NEMR3Native-win.cpp@ 72451

Last change on this file since 72451 was 72446, checked in by vboxsync, 7 years ago
NEM/win: Working on intercepting VMMCALL and VMCALL. bugref:9044
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 125.0 KB

Line
1	/* $Id: NEMR3Native-win.cpp 72446 2018-06-05 08:53:01Z vboxsync $ */
2	/** @file
3	* NEM - Native execution manager, native ring-3 Windows backend.
4	*
5	* Log group 2: Exit logging.
6	* Log group 3: Log context on exit.
7	* Log group 5: Ring-3 memory management
8	* Log group 6: Ring-0 memory management
9	* Log group 12: API intercepts.
10	*/
11
12	/*
13	* Copyright (C) 2018 Oracle Corporation
14	*
15	* This file is part of VirtualBox Open Source Edition (OSE), as
16	* available from http://www.virtualbox.org. This file is free software;
17	* you can redistribute it and/or modify it under the terms of the GNU
18	* General Public License (GPL) as published by the Free Software
19	* Foundation, in version 2 as it comes in the "COPYING" file of the
20	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
21	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
22	*/
23
24
25	/*********************************************************************************************************************************
26	* Header Files *
27	*********************************************************************************************************************************/
28	#define LOG_GROUP LOG_GROUP_NEM
29	#include <iprt/nt/nt-and-windows.h>
30	#include <iprt/nt/hyperv.h>
31	#include <iprt/nt/vid.h>
32	#include <WinHvPlatform.h>
33
34	#ifndef _WIN32_WINNT_WIN10
35	# error "Missing _WIN32_WINNT_WIN10"
36	#endif
37	#ifndef _WIN32_WINNT_WIN10_RS1 /* Missing define, causing trouble for us. */
38	# define _WIN32_WINNT_WIN10_RS1 (_WIN32_WINNT_WIN10 + 1)
39	#endif
40	#include <sysinfoapi.h>
41	#include <debugapi.h>
42	#include <errhandlingapi.h>
43	#include <fileapi.h>
44	#include <winerror.h> /* no api header for this. */
45
46	#include <VBox/vmm/nem.h>
47	#include <VBox/vmm/iem.h>
48	#include <VBox/vmm/em.h>
49	#include <VBox/vmm/apic.h>
50	#include <VBox/vmm/pdm.h>
51	#include "NEMInternal.h"
52	#include <VBox/vmm/vm.h>
53
54	#include <iprt/ldr.h>
55	#include <iprt/path.h>
56	#include <iprt/string.h>
57	#include <iprt/system.h>
58
59
60	/*********************************************************************************************************************************
61	* Defined Constants And Macros *
62	*********************************************************************************************************************************/
63	#ifdef LOG_ENABLED
64	# define NEM_WIN_INTERCEPT_NT_IO_CTLS
65	#endif
66
67	/** VID I/O control detection: Fake partition handle input. */
68	#define NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE ((HANDLE)(uintptr_t)38479125)
69	/** VID I/O control detection: Fake partition ID return. */
70	#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID UINT64_C(0xfa1e000042424242)
71	/** VID I/O control detection: Fake CPU index input. */
72	#define NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX UINT32_C(42)
73	/** VID I/O control detection: Fake timeout input. */
74	#define NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT UINT32_C(0x00080286)
75
76
77	/*********************************************************************************************************************************
78	* Global Variables *
79	*********************************************************************************************************************************/
80	/** @name APIs imported from WinHvPlatform.dll
81	* @{ */
82	static decltype(WHvGetCapability) * g_pfnWHvGetCapability;
83	static decltype(WHvCreatePartition) * g_pfnWHvCreatePartition;
84	static decltype(WHvSetupPartition) * g_pfnWHvSetupPartition;
85	static decltype(WHvDeletePartition) * g_pfnWHvDeletePartition;
86	static decltype(WHvGetPartitionProperty) * g_pfnWHvGetPartitionProperty;
87	static decltype(WHvSetPartitionProperty) * g_pfnWHvSetPartitionProperty;
88	static decltype(WHvMapGpaRange) * g_pfnWHvMapGpaRange;
89	static decltype(WHvUnmapGpaRange) * g_pfnWHvUnmapGpaRange;
90	static decltype(WHvTranslateGva) * g_pfnWHvTranslateGva;
91	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
92	static decltype(WHvCreateVirtualProcessor) * g_pfnWHvCreateVirtualProcessor;
93	static decltype(WHvDeleteVirtualProcessor) * g_pfnWHvDeleteVirtualProcessor;
94	static decltype(WHvRunVirtualProcessor) * g_pfnWHvRunVirtualProcessor;
95	static decltype(WHvCancelRunVirtualProcessor) * g_pfnWHvCancelRunVirtualProcessor;
96	static decltype(WHvGetVirtualProcessorRegisters) * g_pfnWHvGetVirtualProcessorRegisters;
97	static decltype(WHvSetVirtualProcessorRegisters) * g_pfnWHvSetVirtualProcessorRegisters;
98	#endif
99	/** @} */
100
101	/** @name APIs imported from Vid.dll
102	* @{ */
103	static decltype(VidGetHvPartitionId) *g_pfnVidGetHvPartitionId;
104	static decltype(VidStartVirtualProcessor) *g_pfnVidStartVirtualProcessor;
105	static decltype(VidStopVirtualProcessor) *g_pfnVidStopVirtualProcessor;
106	static decltype(VidMessageSlotMap) *g_pfnVidMessageSlotMap;
107	static decltype(VidMessageSlotHandleAndGetNext) *g_pfnVidMessageSlotHandleAndGetNext;
108	#ifdef LOG_ENABLED
109	static decltype(VidGetVirtualProcessorState) *g_pfnVidGetVirtualProcessorState;
110	static decltype(VidSetVirtualProcessorState) *g_pfnVidSetVirtualProcessorState;
111	static decltype(VidGetVirtualProcessorRunningStatus) *g_pfnVidGetVirtualProcessorRunningStatus;
112	#endif
113	/** @} */
114
115	/** The Windows build number. */
116	static uint32_t g_uBuildNo = 17134;
117
118
119
120	/**
121	* Import instructions.
122	*/
123	static const struct
124	{
125	uint8_t idxDll; /*< 0 for WinHvPlatform.dll, 1 for vid.dll. /
126	bool fOptional; /*< Set if import is optional. /
127	PFNRT ppfn; /< The function pointer variable. /
128	const char pszName; /< The function name. /
129	} g_aImports[] =
130	{
131	#define NEM_WIN_IMPORT(a_idxDll, a_fOptional, a_Name) { (a_idxDll), (a_fOptional), (PFNRT *)&RT_CONCAT(g_pfn,a_Name), #a_Name }
132	NEM_WIN_IMPORT(0, false, WHvGetCapability),
133	NEM_WIN_IMPORT(0, false, WHvCreatePartition),
134	NEM_WIN_IMPORT(0, false, WHvSetupPartition),
135	NEM_WIN_IMPORT(0, false, WHvDeletePartition),
136	NEM_WIN_IMPORT(0, false, WHvGetPartitionProperty),
137	NEM_WIN_IMPORT(0, false, WHvSetPartitionProperty),
138	NEM_WIN_IMPORT(0, false, WHvMapGpaRange),
139	NEM_WIN_IMPORT(0, false, WHvUnmapGpaRange),
140	NEM_WIN_IMPORT(0, false, WHvTranslateGva),
141	#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
142	NEM_WIN_IMPORT(0, false, WHvCreateVirtualProcessor),
143	NEM_WIN_IMPORT(0, false, WHvDeleteVirtualProcessor),
144	NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
145	NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
146	NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
147	NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
148	#endif
149	NEM_WIN_IMPORT(1, false, VidGetHvPartitionId),
150	NEM_WIN_IMPORT(1, false, VidMessageSlotMap),
151	NEM_WIN_IMPORT(1, false, VidMessageSlotHandleAndGetNext),
152	NEM_WIN_IMPORT(1, false, VidStartVirtualProcessor),
153	NEM_WIN_IMPORT(1, false, VidStopVirtualProcessor),
154	#ifdef LOG_ENABLED
155	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorState),
156	NEM_WIN_IMPORT(1, false, VidSetVirtualProcessorState),
157	NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorRunningStatus),
158	#endif
159	#undef NEM_WIN_IMPORT
160	};
161
162
163	/** The real NtDeviceIoControlFile API in NTDLL. */
164	static decltype(NtDeviceIoControlFile) *g_pfnNtDeviceIoControlFile;
165	/** Pointer to the NtDeviceIoControlFile import table entry. */
166	static decltype(NtDeviceIoControlFile) **g_ppfnVidNtDeviceIoControlFile;
167	/** Info about the VidGetHvPartitionId I/O control interface. */
168	static NEMWINIOCTL g_IoCtlGetHvPartitionId;
169	/** Info about the VidStartVirtualProcessor I/O control interface. */
170	static NEMWINIOCTL g_IoCtlStartVirtualProcessor;
171	/** Info about the VidStopVirtualProcessor I/O control interface. */
172	static NEMWINIOCTL g_IoCtlStopVirtualProcessor;
173	/** Info about the VidMessageSlotHandleAndGetNext I/O control interface. */
174	static NEMWINIOCTL g_IoCtlMessageSlotHandleAndGetNext;
175	#ifdef LOG_ENABLED
176	/** Info about the VidMessageSlotMap I/O control interface - for logging. */
177	static NEMWINIOCTL g_IoCtlMessageSlotMap;
178	/* Info about the VidGetVirtualProcessorState I/O control interface - for logging. */
179	static NEMWINIOCTL g_IoCtlGetVirtualProcessorState;
180	/* Info about the VidSetVirtualProcessorState I/O control interface - for logging. */
181	static NEMWINIOCTL g_IoCtlSetVirtualProcessorState;
182	/** Pointer to what nemR3WinIoctlDetector_ForLogging should fill in. */
183	static NEMWINIOCTL *g_pIoCtlDetectForLogging;
184	#endif
185
186	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
187	/** Mapping slot for CPU #0.
188	* @{ */
189	static VID_MESSAGE_MAPPING_HEADER *g_pMsgSlotMapping = NULL;
190	static const HV_MESSAGE_HEADER *g_pHvMsgHdr;
191	static const HV_X64_INTERCEPT_MESSAGE_HEADER *g_pX64MsgHdr;
192	/** @} */
193	#endif
194
195
196	/*
197	* Let the preprocessor alias the APIs to import variables for better autocompletion.
198	*/
199	#ifndef IN_SLICKEDIT
200	# define WHvGetCapability g_pfnWHvGetCapability
201	# define WHvCreatePartition g_pfnWHvCreatePartition
202	# define WHvSetupPartition g_pfnWHvSetupPartition
203	# define WHvDeletePartition g_pfnWHvDeletePartition
204	# define WHvGetPartitionProperty g_pfnWHvGetPartitionProperty
205	# define WHvSetPartitionProperty g_pfnWHvSetPartitionProperty
206	# define WHvMapGpaRange g_pfnWHvMapGpaRange
207	# define WHvUnmapGpaRange g_pfnWHvUnmapGpaRange
208	# define WHvTranslateGva g_pfnWHvTranslateGva
209	# define WHvCreateVirtualProcessor g_pfnWHvCreateVirtualProcessor
210	# define WHvDeleteVirtualProcessor g_pfnWHvDeleteVirtualProcessor
211	# define WHvRunVirtualProcessor g_pfnWHvRunVirtualProcessor
212	# define WHvGetRunExitContextSize g_pfnWHvGetRunExitContextSize
213	# define WHvCancelRunVirtualProcessor g_pfnWHvCancelRunVirtualProcessor
214	# define WHvGetVirtualProcessorRegisters g_pfnWHvGetVirtualProcessorRegisters
215	# define WHvSetVirtualProcessorRegisters g_pfnWHvSetVirtualProcessorRegisters
216
217	# define VidMessageSlotHandleAndGetNext g_pfnVidMessageSlotHandleAndGetNext
218	# define VidStartVirtualProcessor g_pfnVidStartVirtualProcessor
219	# define VidStopVirtualProcessor g_pfnVidStopVirtualProcessor
220
221	#endif
222
223	/** WHV_MEMORY_ACCESS_TYPE names */
224	static const char * const g_apszWHvMemAccesstypes[4] = { "read", "write", "exec", "!undefined!" };
225
226
227	/*********************************************************************************************************************************
228	* Internal Functions *
229	*********************************************************************************************************************************/
230
231	/*
232	* Instantate the code we share with ring-0.
233	*/
234	#include "../VMMAll/NEMAllNativeTemplate-win.cpp.h"
235
236
237
238	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
239	/**
240	* Wrapper that logs the call from VID.DLL.
241	*
242	* This is very handy for figuring out why an API call fails.
243	*/
244	static NTSTATUS WINAPI
245	nemR3WinLogWrapper_NtDeviceIoControlFile(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
246	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
247	PVOID pvOutput, ULONG cbOutput)
248	{
249
250	char szFunction[32];
251	const char *pszFunction;
252	if (uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction)
253	pszFunction = "VidMessageSlotHandleAndGetNext";
254	else if (uFunction == g_IoCtlStartVirtualProcessor.uFunction)
255	pszFunction = "VidStartVirtualProcessor";
256	else if (uFunction == g_IoCtlStopVirtualProcessor.uFunction)
257	pszFunction = "VidStopVirtualProcessor";
258	else if (uFunction == g_IoCtlMessageSlotMap.uFunction)
259	pszFunction = "VidMessageSlotMap";
260	else if (uFunction == g_IoCtlGetVirtualProcessorState.uFunction)
261	pszFunction = "VidGetVirtualProcessorState";
262	else if (uFunction == g_IoCtlSetVirtualProcessorState.uFunction)
263	pszFunction = "VidSetVirtualProcessorState";
264	else
265	{
266	RTStrPrintf(szFunction, sizeof(szFunction), "%#x", uFunction);
267	pszFunction = szFunction;
268	}
269
270	if (cbInput > 0 && pvInput)
271	Log12(("VID!NtDeviceIoControlFile: %s/input: %.*Rhxs\n", pszFunction, RT_MIN(cbInput, 32), pvInput));
272	NTSTATUS rcNt = g_pfnNtDeviceIoControlFile(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, uFunction,
273	pvInput, cbInput, pvOutput, cbOutput);
274	if (!hEvt && !pfnApcCallback && !pvApcCtx)
275	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
276	hFile, pIos, pIos->Status, pIos->Information, pszFunction, pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
277	else
278	Log12(("VID!NtDeviceIoControlFile: hFile=%#zx hEvt=%#zx Apc=%p/%p pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
279	hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pIos->Status, pIos->Information, pszFunction,
280	pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
281	if (cbOutput > 0 && pvOutput)
282	{
283	Log12(("VID!NtDeviceIoControlFile: %s/output: %.*Rhxs\n", pszFunction, RT_MIN(cbOutput, 32), pvOutput));
284	if (uFunction == 0x2210cc && g_pMsgSlotMapping == NULL && cbOutput >= sizeof(void *))
285	{
286	g_pMsgSlotMapping = (VID_MESSAGE_MAPPING_HEADER *)pvOutput;
287	g_pHvMsgHdr = (const HV_MESSAGE_HEADER *)(g_pMsgSlotMapping + 1);
288	g_pX64MsgHdr = (const HV_X64_INTERCEPT_MESSAGE_HEADER *)(g_pHvMsgHdr + 1);
289	Log12(("VID!NtDeviceIoControlFile: Message slot mapping: %p\n", g_pMsgSlotMapping));
290	}
291	}
292	if ( g_pMsgSlotMapping
293	&& ( uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction
294	\|\| uFunction == g_IoCtlStopVirtualProcessor.uFunction
295	\|\| uFunction == g_IoCtlMessageSlotMap.uFunction
296	))
297	Log12(("VID!NtDeviceIoControlFile: enmVidMsgType=%#x cb=%#x msg=%#x payload=%u cs:rip=%04x:%08RX64 (%s)\n",
298	g_pMsgSlotMapping->enmVidMsgType, g_pMsgSlotMapping->cbMessage,
299	g_pHvMsgHdr->MessageType, g_pHvMsgHdr->PayloadSize,
300	g_pX64MsgHdr->CsSegment.Selector, g_pX64MsgHdr->Rip, pszFunction));
301
302	return rcNt;
303	}
304	#endif /* NEM_WIN_INTERCEPT_NT_IO_CTLS */
305
306
307	/**
308	* Patches the call table of VID.DLL so we can intercept NtDeviceIoControlFile.
309	*
310	* This is for used to figure out the I/O control codes and in logging builds
311	* for logging API calls that WinHvPlatform.dll does.
312	*
313	* @returns VBox status code.
314	* @param hLdrModVid The VID module handle.
315	* @param pErrInfo Where to return additional error information.
316	*/
317	static int nemR3WinInitVidIntercepts(RTLDRMOD hLdrModVid, PRTERRINFO pErrInfo)
318	{
319	/*
320	* Locate the real API.
321	*/
322	g_pfnNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) *)RTLdrGetSystemSymbol("NTDLL.DLL", "NtDeviceIoControlFile");
323	AssertReturn(g_pfnNtDeviceIoControlFile != NULL,
324	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to resolve NtDeviceIoControlFile from NTDLL.DLL"));
325
326	/*
327	* Locate the PE header and get what we need from it.
328	*/
329	uint8_t const pbImage = (uint8_t const )RTLdrGetNativeHandle(hLdrModVid);
330	IMAGE_DOS_HEADER const pMzHdr = (IMAGE_DOS_HEADER const )pbImage;
331	AssertReturn(pMzHdr->e_magic == IMAGE_DOS_SIGNATURE,
332	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL mapping doesn't start with MZ signature: %#x", pMzHdr->e_magic));
333	IMAGE_NT_HEADERS const pNtHdrs = (IMAGE_NT_HEADERS const )&pbImage[pMzHdr->e_lfanew];
334	AssertReturn(pNtHdrs->Signature == IMAGE_NT_SIGNATURE,
335	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL has invalid PE signaturre: %#x @%#x",
336	pNtHdrs->Signature, pMzHdr->e_lfanew));
337
338	uint32_t const cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
339	IMAGE_DATA_DIRECTORY const ImportDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
340
341	/*
342	* Walk the import descriptor table looking for NTDLL.DLL.
343	*/
344	AssertReturn( ImportDir.Size > 0
345	&& ImportDir.Size < cbImage,
346	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory size: %#x", ImportDir.Size));
347	AssertReturn( ImportDir.VirtualAddress > 0
348	&& ImportDir.VirtualAddress <= cbImage - ImportDir.Size,
349	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory RVA: %#x", ImportDir.VirtualAddress));
350
351	for (PIMAGE_IMPORT_DESCRIPTOR pImps = (PIMAGE_IMPORT_DESCRIPTOR)&pbImage[ImportDir.VirtualAddress];
352	pImps->Name != 0 && pImps->FirstThunk != 0;
353	pImps++)
354	{
355	AssertReturn(pImps->Name < cbImage,
356	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory entry name: %#x", pImps->Name));
357	const char pszModName = (const char )&pbImage[pImps->Name];
358	if (RTStrICmpAscii(pszModName, "ntdll.dll"))
359	continue;
360	AssertReturn(pImps->FirstThunk < cbImage,
361	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
362	AssertReturn(pImps->OriginalFirstThunk < cbImage,
363	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
364
365	/*
366	* Walk the thunks table(s) looking for NtDeviceIoControlFile.
367	*/
368	PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]; /* update this. */
369	PIMAGE_THUNK_DATA pThunk = pImps->OriginalFirstThunk == 0 /* read from this. */
370	? (PIMAGE_THUNK_DATA)&pbImage[pImps->FirstThunk]
371	: (PIMAGE_THUNK_DATA)&pbImage[pImps->OriginalFirstThunk];
372	while (pThunk->u1.Ordinal != 0)
373	{
374	if (!(pThunk->u1.Ordinal & IMAGE_ORDINAL_FLAG32))
375	{
376	AssertReturn(pThunk->u1.Ordinal > 0 && pThunk->u1.Ordinal < cbImage,
377	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
378
379	const char pszSymbol = (const char )&pbImage[(uintptr_t)pThunk->u1.AddressOfData + 2];
380	if (strcmp(pszSymbol, "NtDeviceIoControlFile") == 0)
381	{
382	DWORD fOldProt = PAGE_READONLY;
383	VirtualProtect(&pFirstThunk->u1.Function, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &fOldProt);
384	g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)&pFirstThunk->u1.Function;
385	/* Don't restore the protection here, so we modify the NtDeviceIoControlFile pointer later. */
386	}
387	}
388
389	pThunk++;
390	pFirstThunk++;
391	}
392	}
393
394	if (*g_ppfnVidNtDeviceIoControlFile)
395	{
396	#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
397	*g_ppfnVidNtDeviceIoControlFile = nemR3WinLogWrapper_NtDeviceIoControlFile;
398	#endif
399	return VINF_SUCCESS;
400	}
401	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to patch NtDeviceIoControlFile import in VID.DLL!");
402	}
403
404
405	/**
406	* Worker for nemR3NativeInit that probes and load the native API.
407	*
408	* @returns VBox status code.
409	* @param fForced Whether the HMForced flag is set and we should
410	* fail if we cannot initialize.
411	* @param pErrInfo Where to always return error info.
412	*/
413	static int nemR3WinInitProbeAndLoad(bool fForced, PRTERRINFO pErrInfo)
414	{
415	/*
416	* Check that the DLL files we need are present, but without loading them.
417	* We'd like to avoid loading them unnecessarily.
418	*/
419	WCHAR wszPath[MAX_PATH + 64];
420	UINT cwcPath = GetSystemDirectoryW(wszPath, MAX_PATH);
421	if (cwcPath >= MAX_PATH \|\| cwcPath < 2)
422	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "GetSystemDirectoryW failed (%#x / %u)", cwcPath, GetLastError());
423
424	if (wszPath[cwcPath - 1] != '\\' \|\| wszPath[cwcPath - 1] != '/')
425	wszPath[cwcPath++] = '\\';
426	RTUtf16CopyAscii(&wszPath[cwcPath], RT_ELEMENTS(wszPath) - cwcPath, "WinHvPlatform.dll");
427	if (GetFileAttributesW(wszPath) == INVALID_FILE_ATTRIBUTES)
428	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "The native API dll was not found (%ls)", wszPath);
429
430	/*
431	* Check that we're in a VM and that the hypervisor identifies itself as Hyper-V.
432	*/
433	if (!ASMHasCpuId())
434	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID support");
435	if (!ASMIsValidStdRange(ASMCpuId_EAX(0)))
436	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID leaf #1");
437	if (!(ASMCpuId_ECX(1) & X86_CPUID_FEATURE_ECX_HVP))
438	return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Not in a hypervisor partition (HVP=0)");
439
440	uint32_t cMaxHyperLeaf = 0;
441	uint32_t uEbx = 0;
442	uint32_t uEcx = 0;
443	uint32_t uEdx = 0;
444	ASMCpuIdExSlow(0x40000000, 0, 0, 0, &cMaxHyperLeaf, &uEbx, &uEcx, &uEdx);
445	if (!ASMIsValidHypervisorRange(cMaxHyperLeaf))
446	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Invalid hypervisor CPUID range (%#x %#x %#x %#x)",
447	cMaxHyperLeaf, uEbx, uEcx, uEdx);
448	if ( uEbx != UINT32_C(0x7263694d) /* Micr */
449	\|\| uEcx != UINT32_C(0x666f736f) /* osof */
450	\|\| uEdx != UINT32_C(0x76482074) /* t Hv */)
451	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
452	"Not Hyper-V CPUID signature: %#x %#x %#x (expected %#x %#x %#x)",
453	uEbx, uEcx, uEdx, UINT32_C(0x7263694d), UINT32_C(0x666f736f), UINT32_C(0x76482074));
454	if (cMaxHyperLeaf < UINT32_C(0x40000005))
455	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Too narrow hypervisor CPUID range (%#x)", cMaxHyperLeaf);
456
457	/** @todo would be great if we could recognize a root partition from the
458	* CPUID info, but I currently don't dare do that. */
459
460	/*
461	* Now try load the DLLs and resolve the APIs.
462	*/
463	static const char * const s_apszDllNames[2] = { "WinHvPlatform.dll", "vid.dll" };
464	RTLDRMOD ahMods[2] = { NIL_RTLDRMOD, NIL_RTLDRMOD };
465	int rc = VINF_SUCCESS;
466	for (unsigned i = 0; i < RT_ELEMENTS(s_apszDllNames); i++)
467	{
468	int rc2 = RTLdrLoadSystem(s_apszDllNames[i], true /fNoUnload/, &ahMods[i]);
469	if (RT_FAILURE(rc2))
470	{
471	if (!RTErrInfoIsSet(pErrInfo))
472	RTErrInfoSetF(pErrInfo, rc2, "Failed to load API DLL: %s: %Rrc", s_apszDllNames[i], rc2);
473	else
474	RTErrInfoAddF(pErrInfo, rc2, "; %s: %Rrc", s_apszDllNames[i], rc2);
475	ahMods[i] = NIL_RTLDRMOD;
476	rc = VERR_NEM_INIT_FAILED;
477	}
478	}
479	if (RT_SUCCESS(rc))
480	rc = nemR3WinInitVidIntercepts(ahMods[1], pErrInfo);
481	if (RT_SUCCESS(rc))
482	{
483	for (unsigned i = 0; i < RT_ELEMENTS(g_aImports); i++)
484	{
485	int rc2 = RTLdrGetSymbol(ahMods[g_aImports[i].idxDll], g_aImports[i].pszName, (void **)g_aImports[i].ppfn);
486	if (RT_FAILURE(rc2))
487	{
488	*g_aImports[i].ppfn = NULL;
489
490	LogRel(("NEM: %s: Failed to import %s!%s: %Rrc",
491	g_aImports[i].fOptional ? "info" : fForced ? "fatal" : "error",
492	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName, rc2));
493	if (!g_aImports[i].fOptional)
494	{
495	if (RTErrInfoIsSet(pErrInfo))
496	RTErrInfoAddF(pErrInfo, rc2, ", %s!%s",
497	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
498	else
499	rc = RTErrInfoSetF(pErrInfo, rc2, "Failed to import: %s!%s",
500	s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
501	Assert(RT_FAILURE(rc));
502	}
503	}
504	}
505	if (RT_SUCCESS(rc))
506	{
507	Assert(!RTErrInfoIsSet(pErrInfo));
508	}
509	}
510
511	for (unsigned i = 0; i < RT_ELEMENTS(ahMods); i++)
512	RTLdrClose(ahMods[i]);
513	return rc;
514	}
515
516
517	/**
518	* Wrapper for different WHvGetCapability signatures.
519	*/
520	DECLINLINE(HRESULT) WHvGetCapabilityWrapper(WHV_CAPABILITY_CODE enmCap, WHV_CAPABILITY *pOutput, uint32_t cbOutput)
521	{
522	return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput, NULL);
523	}
524
525
526	/**
527	* Worker for nemR3NativeInit that gets the hypervisor capabilities.
528	*
529	* @returns VBox status code.
530	* @param pVM The cross context VM structure.
531	* @param pErrInfo Where to always return error info.
532	*/
533	static int nemR3WinInitCheckCapabilities(PVM pVM, PRTERRINFO pErrInfo)
534	{
535	#define NEM_LOG_REL_CAP_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %-38s= " a_szFmt "\n", a_szField, a_Value))
536	#define NEM_LOG_REL_CAP_SUB_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %36s: " a_szFmt "\n", a_szField, a_Value))
537	#define NEM_LOG_REL_CAP_SUB(a_szField, a_Value) NEM_LOG_REL_CAP_SUB_EX(a_szField, "%d", a_Value)
538
539	/*
540	* Is the hypervisor present with the desired capability?
541	*
542	* In build 17083 this translates into:
543	* - CPUID[0x00000001].HVP is set
544	* - CPUID[0x40000000] == "Microsoft Hv"
545	* - CPUID[0x40000001].eax == "Hv#1"
546	* - CPUID[0x40000003].ebx[12] is set.
547	* - VidGetExoPartitionProperty(INVALID_HANDLE_VALUE, 0x60000, &Ignored) returns
548	* a non-zero value.
549	*/
550	/**
551	* @todo Someone at Microsoft please explain weird API design:
552	* 1. Pointless CapabilityCode duplication int the output;
553	* 2. No output size.
554	*/
555	WHV_CAPABILITY Caps;
556	RT_ZERO(Caps);
557	SetLastError(0);
558	HRESULT hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeHypervisorPresent, &Caps, sizeof(Caps));
559	DWORD rcWin = GetLastError();
560	if (FAILED(hrc))
561	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
562	"WHvGetCapability/WHvCapabilityCodeHypervisorPresent failed: %Rhrc (Last=%#x/%u)",
563	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
564	if (!Caps.HypervisorPresent)
565	{
566	if (!RTPathExists(RTPATH_NT_PASSTHRU_PREFIX "Device\\VidExo"))
567	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
568	"WHvCapabilityCodeHypervisorPresent is FALSE! Make sure you have enabled the 'Windows Hypervisor Platform' feature.");
569	return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "WHvCapabilityCodeHypervisorPresent is FALSE! (%u)", rcWin);
570	}
571	LogRel(("NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...\n"));
572
573
574	/*
575	* Check what extended VM exits are supported.
576	*/
577	RT_ZERO(Caps);
578	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExtendedVmExits, &Caps, sizeof(Caps));
579	if (FAILED(hrc))
580	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
581	"WHvGetCapability/WHvCapabilityCodeExtendedVmExits failed: %Rhrc (Last=%#x/%u)",
582	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
583	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeExtendedVmExits", "%'#018RX64", Caps.ExtendedVmExits.AsUINT64);
584	pVM->nem.s.fExtendedMsrExit = RT_BOOL(Caps.ExtendedVmExits.X64MsrExit);
585	pVM->nem.s.fExtendedCpuIdExit = RT_BOOL(Caps.ExtendedVmExits.X64CpuidExit);
586	pVM->nem.s.fExtendedXcptExit = RT_BOOL(Caps.ExtendedVmExits.ExceptionExit);
587	NEM_LOG_REL_CAP_SUB("fExtendedMsrExit", pVM->nem.s.fExtendedMsrExit);
588	NEM_LOG_REL_CAP_SUB("fExtendedCpuIdExit", pVM->nem.s.fExtendedCpuIdExit);
589	NEM_LOG_REL_CAP_SUB("fExtendedXcptExit", pVM->nem.s.fExtendedXcptExit);
590	if (Caps.ExtendedVmExits.AsUINT64 & ~(uint64_t)7)
591	LogRel(("NEM: Warning! Unknown VM exit definitions: %#RX64\n", Caps.ExtendedVmExits.AsUINT64));
592	/** @todo RECHECK: WHV_EXTENDED_VM_EXITS typedef. */
593
594	/*
595	* Check features in case they end up defining any.
596	*/
597	RT_ZERO(Caps);
598	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeFeatures, &Caps, sizeof(Caps));
599	if (FAILED(hrc))
600	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
601	"WHvGetCapability/WHvCapabilityCodeFeatures failed: %Rhrc (Last=%#x/%u)",
602	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
603	if (Caps.Features.AsUINT64 & ~(uint64_t)0)
604	LogRel(("NEM: Warning! Unknown feature definitions: %#RX64\n", Caps.Features.AsUINT64));
605	/** @todo RECHECK: WHV_CAPABILITY_FEATURES typedef. */
606
607	/*
608	* Check supported exception exit bitmap bits.
609	* We don't currently require this, so we just log failure.
610	*/
611	RT_ZERO(Caps);
612	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExceptionExitBitmap, &Caps, sizeof(Caps));
613	if (SUCCEEDED(hrc))
614	LogRel(("NEM: Supported exception exit bitmap: %#RX64\n", Caps.ExceptionExitBitmap));
615	else
616	LogRel(("NEM: Warning! WHvGetCapability/WHvCapabilityCodeExceptionExitBitmap failed: %Rhrc (Last=%#x/%u)",
617	hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
618
619	/*
620	* Check that the CPU vendor is supported.
621	*/
622	RT_ZERO(Caps);
623	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorVendor, &Caps, sizeof(Caps));
624	if (FAILED(hrc))
625	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
626	"WHvGetCapability/WHvCapabilityCodeProcessorVendor failed: %Rhrc (Last=%#x/%u)",
627	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
628	switch (Caps.ProcessorVendor)
629	{
630	/** @todo RECHECK: WHV_PROCESSOR_VENDOR typedef. */
631	case WHvProcessorVendorIntel:
632	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - Intel", Caps.ProcessorVendor);
633	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_INTEL;
634	break;
635	case WHvProcessorVendorAmd:
636	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - AMD", Caps.ProcessorVendor);
637	pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_AMD;
638	break;
639	default:
640	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d", Caps.ProcessorVendor);
641	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unknown processor vendor: %d", Caps.ProcessorVendor);
642	}
643
644	/*
645	* CPU features, guessing these are virtual CPU features?
646	*/
647	RT_ZERO(Caps);
648	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorFeatures, &Caps, sizeof(Caps));
649	if (FAILED(hrc))
650	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
651	"WHvGetCapability/WHvCapabilityCodeProcessorFeatures failed: %Rhrc (Last=%#x/%u)",
652	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
653	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorFeatures", "%'#018RX64", Caps.ProcessorFeatures.AsUINT64);
654	#define NEM_LOG_REL_CPU_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ProcessorFeatures.a_Field)
655	NEM_LOG_REL_CPU_FEATURE(Sse3Support);
656	NEM_LOG_REL_CPU_FEATURE(LahfSahfSupport);
657	NEM_LOG_REL_CPU_FEATURE(Ssse3Support);
658	NEM_LOG_REL_CPU_FEATURE(Sse4_1Support);
659	NEM_LOG_REL_CPU_FEATURE(Sse4_2Support);
660	NEM_LOG_REL_CPU_FEATURE(Sse4aSupport);
661	NEM_LOG_REL_CPU_FEATURE(XopSupport);
662	NEM_LOG_REL_CPU_FEATURE(PopCntSupport);
663	NEM_LOG_REL_CPU_FEATURE(Cmpxchg16bSupport);
664	NEM_LOG_REL_CPU_FEATURE(Altmovcr8Support);
665	NEM_LOG_REL_CPU_FEATURE(LzcntSupport);
666	NEM_LOG_REL_CPU_FEATURE(MisAlignSseSupport);
667	NEM_LOG_REL_CPU_FEATURE(MmxExtSupport);
668	NEM_LOG_REL_CPU_FEATURE(Amd3DNowSupport);
669	NEM_LOG_REL_CPU_FEATURE(ExtendedAmd3DNowSupport);
670	NEM_LOG_REL_CPU_FEATURE(Page1GbSupport);
671	NEM_LOG_REL_CPU_FEATURE(AesSupport);
672	NEM_LOG_REL_CPU_FEATURE(PclmulqdqSupport);
673	NEM_LOG_REL_CPU_FEATURE(PcidSupport);
674	NEM_LOG_REL_CPU_FEATURE(Fma4Support);
675	NEM_LOG_REL_CPU_FEATURE(F16CSupport);
676	NEM_LOG_REL_CPU_FEATURE(RdRandSupport);
677	NEM_LOG_REL_CPU_FEATURE(RdWrFsGsSupport);
678	NEM_LOG_REL_CPU_FEATURE(SmepSupport);
679	NEM_LOG_REL_CPU_FEATURE(EnhancedFastStringSupport);
680	NEM_LOG_REL_CPU_FEATURE(Bmi1Support);
681	NEM_LOG_REL_CPU_FEATURE(Bmi2Support);
682	/* two reserved bits here, see below */
683	NEM_LOG_REL_CPU_FEATURE(MovbeSupport);
684	NEM_LOG_REL_CPU_FEATURE(Npiep1Support);
685	NEM_LOG_REL_CPU_FEATURE(DepX87FPUSaveSupport);
686	NEM_LOG_REL_CPU_FEATURE(RdSeedSupport);
687	NEM_LOG_REL_CPU_FEATURE(AdxSupport);
688	NEM_LOG_REL_CPU_FEATURE(IntelPrefetchSupport);
689	NEM_LOG_REL_CPU_FEATURE(SmapSupport);
690	NEM_LOG_REL_CPU_FEATURE(HleSupport);
691	NEM_LOG_REL_CPU_FEATURE(RtmSupport);
692	NEM_LOG_REL_CPU_FEATURE(RdtscpSupport);
693	NEM_LOG_REL_CPU_FEATURE(ClflushoptSupport);
694	NEM_LOG_REL_CPU_FEATURE(ClwbSupport);
695	NEM_LOG_REL_CPU_FEATURE(ShaSupport);
696	NEM_LOG_REL_CPU_FEATURE(X87PointersSavedSupport);
697	#undef NEM_LOG_REL_CPU_FEATURE
698	if (Caps.ProcessorFeatures.AsUINT64 & (~(RT_BIT_64(43) - 1) \| RT_BIT_64(27) \| RT_BIT_64(28)))
699	LogRel(("NEM: Warning! Unknown CPU features: %#RX64\n", Caps.ProcessorFeatures.AsUINT64));
700	pVM->nem.s.uCpuFeatures.u64 = Caps.ProcessorFeatures.AsUINT64;
701	/** @todo RECHECK: WHV_PROCESSOR_FEATURES typedef. */
702
703	/*
704	* The cache line flush size.
705	*/
706	RT_ZERO(Caps);
707	hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorClFlushSize, &Caps, sizeof(Caps));
708	if (FAILED(hrc))
709	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
710	"WHvGetCapability/WHvCapabilityCodeProcessorClFlushSize failed: %Rhrc (Last=%#x/%u)",
711	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
712	NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorClFlushSize", "2^%u", Caps.ProcessorClFlushSize);
713	if (Caps.ProcessorClFlushSize < 8 && Caps.ProcessorClFlushSize > 9)
714	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unsupported cache line flush size: %u", Caps.ProcessorClFlushSize);
715	pVM->nem.s.cCacheLineFlushShift = Caps.ProcessorClFlushSize;
716
717	/*
718	* See if they've added more properties that we're not aware of.
719	*/
720	/** @todo RECHECK: WHV_CAPABILITY_CODE typedef. */
721	if (!IsDebuggerPresent()) /* Too noisy when in debugger, so skip. */
722	{
723	static const struct
724	{
725	uint32_t iMin, iMax; } s_aUnknowns[] =
726	{
727	{ 0x0004, 0x000f },
728	{ 0x1003, 0x100f },
729	{ 0x2000, 0x200f },
730	{ 0x3000, 0x300f },
731	{ 0x4000, 0x400f },
732	};
733	for (uint32_t j = 0; j < RT_ELEMENTS(s_aUnknowns); j++)
734	for (uint32_t i = s_aUnknowns[j].iMin; i <= s_aUnknowns[j].iMax; i++)
735	{
736	RT_ZERO(Caps);
737	hrc = WHvGetCapabilityWrapper((WHV_CAPABILITY_CODE)i, &Caps, sizeof(Caps));
738	if (SUCCEEDED(hrc))
739	LogRel(("NEM: Warning! Unknown capability %#x returning: %.*Rhxs\n", i, sizeof(Caps), &Caps));
740	}
741	}
742
743	/*
744	* For proper operation, we require CPUID exits.
745	*/
746	if (!pVM->nem.s.fExtendedCpuIdExit)
747	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended CPUID exit support");
748	if (!pVM->nem.s.fExtendedMsrExit)
749	return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended MSR exit support");
750
751	#undef NEM_LOG_REL_CAP_EX
752	#undef NEM_LOG_REL_CAP_SUB_EX
753	#undef NEM_LOG_REL_CAP_SUB
754	return VINF_SUCCESS;
755	}
756
757
758	/**
759	* Used to fill in g_IoCtlGetHvPartitionId.
760	*/
761	static NTSTATUS WINAPI
762	nemR3WinIoctlDetector_GetHvPartitionId(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
763	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
764	PVOID pvOutput, ULONG cbOutput)
765	{
766	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
767	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
768	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
769	AssertLogRelMsgReturn(cbInput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
770	RT_NOREF(pvInput);
771
772	AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
773	AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_ID), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
774	(HV_PARTITION_ID )pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID;
775
776	g_IoCtlGetHvPartitionId.cbInput = cbInput;
777	g_IoCtlGetHvPartitionId.cbOutput = cbOutput;
778	g_IoCtlGetHvPartitionId.uFunction = uFunction;
779
780	return STATUS_SUCCESS;
781	}
782
783
784	/**
785	* Used to fill in g_IoCtlStartVirtualProcessor.
786	*/
787	static NTSTATUS WINAPI
788	nemR3WinIoctlDetector_StartVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
789	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
790	PVOID pvOutput, ULONG cbOutput)
791	{
792	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
793	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
794	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
795	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
796	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
797	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
798	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
799	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
800	RT_NOREF(pvOutput);
801
802	g_IoCtlStartVirtualProcessor.cbInput = cbInput;
803	g_IoCtlStartVirtualProcessor.cbOutput = cbOutput;
804	g_IoCtlStartVirtualProcessor.uFunction = uFunction;
805
806	return STATUS_SUCCESS;
807	}
808
809
810	/**
811	* Used to fill in g_IoCtlStartVirtualProcessor.
812	*/
813	static NTSTATUS WINAPI
814	nemR3WinIoctlDetector_StopVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
815	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
816	PVOID pvOutput, ULONG cbOutput)
817	{
818	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
819	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
820	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
821	AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
822	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
823	AssertLogRelMsgReturn((HV_VP_INDEX )pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
824	("piCpu=%u\n", (HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
825	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
826	RT_NOREF(pvOutput);
827
828	g_IoCtlStopVirtualProcessor.cbInput = cbInput;
829	g_IoCtlStopVirtualProcessor.cbOutput = cbOutput;
830	g_IoCtlStopVirtualProcessor.uFunction = uFunction;
831
832	return STATUS_SUCCESS;
833	}
834
835
836	/**
837	* Used to fill in g_IoCtlMessageSlotHandleAndGetNext
838	*/
839	static NTSTATUS WINAPI
840	nemR3WinIoctlDetector_MessageSlotHandleAndGetNext(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
841	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
842	PVOID pvOutput, ULONG cbOutput)
843	{
844	AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
845	RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
846	AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
847
848	AssertLogRelMsgReturn(cbInput == sizeof(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT), ("cbInput=%#x\n", cbInput),
849	STATUS_INVALID_PARAMETER_8);
850	AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
851	PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
852	AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
853	&& pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE
854	&& pVidIn->cMillies == NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT,
855	("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
856	STATUS_INVALID_PARAMETER_9);
857	AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
858	RT_NOREF(pvOutput);
859
860	g_IoCtlMessageSlotHandleAndGetNext.cbInput = cbInput;
861	g_IoCtlMessageSlotHandleAndGetNext.cbOutput = cbOutput;
862	g_IoCtlMessageSlotHandleAndGetNext.uFunction = uFunction;
863
864	return STATUS_SUCCESS;
865	}
866
867
868	#ifdef LOG_ENABLED
869	/**
870	* Used to fill in what g_pIoCtlDetectForLogging points to.
871	*/
872	static NTSTATUS WINAPI nemR3WinIoctlDetector_ForLogging(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
873	PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
874	PVOID pvOutput, ULONG cbOutput)
875	{
876	RT_NOREF(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pvInput, pvOutput);
877
878	g_pIoCtlDetectForLogging->cbInput = cbInput;
879	g_pIoCtlDetectForLogging->cbOutput = cbOutput;
880	g_pIoCtlDetectForLogging->uFunction = uFunction;
881
882	return STATUS_SUCCESS;
883	}
884	#endif
885
886
887	/**
888	* Worker for nemR3NativeInit that detect I/O control function numbers for VID.
889	*
890	* We use the function numbers directly in ring-0 and to name functions when
891	* logging NtDeviceIoControlFile calls.
892	*
893	* @note We could alternatively do this by disassembling the respective
894	* functions, but hooking NtDeviceIoControlFile and making fake calls
895	* more easily provides the desired information.
896	*
897	* @returns VBox status code.
898	* @param pVM The cross context VM structure. Will set I/O
899	* control info members.
900	* @param pErrInfo Where to always return error info.
901	*/
902	static int nemR3WinInitDiscoverIoControlProperties(PVM pVM, PRTERRINFO pErrInfo)
903	{
904	/*
905	* Probe the I/O control information for select VID APIs so we can use
906	* them directly from ring-0 and better log them.
907	*
908	*/
909	decltype(NtDeviceIoControlFile) * const pfnOrg = *g_ppfnVidNtDeviceIoControlFile;
910
911	/* VidGetHvPartitionId */
912	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetHvPartitionId;
913	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
914	BOOL fRet = g_pfnVidGetHvPartitionId(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &idHvPartition);
915	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
916	AssertReturn(fRet && idHvPartition == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID && g_IoCtlGetHvPartitionId.uFunction != 0,
917	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
918	"Problem figuring out VidGetHvPartitionId: fRet=%u idHvPartition=%#x dwErr=%u",
919	fRet, idHvPartition, GetLastError()) );
920	LogRel(("NEM: VidGetHvPartitionId -> fun:%#x in:%#x out:%#x\n",
921	g_IoCtlGetHvPartitionId.uFunction, g_IoCtlGetHvPartitionId.cbInput, g_IoCtlGetHvPartitionId.cbOutput));
922
923	/* VidStartVirtualProcessor */
924	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StartVirtualProcessor;
925	fRet = g_pfnVidStartVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
926	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
927	AssertReturn(fRet && g_IoCtlStartVirtualProcessor.uFunction != 0,
928	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
929	"Problem figuring out VidStartVirtualProcessor: fRet=%u dwErr=%u",
930	fRet, GetLastError()) );
931	LogRel(("NEM: VidStartVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStartVirtualProcessor.uFunction,
932	g_IoCtlStartVirtualProcessor.cbInput, g_IoCtlStartVirtualProcessor.cbOutput));
933
934	/* VidStopVirtualProcessor */
935	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StopVirtualProcessor;
936	fRet = g_pfnVidStopVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
937	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
938	AssertReturn(fRet && g_IoCtlStopVirtualProcessor.uFunction != 0,
939	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
940	"Problem figuring out VidStopVirtualProcessor: fRet=%u dwErr=%u",
941	fRet, GetLastError()) );
942	LogRel(("NEM: VidStopVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStopVirtualProcessor.uFunction,
943	g_IoCtlStopVirtualProcessor.cbInput, g_IoCtlStopVirtualProcessor.cbOutput));
944
945	/* VidMessageSlotHandleAndGetNext */
946	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_MessageSlotHandleAndGetNext;
947	fRet = g_pfnVidMessageSlotHandleAndGetNext(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE,
948	NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX, VID_MSHAGN_F_HANDLE_MESSAGE,
949	NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT);
950	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
951	AssertReturn(fRet && g_IoCtlMessageSlotHandleAndGetNext.uFunction != 0,
952	RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
953	"Problem figuring out VidMessageSlotHandleAndGetNext: fRet=%u dwErr=%u",
954	fRet, GetLastError()) );
955	LogRel(("NEM: VidMessageSlotHandleAndGetNext -> fun:%#x in:%#x out:%#x\n",
956	g_IoCtlMessageSlotHandleAndGetNext.uFunction, g_IoCtlMessageSlotHandleAndGetNext.cbInput,
957	g_IoCtlMessageSlotHandleAndGetNext.cbOutput));
958
959	#ifdef LOG_ENABLED
960	/* The following are only for logging: */
961	union
962	{
963	VID_MAPPED_MESSAGE_SLOT MapSlot;
964	HV_REGISTER_NAME Name;
965	HV_REGISTER_VALUE Value;
966	} uBuf;
967
968	/* VidMessageSlotMap */
969	g_pIoCtlDetectForLogging = &g_IoCtlMessageSlotMap;
970	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
971	fRet = g_pfnVidMessageSlotMap(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &uBuf.MapSlot, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
972	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
973	Assert(fRet);
974	LogRel(("NEM: VidMessageSlotMap -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
975	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
976
977	/* VidGetVirtualProcessorState */
978	uBuf.Name = HvRegisterExplicitSuspend;
979	g_pIoCtlDetectForLogging = &g_IoCtlGetVirtualProcessorState;
980	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
981	fRet = g_pfnVidGetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
982	&uBuf.Name, 1, &uBuf.Value);
983	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
984	Assert(fRet);
985	LogRel(("NEM: VidGetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
986	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
987
988	/* VidSetVirtualProcessorState */
989	uBuf.Name = HvRegisterExplicitSuspend;
990	g_pIoCtlDetectForLogging = &g_IoCtlSetVirtualProcessorState;
991	*g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
992	fRet = g_pfnVidSetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
993	&uBuf.Name, 1, &uBuf.Value);
994	*g_ppfnVidNtDeviceIoControlFile = pfnOrg;
995	Assert(fRet);
996	LogRel(("NEM: VidSetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
997	g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
998
999	g_pIoCtlDetectForLogging = NULL;
1000	#endif
1001
1002	/* Done. */
1003	pVM->nem.s.IoCtlGetHvPartitionId = g_IoCtlGetHvPartitionId;
1004	pVM->nem.s.IoCtlStartVirtualProcessor = g_IoCtlStartVirtualProcessor;
1005	pVM->nem.s.IoCtlStopVirtualProcessor = g_IoCtlStopVirtualProcessor;
1006	pVM->nem.s.IoCtlMessageSlotHandleAndGetNext = g_IoCtlMessageSlotHandleAndGetNext;
1007	return VINF_SUCCESS;
1008	}
1009
1010
1011	/**
1012	* Creates and sets up a Hyper-V (exo) partition.
1013	*
1014	* @returns VBox status code.
1015	* @param pVM The cross context VM structure.
1016	* @param pErrInfo Where to always return error info.
1017	*/
1018	static int nemR3WinInitCreatePartition(PVM pVM, PRTERRINFO pErrInfo)
1019	{
1020	AssertReturn(!pVM->nem.s.hPartition, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1021	AssertReturn(!pVM->nem.s.hPartitionDevice, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1022
1023	/*
1024	* Create the partition.
1025	*/
1026	WHV_PARTITION_HANDLE hPartition;
1027	HRESULT hrc = WHvCreatePartition(&hPartition);
1028	if (FAILED(hrc))
1029	return RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED, "WHvCreatePartition failed with %Rhrc (Last=%#x/%u)",
1030	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1031
1032	int rc;
1033
1034	/*
1035	* Set partition properties, most importantly the CPU count.
1036	*/
1037	/**
1038	* @todo Someone at Microsoft please explain another weird API:
1039	* - Why this API doesn't take the WHV_PARTITION_PROPERTY_CODE value as an
1040	* argument rather than as part of the struct. That is so weird if you've
1041	* used any other NT or windows API, including WHvGetCapability().
1042	* - Why use PVOID when WHV_PARTITION_PROPERTY is what's expected. We
1043	* technically only need 9 bytes for setting/getting
1044	* WHVPartitionPropertyCodeProcessorClFlushSize, but the API insists on 16. */
1045	WHV_PARTITION_PROPERTY Property;
1046	RT_ZERO(Property);
1047	Property.ProcessorCount = pVM->cCpus;
1048	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorCount, &Property, sizeof(Property));
1049	if (SUCCEEDED(hrc))
1050	{
1051	RT_ZERO(Property);
1052	Property.ExtendedVmExits.X64CpuidExit = pVM->nem.s.fExtendedCpuIdExit; /** @todo Register fixed results and restrict cpuid exits */
1053	Property.ExtendedVmExits.X64MsrExit = pVM->nem.s.fExtendedMsrExit;
1054	Property.ExtendedVmExits.ExceptionExit = pVM->nem.s.fExtendedXcptExit;
1055	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExtendedVmExits, &Property, sizeof(Property));
1056	if (SUCCEEDED(hrc))
1057	{
1058	/*
1059	* We'll continue setup in nemR3NativeInitAfterCPUM.
1060	*/
1061	pVM->nem.s.fCreatedEmts = false;
1062	pVM->nem.s.hPartition = hPartition;
1063	LogRel(("NEM: Created partition %p.\n", hPartition));
1064	return VINF_SUCCESS;
1065	}
1066
1067	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1068	"Failed setting WHvPartitionPropertyCodeExtendedVmExits to %'#RX64: %Rhrc",
1069	Property.ExtendedVmExits.AsUINT64, hrc);
1070	}
1071	else
1072	rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1073	"Failed setting WHvPartitionPropertyCodeProcessorCount to %u: %Rhrc (Last=%#x/%u)",
1074	pVM->cCpus, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1075	WHvDeletePartition(hPartition);
1076
1077	Assert(!pVM->nem.s.hPartitionDevice);
1078	Assert(!pVM->nem.s.hPartition);
1079	return rc;
1080	}
1081
1082
1083	/**
1084	* Makes sure APIC and firmware will not allow X2APIC mode.
1085	*
1086	* This is rather ugly.
1087	*
1088	* @returns VBox status code
1089	* @param pVM The cross context VM structure.
1090	*/
1091	static int nemR3WinDisableX2Apic(PVM pVM)
1092	{
1093	/*
1094	* First make sure the 'Mode' config value of the APIC isn't set to X2APIC.
1095	* This defaults to APIC, so no need to change unless it's X2APIC.
1096	*/
1097	PCFGMNODE pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/apic/0/Config");
1098	if (pCfg)
1099	{
1100	uint8_t bMode = 0;
1101	int rc = CFGMR3QueryU8(pCfg, "Mode", &bMode);
1102	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1103	if (RT_SUCCESS(rc) && bMode == PDMAPICMODE_X2APIC)
1104	{
1105	LogRel(("NEM: Adjusting APIC configuration from X2APIC to APIC max mode. X2APIC is not supported by the WinHvPlatform API!\n"));
1106	LogRel(("NEM: Disable Hyper-V if you need X2APIC for your guests!\n"));
1107	rc = CFGMR3RemoveValue(pCfg, "Mode");
1108	rc = CFGMR3InsertInteger(pCfg, "Mode", PDMAPICMODE_APIC);
1109	AssertLogRelRCReturn(rc, rc);
1110	}
1111	}
1112
1113	/*
1114	* Now the firmwares.
1115	* These also defaults to APIC and only needs adjusting if configured to X2APIC (2).
1116	*/
1117	static const char * const s_apszFirmwareConfigs[] =
1118	{
1119	"/Devices/efi/0/Config",
1120	"/Devices/pcbios/0/Config",
1121	};
1122	for (unsigned i = 0; i < RT_ELEMENTS(s_apszFirmwareConfigs); i++)
1123	{
1124	pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/APIC/0/Config");
1125	if (pCfg)
1126	{
1127	uint8_t bMode = 0;
1128	int rc = CFGMR3QueryU8(pCfg, "APIC", &bMode);
1129	AssertLogRelMsgReturn(RT_SUCCESS(rc) \|\| rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1130	if (RT_SUCCESS(rc) && bMode == 2)
1131	{
1132	LogRel(("NEM: Adjusting %s/Mode from 2 (X2APIC) to 1 (APIC).\n", s_apszFirmwareConfigs[i]));
1133	rc = CFGMR3RemoveValue(pCfg, "APIC");
1134	rc = CFGMR3InsertInteger(pCfg, "APIC", 1);
1135	AssertLogRelRCReturn(rc, rc);
1136	}
1137	}
1138	}
1139
1140	return VINF_SUCCESS;
1141	}
1142
1143
1144	/**
1145	* Try initialize the native API.
1146	*
1147	* This may only do part of the job, more can be done in
1148	* nemR3NativeInitAfterCPUM() and nemR3NativeInitCompleted().
1149	*
1150	* @returns VBox status code.
1151	* @param pVM The cross context VM structure.
1152	* @param fFallback Whether we're in fallback mode or use-NEM mode. In
1153	* the latter we'll fail if we cannot initialize.
1154	* @param fForced Whether the HMForced flag is set and we should
1155	* fail if we cannot initialize.
1156	*/
1157	int nemR3NativeInit(PVM pVM, bool fFallback, bool fForced)
1158	{
1159	g_uBuildNo = RTSystemGetNtBuildNo();
1160
1161	/*
1162	* Some state init.
1163	*/
1164	for (VMCPUID iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1165	{
1166	PNEMCPU pNemCpu = &pVM->aCpus[iCpu].nem.s;
1167	pNemCpu->uPendingApicBase = UINT64_MAX;
1168	}
1169
1170	/*
1171	* Error state.
1172	* The error message will be non-empty on failure and 'rc' will be set too.
1173	*/
1174	RTERRINFOSTATIC ErrInfo;
1175	PRTERRINFO pErrInfo = RTErrInfoInitStatic(&ErrInfo);
1176	int rc = nemR3WinInitProbeAndLoad(fForced, pErrInfo);
1177	if (RT_SUCCESS(rc))
1178	{
1179	/*
1180	* Check the capabilties of the hypervisor, starting with whether it's present.
1181	*/
1182	rc = nemR3WinInitCheckCapabilities(pVM, pErrInfo);
1183	if (RT_SUCCESS(rc))
1184	{
1185	/*
1186	* Discover the VID I/O control function numbers we need.
1187	*/
1188	rc = nemR3WinInitDiscoverIoControlProperties(pVM, pErrInfo);
1189	if (RT_SUCCESS(rc))
1190	{
1191	/*
1192	* Check out our ring-0 capabilities.
1193	*/
1194	rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /idCpu/, VMMR0_DO_NEM_INIT_VM, 0, NULL);
1195	if (RT_SUCCESS(rc))
1196	{
1197	/*
1198	* Create and initialize a partition.
1199	*/
1200	rc = nemR3WinInitCreatePartition(pVM, pErrInfo);
1201	if (RT_SUCCESS(rc))
1202	{
1203	VM_SET_MAIN_EXECUTION_ENGINE(pVM, VM_EXEC_ENGINE_NATIVE_API);
1204	Log(("NEM: Marked active!\n"));
1205	nemR3WinDisableX2Apic(pVM);
1206
1207	/* Register release statistics */
1208	for (VMCPUID iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1209	{
1210	PNEMCPU pNemCpu = &pVM->aCpus[iCpu].nem.s;
1211	STAMR3RegisterF(pVM, &pNemCpu->StatExitPortIo, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of port I/O exits", "/NEM/CPU%u/ExitPortIo", iCpu);
1212	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemUnmapped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unmapped memory exits", "/NEM/CPU%u/ExitMemUnmapped", iCpu);
1213	STAMR3RegisterF(pVM, &pNemCpu->StatExitMemIntercept, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of intercepted memory exits", "/NEM/CPU%u/ExitMemIntercept", iCpu);
1214	STAMR3RegisterF(pVM, &pNemCpu->StatExitHalt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitHalt", iCpu);
1215	STAMR3RegisterF(pVM, &pNemCpu->StatExitInterruptWindow, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitInterruptWindow", iCpu);
1216	STAMR3RegisterF(pVM, &pNemCpu->StatExitCpuId, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of CPUID exits", "/NEM/CPU%u/ExitCpuId", iCpu);
1217	STAMR3RegisterF(pVM, &pNemCpu->StatExitMsr, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of MSR access exits", "/NEM/CPU%u/ExitMsr", iCpu);
1218	STAMR3RegisterF(pVM, &pNemCpu->StatExitException, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of exception exits", "/NEM/CPU%u/ExitException", iCpu);
1219	STAMR3RegisterF(pVM, &pNemCpu->StatExitUnrecoverable, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unrecoverable exits", "/NEM/CPU%u/ExitUnrecoverable", iCpu);
1220	STAMR3RegisterF(pVM, &pNemCpu->StatGetMsgTimeout, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of get message timeouts/alerts", "/NEM/CPU%u/GetMsgTimeout", iCpu);
1221	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuSuccess, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of successful CPU stops", "/NEM/CPU%u/StopCpuSuccess", iCpu);
1222	STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPending, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stops", "/NEM/CPU%u/StopCpuPending", iCpu);
1223	STAMR3RegisterF(pVM, &pNemCpu->StatCancelChangedState, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel changed state", "/NEM/CPU%u/CancelChangedState", iCpu);
1224	STAMR3RegisterF(pVM, &pNemCpu->StatCancelAlertedThread, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel alerted EMT", "/NEM/CPU%u/CancelAlertedEMT", iCpu);
1225	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPre, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pre execution FF breaks", "/NEM/CPU%u/BreakOnFFPre", iCpu);
1226	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPost, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of post execution FF breaks", "/NEM/CPU%u/BreakOnFFPost", iCpu);
1227	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnCancel, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel execution breaks", "/NEM/CPU%u/BreakOnCancel", iCpu);
1228	STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnStatus, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of status code breaks", "/NEM/CPU%u/BreakOnStatus", iCpu);
1229	}
1230
1231	PUVM pUVM = pVM->pUVM;
1232	STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesAvailable, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1233	STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Free pages available to the hypervisor",
1234	"/NEM/R0Stats/cPagesAvailable");
1235	STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesInUse, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1236	STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Pages in use by hypervisor",
1237	"/NEM/R0Stats/cPagesInUse");
1238	}
1239	}
1240	}
1241	}
1242	}
1243
1244	/*
1245	* We only fail if in forced mode, otherwise just log the complaint and return.
1246	*/
1247	Assert(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API \|\| RTErrInfoIsSet(pErrInfo));
1248	if ( (fForced \|\| !fFallback)
1249	&& pVM->bMainExecutionEngine != VM_EXEC_ENGINE_NATIVE_API)
1250	return VMSetError(pVM, RT_SUCCESS_NP(rc) ? VERR_NEM_NOT_AVAILABLE : rc, RT_SRC_POS, "%s", pErrInfo->pszMsg);
1251
1252	if (RTErrInfoIsSet(pErrInfo))
1253	LogRel(("NEM: Not available: %s\n", pErrInfo->pszMsg));
1254	return VINF_SUCCESS;
1255	}
1256
1257
1258	/**
1259	* This is called after CPUMR3Init is done.
1260	*
1261	* @returns VBox status code.
1262	* @param pVM The VM handle..
1263	*/
1264	int nemR3NativeInitAfterCPUM(PVM pVM)
1265	{
1266	/*
1267	* Validate sanity.
1268	*/
1269	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1270	AssertReturn(hPartition != NULL, VERR_WRONG_ORDER);
1271	AssertReturn(!pVM->nem.s.hPartitionDevice, VERR_WRONG_ORDER);
1272	AssertReturn(!pVM->nem.s.fCreatedEmts, VERR_WRONG_ORDER);
1273	AssertReturn(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API, VERR_WRONG_ORDER);
1274
1275	/*
1276	* Continue setting up the partition now that we've got most of the CPUID feature stuff.
1277	*/
1278	WHV_PARTITION_PROPERTY Property;
1279	HRESULT hrc;
1280
1281	#if 0
1282	/* Not sure if we really need to set the vendor.
1283	Update: Apparently we don't. WHvPartitionPropertyCodeProcessorVendor was removed in 17110. */
1284	RT_ZERO(Property);
1285	Property.ProcessorVendor = pVM->nem.s.enmCpuVendor == CPUMCPUVENDOR_AMD ? WHvProcessorVendorAmd
1286	: WHvProcessorVendorIntel;
1287	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorVendor, &Property, sizeof(Property));
1288	if (FAILED(hrc))
1289	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1290	"Failed to set WHvPartitionPropertyCodeProcessorVendor to %u: %Rhrc (Last=%#x/%u)",
1291	Property.ProcessorVendor, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1292	#endif
1293
1294	/* Not sure if we really need to set the cache line flush size. */
1295	RT_ZERO(Property);
1296	Property.ProcessorClFlushSize = pVM->nem.s.cCacheLineFlushShift;
1297	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorClFlushSize, &Property, sizeof(Property));
1298	if (FAILED(hrc))
1299	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1300	"Failed to set WHvPartitionPropertyCodeProcessorClFlushSize to %u: %Rhrc (Last=%#x/%u)",
1301	pVM->nem.s.cCacheLineFlushShift, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1302
1303	/* Intercept #DB, #BP and #UD exceptions. */
1304	RT_ZERO(Property);
1305	Property.ExceptionExitBitmap = RT_BIT_64(WHvX64ExceptionTypeDivideErrorFault)
1306	\| RT_BIT_64(WHvX64ExceptionTypeBreakpointTrap)
1307	\| RT_BIT_64(WHvX64ExceptionTypeInvalidOpcodeFault);
1308	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExceptionExitBitmap, &Property, sizeof(Property));
1309	if (FAILED(hrc))
1310	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1311	"Failed to set WHvPartitionPropertyCodeExceptionExitBitmap to %#RX64: %Rhrc (Last=%#x/%u)",
1312	Property.ExceptionExitBitmap, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1313
1314
1315	/*
1316	* Sync CPU features with CPUM.
1317	*/
1318	/** @todo sync CPU features with CPUM. */
1319
1320	/* Set the partition property. */
1321	RT_ZERO(Property);
1322	Property.ProcessorFeatures.AsUINT64 = pVM->nem.s.uCpuFeatures.u64;
1323	hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorFeatures, &Property, sizeof(Property));
1324	if (FAILED(hrc))
1325	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1326	"Failed to set WHvPartitionPropertyCodeProcessorFeatures to %'#RX64: %Rhrc (Last=%#x/%u)",
1327	pVM->nem.s.uCpuFeatures.u64, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1328
1329	/*
1330	* Set up the partition and create EMTs.
1331	*
1332	* Seems like this is where the partition is actually instantiated and we get
1333	* a handle to it.
1334	*/
1335	hrc = WHvSetupPartition(hPartition);
1336	if (FAILED(hrc))
1337	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1338	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)",
1339	hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1340
1341	/* Get the handle. */
1342	HANDLE hPartitionDevice;
1343	__try
1344	{
1345	hPartitionDevice = ((HANDLE *)hPartition)[1];
1346	}
1347	__except(EXCEPTION_EXECUTE_HANDLER)
1348	{
1349	hrc = GetExceptionCode();
1350	hPartitionDevice = NULL;
1351	}
1352	if ( hPartitionDevice == NULL
1353	\|\| hPartitionDevice == (HANDLE)(intptr_t)-1)
1354	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1355	"Failed to get device handle for partition %p: %Rhrc", hPartition, hrc);
1356
1357	HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1358	if (!g_pfnVidGetHvPartitionId(hPartitionDevice, &idHvPartition))
1359	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1360	"Failed to get device handle and/or partition ID for %p (hPartitionDevice=%p, Last=%#x/%u)",
1361	hPartition, hPartitionDevice, RTNtLastStatusValue(), RTNtLastErrorValue());
1362	pVM->nem.s.hPartitionDevice = hPartitionDevice;
1363	pVM->nem.s.idHvPartition = idHvPartition;
1364
1365	/*
1366	* Setup the EMTs.
1367	*/
1368	VMCPUID iCpu;
1369	for (iCpu = 0; iCpu < pVM->cCpus; iCpu++)
1370	{
1371	PVMCPU pVCpu = &pVM->aCpus[iCpu];
1372
1373	pVCpu->nem.s.hNativeThreadHandle = (RTR3PTR)RTThreadGetNativeHandle(VMR3GetThreadHandle(pVCpu->pUVCpu));
1374	Assert((HANDLE)pVCpu->nem.s.hNativeThreadHandle != INVALID_HANDLE_VALUE);
1375
1376	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1377	VID_MAPPED_MESSAGE_SLOT MappedMsgSlot = { NULL, UINT32_MAX, UINT32_MAX };
1378	if (g_pfnVidMessageSlotMap(hPartitionDevice, &MappedMsgSlot, iCpu))
1379	{
1380	AssertLogRelMsg(MappedMsgSlot.iCpu == iCpu && MappedMsgSlot.uParentAdvisory == UINT32_MAX,
1381	("%#x %#x (iCpu=%#x)\n", MappedMsgSlot.iCpu, MappedMsgSlot.uParentAdvisory, iCpu));
1382	pVCpu->nem.s.pvMsgSlotMapping = MappedMsgSlot.pMsgBlock;
1383	}
1384	else
1385	{
1386	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1387	DWORD const dwErrLast = RTNtLastErrorValue();
1388	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1389	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1390	}
1391	#else
1392	hrc = WHvCreateVirtualProcessor(hPartition, iCpu, 0 /fFlags/);
1393	if (FAILED(hrc))
1394	{
1395	NTSTATUS const rcNtLast = RTNtLastStatusValue();
1396	DWORD const dwErrLast = RTNtLastErrorValue();
1397	while (iCpu-- > 0)
1398	{
1399	HRESULT hrc2 = WHvDeleteVirtualProcessor(hPartition, iCpu);
1400	AssertLogRelMsg(SUCCEEDED(hrc2), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1401	hPartition, iCpu, hrc2, RTNtLastStatusValue(),
1402	RTNtLastErrorValue()));
1403	}
1404	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1405	"Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1406	}
1407	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
1408	}
1409	pVM->nem.s.fCreatedEmts = true;
1410
1411	/*
1412	* Do some more ring-0 initialization now that we've got the partition handle.
1413	*/
1414	int rc = VMMR3CallR0Emt(pVM, &pVM->aCpus[0], VMMR0_DO_NEM_INIT_VM_PART_2, 0, NULL);
1415	if (RT_SUCCESS(rc))
1416	{
1417	LogRel(("NEM: Successfully set up partition (device handle %p, partition ID %#llx)\n", hPartitionDevice, idHvPartition));
1418
1419	#if 1
1420	VMMR3CallR0Emt(pVM, &pVM->aCpus[0], VMMR0_DO_NEM_UPDATE_STATISTICS, 0, NULL);
1421	LogRel(("NEM: Memory balance: %#RX64 out of %#RX64 pages in use\n",
1422	pVM->nem.s.R0Stats.cPagesInUse, pVM->nem.s.R0Stats.cPagesAvailable));
1423	#endif
1424
1425	/*
1426	* Register statistics on shared pages.
1427	*/
1428	/** @todo HvCallMapStatsPage */
1429
1430	/*
1431	* Adjust features.
1432	* Note! We've already disabled X2APIC via CFGM during the first init call.
1433	*/
1434	return VINF_SUCCESS;
1435	}
1436	return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS, "Call to NEMR0InitVMPart2 failed: %Rrc", rc);
1437	}
1438
1439
1440	int nemR3NativeInitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
1441	{
1442	//BOOL fRet = SetThreadPriority(GetCurrentThread(), 0);
1443	//AssertLogRel(fRet);
1444
1445	NOREF(pVM); NOREF(enmWhat);
1446	return VINF_SUCCESS;
1447	}
1448
1449
1450	int nemR3NativeTerm(PVM pVM)
1451	{
1452	/*
1453	* Delete the partition.
1454	*/
1455	WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1456	pVM->nem.s.hPartition = NULL;
1457	pVM->nem.s.hPartitionDevice = NULL;
1458	if (hPartition != NULL)
1459	{
1460	VMCPUID iCpu = pVM->nem.s.fCreatedEmts ? pVM->cCpus : 0;
1461	LogRel(("NEM: Destroying partition %p with its %u VCpus...\n", hPartition, iCpu));
1462	while (iCpu-- > 0)
1463	{
1464	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1465	pVM->aCpus[iCpu].nem.s.pvMsgSlotMapping = NULL;
1466	#else
1467	HRESULT hrc = WHvDeleteVirtualProcessor(hPartition, iCpu);
1468	AssertLogRelMsg(SUCCEEDED(hrc), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1469	hPartition, iCpu, hrc, RTNtLastStatusValue(),
1470	RTNtLastErrorValue()));
1471	#endif
1472	}
1473	WHvDeletePartition(hPartition);
1474	}
1475	pVM->nem.s.fCreatedEmts = false;
1476	return VINF_SUCCESS;
1477	}
1478
1479
1480	/**
1481	* VM reset notification.
1482	*
1483	* @param pVM The cross context VM structure.
1484	*/
1485	void nemR3NativeReset(PVM pVM)
1486	{
1487	/* Unfix the A20 gate. */
1488	pVM->nem.s.fA20Fixed = false;
1489	}
1490
1491
1492	/**
1493	* Reset CPU due to INIT IPI or hot (un)plugging.
1494	*
1495	* @param pVCpu The cross context virtual CPU structure of the CPU being
1496	* reset.
1497	* @param fInitIpi Whether this is the INIT IPI or hot (un)plugging case.
1498	*/
1499	void nemR3NativeResetCpu(PVMCPU pVCpu, bool fInitIpi)
1500	{
1501	/* Lock the A20 gate if INIT IPI, make sure it's enabled. */
1502	if (fInitIpi && pVCpu->idCpu > 0)
1503	{
1504	PVM pVM = pVCpu->CTX_SUFF(pVM);
1505	if (!pVM->nem.s.fA20Enabled)
1506	nemR3NativeNotifySetA20(pVCpu, true);
1507	pVM->nem.s.fA20Enabled = true;
1508	pVM->nem.s.fA20Fixed = true;
1509	}
1510	}
1511
1512	#if 0 //ndef NEM_WIN_USE_OUR_OWN_RUN_API - migrating to NEMAllNativeTemplate-win.cpp.h */
1513
1514	# ifdef LOG_ENABLED
1515	/**
1516	* Log the full details of an exit reason.
1517	*
1518	* @param pExitReason The exit reason to log.
1519	*/
1520	static void nemR3WinLogWHvExitReason(WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1521	{
1522	bool fExitCtx = false;
1523	bool fExitInstr = false;
1524	switch (pExitReason->ExitReason)
1525	{
1526	case WHvRunVpExitReasonMemoryAccess:
1527	Log2(("Exit: Memory access: GCPhys=%RGp GCVirt=%RGv %s %s %s\n",
1528	pExitReason->MemoryAccess.Gpa, pExitReason->MemoryAccess.Gva,
1529	g_apszWHvMemAccesstypes[pExitReason->MemoryAccess.AccessInfo.AccessType],
1530	pExitReason->MemoryAccess.AccessInfo.GpaUnmapped ? "unmapped" : "mapped",
1531	pExitReason->MemoryAccess.AccessInfo.GvaValid ? "" : "invalid-gc-virt"));
1532	AssertMsg(!(pExitReason->MemoryAccess.AccessInfo.AsUINT32 & ~UINT32_C(0xf)),
1533	("MemoryAccess.AccessInfo=%#x\n", pExitReason->MemoryAccess.AccessInfo.AsUINT32));
1534	fExitCtx = fExitInstr = true;
1535	break;
1536
1537	case WHvRunVpExitReasonX64IoPortAccess:
1538	Log2(("Exit: I/O port access: IoPort=%#x LB %u %s%s%s rax=%#RX64 rcx=%#RX64 rsi=%#RX64 rdi=%#RX64\n",
1539	pExitReason->IoPortAccess.PortNumber,
1540	pExitReason->IoPortAccess.AccessInfo.AccessSize,
1541	pExitReason->IoPortAccess.AccessInfo.IsWrite ? "out" : "in",
1542	pExitReason->IoPortAccess.AccessInfo.StringOp ? " string" : "",
1543	pExitReason->IoPortAccess.AccessInfo.RepPrefix ? " rep" : "",
1544	pExitReason->IoPortAccess.Rax,
1545	pExitReason->IoPortAccess.Rcx,
1546	pExitReason->IoPortAccess.Rsi,
1547	pExitReason->IoPortAccess.Rdi));
1548	Log2(("Exit: + ds=%#x:{%#RX64 LB %#RX32, %#x} es=%#x:{%#RX64 LB %#RX32, %#x}\n",
1549	pExitReason->IoPortAccess.Ds.Selector,
1550	pExitReason->IoPortAccess.Ds.Base,
1551	pExitReason->IoPortAccess.Ds.Limit,
1552	pExitReason->IoPortAccess.Ds.Attributes,
1553	pExitReason->IoPortAccess.Es.Selector,
1554	pExitReason->IoPortAccess.Es.Base,
1555	pExitReason->IoPortAccess.Es.Limit,
1556	pExitReason->IoPortAccess.Es.Attributes ));
1557
1558	AssertMsg( pExitReason->IoPortAccess.AccessInfo.AccessSize == 1
1559	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 2
1560	\|\| pExitReason->IoPortAccess.AccessInfo.AccessSize == 4,
1561	("IoPortAccess.AccessInfo.AccessSize=%d\n", pExitReason->IoPortAccess.AccessInfo.AccessSize));
1562	AssertMsg(!(pExitReason->IoPortAccess.AccessInfo.AsUINT32 & ~UINT32_C(0x3f)),
1563	("IoPortAccess.AccessInfo=%#x\n", pExitReason->IoPortAccess.AccessInfo.AsUINT32));
1564	fExitCtx = fExitInstr = true;
1565	break;
1566
1567	# if 0
1568	case WHvRunVpExitReasonUnrecoverableException:
1569	case WHvRunVpExitReasonInvalidVpRegisterValue:
1570	case WHvRunVpExitReasonUnsupportedFeature:
1571	case WHvRunVpExitReasonX64InterruptWindow:
1572	case WHvRunVpExitReasonX64Halt:
1573	case WHvRunVpExitReasonX64MsrAccess:
1574	case WHvRunVpExitReasonX64Cpuid:
1575	case WHvRunVpExitReasonException:
1576	case WHvRunVpExitReasonCanceled:
1577	case WHvRunVpExitReasonAlerted:
1578	WHV_X64_MSR_ACCESS_CONTEXT MsrAccess;
1579	WHV_X64_CPUID_ACCESS_CONTEXT CpuidAccess;
1580	WHV_VP_EXCEPTION_CONTEXT VpException;
1581	WHV_X64_INTERRUPTION_DELIVERABLE_CONTEXT InterruptWindow;
1582	WHV_UNRECOVERABLE_EXCEPTION_CONTEXT UnrecoverableException;
1583	WHV_X64_UNSUPPORTED_FEATURE_CONTEXT UnsupportedFeature;
1584	WHV_RUN_VP_CANCELED_CONTEXT CancelReason;
1585	# endif
1586
1587	case WHvRunVpExitReasonNone:
1588	Log2(("Exit: No reason\n"));
1589	AssertFailed();
1590	break;
1591
1592	default:
1593	Log(("Exit: %#x\n", pExitReason->ExitReason));
1594	break;
1595	}
1596
1597	/*
1598	* Context and maybe instruction details.
1599	*/
1600	if (fExitCtx)
1601	{
1602	const WHV_VP_EXIT_CONTEXT *pVpCtx = &pExitReason->VpContext;
1603	Log2(("Exit: + CS:RIP=%04x:%08RX64 RFLAGS=%06RX64 cbInstr=%u CS={%RX64 L %#RX32, %#x}\n",
1604	pVpCtx->Cs.Selector,
1605	pVpCtx->Rip,
1606	pVpCtx->Rflags,
1607	pVpCtx->InstructionLength,
1608	pVpCtx->Cs.Base, pVpCtx->Cs.Limit, pVpCtx->Cs.Attributes));
1609	Log2(("Exit: + cpl=%d CR0.PE=%d CR0.AM=%d EFER.LMA=%d DebugActive=%d InterruptionPending=%d InterruptShadow=%d\n",
1610	pVpCtx->ExecutionState.Cpl,
1611	pVpCtx->ExecutionState.Cr0Pe,
1612	pVpCtx->ExecutionState.Cr0Am,
1613	pVpCtx->ExecutionState.EferLma,
1614	pVpCtx->ExecutionState.DebugActive,
1615	pVpCtx->ExecutionState.InterruptionPending,
1616	pVpCtx->ExecutionState.InterruptShadow));
1617	AssertMsg(!(pVpCtx->ExecutionState.AsUINT16 & ~UINT16_C(0x107f)),
1618	("ExecutionState.AsUINT16=%#x\n", pVpCtx->ExecutionState.AsUINT16));
1619
1620	/** @todo Someone at Microsoft please explain why the InstructionBytes fields
1621	* are 16 bytes long, when 15 would've been sufficent and saved 3-7 bytes of
1622	* alignment padding? Intel max length is 15, so is this sSome ARM stuff?
1623	* Aren't ARM
1624	* instructions max 32-bit wide? Confused. */
1625	if (fExitInstr && pExitReason->IoPortAccess.InstructionByteCount > 0)
1626	Log2(("Exit: + Instruction %.*Rhxs\n",
1627	pExitReason->IoPortAccess.InstructionByteCount, &pExitReason->IoPortAccess.InstructionBytes[0]));
1628	}
1629	}
1630	# endif /* LOG_ENABLED */
1631
1632
1633	static VBOXSTRICTRC nemR3WinWHvHandleHalt(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1634	{
1635	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
1636	LogFlow(("nemR3WinWHvHandleHalt\n"));
1637	return VINF_EM_HALT;
1638	}
1639
1640
1641	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1642	/**
1643	* @callback_method_impl{FNPGMPHYSNEMENUMCALLBACK,
1644	* Hack to unmap all pages when/before we run into quota (WHv only).}
1645	*/
1646	static DECLCALLBACK(int) nemR3WinWHvUnmapOnePageCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, uint8_t pu2NemState, void pvUser)
1647	{
1648	RT_NOREF_PV(pvUser);
1649	RT_NOREF_PV(pVCpu);
1650	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
1651	if (SUCCEEDED(hrc))
1652	{
1653	Log5(("NEM GPA unmap all: %RGp (cMappedPages=%u)\n", GCPhys, pVM->nem.s.cMappedPages - 1));
1654	*pu2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
1655	}
1656	else
1657	{
1658	LogRel(("nemR3WinWHvUnmapOnePageCallback: GCPhys=%RGp %s hrc=%Rhrc (%#x) Last=%#x/%u (cMappedPages=%u)\n",
1659	GCPhys, g_apszPageStates[*pu2NemState], hrc, hrc, RTNtLastStatusValue(),
1660	RTNtLastErrorValue(), pVM->nem.s.cMappedPages));
1661	*pu2NemState = NEM_WIN_PAGE_STATE_NOT_SET;
1662	}
1663	if (pVM->nem.s.cMappedPages > 0)
1664	ASMAtomicDecU32(&pVM->nem.s.cMappedPages);
1665	return VINF_SUCCESS;
1666	}
1667	# endif /* !NEM_WIN_USE_HYPERCALLS_FOR_PAGES */
1668
1669
1670	/**
1671	* Handles an memory access VMEXIT.
1672	*
1673	* This can be triggered by a number of things.
1674	*
1675	* @returns Strict VBox status code.
1676	* @param pVM The cross context VM structure.
1677	* @param pVCpu The cross context virtual CPU structure.
1678	* @param pCtx The CPU context to update.
1679	* @param pMemCtx The exit reason information.
1680	* @param pVpContext The processor context info associated with the exit.
1681	*/
1682	static VBOXSTRICTRC nemR3WinWHvHandleMemoryAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_MEMORY_ACCESS_CONTEXT const *pMemCtx,
1683	WHV_VP_EXIT_CONTEXT const *pVpContext)
1684	{
1685	/*
1686	* Ask PGM for information about the given GCPhys. We need to check if we're
1687	* out of sync first.
1688	*/
1689	NEMHCWINHMACPCCSTATE State = { pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite, false, false };
1690	PGMPHYSNEMPAGEINFO Info;
1691	int rc = PGMPhysNemPageInfoChecker(pVM, pVCpu, pMemCtx->Gpa, State.fWriteAccess, &Info,
1692	nemHCWinHandleMemoryAccessPageCheckerCallback, &State);
1693	if (RT_SUCCESS(rc))
1694	{
1695	if (Info.fNemProt & (pMemCtx->AccessInfo.AccessType == WHvMemoryAccessWrite ? NEM_PAGE_PROT_WRITE : NEM_PAGE_PROT_READ))
1696	{
1697	if (State.fCanResume)
1698	{
1699	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; restarting (%s)\n",
1700	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1701	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1702	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1703	return VINF_SUCCESS;
1704	}
1705	}
1706	Log4(("MemExit: %RGp (=>%RHp) %s fProt=%u%s%s%s; emulating (%s)\n",
1707	pMemCtx->Gpa, Info.HCPhys, g_apszPageStates[Info.u2NemState], Info.fNemProt,
1708	Info.fHasHandlers ? " handlers" : "", Info.fZeroPage ? " zero-pg" : "",
1709	State.fDidSomething ? "" : " no-change", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1710	}
1711	else
1712	Log4(("MemExit: %RGp rc=%Rrc%s; emulating (%s)\n", pMemCtx->Gpa, rc,
1713	State.fDidSomething ? " modified-backing" : "", g_apszWHvMemAccesstypes[pMemCtx->AccessInfo.AccessType]));
1714
1715	/*
1716	* Emulate the memory access, either access handler or special memory.
1717	*/
1718	rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1719	AssertRCReturn(rc, rc);
1720
1721	VBOXSTRICTRC rcStrict;
1722	if (pMemCtx->InstructionByteCount > 0)
1723	rcStrict = IEMExecOneWithPrefetchedByPC(pVCpu, CPUMCTX2CORE(pCtx), pVpContext->Rip,
1724	&pMemCtx->InstructionBytes[0], pMemCtx->InstructionByteCount);
1725	else
1726	rcStrict = IEMExecOne(pVCpu);
1727	/** @todo do we need to do anything wrt debugging here? */
1728	return rcStrict;
1729	}
1730
1731
1732	/**
1733	* Handles an I/O port access VMEXIT.
1734	*
1735	* We ASSUME that the hypervisor has don't I/O port access control.
1736	*
1737	* @returns Strict VBox status code.
1738	* @param pVM The cross context VM structure.
1739	* @param pVCpu The cross context virtual CPU structure.
1740	* @param pCtx The CPU context to update.
1741	* @param pIoPortCtx The exit reason information.
1742	* @param pVpContext The processor context info associated with the exit.
1743	*/
1744	static VBOXSTRICTRC
1745	nemR3WinWHvHandleIoPortAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_X64_IO_PORT_ACCESS_CONTEXT const *pIoPortCtx,
1746	WHV_VP_EXIT_CONTEXT const *pVpContext)
1747	{
1748	Assert( pIoPortCtx->AccessInfo.AccessSize == 1
1749	\|\| pIoPortCtx->AccessInfo.AccessSize == 2
1750	\|\| pIoPortCtx->AccessInfo.AccessSize == 4);
1751
1752	VBOXSTRICTRC rcStrict;
1753	if (!pIoPortCtx->AccessInfo.StringOp)
1754	{
1755	/*
1756	* Simple port I/O.
1757	*/
1758	//Assert(pCtx->rax == pIoPortCtx->Rax); - sledgehammer
1759
1760	static uint32_t const s_fAndMask[8] =
1761	{ UINT32_MAX, UINT32_C(0xff), UINT32_C(0xffff), UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX, UINT32_MAX };
1762	uint32_t const fAndMask = s_fAndMask[pIoPortCtx->AccessInfo.AccessSize];
1763	if (pIoPortCtx->AccessInfo.IsWrite)
1764	{
1765	rcStrict = IOMIOPortWrite(pVM, pVCpu, pIoPortCtx->PortNumber, (uint32_t)pIoPortCtx->Rax & fAndMask,
1766	pIoPortCtx->AccessInfo.AccessSize);
1767	if (IOM_SUCCESS(rcStrict))
1768	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, pVpContext);
1769	}
1770	else
1771	{
1772	uint32_t uValue = 0;
1773	rcStrict = IOMIOPortRead(pVM, pVCpu, pIoPortCtx->PortNumber, &uValue,
1774	pIoPortCtx->AccessInfo.AccessSize);
1775	if (IOM_SUCCESS(rcStrict))
1776	{
1777	pCtx->eax = (pCtx->eax & ~fAndMask) \| (uValue & fAndMask);
1778	nemR3WinAdvanceGuestRipAndClearRF(pVCpu, pCtx, pVpContext);
1779	}
1780	}
1781	}
1782	else
1783	{
1784	/*
1785	* String port I/O.
1786	*/
1787	/** @todo Someone at Microsoft please explain how we can get the address mode
1788	* from the IoPortAccess.VpContext. CS.Attributes is only sufficient for
1789	* getting the default mode, it can always be overridden by a prefix. This
1790	* forces us to interpret the instruction from opcodes, which is suboptimal.
1791	* Both AMD-V and VT-x includes the address size in the exit info, at least on
1792	* CPUs that are reasonably new. */
1793	# if 0 // requires sledgehammer
1794	Assert( pIoPortCtx->Ds.Base == pCtx->ds.u64Base
1795	&& pIoPortCtx->Ds.Limit == pCtx->ds.u32Limit
1796	&& pIoPortCtx->Ds.Selector == pCtx->ds.Sel);
1797	Assert( pIoPortCtx->Es.Base == pCtx->es.u64Base
1798	&& pIoPortCtx->Es.Limit == pCtx->es.u32Limit
1799	&& pIoPortCtx->Es.Selector == pCtx->es.Sel);
1800	Assert(pIoPortCtx->Rdi == pCtx->rdi);
1801	Assert(pIoPortCtx->Rsi == pCtx->rsi);
1802	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1803	Assert(pIoPortCtx->Rcx == pCtx->rcx);
1804	# endif
1805
1806	int rc = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, NEM_WIN_CPUMCTX_EXTRN_MASK_FOR_IEM);
1807	AssertRCReturn(rc, rc);
1808
1809	rcStrict = IEMExecOne(pVCpu);
1810	}
1811	if (IOM_SUCCESS(rcStrict))
1812	{
1813	/*
1814	* Do debug checks.
1815	*/
1816	if ( pVpContext->ExecutionState.DebugActive /** @todo Microsoft: Does DebugActive this only reflext DR7? */
1817	\|\| (pVpContext->Rflags & X86_EFL_TF)
1818	\|\| DBGFBpIsHwIoArmed(pVM) )
1819	{
1820	/** @todo Debugging. */
1821	}
1822	}
1823	return rcStrict;
1824	}
1825
1826
1827	static VBOXSTRICTRC nemR3WinWHvHandleInterruptWindow(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1828	{
1829	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1830	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1831	}
1832
1833
1834	static VBOXSTRICTRC nemR3WinWHvHandleMsrAccess(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1835	{
1836	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1837	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1838	}
1839
1840
1841	static VBOXSTRICTRC nemR3WinWHvHandleCpuId(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1842	{
1843	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1844	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1845	}
1846
1847
1848	static VBOXSTRICTRC nemR3WinWHvHandleException(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1849	{
1850	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1851	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1852	}
1853
1854
1855	static VBOXSTRICTRC nemR3WinWHvHandleUD(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1856	{
1857	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1858	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1859	}
1860
1861
1862	static VBOXSTRICTRC nemR3WinWHvHandleTripleFault(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1863	{
1864	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1865	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1866	}
1867
1868
1869	static VBOXSTRICTRC nemR3WinWHvHandleInvalidState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, WHV_RUN_VP_EXIT_CONTEXT const *pExitReason)
1870	{
1871	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx); NOREF(pExitReason);
1872	AssertLogRelFailedReturn(VERR_NOT_IMPLEMENTED);
1873	}
1874
1875
1876	VBOXSTRICTRC nemR3WinWHvRunGC(PVM pVM, PVMCPU pVCpu)
1877	{
1878	# ifdef LOG_ENABLED
1879	if (LogIs3Enabled())
1880	{
1881	Log3(("nemR3NativeRunGC: Entering #%u\n", pVCpu->idCpu));
1882	nemHCWinLogState(pVM, pVCpu);
1883	}
1884	# endif
1885
1886	/*
1887	* The run loop.
1888	*/
1889	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
1890	const bool fSingleStepping = false; /** @todo get this from somewhere. */
1891	VBOXSTRICTRC rcStrict = VINF_SUCCESS;
1892	for (unsigned iLoop = 0;;iLoop++)
1893	{
1894	/*
1895	* Copy the state.
1896	*/
1897	int rc2 = nemHCWinCopyStateToHyperV(pVM, pVCpu, pCtx);
1898	AssertRCBreakStmt(rc2, rcStrict = rc2);
1899
1900	/*
1901	* Run a bit.
1902	*/
1903	WHV_RUN_VP_EXIT_CONTEXT ExitReason;
1904	RT_ZERO(ExitReason);
1905	if ( !VM_FF_IS_PENDING(pVM, VM_FF_EMT_RENDEZVOUS \| VM_FF_TM_VIRTUAL_SYNC)
1906	&& !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
1907	{
1908	Log8(("Calling WHvRunVirtualProcessor\n"));
1909	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC_NEM, VMCPUSTATE_STARTED);
1910	HRESULT hrc = WHvRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, &ExitReason, sizeof(ExitReason));
1911	VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC_NEM);
1912	AssertLogRelMsgBreakStmt(SUCCEEDED(hrc),
1913	("WHvRunVirtualProcessor(%p, %u,,) -> %Rhrc (Last=%#x/%u)\n", pVM->nem.s.hPartition, pVCpu->idCpu,
1914	hrc, RTNtLastStatusValue(), RTNtLastErrorValue()),
1915	rcStrict = VERR_INTERNAL_ERROR);
1916	Log2(("WHvRunVirtualProcessor -> %#x; exit code %#x (%d) (cpu status %u)\n",
1917	hrc, ExitReason.ExitReason, ExitReason.ExitReason, nemHCWinCpuGetRunningStatus(pVCpu) ));
1918	}
1919	else
1920	{
1921	LogFlow(("nemR3NativeRunGC: returning: pending FF (pre exec)\n"));
1922	break;
1923	}
1924
1925	# if 0 /* sledgehammer approach */
1926	/*
1927	* Copy back the state.
1928	*/
1929	rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, UINT64_MAX);
1930	AssertRCBreakStmt(rc2, rcStrict = rc2);
1931	# endif
1932
1933	# ifdef LOG_ENABLED
1934	/*
1935	* Do some logging.
1936	*/
1937	if (LogIs2Enabled())
1938	nemR3WinLogWHvExitReason(&ExitReason);
1939	if (LogIs3Enabled())
1940	nemHCWinLogState(pVM, pVCpu);
1941	# endif
1942
1943	# if 0 //def VBOX_STRICT - requires sledgehammer
1944	/* Assert that the VpContext field makes sense. */
1945	switch (ExitReason.ExitReason)
1946	{
1947	case WHvRunVpExitReasonMemoryAccess:
1948	case WHvRunVpExitReasonX64IoPortAccess:
1949	case WHvRunVpExitReasonX64MsrAccess:
1950	case WHvRunVpExitReasonX64Cpuid:
1951	case WHvRunVpExitReasonException:
1952	case WHvRunVpExitReasonUnrecoverableException:
1953	Assert( ExitReason.IoPortAccess.VpContext.InstructionLength > 0
1954	\|\| ( ExitReason.ExitReason == WHvRunVpExitReasonMemoryAccess
1955	&& ExitReason.MemoryAccess.AccessInfo.AccessType == WHvMemoryAccessExecute));
1956	Assert(ExitReason.IoPortAccess.VpContext.InstructionLength < 16);
1957	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cpl == CPUMGetGuestCPL(pVCpu));
1958	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Pe == RT_BOOL(pCtx->cr0 & X86_CR0_PE));
1959	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Cr0Am == RT_BOOL(pCtx->cr0 & X86_CR0_AM));
1960	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.EferLma == RT_BOOL(pCtx->msrEFER & MSR_K6_EFER_LMA));
1961	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.DebugActive == RT_BOOL(pCtx->dr[7] & X86_DR7_ENABLED_MASK));
1962	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved0 == 0);
1963	Assert(ExitReason.IoPortAccess.VpContext.ExecutionState.Reserved1 == 0);
1964	Assert(ExitReason.IoPortAccess.VpContext.Rip == pCtx->rip);
1965	Assert(ExitReason.IoPortAccess.VpContext.Rflags == pCtx->rflags.u);
1966	Assert( ExitReason.IoPortAccess.VpContext.Cs.Base == pCtx->cs.u64Base
1967	&& ExitReason.IoPortAccess.VpContext.Cs.Limit == pCtx->cs.u32Limit
1968	&& ExitReason.IoPortAccess.VpContext.Cs.Selector == pCtx->cs.Sel);
1969	break;
1970	default: break; /* shut up compiler. */
1971	}
1972	# endif
1973
1974	/*
1975	* Deal with the exit.
1976	*/
1977	switch (ExitReason.ExitReason)
1978	{
1979	/* Frequent exits: */
1980	case WHvRunVpExitReasonCanceled:
1981	//case WHvRunVpExitReasonAlerted:
1982	rcStrict = VINF_SUCCESS;
1983	break;
1984
1985	case WHvRunVpExitReasonX64Halt:
1986	rcStrict = nemR3WinWHvHandleHalt(pVM, pVCpu, pCtx);
1987	break;
1988
1989	case WHvRunVpExitReasonMemoryAccess:
1990	rcStrict = nemR3WinWHvHandleMemoryAccess(pVM, pVCpu, pCtx, &ExitReason.MemoryAccess, &ExitReason.VpContext);
1991	break;
1992
1993	case WHvRunVpExitReasonX64IoPortAccess:
1994	rcStrict = nemR3WinWHvHandleIoPortAccess(pVM, pVCpu, pCtx, &ExitReason.IoPortAccess, &ExitReason.VpContext);
1995	break;
1996
1997	case WHvRunVpExitReasonX64InterruptWindow:
1998	rcStrict = nemR3WinWHvHandleInterruptWindow(pVM, pVCpu, pCtx, &ExitReason);
1999	break;
2000
2001	case WHvRunVpExitReasonX64MsrAccess: /* needs configuring */
2002	rcStrict = nemR3WinWHvHandleMsrAccess(pVM, pVCpu, pCtx, &ExitReason);
2003	break;
2004
2005	case WHvRunVpExitReasonX64Cpuid: /* needs configuring */
2006	rcStrict = nemR3WinWHvHandleCpuId(pVM, pVCpu, pCtx, &ExitReason);
2007	break;
2008
2009	case WHvRunVpExitReasonException: /* needs configuring */
2010	rcStrict = nemR3WinWHvHandleException(pVM, pVCpu, pCtx, &ExitReason);
2011	break;
2012
2013	/* Unlikely exits: */
2014	case WHvRunVpExitReasonUnsupportedFeature:
2015	rcStrict = nemR3WinWHvHandleUD(pVM, pVCpu, pCtx, &ExitReason);
2016	break;
2017
2018	case WHvRunVpExitReasonUnrecoverableException:
2019	rcStrict = nemR3WinWHvHandleTripleFault(pVM, pVCpu, pCtx, &ExitReason);
2020	break;
2021
2022	case WHvRunVpExitReasonInvalidVpRegisterValue:
2023	rcStrict = nemR3WinWHvHandleInvalidState(pVM, pVCpu, pCtx, &ExitReason);
2024	break;
2025
2026	/* Undesired exits: */
2027	case WHvRunVpExitReasonNone:
2028	default:
2029	AssertLogRelMsgFailed(("Unknown ExitReason: %#x\n", ExitReason.ExitReason));
2030	rcStrict = VERR_INTERNAL_ERROR_3;
2031	break;
2032	}
2033	if (rcStrict != VINF_SUCCESS)
2034	{
2035	LogFlow(("nemR3NativeRunGC: returning: %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
2036	break;
2037	}
2038
2039	# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2040	/* Hack alert! */
2041	uint32_t const cMappedPages = pVM->nem.s.cMappedPages;
2042	if (cMappedPages < 4000)
2043	{ /* likely */ }
2044	else
2045	{
2046	PGMPhysNemEnumPagesByState(pVM, pVCpu, NEM_WIN_PAGE_STATE_READABLE, nemR3WinWHvUnmapOnePageCallback, NULL);
2047	Log(("nemR3NativeRunGC: Unmapped all; cMappedPages=%u -> %u\n", cMappedPages, pVM->nem.s.cMappedPages));
2048	}
2049	# endif
2050
2051	/* If any FF is pending, return to the EM loops. That's okay for the
2052	current sledgehammer approach. */
2053	if ( VM_FF_IS_PENDING( pVM, !fSingleStepping ? VM_FF_HP_R0_PRE_HM_MASK : VM_FF_HP_R0_PRE_HM_STEP_MASK)
2054	\|\| VMCPU_FF_IS_PENDING(pVCpu, !fSingleStepping ? VMCPU_FF_HP_R0_PRE_HM_MASK : VMCPU_FF_HP_R0_PRE_HM_STEP_MASK) )
2055	{
2056	LogFlow(("nemR3NativeRunGC: returning: pending FF (%#x / %#x)\n", pVM->fGlobalForcedActions, pVCpu->fLocalForcedActions));
2057	break;
2058	}
2059	}
2060
2061
2062	/*
2063	* Copy back the state before returning.
2064	*/
2065	if (pCtx->fExtrn & (CPUMCTX_EXTRN_ALL \| (CPUMCTX_EXTRN_NEM_WIN_MASK & ~CPUMCTX_EXTRN_NEM_WIN_EVENT_INJECT)))
2066	{
2067	int rc2 = nemHCWinCopyStateFromHyperV(pVM, pVCpu, pCtx, CPUMCTX_EXTRN_ALL \| CPUMCTX_EXTRN_NEM_WIN_MASK);
2068	if (RT_SUCCESS(rc2))
2069	pCtx->fExtrn = 0;
2070	else if (RT_SUCCESS(rcStrict))
2071	rcStrict = rc2;
2072	}
2073	else
2074	pCtx->fExtrn = 0;
2075
2076	return rcStrict;
2077	}
2078
2079	#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API - migrating to NEMAllNativeTemplate-win.cpp.h*/
2080
2081
2082	VBOXSTRICTRC nemR3NativeRunGC(PVM pVM, PVMCPU pVCpu)
2083	{
2084	#if !defined(NEM_WIN_USE_OUR_OWN_RUN_API) \|\| 0
2085	return nemHCWinRunGC(pVM, pVCpu, NULL /pGVM/, NULL /pGVCpu/);
2086	#else
2087	for (;;)
2088	{
2089	VBOXSTRICTRC rcStrict = VMMR3CallR0EmtFast(pVM, pVCpu, VMMR0_DO_NEM_RUN);
2090	if (RT_SUCCESS(rcStrict))
2091	{
2092	/*
2093	* We deal with VINF_NEM_CHANGE_PGM_MODE, VINF_NEM_FLUSH_TLB and
2094	* VINF_NEM_UPDATE_APIC_BASE here, since we're running the risk of
2095	* getting these while we already got another RC (I/O ports).
2096	*
2097	* The APIC base update and a PGM update can happen at the same time, so
2098	* we don't depend on the status code for that and always checks it first.
2099	*/
2100	/* APIC base: */
2101	if (pVCpu->nem.s.uPendingApicBase != UINT64_MAX)
2102	{
2103	LogFlow(("nemR3NativeRunGC: calling APICSetBaseMsr(,%RX64)...\n", pVCpu->nem.s.uPendingApicBase));
2104	VBOXSTRICTRC rc2 = APICSetBaseMsr(pVCpu, pVCpu->nem.s.uPendingApicBase);
2105	AssertLogRelMsg(rc2 == VINF_SUCCESS, ("rc2=%Rrc [%#RX64]\n", VBOXSTRICTRC_VAL(rc2), pVCpu->nem.s.uPendingApicBase));
2106	pVCpu->nem.s.uPendingApicBase = UINT64_MAX;
2107	}
2108
2109	/* Status codes: */
2110	VBOXSTRICTRC rcPending = pVCpu->nem.s.rcPending;
2111	pVCpu->nem.s.rcPending = VINF_SUCCESS;
2112	if ( rcStrict == VINF_NEM_CHANGE_PGM_MODE
2113	\|\| rcStrict == VINF_PGM_CHANGE_MODE
2114	\|\| rcPending == VINF_NEM_CHANGE_PGM_MODE )
2115	{
2116	LogFlow(("nemR3NativeRunGC: calling PGMChangeMode...\n"));
2117	int rc = PGMChangeMode(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR4(pVCpu), CPUMGetGuestEFER(pVCpu));
2118	AssertRCReturn(rc, rc);
2119	if (rcStrict == VINF_NEM_CHANGE_PGM_MODE \|\| rcStrict == VINF_NEM_FLUSH_TLB)
2120	{
2121	if ( !VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK \| VM_FF_HP_R0_PRE_HM_MASK)
2122	&& !VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_HIGH_PRIORITY_POST_MASK \| VMCPU_FF_HP_R0_PRE_HM_MASK)
2123	& ~VMCPU_FF_RESUME_GUEST_MASK))
2124	{
2125	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
2126	continue;
2127	}
2128	rcStrict = VINF_SUCCESS;
2129	}
2130	}
2131	else if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcPending == VINF_NEM_FLUSH_TLB)
2132	{
2133	LogFlow(("nemR3NativeRunGC: calling PGMFlushTLB...\n"));
2134	int rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true);
2135	AssertRCReturn(rc, rc);
2136	if (rcStrict == VINF_NEM_FLUSH_TLB \|\| rcStrict == VINF_NEM_CHANGE_PGM_MODE)
2137	{
2138	if ( !VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK \| VM_FF_HP_R0_PRE_HM_MASK)
2139	&& !VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_HIGH_PRIORITY_POST_MASK \| VMCPU_FF_HP_R0_PRE_HM_MASK)
2140	& ~VMCPU_FF_RESUME_GUEST_MASK))
2141	{
2142	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
2143	continue;
2144	}
2145	rcStrict = VINF_SUCCESS;
2146	}
2147	}
2148	else if (rcStrict == VINF_NEM_UPDATE_APIC_BASE \|\| rcPending == VERR_NEM_UPDATE_APIC_BASE)
2149	continue;
2150	else
2151	AssertMsg(rcPending == VINF_SUCCESS, ("rcPending=%Rrc\n", VBOXSTRICTRC_VAL(rcPending) ));
2152	}
2153	LogFlow(("nemR3NativeRunGC: returns %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
2154	return rcStrict;
2155	}
2156	#endif
2157	}
2158
2159
2160	bool nemR3NativeCanExecuteGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2161	{
2162	NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
2163	return true;
2164	}
2165
2166
2167	bool nemR3NativeSetSingleInstruction(PVM pVM, PVMCPU pVCpu, bool fEnable)
2168	{
2169	NOREF(pVM); NOREF(pVCpu); NOREF(fEnable);
2170	return false;
2171	}
2172
2173
2174	/**
2175	* Forced flag notification call from VMEmt.h.
2176	*
2177	* This is only called when pVCpu is in the VMCPUSTATE_STARTED_EXEC_NEM state.
2178	*
2179	* @param pVM The cross context VM structure.
2180	* @param pVCpu The cross context virtual CPU structure of the CPU
2181	* to be notified.
2182	* @param fFlags Notification flags, VMNOTIFYFF_FLAGS_XXX.
2183	*/
2184	void nemR3NativeNotifyFF(PVM pVM, PVMCPU pVCpu, uint32_t fFlags)
2185	{
2186	#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
2187	nemHCWinCancelRunVirtualProcessor(pVM, pVCpu);
2188	#else
2189	Log8(("nemR3NativeNotifyFF: canceling %u\n", pVCpu->idCpu));
2190	HRESULT hrc = WHvCancelRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, 0);
2191	AssertMsg(SUCCEEDED(hrc), ("WHvCancelRunVirtualProcessor -> hrc=%Rhrc\n", hrc));
2192	RT_NOREF_PV(hrc);
2193	#endif
2194	RT_NOREF_PV(fFlags);
2195	}
2196
2197
2198	DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv)
2199	{
2200	PGMPAGEMAPLOCK Lock;
2201	int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, &Lock);
2202	if (RT_SUCCESS(rc))
2203	PGMPhysReleasePageMappingLock(pVM, &Lock);
2204	return rc;
2205	}
2206
2207
2208	DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv)
2209	{
2210	PGMPAGEMAPLOCK Lock;
2211	int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, &Lock);
2212	if (RT_SUCCESS(rc))
2213	PGMPhysReleasePageMappingLock(pVM, &Lock);
2214	return rc;
2215	}
2216
2217
2218	int nemR3NativeNotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb)
2219	{
2220	Log5(("nemR3NativeNotifyPhysRamRegister: %RGp LB %RGp\n", GCPhys, cb));
2221	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2222	return VINF_SUCCESS;
2223	}
2224
2225
2226	int nemR3NativeNotifyPhysMmioExMap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags, void *pvMmio2)
2227	{
2228	Log5(("nemR3NativeNotifyPhysMmioExMap: %RGp LB %RGp fFlags=%#x pvMmio2=%p\n", GCPhys, cb, fFlags, pvMmio2));
2229	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags); NOREF(pvMmio2);
2230	return VINF_SUCCESS;
2231	}
2232
2233
2234	int nemR3NativeNotifyPhysMmioExUnmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2235	{
2236	Log5(("nemR3NativeNotifyPhysMmioExUnmap: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2237	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2238	return VINF_SUCCESS;
2239	}
2240
2241
2242	/**
2243	* Called early during ROM registration, right after the pages have been
2244	* allocated and the RAM range updated.
2245	*
2246	* This will be succeeded by a number of NEMHCNotifyPhysPageProtChanged() calls
2247	* and finally a NEMR3NotifyPhysRomRegisterEarly().
2248	*
2249	* @returns VBox status code
2250	* @param pVM The cross context VM structure.
2251	* @param GCPhys The ROM address (page aligned).
2252	* @param cb The size (page aligned).
2253	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2254	*/
2255	int nemR3NativeNotifyPhysRomRegisterEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2256	{
2257	Log5(("nemR3NativeNotifyPhysRomRegisterEarly: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2258	#if 0 /* Let's not do this after all. We'll protection change notifications for each page and if not we'll map them lazily. */
2259	RTGCPHYS const cPages = cb >> X86_PAGE_SHIFT;
2260	for (RTGCPHYS iPage = 0; iPage < cPages; iPage++, GCPhys += X86_PAGE_SIZE)
2261	{
2262	const void *pvPage;
2263	int rc = nemR3NativeGCPhys2R3PtrReadOnly(pVM, GCPhys, &pvPage);
2264	if (RT_SUCCESS(rc))
2265	{
2266	HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, (void *)pvPage, GCPhys, X86_PAGE_SIZE,
2267	WHvMapGpaRangeFlagRead \| WHvMapGpaRangeFlagExecute);
2268	if (SUCCEEDED(hrc))
2269	{ /* likely */ }
2270	else
2271	{
2272	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2273	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2274	return VERR_NEM_INIT_FAILED;
2275	}
2276	}
2277	else
2278	{
2279	LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2280	return rc;
2281	}
2282	}
2283	#else
2284	NOREF(pVM); NOREF(GCPhys); NOREF(cb);
2285	#endif
2286	RT_NOREF_PV(fFlags);
2287	return VINF_SUCCESS;
2288	}
2289
2290
2291	/**
2292	* Called after the ROM range has been fully completed.
2293	*
2294	* This will be preceeded by a NEMR3NotifyPhysRomRegisterEarly() call as well a
2295	* number of NEMHCNotifyPhysPageProtChanged calls.
2296	*
2297	* @returns VBox status code
2298	* @param pVM The cross context VM structure.
2299	* @param GCPhys The ROM address (page aligned).
2300	* @param cb The size (page aligned).
2301	* @param fFlags NEM_NOTIFY_PHYS_ROM_F_XXX.
2302	*/
2303	int nemR3NativeNotifyPhysRomRegisterLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags)
2304	{
2305	Log5(("nemR3NativeNotifyPhysRomRegisterLate: %RGp LB %RGp fFlags=%#x\n", GCPhys, cb, fFlags));
2306	NOREF(pVM); NOREF(GCPhys); NOREF(cb); NOREF(fFlags);
2307	return VINF_SUCCESS;
2308	}
2309
2310
2311	/**
2312	* @callback_method_impl{FNPGMPHYSNEMCHECKPAGE}
2313	*/
2314	static DECLCALLBACK(int) nemR3WinUnsetForA20CheckerCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys,
2315	PPGMPHYSNEMPAGEINFO pInfo, void *pvUser)
2316	{
2317	/* We'll just unmap the memory. */
2318	if (pInfo->u2NemState > NEM_WIN_PAGE_STATE_UNMAPPED)
2319	{
2320	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2321	int rc = nemHCWinHypercallUnmapPage(pVM, pVCpu, GCPhys);
2322	AssertRC(rc);
2323	if (RT_SUCCESS(rc))
2324	#else
2325	HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
2326	if (SUCCEEDED(hrc))
2327	#endif
2328	{
2329	uint32_t cMappedPages = ASMAtomicDecU32(&pVM->nem.s.cMappedPages); NOREF(cMappedPages);
2330	Log5(("NEM GPA unmapped/A20: %RGp (was %s, cMappedPages=%u)\n", GCPhys, g_apszPageStates[pInfo->u2NemState], cMappedPages));
2331	pInfo->u2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
2332	}
2333	else
2334	{
2335	#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2336	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2337	return rc;
2338	#else
2339	LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2340	GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2341	return VERR_INTERNAL_ERROR_2;
2342	#endif
2343	}
2344	}
2345	RT_NOREF(pVCpu, pvUser);
2346	return VINF_SUCCESS;
2347	}
2348
2349
2350	/**
2351	* Unmaps a page from Hyper-V for the purpose of emulating A20 gate behavior.
2352	*
2353	* @returns The PGMPhysNemQueryPageInfo result.
2354	* @param pVM The cross context VM structure.
2355	* @param pVCpu The cross context virtual CPU structure.
2356	* @param GCPhys The page to unmap.
2357	*/
2358	static int nemR3WinUnmapPageForA20Gate(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2359	{
2360	PGMPHYSNEMPAGEINFO Info;
2361	return PGMPhysNemPageInfoChecker(pVM, pVCpu, GCPhys, false /fMakeWritable/, &Info,
2362	nemR3WinUnsetForA20CheckerCallback, NULL);
2363	}
2364
2365
2366	/**
2367	* Called when the A20 state changes.
2368	*
2369	* Hyper-V doesn't seem to offer a simple way of implementing the A20 line
2370	* features of PCs. So, we do a very minimal emulation of the HMA to make DOS
2371	* happy.
2372	*
2373	* @param pVCpu The CPU the A20 state changed on.
2374	* @param fEnabled Whether it was enabled (true) or disabled.
2375	*/
2376	void nemR3NativeNotifySetA20(PVMCPU pVCpu, bool fEnabled)
2377	{
2378	Log(("nemR3NativeNotifySetA20: fEnabled=%RTbool\n", fEnabled));
2379	PVM pVM = pVCpu->CTX_SUFF(pVM);
2380	if (!pVM->nem.s.fA20Fixed)
2381	{
2382	pVM->nem.s.fA20Enabled = fEnabled;
2383	for (RTGCPHYS GCPhys = _1M; GCPhys < _1M + _64K; GCPhys += X86_PAGE_SIZE)
2384	nemR3WinUnmapPageForA20Gate(pVM, pVCpu, GCPhys);
2385	}
2386	}
2387
2388
2389	/** @page pg_nem_win NEM/win - Native Execution Manager, Windows.
2390	*
2391	* On Windows the Hyper-V root partition (dom0 in zen terminology) does not have
2392	* nested VT-x or AMD-V capabilities. For a while raw-mode worked inside it,
2393	* but for a while now we've been getting \#GP when trying to modify CR4 in the
2394	* world switcher. So, when Hyper-V is active on Windows we have little choice
2395	* but to use Hyper-V to run our VMs.
2396	*
2397	*
2398	* @section sub_nem_win_whv The WinHvPlatform API
2399	*
2400	* Since Windows 10 build 17083 there is a documented API for managing Hyper-V
2401	* VMs, header file WinHvPlatform.h and implementation in WinHvPlatform.dll.
2402	* This interface is a wrapper around the undocumented Virtualization
2403	* Infrastructure Driver (VID) API - VID.DLL and VID.SYS. The wrapper is
2404	* written in C++, namespaced, early versions (at least) was using standard C++
2405	* container templates in several places.
2406	*
2407	* When creating a VM using WHvCreatePartition, it will only create the
2408	* WinHvPlatform structures for it, to which you get an abstract pointer. The
2409	* VID API that actually creates the partition is first engaged when you call
2410	* WHvSetupPartition after first setting a lot of properties using
2411	* WHvSetPartitionProperty. Since the VID API is just a very thin wrapper
2412	* around CreateFile and NtDeviceIoControlFile, it returns an actual HANDLE for
2413	* the partition WinHvPlatform. We fish this HANDLE out of the WinHvPlatform
2414	* partition structures because we need to talk directly to VID for reasons
2415	* we'll get to in a bit. (Btw. we could also intercept the CreateFileW or
2416	* NtDeviceIoControlFile calls from VID.DLL to get the HANDLE should fishing in
2417	* the partition structures become difficult.)
2418	*
2419	* The WinHvPlatform API requires us to both set the number of guest CPUs before
2420	* setting up the partition and call WHvCreateVirtualProcessor for each of them.
2421	* The CPU creation function boils down to a VidMessageSlotMap call that sets up
2422	* and maps a message buffer into ring-3 for async communication with hyper-V
2423	* and/or the VID.SYS thread actually running the CPU thru
2424	* WinHvRunVpDispatchLoop(). When for instance a VMEXIT is encountered, hyper-V
2425	* sends a message that the WHvRunVirtualProcessor API retrieves (and later
2426	* acknowledges) via VidMessageSlotHandleAndGetNext. It should be noteded that
2427	* WHvDeleteVirtualProcessor doesn't do much as there seems to be no partner
2428	* function VidMessagesSlotMap that reverses what it did.
2429	*
2430	* Memory is managed thru calls to WHvMapGpaRange and WHvUnmapGpaRange (GPA does
2431	* not mean grade point average here, but rather guest physical addressspace),
2432	* which corresponds to VidCreateVaGpaRangeSpecifyUserVa and VidDestroyGpaRange
2433	* respectively. As 'UserVa' indicates, the functions works on user process
2434	* memory. The mappings are also subject to quota restrictions, so the number
2435	* of ranges are limited and probably their total size as well. Obviously
2436	* VID.SYS keeps track of the ranges, but so does WinHvPlatform, which means
2437	* there is a bit of overhead involved and quota restrctions makes sense. For
2438	* some reason though, regions are lazily mapped on VMEXIT/memory by
2439	* WHvRunVirtualProcessor.
2440	*
2441	* Running guest code is done thru the WHvRunVirtualProcessor function. It
2442	* asynchronously starts or resumes hyper-V CPU execution and then waits for an
2443	* VMEXIT message. Hyper-V / VID.SYS will return information about the message
2444	* in the message buffer mapping, and WHvRunVirtualProcessor will convert that
2445	* finto it's own WHV_RUN_VP_EXIT_CONTEXT format.
2446	*
2447	* Other threads can interrupt the execution by using WHvCancelVirtualProcessor,
2448	* which which case the thread in WHvRunVirtualProcessor is woken up via a dummy
2449	* QueueUserAPC and will call VidStopVirtualProcessor to asynchronously end
2450	* execution. The stop CPU call not immediately succeed if the CPU encountered
2451	* a VMEXIT before the stop was processed, in which case the VMEXIT needs to be
2452	* processed first, and the pending stop will be processed in a subsequent call
2453	* to WHvRunVirtualProcessor.
2454	*
2455	* Registers are retrieved and set via WHvGetVirtualProcessorRegisters and
2456	* WHvSetVirtualProcessorRegisters. In addition, several VMEXITs include
2457	* essential register state in the exit context information, potentially making
2458	* it possible to emulate the instruction causing the exit without involving
2459	* WHvGetVirtualProcessorRegisters.
2460	*
2461	*
2462	* @subsection subsec_nem_win_whv_cons Issues & Feedback
2463	*
2464	* Here are some observations (mostly against build 17101):
2465	*
2466	* - The VMEXIT performance is dismal (build 17134).
2467	*
2468	* Our proof of concept implementation with a kernel runloop (i.e. not using
2469	* WHvRunVirtualProcessor and friends, but calling VID.SYS fast I/O control
2470	* entry point directly) delivers 9-10% of the port I/O performance and only
2471	* 6-7% of the MMIO performance that we have with our own hypervisor.
2472	*
2473	* When using the offical WinHvPlatform API, the numbers are %3 for port I/O
2474	* and 5% for MMIO.
2475	*
2476	* While the tests we've done are using tight tight loops only doing port I/O
2477	* and MMIO, the problem is clearly visible when running regular guest OSes.
2478	* Anything that hammers the VGA device would be suffering, for example:
2479	*
2480	* - Windows 2000 boot screen animation overloads us with MMIO exits
2481	* and won't even boot because all the time is spent in interrupt
2482	* handlers and redrawin the screen.
2483	*
2484	* - DSL 4.4 and its bootmenu logo is slower than molasses in january.
2485	*
2486	* We have not found a workaround for this yet.
2487	*
2488	* Something that might improve the issue a little is to detect blocks with
2489	* excessive MMIO and port I/O exits and emulate instructions to cover
2490	* multiple exits before letting Hyper-V have a go at the guest execution
2491	* again. This will only improve the situation under some circumstances,
2492	* since emulating instructions without recompilation can be expensive, so
2493	* there will only be real gains if the exitting instructions are tightly
2494	* packed.
2495	*
2496	*
2497	* - Unable to access WHvX64RegisterMsrMtrrCap on AMD Ryzen (build 17134).
2498	*
2499	*
2500	* - On AMD Ryzen grub/debian 9.0 ends up with a unrecoverable exception
2501	* when IA32_MTRR_PHYSMASK0 is written.
2502	*
2503	*
2504	* - The IA32_APIC_BASE register does not work right:
2505	*
2506	* - Attempts by the guest to clear bit 11 (EN) are ignored, both the
2507	* guest and the VMM reads back the old value.
2508	*
2509	* - Attempts to modify the base address (bits NN:12) seems to be ignored
2510	* in the same way.
2511	*
2512	* - The VMM can modify both the base address as well as the the EN and
2513	* BSP bits, however this is useless if we cannot intercept the WRMSR.
2514	*
2515	* - Attempts by the guest to set the EXTD bit (X2APIC) result in \#GP(0),
2516	* while the VMM ends up with with ERROR_HV_INVALID_PARAMETER. Seems
2517	* there is no way to support X2APIC.
2518	*
2519	*
2520	* - The WHvCancelVirtualProcessor API schedules a dummy usermode APC callback
2521	* in order to cancel any current or future alertable wait in VID.SYS during
2522	* the VidMessageSlotHandleAndGetNext call.
2523	*
2524	* IIRC this will make the kernel schedule the specified callback thru
2525	* NTDLL!KiUserApcDispatcher by modifying the thread context and quite
2526	* possibly the userland thread stack. When the APC callback returns to
2527	* KiUserApcDispatcher, it will call NtContinue to restore the old thread
2528	* context and resume execution from there. This naturally adds up to some
2529	* CPU cycles, ring transitions aren't for free, especially after Spectre &
2530	* Meltdown mitigations.
2531	*
2532	* Using NtAltertThread call could do the same without the thread context
2533	* modifications and the extra kernel call.
2534	*
2535	*
2536	* - Not sure if this is a thing, but WHvCancelVirtualProcessor seems to cause
2537	* cause a lot more spurious WHvRunVirtualProcessor returns that what we get
2538	* with the replacement code. By spurious returns we mean that the
2539	* subsequent call to WHvRunVirtualProcessor would return immediately.
2540	*
2541	*
2542	* - When WHvRunVirtualProcessor returns without a message, or on a terse
2543	* VID message like HLT, it will make a kernel call to get some registers.
2544	* This is potentially inefficient if the caller decides he needs more
2545	* register state.
2546	*
2547	* It would be better to just return what's available and let the caller fetch
2548	* what is missing from his point of view in a single kernel call.
2549	*
2550	*
2551	* - The WHvRunVirtualProcessor implementation does lazy GPA range mappings when
2552	* a unmapped GPA message is received from hyper-V.
2553	*
2554	* Since MMIO is currently realized as unmapped GPA, this will slow down all
2555	* MMIO accesses a tiny little bit as WHvRunVirtualProcessor looks up the
2556	* guest physical address to check if it is a pending lazy mapping.
2557	*
2558	* The lazy mapping feature makes no sense to us. We as API user have all the
2559	* information and can do lazy mapping ourselves if we want/have to (see next
2560	* point).
2561	*
2562	*
2563	* - There is no API for modifying protection of a page within a GPA range.
2564	*
2565	* From what we can tell, the only way to modify the protection (like readonly
2566	* -> writable, or vice versa) is to first unmap the range and then remap it
2567	* with the new protection.
2568	*
2569	* We are for instance doing this quite a bit in order to track dirty VRAM
2570	* pages. VRAM pages starts out as readonly, when the guest writes to a page
2571	* we take an exit, notes down which page it is, makes it writable and restart
2572	* the instruction. After refreshing the display, we reset all the writable
2573	* pages to readonly again, bulk fashion.
2574	*
2575	* Now to work around this issue, we do page sized GPA ranges. In addition to
2576	* add a lot of tracking overhead to WinHvPlatform and VID.SYS, this also
2577	* causes us to exceed our quota before we've even mapped a default sized
2578	* (128MB) VRAM page-by-page. So, to work around this quota issue we have to
2579	* lazily map pages and actively restrict the number of mappings.
2580	*
2581	* Our best workaround thus far is bypassing WinHvPlatform and VID entirely
2582	* when in comes to guest memory management and instead use the underlying
2583	* hypercalls (HvCallMapGpaPages, HvCallUnmapGpaPages) to do it ourselves.
2584	* (This also maps a whole lot better into our own guest page management
2585	* infrastructure.)
2586	*
2587	*
2588	* - Observed problems doing WHvUnmapGpaRange immediately followed by
2589	* WHvMapGpaRange.
2590	*
2591	* As mentioned above, we've been forced to use this sequence when modifying
2592	* page protection. However, when transitioning from readonly to writable,
2593	* we've ended up looping forever with the same write to readonly memory
2594	* VMEXIT. We're wondering if this issue might be related to the lazy mapping
2595	* logic in WinHvPlatform.
2596	*
2597	* Workaround: Insert a WHvRunVirtualProcessor call and make sure to get a GPA
2598	* unmapped exit between the two calls. Not entirely great performance wise
2599	* (or the santity of our code).
2600	*
2601	*
2602	* - Implementing A20 gate behavior is tedious, where as correctly emulating the
2603	* A20M# pin (present on 486 and later) is near impossible for SMP setups
2604	* (e.g. possiblity of two CPUs with different A20 status).
2605	*
2606	* Workaround: Only do A20 on CPU 0, restricting the emulation to HMA. We
2607	* unmap all pages related to HMA (0x100000..0x10ffff) when the A20 state
2608	* changes, lazily syncing the right pages back when accessed.
2609	*
2610	*
2611	* - WHVRunVirtualProcessor wastes time converting VID/Hyper-V messages to its
2612	* own format (WHV_RUN_VP_EXIT_CONTEXT).
2613	*
2614	* We understand this might be because Microsoft wishes to remain free to
2615	* modify the VID/Hyper-V messages, but it's still rather silly and does slow
2616	* things down a little. We'd much rather just process the messages directly.
2617	*
2618	*
2619	* - WHVRunVirtualProcessor would've benefited from using a callback interface:
2620	*
2621	* - The potential size changes of the exit context structure wouldn't be
2622	* an issue, since the function could manage that itself.
2623	*
2624	* - State handling could probably be simplified (like cancelation).
2625	*
2626	*
2627	* - WHvGetVirtualProcessorRegisters and WHvSetVirtualProcessorRegisters
2628	* internally converts register names, probably using temporary heap buffers.
2629	*
2630	* From the looks of things, they are converting from WHV_REGISTER_NAME to
2631	* HV_REGISTER_NAME from in the "Virtual Processor Register Names" section in
2632	* the "Hypervisor Top-Level Functional Specification" document. This feels
2633	* like an awful waste of time.
2634	*
2635	* We simply cannot understand why HV_REGISTER_NAME isn't used directly here,
2636	* or at least the same values, making any conversion reduntant. Restricting
2637	* access to certain registers could easily be implement by scanning the
2638	* inputs.
2639	*
2640	* To avoid the heap + conversion overhead, we're currently using the
2641	* HvCallGetVpRegisters and HvCallSetVpRegisters calls directly.
2642	*
2643	*
2644	* - The YMM and XCR0 registers are not yet named (17083). This probably
2645	* wouldn't be a problem if HV_REGISTER_NAME was used, see previous point.
2646	*
2647	*
2648	* - Why does VID.SYS only query/set 32 registers at the time thru the
2649	* HvCallGetVpRegisters and HvCallSetVpRegisters hypercalls?
2650	*
2651	* We've not trouble getting/setting all the registers defined by
2652	* WHV_REGISTER_NAME in one hypercall (around 80). Some kind of stack
2653	* buffering or similar?
2654	*
2655	*
2656	* - To handle the VMMCALL / VMCALL instructions, it seems we need to intercept
2657	* \#UD exceptions and inspect the opcodes. A dedicated exit for hypercalls
2658	* would be more efficient, esp. for guests using \#UD for other purposes..
2659	*
2660	*
2661	* - Wrong instruction length in the VpContext with unmapped GPA memory exit
2662	* contexts on 17115/AMD.
2663	*
2664	* One byte "PUSH CS" was reported as 2 bytes, while a two byte
2665	* "MOV [EBX],EAX" was reported with a 1 byte instruction length. Problem
2666	* naturally present in untranslated hyper-v messages.
2667	*
2668	*
2669	* - The I/O port exit context information seems to be missing the address size
2670	* information needed for correct string I/O emulation.
2671	*
2672	* VT-x provides this information in bits 7:9 in the instruction information
2673	* field on newer CPUs. AMD-V in bits 7:9 in the EXITINFO1 field in the VMCB.
2674	*
2675	* We can probably work around this by scanning the instruction bytes for
2676	* address size prefixes. Haven't investigated it any further yet.
2677	*
2678	*
2679	* - The WHvGetCapability function has a weird design:
2680	* - The CapabilityCode parameter is pointlessly duplicated in the output
2681	* structure (WHV_CAPABILITY).
2682	*
2683	* - API takes void pointer, but everyone will probably be using
2684	* WHV_CAPABILITY due to WHV_CAPABILITY::CapabilityCode making it
2685	* impractical to use anything else.
2686	*
2687	* - No output size.
2688	*
2689	* - See GetFileAttributesEx, GetFileInformationByHandleEx,
2690	* FindFirstFileEx, and others for typical pattern for generic
2691	* information getters.
2692	*
2693	* Update: All concerns have been addressed in build 17110.
2694	*
2695	*
2696	* - The WHvGetPartitionProperty function uses the same weird design as
2697	* WHvGetCapability, see above.
2698	*
2699	* Update: All concerns have been addressed in build 17110.
2700	*
2701	*
2702	* - The WHvSetPartitionProperty function has a totally weird design too:
2703	* - In contrast to its partner WHvGetPartitionProperty, the property code
2704	* is not a separate input parameter here but part of the input
2705	* structure.
2706	*
2707	* - The input structure is a void pointer rather than a pointer to
2708	* WHV_PARTITION_PROPERTY which everyone probably will be using because
2709	* of the WHV_PARTITION_PROPERTY::PropertyCode field.
2710	*
2711	* - Really, why use PVOID for the input when the function isn't accepting
2712	* minimal sizes. E.g. WHVPartitionPropertyCodeProcessorClFlushSize only
2713	* requires a 9 byte input, but the function insists on 16 bytes (17083).
2714	*
2715	* - See GetFileAttributesEx, SetFileInformationByHandle, FindFirstFileEx,
2716	* and others for typical pattern for generic information setters and
2717	* getters.
2718	*
2719	* Update: All concerns have been addressed in build 17110.
2720	*
2721	*
2722	*
2723	* @section sec_nem_win_impl Our implementation.
2724	*
2725	* We set out with the goal of wanting to run as much as possible in ring-0,
2726	* reasoning that this would give use the best performance.
2727	*
2728	* This goal was approached gradually, starting out with a pure WinHvPlatform
2729	* implementation, gradually replacing parts: register access, guest memory
2730	* handling, running virtual processors. Then finally moving it all into
2731	* ring-0, while keeping most of it configurable so that we could make
2732	* comparisons (see NEMInternal.h and nemR3NativeRunGC()).
2733	*
2734	*
2735	* @subsection subsect_nem_win_impl_ioctl VID.SYS I/O control calls
2736	*
2737	* To run things in ring-0 we need to talk directly to VID.SYS thru its I/O
2738	* control interface. Looking at changes between like build 17083 and 17101 (if
2739	* memory serves) a set of the VID I/O control numbers shifted a little, which
2740	* means we need to determin them dynamically. We currently do this by hooking
2741	* the NtDeviceIoControlFile API call from VID.DLL and snooping up the
2742	* parameters when making dummy calls to relevant APIs. (We could also
2743	* disassemble the relevant APIs and try fish out the information from that, but
2744	* this is way simpler.)
2745	*
2746	* Issuing I/O control calls from ring-0 is facing a small challenge with
2747	* respect to direct buffering. When using direct buffering the device will
2748	* typically check that the buffer is actually in the user address space range
2749	* and reject kernel addresses. Fortunately, we've got the cross context VM
2750	* structure that is mapped into both kernel and user space, it's also locked
2751	* and safe to access from kernel space. So, we place the I/O control buffers
2752	* in the per-CPU part of it (NEMCPU::uIoCtlBuf) and give the driver the user
2753	* address if direct access buffering or kernel address if not.
2754	*
2755	* The I/O control calls are 'abstracted' in the support driver, see
2756	* SUPR0IoCtlSetupForHandle(), SUPR0IoCtlPerform() and SUPR0IoCtlCleanup().
2757	*
2758	*
2759	* @subsection subsect_nem_win_impl_cpumctx CPUMCTX
2760	*
2761	* Since the CPU state needs to live in Hyper-V when executing, we probably
2762	* should not transfer more than necessary when handling VMEXITs. To help us
2763	* manage this CPUMCTX got a new field CPUMCTX::fExtrn that to indicate which
2764	* part of the state is currently externalized (== in Hyper-V).
2765	*
2766	*
2767	*/
2768

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp@ 72451

Download in other formats: