-7 bytes of
1530	* alignment padding? Intel max length is 15, so is this sSome ARM stuff?
1531	* Aren't ARM
1532	* instructions max 32-bit wide? Confused. */
1533	if (fExitInstr && pExitReason->IoPortAccess.InstructionByteCount > 0)
1534	Log2(("Exit: + Instruction %.*Rhxs\n",
1535	pExitReason->IoPortAccess.InstructionByteCount,
1536	&pExitReason->IoPortAccess.InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0]));
1537	}
1538	}
1539	# endif /* LOG_ENABLED */
1540
1541
1542	/**
1543	* Advances the guest RIP and clear EFLAGS.RF.
1544	*
1545	* This may clear VMCPU_FF_INHIBIT_INTERRUPTS.
1546	*
1547	* @param pVCpu The cross context virtual CPU structure.
1548	* @param pCtx The CPU context to update.
1549	* @param pExitCtx The exit context.
1550	*/
1551	DECLINLINE(void) nemR3WinAdvanceGuestRipAndClearRF(PVMCPU pVCpu, PCPUMCTX pCtx, WHV_VP_EXIT_CONTEXT const *pExitCtx)
1552	{
1553	/* Advance the RIP. */
1554	Assert(pExitCtx->InstructionLength > 0 && pExitCtx->InstructionLength < 16);
1555	pCtx->rip += pExitCtx->InstructionLength;
1556	pCtx->rflags.Bits.u1RF = 0;
1557
1558	/* Update interrupt inhibition. */
1559	if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1560	{ /* likely */ }
1561	else if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
1562	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
1563	}
1564
1565
1566	static VBOXSTRICTRC nemR3WinWHvHandleHalt(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1567	{
1568	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
1569	LogFlow(("nemR3WinWHvHandleHalt\n"));
1570	return VINF_EM_HALT;
1571	}
1572
1573
1574	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1575	/**
1576	* @callback_method_impl{FNPGMPHYSNEMENUMCALLBACK,
1577	* Hack to unmap all pages when/before we run into quota (WHv only).}
1578	*/
1579	static DECLCALLBACK(int) nemR3WinWHvUnmapOnePageCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint8_t pu2NemState, void pvUser)
1580	{
1581	RT_NOREF_PV(pvUser);
1582	RT_NOREF_PV(pVCpu);
1583	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
1584	if (SUCCEEDED(hrc))
1585	{
1586	Log5(("NEM GPA unmap all: %RGp (cMappedPages=%u)\n", GCPhys, pVM->nem.s.cMappedPages - 1));
1587	*pu2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
1588	}
1589	else
1590	{
1591	LogRel(("nemR3WinWHvUnmapOnePageCallback: GCPhys=%RGp %s hrc=%Rhrc (%#x) Last=%#x/%u (cMappedPages=%u)\n",
1592	GCPhys, g_apszPageStates[*pu2NemState], hrc, hrc, RTNtLastStatusValue(),
1593	RTNtLastErrorValue(), pVM->nem.s.cMappedPages));
1594	*pu2NemState = NEM_WIN_PAGE_STATE_NOT_SET;
1595	}
1596	if (pVM->nem.s.cMappedPages > 0)
1597	ASMAtomicDecU32(&pVM->nem.s.cMappedPages);
1598	return VINF_SUCCESS;
1599	}
1600	# endif /* !NEM_WIN_USE_HYPERCALLS_FOR_PAGES */
1601
1602
1603	/**
1604	* Handles an memory access VMEXIT.
1605	*
1606	* This can be triggered by a number of things.
1607	*
1608	* @returns Strict VBox status code.
1609	* @param pVM The cross context VM structure.
1610	* @param pVCpu The cross context virtual CPU structure.
1611	* @param pCtx The CPU context to update.
1612	* @param pMemCtx The exit reason information.
1613	*/
1614	static VBOXSTRICTRC nemR3WinWHvHandleMemoryAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_MEMORY_ACCESS_CONTEXT const *pMemCtx)
1615	{
1616	/*
1617	* Ask PGM for information about the given GCPhys. We need to check if we're
1618	* out of sync first.
1619	*/
1620	NEMHCWINHMACPCCSTATE State = { pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite, false, false };
1621	PGMPHYSNEMPAGEINFO Info;
1622	int rc = PGMPhysNemPageInfoChecker(pVM, pVCpu, pMemCtx->Gpa, State.fWriteAccess, &Info,
1623	nemHCWinHandleMemoryAccessPageCheckerCallback, &State);
1624	if (RT_SUCCESS(rc))
1625	{
1626	if (Info.fNemProt & (pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite ? NEM_PAGE_PROT_WRITE : NEM_PAGE_PROT_READ))
1627	{
1628	if (State.fCanResume)
1629	{
1630	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; restarting (%s)\n",
1631	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1632	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1633	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1634	return VINF_SUCCESS;
1635	}
1636	}
1637	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; emulating (%s)\n",
1638	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1639	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1640	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1641	}
1642	else
1643	Log4(("MemExit: %RGp rc=%Rrc%s; emulating (%s)\n", pMemCtx->Gpa, rc,
1644	State.fDidSomething ? " modified-backing" : "", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1645
1646	/*
1647	* Emulate the memory access, either access handler or special memory.
1648	*/
1649	rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1650	AssertRCReturn(rc, rc);
1651
1652	VBOXSTRICTRC rcStrict;
1653	if (pMemCtx->InstructionByteCount > 0)
1654	rcStrict = IEMExecOneWithPrefetchedByPC(pVCpu, CPUMCTX2CORE(pCtx), pMemCtx->VpContext.Rip,
1655	&pMemCtx->InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0],
1656	pMemCtx->InstructionByteCount);
1657	else
1658	rcStrict = IEMExecOne(pVCpu);
1659	/** @todo do we need to do anything wrt debugging here? */
1660	return rcStrict;
1661	}
1662
1663
1664	/**
1665	* Handles an I/O port access VMEXIT.
1666	*
1667	* We ASSUME that the hypervisor has don't I/O port access control.
1668	*
1669	* @returns Strict VBox status code.
1670	* @param pVM The cross context VM structure.
1671	* @param pVCpu The cross context virtual CPU structure.
1672	* @param pCtx The CPU context to update.
1673	* @param pIoPortCtx The exit reason information.
1674	*/
1675	static VBOXSTRICTRC nemR3WinWHvHandleIoPortAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx,
1676	WHV_X64_IO_PORT_ACCESS_CONTEXT const *pIoPortCtx)
1677	{
1678	Assert( pIoPortCtx->AccessInfo.AccessSize == 1
1679	\|\| pIoPortCtx->AccessInfo.AccessSize == 2
1680	\|\| pIoPortCtx->AccessInfo.AccessSize == 4);
1681
1682	VBOXSTRICTRC rcStrict;
1683	if (!pIoPortCtx->AccessInfo.StringOp)
1684	{
1685	/*
1686	* Simple port I/O.
1687	*/
1688	//Assert(pCtx->rax == pIoPortCtx->Rax); - sledgehammer
1689
1690	static uint32_t const s_fAndMask[8] =
1691	{ UINT32_MAX, UINT32_C(0xff), UINT32_C(0xffff), UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX };
1692	uint32_t const fAndMask = s_fAndMask[pIoPortCtx->AccessInfo.AccessSize];
1693	if (pIoPortCtx->AccessInfo.IsWrite)
1694	{
1695	rcStrict = IOMIOPortWrite(pVM, pVCpu, pIoPortCtx->PortNumber, (uint32_t)pIoPortCtx->Rax & fAndMask,
1696	pIoPortCtx->AccessInfo.AccessSize);
1697	if (IOM_SUCCESS(rcStrict))
1698	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, &pIoPortCtx->VpContext);
1699	}
1700	else
1701	{
1702	uint32_t uValue = 0;
1703	rcStrict = IOMIOPortRead(pVM, pVCpu, pIoPortCtx->PortNumber, &uValue,
1704	pIoPortCtx->AccessInfo.AccessSize);
1705	if (IOM_SUCCESS(rcStrict))
1706	{
1707	pCtx->eax = (pCtx->eax & ~fAndMask) \| (uValue & fAndMask);
1708	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, &pIoPortCtx->VpContext);
1709	}
1710	}
1711	}
1712	else
1713	{
1714	/*
1715	* String port I/O.
1716	*/
1717	/** @todo Someone at Microsoft please explain how we can get the address mode
1718	* from the IoPortAccess.VpContext. CS.Attributes is only sufficient for
1719	* getting the default mode, it can always be overridden by a prefix. This
1720	* forces us to interpret the instruction from opcodes, which is suboptimal.
1721	* Both AMD-V and VT-x includes the address size in the exit info, at least on
1722	* CPUs that are reasonably new. */
1723	# if 0 // requires sledgehammer
1724	Assert( pIoPortCtx->Ds.Base == pCtx->ds.u64Base
1725	&& pIoPortCtx->Ds.Limit == pCtx->ds.u32Limit
1726	&& pIoPortCtx->Ds.Selector == pCtx->ds.Sel);
1727	Assert( pIoPortCtx->Es.Base == pCtx->es.u64Base
1728	&& pIoPortCtx->Es.Limit == pCtx->es.u32Limit
1729	&& pIoPortCtx->Es.Selector == pCtx->es.Sel);
1730	Assert(pIoPortCtx->Rdi == pCtx->rdi);
1731	Assert(pIoPortCtx->Rsi == pCtx->rsi);
1732	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1733	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1734	# endif
1735
1736	int rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1737	AssertRCReturn(rc, rc);
1738
1739	rcStrict = IEMExecOne(pVCpu);
1740	}
1741	if (IOM_SUCCESS(rcStrict))
1742	{
1743	/*
1744	* Do debug checks.
1745	*/
1746	if ( pIoPortCtx->VpContext.ExecutionState.DebugActive /** @todo Microsoft: Does DebugActive this only reflext DR7? */
1747	\|\| (pIoPortCtx->VpContext.Rflags & X86_EFL_TF)
1748	\|\| DBGFBpIsHwIoArmed(pVM) )
1749	{
1750	/** @todo Debugging. */
1751	}
1752	}
1753	return rcStrict;
1754	}
1755
1756
1757	static VBOXSTRICTRC nemR3WinWHvHandleInterruptWindow(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1758	{
1759	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1760	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1761	}
1762
1763
1764	static VBOXSTRICTRC nemR3WinWHvHandleMsrAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1765	{
1766	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1767	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1768	}
1769
1770
1771	static VBOXSTRICTRC nemR3WinWHvHandleCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1772	{
1773	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1774	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1775	}
1776
1777
1778	static VBOXSTRICTRC nemR3WinWHvHandleException(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1779	{
1780	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1781	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1782	}
1783
1784
1785	static VBOXSTRICTRC nemR3WinWHvHandleUD(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1786	{
1787	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1788	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1789	}
1790
1791
1792	static VBOXSTRICTRC nemR3WinWHvHandleTripleFault(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1793	{
1794	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1795	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1796	}
1797
1798
1799	static VBOXSTRICTRC nemR3WinWHvHandleInvalidState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1800	{
1801	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1802	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1803	}
1804
1805
1806	VBOXSTRICTRC nemR3WinWHvRunGC(PVM pVM, PVMCPU pVCpu)
1807	{
1808	# ifdef LOG_ENABLED
1809	if (LogIs3Enabled())
1810	{
1811	Log3(("nemR3NativeRunGC: Entering #%u\n", pVCpu->idCpu));
1812	nemHCWinLogState(pVM, pVCpu);
1813	}
1814	# endif
1815
1816	/*
1817	* The run loop.
1818	*/
1819	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
1820	const bool fSingleStepping = false; /** @todo get this from somewhere. */
1821	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1822	for (unsigned iLoop = 0;;iLoop++)
1823	{
1824	/*
1825	* Copy the state.
1826	*/
1827	int rc2 = nemHCWinCopyStateToHyperV(pVM, pVCpu, pCtx);
1828	AssertRCBreakStmt(rc2, rcStrict = rc2);
1829
1830	/*
1831	* Run a bit.
1832	*/
1833	WHV_RUN_VP_EXIT_CONTEXT ExitReason;
1834	RT_ZERO(ExitReason);
1835	if ( !VM_FF_IS_PENDING(pVM, VM_FF_EMT_RENDEZVOUS \| VM_FF_TM_VIRTUAL_SYNC)
1836	&& !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
1837	{
1838	Log8(("Calling WHvRunVirtualProcessor\n"));
1839	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC_NEM, VMCPUSTATE_STARTED);
1840	HRESULT hrc = WHvRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, &ExitReason, sizeof(ExitReason));
1841	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC_NEM);
1842	AssertLogRelMsgBreakStmt(SUCCEEDED(hrc),
1843	("WHvRunVirtualProcessor(%p, %u,,) -> %Rhrc (Last=%#x/%u)\n", pVM->nem.s.hPartition, pVCpu->idCpu,
1844	hrc, RTNtLastStatusValue(), RTNtLastErrorValue()),
1845	rcStrict = VERR_INTERNAL_ERROR);
1846	Log2(("WHvRunVirtualProcessor -> %#x; exit code %#x (%d) (cpu status %u)\n",
1847	hrc, ExitReason.ExitReason, ExitReason.ExitReason, nemHCWinCpuGetRunningStatus(pVCpu) ));
1848	}
1849	else
1850	{
1851	LogFlow(("nemR3NativeRunGC: returning: pending FF (pre exec)\n"));
1852	break;
1853	}
1854
1855	# if 0 /* sledgehammer approach */
1856	/*
1857	* Copy back the state.
1858	*/
1859	rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, UINT64_MAX);
1860	AssertRCBreakStmt(rc2, rcStrict = rc2);
1861	# endif
1862
1863	# ifdef LOG_ENABLED
1864	/*
1865	* Do some logging.
1866	*/
1867	if (LogIs2Enabled())
1868	nemR3WinLogWHvExitReason(&ExitReason);
1869	if (LogIs3Enabled())
1870	nemHCWinLogState(pVM, pVCpu);
1871	# endif
1872
1873	# if 0 //def VBOX_STRICT - requires sledgehammer
1874	/* Assert that the VpContext field makes sense. */
1875	switch (ExitReason.ExitReason)
1876	{
1877	case WHvRunVpExitReasonMemoryAccess:
1878	case WHvRunVpExitReasonX64IoPortAccess:
1879	case WHvRunVpExitReasonX64MsrAccess:
1880	case WHvRunVpExitReasonX64Cpuid:
1881	case WHvRunVpExitReasonException:
1882	case WHvRunVpExitReasonUnrecoverableException:
1883	Assert( ExitReason.IoPortAccess.VpContext.InstructionLength > 0
1884	\|\| ( ExitReason.ExitReason == WHvRunVpExitReasonMemoryAccess
1885	&& ExitReason.MemoryAccess.AccessInfo.AccessType == WHvMemoryAccessExecute));
1886	Assert(ExitReason.IoPortAccess.VpContext.InstructionLength < 16);
1887	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cpl == CPUMGetGuestCPL(pVCpu));
1888	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Pe == RT_BOOL(pCtx->cr0 & X86_CR0_PE));
1889	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Am == RT_BOOL(pCtx->cr0 & X86_CR0_AM));
1890	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.EferLma == RT_BOOL(pCtx->msrEFER & MSR_K6_EFER_LMA));
1891	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.DebugActive == RT_BOOL(pCtx->dr[7] & X86_DR7_ENABLED_MASK));
1892	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved0 == 0);
1893	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved1 == 0);
1894	Assert(ExitReason.IoPortAccess.VpContext.Rip == pCtx->rip);
1895	Assert(ExitReason.IoPortAccess.VpContext.Rflags == pCtx->rflags.u);
1896	Assert( ExitReason.IoPortAccess.VpContext.Cs.Base == pCtx->cs.u64Base
1897	&& ExitReason.IoPortAccess.VpContext.Cs.Limit == pCtx->cs.u32Limit
1898	&& ExitReason.IoPortAccess.VpContext.Cs.Selector == pCtx->cs.Sel);
1899	break;
1900	default: break; /* shut up compiler. */
1901	}
1902	# endif
1903
1904	/*
1905	* Deal with the exit.
1906	*/
1907	switch (ExitReason.ExitReason)
1908	{
1909	/* Frequent exits: */
1910	case WHvRunVpExitReasonCanceled:
1911	case WHvRunVpExitReasonAlerted:
1912	rcStrict = VINF_SUCCESS;
1913	break;
1914
1915	case WHvRunVpExitReasonX64Halt:
1916	rcStrict = nemR3WinWHvHandleHalt(pVM, pVCpu, pCtx);
1917	break;
1918
1919	case WHvRunVpExitReasonMemoryAccess:
1920	rcStrict = nemR3WinWHvHandleMemoryAccess(pVM, pVCpu, pCtx, &ExitReason.MemoryAccess);
1921	break;
1922
1923	case WHvRunVpExitReasonX64IoPortAccess:
1924	rcStrict = nemR3WinWHvHandleIoPortAccess(pVM, pVCpu, pCtx, &ExitReason.IoPortAccess);
1925	break;
1926
1927	case WHvRunVpExitReasonX64InterruptWindow:
1928	rcStrict = nemR3WinWHvHandleInterruptWindow(pVM, pVCpu, pCtx, &ExitReason);
1929	break;
1930
1931	case WHvRunVpExitReasonX64MsrAccess: /* needs configuring */
1932	rcStrict = nemR3WinWHvHandleMsrAccess(pVM, pVCpu, pCtx, &ExitReason);
1933	break;
1934
1935	case WHvRunVpExitReasonX64Cpuid: /* needs configuring */
1936	rcStrict = nemR3WinWHvHandleCpuId(pVM, pVCpu, pCtx, &ExitReason);
1937	break;
1938
1939	case WHvRunVpExitReasonException: /* needs configuring */
1940	rcStrict = nemR3WinWHvHandleException(pVM, pVCpu, pCtx, &ExitReason);
1941	break;
1942
1943	/* Unlikely exits: */
1944	case WHvRunVpExitReasonUnsupportedFeature:
1945	rcStrict = nemR3WinWHvHandleUD(pVM, pVCpu, pCtx, &ExitReason);
1946	break;
1947
1948	case WHvRunVpExitReasonUnrecoverableException:
1949	rcStrict = nemR3WinWHvHandleTripleFault(pVM, pVCpu, pCtx, &ExitReason);
1950	break;
1951
1952	case WHvRunVpExitReasonInvalidVpRegisterValue:
1953	rcStrict = nemR3WinWHvHandleInvalidState(pVM, pVCpu, pCtx, &ExitReason);
1954	break;
1955
1956	/* Undesired exits: */
1957	case WHvRunVpExitReasonNone:
1958	default:
1959	AssertLogRelMsgFailed(("Unknown ExitReason: %#x\n", ExitReason.ExitReason));
1960	rcStrict = VERR_INTERNAL_ERROR_3;
1961	break;
1962	}
1963	if (rcStrict != VINF_SUCCESS)
1964	{
1965	LogFlow(("nemR3NativeRunGC: returning: %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1966	break;
1967	}
1968
1969	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1970	/* Hack alert! */
1971	uint32_t const cMappedPages = pVM->nem.s.cMappedPages;
1972	if (cMappedPages < 4000)
1973	{ /* likely */ }
1974	else
1975	{
1976	PGMPhysNemEnumPagesByState(pVM, pVCpu, NEM_WIN_PAGE_STATE_READABLE, nemR3WinWHvUnmapOnePageCallback, NULL);
1977	Log(("nemR3NativeRunGC: Unmapped all; cMappedPages=%u -> %u\n", cMappedPages, pVM->nem.s.cMappedPages));
1978	}
1979	# endif
1980
1981	/* If any FF is pending, return to the EM loops. That's okay for the
1982	current sledgehammer approach. */
1983	if ( VM_FF_IS_PENDING( pVM, !fSingleStepping ? VM_FF_HP_R0_PRE_HM_MASK : VM_FF_HP_R0_PRE_HM_STEP_MASK)
1984	\|\| VMCPU_FF_IS_PENDING(pVCpu, !fSingleStepping ? VMCPU_FF_HP_R0_PRE_HM_MASK : VMCPU_FF_HP_R0_PRE_HM_STEP_MASK) )
1985	{
1986	LogFlow(("nemR3NativeRunGC: returning: pending FF (%#x / %#x)\n", pVM->fGlobalForcedActions, pVCpu->fLocalForcedActions));
1987	break;
1988	}
1989	}
1990
1991
1992	/*
1993	* Copy back the state before returning.
1994	*/
1995	if (pCtx->fExtrn & (CPUMCTX_EXTRN_ALL \| (CPUMCTX_EXTRN_NEM_WIN_MASK & ~CPUMCTX_EXTRN_NEM_WIN_EVENT_INJECT)))
1996	{
1997	int rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, CPUMCTX_EXTRN_ALL \| CPUMCTX_EXTRN_NEM_WIN_MASK);
1998	if (RT_SUCCESS(rc2))
1999	pCtx->fExtrn = 0;
2000	else if (RT_SUCCESS(rcStrict))
2001	rcStrict = rc2;
2002	}
2003	else
2004	pCtx->fExtrn = 0;
2005
2006	return rcStrict;
2007	}
2008
2009	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
2010
2011
2012	VBOXSTRICTRC nemR3NativeRunGC(PVM pVM, PVMCPU pVCpu)
2013	{
2014	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
2015	return nemR3WinWHvRunGC(pVM, pVCpu);
2016	#elif 0
2017	return nemHCWinRunGC(pVM, pVCpu, NULL /pGVM/, NULL /pGVCpu/);
2018	#else
2019	VBOXSTRICTRC rcStrict = VMMR3CallR0EmtFast(pVM, pVCpu, VMMR0_DO_NEM_RUN);
2020	if (RT_SUCCESS(rcStrict))
2021	{
2022	/* We deal wtih VINF_NEM_CHANGE_PGM_MODE and VINF_NEM_FLUSH_TLB here, since we're running
2023	the risk of getting these while we already got another RC (I/O ports). */
2024	VBOXSTRICTRC rcPgmPending = pVCpu->nem.s.rcPgmPending;
2025	pVCpu->nem.s.rcPgmPending = VINF_SUCCESS;
2026	if ( rcStrict == VINF_NEM_CHANGE_PGM_MODE
2027	\|\| rcStrict == VINF_PGM_CHANGE_MODE
2028	\|\| rcPgmPending == VINF_NEM_CHANGE_PGM_MODE )
2029	{
2030	LogFlow(("nemR3NativeRunGC: calling PGMChangeMode...\n"));
2031	int rc = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2032	AssertRCReturn(rc, rc);
2033	if (rcStrict == VINF_NEM_CHANGE_PGM_MODE \|\| rcStrict == VINF_NEM_FLUSH_TLB)
2034	rcStrict = VINF_SUCCESS;
2035	}
2036	else if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcPgmPending == VINF_NEM_FLUSH_TLB)
2037	{
2038	LogFlow(("nemR3NativeRunGC: calling PGMFlushTLB...\n"));
2039	int rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true);
2040	AssertRCReturn(rc, rc);
2041	if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcStrict == VINF_NEM_CHANGE_PGM_MODE)
2042	rcStrict = VINF_SUCCESS;
2043	}
2044	else
2045	AssertMsg(rcPgmPending == VINF_SUCCESS, ("rcPgmPending=%Rrc\n", VBOXSTRICTRC_VAL(rcPgmPending) ));
2046	}
2047	return rcStrict;
2048	#endif
2049	}
2050
2051
2052	bool nemR3NativeCanExecuteGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2053	{
2054	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
2055	return true;
2056	}
2057
2058
2059	bool nemR3NativeSetSingleInstruction(PVM pVM, PVMCPU pVCpu, bool fEnable)
2060	{
2061	NOREF(pVM); NOREF(pVCpu); NOREF(fEnable);
2062	return false;
2063	}
2064
2065
2066	/**
2067	* Forced flag notification call from VMEmt.h.
2068	*
2069	* This is only called when pVCpu is in the VMCPUSTATE_STARTED_EXEC_NEM state.
2070	*
2071	* @param pVM The cross context VM structure.
2072	* @param pVCpu The cross context virtual CPU structure of the CPU
2073	* to be notified.
2074	* @param fFlags Notification flags, VMNOTIFYFF_FLAGS_XXX.
2075	*/
2076	void nemR3NativeNotifyFF(PVM pVM, PVMCPU pVCpu, uint32_t fFlags)
2077	{
2078	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
2079	nemHCWinCancelRunVirtualProcessor(pVM, pVCpu);
2080	#else
2081	Log8(("nemR3NativeNotifyFF: canceling %u\n", pVCpu->idCpu));
2082	HRESULT hrc = WHvCancelRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, 0);
2083	AssertMsg(SUCCEEDED(hrc), ("WHvCancelRunVirtualProcessor -> hrc=%Rhrc\n", hrc));
2084	RT_NOREF_PV(hrc);
2085	#endif
2086	RT_NOREF_PV(fFlags);
2087	}
2088
2089
2090	DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv)
2091	{
2092	PGMPAGEMAPLOCK Lock;
2093	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, &Lock);
2094	if (RT_SUCCESS(rc))
2095	PGMPhysReleasePageMappingLock(pVM, &Lock);
2096	return rc;
2097	}
2098
2099
2100	DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv)
2101	{
2102	PGMPAGEMAPLOCK Lock;
2103	int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, &Lock);
2104	if (RT_SUCCESS(rc))
2105	PGMPhysReleasePageMappingLock(pVM, &Lock);
2106	return rc;
2107	}
2108
2109
2110	int nemR3NativeNotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb)
2111	{
2112	Log5(("nemR3NativeNotifyPhysRamRegister: %RGp LB %RGp\n", GCPhys, cb));
2113	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2114	return VINF_SUCCESS;
2115	}
2116
2117
2118	int nemR3NativeNotifyPhysMmioExMap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags, void *pvMmio2)
2119	{
2120	Log5(("nemR3NativeNotifyPhysMmioExMap: %RGp LB %RGp fFlags=%#x pvMmio2=%p\n", GCPhys, cb, fFlags, pvMmio2));
2121	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags); NOREF(pvMmio2);
2122	return VINF_SUCCESS;
2123	}
2124
2125
2126	int nemR3NativeNotifyPhysMmioExUnmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2127	{
2128	Log5(("nemR3NativeNotifyPhysMmioExUnmap: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2129	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2130	return VINF_SUCCESS;
2131	}
2132
2133
2134	/**
2135	* Called early during ROM registration, right after the pages have been
2136	* allocated and the RAM range updated.
2137	*
2138	* This will be succeeded by a number of NEMHCNotifyPhysPageProtChanged() calls
2139	* and finally a NEMR3NotifyPhysRomRegisterEarly().
2140	*
2141	* @returns VBox status code
2142	* @param pVM The cross context VM structure.
2143	* @param GCPhys The ROM address (page aligned).
2144	* @param cb The size (page aligned).
2145	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2146	*/
2147	int nemR3NativeNotifyPhysRomRegisterEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2148	{
2149	Log5(("nemR3NativeNotifyPhysRomRegisterEarly: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2150	#if 0 /* Let's not do this after all. We'll protection change notifications for each page and if not we'll map them lazily. */
2151	RTGCPHYS const cPages = cb >> X86_PAGE_SHIFT;
2152	for (RTGCPHYS iPage = 0; iPage < cPages; iPage++, GCPhys += X86_PAGE_SIZE)
2153	{
2154	const void *pvPage;
2155	int rc = nemR3NativeGCPhys2R3PtrReadOnly(pVM, GCPhys, &pvPage);
2156	if (RT_SUCCESS(rc))
2157	{
2158	HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, (void *)pvPage, GCPhys, X86_PAGE_SIZE,
2159	WHvMapGpaRangeFlagRead \| WHvMapGpaRangeFlagExecute);
2160	if (SUCCEEDED(hrc))
2161	{ /* likely */ }
2162	else
2163	{
2164	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2165	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2166	return VERR_NEM_INIT_FAILED;
2167	}
2168	}
2169	else
2170	{
2171	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2172	return rc;
2173	}
2174	}
2175	#else
2176	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2177	#endif
2178	RT_NOREF_PV(fFlags);
2179	return VINF_SUCCESS;
2180	}
2181
2182
2183	/**
2184	* Called after the ROM range has been fully completed.
2185	*
2186	* This will be preceeded by a NEMR3NotifyPhysRomRegisterEarly() call as well a
2187	* number of NEMHCNotifyPhysPageProtChanged calls.
2188	*
2189	* @returns VBox status code
2190	* @param pVM The cross context VM structure.
2191	* @param GCPhys The ROM address (page aligned).
2192	* @param cb The size (page aligned).
2193	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2194	*/
2195	int nemR3NativeNotifyPhysRomRegisterLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2196	{
2197	Log5(("nemR3NativeNotifyPhysRomRegisterLate: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2198	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2199	return VINF_SUCCESS;
2200	}
2201
2202
2203	/**
2204	* @callback_method_impl{FNPGMPHYSNEMCHECKPAGE}
2205	*/
2206	static DECLCALLBACK(int) nemR3WinUnsetForA20CheckerCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys,
2207	PPGMPHYSNEMPAGEINFO pInfo, void *pvUser)
2208	{
2209	/* We'll just unmap the memory. */
2210	if (pInfo->u2NemState > NEM_WIN_PAGE_STATE_UNMAPPED)
2211	{
2212	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2213	int rc = nemHCWinHypercallUnmapPage(pVM, pVCpu, GCPhys);
2214	AssertRC(rc);
2215	if (RT_SUCCESS(rc))
2216	#else
2217	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
2218	if (SUCCEEDED(hrc))
2219	#endif
2220	{
2221	uint32_t cMappedPages = ASMAtomicDecU32(&pVM->nem.s.cMappedPages); NOREF(cMappedPages);
2222	Log5(("NEM GPA unmapped/A20: %RGp (was %s, cMappedPages=%u)\n", GCPhys, g_apszPageStates[pInfo->u2NemState], cMappedPages));
2223	pInfo->u2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
2224	}
2225	else
2226	{
2227	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2228	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2229	return rc;
2230	#else
2231	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2232	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2233	return VERR_INTERNAL_ERROR_2;
2234	#endif
2235	}
2236	}
2237	RT_NOREF(pVCpu, pvUser);
2238	return VINF_SUCCESS;
2239	}
2240
2241
2242	/**
2243	* Unmaps a page from Hyper-V for the purpose of emulating A20 gate behavior.
2244	*
2245	* @returns The PGMPhysNemQueryPageInfo result.
2246	* @param pVM The cross context VM structure.
2247	* @param pVCpu The cross context virtual CPU structure.
2248	* @param GCPhys The page to unmap.
2249	*/
2250	static int nemR3WinUnmapPageForA20Gate(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2251	{
2252	PGMPHYSNEMPAGEINFO Info;
2253	return PGMPhysNemPageInfoChecker(pVM, pVCpu, GCPhys, false /fMakeWritable/, &Info,
2254	nemR3WinUnsetForA20CheckerCallback, NULL);
2255	}
2256
2257
2258	/**
2259	* Called when the A20 state changes.
2260	*
2261	* Hyper-V doesn't seem to offer a simple way of implementing the A20 line
2262	* features of PCs. So, we do a very minimal emulation of the HMA to make DOS
2263	* happy.
2264	*
2265	* @param pVCpu The CPU the A20 state changed on.
2266	* @param fEnabled Whether it was enabled (true) or disabled.
2267	*/
2268	void nemR3NativeNotifySetA20(PVMCPU pVCpu, bool fEnabled)
2269	{
2270	Log(("nemR3NativeNotifySetA20: fEnabled=%RTbool\n", fEnabled));
2271	PVM pVM = pVCpu->CTX_SUFF(pVM);
2272	if (!pVM->nem.s.fA20Fixed)
2273	{
2274	pVM->nem.s.fA20Enabled = fEnabled;
2275	for (RTGCPHYS GCPhys = _1M; GCPhys < _1M + _64K; GCPhys += X86_PAGE_SIZE)
2276	nemR3WinUnmapPageForA20Gate(pVM, pVCpu, GCPhys);
2277	}
2278	}
2279
2280
2281	/** @page pg_nem_win NEM/win - Native Execution Manager, Windows.
2282	*
2283	* On Windows the Hyper-V root partition (dom0 in zen terminology) does not have
2284	* nested VT-x or AMD-V capabilities. For a while raw-mode worked inside it,
2285	* but for a while now we've been getting \#GP when trying to modify CR4 in the
2286	* world switcher. So, when Hyper-V is active on Windows we have little choice
2287	* but to use Hyper-V to run our VMs.
2288	*
2289	*
2290	* @section sub_nem_win_whv The WinHvPlatform API
2291	*
2292	* Since Windows 10 build 17083 there is a documented API for managing Hyper-V
2293	* VMs, header file WinHvPlatform.h and implementation in WinHvPlatform.dll.
2294	* This interface is a wrapper around the undocumented Virtualization
2295	* Infrastructure Driver (VID) API - VID.DLL and VID.SYS. The wrapper is
2296	* written in C++, namespaced, early versions (at least) was using standard C++
2297	* container templates in several places.
2298	*
2299	* When creating a VM using WHvCreatePartition, it will only create the
2300	* WinHvPlatform structures for it, to which you get an abstract pointer. The
2301	* VID API that actually creates the partition is first engaged when you call
2302	* WHvSetupPartition after first setting a lot of properties using
2303	* WHvSetPartitionProperty. Since the VID API is just a very thin wrapper
2304	* around CreateFile and NtDeviceIoControlFile, it returns an actual HANDLE for
2305	* the partition WinHvPlatform. We fish this HANDLE out of the WinHvPlatform
2306	* partition structures because we need to talk directly to VID for reasons
2307	* we'll get to in a bit. (Btw. we could also intercept the CreateFileW or
2308	* NtDeviceIoControlFile calls from VID.DLL to get the HANDLE should fishing in
2309	* the partition structures become difficult.)
2310	*
2311	* The WinHvPlatform API requires us to both set the number of guest CPUs before
2312	* setting up the partition and call WHvCreateVirtualProcessor for each of them.
2313	* The CPU creation function boils down to a VidMessageSlotMap call that sets up
2314	* and maps a message buffer into ring-3 for async communication with hyper-V
2315	* and/or the VID.SYS thread actually running the CPU thru
2316	* WinHvRunVpDispatchLoop(). When for instance a VMEXIT is encountered, hyper-V
2317	* sends a message that the WHvRunVirtualProcessor API retrieves (and later
2318	* acknowledges) via VidMessageSlotHandleAndGetNext. It should be noteded that
2319	* WHvDeleteVirtualProcessor doesn't do much as there seems to be no partner
2320	* function VidMessagesSlotMap that reverses what it did.
2321	*
2322	* Memory is managed thru calls to WHvMapGpaRange and WHvUnmapGpaRange (GPA does
2323	* not mean grade point average here, but rather guest physical addressspace),
2324	* which corresponds to VidCreateVaGpaRangeSpecifyUserVa and VidDestroyGpaRange
2325	* respectively. As 'UserVa' indicates, the functions works on user process
2326	* memory. The mappings are also subject to quota restrictions, so the number
2327	* of ranges are limited and probably their total size as well. Obviously
2328	* VID.SYS keeps track of the ranges, but so does WinHvPlatform, which means
2329	* there is a bit of overhead involved and quota restrctions makes sense. For
2330	* some reason though, regions are lazily mapped on VMEXIT/memory by
2331	* WHvRunVirtualProcessor.
2332	*
2333	* Running guest code is done thru the WHvRunVirtualProcessor function. It
2334	* asynchronously starts or resumes hyper-V CPU execution and then waits for an
2335	* VMEXIT message. Hyper-V / VID.SYS will return information about the message
2336	* in the message buffer mapping, and WHvRunVirtualProcessor will convert that
2337	* finto it's own WHV_RUN_VP_EXIT_CONTEXT format.
2338	*
2339	* Other threads can interrupt the execution by using WHvCancelVirtualProcessor,
2340	* which which case the thread in WHvRunVirtualProcessor is woken up via a dummy
2341	* QueueUserAPC and will call VidStopVirtualProcessor to asynchronously end
2342	* execution. The stop CPU call not immediately succeed if the CPU encountered
2343	* a VMEXIT before the stop was processed, in which case the VMEXIT needs to be
2344	* processed first, and the pending stop will be processed in a subsequent call
2345	* to WHvRunVirtualProcessor.
2346	*
2347	* Registers are retrieved and set via WHvGetVirtualProcessorRegisters and
2348	* WHvSetVirtualProcessorRegisters. In addition, several VMEXITs include
2349	* essential register state in the exit context information, potentially making
2350	* it possible to emulate the instruction causing the exit without involving
2351	* WHvGetVirtualProcessorRegisters.
2352	*
2353	*
2354	* @subsection subsec_nem_win_whv_cons Issues & Feedback
2355	*
2356	* Here are some observations (mostly against build 17101):
2357	*
2358	* - The VMEXIT performance is dismal (build 17101).
2359	*
2360	* Our proof of concept implementation with a kernel runloop (i.e. not using
2361	* WHvRunVirtualProcessor and friends, but calling VID.SYS fast I/O control
2362	* entry point directly) delivers 9-10% of the port I/O performance and only
2363	* 6-7% of the MMIO performance that we have with our own hypervisor.
2364	*
2365	* When using the offical WinHvPlatform API, the numbers are %3 for port I/O
2366	* and 5% for MMIO.
2367	*
2368	* While the tests we've done are using tight tight loops only doing port I/O
2369	* and MMIO, the problem is clearly visible when running regular guest OSes.
2370	* Anything that hammers the VGA device would be suffering, for example:
2371	*
2372	* - Windows 2000 boot screen animation overloads us with MMIO exits
2373	* and won't even boot because all the time is spent in interrupt
2374	* handlers and redrawin the screen.
2375	*
2376	* - DSL 4.4 and its bootmenu logo is slower than molasses in january.
2377	*
2378	* We have not found a workaround for this yet.
2379	*
2380	* Something that might improve the issue a little is to detect blocks with
2381	* excessive MMIO and port I/O exits and emulate instructions to cover
2382	* multiple exits before letting Hyper-V have a go at the guest execution
2383	* again. This will only improve the situation under some circumstances,
2384	* since emulating instructions without recompilation can be expensive, so
2385	* there will only be real gains if the exitting instructions are tightly
2386	* packed.
2387	*
2388	*
2389	* - The WHvCancelVirtualProcessor API schedules a dummy usermode APC callback
2390	* in order to cancel any current or future alertable wait in VID.SYS during
2391	* the VidMessageSlotHandleAndGetNext call.
2392	*
2393	* IIRC this will make the kernel schedule the specified callback thru
2394	* NTDLL!KiUserApcDispatcher by modifying the thread context and quite
2395	* possibly the userland thread stack. When the APC callback returns to
2396	* KiUserApcDispatcher, it will call NtContinue to restore the old thread
2397	* context and resume execution from there. This naturally adds up to some
2398	* CPU cycles, ring transitions aren't for free, especially after Spectre &
2399	* Meltdown mitigations.
2400	*
2401	* Using NtAltertThread call could do the same without the thread context
2402	* modifications and the extra kernel call.
2403	*
2404	*
2405	* - Not sure if this is a thing, but WHvCancelVirtualProcessor seems to cause
2406	* cause a lot more spurious WHvRunVirtualProcessor returns that what we get
2407	* with the replacement code. By spurious returns we mean that the
2408	* subsequent call to WHvRunVirtualProcessor would return immediately.
2409	*
2410	*
2411	* - When WHvRunVirtualProcessor returns without a message, or on a terse
2412	* VID message like HLT, it will make a kernel call to get some registers.
2413	* This is potentially inefficient if the caller decides he needs more
2414	* register state.
2415	*
2416	* It would be better to just return what's available and let the caller fetch
2417	* what is missing from his point of view in a single kernel call.
2418	*
2419	*
2420	* - The WHvRunVirtualProcessor implementation does lazy GPA range mappings when
2421	* a unmapped GPA message is received from hyper-V.
2422	*
2423	* Since MMIO is currently realized as unmapped GPA, this will slow down all
2424	* MMIO accesses a tiny little bit as WHvRunVirtualProcessor looks up the
2425	* guest physical address to check if it is a pending lazy mapping.
2426	*
2427	* The lazy mapping feature makes no sense to us. We as API user have all the
2428	* information and can do lazy mapping ourselves if we want/have to (see next
2429	* point).
2430	*
2431	*
2432	* - There is no API for modifying protection of a page within a GPA range.
2433	*
2434	* From what we can tell, the only way to modify the protection (like readonly
2435	* -> writable, or vice versa) is to first unmap the range and then remap it
2436	* with the new protection.
2437	*
2438	* We are for instance doing this quite a bit in order to track dirty VRAM
2439	* pages. VRAM pages starts out as readonly, when the guest writes to a page
2440	* we take an exit, notes down which page it is, makes it writable and restart
2441	* the instruction. After refreshing the display, we reset all the writable
2442	* pages to readonly again, bulk fashion.
2443	*
2444	* Now to work around this issue, we do page sized GPA ranges. In addition to
2445	* add a lot of tracking overhead to WinHvPlatform and VID.SYS, this also
2446	* causes us to exceed our quota before we've even mapped a default sized
2447	* (128MB) VRAM page-by-page. So, to work around this quota issue we have to
2448	* lazily map pages and actively restrict the number of mappings.
2449	*
2450	* Our best workaround thus far is bypassing WinHvPlatform and VID entirely
2451	* when in comes to guest memory management and instead use the underlying
2452	* hypercalls (HvCallMapGpaPages, HvCallUnmapGpaPages) to do it ourselves.
2453	* (This also maps a whole lot better into our own guest page management
2454	* infrastructure.)
2455	*
2456	*
2457	* - Observed problems doing WHvUnmapGpaRange immediately followed by
2458	* WHvMapGpaRange.
2459	*
2460	* As mentioned above, we've been forced to use this sequence when modifying
2461	* page protection. However, when transitioning from readonly to writable,
2462	* we've ended up looping forever with the same write to readonly memory
2463	* VMEXIT. We're wondering if this issue might be related to the lazy mapping
2464	* logic in WinHvPlatform.
2465	*
2466	* Workaround: Insert a WHvRunVirtualProcessor call and make sure to get a GPA
2467	* unmapped exit between the two calls. Not entirely great performance wise
2468	* (or the santity of our code).
2469	*
2470	*
2471	* - Implementing A20 gate behavior is tedious, where as correctly emulating the
2472	* A20M# pin (present on 486 and later) is near impossible for SMP setups
2473	* (e.g. possiblity of two CPUs with different A20 status).
2474	*
2475	* Workaround: Only do A20 on CPU 0, restricting the emulation to HMA. We
2476	* unmap all pages related to HMA (0x100000..0x10ffff) when the A20 state
2477	* changes, lazily syncing the right pages back when accessed.
2478	*
2479	*
2480	* - WHVRunVirtualProcessor wastes time converting VID/Hyper-V messages to its
2481	* own format (WHV_RUN_VP_EXIT_CONTEXT).
2482	*
2483	* We understand this might be because Microsoft wishes to remain free to
2484	* modify the VID/Hyper-V messages, but it's still rather silly and does slow
2485	* things down a little. We'd much rather just process the messages directly.
2486	*
2487	*
2488	* - WHVRunVirtualProcessor would've benefited from using a callback interface:
2489	*
2490	* - The potential size changes of the exit context structure wouldn't be
2491	* an issue, since the function could manage that itself.
2492	*
2493	* - State handling could probably be simplified (like cancelation).
2494	*
2495	*
2496	* - WHvGetVirtualProcessorRegisters and WHvSetVirtualProcessorRegisters
2497	* internally converts register names, probably using temporary heap buffers.
2498	*
2499	* From the looks of things, they are converting from WHV_REGISTER_NAME to
2500	* HV_REGISTER_NAME from in the "Virtual Processor Register Names" section in
2501	* the "Hypervisor Top-Level Functional Specification" document. This feels
2502	* like an awful waste of time.
2503	*
2504	* We simply cannot understand why HV_REGISTER_NAME isn't used directly here,
2505	* or at least the same values, making any conversion reduntant. Restricting
2506	* access to certain registers could easily be implement by scanning the
2507	* inputs.
2508	*
2509	* To avoid the heap + conversion overhead, we're currently using the
2510	* HvCallGetVpRegisters and HvCallSetVpRegisters calls directly.
2511	*
2512	*
2513	* - The YMM and XCR0 registers are not yet named (17083). This probably
2514	* wouldn't be a problem if HV_REGISTER_NAME was used, see previous point.
2515	*
2516	*
2517	* - Why does VID.SYS only query/set 32 registers at the time thru the
2518	* HvCallGetVpRegisters and HvCallSetVpRegisters hypercalls?
2519	*
2520	* We've not trouble getting/setting all the registers defined by
2521	* WHV_REGISTER_NAME in one hypercall (around 80). Some kind of stack
2522	* buffering or similar?
2523	*
2524	*
2525	* - Wrong instruction length in the VpContext with unmapped GPA memory exit
2526	* contexts on 17115/AMD.
2527	*
2528	* One byte "PUSH CS" was reported as 2 bytes, while a two byte
2529	* "MOV [EBX],EAX" was reported with a 1 byte instruction length. Problem
2530	* naturally present in untranslated hyper-v messages.
2531	*
2532	*
2533	* - The I/O port exit context information seems to be missing the address size
2534	* information needed for correct string I/O emulation.
2535	*
2536	* VT-x provides this information in bits 7:9 in the instruction information
2537	* field on newer CPUs. AMD-V in bits 7:9 in the EXITINFO1 field in the VMCB.
2538	*
2539	* We can probably work around this by scanning the instruction bytes for
2540	* address size prefixes. Haven't investigated it any further yet.
2541	*
2542	*
2543	* - The WHvGetCapability function has a weird design:
2544	* - The CapabilityCode parameter is pointlessly duplicated in the output
2545	* structure (WHV_CAPABILITY).
2546	*
2547	* - API takes void pointer, but everyone will probably be using
2548	* WHV_CAPABILITY due to WHV_CAPABILITY::CapabilityCode making it
2549	* impractical to use anything else.
2550	*
2551	* - No output size.
2552	*
2553	* - See GetFileAttributesEx, GetFileInformationByHandleEx,
2554	* FindFirstFileEx, and others for typical pattern for generic
2555	* information getters.
2556	*
2557	* Update: All concerns have been addressed in build 17110.
2558	*
2559	*
2560	* - The WHvGetPartitionProperty function uses the same weird design as
2561	* WHvGetCapability, see above.
2562	*
2563	* Update: All concerns have been addressed in build 17110.
2564	*
2565	*
2566	* - The WHvSetPartitionProperty function has a totally weird design too:
2567	* - In contrast to its partner WHvGetPartitionProperty, the property code
2568	* is not a separate input parameter here but part of the input
2569	* structure.
2570	*
2571	* - The input structure is a void pointer rather than a pointer to
2572	* WHV_PARTITION_PROPERTY which everyone probably will be using because
2573	* of the WHV_PARTITION_PROPERTY::PropertyCode field.
2574	*
2575	* - Really, why use PVOID for the input when the function isn't accepting
2576	* minimal sizes. E.g. WHVPartitionPropertyCodeProcessorClFlushSize only
2577	* requires a 9 byte input, but the function insists on 16 bytes (17083).
2578	*
2579	* - See GetFileAttributesEx, SetFileInformationByHandle, FindFirstFileEx,
2580	* and others for typical pattern for generic information setters and
2581	* getters.
2582	*
2583	* Update: All concerns have been addressed in build 17110.
2584	*
2585	*
2586	*
2587	* @section sec_nem_win_impl Our implementation.
2588	*
2589	* We set out with the goal of wanting to run as much as possible in ring-0,
2590	* reasoning that this would give use the best performance.
2591	*
2592	* This goal was approached gradually, starting out with a pure WinHvPlatform
2593	* implementation, gradually replacing parts: register access, guest memory
2594	* handling, running virtual processors. Then finally moving it all into
2595	* ring-0, while keeping most of it configurable so that we could make
2596	* comparisons (see NEMInternal.h and nemR3NativeRunGC()).
2597	*
2598	*
2599	* @subsection subsect_nem_win_impl_ioctl VID.SYS I/O control calls
2600	*
2601	* To run things in ring-0 we need to talk directly to VID.SYS thru its I/O
2602	* control interface. Looking at changes between like build 17083 and 17101 (if
2603	* memory serves) a set of the VID I/O control numbers shifted a little, which
2604	* means we need to determin them dynamically. We currently do this by hooking
2605	* the NtDeviceIoControlFile API call from VID.DLL and snooping up the
2606	* parameters when making dummy calls to relevant APIs. (We could also
2607	* disassemble the relevant APIs and try fish out the information from that, but
2608	* this is way simpler.)
2609	*
2610	* Issuing I/O control calls from ring-0 is facing a small challenge with
2611	* respect to direct buffering. When using direct buffering the device will
2612	* typically check that the buffer is actually in the user address space range
2613	* and reject kernel addresses. Fortunately, we've got the cross context VM
2614	* structure that is mapped into both kernel and user space, it's also locked
2615	* and safe to access from kernel space. So, we place the I/O control buffers
2616	* in the per-CPU part of it (NEMCPU::uIoCtlBuf) and give the driver the user
2617	* address if direct access buffering or kernel address if not.
2618	*
2619	* The I/O control calls are 'abstracted' in the support driver, see
2620	* SUPR0IoCtlSetupForHandle(), SUPR0IoctlPerform() and SUPR0IoCtlCleanup().
2621	*
2622	*
2623	* @subsection subsect_nem_win_impl_cpumctx CPUMCTX
2624	*
2625	* Since the CPU state needs to live in Hyper-V when executing, we probably
2626	* should not transfer more than necessary when handling VMEXITs. To help us
2627	* manage this CPUMCTX got a new field CPUMCTX::fExtrn that to indicate which
2628	* part of the state is currently externalized (== in Hyper-V).
2629	*
2630	*
2631	*/
2632

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp@ 71612

Download in other formats: