NEMR3Native-win.cpp@ 72208

Last change on this file since 72208 was 72207, checked in by vboxsync, 7 years ago
NEM: Inject interrupts from the inner NEM loop, use interrupt windows. bugref:9044
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 118.3 KB

Line
1	/* $Id: NEMR3Native-win.cpp 72207 2018-05-14 19:16:43Z vboxsync $ */
2	/** @file
3	* NEM - Native execution manager, native ring-3 Windows backend.
4	*
5	* Log group 2: Exit logging.
6	* Log group 3: Log context on exit.
7	* Log group 5: Ring-3 memory management
8	* Log group 6: Ring-0 memory management
9	* Log group 12: API intercepts.
10	*/
11
12	/*
13	* Copyright (C) 2018 Oracle Corporation
14	*
15	* This file is part of VirtualBox Open Source Edition (OSE), as
16	* available from http://www.virtualbox.org. This file is free software;
17	* you can redistribute it and/or modify it under the terms of the GNU
18	* General Public License (GPL) as published by the Free Software
19	* Foundation, in version 2 as it comes in the "COPYING" file of the
20	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
21	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
22	*/
23
24
25	/*********************************************************************************************************************************
26	* Header Files *
27	*********************************************************************************************************************************/
28	#define LOG_GROUP LOG_GROUP_NEM
29	#include <iprt/nt/nt-and-windows.h>
30	#include <iprt/nt/hyperv.h>
31	#include <iprt/nt/vid.h>
32	#include <WinHvPlatform.h>
33
34	#ifndef _WIN32_WINNT_WIN10
35	# error "Missing _WIN32_WINNT_WIN10"
36	#endif
37	#ifndef _WIN32_WINNT_WIN10_RS1 /* Missing define, causing trouble for us. */
38	# define _WIN32_WINNT_WIN10_RS1 (_WIN32_WINNT_WIN10 + 1)
39	#endif
40	#include <sysinfoapi.h>
41	#include <debugapi.h>
42	#include <errhandlingapi.h>
43	#include <fileapi.h>
44	#include <winerror.h> /* no api header for this. */
45
46	#include <VBox/vmm/nem.h>
47	#include <VBox/vmm/iem.h>
48	#include <VBox/vmm/em.h>
49	#include <VBox/vmm/apic.h>
50	#include <VBox/vmm/pdm.h>
51	#include "NEMInternal.h"
52	#include <VBox/vmm/vm.h>
53
54	#include <iprt/ldr.h>
55	#include <iprt/path.h>
56	#include <iprt/string.h>
57	#include <iprt/system.h>
58
59
60	/*********************************************************************************************************************************
61	* Defined Constants And Macros *
62	*********************************************************************************************************************************/
63	#ifdef LOG_ENABLED
64	# define NEM_WIN_INTERCEPT_NT_IO_CTLS
65	#endif
66
67	/** VID I/O control detection: Fake partition handle input. */
68	#define NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE ((HANDLE)(uintptr_t)38479125)
69	/** VID I/O control detection: Fake partition ID return. */
70	#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID UINT64_C(0xfa1e000042424242)
71	/** VID I/O control detection: Fake CPU index input. */
72	#define NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX UINT32_C(42)
73	/** VID I/O control detection: Fake timeout input. */
74	#define NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT UINT32_C(0x00080286)
75
76
77	/*********************************************************************************************************************************
78	* Structures and Typedefs *
79	*********************************************************************************************************************************/
80	#ifndef NEM_WIN_USE_17110_PLUS_WDK
81	typedef HRESULT (WINAPI PFNWHVGETCAPABILITY_17110)(WHV_CAPABILITY_CODE, void , uint32_t, uint32_t *);
82	typedef HRESULT (WINAPI PFNWHVSETPARTITIONPROPERTY_17110)(WHV_PARTITION_HANDLE, WHV_PARTITION_PROPERTY_CODE, void , uint32_t);
83	#endif
84
85
86	/*********************************************************************************************************************************
87	* Global Variables *
88	*********************************************************************************************************************************/
89	/** @name APIs imported from WinHvPlatform.dll
90	* @{ */
91	static decltype(WHvGetCapability) * g_pfnWHvGetCapability;
92	static decltype(WHvCreatePartition) * g_pfnWHvCreatePartition;
93	static decltype(WHvSetupPartition) * g_pfnWHvSetupPartition;
94	static decltype(WHvDeletePartition) * g_pfnWHvDeletePartition;
95	static decltype(WHvGetPartitionProperty) * g_pfnWHvGetPartitionProperty;
96	static decltype(WHvSetPartitionProperty) * g_pfnWHvSetPartitionProperty;
97	static decltype(WHvMapGpaRange) * g_pfnWHvMapGpaRange;
98	static decltype(WHvUnmapGpaRange) * g_pfnWHvUnmapGpaRange;
99	static decltype(WHvTranslateGva) * g_pfnWHvTranslateGva;
100	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
101	static decltype(WHvCreateVirtualProcessor) * g_pfnWHvCreateVirtualProcessor;
102	static decltype(WHvDeleteVirtualProcessor) * g_pfnWHvDeleteVirtualProcessor;
103	static decltype(WHvRunVirtualProcessor) * g_pfnWHvRunVirtualProcessor;
104	static decltype(WHvCancelRunVirtualProcessor) * g_pfnWHvCancelRunVirtualProcessor;
105	static decltype(WHvGetVirtualProcessorRegisters) * g_pfnWHvGetVirtualProcessorRegisters;
106	static decltype(WHvSetVirtualProcessorRegisters) * g_pfnWHvSetVirtualProcessorRegisters;
107	#endif
108	/** @} */
109
110	/** @name APIs imported from Vid.dll
111	* @{ */
112	static decltype(VidGetHvPartitionId) *g_pfnVidGetHvPartitionId;
113	static decltype(VidStartVirtualProcessor) *g_pfnVidStartVirtualProcessor;
114	static decltype(VidStopVirtualProcessor) *g_pfnVidStopVirtualProcessor;
115	static decltype(VidMessageSlotMap) *g_pfnVidMessageSlotMap;
116	static decltype(VidMessageSlotHandleAndGetNext) *g_pfnVidMessageSlotHandleAndGetNext;
117	#ifdef LOG_ENABLED
118	static decltype(VidGetVirtualProcessorState) *g_pfnVidGetVirtualProcessorState;
119	static decltype(VidSetVirtualProcessorState) *g_pfnVidSetVirtualProcessorState;
120	static decltype(VidGetVirtualProcessorRunningStatus) *g_pfnVidGetVirtualProcessorRunningStatus;
121	#endif
122	/** @} */
123
124	/** The Windows build number. */
125	static uint32_t g_uBuildNo = 17110;
126
127
128
129	/**
130	* Import instructions.
131	*/
132	static const struct
133	{
134	uint8_t idxDll; /*< 0 for WinHvPlatform.dll, 1 for vid.dll. /
135	bool fOptional; /*< Set if import is optional. /
136	PFNRT ppfn; /< The function pointer variable. /
137	const char pszName; /< The function name. /
138	} g_aImports[] =
139	{
140	#define NEM_WIN_IMPORT(a_idxDll, a_fOptional, a_Name) { (a_idxDll), (a_fOptional), (PFNRT *)&RT_CONCAT(g_pfn,a_Name), #a_Name }
141	NEM_WIN_IMPORT(0, false, WHvGetCapability),
142	NEM_WIN_IMPORT(0, false, WHvCreatePartition),
143	NEM_WIN_IMPORT(0, false, WHvSetupPartition),
144	NEM_WIN_IMPORT(0, false, WHvDeletePartition),
145	NEM_WIN_IMPORT(0, false, WHvGetPartitionProperty),
146	NEM_WIN_IMPORT(0, false, WHvSetPartitionProperty),
147	NEM_WIN_IMPORT(0, false, WHvMapGpaRange),
148	NEM_WIN_IMPORT(0, false, WHvUnmapGpaRange),
149	NEM_WIN_IMPORT(0, false, WHvTranslateGva),
150	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
151	NEM_WIN_IMPORT(0, false, WHvCreateVirtualProcessor),
152	NEM_WIN_IMPORT(0, false, WHvDeleteVirtualProcessor),
153	NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
154	NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
155	NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
156	NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
157	#endif
158	NEM_WIN_IMPORT(1, false, VidGetHvPartitionId),
159	NEM_WIN_IMPORT(1, false, VidMessageSlotMap),
160	NEM_WIN_IMPORT(1, false, VidMessageSlotHandleAndGetNext),
161	NEM_WIN_IMPORT(1, false, VidStartVirtualProcessor),
162	NEM_WIN_IMPORT(1, false, VidStopVirtualProcessor),
163	#ifdef LOG_ENABLED
164	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorState),
165	NEM_WIN_IMPORT(1, false, VidSetVirtualProcessorState),
166	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorRunningStatus),
167	#endif
168	#undef NEM_WIN_IMPORT
169	};
170
171
172	/** The real NtDeviceIoControlFile API in NTDLL. */
173	static decltype(NtDeviceIoControlFile) *g_pfnNtDeviceIoControlFile;
174	/** Pointer to the NtDeviceIoControlFile import table entry. */
175	static decltype(NtDeviceIoControlFile) **g_ppfnVidNtDeviceIoControlFile;
176	/** Info about the VidGetHvPartitionId I/O control interface. */
177	static NEMWINIOCTL g_IoCtlGetHvPartitionId;
178	/** Info about the VidStartVirtualProcessor I/O control interface. */
179	static NEMWINIOCTL g_IoCtlStartVirtualProcessor;
180	/** Info about the VidStopVirtualProcessor I/O control interface. */
181	static NEMWINIOCTL g_IoCtlStopVirtualProcessor;
182	/** Info about the VidMessageSlotHandleAndGetNext I/O control interface. */
183	static NEMWINIOCTL g_IoCtlMessageSlotHandleAndGetNext;
184	#ifdef LOG_ENABLED
185	/** Info about the VidMessageSlotMap I/O control interface - for logging. */
186	static NEMWINIOCTL g_IoCtlMessageSlotMap;
187	/* Info about the VidGetVirtualProcessorState I/O control interface - for logging. */
188	static NEMWINIOCTL g_IoCtlGetVirtualProcessorState;
189	/* Info about the VidSetVirtualProcessorState I/O control interface - for logging. */
190	static NEMWINIOCTL g_IoCtlSetVirtualProcessorState;
191	/** Pointer to what nemR3WinIoctlDetector_ForLogging should fill in. */
192	static NEMWINIOCTL *g_pIoCtlDetectForLogging;
193	#endif
194
195	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
196	/** Mapping slot for CPU #0.
197	* @{ */
198	static VID_MESSAGE_MAPPING_HEADER *g_pMsgSlotMapping = NULL;
199	static const HV_MESSAGE_HEADER *g_pHvMsgHdr;
200	static const HV_X64_INTERCEPT_MESSAGE_HEADER *g_pX64MsgHdr;
201	/** @} */
202	#endif
203
204
205	/*
206	* Let the preprocessor alias the APIs to import variables for better autocompletion.
207	*/
208	#ifndef IN_SLICKEDIT
209	# define WHvGetCapability g_pfnWHvGetCapability
210	# define WHvCreatePartition g_pfnWHvCreatePartition
211	# define WHvSetupPartition g_pfnWHvSetupPartition
212	# define WHvDeletePartition g_pfnWHvDeletePartition
213	# define WHvGetPartitionProperty g_pfnWHvGetPartitionProperty
214	# define WHvSetPartitionProperty g_pfnWHvSetPartitionProperty
215	# define WHvMapGpaRange g_pfnWHvMapGpaRange
216	# define WHvUnmapGpaRange g_pfnWHvUnmapGpaRange
217	# define WHvTranslateGva g_pfnWHvTranslateGva
218	# define WHvCreateVirtualProcessor g_pfnWHvCreateVirtualProcessor
219	# define WHvDeleteVirtualProcessor g_pfnWHvDeleteVirtualProcessor
220	# define WHvRunVirtualProcessor g_pfnWHvRunVirtualProcessor
221	# define WHvGetRunExitContextSize g_pfnWHvGetRunExitContextSize
222	# define WHvCancelRunVirtualProcessor g_pfnWHvCancelRunVirtualProcessor
223	# define WHvGetVirtualProcessorRegisters g_pfnWHvGetVirtualProcessorRegisters
224	# define WHvSetVirtualProcessorRegisters g_pfnWHvSetVirtualProcessorRegisters
225
226	# define VidMessageSlotHandleAndGetNext g_pfnVidMessageSlotHandleAndGetNext
227	# define VidStartVirtualProcessor g_pfnVidStartVirtualProcessor
228	# define VidStopVirtualProcessor g_pfnVidStopVirtualProcessor
229
230	#endif
231
232	/** WHV_MEMORY_ACCESS_TYPE names */
233	static const char * const g_apszWHvMemAccesstypes[4] = { "read", "write", "exec", "!undefined!" };
234
235
236	/*********************************************************************************************************************************
237	* Internal Functions *
238	*********************************************************************************************************************************/
239
240	/*
241	* Instantate the code we share with ring-0.
242	*/
243	#include "../VMMAll/NEMAllNativeTemplate-win.cpp.h"
244
245
246
247	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
248	/**
249	* Wrapper that logs the call from VID.DLL.
250	*
251	* This is very handy for figuring out why an API call fails.
252	*/
253	static NTSTATUS WINAPI
254	nemR3WinLogWrapper_NtDeviceIoControlFile(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
255	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
256	PVOID pvOutput, ULONG cbOutput)
257	{
258
259	char szFunction[32];
260	const char *pszFunction;
261	if (uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction)
262	pszFunction = "VidMessageSlotHandleAndGetNext";
263	else if (uFunction == g_IoCtlStartVirtualProcessor.uFunction)
264	pszFunction = "VidStartVirtualProcessor";
265	else if (uFunction == g_IoCtlStopVirtualProcessor.uFunction)
266	pszFunction = "VidStopVirtualProcessor";
267	else if (uFunction == g_IoCtlMessageSlotMap.uFunction)
268	pszFunction = "VidMessageSlotMap";
269	else if (uFunction == g_IoCtlGetVirtualProcessorState.uFunction)
270	pszFunction = "VidGetVirtualProcessorState";
271	else if (uFunction == g_IoCtlSetVirtualProcessorState.uFunction)
272	pszFunction = "VidSetVirtualProcessorState";
273	else
274	{
275	RTStrPrintf(szFunction, sizeof(szFunction), "%#x", uFunction);
276	pszFunction = szFunction;
277	}
278
279	if (cbInput > 0 && pvInput)
280	Log12(("VID!NtDeviceIoControlFile: %s/input: %.*Rhxs\n", pszFunction, RT_MIN(cbInput, 32), pvInput));
281	NTSTATUS rcNt = g_pfnNtDeviceIoControlFile(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, uFunction,
282	pvInput, cbInput, pvOutput, cbOutput);
283	if (!hEvt && !pfnApcCallback && !pvApcCtx)
284	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
285	hFile, pIos, pIos->Status, pIos->Information, pszFunction, pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
286	else
287	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx hEvt=%#zx Apc=%p/%p pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
288	hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pIos->Status, pIos->Information, pszFunction,
289	pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
290	if (cbOutput > 0 && pvOutput)
291	{
292	Log12(("VID!NtDeviceIoControlFile: %s/output: %.*Rhxs\n", pszFunction, RT_MIN(cbOutput, 32), pvOutput));
293	if (uFunction == 0x2210cc && g_pMsgSlotMapping == NULL && cbOutput >= sizeof(void *))
294	{
295	g_pMsgSlotMapping = (VID_MESSAGE_MAPPING_HEADER *)pvOutput;
296	g_pHvMsgHdr = (const HV_MESSAGE_HEADER *)(g_pMsgSlotMapping + 1);
297	g_pX64MsgHdr = (const HV_X64_INTERCEPT_MESSAGE_HEADER *)(g_pHvMsgHdr + 1);
298	Log12(("VID!NtDeviceIoControlFile: Message slot mapping: %p\n", g_pMsgSlotMapping));
299	}
300	}
301	if ( g_pMsgSlotMapping
302	&& ( uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction
303	\|\| uFunction == g_IoCtlStopVirtualProcessor.uFunction
304	\|\| uFunction == g_IoCtlMessageSlotMap.uFunction
305	))
306	Log12(("VID!NtDeviceIoControlFile: enmVidMsgType=%#x cb=%#x msg=%#x payload=%u cs:rip=%04x:%08RX64 (%s)\n",
307	g_pMsgSlotMapping->enmVidMsgType, g_pMsgSlotMapping->cbMessage,
308	g_pHvMsgHdr->MessageType, g_pHvMsgHdr->PayloadSize,
309	g_pX64MsgHdr->CsSegment.Selector, g_pX64MsgHdr->Rip, pszFunction));
310
311	return rcNt;
312	}
313	#endif /* NEM_WIN_INTERCEPT_NT_IO_CTLS */
314
315
316	/**
317	* Patches the call table of VID.DLL so we can intercept NtDeviceIoControlFile.
318	*
319	* This is for used to figure out the I/O control codes and in logging builds
320	* for logging API calls that WinHvPlatform.dll does.
321	*
322	* @returns VBox status code.
323	* @param hLdrModVid The VID module handle.
324	* @param pErrInfo Where to return additional error information.
325	*/
326	static int nemR3WinInitVidIntercepts(RTLDRMOD hLdrModVid, PRTERRINFO pErrInfo)
327	{
328	/*
329	* Locate the real API.
330	*/
331	g_pfnNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) *)RTLdrGetSystemSymbol("NTDLL.DLL", "NtDeviceIoControlFile");
332	AssertReturn(g_pfnNtDeviceIoControlFile != NULL,
333	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to resolve NtDeviceIoControlFile from NTDLL.DLL"));
334
335	/*
336	* Locate the PE header and get what we need from it.
337	*/
338	uint8_t const pbImage = (uint8_t const )RTLdrGetNativeHandle(hLdrModVid);
339	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbImage;
340	AssertReturn(pMzHdr->e_magic == IMAGE_DOS_SIGNATURE,
341	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL mapping doesn't start with MZ signature: %#x", pMzHdr->e_magic));
342	IMAGE_NT_HEADERS const pNtHdrs = (IMAGE_NT_HEADERS const )&pbImage[pMzHdr->e_lfanew];
343	AssertReturn(pNtHdrs->Signature == IMAGE_NT_SIGNATURE,
344	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL has invalid PE signaturre: %#x @%#x",
345	pNtHdrs->Signature, pMzHdr->e_lfanew));
346
347	uint32_t const cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
348	IMAGE_DATA_DIRECTORY const ImportDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
349
350	/*
351	* Walk the import descriptor table looking for NTDLL.DLL.
352	*/
353	AssertReturn( ImportDir.Size > 0
354	&& ImportDir.Size < cbImage,
355	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory size: %#x", ImportDir.Size));
356	AssertReturn( ImportDir.VirtualAddress > 0
357	&& ImportDir.VirtualAddress <= cbImage - ImportDir.Size,
358	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory RVA: %#x", ImportDir.VirtualAddress));
359
360	for (PIMAGE_IMPORT_DESCRIPTOR pImps = (PIMAGE_IMPORT_DESCRIPTOR)&pbImage[ImportDir.VirtualAddress];
361	pImps->Name != 0 && pImps->FirstThunk != 0;
362	pImps++)
363	{
364	AssertReturn(pImps->Name < cbImage,
365	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory entry name: %#x", pImps->Name));
366	const char pszModName = (const char )&pbImage[pImps->Name];
367	if (RTStrICmpAscii(pszModName, "ntdll.dll"))
368	continue;
369	AssertReturn(pImps->FirstThunk < cbImage,
370	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
371	AssertReturn(pImps->OriginalFirstThunk < cbImage,
372	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
373
374	/*
375	* Walk the thunks table(s) looking for NtDeviceIoControlFile.
376	*/
377	PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]; /* update this. */
378	PIMAGE_THUNK_DATA pThunk = pImps->OriginalFirstThunk == 0 /* read from this. */
379	? (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]
380	: (PIMAGE_THUNK_DATA)&pbImage[pImps->OriginalFirstThunk];
381	while (pThunk->u1.Ordinal != 0)
382	{
383	if (!(pThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32))
384	{
385	AssertReturn(pThunk->u1.Ordinal > 0 && pThunk->u1.Ordinal < cbImage,
386	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
387
388	const char pszSymbol = (const char )&pbImage[(uintptr_t)pThunk->u1.AddressOfData + 2];
389	if (strcmp(pszSymbol, "NtDeviceIoControlFile") == 0)
390	{
391	DWORD fOldProt = PAGE_READONLY;
392	VirtualProtect(&pFirstThunk->u1.Function, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &fOldProt);
393	g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)&pFirstThunk->u1.Function;
394	/* Don't restore the protection here, so we modify the NtDeviceIoControlFile pointer later. */
395	}
396	}
397
398	pThunk++;
399	pFirstThunk++;
400	}
401	}
402
403	if (*g_ppfnVidNtDeviceIoControlFile)
404	{
405	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
406	*g_ppfnVidNtDeviceIoControlFile = nemR3WinLogWrapper_NtDeviceIoControlFile;
407	#endif
408	return VINF_SUCCESS;
409	}
410	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to patch NtDeviceIoControlFile import in VID.DLL!");
411	}
412
413
414	/**
415	* Worker for nemR3NativeInit that probes and load the native API.
416	*
417	* @returns VBox status code.
418	* @param fForced Whether the HMForced flag is set and we should
419	* fail if we cannot initialize.
420	* @param pErrInfo Where to always return error info.
421	*/
422	static int nemR3WinInitProbeAndLoad(bool fForced, PRTERRINFO pErrInfo)
423	{
424	/*
425	* Check that the DLL files we need are present, but without loading them.
426	* We'd like to avoid loading them unnecessarily.
427	*/
428	WCHAR wszPath[MAX_PATH + 64];
429	UINT cwcPath = GetSystemDirectoryW(wszPath, MAX_PATH);
430	if (cwcPath >= MAX_PATH \|\| cwcPath < 2)
431	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "GetSystemDirectoryW failed (%#x / %u)", cwcPath, GetLastError());
432
433	if (wszPath[cwcPath - 1] != '\\' \|\| wszPath[cwcPath - 1] != '/')
434	wszPath[cwcPath++] = '\\';
435	RTUtf16CopyAscii(&wszPath[cwcPath], RT_ELEMENTS(wszPath) - cwcPath, "WinHvPlatform.dll");
436	if (GetFileAttributesW(wszPath) == INVALID_FILE_ATTRIBUTES)
437	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "The native API dll was not found (%ls)", wszPath);
438
439	/*
440	* Check that we're in a VM and that the hypervisor identifies itself as Hyper-V.
441	*/
442	if (!ASMHasCpuId())
443	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID support");
444	if (!ASMIsValidStdRange(ASMCpuId_EAX(0)))
445	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID leaf #1");
446	if (!(ASMCpuId_ECX(1) & X86_CPUID_FEATURE_ECX_HVP))
447	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Not in a hypervisor partition (HVP=0)");
448
449	uint32_t cMaxHyperLeaf = 0;
450	uint32_t uEbx = 0;
451	uint32_t uEcx = 0;
452	uint32_t uEdx = 0;
453	ASMCpuIdExSlow(0x40000000, 0, 0, 0, &cMaxHyperLeaf, &uEbx, &uEcx, &uEdx);
454	if (!ASMIsValidHypervisorRange(cMaxHyperLeaf))
455	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Invalid hypervisor CPUID range (%#x %#x %#x %#x)",
456	cMaxHyperLeaf, uEbx, uEcx, uEdx);
457	if ( uEbx != UINT32_C(0x7263694d) /* Micr */
458	\|\| uEcx != UINT32_C(0x666f736f) /* osof */
459	\|\| uEdx != UINT32_C(0x76482074) /* t Hv */)
460	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
461	"Not Hyper-V CPUID signature: %#x %#x %#x (expected %#x %#x %#x)",
462	uEbx, uEcx, uEdx, UINT32_C(0x7263694d), UINT32_C(0x666f736f), UINT32_C(0x76482074));
463	if (cMaxHyperLeaf < UINT32_C(0x40000005))
464	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Too narrow hypervisor CPUID range (%#x)", cMaxHyperLeaf);
465
466	/** @todo would be great if we could recognize a root partition from the
467	* CPUID info, but I currently don't dare do that. */
468
469	/*
470	* Now try load the DLLs and resolve the APIs.
471	*/
472	static const char * const s_apszDllNames[2] = { "WinHvPlatform.dll", "vid.dll" };
473	RTLDRMOD ahMods[2] = { NIL_RTLDRMOD, NIL_RTLDRMOD };
474	int rc = VINF_SUCCESS;
475	for (unsigned i = 0; i < RT_ELEMENTS(s_apszDllNames); i++)
476	{
477	int rc2 = RTLdrLoadSystem(s_apszDllNames[i], true /fNoUnload/, &ahMods[i]);
478	if (RT_FAILURE(rc2))
479	{
480	if (!RTErrInfoIsSet(pErrInfo))
481	RTErrInfoSetF(pErrInfo, rc2, "Failed to load API DLL: %s: %Rrc", s_apszDllNames[i], rc2);
482	else
483	RTErrInfoAddF(pErrInfo, rc2, "; %s: %Rrc", s_apszDllNames[i], rc2);
484	ahMods[i] = NIL_RTLDRMOD;
485	rc = VERR_NEM_INIT_FAILED;
486	}
487	}
488	if (RT_SUCCESS(rc))
489	rc = nemR3WinInitVidIntercepts(ahMods[1], pErrInfo);
490	if (RT_SUCCESS(rc))
491	{
492	for (unsigned i = 0; i < RT_ELEMENTS(g_aImports); i++)
493	{
494	int rc2 = RTLdrGetSymbol(ahMods[g_aImports[i].idxDll], g_aImports[i].pszName, (void **)g_aImports[i].ppfn);
495	if (RT_FAILURE(rc2))
496	{
497	*g_aImports[i].ppfn = NULL;
498
499	LogRel(("NEM: %s: Failed to import %s!%s: %Rrc",
500	g_aImports[i].fOptional ? "info" : fForced ? "fatal" : "error",
501	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName, rc2));
502	if (!g_aImports[i].fOptional)
503	{
504	if (RTErrInfoIsSet(pErrInfo))
505	RTErrInfoAddF(pErrInfo, rc2, ", %s!%s",
506	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
507	else
508	rc = RTErrInfoSetF(pErrInfo, rc2, "Failed to import: %s!%s",
509	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
510	Assert(RT_FAILURE(rc));
511	}
512	}
513	}
514	if (RT_SUCCESS(rc))
515	{
516	Assert(!RTErrInfoIsSet(pErrInfo));
517	}
518	}
519
520	for (unsigned i = 0; i < RT_ELEMENTS(ahMods); i++)
521	RTLdrClose(ahMods[i]);
522	return rc;
523	}
524
525
526	/**
527	* Wrapper for different WHvGetCapability signatures.
528	*/
529	DECLINLINE(HRESULT) WHvGetCapabilityWrapper(WHV_CAPABILITY_CODE enmCap, WHV_CAPABILITY *pOutput, uint32_t cbOutput)
530	{
531	#ifdef NEM_WIN_USE_17110_PLUS_WDK
532	return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput, NULL);
533	#else
534	if (g_uBuildNo >= 17110)
535	{
536	PFNWHVGETCAPABILITY_17110 pfnNewVersion = (PFNWHVGETCAPABILITY_17110)g_pfnWHvGetCapability;
537	return pfnNewVersion(enmCap, &pOutput->HypervisorPresent, cbOutput - RT_OFFSETOF(WHV_CAPABILITY, HypervisorPresent), NULL);
538	}
539	return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput);
540	#endif
541	}
542
543
544	/**
545	* Worker for nemR3NativeInit that gets the hypervisor capabilities.
546	*
547	* @returns VBox status code.
548	* @param pVM The cross context VM structure.
549	* @param pErrInfo Where to always return error info.
550	*/
551	static int nemR3WinInitCheckCapabilities(PVM pVM, PRTERRINFO pErrInfo)
552	{
553	#define NEM_LOG_REL_CAP_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %-38s= " a_szFmt "\n", a_szField, a_Value))
554	#define NEM_LOG_REL_CAP_SUB_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %36s: " a_szFmt "\n", a_szField, a_Value))
555	#define NEM_LOG_REL_CAP_SUB(a_szField, a_Value) NEM_LOG_REL_CAP_SUB_EX(a_szField, "%d", a_Value)
556
557	/*
558	* Is the hypervisor present with the desired capability?
559	*
560	* In build 17083 this translates into:
561	* - CPUID[0x00000001].HVP is set
562	* - CPUID[0x40000000] == "Microsoft Hv"
563	* - CPUID[0x40000001].eax == "Hv#1"
564	* - CPUID[0x40000003].ebx[12] is set.
565	* - VidGetExoPartitionProperty(INVALID_HANDLE_VALUE, 0x60000, &Ignored) returns
566	* a non-zero value.
567	*/
568	/**
569	* @todo Someone at Microsoft please explain weird API design:
570	* 1. Pointless CapabilityCode duplication int the output;
571	* 2. No output size.
572	*/
573	WHV_CAPABILITY Caps;
574	RT_ZERO(Caps);
575	SetLastError(0);
576	HRESULT hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeHypervisorPresent, &Caps, sizeof(Caps));
577	DWORD rcWin = GetLastError();
578	if (FAILED(hrc))
579	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
580	"WHvGetCapability/WHvCapabilityCodeHypervisorPresent failed: %Rhrc (Last=%#x/%u)",
581	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
582	if (!Caps.HypervisorPresent)
583	{
584	if (!RTPathExists(RTPATH_NT_PASSTHRU_PREFIX "Device\\VidExo"))
585	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
586	"WHvCapabilityCodeHypervisorPresent is FALSE! Make sure you have enabled the 'Windows Hypervisor Platform' feature.");
587	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "WHvCapabilityCodeHypervisorPresent is FALSE! (%u)", rcWin);
588	}
589	LogRel(("NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...\n"));
590
591
592	/*
593	* Check what extended VM exits are supported.
594	*/
595	RT_ZERO(Caps);
596	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExtendedVmExits, &Caps, sizeof(Caps));
597	if (FAILED(hrc))
598	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
599	"WHvGetCapability/WHvCapabilityCodeExtendedVmExits failed: %Rhrc (Last=%#x/%u)",
600	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
601	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeExtendedVmExits", "%'#018RX64", Caps.ExtendedVmExits.AsUINT64);
602	pVM->nem.s.fExtendedMsrExit = RT_BOOL(Caps.ExtendedVmExits.X64MsrExit);
603	pVM->nem.s.fExtendedCpuIdExit = RT_BOOL(Caps.ExtendedVmExits.X64CpuidExit);
604	pVM->nem.s.fExtendedXcptExit = RT_BOOL(Caps.ExtendedVmExits.ExceptionExit);
605	NEM_LOG_REL_CAP_SUB("fExtendedMsrExit", pVM->nem.s.fExtendedMsrExit);
606	NEM_LOG_REL_CAP_SUB("fExtendedCpuIdExit", pVM->nem.s.fExtendedCpuIdExit);
607	NEM_LOG_REL_CAP_SUB("fExtendedXcptExit", pVM->nem.s.fExtendedXcptExit);
608	if (Caps.ExtendedVmExits.AsUINT64 & ~(uint64_t)7)
609	LogRel(("NEM: Warning! Unknown VM exit definitions: %#RX64\n", Caps.ExtendedVmExits.AsUINT64));
610	/** @todo RECHECK: WHV_EXTENDED_VM_EXITS typedef. */
611
612	/*
613	* Check features in case they end up defining any.
614	*/
615	RT_ZERO(Caps);
616	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeFeatures, &Caps, sizeof(Caps));
617	if (FAILED(hrc))
618	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
619	"WHvGetCapability/WHvCapabilityCodeFeatures failed: %Rhrc (Last=%#x/%u)",
620	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
621	if (Caps.Features.AsUINT64 & ~(uint64_t)0)
622	LogRel(("NEM: Warning! Unknown feature definitions: %#RX64\n", Caps.Features.AsUINT64));
623	/** @todo RECHECK: WHV_CAPABILITY_FEATURES typedef. */
624
625	/*
626	* Check that the CPU vendor is supported.
627	*/
628	RT_ZERO(Caps);
629	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorVendor, &Caps, sizeof(Caps));
630	if (FAILED(hrc))
631	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
632	"WHvGetCapability/WHvCapabilityCodeProcessorVendor failed: %Rhrc (Last=%#x/%u)",
633	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
634	switch (Caps.ProcessorVendor)
635	{
636	/** @todo RECHECK: WHV_PROCESSOR_VENDOR typedef. */
637	case WHvProcessorVendorIntel:
638	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - Intel", Caps.ProcessorVendor);
639	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_INTEL;
640	break;
641	case WHvProcessorVendorAmd:
642	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - AMD", Caps.ProcessorVendor);
643	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_AMD;
644	break;
645	default:
646	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d", Caps.ProcessorVendor);
647	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unknown processor vendor: %d", Caps.ProcessorVendor);
648	}
649
650	/*
651	* CPU features, guessing these are virtual CPU features?
652	*/
653	RT_ZERO(Caps);
654	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorFeatures, &Caps, sizeof(Caps));
655	if (FAILED(hrc))
656	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
657	"WHvGetCapability/WHvCapabilityCodeProcessorFeatures failed: %Rhrc (Last=%#x/%u)",
658	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
659	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorFeatures", "%'#018RX64", Caps.ProcessorFeatures.AsUINT64);
660	#define NEM_LOG_REL_CPU_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ProcessorFeatures.a_Field)
661	NEM_LOG_REL_CPU_FEATURE(Sse3Support);
662	NEM_LOG_REL_CPU_FEATURE(LahfSahfSupport);
663	NEM_LOG_REL_CPU_FEATURE(Ssse3Support);
664	NEM_LOG_REL_CPU_FEATURE(Sse4_1Support);
665	NEM_LOG_REL_CPU_FEATURE(Sse4_2Support);
666	NEM_LOG_REL_CPU_FEATURE(Sse4aSupport);
667	NEM_LOG_REL_CPU_FEATURE(XopSupport);
668	NEM_LOG_REL_CPU_FEATURE(PopCntSupport);
669	NEM_LOG_REL_CPU_FEATURE(Cmpxchg16bSupport);
670	NEM_LOG_REL_CPU_FEATURE(Altmovcr8Support);
671	NEM_LOG_REL_CPU_FEATURE(LzcntSupport);
672	NEM_LOG_REL_CPU_FEATURE(MisAlignSseSupport);
673	NEM_LOG_REL_CPU_FEATURE(MmxExtSupport);
674	NEM_LOG_REL_CPU_FEATURE(Amd3DNowSupport);
675	NEM_LOG_REL_CPU_FEATURE(ExtendedAmd3DNowSupport);
676	NEM_LOG_REL_CPU_FEATURE(Page1GbSupport);
677	NEM_LOG_REL_CPU_FEATURE(AesSupport);
678	NEM_LOG_REL_CPU_FEATURE(PclmulqdqSupport);
679	NEM_LOG_REL_CPU_FEATURE(PcidSupport);
680	NEM_LOG_REL_CPU_FEATURE(Fma4Support);
681	NEM_LOG_REL_CPU_FEATURE(F16CSupport);
682	NEM_LOG_REL_CPU_FEATURE(RdRandSupport);
683	NEM_LOG_REL_CPU_FEATURE(RdWrFsGsSupport);
684	NEM_LOG_REL_CPU_FEATURE(SmepSupport);
685	NEM_LOG_REL_CPU_FEATURE(EnhancedFastStringSupport);
686	NEM_LOG_REL_CPU_FEATURE(Bmi1Support);
687	NEM_LOG_REL_CPU_FEATURE(Bmi2Support);
688	/* two reserved bits here, see below */
689	NEM_LOG_REL_CPU_FEATURE(MovbeSupport);
690	NEM_LOG_REL_CPU_FEATURE(Npiep1Support);
691	NEM_LOG_REL_CPU_FEATURE(DepX87FPUSaveSupport);
692	NEM_LOG_REL_CPU_FEATURE(RdSeedSupport);
693	NEM_LOG_REL_CPU_FEATURE(AdxSupport);
694	NEM_LOG_REL_CPU_FEATURE(IntelPrefetchSupport);
695	NEM_LOG_REL_CPU_FEATURE(SmapSupport);
696	NEM_LOG_REL_CPU_FEATURE(HleSupport);
697	NEM_LOG_REL_CPU_FEATURE(RtmSupport);
698	NEM_LOG_REL_CPU_FEATURE(RdtscpSupport);
699	NEM_LOG_REL_CPU_FEATURE(ClflushoptSupport);
700	NEM_LOG_REL_CPU_FEATURE(ClwbSupport);
701	NEM_LOG_REL_CPU_FEATURE(ShaSupport);
702	NEM_LOG_REL_CPU_FEATURE(X87PointersSavedSupport);
703	#undef NEM_LOG_REL_CPU_FEATURE
704	if (Caps.ProcessorFeatures.AsUINT64 & (~(RT_BIT_64(43) - 1) \| RT_BIT_64(27) \| RT_BIT_64(28)))
705	LogRel(("NEM: Warning! Unknown CPU features: %#RX64\n", Caps.ProcessorFeatures.AsUINT64));
706	pVM->nem.s.uCpuFeatures.u64 = Caps.ProcessorFeatures.AsUINT64;
707	/** @todo RECHECK: WHV_PROCESSOR_FEATURES typedef. */
708
709	/*
710	* The cache line flush size.
711	*/
712	RT_ZERO(Caps);
713	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorClFlushSize, &Caps, sizeof(Caps));
714	if (FAILED(hrc))
715	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
716	"WHvGetCapability/WHvCapabilityCodeProcessorClFlushSize failed: %Rhrc (Last=%#x/%u)",
717	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
718	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorClFlushSize", "2^%u", Caps.ProcessorClFlushSize);
719	if (Caps.ProcessorClFlushSize < 8 && Caps.ProcessorClFlushSize > 9)
720	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unsupported cache line flush size: %u", Caps.ProcessorClFlushSize);
721	pVM->nem.s.cCacheLineFlushShift = Caps.ProcessorClFlushSize;
722
723	/*
724	* See if they've added more properties that we're not aware of.
725	*/
726	/** @todo RECHECK: WHV_CAPABILITY_CODE typedef. */
727	if (!IsDebuggerPresent()) /* Too noisy when in debugger, so skip. */
728	{
729	static const struct
730	{
731	uint32_t iMin, iMax; } s_aUnknowns[] =
732	{
733	{ 0x0003, 0x000f },
734	{ 0x1003, 0x100f },
735	{ 0x2000, 0x200f },
736	{ 0x3000, 0x300f },
737	{ 0x4000, 0x400f },
738	};
739	for (uint32_t j = 0; j < RT_ELEMENTS(s_aUnknowns); j++)
740	for (uint32_t i = s_aUnknowns[j].iMin; i <= s_aUnknowns[j].iMax; i++)
741	{
742	RT_ZERO(Caps);
743	hrc = WHvGetCapabilityWrapper((WHV_CAPABILITY_CODE)i, &Caps, sizeof(Caps));
744	if (SUCCEEDED(hrc))
745	LogRel(("NEM: Warning! Unknown capability %#x returning: %.*Rhxs\n", i, sizeof(Caps), &Caps));
746	}
747	}
748
749	#undef NEM_LOG_REL_CAP_EX
750	#undef NEM_LOG_REL_CAP_SUB_EX
751	#undef NEM_LOG_REL_CAP_SUB
752	return VINF_SUCCESS;
753	}
754
755
756	/**
757	* Used to fill in g_IoCtlGetHvPartitionId.
758	*/
759	static NTSTATUS WINAPI
760	nemR3WinIoctlDetector_GetHvPartitionId(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
761	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
762	PVOID pvOutput, ULONG cbOutput)
763	{
764	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
765	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
766	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
767	AssertLogRelMsgReturn(cbInput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
768	RT_NOREF(pvInput);
769
770	AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
771	AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_ID), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
772	(HV_PARTITION_ID )pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID;
773
774	g_IoCtlGetHvPartitionId.cbInput = cbInput;
775	g_IoCtlGetHvPartitionId.cbOutput = cbOutput;
776	g_IoCtlGetHvPartitionId.uFunction = uFunction;
777
778	return STATUS_SUCCESS;
779	}
780
781
782	/**
783	* Used to fill in g_IoCtlStartVirtualProcessor.
784	*/
785	static NTSTATUS WINAPI
786	nemR3WinIoctlDetector_StartVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
787	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
788	PVOID pvOutput, ULONG cbOutput)
789	{
790	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
791	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
792	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
793	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
794	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
795	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
796	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
797	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
798	RT_NOREF(pvOutput);
799
800	g_IoCtlStartVirtualProcessor.cbInput = cbInput;
801	g_IoCtlStartVirtualProcessor.cbOutput = cbOutput;
802	g_IoCtlStartVirtualProcessor.uFunction = uFunction;
803
804	return STATUS_SUCCESS;
805	}
806
807
808	/**
809	* Used to fill in g_IoCtlStartVirtualProcessor.
810	*/
811	static NTSTATUS WINAPI
812	nemR3WinIoctlDetector_StopVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
813	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
814	PVOID pvOutput, ULONG cbOutput)
815	{
816	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
817	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
818	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
819	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
820	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
821	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
822	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
823	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
824	RT_NOREF(pvOutput);
825
826	g_IoCtlStopVirtualProcessor.cbInput = cbInput;
827	g_IoCtlStopVirtualProcessor.cbOutput = cbOutput;
828	g_IoCtlStopVirtualProcessor.uFunction = uFunction;
829
830	return STATUS_SUCCESS;
831	}
832
833
834	/**
835	* Used to fill in g_IoCtlMessageSlotHandleAndGetNext
836	*/
837	static NTSTATUS WINAPI
838	nemR3WinIoctlDetector_MessageSlotHandleAndGetNext(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
839	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
840	PVOID pvOutput, ULONG cbOutput)
841	{
842	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
843	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
844	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
845
846	AssertLogRelMsgReturn(cbInput == sizeof(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT), ("cbInput=%#x\n", cbInput),
847	STATUS_INVALID_PARAMETER_8);
848	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
849	PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
850	AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
851	&& pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE
852	&& pVidIn->cMillies == NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT,
853	("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
854	STATUS_INVALID_PARAMETER_9);
855	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
856	RT_NOREF(pvOutput);
857
858	g_IoCtlMessageSlotHandleAndGetNext.cbInput = cbInput;
859	g_IoCtlMessageSlotHandleAndGetNext.cbOutput = cbOutput;
860	g_IoCtlMessageSlotHandleAndGetNext.uFunction = uFunction;
861
862	return STATUS_SUCCESS;
863	}
864
865
866	#ifdef LOG_ENABLED
867	/**
868	* Used to fill in what g_pIoCtlDetectForLogging points to.
869	*/
870	static NTSTATUS WINAPI nemR3WinIoctlDetector_ForLogging(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
871	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
872	PVOID pvOutput, ULONG cbOutput)
873	{
874	RT_NOREF(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pvInput, pvOutput);
875
876	g_pIoCtlDetectForLogging->cbInput = cbInput;
877	g_pIoCtlDetectForLogging->cbOutput = cbOutput;
878	g_pIoCtlDetectForLogging->uFunction = uFunction;
879
880	return STATUS_SUCCESS;
881	}
882	#endif
883
884
885	/**
886	* Worker for nemR3NativeInit that detect I/O control function numbers for VID.
887	*
888	* We use the function numbers directly in ring-0 and to name functions when
889	* logging NtDeviceIoControlFile calls.
890	*
891	* @note We could alternatively do this by disassembling the respective
892	* functions, but hooking NtDeviceIoControlFile and making fake calls
893	* more easily provides the desired information.
894	*
895	* @returns VBox status code.
896	* @param pVM The cross context VM structure. Will set I/O
897	* control info members.
898	* @param pErrInfo Where to always return error info.
899	*/
900	static int nemR3WinInitDiscoverIoControlProperties(PVM pVM, PRTERRINFO pErrInfo)
901	{
902	/*
903	* Probe the I/O control information for select VID APIs so we can use
904	* them directly from ring-0 and better log them.
905	*
906	*/
907	decltype(NtDeviceIoControlFile) * const pfnOrg = *g_ppfnVidNtDeviceIoControlFile;
908
909	/* VidGetHvPartitionId */
910	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetHvPartitionId;
911	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
912	BOOL fRet = g_pfnVidGetHvPartitionId(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &idHvPartition);
913	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
914	AssertReturn(fRet && idHvPartition == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID && g_IoCtlGetHvPartitionId.uFunction != 0,
915	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
916	"Problem figuring out VidGetHvPartitionId: fRet=%u idHvPartition=%#x dwErr=%u",
917	fRet, idHvPartition, GetLastError()) );
918	LogRel(("NEM: VidGetHvPartitionId -> fun:%#x in:%#x out:%#x\n",
919	g_IoCtlGetHvPartitionId.uFunction, g_IoCtlGetHvPartitionId.cbInput, g_IoCtlGetHvPartitionId.cbOutput));
920
921	/* VidStartVirtualProcessor */
922	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StartVirtualProcessor;
923	fRet = g_pfnVidStartVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
924	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
925	AssertReturn(fRet && g_IoCtlStartVirtualProcessor.uFunction != 0,
926	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
927	"Problem figuring out VidStartVirtualProcessor: fRet=%u dwErr=%u",
928	fRet, GetLastError()) );
929	LogRel(("NEM: VidStartVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStartVirtualProcessor.uFunction,
930	g_IoCtlStartVirtualProcessor.cbInput, g_IoCtlStartVirtualProcessor.cbOutput));
931
932	/* VidStopVirtualProcessor */
933	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StopVirtualProcessor;
934	fRet = g_pfnVidStopVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
935	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
936	AssertReturn(fRet && g_IoCtlStopVirtualProcessor.uFunction != 0,
937	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
938	"Problem figuring out VidStopVirtualProcessor: fRet=%u dwErr=%u",
939	fRet, GetLastError()) );
940	LogRel(("NEM: VidStopVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStopVirtualProcessor.uFunction,
941	g_IoCtlStopVirtualProcessor.cbInput, g_IoCtlStopVirtualProcessor.cbOutput));
942
943	/* VidMessageSlotHandleAndGetNext */
944	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_MessageSlotHandleAndGetNext;
945	fRet = g_pfnVidMessageSlotHandleAndGetNext(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE,
946	NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX, VID_MSHAGN_F_HANDLE_MESSAGE,
947	NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT);
948	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
949	AssertReturn(fRet && g_IoCtlMessageSlotHandleAndGetNext.uFunction != 0,
950	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
951	"Problem figuring out VidMessageSlotHandleAndGetNext: fRet=%u dwErr=%u",
952	fRet, GetLastError()) );
953	LogRel(("NEM: VidMessageSlotHandleAndGetNext -> fun:%#x in:%#x out:%#x\n",
954	g_IoCtlMessageSlotHandleAndGetNext.uFunction, g_IoCtlMessageSlotHandleAndGetNext.cbInput,
955	g_IoCtlMessageSlotHandleAndGetNext.cbOutput));
956
957	#ifdef LOG_ENABLED
958	/* The following are only for logging: */
959	union
960	{
961	VID_MAPPED_MESSAGE_SLOT MapSlot;
962	HV_REGISTER_NAME Name;
963	HV_REGISTER_VALUE Value;
964	} uBuf;
965
966	/* VidMessageSlotMap */
967	g_pIoCtlDetectForLogging = &g_IoCtlMessageSlotMap;
968	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
969	fRet = g_pfnVidMessageSlotMap(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &uBuf.MapSlot, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
970	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
971	Assert(fRet);
972	LogRel(("NEM: VidMessageSlotMap -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
973	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
974
975	/* VidGetVirtualProcessorState */
976	uBuf.Name = HvRegisterExplicitSuspend;
977	g_pIoCtlDetectForLogging = &g_IoCtlGetVirtualProcessorState;
978	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
979	fRet = g_pfnVidGetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
980	&uBuf.Name, 1, &uBuf.Value);
981	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
982	Assert(fRet);
983	LogRel(("NEM: VidGetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
984	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
985
986	/* VidSetVirtualProcessorState */
987	uBuf.Name = HvRegisterExplicitSuspend;
988	g_pIoCtlDetectForLogging = &g_IoCtlSetVirtualProcessorState;
989	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
990	fRet = g_pfnVidSetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
991	&uBuf.Name, 1, &uBuf.Value);
992	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
993	Assert(fRet);
994	LogRel(("NEM: VidSetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
995	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
996
997	g_pIoCtlDetectForLogging = NULL;
998	#endif
999
1000	/* Done. */
1001	pVM->nem.s.IoCtlGetHvPartitionId = g_IoCtlGetHvPartitionId;
1002	pVM->nem.s.IoCtlStartVirtualProcessor = g_IoCtlStartVirtualProcessor;
1003	pVM->nem.s.IoCtlStopVirtualProcessor = g_IoCtlStopVirtualProcessor;
1004	pVM->nem.s.IoCtlMessageSlotHandleAndGetNext = g_IoCtlMessageSlotHandleAndGetNext;
1005	return VINF_SUCCESS;
1006	}
1007
1008
1009	/**
1010	* Wrapper for different WHvSetPartitionProperty signatures.
1011	*/
1012	DECLINLINE(HRESULT) WHvSetPartitionPropertyWrapper(WHV_PARTITION_HANDLE hPartition, WHV_PARTITION_PROPERTY_CODE enmProp,
1013	WHV_PARTITION_PROPERTY *pInput, uint32_t cbInput)
1014	{
1015	#ifdef NEM_WIN_USE_17110_PLUS_WDK
1016	return g_pfnWHvSetPartitionProperty(hPartition, enmProp, pInput, cbInput, NULL);
1017	#else
1018	pInput->PropertyCode = enmProp;
1019	if (g_uBuildNo >= 17110)
1020	{
1021	PFNWHVSETPARTITIONPROPERTY_17110 pfnNewVersion = (PFNWHVSETPARTITIONPROPERTY_17110)g_pfnWHvSetPartitionProperty;
1022	return pfnNewVersion(hPartition, enmProp, &pInput->ExtendedVmExits,
1023	cbInput - RT_UOFFSETOF(WHV_PARTITION_PROPERTY, ExtendedVmExits));
1024	}
1025	return g_pfnWHvSetPartitionProperty(hPartition, pInput, cbInput);
1026	#endif
1027	}
1028
1029
1030	/**
1031	* Creates and sets up a Hyper-V (exo) partition.
1032	*
1033	* @returns VBox status code.
1034	* @param pVM The cross context VM structure.
1035	* @param pErrInfo Where to always return error info.
1036	*/
1037	static int nemR3WinInitCreatePartition(PVM pVM, PRTERRINFO pErrInfo)
1038	{
1039	AssertReturn(!pVM->nem.s.hPartition, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1040	AssertReturn(!pVM->nem.s.hPartitionDevice, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1041
1042	/*
1043	* Create the partition.
1044	*/
1045	WHV_PARTITION_HANDLE hPartition;
1046	HRESULT hrc = WHvCreatePartition(&hPartition);
1047	if (FAILED(hrc))
1048	return RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED, "WHvCreatePartition failed with %Rhrc (Last=%#x/%u)",
1049	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1050
1051	int rc;
1052
1053	/*
1054	* Set partition properties, most importantly the CPU count.
1055	*/
1056	/**
1057	* @todo Someone at Microsoft please explain another weird API:
1058	* - Why this API doesn't take the WHV_PARTITION_PROPERTY_CODE value as an
1059	* argument rather than as part of the struct. That is so weird if you've
1060	* used any other NT or windows API, including WHvGetCapability().
1061	* - Why use PVOID when WHV_PARTITION_PROPERTY is what's expected. We
1062	* technically only need 9 bytes for setting/getting
1063	* WHVPartitionPropertyCodeProcessorClFlushSize, but the API insists on 16. */
1064	WHV_PARTITION_PROPERTY Property;
1065	RT_ZERO(Property);
1066	Property.ProcessorCount = pVM->cCpus;
1067	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorCount, &Property, sizeof(Property));
1068	if (SUCCEEDED(hrc))
1069	{
1070	RT_ZERO(Property);
1071	#if 0
1072	Property.ExtendedVmExits.X64CpuidExit = pVM->nem.s.fExtendedCpuIdExit;
1073	Property.ExtendedVmExits.X64MsrExit = pVM->nem.s.fExtendedMsrExit;
1074	Property.ExtendedVmExits.ExceptionExit = pVM->nem.s.fExtendedXcptExit;
1075	#endif
1076	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeExtendedVmExits, &Property, sizeof(Property));
1077	if (SUCCEEDED(hrc))
1078	{
1079	/*
1080	* We'll continue setup in nemR3NativeInitAfterCPUM.
1081	*/
1082	pVM->nem.s.fCreatedEmts = false;
1083	pVM->nem.s.hPartition = hPartition;
1084	LogRel(("NEM: Created partition %p.\n", hPartition));
1085	return VINF_SUCCESS;
1086	}
1087
1088	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1089	"Failed setting WHvPartitionPropertyCodeExtendedVmExits to %'#RX64: %Rhrc",
1090	Property.ExtendedVmExits.AsUINT64, hrc);
1091	}
1092	else
1093	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1094	"Failed setting WHvPartitionPropertyCodeProcessorCount to %u: %Rhrc (Last=%#x/%u)",
1095	pVM->cCpus, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1096	WHvDeletePartition(hPartition);
1097
1098	Assert(!pVM->nem.s.hPartitionDevice);
1099	Assert(!pVM->nem.s.hPartition);
1100	return rc;
1101	}
1102
1103
1104	/**
1105	* Try initialize the native API.
1106	*
1107	* This may only do part of the job, more can be done in
1108	* nemR3NativeInitAfterCPUM() and nemR3NativeInitCompleted().
1109	*
1110	* @returns VBox status code.
1111	* @param pVM The cross context VM structure.
1112	* @param fFallback Whether we're in fallback mode or use-NEM mode. In
1113	* the latter we'll fail if we cannot initialize.
1114	* @param fForced Whether the HMForced flag is set and we should
1115	* fail if we cannot initialize.
1116	*/
1117	int nemR3NativeInit(PVM pVM, bool fFallback, bool fForced)
1118	{
1119	g_uBuildNo = RTSystemGetNtBuildNo();
1120
1121	/*
1122	* Error state.
1123	* The error message will be non-empty on failure and 'rc' will be set too.
1124	*/
1125	RTERRINFOSTATIC ErrInfo;
1126	PRTERRINFO pErrInfo = RTErrInfoInitStatic(&ErrInfo);
1127	int rc = nemR3WinInitProbeAndLoad(fForced, pErrInfo);
1128	if (RT_SUCCESS(rc))
1129	{
1130	/*
1131	* Check the capabilties of the hypervisor, starting with whether it's present.
1132	*/
1133	rc = nemR3WinInitCheckCapabilities(pVM, pErrInfo);
1134	if (RT_SUCCESS(rc))
1135	{
1136	/*
1137	* Discover the VID I/O control function numbers we need.
1138	*/
1139	rc = nemR3WinInitDiscoverIoControlProperties(pVM, pErrInfo);
1140	if (RT_SUCCESS(rc))
1141	{
1142	/*
1143	* Check out our ring-0 capabilities.
1144	*/
1145	rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /idCpu/, VMMR0_DO_NEM_INIT_VM, 0, NULL);
1146	if (RT_SUCCESS(rc))
1147	{
1148	/*
1149	* Create and initialize a partition.
1150	*/
1151	rc = nemR3WinInitCreatePartition(pVM, pErrInfo);
1152	if (RT_SUCCESS(rc))
1153	{
1154	VM_SET_MAIN_EXECUTION_ENGINE(pVM, VM_EXEC_ENGINE_NATIVE_API);
1155	Log(("NEM: Marked active!\n"));
1156
1157	/* Register release statistics */
1158	for (VMCPUID iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1159	{
1160	PNEMCPU pNemCpu = &pVM->aCpus[iCpu].nem.s;
1161	STAMR3RegisterF(pVM, &pNemCpu->StatExitPortIo, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of port I/O exits", "/NEM/CPU%u/ExitPortIo", iCpu);
1162	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemUnmapped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unmapped memory exits", "/NEM/CPU%u/ExitMemUnmapped", iCpu);
1163	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemIntercept, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of intercepted memory exits", "/NEM/CPU%u/ExitMemIntercept", iCpu);
1164	STAMR3RegisterF(pVM, &pNemCpu->StatExitHalt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitHalt", iCpu);
1165	STAMR3RegisterF(pVM, &pNemCpu->StatExitInterruptWindow, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitInterruptWindow", iCpu);
1166	STAMR3RegisterF(pVM, &pNemCpu->StatGetMsgTimeout, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of get message timeouts/alerts", "/NEM/CPU%u/GetMsgTimeout", iCpu);
1167	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuSuccess, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of successful CPU stops", "/NEM/CPU%u/StopCpuSuccess", iCpu);
1168	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPending, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stops", "/NEM/CPU%u/StopCpuPending", iCpu);
1169	STAMR3RegisterF(pVM, &pNemCpu->StatCancelChangedState, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel changed state", "/NEM/CPU%u/CancelChangedState", iCpu);
1170	STAMR3RegisterF(pVM, &pNemCpu->StatCancelAlertedThread, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel alerted EMT", "/NEM/CPU%u/CancelAlertedEMT", iCpu);
1171	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPre, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pre execution FF breaks", "/NEM/CPU%u/BreakOnFFPre", iCpu);
1172	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPost, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of post execution FF breaks", "/NEM/CPU%u/BreakOnFFPost", iCpu);
1173	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnCancel, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel execution breaks", "/NEM/CPU%u/BreakOnCancel", iCpu);
1174	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnStatus, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of status code breaks", "/NEM/CPU%u/BreakOnStatus", iCpu);
1175	}
1176	}
1177	}
1178	}
1179	}
1180	}
1181
1182	/*
1183	* We only fail if in forced mode, otherwise just log the complaint and return.
1184	*/
1185	Assert(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API \|\| RTErrInfoIsSet(pErrInfo));
1186	if ( (fForced \|\| !fFallback)
1187	&& pVM->bMainExecutionEngine != VM_EXEC_ENGINE_NATIVE_API)
1188	return VMSetError(pVM, RT_SUCCESS_NP(rc) ? VERR_NEM_NOT_AVAILABLE : rc, RT_SRC_POS, "%s", pErrInfo->pszMsg);
1189
1190	if (RTErrInfoIsSet(pErrInfo))
1191	LogRel(("NEM: Not available: %s\n", pErrInfo->pszMsg));
1192	return VINF_SUCCESS;
1193	}
1194
1195
1196	/**
1197	* This is called after CPUMR3Init is done.
1198	*
1199	* @returns VBox status code.
1200	* @param pVM The VM handle..
1201	*/
1202	int nemR3NativeInitAfterCPUM(PVM pVM)
1203	{
1204	/*
1205	* Validate sanity.
1206	*/
1207	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1208	AssertReturn(hPartition != NULL, VERR_WRONG_ORDER);
1209	AssertReturn(!pVM->nem.s.hPartitionDevice, VERR_WRONG_ORDER);
1210	AssertReturn(!pVM->nem.s.fCreatedEmts, VERR_WRONG_ORDER);
1211	AssertReturn(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API, VERR_WRONG_ORDER);
1212
1213	/*
1214	* Continue setting up the partition now that we've got most of the CPUID feature stuff.
1215	*/
1216	WHV_PARTITION_PROPERTY Property;
1217	HRESULT hrc;
1218
1219	#if 0
1220	/* Not sure if we really need to set the vendor.
1221	Update: Apparently we don't. WHvPartitionPropertyCodeProcessorVendor was removed in 17110. */
1222	RT_ZERO(Property);
1223	Property.ProcessorVendor = pVM->nem.s.enmCpuVendor == CPUMCPUVENDOR_AMD ? WHvProcessorVendorAmd
1224	: WHvProcessorVendorIntel;
1225	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorVendor, &Property, sizeof(Property));
1226	if (FAILED(hrc))
1227	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1228	"Failed to set WHvPartitionPropertyCodeProcessorVendor to %u: %Rhrc (Last=%#x/%u)",
1229	Property.ProcessorVendor, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1230	#endif
1231
1232	/* Not sure if we really need to set the cache line flush size. */
1233	RT_ZERO(Property);
1234	Property.ProcessorClFlushSize = pVM->nem.s.cCacheLineFlushShift;
1235	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorClFlushSize, &Property, sizeof(Property));
1236	if (FAILED(hrc))
1237	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1238	"Failed to set WHvPartitionPropertyCodeProcessorClFlushSize to %u: %Rhrc (Last=%#x/%u)",
1239	pVM->nem.s.cCacheLineFlushShift, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1240
1241	/*
1242	* Sync CPU features with CPUM.
1243	*/
1244	/** @todo sync CPU features with CPUM. */
1245
1246	/* Set the partition property. */
1247	RT_ZERO(Property);
1248	Property.ProcessorFeatures.AsUINT64 = pVM->nem.s.uCpuFeatures.u64;
1249	hrc = WHvSetPartitionPropertyWrapper(hPartition, WHvPartitionPropertyCodeProcessorFeatures, &Property, sizeof(Property));
1250	if (FAILED(hrc))
1251	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1252	"Failed to set WHvPartitionPropertyCodeProcessorFeatures to %'#RX64: %Rhrc (Last=%#x/%u)",
1253	pVM->nem.s.uCpuFeatures.u64, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1254
1255	/*
1256	* Set up the partition and create EMTs.
1257	*
1258	* Seems like this is where the partition is actually instantiated and we get
1259	* a handle to it.
1260	*/
1261	hrc = WHvSetupPartition(hPartition);
1262	if (FAILED(hrc))
1263	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1264	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)",
1265	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1266
1267	/* Get the handle. */
1268	HANDLE hPartitionDevice;
1269	__try
1270	{
1271	hPartitionDevice = ((HANDLE *)hPartition)[1];
1272	}
1273	__except(EXCEPTION_EXECUTE_HANDLER)
1274	{
1275	hrc = GetExceptionCode();
1276	hPartitionDevice = NULL;
1277	}
1278	if ( hPartitionDevice == NULL
1279	\|\| hPartitionDevice == (HANDLE)(intptr_t)-1)
1280	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1281	"Failed to get device handle for partition %p: %Rhrc", hPartition, hrc);
1282
1283	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1284	if (!g_pfnVidGetHvPartitionId(hPartitionDevice, &idHvPartition))
1285	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1286	"Failed to get device handle and/or partition ID for %p (hPartitionDevice=%p, Last=%#x/%u)",
1287	hPartition, hPartitionDevice, RTNtLastStatusValue(), RTNtLastErrorValue());
1288	pVM->nem.s.hPartitionDevice = hPartitionDevice;
1289	pVM->nem.s.idHvPartition = idHvPartition;
1290
1291	/*
1292	* Setup the EMTs.
1293	*/
1294	VMCPUID iCpu;
1295	for (iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1296	{
1297	PVMCPU pVCpu = &pVM->aCpus[iCpu];
1298
1299	pVCpu->nem.s.hNativeThreadHandle = (RTR3PTR)RTThreadGetNativeHandle(VMR3GetThreadHandle(pVCpu->pUVCpu));
1300	Assert((HANDLE)pVCpu->nem.s.hNativeThreadHandle != INVALID_HANDLE_VALUE);
1301
1302	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1303	VID_MAPPED_MESSAGE_SLOT MappedMsgSlot = { NULL, UINT32_MAX, UINT32_MAX };
1304	if (g_pfnVidMessageSlotMap(hPartitionDevice, &MappedMsgSlot, iCpu))
1305	{
1306	AssertLogRelMsg(MappedMsgSlot.iCpu == iCpu && MappedMsgSlot.uParentAdvisory == UINT32_MAX,
1307	("%#x %#x (iCpu=%#x)\n", MappedMsgSlot.iCpu, MappedMsgSlot.uParentAdvisory, iCpu));
1308	pVCpu->nem.s.pvMsgSlotMapping = MappedMsgSlot.pMsgBlock;
1309	}
1310	else
1311	{
1312	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1313	DWORD const dwErrLast = RTNtLastErrorValue();
1314	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1315	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1316	}
1317	#else
1318	hrc = WHvCreateVirtualProcessor(hPartition, iCpu, 0 /fFlags/);
1319	if (FAILED(hrc))
1320	{
1321	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1322	DWORD const dwErrLast = RTNtLastErrorValue();
1323	while (iCpu-- > 0)
1324	{
1325	HRESULT hrc2 = WHvDeleteVirtualProcessor(hPartition, iCpu);
1326	AssertLogRelMsg(SUCCEEDED(hrc2), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1327	hPartition, iCpu, hrc2, RTNtLastStatusValue(),
1328	RTNtLastErrorValue()));
1329	}
1330	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1331	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1332	}
1333	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
1334	}
1335	pVM->nem.s.fCreatedEmts = true;
1336
1337	/*
1338	* Do some more ring-0 initialization now that we've got the partition handle.
1339	*/
1340	int rc = VMMR3CallR0Emt(pVM, &pVM->aCpus[0], VMMR0_DO_NEM_INIT_VM_PART_2, 0, NULL);
1341	if (RT_SUCCESS(rc))
1342	{
1343	LogRel(("NEM: Successfully set up partition (device handle %p, partition ID %#llx)\n", hPartitionDevice, idHvPartition));
1344	return VINF_SUCCESS;
1345	}
1346	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS, "Call to NEMR0InitVMPart2 failed: %Rrc", rc);
1347	}
1348
1349
1350	int nemR3NativeInitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
1351	{
1352	//BOOL fRet = SetThreadPriority(GetCurrentThread(), 0);
1353	//AssertLogRel(fRet);
1354
1355	NOREF(pVM); NOREF(enmWhat);
1356	return VINF_SUCCESS;
1357	}
1358
1359
1360	int nemR3NativeTerm(PVM pVM)
1361	{
1362	/*
1363	* Delete the partition.
1364	*/
1365	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1366	pVM->nem.s.hPartition = NULL;
1367	pVM->nem.s.hPartitionDevice = NULL;
1368	if (hPartition != NULL)
1369	{
1370	VMCPUID iCpu = pVM->nem.s.fCreatedEmts ? pVM->cCpus : 0;
1371	LogRel(("NEM: Destroying partition %p with its %u VCpus...\n", hPartition, iCpu));
1372	while (iCpu-- > 0)
1373	{
1374	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1375	pVM->aCpus[iCpu].nem.s.pvMsgSlotMapping = NULL;
1376	#else
1377	HRESULT hrc = WHvDeleteVirtualProcessor(hPartition, iCpu);
1378	AssertLogRelMsg(SUCCEEDED(hrc), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1379	hPartition, iCpu, hrc, RTNtLastStatusValue(),
1380	RTNtLastErrorValue()));
1381	#endif
1382	}
1383	WHvDeletePartition(hPartition);
1384	}
1385	pVM->nem.s.fCreatedEmts = false;
1386	return VINF_SUCCESS;
1387	}
1388
1389
1390	/**
1391	* VM reset notification.
1392	*
1393	* @param pVM The cross context VM structure.
1394	*/
1395	void nemR3NativeReset(PVM pVM)
1396	{
1397	/* Unfix the A20 gate. */
1398	pVM->nem.s.fA20Fixed = false;
1399	}
1400
1401
1402	/**
1403	* Reset CPU due to INIT IPI or hot (un)plugging.
1404	*
1405	* @param pVCpu The cross context virtual CPU structure of the CPU being
1406	* reset.
1407	* @param fInitIpi Whether this is the INIT IPI or hot (un)plugging case.
1408	*/
1409	void nemR3NativeResetCpu(PVMCPU pVCpu, bool fInitIpi)
1410	{
1411	/* Lock the A20 gate if INIT IPI, make sure it's enabled. */
1412	if (fInitIpi && pVCpu->idCpu > 0)
1413	{
1414	PVM pVM = pVCpu->CTX_SUFF(pVM);
1415	if (!pVM->nem.s.fA20Enabled)
1416	nemR3NativeNotifySetA20(pVCpu, true);
1417	pVM->nem.s.fA20Enabled = true;
1418	pVM->nem.s.fA20Fixed = true;
1419	}
1420	}
1421
1422	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
1423
1424	# ifdef LOG_ENABLED
1425	/**
1426	* Log the full details of an exit reason.
1427	*
1428	* @param pExitReason The exit reason to log.
1429	*/
1430	static void nemR3WinLogWHvExitReason(WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1431	{
1432	bool fExitCtx = false;
1433	bool fExitInstr = false;
1434	switch (pExitReason->ExitReason)
1435	{
1436	case WHvRunVpExitReasonMemoryAccess:
1437	Log2(("Exit: Memory access: GCPhys=%RGp GCVirt=%RGv %s %s %s\n",
1438	pExitReason->MemoryAccess.Gpa, pExitReason->MemoryAccess.Gva,
1439	g_apszWHvMemAccesstypes[pExitReason->MemoryAccess.AccessInfo.AccessType],
1440	pExitReason->MemoryAccess.AccessInfo.GpaUnmapped ? "unmapped" : "mapped",
1441	pExitReason->MemoryAccess.AccessInfo.GvaValid ? "" : "invalid-gc-virt"));
1442	AssertMsg(!(pExitReason->MemoryAccess.AccessInfo.AsUINT32 & ~UINT32_C(0xf)),
1443	("MemoryAccess.AccessInfo=%#x\n", pExitReason->MemoryAccess.AccessInfo.AsUINT32));
1444	fExitCtx = fExitInstr = true;
1445	break;
1446
1447	case WHvRunVpExitReasonX64IoPortAccess:
1448	Log2(("Exit: I/O port access: IoPort=%#x LB %u %s%s%s rax=%#RX64 rcx=%#RX64 rsi=%#RX64 rdi=%#RX64\n",
1449	pExitReason->IoPortAccess.PortNumber,
1450	pExitReason->IoPortAccess.AccessInfo.AccessSize,
1451	pExitReason->IoPortAccess.AccessInfo.IsWrite ? "out" : "in",
1452	pExitReason->IoPortAccess.AccessInfo.StringOp ? " string" : "",
1453	pExitReason->IoPortAccess.AccessInfo.RepPrefix ? " rep" : "",
1454	pExitReason->IoPortAccess.Rax,
1455	pExitReason->IoPortAccess.Rcx,
1456	pExitReason->IoPortAccess.Rsi,
1457	pExitReason->IoPortAccess.Rdi));
1458	Log2(("Exit: + ds=%#x:{%#RX64 LB %#RX32, %#x} es=%#x:{%#RX64 LB %#RX32, %#x}\n",
1459	pExitReason->IoPortAccess.Ds.Selector,
1460	pExitReason->IoPortAccess.Ds.Base,
1461	pExitReason->IoPortAccess.Ds.Limit,
1462	pExitReason->IoPortAccess.Ds.Attributes,
1463	pExitReason->IoPortAccess.Es.Selector,
1464	pExitReason->IoPortAccess.Es.Base,
1465	pExitReason->IoPortAccess.Es.Limit,
1466	pExitReason->IoPortAccess.Es.Attributes ));
1467
1468	AssertMsg( pExitReason->IoPortAccess.AccessInfo.AccessSize == 1
1469	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 2
1470	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 4,
1471	("IoPortAccess.AccessInfo.AccessSize=%d\n", pExitReason->IoPortAccess.AccessInfo.AccessSize));
1472	AssertMsg(!(pExitReason->IoPortAccess.AccessInfo.AsUINT32 & ~UINT32_C(0x3f)),
1473	("IoPortAccess.AccessInfo=%#x\n", pExitReason->IoPortAccess.AccessInfo.AsUINT32));
1474	fExitCtx = fExitInstr = true;
1475	break;
1476
1477	# if 0
1478	case WHvRunVpExitReasonUnrecoverableException:
1479	case WHvRunVpExitReasonInvalidVpRegisterValue:
1480	case WHvRunVpExitReasonUnsupportedFeature:
1481	case WHvRunVpExitReasonX64InterruptWindow:
1482	case WHvRunVpExitReasonX64Halt:
1483	case WHvRunVpExitReasonX64MsrAccess:
1484	case WHvRunVpExitReasonX64Cpuid:
1485	case WHvRunVpExitReasonException:
1486	case WHvRunVpExitReasonCanceled:
1487	case WHvRunVpExitReasonAlerted:
1488	WHV_X64_MSR_ACCESS_CONTEXT MsrAccess;
1489	WHV_X64_CPUID_ACCESS_CONTEXT CpuidAccess;
1490	WHV_VP_EXCEPTION_CONTEXT VpException;
1491	WHV_X64_INTERRUPTION_DELIVERABLE_CONTEXT InterruptWindow;
1492	WHV_UNRECOVERABLE_EXCEPTION_CONTEXT UnrecoverableException;
1493	WHV_X64_UNSUPPORTED_FEATURE_CONTEXT UnsupportedFeature;
1494	WHV_RUN_VP_CANCELED_CONTEXT CancelReason;
1495	# endif
1496
1497	case WHvRunVpExitReasonNone:
1498	Log2(("Exit: No reason\n"));
1499	AssertFailed();
1500	break;
1501
1502	default:
1503	Log(("Exit: %#x\n", pExitReason->ExitReason));
1504	break;
1505	}
1506
1507	/*
1508	* Context and maybe instruction details.
1509	*/
1510	if (fExitCtx)
1511	{
1512	const WHV_VP_EXIT_CONTEXT *pVpCtx = &pExitReason->IoPortAccess.VpContext;
1513	Log2(("Exit: + CS:RIP=%04x:%08RX64 RFLAGS=%06RX64 cbInstr=%u CS={%RX64 L %#RX32, %#x}\n",
1514	pVpCtx->Cs.Selector,
1515	pVpCtx->Rip,
1516	pVpCtx->Rflags,
1517	pVpCtx->InstructionLength,
1518	pVpCtx->Cs.Base, pVpCtx->Cs.Limit, pVpCtx->Cs.Attributes));
1519	Log2(("Exit: + cpl=%d CR0.PE=%d CR0.AM=%d EFER.LMA=%d DebugActive=%d InterruptionPending=%d InterruptShadow=%d\n",
1520	pVpCtx->ExecutionState.Cpl,
1521	pVpCtx->ExecutionState.Cr0Pe,
1522	pVpCtx->ExecutionState.Cr0Am,
1523	pVpCtx->ExecutionState.EferLma,
1524	pVpCtx->ExecutionState.DebugActive,
1525	pVpCtx->ExecutionState.InterruptionPending,
1526	pVpCtx->ExecutionState.InterruptShadow));
1527	AssertMsg(!(pVpCtx->ExecutionState.AsUINT16 & ~UINT16_C(0x107f)),
1528	("ExecutionState.AsUINT16=%#x\n", pVpCtx->ExecutionState.AsUINT16));
1529
1530	/** @todo Someone at Microsoft please explain why the InstructionBytes fields
1531	* are 16 bytes long, when 15 would've been sufficent and saved 3-7 bytes of
1532	* alignment padding? Intel max length is 15, so is this sSome ARM stuff?
1533	* Aren't ARM
1534	* instructions max 32-bit wide? Confused. */
1535	if (fExitInstr && pExitReason->IoPortAccess.InstructionByteCount > 0)
1536	Log2(("Exit: + Instruction %.*Rhxs\n",
1537	pExitReason->IoPortAccess.InstructionByteCount,
1538	&pExitReason->IoPortAccess.InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0]));
1539	}
1540	}
1541	# endif /* LOG_ENABLED */
1542
1543
1544	/**
1545	* Advances the guest RIP and clear EFLAGS.RF.
1546	*
1547	* This may clear VMCPU_FF_INHIBIT_INTERRUPTS.
1548	*
1549	* @param pVCpu The cross context virtual CPU structure.
1550	* @param pCtx The CPU context to update.
1551	* @param pExitCtx The exit context.
1552	*/
1553	DECLINLINE(void) nemR3WinAdvanceGuestRipAndClearRF(PVMCPU pVCpu, PCPUMCTX pCtx, WHV_VP_EXIT_CONTEXT const *pExitCtx)
1554	{
1555	/* Advance the RIP. */
1556	Assert(pExitCtx->InstructionLength > 0 && pExitCtx->InstructionLength < 16);
1557	pCtx->rip += pExitCtx->InstructionLength;
1558	pCtx->rflags.Bits.u1RF = 0;
1559
1560	/* Update interrupt inhibition. */
1561	if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1562	{ /* likely */ }
1563	else if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
1564	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
1565	}
1566
1567
1568	static VBOXSTRICTRC nemR3WinWHvHandleHalt(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1569	{
1570	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
1571	LogFlow(("nemR3WinWHvHandleHalt\n"));
1572	return VINF_EM_HALT;
1573	}
1574
1575
1576	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1577	/**
1578	* @callback_method_impl{FNPGMPHYSNEMENUMCALLBACK,
1579	* Hack to unmap all pages when/before we run into quota (WHv only).}
1580	*/
1581	static DECLCALLBACK(int) nemR3WinWHvUnmapOnePageCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint8_t pu2NemState, void pvUser)
1582	{
1583	RT_NOREF_PV(pvUser);
1584	RT_NOREF_PV(pVCpu);
1585	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
1586	if (SUCCEEDED(hrc))
1587	{
1588	Log5(("NEM GPA unmap all: %RGp (cMappedPages=%u)\n", GCPhys, pVM->nem.s.cMappedPages - 1));
1589	*pu2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
1590	}
1591	else
1592	{
1593	LogRel(("nemR3WinWHvUnmapOnePageCallback: GCPhys=%RGp %s hrc=%Rhrc (%#x) Last=%#x/%u (cMappedPages=%u)\n",
1594	GCPhys, g_apszPageStates[*pu2NemState], hrc, hrc, RTNtLastStatusValue(),
1595	RTNtLastErrorValue(), pVM->nem.s.cMappedPages));
1596	*pu2NemState = NEM_WIN_PAGE_STATE_NOT_SET;
1597	}
1598	if (pVM->nem.s.cMappedPages > 0)
1599	ASMAtomicDecU32(&pVM->nem.s.cMappedPages);
1600	return VINF_SUCCESS;
1601	}
1602	# endif /* !NEM_WIN_USE_HYPERCALLS_FOR_PAGES */
1603
1604
1605	/**
1606	* Handles an memory access VMEXIT.
1607	*
1608	* This can be triggered by a number of things.
1609	*
1610	* @returns Strict VBox status code.
1611	* @param pVM The cross context VM structure.
1612	* @param pVCpu The cross context virtual CPU structure.
1613	* @param pCtx The CPU context to update.
1614	* @param pMemCtx The exit reason information.
1615	*/
1616	static VBOXSTRICTRC nemR3WinWHvHandleMemoryAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_MEMORY_ACCESS_CONTEXT const *pMemCtx)
1617	{
1618	/*
1619	* Ask PGM for information about the given GCPhys. We need to check if we're
1620	* out of sync first.
1621	*/
1622	NEMHCWINHMACPCCSTATE State = { pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite, false, false };
1623	PGMPHYSNEMPAGEINFO Info;
1624	int rc = PGMPhysNemPageInfoChecker(pVM, pVCpu, pMemCtx->Gpa, State.fWriteAccess, &Info,
1625	nemHCWinHandleMemoryAccessPageCheckerCallback, &State);
1626	if (RT_SUCCESS(rc))
1627	{
1628	if (Info.fNemProt & (pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite ? NEM_PAGE_PROT_WRITE : NEM_PAGE_PROT_READ))
1629	{
1630	if (State.fCanResume)
1631	{
1632	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; restarting (%s)\n",
1633	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1634	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1635	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1636	return VINF_SUCCESS;
1637	}
1638	}
1639	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; emulating (%s)\n",
1640	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1641	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1642	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1643	}
1644	else
1645	Log4(("MemExit: %RGp rc=%Rrc%s; emulating (%s)\n", pMemCtx->Gpa, rc,
1646	State.fDidSomething ? " modified-backing" : "", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1647
1648	/*
1649	* Emulate the memory access, either access handler or special memory.
1650	*/
1651	rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1652	AssertRCReturn(rc, rc);
1653
1654	VBOXSTRICTRC rcStrict;
1655	if (pMemCtx->InstructionByteCount > 0)
1656	rcStrict = IEMExecOneWithPrefetchedByPC(pVCpu, CPUMCTX2CORE(pCtx), pMemCtx->VpContext.Rip,
1657	&pMemCtx->InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0],
1658	pMemCtx->InstructionByteCount);
1659	else
1660	rcStrict = IEMExecOne(pVCpu);
1661	/** @todo do we need to do anything wrt debugging here? */
1662	return rcStrict;
1663	}
1664
1665
1666	/**
1667	* Handles an I/O port access VMEXIT.
1668	*
1669	* We ASSUME that the hypervisor has don't I/O port access control.
1670	*
1671	* @returns Strict VBox status code.
1672	* @param pVM The cross context VM structure.
1673	* @param pVCpu The cross context virtual CPU structure.
1674	* @param pCtx The CPU context to update.
1675	* @param pIoPortCtx The exit reason information.
1676	*/
1677	static VBOXSTRICTRC nemR3WinWHvHandleIoPortAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx,
1678	WHV_X64_IO_PORT_ACCESS_CONTEXT const *pIoPortCtx)
1679	{
1680	Assert( pIoPortCtx->AccessInfo.AccessSize == 1
1681	\|\| pIoPortCtx->AccessInfo.AccessSize == 2
1682	\|\| pIoPortCtx->AccessInfo.AccessSize == 4);
1683
1684	VBOXSTRICTRC rcStrict;
1685	if (!pIoPortCtx->AccessInfo.StringOp)
1686	{
1687	/*
1688	* Simple port I/O.
1689	*/
1690	//Assert(pCtx->rax == pIoPortCtx->Rax); - sledgehammer
1691
1692	static uint32_t const s_fAndMask[8] =
1693	{ UINT32_MAX, UINT32_C(0xff), UINT32_C(0xffff), UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX };
1694	uint32_t const fAndMask = s_fAndMask[pIoPortCtx->AccessInfo.AccessSize];
1695	if (pIoPortCtx->AccessInfo.IsWrite)
1696	{
1697	rcStrict = IOMIOPortWrite(pVM, pVCpu, pIoPortCtx->PortNumber, (uint32_t)pIoPortCtx->Rax & fAndMask,
1698	pIoPortCtx->AccessInfo.AccessSize);
1699	if (IOM_SUCCESS(rcStrict))
1700	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, &pIoPortCtx->VpContext);
1701	}
1702	else
1703	{
1704	uint32_t uValue = 0;
1705	rcStrict = IOMIOPortRead(pVM, pVCpu, pIoPortCtx->PortNumber, &uValue,
1706	pIoPortCtx->AccessInfo.AccessSize);
1707	if (IOM_SUCCESS(rcStrict))
1708	{
1709	pCtx->eax = (pCtx->eax & ~fAndMask) \| (uValue & fAndMask);
1710	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, &pIoPortCtx->VpContext);
1711	}
1712	}
1713	}
1714	else
1715	{
1716	/*
1717	* String port I/O.
1718	*/
1719	/** @todo Someone at Microsoft please explain how we can get the address mode
1720	* from the IoPortAccess.VpContext. CS.Attributes is only sufficient for
1721	* getting the default mode, it can always be overridden by a prefix. This
1722	* forces us to interpret the instruction from opcodes, which is suboptimal.
1723	* Both AMD-V and VT-x includes the address size in the exit info, at least on
1724	* CPUs that are reasonably new. */
1725	# if 0 // requires sledgehammer
1726	Assert( pIoPortCtx->Ds.Base == pCtx->ds.u64Base
1727	&& pIoPortCtx->Ds.Limit == pCtx->ds.u32Limit
1728	&& pIoPortCtx->Ds.Selector == pCtx->ds.Sel);
1729	Assert( pIoPortCtx->Es.Base == pCtx->es.u64Base
1730	&& pIoPortCtx->Es.Limit == pCtx->es.u32Limit
1731	&& pIoPortCtx->Es.Selector == pCtx->es.Sel);
1732	Assert(pIoPortCtx->Rdi == pCtx->rdi);
1733	Assert(pIoPortCtx->Rsi == pCtx->rsi);
1734	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1735	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1736	# endif
1737
1738	int rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1739	AssertRCReturn(rc, rc);
1740
1741	rcStrict = IEMExecOne(pVCpu);
1742	}
1743	if (IOM_SUCCESS(rcStrict))
1744	{
1745	/*
1746	* Do debug checks.
1747	*/
1748	if ( pIoPortCtx->VpContext.ExecutionState.DebugActive /** @todo Microsoft: Does DebugActive this only reflext DR7? */
1749	\|\| (pIoPortCtx->VpContext.Rflags & X86_EFL_TF)
1750	\|\| DBGFBpIsHwIoArmed(pVM) )
1751	{
1752	/** @todo Debugging. */
1753	}
1754	}
1755	return rcStrict;
1756	}
1757
1758
1759	static VBOXSTRICTRC nemR3WinWHvHandleInterruptWindow(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1760	{
1761	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1762	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1763	}
1764
1765
1766	static VBOXSTRICTRC nemR3WinWHvHandleMsrAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1767	{
1768	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1769	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1770	}
1771
1772
1773	static VBOXSTRICTRC nemR3WinWHvHandleCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1774	{
1775	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1776	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1777	}
1778
1779
1780	static VBOXSTRICTRC nemR3WinWHvHandleException(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1781	{
1782	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1783	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1784	}
1785
1786
1787	static VBOXSTRICTRC nemR3WinWHvHandleUD(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1788	{
1789	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1790	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1791	}
1792
1793
1794	static VBOXSTRICTRC nemR3WinWHvHandleTripleFault(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1795	{
1796	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1797	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1798	}
1799
1800
1801	static VBOXSTRICTRC nemR3WinWHvHandleInvalidState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1802	{
1803	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1804	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1805	}
1806
1807
1808	VBOXSTRICTRC nemR3WinWHvRunGC(PVM pVM, PVMCPU pVCpu)
1809	{
1810	# ifdef LOG_ENABLED
1811	if (LogIs3Enabled())
1812	{
1813	Log3(("nemR3NativeRunGC: Entering #%u\n", pVCpu->idCpu));
1814	nemHCWinLogState(pVM, pVCpu);
1815	}
1816	# endif
1817
1818	/*
1819	* The run loop.
1820	*/
1821	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
1822	const bool fSingleStepping = false; /** @todo get this from somewhere. */
1823	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1824	for (unsigned iLoop = 0;;iLoop++)
1825	{
1826	/*
1827	* Copy the state.
1828	*/
1829	int rc2 = nemHCWinCopyStateToHyperV(pVM, pVCpu, pCtx);
1830	AssertRCBreakStmt(rc2, rcStrict = rc2);
1831
1832	/*
1833	* Run a bit.
1834	*/
1835	WHV_RUN_VP_EXIT_CONTEXT ExitReason;
1836	RT_ZERO(ExitReason);
1837	if ( !VM_FF_IS_PENDING(pVM, VM_FF_EMT_RENDEZVOUS \| VM_FF_TM_VIRTUAL_SYNC)
1838	&& !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
1839	{
1840	Log8(("Calling WHvRunVirtualProcessor\n"));
1841	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC_NEM, VMCPUSTATE_STARTED);
1842	HRESULT hrc = WHvRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, &ExitReason, sizeof(ExitReason));
1843	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC_NEM);
1844	AssertLogRelMsgBreakStmt(SUCCEEDED(hrc),
1845	("WHvRunVirtualProcessor(%p, %u,,) -> %Rhrc (Last=%#x/%u)\n", pVM->nem.s.hPartition, pVCpu->idCpu,
1846	hrc, RTNtLastStatusValue(), RTNtLastErrorValue()),
1847	rcStrict = VERR_INTERNAL_ERROR);
1848	Log2(("WHvRunVirtualProcessor -> %#x; exit code %#x (%d) (cpu status %u)\n",
1849	hrc, ExitReason.ExitReason, ExitReason.ExitReason, nemHCWinCpuGetRunningStatus(pVCpu) ));
1850	}
1851	else
1852	{
1853	LogFlow(("nemR3NativeRunGC: returning: pending FF (pre exec)\n"));
1854	break;
1855	}
1856
1857	# if 0 /* sledgehammer approach */
1858	/*
1859	* Copy back the state.
1860	*/
1861	rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, UINT64_MAX);
1862	AssertRCBreakStmt(rc2, rcStrict = rc2);
1863	# endif
1864
1865	# ifdef LOG_ENABLED
1866	/*
1867	* Do some logging.
1868	*/
1869	if (LogIs2Enabled())
1870	nemR3WinLogWHvExitReason(&ExitReason);
1871	if (LogIs3Enabled())
1872	nemHCWinLogState(pVM, pVCpu);
1873	# endif
1874
1875	# if 0 //def VBOX_STRICT - requires sledgehammer
1876	/* Assert that the VpContext field makes sense. */
1877	switch (ExitReason.ExitReason)
1878	{
1879	case WHvRunVpExitReasonMemoryAccess:
1880	case WHvRunVpExitReasonX64IoPortAccess:
1881	case WHvRunVpExitReasonX64MsrAccess:
1882	case WHvRunVpExitReasonX64Cpuid:
1883	case WHvRunVpExitReasonException:
1884	case WHvRunVpExitReasonUnrecoverableException:
1885	Assert( ExitReason.IoPortAccess.VpContext.InstructionLength > 0
1886	\|\| ( ExitReason.ExitReason == WHvRunVpExitReasonMemoryAccess
1887	&& ExitReason.MemoryAccess.AccessInfo.AccessType == WHvMemoryAccessExecute));
1888	Assert(ExitReason.IoPortAccess.VpContext.InstructionLength < 16);
1889	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cpl == CPUMGetGuestCPL(pVCpu));
1890	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Pe == RT_BOOL(pCtx->cr0 & X86_CR0_PE));
1891	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Am == RT_BOOL(pCtx->cr0 & X86_CR0_AM));
1892	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.EferLma == RT_BOOL(pCtx->msrEFER & MSR_K6_EFER_LMA));
1893	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.DebugActive == RT_BOOL(pCtx->dr[7] & X86_DR7_ENABLED_MASK));
1894	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved0 == 0);
1895	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved1 == 0);
1896	Assert(ExitReason.IoPortAccess.VpContext.Rip == pCtx->rip);
1897	Assert(ExitReason.IoPortAccess.VpContext.Rflags == pCtx->rflags.u);
1898	Assert( ExitReason.IoPortAccess.VpContext.Cs.Base == pCtx->cs.u64Base
1899	&& ExitReason.IoPortAccess.VpContext.Cs.Limit == pCtx->cs.u32Limit
1900	&& ExitReason.IoPortAccess.VpContext.Cs.Selector == pCtx->cs.Sel);
1901	break;
1902	default: break; /* shut up compiler. */
1903	}
1904	# endif
1905
1906	/*
1907	* Deal with the exit.
1908	*/
1909	switch (ExitReason.ExitReason)
1910	{
1911	/* Frequent exits: */
1912	case WHvRunVpExitReasonCanceled:
1913	case WHvRunVpExitReasonAlerted:
1914	rcStrict = VINF_SUCCESS;
1915	break;
1916
1917	case WHvRunVpExitReasonX64Halt:
1918	rcStrict = nemR3WinWHvHandleHalt(pVM, pVCpu, pCtx);
1919	break;
1920
1921	case WHvRunVpExitReasonMemoryAccess:
1922	rcStrict = nemR3WinWHvHandleMemoryAccess(pVM, pVCpu, pCtx, &ExitReason.MemoryAccess);
1923	break;
1924
1925	case WHvRunVpExitReasonX64IoPortAccess:
1926	rcStrict = nemR3WinWHvHandleIoPortAccess(pVM, pVCpu, pCtx, &ExitReason.IoPortAccess);
1927	break;
1928
1929	case WHvRunVpExitReasonX64InterruptWindow:
1930	rcStrict = nemR3WinWHvHandleInterruptWindow(pVM, pVCpu, pCtx, &ExitReason);
1931	break;
1932
1933	case WHvRunVpExitReasonX64MsrAccess: /* needs configuring */
1934	rcStrict = nemR3WinWHvHandleMsrAccess(pVM, pVCpu, pCtx, &ExitReason);
1935	break;
1936
1937	case WHvRunVpExitReasonX64Cpuid: /* needs configuring */
1938	rcStrict = nemR3WinWHvHandleCpuId(pVM, pVCpu, pCtx, &ExitReason);
1939	break;
1940
1941	case WHvRunVpExitReasonException: /* needs configuring */
1942	rcStrict = nemR3WinWHvHandleException(pVM, pVCpu, pCtx, &ExitReason);
1943	break;
1944
1945	/* Unlikely exits: */
1946	case WHvRunVpExitReasonUnsupportedFeature:
1947	rcStrict = nemR3WinWHvHandleUD(pVM, pVCpu, pCtx, &ExitReason);
1948	break;
1949
1950	case WHvRunVpExitReasonUnrecoverableException:
1951	rcStrict = nemR3WinWHvHandleTripleFault(pVM, pVCpu, pCtx, &ExitReason);
1952	break;
1953
1954	case WHvRunVpExitReasonInvalidVpRegisterValue:
1955	rcStrict = nemR3WinWHvHandleInvalidState(pVM, pVCpu, pCtx, &ExitReason);
1956	break;
1957
1958	/* Undesired exits: */
1959	case WHvRunVpExitReasonNone:
1960	default:
1961	AssertLogRelMsgFailed(("Unknown ExitReason: %#x\n", ExitReason.ExitReason));
1962	rcStrict = VERR_INTERNAL_ERROR_3;
1963	break;
1964	}
1965	if (rcStrict != VINF_SUCCESS)
1966	{
1967	LogFlow(("nemR3NativeRunGC: returning: %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1968	break;
1969	}
1970
1971	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1972	/* Hack alert! */
1973	uint32_t const cMappedPages = pVM->nem.s.cMappedPages;
1974	if (cMappedPages < 4000)
1975	{ /* likely */ }
1976	else
1977	{
1978	PGMPhysNemEnumPagesByState(pVM, pVCpu, NEM_WIN_PAGE_STATE_READABLE, nemR3WinWHvUnmapOnePageCallback, NULL);
1979	Log(("nemR3NativeRunGC: Unmapped all; cMappedPages=%u -> %u\n", cMappedPages, pVM->nem.s.cMappedPages));
1980	}
1981	# endif
1982
1983	/* If any FF is pending, return to the EM loops. That's okay for the
1984	current sledgehammer approach. */
1985	if ( VM_FF_IS_PENDING( pVM, !fSingleStepping ? VM_FF_HP_R0_PRE_HM_MASK : VM_FF_HP_R0_PRE_HM_STEP_MASK)
1986	\|\| VMCPU_FF_IS_PENDING(pVCpu, !fSingleStepping ? VMCPU_FF_HP_R0_PRE_HM_MASK : VMCPU_FF_HP_R0_PRE_HM_STEP_MASK) )
1987	{
1988	LogFlow(("nemR3NativeRunGC: returning: pending FF (%#x / %#x)\n", pVM->fGlobalForcedActions, pVCpu->fLocalForcedActions));
1989	break;
1990	}
1991	}
1992
1993
1994	/*
1995	* Copy back the state before returning.
1996	*/
1997	if (pCtx->fExtrn & (CPUMCTX_EXTRN_ALL \| (CPUMCTX_EXTRN_NEM_WIN_MASK & ~CPUMCTX_EXTRN_NEM_WIN_EVENT_INJECT)))
1998	{
1999	int rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, CPUMCTX_EXTRN_ALL \| CPUMCTX_EXTRN_NEM_WIN_MASK);
2000	if (RT_SUCCESS(rc2))
2001	pCtx->fExtrn = 0;
2002	else if (RT_SUCCESS(rcStrict))
2003	rcStrict = rc2;
2004	}
2005	else
2006	pCtx->fExtrn = 0;
2007
2008	return rcStrict;
2009	}
2010
2011	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
2012
2013
2014	VBOXSTRICTRC nemR3NativeRunGC(PVM pVM, PVMCPU pVCpu)
2015	{
2016	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
2017	return nemR3WinWHvRunGC(pVM, pVCpu);
2018	#elif 0
2019	return nemHCWinRunGC(pVM, pVCpu, NULL /pGVM/, NULL /pGVCpu/);
2020	#else
2021	VBOXSTRICTRC rcStrict = VMMR3CallR0EmtFast(pVM, pVCpu, VMMR0_DO_NEM_RUN);
2022	if (RT_SUCCESS(rcStrict))
2023	{
2024	/* We deal wtih VINF_NEM_CHANGE_PGM_MODE and VINF_NEM_FLUSH_TLB here, since we're running
2025	the risk of getting these while we already got another RC (I/O ports). */
2026	VBOXSTRICTRC rcPgmPending = pVCpu->nem.s.rcPgmPending;
2027	pVCpu->nem.s.rcPgmPending = VINF_SUCCESS;
2028	if ( rcStrict == VINF_NEM_CHANGE_PGM_MODE
2029	\|\| rcStrict == VINF_PGM_CHANGE_MODE
2030	\|\| rcPgmPending == VINF_NEM_CHANGE_PGM_MODE )
2031	{
2032	LogFlow(("nemR3NativeRunGC: calling PGMChangeMode...\n"));
2033	int rc = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2034	AssertRCReturn(rc, rc);
2035	if (rcStrict == VINF_NEM_CHANGE_PGM_MODE \|\| rcStrict == VINF_NEM_FLUSH_TLB)
2036	rcStrict = VINF_SUCCESS;
2037	}
2038	else if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcPgmPending == VINF_NEM_FLUSH_TLB)
2039	{
2040	LogFlow(("nemR3NativeRunGC: calling PGMFlushTLB...\n"));
2041	int rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true);
2042	AssertRCReturn(rc, rc);
2043	if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcStrict == VINF_NEM_CHANGE_PGM_MODE)
2044	rcStrict = VINF_SUCCESS;
2045	}
2046	else
2047	AssertMsg(rcPgmPending == VINF_SUCCESS, ("rcPgmPending=%Rrc\n", VBOXSTRICTRC_VAL(rcPgmPending) ));
2048	}
2049	LogFlow(("nemR3NativeRunGC: returns %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2050	return rcStrict;
2051	#endif
2052	}
2053
2054
2055	bool nemR3NativeCanExecuteGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2056	{
2057	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
2058	return true;
2059	}
2060
2061
2062	bool nemR3NativeSetSingleInstruction(PVM pVM, PVMCPU pVCpu, bool fEnable)
2063	{
2064	NOREF(pVM); NOREF(pVCpu); NOREF(fEnable);
2065	return false;
2066	}
2067
2068
2069	/**
2070	* Forced flag notification call from VMEmt.h.
2071	*
2072	* This is only called when pVCpu is in the VMCPUSTATE_STARTED_EXEC_NEM state.
2073	*
2074	* @param pVM The cross context VM structure.
2075	* @param pVCpu The cross context virtual CPU structure of the CPU
2076	* to be notified.
2077	* @param fFlags Notification flags, VMNOTIFYFF_FLAGS_XXX.
2078	*/
2079	void nemR3NativeNotifyFF(PVM pVM, PVMCPU pVCpu, uint32_t fFlags)
2080	{
2081	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
2082	nemHCWinCancelRunVirtualProcessor(pVM, pVCpu);
2083	#else
2084	Log8(("nemR3NativeNotifyFF: canceling %u\n", pVCpu->idCpu));
2085	HRESULT hrc = WHvCancelRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, 0);
2086	AssertMsg(SUCCEEDED(hrc), ("WHvCancelRunVirtualProcessor -> hrc=%Rhrc\n", hrc));
2087	RT_NOREF_PV(hrc);
2088	#endif
2089	RT_NOREF_PV(fFlags);
2090	}
2091
2092
2093	DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv)
2094	{
2095	PGMPAGEMAPLOCK Lock;
2096	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, &Lock);
2097	if (RT_SUCCESS(rc))
2098	PGMPhysReleasePageMappingLock(pVM, &Lock);
2099	return rc;
2100	}
2101
2102
2103	DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv)
2104	{
2105	PGMPAGEMAPLOCK Lock;
2106	int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, &Lock);
2107	if (RT_SUCCESS(rc))
2108	PGMPhysReleasePageMappingLock(pVM, &Lock);
2109	return rc;
2110	}
2111
2112
2113	int nemR3NativeNotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb)
2114	{
2115	Log5(("nemR3NativeNotifyPhysRamRegister: %RGp LB %RGp\n", GCPhys, cb));
2116	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2117	return VINF_SUCCESS;
2118	}
2119
2120
2121	int nemR3NativeNotifyPhysMmioExMap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags, void *pvMmio2)
2122	{
2123	Log5(("nemR3NativeNotifyPhysMmioExMap: %RGp LB %RGp fFlags=%#x pvMmio2=%p\n", GCPhys, cb, fFlags, pvMmio2));
2124	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags); NOREF(pvMmio2);
2125	return VINF_SUCCESS;
2126	}
2127
2128
2129	int nemR3NativeNotifyPhysMmioExUnmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2130	{
2131	Log5(("nemR3NativeNotifyPhysMmioExUnmap: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2132	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2133	return VINF_SUCCESS;
2134	}
2135
2136
2137	/**
2138	* Called early during ROM registration, right after the pages have been
2139	* allocated and the RAM range updated.
2140	*
2141	* This will be succeeded by a number of NEMHCNotifyPhysPageProtChanged() calls
2142	* and finally a NEMR3NotifyPhysRomRegisterEarly().
2143	*
2144	* @returns VBox status code
2145	* @param pVM The cross context VM structure.
2146	* @param GCPhys The ROM address (page aligned).
2147	* @param cb The size (page aligned).
2148	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2149	*/
2150	int nemR3NativeNotifyPhysRomRegisterEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2151	{
2152	Log5(("nemR3NativeNotifyPhysRomRegisterEarly: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2153	#if 0 /* Let's not do this after all. We'll protection change notifications for each page and if not we'll map them lazily. */
2154	RTGCPHYS const cPages = cb >> X86_PAGE_SHIFT;
2155	for (RTGCPHYS iPage = 0; iPage < cPages; iPage++, GCPhys += X86_PAGE_SIZE)
2156	{
2157	const void *pvPage;
2158	int rc = nemR3NativeGCPhys2R3PtrReadOnly(pVM, GCPhys, &pvPage);
2159	if (RT_SUCCESS(rc))
2160	{
2161	HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, (void *)pvPage, GCPhys, X86_PAGE_SIZE,
2162	WHvMapGpaRangeFlagRead \| WHvMapGpaRangeFlagExecute);
2163	if (SUCCEEDED(hrc))
2164	{ /* likely */ }
2165	else
2166	{
2167	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2168	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2169	return VERR_NEM_INIT_FAILED;
2170	}
2171	}
2172	else
2173	{
2174	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2175	return rc;
2176	}
2177	}
2178	#else
2179	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2180	#endif
2181	RT_NOREF_PV(fFlags);
2182	return VINF_SUCCESS;
2183	}
2184
2185
2186	/**
2187	* Called after the ROM range has been fully completed.
2188	*
2189	* This will be preceeded by a NEMR3NotifyPhysRomRegisterEarly() call as well a
2190	* number of NEMHCNotifyPhysPageProtChanged calls.
2191	*
2192	* @returns VBox status code
2193	* @param pVM The cross context VM structure.
2194	* @param GCPhys The ROM address (page aligned).
2195	* @param cb The size (page aligned).
2196	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2197	*/
2198	int nemR3NativeNotifyPhysRomRegisterLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2199	{
2200	Log5(("nemR3NativeNotifyPhysRomRegisterLate: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2201	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2202	return VINF_SUCCESS;
2203	}
2204
2205
2206	/**
2207	* @callback_method_impl{FNPGMPHYSNEMCHECKPAGE}
2208	*/
2209	static DECLCALLBACK(int) nemR3WinUnsetForA20CheckerCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys,
2210	PPGMPHYSNEMPAGEINFO pInfo, void *pvUser)
2211	{
2212	/* We'll just unmap the memory. */
2213	if (pInfo->u2NemState > NEM_WIN_PAGE_STATE_UNMAPPED)
2214	{
2215	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2216	int rc = nemHCWinHypercallUnmapPage(pVM, pVCpu, GCPhys);
2217	AssertRC(rc);
2218	if (RT_SUCCESS(rc))
2219	#else
2220	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
2221	if (SUCCEEDED(hrc))
2222	#endif
2223	{
2224	uint32_t cMappedPages = ASMAtomicDecU32(&pVM->nem.s.cMappedPages); NOREF(cMappedPages);
2225	Log5(("NEM GPA unmapped/A20: %RGp (was %s, cMappedPages=%u)\n", GCPhys, g_apszPageStates[pInfo->u2NemState], cMappedPages));
2226	pInfo->u2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
2227	}
2228	else
2229	{
2230	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2231	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2232	return rc;
2233	#else
2234	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2235	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2236	return VERR_INTERNAL_ERROR_2;
2237	#endif
2238	}
2239	}
2240	RT_NOREF(pVCpu, pvUser);
2241	return VINF_SUCCESS;
2242	}
2243
2244
2245	/**
2246	* Unmaps a page from Hyper-V for the purpose of emulating A20 gate behavior.
2247	*
2248	* @returns The PGMPhysNemQueryPageInfo result.
2249	* @param pVM The cross context VM structure.
2250	* @param pVCpu The cross context virtual CPU structure.
2251	* @param GCPhys The page to unmap.
2252	*/
2253	static int nemR3WinUnmapPageForA20Gate(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2254	{
2255	PGMPHYSNEMPAGEINFO Info;
2256	return PGMPhysNemPageInfoChecker(pVM, pVCpu, GCPhys, false /fMakeWritable/, &Info,
2257	nemR3WinUnsetForA20CheckerCallback, NULL);
2258	}
2259
2260
2261	/**
2262	* Called when the A20 state changes.
2263	*
2264	* Hyper-V doesn't seem to offer a simple way of implementing the A20 line
2265	* features of PCs. So, we do a very minimal emulation of the HMA to make DOS
2266	* happy.
2267	*
2268	* @param pVCpu The CPU the A20 state changed on.
2269	* @param fEnabled Whether it was enabled (true) or disabled.
2270	*/
2271	void nemR3NativeNotifySetA20(PVMCPU pVCpu, bool fEnabled)
2272	{
2273	Log(("nemR3NativeNotifySetA20: fEnabled=%RTbool\n", fEnabled));
2274	PVM pVM = pVCpu->CTX_SUFF(pVM);
2275	if (!pVM->nem.s.fA20Fixed)
2276	{
2277	pVM->nem.s.fA20Enabled = fEnabled;
2278	for (RTGCPHYS GCPhys = _1M; GCPhys < _1M + _64K; GCPhys += X86_PAGE_SIZE)
2279	nemR3WinUnmapPageForA20Gate(pVM, pVCpu, GCPhys);
2280	}
2281	}
2282
2283
2284	/** @page pg_nem_win NEM/win - Native Execution Manager, Windows.
2285	*
2286	* On Windows the Hyper-V root partition (dom0 in zen terminology) does not have
2287	* nested VT-x or AMD-V capabilities. For a while raw-mode worked inside it,
2288	* but for a while now we've been getting \#GP when trying to modify CR4 in the
2289	* world switcher. So, when Hyper-V is active on Windows we have little choice
2290	* but to use Hyper-V to run our VMs.
2291	*
2292	*
2293	* @section sub_nem_win_whv The WinHvPlatform API
2294	*
2295	* Since Windows 10 build 17083 there is a documented API for managing Hyper-V
2296	* VMs, header file WinHvPlatform.h and implementation in WinHvPlatform.dll.
2297	* This interface is a wrapper around the undocumented Virtualization
2298	* Infrastructure Driver (VID) API - VID.DLL and VID.SYS. The wrapper is
2299	* written in C++, namespaced, early versions (at least) was using standard C++
2300	* container templates in several places.
2301	*
2302	* When creating a VM using WHvCreatePartition, it will only create the
2303	* WinHvPlatform structures for it, to which you get an abstract pointer. The
2304	* VID API that actually creates the partition is first engaged when you call
2305	* WHvSetupPartition after first setting a lot of properties using
2306	* WHvSetPartitionProperty. Since the VID API is just a very thin wrapper
2307	* around CreateFile and NtDeviceIoControlFile, it returns an actual HANDLE for
2308	* the partition WinHvPlatform. We fish this HANDLE out of the WinHvPlatform
2309	* partition structures because we need to talk directly to VID for reasons
2310	* we'll get to in a bit. (Btw. we could also intercept the CreateFileW or
2311	* NtDeviceIoControlFile calls from VID.DLL to get the HANDLE should fishing in
2312	* the partition structures become difficult.)
2313	*
2314	* The WinHvPlatform API requires us to both set the number of guest CPUs before
2315	* setting up the partition and call WHvCreateVirtualProcessor for each of them.
2316	* The CPU creation function boils down to a VidMessageSlotMap call that sets up
2317	* and maps a message buffer into ring-3 for async communication with hyper-V
2318	* and/or the VID.SYS thread actually running the CPU thru
2319	* WinHvRunVpDispatchLoop(). When for instance a VMEXIT is encountered, hyper-V
2320	* sends a message that the WHvRunVirtualProcessor API retrieves (and later
2321	* acknowledges) via VidMessageSlotHandleAndGetNext. It should be noteded that
2322	* WHvDeleteVirtualProcessor doesn't do much as there seems to be no partner
2323	* function VidMessagesSlotMap that reverses what it did.
2324	*
2325	* Memory is managed thru calls to WHvMapGpaRange and WHvUnmapGpaRange (GPA does
2326	* not mean grade point average here, but rather guest physical addressspace),
2327	* which corresponds to VidCreateVaGpaRangeSpecifyUserVa and VidDestroyGpaRange
2328	* respectively. As 'UserVa' indicates, the functions works on user process
2329	* memory. The mappings are also subject to quota restrictions, so the number
2330	* of ranges are limited and probably their total size as well. Obviously
2331	* VID.SYS keeps track of the ranges, but so does WinHvPlatform, which means
2332	* there is a bit of overhead involved and quota restrctions makes sense. For
2333	* some reason though, regions are lazily mapped on VMEXIT/memory by
2334	* WHvRunVirtualProcessor.
2335	*
2336	* Running guest code is done thru the WHvRunVirtualProcessor function. It
2337	* asynchronously starts or resumes hyper-V CPU execution and then waits for an
2338	* VMEXIT message. Hyper-V / VID.SYS will return information about the message
2339	* in the message buffer mapping, and WHvRunVirtualProcessor will convert that
2340	* finto it's own WHV_RUN_VP_EXIT_CONTEXT format.
2341	*
2342	* Other threads can interrupt the execution by using WHvCancelVirtualProcessor,
2343	* which which case the thread in WHvRunVirtualProcessor is woken up via a dummy
2344	* QueueUserAPC and will call VidStopVirtualProcessor to asynchronously end
2345	* execution. The stop CPU call not immediately succeed if the CPU encountered
2346	* a VMEXIT before the stop was processed, in which case the VMEXIT needs to be
2347	* processed first, and the pending stop will be processed in a subsequent call
2348	* to WHvRunVirtualProcessor.
2349	*
2350	* Registers are retrieved and set via WHvGetVirtualProcessorRegisters and
2351	* WHvSetVirtualProcessorRegisters. In addition, several VMEXITs include
2352	* essential register state in the exit context information, potentially making
2353	* it possible to emulate the instruction causing the exit without involving
2354	* WHvGetVirtualProcessorRegisters.
2355	*
2356	*
2357	* @subsection subsec_nem_win_whv_cons Issues & Feedback
2358	*
2359	* Here are some observations (mostly against build 17101):
2360	*
2361	* - The VMEXIT performance is dismal (build 17101).
2362	*
2363	* Our proof of concept implementation with a kernel runloop (i.e. not using
2364	* WHvRunVirtualProcessor and friends, but calling VID.SYS fast I/O control
2365	* entry point directly) delivers 9-10% of the port I/O performance and only
2366	* 6-7% of the MMIO performance that we have with our own hypervisor.
2367	*
2368	* When using the offical WinHvPlatform API, the numbers are %3 for port I/O
2369	* and 5% for MMIO.
2370	*
2371	* While the tests we've done are using tight tight loops only doing port I/O
2372	* and MMIO, the problem is clearly visible when running regular guest OSes.
2373	* Anything that hammers the VGA device would be suffering, for example:
2374	*
2375	* - Windows 2000 boot screen animation overloads us with MMIO exits
2376	* and won't even boot because all the time is spent in interrupt
2377	* handlers and redrawin the screen.
2378	*
2379	* - DSL 4.4 and its bootmenu logo is slower than molasses in january.
2380	*
2381	* We have not found a workaround for this yet.
2382	*
2383	* Something that might improve the issue a little is to detect blocks with
2384	* excessive MMIO and port I/O exits and emulate instructions to cover
2385	* multiple exits before letting Hyper-V have a go at the guest execution
2386	* again. This will only improve the situation under some circumstances,
2387	* since emulating instructions without recompilation can be expensive, so
2388	* there will only be real gains if the exitting instructions are tightly
2389	* packed.
2390	*
2391	*
2392	* - The WHvCancelVirtualProcessor API schedules a dummy usermode APC callback
2393	* in order to cancel any current or future alertable wait in VID.SYS during
2394	* the VidMessageSlotHandleAndGetNext call.
2395	*
2396	* IIRC this will make the kernel schedule the specified callback thru
2397	* NTDLL!KiUserApcDispatcher by modifying the thread context and quite
2398	* possibly the userland thread stack. When the APC callback returns to
2399	* KiUserApcDispatcher, it will call NtContinue to restore the old thread
2400	* context and resume execution from there. This naturally adds up to some
2401	* CPU cycles, ring transitions aren't for free, especially after Spectre &
2402	* Meltdown mitigations.
2403	*
2404	* Using NtAltertThread call could do the same without the thread context
2405	* modifications and the extra kernel call.
2406	*
2407	*
2408	* - Not sure if this is a thing, but WHvCancelVirtualProcessor seems to cause
2409	* cause a lot more spurious WHvRunVirtualProcessor returns that what we get
2410	* with the replacement code. By spurious returns we mean that the
2411	* subsequent call to WHvRunVirtualProcessor would return immediately.
2412	*
2413	*
2414	* - When WHvRunVirtualProcessor returns without a message, or on a terse
2415	* VID message like HLT, it will make a kernel call to get some registers.
2416	* This is potentially inefficient if the caller decides he needs more
2417	* register state.
2418	*
2419	* It would be better to just return what's available and let the caller fetch
2420	* what is missing from his point of view in a single kernel call.
2421	*
2422	*
2423	* - The WHvRunVirtualProcessor implementation does lazy GPA range mappings when
2424	* a unmapped GPA message is received from hyper-V.
2425	*
2426	* Since MMIO is currently realized as unmapped GPA, this will slow down all
2427	* MMIO accesses a tiny little bit as WHvRunVirtualProcessor looks up the
2428	* guest physical address to check if it is a pending lazy mapping.
2429	*
2430	* The lazy mapping feature makes no sense to us. We as API user have all the
2431	* information and can do lazy mapping ourselves if we want/have to (see next
2432	* point).
2433	*
2434	*
2435	* - There is no API for modifying protection of a page within a GPA range.
2436	*
2437	* From what we can tell, the only way to modify the protection (like readonly
2438	* -> writable, or vice versa) is to first unmap the range and then remap it
2439	* with the new protection.
2440	*
2441	* We are for instance doing this quite a bit in order to track dirty VRAM
2442	* pages. VRAM pages starts out as readonly, when the guest writes to a page
2443	* we take an exit, notes down which page it is, makes it writable and restart
2444	* the instruction. After refreshing the display, we reset all the writable
2445	* pages to readonly again, bulk fashion.
2446	*
2447	* Now to work around this issue, we do page sized GPA ranges. In addition to
2448	* add a lot of tracking overhead to WinHvPlatform and VID.SYS, this also
2449	* causes us to exceed our quota before we've even mapped a default sized
2450	* (128MB) VRAM page-by-page. So, to work around this quota issue we have to
2451	* lazily map pages and actively restrict the number of mappings.
2452	*
2453	* Our best workaround thus far is bypassing WinHvPlatform and VID entirely
2454	* when in comes to guest memory management and instead use the underlying
2455	* hypercalls (HvCallMapGpaPages, HvCallUnmapGpaPages) to do it ourselves.
2456	* (This also maps a whole lot better into our own guest page management
2457	* infrastructure.)
2458	*
2459	*
2460	* - Observed problems doing WHvUnmapGpaRange immediately followed by
2461	* WHvMapGpaRange.
2462	*
2463	* As mentioned above, we've been forced to use this sequence when modifying
2464	* page protection. However, when transitioning from readonly to writable,
2465	* we've ended up looping forever with the same write to readonly memory
2466	* VMEXIT. We're wondering if this issue might be related to the lazy mapping
2467	* logic in WinHvPlatform.
2468	*
2469	* Workaround: Insert a WHvRunVirtualProcessor call and make sure to get a GPA
2470	* unmapped exit between the two calls. Not entirely great performance wise
2471	* (or the santity of our code).
2472	*
2473	*
2474	* - Implementing A20 gate behavior is tedious, where as correctly emulating the
2475	* A20M# pin (present on 486 and later) is near impossible for SMP setups
2476	* (e.g. possiblity of two CPUs with different A20 status).
2477	*
2478	* Workaround: Only do A20 on CPU 0, restricting the emulation to HMA. We
2479	* unmap all pages related to HMA (0x100000..0x10ffff) when the A20 state
2480	* changes, lazily syncing the right pages back when accessed.
2481	*
2482	*
2483	* - WHVRunVirtualProcessor wastes time converting VID/Hyper-V messages to its
2484	* own format (WHV_RUN_VP_EXIT_CONTEXT).
2485	*
2486	* We understand this might be because Microsoft wishes to remain free to
2487	* modify the VID/Hyper-V messages, but it's still rather silly and does slow
2488	* things down a little. We'd much rather just process the messages directly.
2489	*
2490	*
2491	* - WHVRunVirtualProcessor would've benefited from using a callback interface:
2492	*
2493	* - The potential size changes of the exit context structure wouldn't be
2494	* an issue, since the function could manage that itself.
2495	*
2496	* - State handling could probably be simplified (like cancelation).
2497	*
2498	*
2499	* - WHvGetVirtualProcessorRegisters and WHvSetVirtualProcessorRegisters
2500	* internally converts register names, probably using temporary heap buffers.
2501	*
2502	* From the looks of things, they are converting from WHV_REGISTER_NAME to
2503	* HV_REGISTER_NAME from in the "Virtual Processor Register Names" section in
2504	* the "Hypervisor Top-Level Functional Specification" document. This feels
2505	* like an awful waste of time.
2506	*
2507	* We simply cannot understand why HV_REGISTER_NAME isn't used directly here,
2508	* or at least the same values, making any conversion reduntant. Restricting
2509	* access to certain registers could easily be implement by scanning the
2510	* inputs.
2511	*
2512	* To avoid the heap + conversion overhead, we're currently using the
2513	* HvCallGetVpRegisters and HvCallSetVpRegisters calls directly.
2514	*
2515	*
2516	* - The YMM and XCR0 registers are not yet named (17083). This probably
2517	* wouldn't be a problem if HV_REGISTER_NAME was used, see previous point.
2518	*
2519	*
2520	* - Why does VID.SYS only query/set 32 registers at the time thru the
2521	* HvCallGetVpRegisters and HvCallSetVpRegisters hypercalls?
2522	*
2523	* We've not trouble getting/setting all the registers defined by
2524	* WHV_REGISTER_NAME in one hypercall (around 80). Some kind of stack
2525	* buffering or similar?
2526	*
2527	*
2528	* - Wrong instruction length in the VpContext with unmapped GPA memory exit
2529	* contexts on 17115/AMD.
2530	*
2531	* One byte "PUSH CS" was reported as 2 bytes, while a two byte
2532	* "MOV [EBX],EAX" was reported with a 1 byte instruction length. Problem
2533	* naturally present in untranslated hyper-v messages.
2534	*
2535	*
2536	* - The I/O port exit context information seems to be missing the address size
2537	* information needed for correct string I/O emulation.
2538	*
2539	* VT-x provides this information in bits 7:9 in the instruction information
2540	* field on newer CPUs. AMD-V in bits 7:9 in the EXITINFO1 field in the VMCB.
2541	*
2542	* We can probably work around this by scanning the instruction bytes for
2543	* address size prefixes. Haven't investigated it any further yet.
2544	*
2545	*
2546	* - The WHvGetCapability function has a weird design:
2547	* - The CapabilityCode parameter is pointlessly duplicated in the output
2548	* structure (WHV_CAPABILITY).
2549	*
2550	* - API takes void pointer, but everyone will probably be using
2551	* WHV_CAPABILITY due to WHV_CAPABILITY::CapabilityCode making it
2552	* impractical to use anything else.
2553	*
2554	* - No output size.
2555	*
2556	* - See GetFileAttributesEx, GetFileInformationByHandleEx,
2557	* FindFirstFileEx, and others for typical pattern for generic
2558	* information getters.
2559	*
2560	* Update: All concerns have been addressed in build 17110.
2561	*
2562	*
2563	* - The WHvGetPartitionProperty function uses the same weird design as
2564	* WHvGetCapability, see above.
2565	*
2566	* Update: All concerns have been addressed in build 17110.
2567	*
2568	*
2569	* - The WHvSetPartitionProperty function has a totally weird design too:
2570	* - In contrast to its partner WHvGetPartitionProperty, the property code
2571	* is not a separate input parameter here but part of the input
2572	* structure.
2573	*
2574	* - The input structure is a void pointer rather than a pointer to
2575	* WHV_PARTITION_PROPERTY which everyone probably will be using because
2576	* of the WHV_PARTITION_PROPERTY::PropertyCode field.
2577	*
2578	* - Really, why use PVOID for the input when the function isn't accepting
2579	* minimal sizes. E.g. WHVPartitionPropertyCodeProcessorClFlushSize only
2580	* requires a 9 byte input, but the function insists on 16 bytes (17083).
2581	*
2582	* - See GetFileAttributesEx, SetFileInformationByHandle, FindFirstFileEx,
2583	* and others for typical pattern for generic information setters and
2584	* getters.
2585	*
2586	* Update: All concerns have been addressed in build 17110.
2587	*
2588	*
2589	*
2590	* @section sec_nem_win_impl Our implementation.
2591	*
2592	* We set out with the goal of wanting to run as much as possible in ring-0,
2593	* reasoning that this would give use the best performance.
2594	*
2595	* This goal was approached gradually, starting out with a pure WinHvPlatform
2596	* implementation, gradually replacing parts: register access, guest memory
2597	* handling, running virtual processors. Then finally moving it all into
2598	* ring-0, while keeping most of it configurable so that we could make
2599	* comparisons (see NEMInternal.h and nemR3NativeRunGC()).
2600	*
2601	*
2602	* @subsection subsect_nem_win_impl_ioctl VID.SYS I/O control calls
2603	*
2604	* To run things in ring-0 we need to talk directly to VID.SYS thru its I/O
2605	* control interface. Looking at changes between like build 17083 and 17101 (if
2606	* memory serves) a set of the VID I/O control numbers shifted a little, which
2607	* means we need to determin them dynamically. We currently do this by hooking
2608	* the NtDeviceIoControlFile API call from VID.DLL and snooping up the
2609	* parameters when making dummy calls to relevant APIs. (We could also
2610	* disassemble the relevant APIs and try fish out the information from that, but
2611	* this is way simpler.)
2612	*
2613	* Issuing I/O control calls from ring-0 is facing a small challenge with
2614	* respect to direct buffering. When using direct buffering the device will
2615	* typically check that the buffer is actually in the user address space range
2616	* and reject kernel addresses. Fortunately, we've got the cross context VM
2617	* structure that is mapped into both kernel and user space, it's also locked
2618	* and safe to access from kernel space. So, we place the I/O control buffers
2619	* in the per-CPU part of it (NEMCPU::uIoCtlBuf) and give the driver the user
2620	* address if direct access buffering or kernel address if not.
2621	*
2622	* The I/O control calls are 'abstracted' in the support driver, see
2623	* SUPR0IoCtlSetupForHandle(), SUPR0IoCtlPerform() and SUPR0IoCtlCleanup().
2624	*
2625	*
2626	* @subsection subsect_nem_win_impl_cpumctx CPUMCTX
2627	*
2628	* Since the CPU state needs to live in Hyper-V when executing, we probably
2629	* should not transfer more than necessary when handling VMEXITs. To help us
2630	* manage this CPUMCTX got a new field CPUMCTX::fExtrn that to indicate which
2631	* part of the state is currently externalized (== in Hyper-V).
2632	*
2633	*
2634	*/
2635

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp@ 72208

Download in other formats: