VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp@ 92443

Last change on this file since 92443 was 92443, checked in by vboxsync, 3 years ago

VMM/NEM-win: More NUC 11 bs3-memalloc-1 numbers and a comment. bugref:10122
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 168.3 KB
Line 
1/* $Id: NEMR3Native-win.cpp 92443 2021-11-15 21:38:37Z vboxsync $ */
2/** @file
3 * NEM - Native execution manager, native ring-3 Windows backend.
4 *
5 * Log group 2: Exit logging.
6 * Log group 3: Log context on exit.
7 * Log group 5: Ring-3 memory management
8 * Log group 6: Ring-0 memory management
9 * Log group 12: API intercepts.
10 */
11
12/*
13 * Copyright (C) 2018-2020 Oracle Corporation
14 *
15 * This file is part of VirtualBox Open Source Edition (OSE), as
16 * available from http://www.virtualbox.org. This file is free software;
17 * you can redistribute it and/or modify it under the terms of the GNU
18 * General Public License (GPL) as published by the Free Software
19 * Foundation, in version 2 as it comes in the "COPYING" file of the
20 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
21 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
22 */
23
24
25/*********************************************************************************************************************************
26* Header Files *
27*********************************************************************************************************************************/
28#define LOG_GROUP LOG_GROUP_NEM
29#define VMCPU_INCL_CPUM_GST_CTX
30#include <iprt/nt/nt-and-windows.h>
31#include <iprt/nt/hyperv.h>
32#include <iprt/nt/vid.h>
33#include <WinHvPlatform.h>
34
35#ifndef _WIN32_WINNT_WIN10
36# error "Missing _WIN32_WINNT_WIN10"
37#endif
38#ifndef _WIN32_WINNT_WIN10_RS1 /* Missing define, causing trouble for us. */
39# define _WIN32_WINNT_WIN10_RS1 (_WIN32_WINNT_WIN10 + 1)
40#endif
41#include <sysinfoapi.h>
42#include <debugapi.h>
43#include <errhandlingapi.h>
44#include <fileapi.h>
45#include <winerror.h> /* no api header for this. */
46
47#include <VBox/vmm/nem.h>
48#include <VBox/vmm/iem.h>
49#include <VBox/vmm/em.h>
50#include <VBox/vmm/apic.h>
51#include <VBox/vmm/pdm.h>
52#include <VBox/vmm/dbgftrace.h>
53#include "NEMInternal.h"
54#include <VBox/vmm/vmcc.h>
55
56#include <iprt/ldr.h>
57#include <iprt/path.h>
58#include <iprt/string.h>
59#include <iprt/system.h>
60#include <iprt/utf16.h>
61
62#ifndef NTDDI_WIN10_VB /* Present in W10 2004 SDK, quite possibly earlier. */
63HRESULT WINAPI WHvQueryGpaRangeDirtyBitmap(WHV_PARTITION_HANDLE, WHV_GUEST_PHYSICAL_ADDRESS, UINT64, UINT64 *, UINT32);
64# define WHvMapGpaRangeFlagTrackDirtyPages ((WHV_MAP_GPA_RANGE_FLAGS)0x00000008)
65#endif
66
67
68/*********************************************************************************************************************************
69* Defined Constants And Macros *
70*********************************************************************************************************************************/
71#ifdef LOG_ENABLED
72# define NEM_WIN_INTERCEPT_NT_IO_CTLS
73#endif
74
75/** VID I/O control detection: Fake partition handle input. */
76#define NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE ((HANDLE)(uintptr_t)38479125)
77/** VID I/O control detection: Fake partition ID return. */
78#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID UINT64_C(0xfa1e000042424242)
79/** VID I/O control detection: The property we get via VidGetPartitionProperty. */
80#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE HvPartitionPropertyProcessorVendor
81/** VID I/O control detection: Fake property value return. */
82#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE UINT64_C(0xf00dface01020304)
83/** VID I/O control detection: Fake CPU index input. */
84#define NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX UINT32_C(42)
85/** VID I/O control detection: Fake timeout input. */
86#define NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT UINT32_C(0x00080286)
87
88
89/*********************************************************************************************************************************
90* Global Variables *
91*********************************************************************************************************************************/
92/** @name APIs imported from WinHvPlatform.dll
93 * @{ */
94static decltype(WHvGetCapability) * g_pfnWHvGetCapability;
95static decltype(WHvCreatePartition) * g_pfnWHvCreatePartition;
96static decltype(WHvSetupPartition) * g_pfnWHvSetupPartition;
97static decltype(WHvDeletePartition) * g_pfnWHvDeletePartition;
98static decltype(WHvGetPartitionProperty) * g_pfnWHvGetPartitionProperty;
99static decltype(WHvSetPartitionProperty) * g_pfnWHvSetPartitionProperty;
100static decltype(WHvMapGpaRange) * g_pfnWHvMapGpaRange;
101static decltype(WHvUnmapGpaRange) * g_pfnWHvUnmapGpaRange;
102static decltype(WHvTranslateGva) * g_pfnWHvTranslateGva;
103static decltype(WHvQueryGpaRangeDirtyBitmap) * g_pfnWHvQueryGpaRangeDirtyBitmap;
104#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
105static decltype(WHvCreateVirtualProcessor) * g_pfnWHvCreateVirtualProcessor;
106static decltype(WHvDeleteVirtualProcessor) * g_pfnWHvDeleteVirtualProcessor;
107static decltype(WHvRunVirtualProcessor) * g_pfnWHvRunVirtualProcessor;
108static decltype(WHvCancelRunVirtualProcessor) * g_pfnWHvCancelRunVirtualProcessor;
109static decltype(WHvGetVirtualProcessorRegisters) * g_pfnWHvGetVirtualProcessorRegisters;
110static decltype(WHvSetVirtualProcessorRegisters) * g_pfnWHvSetVirtualProcessorRegisters;
111#endif
112/** @} */
113
114/** @name APIs imported from Vid.dll
115 * @{ */
116static decltype(VidGetHvPartitionId) *g_pfnVidGetHvPartitionId;
117static decltype(VidGetPartitionProperty) *g_pfnVidGetPartitionProperty;
118static decltype(VidStartVirtualProcessor) *g_pfnVidStartVirtualProcessor;
119static decltype(VidStopVirtualProcessor) *g_pfnVidStopVirtualProcessor;
120static decltype(VidMessageSlotMap) *g_pfnVidMessageSlotMap;
121static decltype(VidMessageSlotHandleAndGetNext) *g_pfnVidMessageSlotHandleAndGetNext;
122#ifdef LOG_ENABLED
123static decltype(VidGetVirtualProcessorState) *g_pfnVidGetVirtualProcessorState;
124static decltype(VidSetVirtualProcessorState) *g_pfnVidSetVirtualProcessorState;
125static decltype(VidGetVirtualProcessorRunningStatus) *g_pfnVidGetVirtualProcessorRunningStatus;
126#endif
127/** @} */
128
129/** The Windows build number. */
130static uint32_t g_uBuildNo = 17134;
131
132
133
134/**
135 * Import instructions.
136 */
137static const struct
138{
139 uint8_t idxDll; /**< 0 for WinHvPlatform.dll, 1 for vid.dll. */
140 bool fOptional; /**< Set if import is optional. */
141 PFNRT *ppfn; /**< The function pointer variable. */
142 const char *pszName; /**< The function name. */
143} g_aImports[] =
144{
145#define NEM_WIN_IMPORT(a_idxDll, a_fOptional, a_Name) { (a_idxDll), (a_fOptional), (PFNRT *)&RT_CONCAT(g_pfn,a_Name), #a_Name }
146 NEM_WIN_IMPORT(0, false, WHvGetCapability),
147 NEM_WIN_IMPORT(0, false, WHvCreatePartition),
148 NEM_WIN_IMPORT(0, false, WHvSetupPartition),
149 NEM_WIN_IMPORT(0, false, WHvDeletePartition),
150 NEM_WIN_IMPORT(0, false, WHvGetPartitionProperty),
151 NEM_WIN_IMPORT(0, false, WHvSetPartitionProperty),
152 NEM_WIN_IMPORT(0, false, WHvMapGpaRange),
153 NEM_WIN_IMPORT(0, false, WHvUnmapGpaRange),
154 NEM_WIN_IMPORT(0, false, WHvTranslateGva),
155 NEM_WIN_IMPORT(0, true, WHvQueryGpaRangeDirtyBitmap),
156#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
157 NEM_WIN_IMPORT(0, false, WHvCreateVirtualProcessor),
158 NEM_WIN_IMPORT(0, false, WHvDeleteVirtualProcessor),
159 NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
160 NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
161 NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
162 NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
163#endif
164 NEM_WIN_IMPORT(1, false, VidGetHvPartitionId),
165 NEM_WIN_IMPORT(1, false, VidGetPartitionProperty),
166 NEM_WIN_IMPORT(1, false, VidMessageSlotMap),
167 NEM_WIN_IMPORT(1, false, VidMessageSlotHandleAndGetNext),
168 NEM_WIN_IMPORT(1, false, VidStartVirtualProcessor),
169 NEM_WIN_IMPORT(1, false, VidStopVirtualProcessor),
170#ifdef LOG_ENABLED
171 NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorState),
172 NEM_WIN_IMPORT(1, false, VidSetVirtualProcessorState),
173 NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorRunningStatus),
174#endif
175#undef NEM_WIN_IMPORT
176};
177
178
179/** The real NtDeviceIoControlFile API in NTDLL. */
180static decltype(NtDeviceIoControlFile) *g_pfnNtDeviceIoControlFile;
181/** Pointer to the NtDeviceIoControlFile import table entry. */
182static decltype(NtDeviceIoControlFile) **g_ppfnVidNtDeviceIoControlFile;
183#if defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) || defined(LOG_ENABLED)
184/** Info about the VidGetHvPartitionId I/O control interface. */
185static NEMWINIOCTL g_IoCtlGetHvPartitionId;
186/** Info about the VidGetPartitionProperty I/O control interface. */
187static NEMWINIOCTL g_IoCtlGetPartitionProperty;
188#endif
189#if defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(LOG_ENABLED)
190/** Info about the VidStartVirtualProcessor I/O control interface. */
191static NEMWINIOCTL g_IoCtlStartVirtualProcessor;
192/** Info about the VidStopVirtualProcessor I/O control interface. */
193static NEMWINIOCTL g_IoCtlStopVirtualProcessor;
194/** Info about the VidMessageSlotHandleAndGetNext I/O control interface. */
195static NEMWINIOCTL g_IoCtlMessageSlotHandleAndGetNext;
196#endif
197#ifdef LOG_ENABLED
198/** Info about the VidMessageSlotMap I/O control interface - for logging. */
199static NEMWINIOCTL g_IoCtlMessageSlotMap;
200/** Info about the VidGetVirtualProcessorState I/O control interface - for logging. */
201static NEMWINIOCTL g_IoCtlGetVirtualProcessorState;
202/** Info about the VidSetVirtualProcessorState I/O control interface - for logging. */
203static NEMWINIOCTL g_IoCtlSetVirtualProcessorState;
204/** Pointer to what nemR3WinIoctlDetector_ForLogging should fill in. */
205static NEMWINIOCTL *g_pIoCtlDetectForLogging;
206#endif
207
208#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
209/** Mapping slot for CPU #0.
210 * @{ */
211static VID_MESSAGE_MAPPING_HEADER *g_pMsgSlotMapping = NULL;
212static const HV_MESSAGE_HEADER *g_pHvMsgHdr;
213static const HV_X64_INTERCEPT_MESSAGE_HEADER *g_pX64MsgHdr;
214/** @} */
215#endif
216
217
218/*
219 * Let the preprocessor alias the APIs to import variables for better autocompletion.
220 */
221#ifndef IN_SLICKEDIT
222# define WHvGetCapability g_pfnWHvGetCapability
223# define WHvCreatePartition g_pfnWHvCreatePartition
224# define WHvSetupPartition g_pfnWHvSetupPartition
225# define WHvDeletePartition g_pfnWHvDeletePartition
226# define WHvGetPartitionProperty g_pfnWHvGetPartitionProperty
227# define WHvSetPartitionProperty g_pfnWHvSetPartitionProperty
228# define WHvMapGpaRange g_pfnWHvMapGpaRange
229# define WHvUnmapGpaRange g_pfnWHvUnmapGpaRange
230# define WHvTranslateGva g_pfnWHvTranslateGva
231# define WHvQueryGpaRangeDirtyBitmap g_pfnWHvQueryGpaRangeDirtyBitmap
232# define WHvCreateVirtualProcessor g_pfnWHvCreateVirtualProcessor
233# define WHvDeleteVirtualProcessor g_pfnWHvDeleteVirtualProcessor
234# define WHvRunVirtualProcessor g_pfnWHvRunVirtualProcessor
235# define WHvGetRunExitContextSize g_pfnWHvGetRunExitContextSize
236# define WHvCancelRunVirtualProcessor g_pfnWHvCancelRunVirtualProcessor
237# define WHvGetVirtualProcessorRegisters g_pfnWHvGetVirtualProcessorRegisters
238# define WHvSetVirtualProcessorRegisters g_pfnWHvSetVirtualProcessorRegisters
239
240# define VidMessageSlotHandleAndGetNext g_pfnVidMessageSlotHandleAndGetNext
241# define VidStartVirtualProcessor g_pfnVidStartVirtualProcessor
242# define VidStopVirtualProcessor g_pfnVidStopVirtualProcessor
243
244#endif
245
246/** WHV_MEMORY_ACCESS_TYPE names */
247static const char * const g_apszWHvMemAccesstypes[4] = { "read", "write", "exec", "!undefined!" };
248
249
250/*********************************************************************************************************************************
251* Internal Functions *
252*********************************************************************************************************************************/
253DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv);
254DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv);
255
256/*
257 * Instantate the code we share with ring-0.
258 */
259#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
260# define NEM_WIN_TEMPLATE_MODE_OWN_RUN_API
261#else
262# undef NEM_WIN_TEMPLATE_MODE_OWN_RUN_API
263#endif
264#include "../VMMAll/NEMAllNativeTemplate-win.cpp.h"
265
266
267
268#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
269/**
270 * Wrapper that logs the call from VID.DLL.
271 *
272 * This is very handy for figuring out why an API call fails.
273 */
274static NTSTATUS WINAPI
275nemR3WinLogWrapper_NtDeviceIoControlFile(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
276 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
277 PVOID pvOutput, ULONG cbOutput)
278{
279
280 char szFunction[32];
281 const char *pszFunction;
282 if (uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction)
283 pszFunction = "VidMessageSlotHandleAndGetNext";
284 else if (uFunction == g_IoCtlStartVirtualProcessor.uFunction)
285 pszFunction = "VidStartVirtualProcessor";
286 else if (uFunction == g_IoCtlStopVirtualProcessor.uFunction)
287 pszFunction = "VidStopVirtualProcessor";
288 else if (uFunction == g_IoCtlMessageSlotMap.uFunction)
289 pszFunction = "VidMessageSlotMap";
290 else if (uFunction == g_IoCtlGetVirtualProcessorState.uFunction)
291 pszFunction = "VidGetVirtualProcessorState";
292 else if (uFunction == g_IoCtlSetVirtualProcessorState.uFunction)
293 pszFunction = "VidSetVirtualProcessorState";
294 else
295 {
296 RTStrPrintf(szFunction, sizeof(szFunction), "%#x", uFunction);
297 pszFunction = szFunction;
298 }
299
300 if (cbInput > 0 && pvInput)
301 Log12(("VID!NtDeviceIoControlFile: %s/input: %.*Rhxs\n", pszFunction, RT_MIN(cbInput, 32), pvInput));
302 NTSTATUS rcNt = g_pfnNtDeviceIoControlFile(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, uFunction,
303 pvInput, cbInput, pvOutput, cbOutput);
304 if (!hEvt && !pfnApcCallback && !pvApcCtx)
305 Log12(("VID!NtDeviceIoControlFile: hFile=%#zx pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
306 hFile, pIos, pIos->Status, pIos->Information, pszFunction, pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
307 else
308 Log12(("VID!NtDeviceIoControlFile: hFile=%#zx hEvt=%#zx Apc=%p/%p pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
309 hFile, hEvt, RT_CB_LOG_CAST(pfnApcCallback), pvApcCtx, pIos, pIos->Status, pIos->Information, pszFunction,
310 pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
311 if (cbOutput > 0 && pvOutput)
312 {
313 Log12(("VID!NtDeviceIoControlFile: %s/output: %.*Rhxs\n", pszFunction, RT_MIN(cbOutput, 32), pvOutput));
314 if (uFunction == 0x2210cc && g_pMsgSlotMapping == NULL && cbOutput >= sizeof(void *))
315 {
316 g_pMsgSlotMapping = *(VID_MESSAGE_MAPPING_HEADER **)pvOutput;
317 g_pHvMsgHdr = (const HV_MESSAGE_HEADER *)(g_pMsgSlotMapping + 1);
318 g_pX64MsgHdr = (const HV_X64_INTERCEPT_MESSAGE_HEADER *)(g_pHvMsgHdr + 1);
319 Log12(("VID!NtDeviceIoControlFile: Message slot mapping: %p\n", g_pMsgSlotMapping));
320 }
321 }
322 if ( g_pMsgSlotMapping
323 && ( uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction
324 || uFunction == g_IoCtlStopVirtualProcessor.uFunction
325 || uFunction == g_IoCtlMessageSlotMap.uFunction
326 ))
327 Log12(("VID!NtDeviceIoControlFile: enmVidMsgType=%#x cb=%#x msg=%#x payload=%u cs:rip=%04x:%08RX64 (%s)\n",
328 g_pMsgSlotMapping->enmVidMsgType, g_pMsgSlotMapping->cbMessage,
329 g_pHvMsgHdr->MessageType, g_pHvMsgHdr->PayloadSize,
330 g_pX64MsgHdr->CsSegment.Selector, g_pX64MsgHdr->Rip, pszFunction));
331
332 return rcNt;
333}
334#endif /* NEM_WIN_INTERCEPT_NT_IO_CTLS */
335
336
337/**
338 * Patches the call table of VID.DLL so we can intercept NtDeviceIoControlFile.
339 *
340 * This is for used to figure out the I/O control codes and in logging builds
341 * for logging API calls that WinHvPlatform.dll does.
342 *
343 * @returns VBox status code.
344 * @param hLdrModVid The VID module handle.
345 * @param pErrInfo Where to return additional error information.
346 */
347static int nemR3WinInitVidIntercepts(RTLDRMOD hLdrModVid, PRTERRINFO pErrInfo)
348{
349 /*
350 * Locate the real API.
351 */
352 g_pfnNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) *)RTLdrGetSystemSymbol("NTDLL.DLL", "NtDeviceIoControlFile");
353 AssertReturn(g_pfnNtDeviceIoControlFile != NULL,
354 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to resolve NtDeviceIoControlFile from NTDLL.DLL"));
355
356 /*
357 * Locate the PE header and get what we need from it.
358 */
359 uint8_t const *pbImage = (uint8_t const *)RTLdrGetNativeHandle(hLdrModVid);
360 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pbImage;
361 AssertReturn(pMzHdr->e_magic == IMAGE_DOS_SIGNATURE,
362 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL mapping doesn't start with MZ signature: %#x", pMzHdr->e_magic));
363 IMAGE_NT_HEADERS const *pNtHdrs = (IMAGE_NT_HEADERS const *)&pbImage[pMzHdr->e_lfanew];
364 AssertReturn(pNtHdrs->Signature == IMAGE_NT_SIGNATURE,
365 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL has invalid PE signaturre: %#x @%#x",
366 pNtHdrs->Signature, pMzHdr->e_lfanew));
367
368 uint32_t const cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
369 IMAGE_DATA_DIRECTORY const ImportDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
370
371 /*
372 * Walk the import descriptor table looking for NTDLL.DLL.
373 */
374 AssertReturn( ImportDir.Size > 0
375 && ImportDir.Size < cbImage,
376 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory size: %#x", ImportDir.Size));
377 AssertReturn( ImportDir.VirtualAddress > 0
378 && ImportDir.VirtualAddress <= cbImage - ImportDir.Size,
379 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory RVA: %#x", ImportDir.VirtualAddress));
380
381 for (PIMAGE_IMPORT_DESCRIPTOR pImps = (PIMAGE_IMPORT_DESCRIPTOR)&pbImage[ImportDir.VirtualAddress];
382 pImps->Name != 0 && pImps->FirstThunk != 0;
383 pImps++)
384 {
385 AssertReturn(pImps->Name < cbImage,
386 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory entry name: %#x", pImps->Name));
387 const char *pszModName = (const char *)&pbImage[pImps->Name];
388 if (RTStrICmpAscii(pszModName, "ntdll.dll"))
389 continue;
390 AssertReturn(pImps->FirstThunk < cbImage,
391 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
392 AssertReturn(pImps->OriginalFirstThunk < cbImage,
393 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
394
395 /*
396 * Walk the thunks table(s) looking for NtDeviceIoControlFile.
397 */
398 uintptr_t *puFirstThunk = (uintptr_t *)&pbImage[pImps->FirstThunk]; /* update this. */
399 if ( pImps->OriginalFirstThunk != 0
400 && pImps->OriginalFirstThunk != pImps->FirstThunk)
401 {
402 uintptr_t const *puOrgThunk = (uintptr_t const *)&pbImage[pImps->OriginalFirstThunk]; /* read from this. */
403 uintptr_t cLeft = (cbImage - (RT_MAX(pImps->FirstThunk, pImps->OriginalFirstThunk)))
404 / sizeof(*puFirstThunk);
405 while (cLeft-- > 0 && *puOrgThunk != 0)
406 {
407 if (!(*puOrgThunk & IMAGE_ORDINAL_FLAG64)) /* ASSUMES 64-bit */
408 {
409 AssertReturn(*puOrgThunk > 0 && *puOrgThunk < cbImage,
410 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad thunk entry: %#x", *puOrgThunk));
411
412 const char *pszSymbol = (const char *)&pbImage[*puOrgThunk + 2];
413 if (strcmp(pszSymbol, "NtDeviceIoControlFile") == 0)
414 g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)puFirstThunk;
415 }
416
417 puOrgThunk++;
418 puFirstThunk++;
419 }
420 }
421 else
422 {
423 /* No original thunk table, so scan the resolved symbols for a match
424 with the NtDeviceIoControlFile address. */
425 uintptr_t const uNeedle = (uintptr_t)g_pfnNtDeviceIoControlFile;
426 uintptr_t cLeft = (cbImage - pImps->FirstThunk) / sizeof(*puFirstThunk);
427 while (cLeft-- > 0 && *puFirstThunk != 0)
428 {
429 if (*puFirstThunk == uNeedle)
430 g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)puFirstThunk;
431 puFirstThunk++;
432 }
433 }
434 }
435
436 if (g_ppfnVidNtDeviceIoControlFile != NULL)
437 {
438 /* Make the thunk writable we can freely modify it. */
439 DWORD fOldProt = PAGE_READONLY;
440 VirtualProtect((void *)(uintptr_t)g_ppfnVidNtDeviceIoControlFile, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &fOldProt);
441
442#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
443 *g_ppfnVidNtDeviceIoControlFile = nemR3WinLogWrapper_NtDeviceIoControlFile;
444#endif
445 return VINF_SUCCESS;
446 }
447 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to patch NtDeviceIoControlFile import in VID.DLL!");
448}
449
450
451/**
452 * Worker for nemR3NativeInit that probes and load the native API.
453 *
454 * @returns VBox status code.
455 * @param fForced Whether the HMForced flag is set and we should
456 * fail if we cannot initialize.
457 * @param pErrInfo Where to always return error info.
458 */
459static int nemR3WinInitProbeAndLoad(bool fForced, PRTERRINFO pErrInfo)
460{
461 /*
462 * Check that the DLL files we need are present, but without loading them.
463 * We'd like to avoid loading them unnecessarily.
464 */
465 WCHAR wszPath[MAX_PATH + 64];
466 UINT cwcPath = GetSystemDirectoryW(wszPath, MAX_PATH);
467 if (cwcPath >= MAX_PATH || cwcPath < 2)
468 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "GetSystemDirectoryW failed (%#x / %u)", cwcPath, GetLastError());
469
470 if (wszPath[cwcPath - 1] != '\\' || wszPath[cwcPath - 1] != '/')
471 wszPath[cwcPath++] = '\\';
472 RTUtf16CopyAscii(&wszPath[cwcPath], RT_ELEMENTS(wszPath) - cwcPath, "WinHvPlatform.dll");
473 if (GetFileAttributesW(wszPath) == INVALID_FILE_ATTRIBUTES)
474 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "The native API dll was not found (%ls)", wszPath);
475
476 /*
477 * Check that we're in a VM and that the hypervisor identifies itself as Hyper-V.
478 */
479 if (!ASMHasCpuId())
480 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID support");
481 if (!ASMIsValidStdRange(ASMCpuId_EAX(0)))
482 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID leaf #1");
483 if (!(ASMCpuId_ECX(1) & X86_CPUID_FEATURE_ECX_HVP))
484 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Not in a hypervisor partition (HVP=0)");
485
486 uint32_t cMaxHyperLeaf = 0;
487 uint32_t uEbx = 0;
488 uint32_t uEcx = 0;
489 uint32_t uEdx = 0;
490 ASMCpuIdExSlow(0x40000000, 0, 0, 0, &cMaxHyperLeaf, &uEbx, &uEcx, &uEdx);
491 if (!ASMIsValidHypervisorRange(cMaxHyperLeaf))
492 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Invalid hypervisor CPUID range (%#x %#x %#x %#x)",
493 cMaxHyperLeaf, uEbx, uEcx, uEdx);
494 if ( uEbx != UINT32_C(0x7263694d) /* Micr */
495 || uEcx != UINT32_C(0x666f736f) /* osof */
496 || uEdx != UINT32_C(0x76482074) /* t Hv */)
497 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
498 "Not Hyper-V CPUID signature: %#x %#x %#x (expected %#x %#x %#x)",
499 uEbx, uEcx, uEdx, UINT32_C(0x7263694d), UINT32_C(0x666f736f), UINT32_C(0x76482074));
500 if (cMaxHyperLeaf < UINT32_C(0x40000005))
501 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Too narrow hypervisor CPUID range (%#x)", cMaxHyperLeaf);
502
503 /** @todo would be great if we could recognize a root partition from the
504 * CPUID info, but I currently don't dare do that. */
505
506 /*
507 * Now try load the DLLs and resolve the APIs.
508 */
509 static const char * const s_apszDllNames[2] = { "WinHvPlatform.dll", "vid.dll" };
510 RTLDRMOD ahMods[2] = { NIL_RTLDRMOD, NIL_RTLDRMOD };
511 int rc = VINF_SUCCESS;
512 for (unsigned i = 0; i < RT_ELEMENTS(s_apszDllNames); i++)
513 {
514 int rc2 = RTLdrLoadSystem(s_apszDllNames[i], true /*fNoUnload*/, &ahMods[i]);
515 if (RT_FAILURE(rc2))
516 {
517 if (!RTErrInfoIsSet(pErrInfo))
518 RTErrInfoSetF(pErrInfo, rc2, "Failed to load API DLL: %s: %Rrc", s_apszDllNames[i], rc2);
519 else
520 RTErrInfoAddF(pErrInfo, rc2, "; %s: %Rrc", s_apszDllNames[i], rc2);
521 ahMods[i] = NIL_RTLDRMOD;
522 rc = VERR_NEM_INIT_FAILED;
523 }
524 }
525 if (RT_SUCCESS(rc))
526 rc = nemR3WinInitVidIntercepts(ahMods[1], pErrInfo);
527 if (RT_SUCCESS(rc))
528 {
529 for (unsigned i = 0; i < RT_ELEMENTS(g_aImports); i++)
530 {
531 int rc2 = RTLdrGetSymbol(ahMods[g_aImports[i].idxDll], g_aImports[i].pszName, (void **)g_aImports[i].ppfn);
532 if (RT_SUCCESS(rc2))
533 {
534 if (g_aImports[i].fOptional)
535 LogRel(("NEM: info: Found optional import %s!%s.\n",
536 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName));
537 }
538 else
539 {
540 *g_aImports[i].ppfn = NULL;
541
542 LogRel(("NEM: %s: Failed to import %s!%s: %Rrc",
543 g_aImports[i].fOptional ? "info" : fForced ? "fatal" : "error",
544 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName, rc2));
545 if (!g_aImports[i].fOptional)
546 {
547 if (RTErrInfoIsSet(pErrInfo))
548 RTErrInfoAddF(pErrInfo, rc2, ", %s!%s",
549 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
550 else
551 rc = RTErrInfoSetF(pErrInfo, rc2, "Failed to import: %s!%s",
552 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
553 Assert(RT_FAILURE(rc));
554 }
555 }
556 }
557 if (RT_SUCCESS(rc))
558 {
559 Assert(!RTErrInfoIsSet(pErrInfo));
560 }
561 }
562
563 for (unsigned i = 0; i < RT_ELEMENTS(ahMods); i++)
564 RTLdrClose(ahMods[i]);
565 return rc;
566}
567
568
569/**
570 * Wrapper for different WHvGetCapability signatures.
571 */
572DECLINLINE(HRESULT) WHvGetCapabilityWrapper(WHV_CAPABILITY_CODE enmCap, WHV_CAPABILITY *pOutput, uint32_t cbOutput)
573{
574 return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput, NULL);
575}
576
577
578/**
579 * Worker for nemR3NativeInit that gets the hypervisor capabilities.
580 *
581 * @returns VBox status code.
582 * @param pVM The cross context VM structure.
583 * @param pErrInfo Where to always return error info.
584 */
585static int nemR3WinInitCheckCapabilities(PVM pVM, PRTERRINFO pErrInfo)
586{
587#define NEM_LOG_REL_CAP_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %-38s= " a_szFmt "\n", a_szField, a_Value))
588#define NEM_LOG_REL_CAP_SUB_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %36s: " a_szFmt "\n", a_szField, a_Value))
589#define NEM_LOG_REL_CAP_SUB(a_szField, a_Value) NEM_LOG_REL_CAP_SUB_EX(a_szField, "%d", a_Value)
590
591 /*
592 * Is the hypervisor present with the desired capability?
593 *
594 * In build 17083 this translates into:
595 * - CPUID[0x00000001].HVP is set
596 * - CPUID[0x40000000] == "Microsoft Hv"
597 * - CPUID[0x40000001].eax == "Hv#1"
598 * - CPUID[0x40000003].ebx[12] is set.
599 * - VidGetExoPartitionProperty(INVALID_HANDLE_VALUE, 0x60000, &Ignored) returns
600 * a non-zero value.
601 */
602 /**
603 * @todo Someone at Microsoft please explain weird API design:
604 * 1. Pointless CapabilityCode duplication int the output;
605 * 2. No output size.
606 */
607 WHV_CAPABILITY Caps;
608 RT_ZERO(Caps);
609 SetLastError(0);
610 HRESULT hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeHypervisorPresent, &Caps, sizeof(Caps));
611 DWORD rcWin = GetLastError();
612 if (FAILED(hrc))
613 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
614 "WHvGetCapability/WHvCapabilityCodeHypervisorPresent failed: %Rhrc (Last=%#x/%u)",
615 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
616 if (!Caps.HypervisorPresent)
617 {
618 if (!RTPathExists(RTPATH_NT_PASSTHRU_PREFIX "Device\\VidExo"))
619 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
620 "WHvCapabilityCodeHypervisorPresent is FALSE! Make sure you have enabled the 'Windows Hypervisor Platform' feature.");
621 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "WHvCapabilityCodeHypervisorPresent is FALSE! (%u)", rcWin);
622 }
623 LogRel(("NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...\n"));
624
625
626 /*
627 * Check what extended VM exits are supported.
628 */
629 RT_ZERO(Caps);
630 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExtendedVmExits, &Caps, sizeof(Caps));
631 if (FAILED(hrc))
632 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
633 "WHvGetCapability/WHvCapabilityCodeExtendedVmExits failed: %Rhrc (Last=%#x/%u)",
634 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
635 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeExtendedVmExits", "%'#018RX64", Caps.ExtendedVmExits.AsUINT64);
636 pVM->nem.s.fExtendedMsrExit = RT_BOOL(Caps.ExtendedVmExits.X64MsrExit);
637 pVM->nem.s.fExtendedCpuIdExit = RT_BOOL(Caps.ExtendedVmExits.X64CpuidExit);
638 pVM->nem.s.fExtendedXcptExit = RT_BOOL(Caps.ExtendedVmExits.ExceptionExit);
639 NEM_LOG_REL_CAP_SUB("fExtendedMsrExit", pVM->nem.s.fExtendedMsrExit);
640 NEM_LOG_REL_CAP_SUB("fExtendedCpuIdExit", pVM->nem.s.fExtendedCpuIdExit);
641 NEM_LOG_REL_CAP_SUB("fExtendedXcptExit", pVM->nem.s.fExtendedXcptExit);
642 if (Caps.ExtendedVmExits.AsUINT64 & ~(uint64_t)7)
643 LogRel(("NEM: Warning! Unknown VM exit definitions: %#RX64\n", Caps.ExtendedVmExits.AsUINT64));
644 /** @todo RECHECK: WHV_EXTENDED_VM_EXITS typedef. */
645
646 /*
647 * Check features in case they end up defining any.
648 */
649 RT_ZERO(Caps);
650 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeFeatures, &Caps, sizeof(Caps));
651 if (FAILED(hrc))
652 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
653 "WHvGetCapability/WHvCapabilityCodeFeatures failed: %Rhrc (Last=%#x/%u)",
654 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
655 if (Caps.Features.AsUINT64 & ~(uint64_t)0)
656 LogRel(("NEM: Warning! Unknown feature definitions: %#RX64\n", Caps.Features.AsUINT64));
657 /** @todo RECHECK: WHV_CAPABILITY_FEATURES typedef. */
658
659 /*
660 * Check supported exception exit bitmap bits.
661 * We don't currently require this, so we just log failure.
662 */
663 RT_ZERO(Caps);
664 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExceptionExitBitmap, &Caps, sizeof(Caps));
665 if (SUCCEEDED(hrc))
666 LogRel(("NEM: Supported exception exit bitmap: %#RX64\n", Caps.ExceptionExitBitmap));
667 else
668 LogRel(("NEM: Warning! WHvGetCapability/WHvCapabilityCodeExceptionExitBitmap failed: %Rhrc (Last=%#x/%u)",
669 hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
670
671 /*
672 * Check that the CPU vendor is supported.
673 */
674 RT_ZERO(Caps);
675 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorVendor, &Caps, sizeof(Caps));
676 if (FAILED(hrc))
677 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
678 "WHvGetCapability/WHvCapabilityCodeProcessorVendor failed: %Rhrc (Last=%#x/%u)",
679 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
680 switch (Caps.ProcessorVendor)
681 {
682 /** @todo RECHECK: WHV_PROCESSOR_VENDOR typedef. */
683 case WHvProcessorVendorIntel:
684 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - Intel", Caps.ProcessorVendor);
685 pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_INTEL;
686 break;
687 case WHvProcessorVendorAmd:
688 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - AMD", Caps.ProcessorVendor);
689 pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_AMD;
690 break;
691 default:
692 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d", Caps.ProcessorVendor);
693 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unknown processor vendor: %d", Caps.ProcessorVendor);
694 }
695
696 /*
697 * CPU features, guessing these are virtual CPU features?
698 */
699 RT_ZERO(Caps);
700 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorFeatures, &Caps, sizeof(Caps));
701 if (FAILED(hrc))
702 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
703 "WHvGetCapability/WHvCapabilityCodeProcessorFeatures failed: %Rhrc (Last=%#x/%u)",
704 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
705 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorFeatures", "%'#018RX64", Caps.ProcessorFeatures.AsUINT64);
706#define NEM_LOG_REL_CPU_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ProcessorFeatures.a_Field)
707 NEM_LOG_REL_CPU_FEATURE(Sse3Support);
708 NEM_LOG_REL_CPU_FEATURE(LahfSahfSupport);
709 NEM_LOG_REL_CPU_FEATURE(Ssse3Support);
710 NEM_LOG_REL_CPU_FEATURE(Sse4_1Support);
711 NEM_LOG_REL_CPU_FEATURE(Sse4_2Support);
712 NEM_LOG_REL_CPU_FEATURE(Sse4aSupport);
713 NEM_LOG_REL_CPU_FEATURE(XopSupport);
714 NEM_LOG_REL_CPU_FEATURE(PopCntSupport);
715 NEM_LOG_REL_CPU_FEATURE(Cmpxchg16bSupport);
716 NEM_LOG_REL_CPU_FEATURE(Altmovcr8Support);
717 NEM_LOG_REL_CPU_FEATURE(LzcntSupport);
718 NEM_LOG_REL_CPU_FEATURE(MisAlignSseSupport);
719 NEM_LOG_REL_CPU_FEATURE(MmxExtSupport);
720 NEM_LOG_REL_CPU_FEATURE(Amd3DNowSupport);
721 NEM_LOG_REL_CPU_FEATURE(ExtendedAmd3DNowSupport);
722 NEM_LOG_REL_CPU_FEATURE(Page1GbSupport);
723 NEM_LOG_REL_CPU_FEATURE(AesSupport);
724 NEM_LOG_REL_CPU_FEATURE(PclmulqdqSupport);
725 NEM_LOG_REL_CPU_FEATURE(PcidSupport);
726 NEM_LOG_REL_CPU_FEATURE(Fma4Support);
727 NEM_LOG_REL_CPU_FEATURE(F16CSupport);
728 NEM_LOG_REL_CPU_FEATURE(RdRandSupport);
729 NEM_LOG_REL_CPU_FEATURE(RdWrFsGsSupport);
730 NEM_LOG_REL_CPU_FEATURE(SmepSupport);
731 NEM_LOG_REL_CPU_FEATURE(EnhancedFastStringSupport);
732 NEM_LOG_REL_CPU_FEATURE(Bmi1Support);
733 NEM_LOG_REL_CPU_FEATURE(Bmi2Support);
734 /* two reserved bits here, see below */
735 NEM_LOG_REL_CPU_FEATURE(MovbeSupport);
736 NEM_LOG_REL_CPU_FEATURE(Npiep1Support);
737 NEM_LOG_REL_CPU_FEATURE(DepX87FPUSaveSupport);
738 NEM_LOG_REL_CPU_FEATURE(RdSeedSupport);
739 NEM_LOG_REL_CPU_FEATURE(AdxSupport);
740 NEM_LOG_REL_CPU_FEATURE(IntelPrefetchSupport);
741 NEM_LOG_REL_CPU_FEATURE(SmapSupport);
742 NEM_LOG_REL_CPU_FEATURE(HleSupport);
743 NEM_LOG_REL_CPU_FEATURE(RtmSupport);
744 NEM_LOG_REL_CPU_FEATURE(RdtscpSupport);
745 NEM_LOG_REL_CPU_FEATURE(ClflushoptSupport);
746 NEM_LOG_REL_CPU_FEATURE(ClwbSupport);
747 NEM_LOG_REL_CPU_FEATURE(ShaSupport);
748 NEM_LOG_REL_CPU_FEATURE(X87PointersSavedSupport);
749#undef NEM_LOG_REL_CPU_FEATURE
750 if (Caps.ProcessorFeatures.AsUINT64 & (~(RT_BIT_64(43) - 1) | RT_BIT_64(27) | RT_BIT_64(28)))
751 LogRel(("NEM: Warning! Unknown CPU features: %#RX64\n", Caps.ProcessorFeatures.AsUINT64));
752 pVM->nem.s.uCpuFeatures.u64 = Caps.ProcessorFeatures.AsUINT64;
753 /** @todo RECHECK: WHV_PROCESSOR_FEATURES typedef. */
754
755 /*
756 * The cache line flush size.
757 */
758 RT_ZERO(Caps);
759 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorClFlushSize, &Caps, sizeof(Caps));
760 if (FAILED(hrc))
761 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
762 "WHvGetCapability/WHvCapabilityCodeProcessorClFlushSize failed: %Rhrc (Last=%#x/%u)",
763 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
764 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorClFlushSize", "2^%u", Caps.ProcessorClFlushSize);
765 if (Caps.ProcessorClFlushSize < 8 && Caps.ProcessorClFlushSize > 9)
766 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unsupported cache line flush size: %u", Caps.ProcessorClFlushSize);
767 pVM->nem.s.cCacheLineFlushShift = Caps.ProcessorClFlushSize;
768
769 /*
770 * See if they've added more properties that we're not aware of.
771 */
772 /** @todo RECHECK: WHV_CAPABILITY_CODE typedef. */
773 if (!IsDebuggerPresent()) /* Too noisy when in debugger, so skip. */
774 {
775 static const struct
776 {
777 uint32_t iMin, iMax; } s_aUnknowns[] =
778 {
779 { 0x0004, 0x000f },
780 { 0x1003, 0x100f },
781 { 0x2000, 0x200f },
782 { 0x3000, 0x300f },
783 { 0x4000, 0x400f },
784 };
785 for (uint32_t j = 0; j < RT_ELEMENTS(s_aUnknowns); j++)
786 for (uint32_t i = s_aUnknowns[j].iMin; i <= s_aUnknowns[j].iMax; i++)
787 {
788 RT_ZERO(Caps);
789 hrc = WHvGetCapabilityWrapper((WHV_CAPABILITY_CODE)i, &Caps, sizeof(Caps));
790 if (SUCCEEDED(hrc))
791 LogRel(("NEM: Warning! Unknown capability %#x returning: %.*Rhxs\n", i, sizeof(Caps), &Caps));
792 }
793 }
794
795 /*
796 * For proper operation, we require CPUID exits.
797 */
798 if (!pVM->nem.s.fExtendedCpuIdExit)
799 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended CPUID exit support");
800 if (!pVM->nem.s.fExtendedMsrExit)
801 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended MSR exit support");
802 if (!pVM->nem.s.fExtendedXcptExit)
803 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended exception exit support");
804
805#undef NEM_LOG_REL_CAP_EX
806#undef NEM_LOG_REL_CAP_SUB_EX
807#undef NEM_LOG_REL_CAP_SUB
808 return VINF_SUCCESS;
809}
810
811#if defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) || defined(LOG_ENABLED)
812
813/**
814 * Used to fill in g_IoCtlGetHvPartitionId.
815 */
816static NTSTATUS WINAPI
817nemR3WinIoctlDetector_GetHvPartitionId(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
818 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
819 PVOID pvOutput, ULONG cbOutput)
820{
821 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
822 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
823 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
824 AssertLogRelMsgReturn(cbInput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
825 RT_NOREF(pvInput);
826
827 AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
828 AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_ID), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
829 *(HV_PARTITION_ID *)pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID;
830
831 g_IoCtlGetHvPartitionId.cbInput = cbInput;
832 g_IoCtlGetHvPartitionId.cbOutput = cbOutput;
833 g_IoCtlGetHvPartitionId.uFunction = uFunction;
834
835 return STATUS_SUCCESS;
836}
837
838
839/**
840 * Used to fill in g_IoCtlGetHvPartitionId.
841 */
842static NTSTATUS WINAPI
843nemR3WinIoctlDetector_GetPartitionProperty(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
844 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
845 PVOID pvOutput, ULONG cbOutput)
846{
847 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
848 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
849 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
850 AssertLogRelMsgReturn(cbInput == sizeof(VID_PARTITION_PROPERTY_CODE), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
851 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
852 AssertLogRelMsgReturn(*(VID_PARTITION_PROPERTY_CODE *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE,
853 ("*pvInput=%#x, expected %#x\n", *(HV_PARTITION_PROPERTY_CODE *)pvInput,
854 NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE), STATUS_INVALID_PARAMETER_9);
855 AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
856 AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_PROPERTY), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
857 *(HV_PARTITION_PROPERTY *)pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE;
858
859 g_IoCtlGetPartitionProperty.cbInput = cbInput;
860 g_IoCtlGetPartitionProperty.cbOutput = cbOutput;
861 g_IoCtlGetPartitionProperty.uFunction = uFunction;
862
863 return STATUS_SUCCESS;
864}
865
866#endif /* defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) || defined(LOG_ENABLED) */
867#if defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(LOG_ENABLED)
868
869/**
870 * Used to fill in g_IoCtlStartVirtualProcessor.
871 */
872static NTSTATUS WINAPI
873nemR3WinIoctlDetector_StartVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
874 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
875 PVOID pvOutput, ULONG cbOutput)
876{
877 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
878 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
879 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
880 AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
881 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
882 AssertLogRelMsgReturn(*(HV_VP_INDEX *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
883 ("*piCpu=%u\n", *(HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
884 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
885 RT_NOREF(pvOutput);
886
887 g_IoCtlStartVirtualProcessor.cbInput = cbInput;
888 g_IoCtlStartVirtualProcessor.cbOutput = cbOutput;
889 g_IoCtlStartVirtualProcessor.uFunction = uFunction;
890
891 return STATUS_SUCCESS;
892}
893
894
895/**
896 * Used to fill in g_IoCtlStartVirtualProcessor.
897 */
898static NTSTATUS WINAPI
899nemR3WinIoctlDetector_StopVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
900 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
901 PVOID pvOutput, ULONG cbOutput)
902{
903 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
904 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
905 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
906 AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
907 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
908 AssertLogRelMsgReturn(*(HV_VP_INDEX *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
909 ("*piCpu=%u\n", *(HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
910 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
911 RT_NOREF(pvOutput);
912
913 g_IoCtlStopVirtualProcessor.cbInput = cbInput;
914 g_IoCtlStopVirtualProcessor.cbOutput = cbOutput;
915 g_IoCtlStopVirtualProcessor.uFunction = uFunction;
916
917 return STATUS_SUCCESS;
918}
919
920
921/**
922 * Used to fill in g_IoCtlMessageSlotHandleAndGetNext
923 */
924static NTSTATUS WINAPI
925nemR3WinIoctlDetector_MessageSlotHandleAndGetNext(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
926 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
927 PVOID pvOutput, ULONG cbOutput)
928{
929 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
930 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
931 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
932
933 if (g_uBuildNo >= 17758)
934 {
935 /* No timeout since about build 17758, it's now always an infinite wait. So, a somewhat compatible change. */
936 AssertLogRelMsgReturn(cbInput == RT_UOFFSETOF(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT, cMillies),
937 ("cbInput=%#x\n", cbInput),
938 STATUS_INVALID_PARAMETER_8);
939 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
940 PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
941 AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
942 && pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE,
943 ("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
944 STATUS_INVALID_PARAMETER_9);
945 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
946 }
947 else
948 {
949 AssertLogRelMsgReturn(cbInput == sizeof(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT), ("cbInput=%#x\n", cbInput),
950 STATUS_INVALID_PARAMETER_8);
951 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
952 PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
953 AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
954 && pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE
955 && pVidIn->cMillies == NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT,
956 ("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
957 STATUS_INVALID_PARAMETER_9);
958 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
959 RT_NOREF(pvOutput);
960 }
961
962 g_IoCtlMessageSlotHandleAndGetNext.cbInput = cbInput;
963 g_IoCtlMessageSlotHandleAndGetNext.cbOutput = cbOutput;
964 g_IoCtlMessageSlotHandleAndGetNext.uFunction = uFunction;
965
966 return STATUS_SUCCESS;
967}
968
969#endif /* defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(LOG_ENABLED) */
970
971#ifdef LOG_ENABLED
972/**
973 * Used to fill in what g_pIoCtlDetectForLogging points to.
974 */
975static NTSTATUS WINAPI nemR3WinIoctlDetector_ForLogging(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
976 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
977 PVOID pvOutput, ULONG cbOutput)
978{
979 RT_NOREF(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pvInput, pvOutput);
980
981 g_pIoCtlDetectForLogging->cbInput = cbInput;
982 g_pIoCtlDetectForLogging->cbOutput = cbOutput;
983 g_pIoCtlDetectForLogging->uFunction = uFunction;
984
985 return STATUS_SUCCESS;
986}
987#endif
988
989
990/**
991 * Worker for nemR3NativeInit that detect I/O control function numbers for VID.
992 *
993 * We use the function numbers directly in ring-0 and to name functions when
994 * logging NtDeviceIoControlFile calls.
995 *
996 * @note We could alternatively do this by disassembling the respective
997 * functions, but hooking NtDeviceIoControlFile and making fake calls
998 * more easily provides the desired information.
999 *
1000 * @returns VBox status code.
1001 * @param pVM The cross context VM structure. Will set I/O
1002 * control info members.
1003 * @param pErrInfo Where to always return error info.
1004 */
1005static int nemR3WinInitDiscoverIoControlProperties(PVM pVM, PRTERRINFO pErrInfo)
1006{
1007 RT_NOREF(pVM, pErrInfo);
1008
1009 /*
1010 * Probe the I/O control information for select VID APIs so we can use
1011 * them directly from ring-0 and better log them.
1012 *
1013 */
1014#if defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) || defined(LOG_ENABLED)
1015 decltype(NtDeviceIoControlFile) * const pfnOrg = *g_ppfnVidNtDeviceIoControlFile;
1016
1017 /* VidGetHvPartitionId - must work due to our memory management. */
1018 HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1019 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetHvPartitionId;
1020 BOOL fRet = g_pfnVidGetHvPartitionId(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &idHvPartition);
1021 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1022 AssertReturn(fRet && idHvPartition == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID && g_IoCtlGetHvPartitionId.uFunction != 0,
1023 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
1024 "Problem figuring out VidGetHvPartitionId: fRet=%u idHvPartition=%#x dwErr=%u",
1025 fRet, idHvPartition, GetLastError()) );
1026 LogRel(("NEM: VidGetHvPartitionId -> fun:%#x in:%#x out:%#x\n",
1027 g_IoCtlGetHvPartitionId.uFunction, g_IoCtlGetHvPartitionId.cbInput, g_IoCtlGetHvPartitionId.cbOutput));
1028
1029 /* VidGetPartitionProperty - must work as it's fallback for VidGetHvPartitionId. */
1030 HV_PARTITION_PROPERTY uPropValue = ~NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE;
1031 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetPartitionProperty;
1032 fRet = g_pfnVidGetPartitionProperty(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE,
1033 &uPropValue);
1034 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1035 AssertReturn( fRet
1036 && uPropValue == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE
1037 && g_IoCtlGetHvPartitionId.uFunction != 0,
1038 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
1039 "Problem figuring out VidGetPartitionProperty: fRet=%u uPropValue=%#x dwErr=%u",
1040 fRet, uPropValue, GetLastError()) );
1041 LogRel(("NEM: VidGetPartitionProperty -> fun:%#x in:%#x out:%#x\n",
1042 g_IoCtlGetPartitionProperty.uFunction, g_IoCtlGetPartitionProperty.cbInput, g_IoCtlGetPartitionProperty.cbOutput));
1043
1044#endif
1045 int rcRet = VINF_SUCCESS;
1046#if defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(LOG_ENABLED)
1047
1048 /* VidStartVirtualProcessor */
1049 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StartVirtualProcessor;
1050 fRet = g_pfnVidStartVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1051 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1052 AssertStmt(fRet && g_IoCtlStartVirtualProcessor.uFunction != 0,
1053 rcRet = RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1054 "Problem figuring out VidStartVirtualProcessor: fRet=%u dwErr=%u",
1055 fRet, GetLastError()) );
1056 LogRel(("NEM: VidStartVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStartVirtualProcessor.uFunction,
1057 g_IoCtlStartVirtualProcessor.cbInput, g_IoCtlStartVirtualProcessor.cbOutput));
1058
1059 /* VidStopVirtualProcessor */
1060 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StopVirtualProcessor;
1061 fRet = g_pfnVidStopVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1062 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1063 AssertStmt(fRet && g_IoCtlStopVirtualProcessor.uFunction != 0,
1064 rcRet = RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1065 "Problem figuring out VidStopVirtualProcessor: fRet=%u dwErr=%u",
1066 fRet, GetLastError()) );
1067 LogRel(("NEM: VidStopVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStopVirtualProcessor.uFunction,
1068 g_IoCtlStopVirtualProcessor.cbInput, g_IoCtlStopVirtualProcessor.cbOutput));
1069
1070 /* VidMessageSlotHandleAndGetNext */
1071 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_MessageSlotHandleAndGetNext;
1072 fRet = g_pfnVidMessageSlotHandleAndGetNext(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE,
1073 NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX, VID_MSHAGN_F_HANDLE_MESSAGE,
1074 NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT);
1075 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1076 AssertStmt(fRet && g_IoCtlMessageSlotHandleAndGetNext.uFunction != 0,
1077 rcRet = RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1078 "Problem figuring out VidMessageSlotHandleAndGetNext: fRet=%u dwErr=%u",
1079 fRet, GetLastError()) );
1080 LogRel(("NEM: VidMessageSlotHandleAndGetNext -> fun:%#x in:%#x out:%#x\n",
1081 g_IoCtlMessageSlotHandleAndGetNext.uFunction, g_IoCtlMessageSlotHandleAndGetNext.cbInput,
1082 g_IoCtlMessageSlotHandleAndGetNext.cbOutput));
1083
1084#endif /* defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(LOG_ENABLED) */
1085#ifdef LOG_ENABLED
1086 /* The following are only for logging: */
1087 union
1088 {
1089 VID_MAPPED_MESSAGE_SLOT MapSlot;
1090 HV_REGISTER_NAME Name;
1091 HV_REGISTER_VALUE Value;
1092 } uBuf;
1093
1094 /* VidMessageSlotMap */
1095 g_pIoCtlDetectForLogging = &g_IoCtlMessageSlotMap;
1096 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1097 fRet = g_pfnVidMessageSlotMap(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &uBuf.MapSlot, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1098 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1099 Assert(fRet);
1100 LogRel(("NEM: VidMessageSlotMap -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1101 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1102
1103 /* VidGetVirtualProcessorState */
1104 uBuf.Name = HvRegisterExplicitSuspend;
1105 g_pIoCtlDetectForLogging = &g_IoCtlGetVirtualProcessorState;
1106 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1107 fRet = g_pfnVidGetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
1108 &uBuf.Name, 1, &uBuf.Value);
1109 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1110 Assert(fRet);
1111 LogRel(("NEM: VidGetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1112 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1113
1114 /* VidSetVirtualProcessorState */
1115 uBuf.Name = HvRegisterExplicitSuspend;
1116 g_pIoCtlDetectForLogging = &g_IoCtlSetVirtualProcessorState;
1117 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1118 fRet = g_pfnVidSetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
1119 &uBuf.Name, 1, &uBuf.Value);
1120 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1121 Assert(fRet);
1122 LogRel(("NEM: VidSetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1123 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1124
1125 g_pIoCtlDetectForLogging = NULL;
1126#endif
1127
1128 /* Done. */
1129#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1130 pVM->nem.s.IoCtlGetHvPartitionId = g_IoCtlGetHvPartitionId;
1131 pVM->nem.s.IoCtlGetPartitionProperty = g_IoCtlGetPartitionProperty;
1132#endif
1133#ifdef NEM_WIN_WITH_RING0_RUNLOOP
1134 pVM->nem.s.IoCtlStartVirtualProcessor = g_IoCtlStartVirtualProcessor;
1135 pVM->nem.s.IoCtlStopVirtualProcessor = g_IoCtlStopVirtualProcessor;
1136 pVM->nem.s.IoCtlMessageSlotHandleAndGetNext = g_IoCtlMessageSlotHandleAndGetNext;
1137#endif
1138 return rcRet;
1139}
1140
1141
1142/**
1143 * Creates and sets up a Hyper-V (exo) partition.
1144 *
1145 * @returns VBox status code.
1146 * @param pVM The cross context VM structure.
1147 * @param pErrInfo Where to always return error info.
1148 */
1149static int nemR3WinInitCreatePartition(PVM pVM, PRTERRINFO pErrInfo)
1150{
1151 AssertReturn(!pVM->nem.s.hPartition, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1152 AssertReturn(!pVM->nem.s.hPartitionDevice, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1153
1154 /*
1155 * Create the partition.
1156 */
1157 WHV_PARTITION_HANDLE hPartition;
1158 HRESULT hrc = WHvCreatePartition(&hPartition);
1159 if (FAILED(hrc))
1160 return RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED, "WHvCreatePartition failed with %Rhrc (Last=%#x/%u)",
1161 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1162
1163 int rc;
1164
1165 /*
1166 * Set partition properties, most importantly the CPU count.
1167 */
1168 /**
1169 * @todo Someone at Microsoft please explain another weird API:
1170 * - Why this API doesn't take the WHV_PARTITION_PROPERTY_CODE value as an
1171 * argument rather than as part of the struct. That is so weird if you've
1172 * used any other NT or windows API, including WHvGetCapability().
1173 * - Why use PVOID when WHV_PARTITION_PROPERTY is what's expected. We
1174 * technically only need 9 bytes for setting/getting
1175 * WHVPartitionPropertyCodeProcessorClFlushSize, but the API insists on 16. */
1176 WHV_PARTITION_PROPERTY Property;
1177 RT_ZERO(Property);
1178 Property.ProcessorCount = pVM->cCpus;
1179 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorCount, &Property, sizeof(Property));
1180 if (SUCCEEDED(hrc))
1181 {
1182 RT_ZERO(Property);
1183 Property.ExtendedVmExits.X64CpuidExit = pVM->nem.s.fExtendedCpuIdExit; /** @todo Register fixed results and restrict cpuid exits */
1184 Property.ExtendedVmExits.X64MsrExit = pVM->nem.s.fExtendedMsrExit;
1185 Property.ExtendedVmExits.ExceptionExit = pVM->nem.s.fExtendedXcptExit;
1186 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExtendedVmExits, &Property, sizeof(Property));
1187 if (SUCCEEDED(hrc))
1188 {
1189 /*
1190 * We'll continue setup in nemR3NativeInitAfterCPUM.
1191 */
1192 pVM->nem.s.fCreatedEmts = false;
1193 pVM->nem.s.hPartition = hPartition;
1194 LogRel(("NEM: Created partition %p.\n", hPartition));
1195 return VINF_SUCCESS;
1196 }
1197
1198 rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1199 "Failed setting WHvPartitionPropertyCodeExtendedVmExits to %'#RX64: %Rhrc",
1200 Property.ExtendedVmExits.AsUINT64, hrc);
1201 }
1202 else
1203 rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1204 "Failed setting WHvPartitionPropertyCodeProcessorCount to %u: %Rhrc (Last=%#x/%u)",
1205 pVM->cCpus, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1206 WHvDeletePartition(hPartition);
1207
1208 Assert(!pVM->nem.s.hPartitionDevice);
1209 Assert(!pVM->nem.s.hPartition);
1210 return rc;
1211}
1212
1213
1214/**
1215 * Makes sure APIC and firmware will not allow X2APIC mode.
1216 *
1217 * This is rather ugly.
1218 *
1219 * @returns VBox status code
1220 * @param pVM The cross context VM structure.
1221 */
1222static int nemR3WinDisableX2Apic(PVM pVM)
1223{
1224 /*
1225 * First make sure the 'Mode' config value of the APIC isn't set to X2APIC.
1226 * This defaults to APIC, so no need to change unless it's X2APIC.
1227 */
1228 PCFGMNODE pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/apic/0/Config");
1229 if (pCfg)
1230 {
1231 uint8_t bMode = 0;
1232 int rc = CFGMR3QueryU8(pCfg, "Mode", &bMode);
1233 AssertLogRelMsgReturn(RT_SUCCESS(rc) || rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1234 if (RT_SUCCESS(rc) && bMode == PDMAPICMODE_X2APIC)
1235 {
1236 LogRel(("NEM: Adjusting APIC configuration from X2APIC to APIC max mode. X2APIC is not supported by the WinHvPlatform API!\n"));
1237 LogRel(("NEM: Disable Hyper-V if you need X2APIC for your guests!\n"));
1238 rc = CFGMR3RemoveValue(pCfg, "Mode");
1239 rc = CFGMR3InsertInteger(pCfg, "Mode", PDMAPICMODE_APIC);
1240 AssertLogRelRCReturn(rc, rc);
1241 }
1242 }
1243
1244 /*
1245 * Now the firmwares.
1246 * These also defaults to APIC and only needs adjusting if configured to X2APIC (2).
1247 */
1248 static const char * const s_apszFirmwareConfigs[] =
1249 {
1250 "/Devices/efi/0/Config",
1251 "/Devices/pcbios/0/Config",
1252 };
1253 for (unsigned i = 0; i < RT_ELEMENTS(s_apszFirmwareConfigs); i++)
1254 {
1255 pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/APIC/0/Config");
1256 if (pCfg)
1257 {
1258 uint8_t bMode = 0;
1259 int rc = CFGMR3QueryU8(pCfg, "APIC", &bMode);
1260 AssertLogRelMsgReturn(RT_SUCCESS(rc) || rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1261 if (RT_SUCCESS(rc) && bMode == 2)
1262 {
1263 LogRel(("NEM: Adjusting %s/Mode from 2 (X2APIC) to 1 (APIC).\n", s_apszFirmwareConfigs[i]));
1264 rc = CFGMR3RemoveValue(pCfg, "APIC");
1265 rc = CFGMR3InsertInteger(pCfg, "APIC", 1);
1266 AssertLogRelRCReturn(rc, rc);
1267 }
1268 }
1269 }
1270
1271 return VINF_SUCCESS;
1272}
1273
1274
1275/**
1276 * Try initialize the native API.
1277 *
1278 * This may only do part of the job, more can be done in
1279 * nemR3NativeInitAfterCPUM() and nemR3NativeInitCompleted().
1280 *
1281 * @returns VBox status code.
1282 * @param pVM The cross context VM structure.
1283 * @param fFallback Whether we're in fallback mode or use-NEM mode. In
1284 * the latter we'll fail if we cannot initialize.
1285 * @param fForced Whether the HMForced flag is set and we should
1286 * fail if we cannot initialize.
1287 */
1288int nemR3NativeInit(PVM pVM, bool fFallback, bool fForced)
1289{
1290 g_uBuildNo = RTSystemGetNtBuildNo();
1291
1292 /*
1293 * Some state init.
1294 */
1295#ifdef NEM_WIN_WITH_A20
1296 pVM->nem.s.fA20Enabled = true;
1297#endif
1298#if 0
1299 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1300 {
1301 PNEMCPU pNemCpu = &pVM->apCpusR3[idCpu]->nem.s;
1302 }
1303#endif
1304
1305#ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1306 /** Some guess working here. */
1307 pVM->nem.s.cMaxMappedPages = 4000;
1308 if (g_uBuildNo >= 22000)
1309 pVM->nem.s.cMaxMappedPages = _64K; /* seems it can do lots more even */
1310#endif
1311
1312 /*
1313 * Error state.
1314 * The error message will be non-empty on failure and 'rc' will be set too.
1315 */
1316 RTERRINFOSTATIC ErrInfo;
1317 PRTERRINFO pErrInfo = RTErrInfoInitStatic(&ErrInfo);
1318 int rc = nemR3WinInitProbeAndLoad(fForced, pErrInfo);
1319 if (RT_SUCCESS(rc))
1320 {
1321 /*
1322 * Check the capabilties of the hypervisor, starting with whether it's present.
1323 */
1324 rc = nemR3WinInitCheckCapabilities(pVM, pErrInfo);
1325 if (RT_SUCCESS(rc))
1326 {
1327 /*
1328 * Discover the VID I/O control function numbers we need.
1329 */
1330 rc = nemR3WinInitDiscoverIoControlProperties(pVM, pErrInfo);
1331 if (rc == VERR_NEM_RING3_ONLY)
1332 {
1333 if (pVM->nem.s.fUseRing0Runloop)
1334 {
1335 LogRel(("NEM: Disabling UseRing0Runloop.\n"));
1336 pVM->nem.s.fUseRing0Runloop = false;
1337 }
1338 rc = VINF_SUCCESS;
1339 }
1340 if (RT_SUCCESS(rc))
1341 {
1342 /*
1343 * Check out our ring-0 capabilities.
1344 */
1345 rc = SUPR3CallVMMR0Ex(VMCC_GET_VMR0_FOR_CALL(pVM), 0 /*idCpu*/, VMMR0_DO_NEM_INIT_VM, 0, NULL);
1346 if (RT_SUCCESS(rc))
1347 {
1348 /*
1349 * Create and initialize a partition.
1350 */
1351 rc = nemR3WinInitCreatePartition(pVM, pErrInfo);
1352 if (RT_SUCCESS(rc))
1353 {
1354 /*
1355 * Set ourselves as the execution engine and make config adjustments.
1356 */
1357 VM_SET_MAIN_EXECUTION_ENGINE(pVM, VM_EXEC_ENGINE_NATIVE_API);
1358 Log(("NEM: Marked active!\n"));
1359 nemR3WinDisableX2Apic(pVM);
1360#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
1361 PGMR3EnableNemMode(pVM);
1362#endif
1363
1364 /*
1365 * Register release statistics
1366 */
1367 STAMR3Register(pVM, (void *)&pVM->nem.s.cMappedPages, STAMTYPE_U32, STAMVISIBILITY_ALWAYS,
1368 "/NEM/PagesCurrentlyMapped", STAMUNIT_PAGES, "Number guest pages currently mapped by the VM");
1369 STAMR3Register(pVM, (void *)&pVM->nem.s.StatMapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1370 "/NEM/PagesMapCalls", STAMUNIT_PAGES, "Calls to WHvMapGpaRange/HvCallMapGpaPages");
1371 STAMR3Register(pVM, (void *)&pVM->nem.s.StatMapPageFailed, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1372 "/NEM/PagesMapFails", STAMUNIT_PAGES, "Calls to WHvMapGpaRange/HvCallMapGpaPages that failed");
1373 STAMR3Register(pVM, (void *)&pVM->nem.s.StatUnmapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1374 "/NEM/PagesUnmapCalls", STAMUNIT_PAGES, "Calls to WHvUnmapGpaRange/HvCallUnmapGpaPages");
1375 STAMR3Register(pVM, (void *)&pVM->nem.s.StatUnmapPageFailed, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1376 "/NEM/PagesUnmapFails", STAMUNIT_PAGES, "Calls to WHvUnmapGpaRange/HvCallUnmapGpaPages that failed");
1377#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1378 STAMR3Register(pVM, (void *)&pVM->nem.s.StatRemapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1379 "/NEM/PagesRemapCalls", STAMUNIT_PAGES, "Calls to HvCallMapGpaPages for changing page protection");
1380 STAMR3Register(pVM, (void *)&pVM->nem.s.StatRemapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1381 "/NEM/PagesRemapFails", STAMUNIT_PAGES, "Calls to HvCallMapGpaPages for changing page protection failed");
1382#elif !defined(VBOX_WITH_PGM_NEM_MODE)
1383 STAMR3Register(pVM, (void *)&pVM->nem.s.StatUnmapAllPages, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1384 "/NEM/PagesUnmapAll", STAMUNIT_PAGES, "Times we had to unmap all the pages");
1385#endif
1386#ifdef VBOX_WITH_PGM_NEM_MODE
1387 STAMR3Register(pVM, &pVM->nem.s.StatProfMapGpaRange, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1388 "/NEM/PagesMapGpaRange", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvMapGpaRange for bigger stuff");
1389 STAMR3Register(pVM, &pVM->nem.s.StatProfUnmapGpaRange, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1390 "/NEM/PagesUnmapGpaRange", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvUnmapGpaRange for bigger stuff");
1391# endif
1392# ifndef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
1393 STAMR3Register(pVM, &pVM->nem.s.StatProfMapGpaRangePage, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1394 "/NEM/PagesMapGpaRangePage", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvMapGpaRange for single pages");
1395 STAMR3Register(pVM, &pVM->nem.s.StatProfUnmapGpaRangePage, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1396 "/NEM/PagesUnmapGpaRangePage", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvUnmapGpaRange for single pages");
1397# endif
1398
1399 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1400 {
1401 PNEMCPU pNemCpu = &pVM->apCpusR3[idCpu]->nem.s;
1402 STAMR3RegisterF(pVM, &pNemCpu->StatExitPortIo, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of port I/O exits", "/NEM/CPU%u/ExitPortIo", idCpu);
1403 STAMR3RegisterF(pVM, &pNemCpu->StatExitMemUnmapped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unmapped memory exits", "/NEM/CPU%u/ExitMemUnmapped", idCpu);
1404 STAMR3RegisterF(pVM, &pNemCpu->StatExitMemIntercept, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of intercepted memory exits", "/NEM/CPU%u/ExitMemIntercept", idCpu);
1405 STAMR3RegisterF(pVM, &pNemCpu->StatExitHalt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitHalt", idCpu);
1406 STAMR3RegisterF(pVM, &pNemCpu->StatExitInterruptWindow, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of interrupt window exits", "/NEM/CPU%u/ExitInterruptWindow", idCpu);
1407 STAMR3RegisterF(pVM, &pNemCpu->StatExitCpuId, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of CPUID exits", "/NEM/CPU%u/ExitCpuId", idCpu);
1408 STAMR3RegisterF(pVM, &pNemCpu->StatExitMsr, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of MSR access exits", "/NEM/CPU%u/ExitMsr", idCpu);
1409 STAMR3RegisterF(pVM, &pNemCpu->StatExitException, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of exception exits", "/NEM/CPU%u/ExitException", idCpu);
1410 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionBp, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #BP exits", "/NEM/CPU%u/ExitExceptionBp", idCpu);
1411 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionDb, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #DB exits", "/NEM/CPU%u/ExitExceptionDb", idCpu);
1412 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionGp, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #GP exits", "/NEM/CPU%u/ExitExceptionGp", idCpu);
1413 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionGpMesa, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #GP exits from mesa driver", "/NEM/CPU%u/ExitExceptionGpMesa", idCpu);
1414 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionUd, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #UD exits", "/NEM/CPU%u/ExitExceptionUd", idCpu);
1415 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionUdHandled, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of handled #UD exits", "/NEM/CPU%u/ExitExceptionUdHandled", idCpu);
1416 STAMR3RegisterF(pVM, &pNemCpu->StatExitUnrecoverable, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unrecoverable exits", "/NEM/CPU%u/ExitUnrecoverable", idCpu);
1417 STAMR3RegisterF(pVM, &pNemCpu->StatGetMsgTimeout, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of get message timeouts/alerts", "/NEM/CPU%u/GetMsgTimeout", idCpu);
1418 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuSuccess, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of successful CPU stops", "/NEM/CPU%u/StopCpuSuccess", idCpu);
1419 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPending, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stops", "/NEM/CPU%u/StopCpuPending", idCpu);
1420 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPendingAlerts,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stop alerts", "/NEM/CPU%u/StopCpuPendingAlerts", idCpu);
1421 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPendingOdd, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of odd pending CPU stops (see code)", "/NEM/CPU%u/StopCpuPendingOdd", idCpu);
1422 STAMR3RegisterF(pVM, &pNemCpu->StatCancelChangedState, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel changed state", "/NEM/CPU%u/CancelChangedState", idCpu);
1423 STAMR3RegisterF(pVM, &pNemCpu->StatCancelAlertedThread, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel alerted EMT", "/NEM/CPU%u/CancelAlertedEMT", idCpu);
1424 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPre, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pre execution FF breaks", "/NEM/CPU%u/BreakOnFFPre", idCpu);
1425 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPost, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of post execution FF breaks", "/NEM/CPU%u/BreakOnFFPost", idCpu);
1426 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnCancel, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel execution breaks", "/NEM/CPU%u/BreakOnCancel", idCpu);
1427 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnStatus, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of status code breaks", "/NEM/CPU%u/BreakOnStatus", idCpu);
1428 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnDemand, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of on-demand state imports", "/NEM/CPU%u/ImportOnDemand", idCpu);
1429 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnReturn, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of state imports on loop return", "/NEM/CPU%u/ImportOnReturn", idCpu);
1430 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnReturnSkipped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of skipped state imports on loop return", "/NEM/CPU%u/ImportOnReturnSkipped", idCpu);
1431 STAMR3RegisterF(pVM, &pNemCpu->StatQueryCpuTick, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of TSC queries", "/NEM/CPU%u/QueryCpuTick", idCpu);
1432 }
1433
1434 PUVM pUVM = pVM->pUVM;
1435 STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesAvailable, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1436 STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Free pages available to the hypervisor",
1437 "/NEM/R0Stats/cPagesAvailable");
1438 STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesInUse, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1439 STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Pages in use by hypervisor",
1440 "/NEM/R0Stats/cPagesInUse");
1441
1442 }
1443 }
1444 else
1445 rc = RTErrInfoSetF(pErrInfo, rc, "VMMR0_DO_NEM_INIT_VM failed: %Rrc", rc);
1446 }
1447 }
1448 }
1449
1450 /*
1451 * We only fail if in forced mode, otherwise just log the complaint and return.
1452 */
1453 Assert(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API || RTErrInfoIsSet(pErrInfo));
1454 if ( (fForced || !fFallback)
1455 && pVM->bMainExecutionEngine != VM_EXEC_ENGINE_NATIVE_API)
1456 return VMSetError(pVM, RT_SUCCESS_NP(rc) ? VERR_NEM_NOT_AVAILABLE : rc, RT_SRC_POS, "%s", pErrInfo->pszMsg);
1457
1458 if (RTErrInfoIsSet(pErrInfo))
1459 LogRel(("NEM: Not available: %s\n", pErrInfo->pszMsg));
1460 return VINF_SUCCESS;
1461}
1462
1463
1464/**
1465 * This is called after CPUMR3Init is done.
1466 *
1467 * @returns VBox status code.
1468 * @param pVM The VM handle..
1469 */
1470int nemR3NativeInitAfterCPUM(PVM pVM)
1471{
1472 /*
1473 * Validate sanity.
1474 */
1475 WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1476 AssertReturn(hPartition != NULL, VERR_WRONG_ORDER);
1477 AssertReturn(!pVM->nem.s.hPartitionDevice, VERR_WRONG_ORDER);
1478 AssertReturn(!pVM->nem.s.fCreatedEmts, VERR_WRONG_ORDER);
1479 AssertReturn(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API, VERR_WRONG_ORDER);
1480
1481 /*
1482 * Continue setting up the partition now that we've got most of the CPUID feature stuff.
1483 */
1484 WHV_PARTITION_PROPERTY Property;
1485 HRESULT hrc;
1486
1487#if 0
1488 /* Not sure if we really need to set the vendor.
1489 Update: Apparently we don't. WHvPartitionPropertyCodeProcessorVendor was removed in 17110. */
1490 RT_ZERO(Property);
1491 Property.ProcessorVendor = pVM->nem.s.enmCpuVendor == CPUMCPUVENDOR_AMD ? WHvProcessorVendorAmd
1492 : WHvProcessorVendorIntel;
1493 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorVendor, &Property, sizeof(Property));
1494 if (FAILED(hrc))
1495 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1496 "Failed to set WHvPartitionPropertyCodeProcessorVendor to %u: %Rhrc (Last=%#x/%u)",
1497 Property.ProcessorVendor, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1498#endif
1499
1500 /* Not sure if we really need to set the cache line flush size. */
1501 RT_ZERO(Property);
1502 Property.ProcessorClFlushSize = pVM->nem.s.cCacheLineFlushShift;
1503 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorClFlushSize, &Property, sizeof(Property));
1504 if (FAILED(hrc))
1505 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1506 "Failed to set WHvPartitionPropertyCodeProcessorClFlushSize to %u: %Rhrc (Last=%#x/%u)",
1507 pVM->nem.s.cCacheLineFlushShift, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1508
1509 /* Intercept #DB, #BP and #UD exceptions. */
1510 RT_ZERO(Property);
1511 Property.ExceptionExitBitmap = RT_BIT_64(WHvX64ExceptionTypeDebugTrapOrFault)
1512 | RT_BIT_64(WHvX64ExceptionTypeBreakpointTrap)
1513 | RT_BIT_64(WHvX64ExceptionTypeInvalidOpcodeFault);
1514
1515 /* Intercept #GP to workaround the buggy mesa vmwgfx driver. */
1516 PVMCPU pVCpu = pVM->apCpusR3[0]; /** @todo In theory per vCPU, in practice same for all. */
1517 if (pVCpu->nem.s.fTrapXcptGpForLovelyMesaDrv)
1518 Property.ExceptionExitBitmap |= RT_BIT_64(WHvX64ExceptionTypeGeneralProtectionFault);
1519
1520 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExceptionExitBitmap, &Property, sizeof(Property));
1521 if (FAILED(hrc))
1522 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1523 "Failed to set WHvPartitionPropertyCodeExceptionExitBitmap to %#RX64: %Rhrc (Last=%#x/%u)",
1524 Property.ExceptionExitBitmap, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1525
1526
1527 /*
1528 * Sync CPU features with CPUM.
1529 */
1530 /** @todo sync CPU features with CPUM. */
1531
1532 /* Set the partition property. */
1533 RT_ZERO(Property);
1534 Property.ProcessorFeatures.AsUINT64 = pVM->nem.s.uCpuFeatures.u64;
1535 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorFeatures, &Property, sizeof(Property));
1536 if (FAILED(hrc))
1537 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1538 "Failed to set WHvPartitionPropertyCodeProcessorFeatures to %'#RX64: %Rhrc (Last=%#x/%u)",
1539 pVM->nem.s.uCpuFeatures.u64, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1540
1541 /*
1542 * Set up the partition.
1543 *
1544 * Seems like this is where the partition is actually instantiated and we get
1545 * a handle to it.
1546 */
1547 hrc = WHvSetupPartition(hPartition);
1548 if (FAILED(hrc))
1549 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1550 "Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)",
1551 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1552
1553 /* Get the handle (could also fish this out via VID.DLL NtDeviceIoControlFile intercepting). */
1554 HANDLE hPartitionDevice;
1555 __try
1556 {
1557 hPartitionDevice = ((HANDLE *)hPartition)[1];
1558 }
1559 __except(EXCEPTION_EXECUTE_HANDLER)
1560 {
1561 hrc = GetExceptionCode();
1562 hPartitionDevice = NULL;
1563 }
1564 if ( hPartitionDevice == NULL
1565 || hPartitionDevice == (HANDLE)(intptr_t)-1)
1566 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1567 "Failed to get device handle for partition %p: %Rhrc", hPartition, hrc);
1568
1569 /* Test the handle. */
1570 HV_PARTITION_PROPERTY uValue;
1571 if (!g_pfnVidGetPartitionProperty(hPartitionDevice, HvPartitionPropertyProcessorVendor, &uValue))
1572 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1573 "Failed to get device handle and/or partition ID for %p (hPartitionDevice=%p, Last=%#x/%u)",
1574 hPartition, hPartitionDevice, RTNtLastStatusValue(), RTNtLastErrorValue());
1575 LogRel(("NEM: HvPartitionPropertyProcessorVendor=%#llx (%lld)\n", uValue, uValue));
1576
1577 /*
1578 * Get the partition ID so we can keep managing our memory the way we've
1579 * been doing for the last 12+ years.
1580 *
1581 * The WHvMapGpaRange/WHvUnmapGpaRange interface is very ill-fitting and
1582 * very inflexible compared to what we need. Fortunately, the hypervisor
1583 * have a much better interface which we are able to use from ring-0.
1584 * Not pretty, but necessary for the time being.
1585 */
1586 HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1587 if (!g_pfnVidGetHvPartitionId(hPartitionDevice, &idHvPartition))
1588 {
1589 if (RTNtLastErrorValue() != ERROR_INVALID_FUNCTION) /* Will try get it later in VMMR0_DO_NEM_INIT_VM_PART_2. */
1590 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1591 "Failed to get device handle and/or partition ID for %p (hPartitionDevice=%p, Last=%#x/%u)",
1592 hPartition, hPartitionDevice, RTNtLastStatusValue(), RTNtLastErrorValue());
1593 LogRel(("NEM: VidGetHvPartitionId failed with ERROR_NOT_SUPPORTED, will try again later from ring-0...\n"));
1594 idHvPartition = HV_PARTITION_ID_INVALID;
1595 }
1596 pVM->nem.s.hPartitionDevice = hPartitionDevice;
1597 pVM->nem.s.idHvPartition = idHvPartition;
1598
1599 /*
1600 * Setup the EMTs.
1601 */
1602 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1603 {
1604 pVCpu = pVM->apCpusR3[idCpu];
1605
1606 pVCpu->nem.s.hNativeThreadHandle = (RTR3PTR)RTThreadGetNativeHandle(VMR3GetThreadHandle(pVCpu->pUVCpu));
1607 Assert((HANDLE)pVCpu->nem.s.hNativeThreadHandle != INVALID_HANDLE_VALUE);
1608
1609#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
1610# ifdef NEM_WIN_WITH_RING0_RUNLOOP
1611 if (!pVM->nem.s.fUseRing0Runloop)
1612# endif
1613 {
1614 hrc = WHvCreateVirtualProcessor(hPartition, idCpu, 0 /*fFlags*/);
1615 if (FAILED(hrc))
1616 {
1617 NTSTATUS const rcNtLast = RTNtLastStatusValue();
1618 DWORD const dwErrLast = RTNtLastErrorValue();
1619 while (idCpu-- > 0)
1620 {
1621 HRESULT hrc2 = WHvDeleteVirtualProcessor(hPartition, idCpu);
1622 AssertLogRelMsg(SUCCEEDED(hrc2), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1623 hPartition, idCpu, hrc2, RTNtLastStatusValue(),
1624 RTNtLastErrorValue()));
1625 }
1626 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1627 "Call to WHvCreateVirtualProcessor failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1628 }
1629 }
1630# ifdef NEM_WIN_WITH_RING0_RUNLOOP
1631 else
1632# endif
1633#endif /* !NEM_WIN_USE_OUR_OWN_RUN_API */
1634#if defined(NEM_WIN_WITH_RING0_RUNLOOP) || defined(NEM_WIN_USE_OUR_OWN_RUN_API)
1635 {
1636 VID_MAPPED_MESSAGE_SLOT MappedMsgSlot = { NULL, UINT32_MAX, UINT32_MAX };
1637 if (g_pfnVidMessageSlotMap(hPartitionDevice, &MappedMsgSlot, idCpu))
1638 {
1639 AssertLogRelMsg(MappedMsgSlot.iCpu == idCpu && MappedMsgSlot.uParentAdvisory == UINT32_MAX,
1640 ("%#x %#x (iCpu=%#x)\n", MappedMsgSlot.iCpu, MappedMsgSlot.uParentAdvisory, idCpu));
1641 pVCpu->nem.s.pvMsgSlotMapping = MappedMsgSlot.pMsgBlock;
1642 }
1643 else
1644 {
1645 NTSTATUS const rcNtLast = RTNtLastStatusValue();
1646 DWORD const dwErrLast = RTNtLastErrorValue();
1647 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1648 "Call to VidMessageSlotMap failed: Last=%#x/%u", rcNtLast, dwErrLast);
1649 }
1650 }
1651#endif
1652 }
1653 pVM->nem.s.fCreatedEmts = true;
1654
1655 /*
1656 * Do some more ring-0 initialization now that we've got the partition handle.
1657 */
1658 int rc = VMMR3CallR0Emt(pVM, pVM->apCpusR3[0], VMMR0_DO_NEM_INIT_VM_PART_2, 0, NULL);
1659 if (RT_SUCCESS(rc))
1660 {
1661 LogRel(("NEM: Successfully set up partition (device handle %p, partition ID %#llx)\n",
1662 hPartitionDevice, pVM->nem.s.idHvPartition));
1663
1664#if 1
1665 VMMR3CallR0Emt(pVM, pVM->apCpusR3[0], VMMR0_DO_NEM_UPDATE_STATISTICS, 0, NULL);
1666 LogRel(("NEM: Memory balance: %#RX64 out of %#RX64 pages in use\n",
1667 pVM->nem.s.R0Stats.cPagesInUse, pVM->nem.s.R0Stats.cPagesAvailable));
1668#endif
1669
1670 /*
1671 * Register statistics on shared pages.
1672 */
1673 /** @todo HvCallMapStatsPage */
1674
1675 /*
1676 * Adjust features.
1677 * Note! We've already disabled X2APIC via CFGM during the first init call.
1678 */
1679
1680#if 0 && defined(DEBUG_bird)
1681 /*
1682 * Poke and probe a little.
1683 */
1684 PVMCPU pVCpu = pVM->apCpusR3[0];
1685 uint32_t aRegNames[1024];
1686 HV_REGISTER_VALUE aRegValues[1024];
1687 uint32_t aPropCodes[128];
1688 uint64_t aPropValues[128];
1689 for (int iOuter = 0; iOuter < 5; iOuter++)
1690 {
1691 LogRel(("\niOuter %d\n", iOuter));
1692# if 1
1693 /* registers */
1694 uint32_t iRegValue = 0;
1695 uint32_t cRegChanges = 0;
1696 for (uint32_t iReg = 0; iReg < 0x001101ff; iReg++)
1697 {
1698 if (iOuter != 0 && aRegNames[iRegValue] > iReg)
1699 continue;
1700 RT_ZERO(pVCpu->nem.s.Hypercall.Experiment);
1701 pVCpu->nem.s.Hypercall.Experiment.uItem = iReg;
1702 int rc2 = VMMR3CallR0Emt(pVM, pVCpu, VMMR0_DO_NEM_EXPERIMENT, 0, NULL);
1703 AssertLogRelRCBreak(rc2);
1704 if (pVCpu->nem.s.Hypercall.Experiment.fSuccess)
1705 {
1706 LogRel(("Register %#010x = %#18RX64, %#18RX64\n", iReg,
1707 pVCpu->nem.s.Hypercall.Experiment.uLoValue, pVCpu->nem.s.Hypercall.Experiment.uHiValue));
1708 if (iReg == HvX64RegisterTsc)
1709 {
1710 uint64_t uTsc = ASMReadTSC();
1711 LogRel(("TSC = %#18RX64; Delta %#18RX64 or %#18RX64\n",
1712 uTsc, pVCpu->nem.s.Hypercall.Experiment.uLoValue - uTsc, uTsc - pVCpu->nem.s.Hypercall.Experiment.uLoValue));
1713 }
1714
1715 if (iOuter == 0)
1716 aRegNames[iRegValue] = iReg;
1717 else if( aRegValues[iRegValue].Reg128.Low64 != pVCpu->nem.s.Hypercall.Experiment.uLoValue
1718 || aRegValues[iRegValue].Reg128.High64 != pVCpu->nem.s.Hypercall.Experiment.uHiValue)
1719 {
1720 LogRel(("Changed from %#18RX64, %#18RX64 !!\n",
1721 aRegValues[iRegValue].Reg128.Low64, aRegValues[iRegValue].Reg128.High64));
1722 LogRel(("Delta %#18RX64, %#18RX64 !!\n",
1723 pVCpu->nem.s.Hypercall.Experiment.uLoValue - aRegValues[iRegValue].Reg128.Low64,
1724 pVCpu->nem.s.Hypercall.Experiment.uHiValue - aRegValues[iRegValue].Reg128.High64));
1725 cRegChanges++;
1726 }
1727 aRegValues[iRegValue].Reg128.Low64 = pVCpu->nem.s.Hypercall.Experiment.uLoValue;
1728 aRegValues[iRegValue].Reg128.High64 = pVCpu->nem.s.Hypercall.Experiment.uHiValue;
1729 iRegValue++;
1730 AssertBreak(iRegValue < RT_ELEMENTS(aRegValues));
1731 }
1732 }
1733 LogRel(("Found %u registers, %u changed\n", iRegValue, cRegChanges));
1734# endif
1735# if 1
1736 /* partition properties */
1737 uint32_t iPropValue = 0;
1738 uint32_t cPropChanges = 0;
1739 for (uint32_t iProp = 0; iProp < 0xc11ff; iProp++)
1740 {
1741 if (iProp == HvPartitionPropertyDebugChannelId /* hangs host */)
1742 continue;
1743 if (iOuter != 0 && aPropCodes[iPropValue] > iProp)
1744 continue;
1745 RT_ZERO(pVCpu->nem.s.Hypercall.Experiment);
1746 pVCpu->nem.s.Hypercall.Experiment.uItem = iProp;
1747 int rc2 = VMMR3CallR0Emt(pVM, pVCpu, VMMR0_DO_NEM_EXPERIMENT, 1, NULL);
1748 AssertLogRelRCBreak(rc2);
1749 if (pVCpu->nem.s.Hypercall.Experiment.fSuccess)
1750 {
1751 LogRel(("Property %#010x = %#18RX64\n", iProp, pVCpu->nem.s.Hypercall.Experiment.uLoValue));
1752 if (iOuter == 0)
1753 aPropCodes[iPropValue] = iProp;
1754 else if (aPropValues[iPropValue] != pVCpu->nem.s.Hypercall.Experiment.uLoValue)
1755 {
1756 LogRel(("Changed from %#18RX64, delta %#18RX64!!\n",
1757 aPropValues[iPropValue], pVCpu->nem.s.Hypercall.Experiment.uLoValue - aPropValues[iPropValue]));
1758 cRegChanges++;
1759 }
1760 aPropValues[iPropValue] = pVCpu->nem.s.Hypercall.Experiment.uLoValue;
1761 iPropValue++;
1762 AssertBreak(iPropValue < RT_ELEMENTS(aPropValues));
1763 }
1764 }
1765 LogRel(("Found %u properties, %u changed\n", iPropValue, cPropChanges));
1766# endif
1767
1768 /* Modify the TSC register value and see what changes. */
1769 if (iOuter != 0)
1770 {
1771 RT_ZERO(pVCpu->nem.s.Hypercall.Experiment);
1772 pVCpu->nem.s.Hypercall.Experiment.uItem = HvX64RegisterTsc;
1773 pVCpu->nem.s.Hypercall.Experiment.uHiValue = UINT64_C(0x00000fffffffffff) >> iOuter;
1774 pVCpu->nem.s.Hypercall.Experiment.uLoValue = UINT64_C(0x0011100000000000) << iOuter;
1775 VMMR3CallR0Emt(pVM, pVCpu, VMMR0_DO_NEM_EXPERIMENT, 2, NULL);
1776 LogRel(("Setting HvX64RegisterTsc -> %RTbool (%#RX64)\n", pVCpu->nem.s.Hypercall.Experiment.fSuccess, pVCpu->nem.s.Hypercall.Experiment.uStatus));
1777 }
1778
1779 RT_ZERO(pVCpu->nem.s.Hypercall.Experiment);
1780 pVCpu->nem.s.Hypercall.Experiment.uItem = HvX64RegisterTsc;
1781 VMMR3CallR0Emt(pVM, pVCpu, VMMR0_DO_NEM_EXPERIMENT, 0, NULL);
1782 LogRel(("HvX64RegisterTsc = %#RX64, %#RX64\n", pVCpu->nem.s.Hypercall.Experiment.uLoValue, pVCpu->nem.s.Hypercall.Experiment.uHiValue));
1783 }
1784
1785#endif
1786 return VINF_SUCCESS;
1787 }
1788 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS, "Call to NEMR0InitVMPart2 failed: %Rrc", rc);
1789}
1790
1791
1792int nemR3NativeInitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
1793{
1794 //BOOL fRet = SetThreadPriority(GetCurrentThread(), 0);
1795 //AssertLogRel(fRet);
1796
1797 NOREF(pVM); NOREF(enmWhat);
1798 return VINF_SUCCESS;
1799}
1800
1801
1802int nemR3NativeTerm(PVM pVM)
1803{
1804 /*
1805 * Delete the partition.
1806 */
1807 WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1808 pVM->nem.s.hPartition = NULL;
1809 pVM->nem.s.hPartitionDevice = NULL;
1810 if (hPartition != NULL)
1811 {
1812 VMCPUID idCpu = pVM->nem.s.fCreatedEmts ? pVM->cCpus : 0;
1813 LogRel(("NEM: Destroying partition %p with its %u VCpus...\n", hPartition, idCpu));
1814 while (idCpu-- > 0)
1815 {
1816 PVMCPU pVCpu = pVM->apCpusR3[idCpu];
1817 pVCpu->nem.s.pvMsgSlotMapping = NULL;
1818#ifndef NEM_WIN_USE_OUR_OWN_RUN_API
1819# ifdef NEM_WIN_WITH_RING0_RUNLOOP
1820 if (!pVM->nem.s.fUseRing0Runloop)
1821# endif
1822 {
1823 HRESULT hrc = WHvDeleteVirtualProcessor(hPartition, idCpu);
1824 AssertLogRelMsg(SUCCEEDED(hrc), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1825 hPartition, idCpu, hrc, RTNtLastStatusValue(),
1826 RTNtLastErrorValue()));
1827 }
1828#endif
1829 }
1830 WHvDeletePartition(hPartition);
1831 }
1832 pVM->nem.s.fCreatedEmts = false;
1833 return VINF_SUCCESS;
1834}
1835
1836
1837/**
1838 * VM reset notification.
1839 *
1840 * @param pVM The cross context VM structure.
1841 */
1842void nemR3NativeReset(PVM pVM)
1843{
1844#if 0
1845 /* Unfix the A20 gate. */
1846 pVM->nem.s.fA20Fixed = false;
1847#else
1848 RT_NOREF(pVM);
1849#endif
1850}
1851
1852
1853/**
1854 * Reset CPU due to INIT IPI or hot (un)plugging.
1855 *
1856 * @param pVCpu The cross context virtual CPU structure of the CPU being
1857 * reset.
1858 * @param fInitIpi Whether this is the INIT IPI or hot (un)plugging case.
1859 */
1860void nemR3NativeResetCpu(PVMCPU pVCpu, bool fInitIpi)
1861{
1862#ifdef NEM_WIN_WITH_A20
1863 /* Lock the A20 gate if INIT IPI, make sure it's enabled. */
1864 if (fInitIpi && pVCpu->idCpu > 0)
1865 {
1866 PVM pVM = pVCpu->CTX_SUFF(pVM);
1867 if (!pVM->nem.s.fA20Enabled)
1868 nemR3NativeNotifySetA20(pVCpu, true);
1869 pVM->nem.s.fA20Enabled = true;
1870 pVM->nem.s.fA20Fixed = true;
1871 }
1872#else
1873 RT_NOREF(pVCpu, fInitIpi);
1874#endif
1875}
1876
1877
1878VBOXSTRICTRC nemR3NativeRunGC(PVM pVM, PVMCPU pVCpu)
1879{
1880#ifdef NEM_WIN_WITH_RING0_RUNLOOP
1881 if (pVM->nem.s.fUseRing0Runloop)
1882 {
1883 for (;;)
1884 {
1885 VBOXSTRICTRC rcStrict = VMMR3CallR0EmtFast(pVM, pVCpu, VMMR0_DO_NEM_RUN);
1886 if (RT_SUCCESS(rcStrict))
1887 {
1888 /*
1889 * We deal with VINF_NEM_FLUSH_TLB here, since we're running the risk of
1890 * getting these while we already got another RC (I/O ports).
1891 */
1892 /* Status codes: */
1893 VBOXSTRICTRC rcPending = pVCpu->nem.s.rcPending;
1894 pVCpu->nem.s.rcPending = VINF_SUCCESS;
1895 if (rcStrict == VINF_NEM_FLUSH_TLB || rcPending == VINF_NEM_FLUSH_TLB)
1896 {
1897 LogFlow(("nemR3NativeRunGC: calling PGMFlushTLB...\n"));
1898 int rc = PGMFlushTLB(pVCpu, CPUMGetGuestCR3(pVCpu), true /*fGlobal*/, false /*fPdpesMapped*/);
1899 AssertRCReturn(rc, rc);
1900 if (rcStrict == VINF_NEM_FLUSH_TLB)
1901 {
1902 if ( !VM_FF_IS_ANY_SET(pVM, VM_FF_HIGH_PRIORITY_POST_MASK | VM_FF_HP_R0_PRE_HM_MASK)
1903 && !VMCPU_FF_IS_ANY_SET(pVCpu, (VMCPU_FF_HIGH_PRIORITY_POST_MASK | VMCPU_FF_HP_R0_PRE_HM_MASK)
1904 & ~VMCPU_FF_RESUME_GUEST_MASK))
1905 {
1906 VMCPU_FF_CLEAR_MASK(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
1907 continue;
1908 }
1909 rcStrict = VINF_SUCCESS;
1910 }
1911 }
1912 else
1913 AssertMsg(rcPending == VINF_SUCCESS, ("rcPending=%Rrc\n", VBOXSTRICTRC_VAL(rcPending) ));
1914 }
1915 LogFlow(("nemR3NativeRunGC: returns %Rrc\n", VBOXSTRICTRC_VAL(rcStrict) ));
1916 return rcStrict;
1917 }
1918 }
1919#endif
1920 return nemHCWinRunGC(pVM, pVCpu);
1921}
1922
1923
1924VMMR3_INT_DECL(bool) NEMR3CanExecuteGuest(PVM pVM, PVMCPU pVCpu)
1925{
1926 Assert(VM_IS_NEM_ENABLED(pVM));
1927
1928#ifndef NEM_WIN_WITH_A20
1929 /*
1930 * Only execute when the A20 gate is enabled because this lovely Hyper-V
1931 * blackbox does not seem to have any way to enable or disable A20.
1932 */
1933 RT_NOREF(pVM);
1934 return PGMPhysIsA20Enabled(pVCpu);
1935#else
1936 RT_NOREF(pVM, pVCpu);
1937 return true;
1938#endif
1939}
1940
1941
1942bool nemR3NativeSetSingleInstruction(PVM pVM, PVMCPU pVCpu, bool fEnable)
1943{
1944 NOREF(pVM); NOREF(pVCpu); NOREF(fEnable);
1945 return false;
1946}
1947
1948
1949/**
1950 * Forced flag notification call from VMEmt.h.
1951 *
1952 * This is only called when pVCpu is in the VMCPUSTATE_STARTED_EXEC_NEM state.
1953 *
1954 * @param pVM The cross context VM structure.
1955 * @param pVCpu The cross context virtual CPU structure of the CPU
1956 * to be notified.
1957 * @param fFlags Notification flags, VMNOTIFYFF_FLAGS_XXX.
1958 */
1959void nemR3NativeNotifyFF(PVM pVM, PVMCPU pVCpu, uint32_t fFlags)
1960{
1961#ifdef NEM_WIN_USE_OUR_OWN_RUN_API
1962 nemHCWinCancelRunVirtualProcessor(pVM, pVCpu);
1963#else
1964# ifdef NEM_WIN_WITH_RING0_RUNLOOP
1965 if (pVM->nem.s.fUseRing0Runloop)
1966 nemHCWinCancelRunVirtualProcessor(pVM, pVCpu);
1967 else
1968# endif
1969 {
1970 Log8(("nemR3NativeNotifyFF: canceling %u\n", pVCpu->idCpu));
1971 HRESULT hrc = WHvCancelRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, 0);
1972 AssertMsg(SUCCEEDED(hrc), ("WHvCancelRunVirtualProcessor -> hrc=%Rhrc\n", hrc));
1973 RT_NOREF_PV(hrc);
1974 }
1975#endif
1976 RT_NOREF_PV(fFlags);
1977}
1978
1979
1980DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv)
1981{
1982 PGMPAGEMAPLOCK Lock;
1983 int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, &Lock);
1984 if (RT_SUCCESS(rc))
1985 PGMPhysReleasePageMappingLock(pVM, &Lock);
1986 return rc;
1987}
1988
1989
1990DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv)
1991{
1992 PGMPAGEMAPLOCK Lock;
1993 int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, &Lock);
1994 if (RT_SUCCESS(rc))
1995 PGMPhysReleasePageMappingLock(pVM, &Lock);
1996 return rc;
1997}
1998
1999
2000VMMR3_INT_DECL(int) NEMR3NotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvR3,
2001 uint8_t *pu2State, uint32_t *puNemRange)
2002{
2003 Log5(("NEMR3NotifyPhysRamRegister: %RGp LB %RGp, pvR3=%p pu2State=%p (%d) puNemRange=%p (%d)\n",
2004 GCPhys, cb, pvR3, pu2State, pu2State, puNemRange, *puNemRange));
2005
2006 *pu2State = UINT8_MAX;
2007 RT_NOREF(puNemRange);
2008
2009#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
2010 if (pvR3)
2011 {
2012 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
2013 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvR3, GCPhys, cb,
2014 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute);
2015 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
2016 if (SUCCEEDED(hrc))
2017 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
2018 else
2019 {
2020 LogRel(("NEMR3NotifyPhysRamRegister: GCPhys=%RGp LB %RGp pvR3=%p hrc=%Rhrc (%#x) Last=%#x/%u\n",
2021 GCPhys, cb, pvR3, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2022 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2023 return VERR_NEM_MAP_PAGES_FAILED;
2024 }
2025 }
2026#else
2027 RT_NOREF(pVM, GCPhys, cb, pvR3);
2028#endif
2029 return VINF_SUCCESS;
2030}
2031
2032
2033VMMR3_INT_DECL(bool) NEMR3IsMmio2DirtyPageTrackingSupported(PVM pVM)
2034{
2035 RT_NOREF(pVM);
2036 return g_pfnWHvQueryGpaRangeDirtyBitmap != NULL;
2037}
2038
2039
2040VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExMapEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags,
2041 void *pvRam, void *pvMmio2, uint8_t *pu2State, uint32_t *puNemRange)
2042{
2043 Log5(("NEMR3NotifyPhysMmioExMapEarly: %RGp LB %RGp fFlags=%#x pvRam=%p pvMmio2=%p pu2State=%p (%d) puNemRange=%p (%#x)\n",
2044 GCPhys, cb, fFlags, pvRam, pvMmio2, pu2State, *pu2State, puNemRange, puNemRange ? *puNemRange : UINT32_MAX));
2045 RT_NOREF(puNemRange);
2046
2047#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
2048 /*
2049 * Unmap the RAM we're replacing.
2050 */
2051 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_REPLACE)
2052 {
2053 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfUnmapGpaRange, a);
2054 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, cb);
2055 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfUnmapGpaRange, a);
2056 if (SUCCEEDED(hrc))
2057 { /* likely */ }
2058 else if (pvMmio2)
2059 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u (ignored)\n",
2060 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2061 else
2062 {
2063 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u\n",
2064 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2065 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
2066 return VERR_NEM_UNMAP_PAGES_FAILED;
2067 }
2068 }
2069
2070 /*
2071 * Map MMIO2 if any.
2072 */
2073 if (pvMmio2)
2074 {
2075 Assert(fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2);
2076 WHV_MAP_GPA_RANGE_FLAGS fWHvFlags = WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute;
2077 if ((fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_TRACK_DIRTY_PAGES) && g_pfnWHvQueryGpaRangeDirtyBitmap)
2078 fWHvFlags |= WHvMapGpaRangeFlagTrackDirtyPages;
2079 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
2080 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvMmio2, GCPhys, cb, fWHvFlags);
2081 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
2082 if (SUCCEEDED(hrc))
2083 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
2084 else
2085 {
2086 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x pvMmio2=%p fWHvFlags=%#x: Map -> hrc=%Rhrc (%#x) Last=%#x/%u\n",
2087 GCPhys, cb, fFlags, pvMmio2, fWHvFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2088 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2089 return VERR_NEM_MAP_PAGES_FAILED;
2090 }
2091 }
2092 else
2093 {
2094 Assert(!(fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2));
2095 *pu2State = NEM_WIN_PAGE_STATE_UNMAPPED;
2096 }
2097 RT_NOREF(pvRam);
2098
2099#else
2100 RT_NOREF(pVM, GCPhys, cb, pvRam, pvMmio2);
2101 *pu2State = (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_REPLACE) ? UINT8_MAX : NEM_WIN_PAGE_STATE_UNMAPPED;
2102#endif
2103 return VINF_SUCCESS;
2104}
2105
2106
2107VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExMapLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags,
2108 void *pvRam, void *pvMmio2, uint32_t *puNemRange)
2109{
2110 RT_NOREF(pVM, GCPhys, cb, fFlags, pvRam, pvMmio2, puNemRange);
2111 return VINF_SUCCESS;
2112}
2113
2114
2115VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExUnmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags, void *pvRam,
2116 void *pvMmio2, uint8_t *pu2State)
2117{
2118 Log5(("NEMR3NotifyPhysMmioExUnmap: %RGp LB %RGp fFlags=%#x pvRam=%p pvMmio2=%p pu2State=%p\n",
2119 GCPhys, cb, fFlags, pvRam, pvMmio2, pu2State));
2120
2121 int rc = VINF_SUCCESS;
2122#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
2123 /*
2124 * Unmap the MMIO2 pages.
2125 */
2126 /** @todo If we implement aliasing (MMIO2 page aliased into MMIO range),
2127 * we may have more stuff to unmap even in case of pure MMIO... */
2128 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2)
2129 {
2130 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfUnmapGpaRange, a);
2131 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, cb);
2132 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfUnmapGpaRange, a);
2133 if (FAILED(hrc))
2134 {
2135 LogRel2(("NEMR3NotifyPhysMmioExUnmap: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u (ignored)\n",
2136 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2137 rc = VERR_NEM_UNMAP_PAGES_FAILED;
2138 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
2139 }
2140 }
2141
2142 /*
2143 * Restore the RAM we replaced.
2144 */
2145 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_REPLACE)
2146 {
2147 AssertPtr(pvRam);
2148 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
2149 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvRam, GCPhys, cb,
2150 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute);
2151 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
2152 if (SUCCEEDED(hrc))
2153 { /* likely */ }
2154 else
2155 {
2156 LogRel(("NEMR3NotifyPhysMmioExUnmap: GCPhys=%RGp LB %RGp pvMmio2=%p hrc=%Rhrc (%#x) Last=%#x/%u\n",
2157 GCPhys, cb, pvMmio2, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2158 rc = VERR_NEM_MAP_PAGES_FAILED;
2159 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2160 }
2161 if (pu2State)
2162 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
2163 }
2164 /* Mark the pages as unmapped if relevant. */
2165 else if (pu2State)
2166 *pu2State = NEM_WIN_PAGE_STATE_UNMAPPED;
2167
2168 RT_NOREF(pvMmio2);
2169#else
2170 RT_NOREF(pVM, GCPhys, cb, fFlags, pvRam, pvMmio2, pu2State);
2171 if (pu2State)
2172 *pu2State = UINT8_MAX;
2173#endif
2174 return rc;
2175}
2176
2177
2178VMMR3_INT_DECL(int) NEMR3PhysMmio2QueryAndResetDirtyBitmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t uNemRange,
2179 void *pvBitmap, size_t cbBitmap)
2180{
2181#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
2182 Assert(VM_IS_NEM_ENABLED(pVM));
2183 AssertReturn(g_pfnWHvQueryGpaRangeDirtyBitmap, VERR_INTERNAL_ERROR_2);
2184 Assert(cbBitmap == (uint32_t)cbBitmap);
2185 RT_NOREF(uNemRange);
2186
2187 /* This is being profiled by PGM, see /PGM/Mmio2QueryAndResetDirtyBitmap. */
2188 HRESULT hrc = WHvQueryGpaRangeDirtyBitmap(pVM->nem.s.hPartition, GCPhys, cb, (UINT64 *)pvBitmap, (uint32_t)cbBitmap);
2189 if (SUCCEEDED(hrc))
2190 return VINF_SUCCESS;
2191
2192 AssertLogRelMsgFailed(("GCPhys=%RGp LB %RGp pvBitmap=%p LB %#zx hrc=%Rhrc (%#x) Last=%#x/%u\n",
2193 GCPhys, cb, pvBitmap, cbBitmap, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2194 return VERR_NEM_QUERY_DIRTY_BITMAP_FAILED;
2195
2196#else
2197 RT_NOREF(pVM, GCPhys, cb, uNemRange, pvBitmap, cbBitmap);
2198 AssertFailed();
2199 return VERR_NOT_IMPLEMENTED;
2200#endif
2201}
2202
2203
2204VMMR3_INT_DECL(int) NEMR3NotifyPhysRomRegisterEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvPages, uint32_t fFlags,
2205 uint8_t *pu2State)
2206{
2207 Log5(("nemR3NativeNotifyPhysRomRegisterEarly: %RGp LB %RGp pvPages=%p fFlags=%#x\n", GCPhys, cb, pvPages, fFlags));
2208 *pu2State = UINT8_MAX;
2209
2210#if 0 /* Let's not do this after all. We'll protection change notifications for each page and if not we'll map them lazily. */
2211 RTGCPHYS const cPages = cb >> X86_PAGE_SHIFT;
2212 for (RTGCPHYS iPage = 0; iPage < cPages; iPage++, GCPhys += X86_PAGE_SIZE)
2213 {
2214 const void *pvPage;
2215 int rc = nemR3NativeGCPhys2R3PtrReadOnly(pVM, GCPhys, &pvPage);
2216 if (RT_SUCCESS(rc))
2217 {
2218 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, (void *)pvPage, GCPhys, X86_PAGE_SIZE,
2219 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagExecute);
2220 if (SUCCEEDED(hrc))
2221 { /* likely */ }
2222 else
2223 {
2224 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2225 GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2226 return VERR_NEM_INIT_FAILED;
2227 }
2228 }
2229 else
2230 {
2231 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2232 return rc;
2233 }
2234 }
2235 RT_NOREF_PV(fFlags);
2236#else
2237 RT_NOREF(pVM, GCPhys, cb, pvPages, fFlags);
2238#endif
2239 return VINF_SUCCESS;
2240}
2241
2242
2243VMMR3_INT_DECL(int) NEMR3NotifyPhysRomRegisterLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvPages,
2244 uint32_t fFlags, uint8_t *pu2State)
2245{
2246 Log5(("nemR3NativeNotifyPhysRomRegisterLate: %RGp LB %RGp pvPages=%p fFlags=%#x pu2State=%p\n",
2247 GCPhys, cb, pvPages, fFlags, pu2State));
2248 *pu2State = UINT8_MAX;
2249
2250#if !defined(NEM_WIN_USE_HYPERCALLS_FOR_PAGES) && defined(VBOX_WITH_PGM_NEM_MODE)
2251 /*
2252 * (Re-)map readonly.
2253 */
2254 AssertPtrReturn(pvPages, VERR_INVALID_POINTER);
2255 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
2256 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvPages, GCPhys, cb, WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagExecute);
2257 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
2258 if (SUCCEEDED(hrc))
2259 *pu2State = NEM_WIN_PAGE_STATE_READABLE;
2260 else
2261 {
2262 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp LB %RGp pvPages=%p fFlags=%#x hrc=%Rhrc (%#x) Last=%#x/%u\n",
2263 GCPhys, cb, pvPages, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2264 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2265 return VERR_NEM_MAP_PAGES_FAILED;
2266 }
2267 RT_NOREF(fFlags);
2268#else
2269 RT_NOREF(pVM, GCPhys, cb, pvPages, fFlags);
2270#endif
2271 return VINF_SUCCESS;
2272}
2273
2274#ifdef NEM_WIN_WITH_A20
2275
2276/**
2277 * @callback_method_impl{FNPGMPHYSNEMCHECKPAGE}
2278 */
2279static DECLCALLBACK(int) nemR3WinUnsetForA20CheckerCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys,
2280 PPGMPHYSNEMPAGEINFO pInfo, void *pvUser)
2281{
2282 /* We'll just unmap the memory. */
2283 if (pInfo->u2NemState > NEM_WIN_PAGE_STATE_UNMAPPED)
2284 {
2285#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2286 int rc = nemHCWinHypercallUnmapPage(pVM, pVCpu, GCPhys);
2287 AssertRC(rc);
2288 if (RT_SUCCESS(rc))
2289#else
2290 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
2291 if (SUCCEEDED(hrc))
2292#endif
2293 {
2294 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPage);
2295 uint32_t cMappedPages = ASMAtomicDecU32(&pVM->nem.s.cMappedPages); NOREF(cMappedPages);
2296 Log5(("NEM GPA unmapped/A20: %RGp (was %s, cMappedPages=%u)\n", GCPhys, g_apszPageStates[pInfo->u2NemState], cMappedPages));
2297 pInfo->u2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
2298 }
2299 else
2300 {
2301 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
2302#ifdef NEM_WIN_USE_HYPERCALLS_FOR_PAGES
2303 LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2304 return rc;
2305#else
2306 LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2307 GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2308 return VERR_INTERNAL_ERROR_2;
2309#endif
2310 }
2311 }
2312 RT_NOREF(pVCpu, pvUser);
2313 return VINF_SUCCESS;
2314}
2315
2316
2317/**
2318 * Unmaps a page from Hyper-V for the purpose of emulating A20 gate behavior.
2319 *
2320 * @returns The PGMPhysNemQueryPageInfo result.
2321 * @param pVM The cross context VM structure.
2322 * @param pVCpu The cross context virtual CPU structure.
2323 * @param GCPhys The page to unmap.
2324 */
2325static int nemR3WinUnmapPageForA20Gate(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2326{
2327 PGMPHYSNEMPAGEINFO Info;
2328 return PGMPhysNemPageInfoChecker(pVM, pVCpu, GCPhys, false /*fMakeWritable*/, &Info,
2329 nemR3WinUnsetForA20CheckerCallback, NULL);
2330}
2331
2332#endif /* NEM_WIN_WITH_A20 */
2333
2334/**
2335 * Called when the A20 state changes.
2336 *
2337 * Hyper-V doesn't seem to offer a simple way of implementing the A20 line
2338 * features of PCs. So, we do a very minimal emulation of the HMA to make DOS
2339 * happy.
2340 *
2341 * @param pVCpu The CPU the A20 state changed on.
2342 * @param fEnabled Whether it was enabled (true) or disabled.
2343 */
2344VMMR3_INT_DECL(void) NEMR3NotifySetA20(PVMCPU pVCpu, bool fEnabled)
2345{
2346 Log(("nemR3NativeNotifySetA20: fEnabled=%RTbool\n", fEnabled));
2347 Assert(VM_IS_NEM_ENABLED(pVCpu->CTX_SUFF(pVM)));
2348#ifdef NEM_WIN_WITH_A20
2349 PVM pVM = pVCpu->CTX_SUFF(pVM);
2350 if (!pVM->nem.s.fA20Fixed)
2351 {
2352 pVM->nem.s.fA20Enabled = fEnabled;
2353 for (RTGCPHYS GCPhys = _1M; GCPhys < _1M + _64K; GCPhys += X86_PAGE_SIZE)
2354 nemR3WinUnmapPageForA20Gate(pVM, pVCpu, GCPhys);
2355 }
2356#else
2357 RT_NOREF(pVCpu, fEnabled);
2358#endif
2359}
2360
2361
2362/** @page pg_nem_win NEM/win - Native Execution Manager, Windows.
2363 *
2364 * On Windows the Hyper-V root partition (dom0 in zen terminology) does not have
2365 * nested VT-x or AMD-V capabilities. Early on raw-mode worked inside it, but
2366 * for a while now we've been getting \#GPs when trying to modify CR4 in the
2367 * world switcher. So, when Hyper-V is active on Windows we have little choice
2368 * but to use Hyper-V to run our VMs.
2369 *
2370 *
2371 * @section sub_nem_win_whv The WinHvPlatform API
2372 *
2373 * Since Windows 10 build 17083 there is a documented API for managing Hyper-V
2374 * VMs: header file WinHvPlatform.h and implementation in WinHvPlatform.dll.
2375 * This interface is a wrapper around the undocumented Virtualization
2376 * Infrastructure Driver (VID) API - VID.DLL and VID.SYS. The wrapper is
2377 * written in C++, namespaced, early versions (at least) was using standard C++
2378 * container templates in several places.
2379 *
2380 * When creating a VM using WHvCreatePartition, it will only create the
2381 * WinHvPlatform structures for it, to which you get an abstract pointer. The
2382 * VID API that actually creates the partition is first engaged when you call
2383 * WHvSetupPartition after first setting a lot of properties using
2384 * WHvSetPartitionProperty. Since the VID API is just a very thin wrapper
2385 * around CreateFile and NtDeviceIoControlFile, it returns an actual HANDLE for
2386 * the partition to WinHvPlatform. We fish this HANDLE out of the WinHvPlatform
2387 * partition structures because we need to talk directly to VID for reasons
2388 * we'll get to in a bit. (Btw. we could also intercept the CreateFileW or
2389 * NtDeviceIoControlFile calls from VID.DLL to get the HANDLE should fishing in
2390 * the partition structures become difficult.)
2391 *
2392 * The WinHvPlatform API requires us to both set the number of guest CPUs before
2393 * setting up the partition and call WHvCreateVirtualProcessor for each of them.
2394 * The CPU creation function boils down to a VidMessageSlotMap call that sets up
2395 * and maps a message buffer into ring-3 for async communication with hyper-V
2396 * and/or the VID.SYS thread actually running the CPU thru
2397 * WinHvRunVpDispatchLoop(). When for instance a VMEXIT is encountered, hyper-V
2398 * sends a message that the WHvRunVirtualProcessor API retrieves (and later
2399 * acknowledges) via VidMessageSlotHandleAndGetNext. Since or about build
2400 * 17757 a register page is also mapped into user space when creating the
2401 * virtual CPU. It should be noteded that WHvDeleteVirtualProcessor doesn't do
2402 * much as there seems to be no partner function VidMessagesSlotMap that
2403 * reverses what it did.
2404 *
2405 * Memory is managed thru calls to WHvMapGpaRange and WHvUnmapGpaRange (GPA does
2406 * not mean grade point average here, but rather guest physical addressspace),
2407 * which corresponds to VidCreateVaGpaRangeSpecifyUserVa and VidDestroyGpaRange
2408 * respectively. As 'UserVa' indicates, the functions works on user process
2409 * memory. The mappings are also subject to quota restrictions, so the number
2410 * of ranges are limited and probably their total size as well. Obviously
2411 * VID.SYS keeps track of the ranges, but so does WinHvPlatform, which means
2412 * there is a bit of overhead involved and quota restrctions makes sense.
2413 *
2414 * Running guest code is done through the WHvRunVirtualProcessor function. It
2415 * asynchronously starts or resumes hyper-V CPU execution and then waits for an
2416 * VMEXIT message. Hyper-V / VID.SYS will return information about the message
2417 * in the message buffer mapping, and WHvRunVirtualProcessor will convert that
2418 * finto it's own WHV_RUN_VP_EXIT_CONTEXT format.
2419 *
2420 * Other threads can interrupt the execution by using WHvCancelVirtualProcessor,
2421 * which since or about build 17757 uses VidMessageSlotHandleAndGetNext to do
2422 * the work (earlier builds would open the waiting thread, do a dummy
2423 * QueueUserAPC on it, and let it upon return use VidStopVirtualProcessor to
2424 * do the actual stopping). While there is certainly a race between cancelation
2425 * and the CPU causing a natural VMEXIT, it is not known whether this still
2426 * causes extra work on subsequent WHvRunVirtualProcessor calls (it did in and
2427 * earlier than 17134).
2428 *
2429 * Registers are retrieved and set via WHvGetVirtualProcessorRegisters and
2430 * WHvSetVirtualProcessorRegisters. In addition, several VMEXITs include
2431 * essential register state in the exit context information, potentially making
2432 * it possible to emulate the instruction causing the exit without involving
2433 * WHvGetVirtualProcessorRegisters.
2434 *
2435 *
2436 * @subsection subsec_nem_win_whv_cons Issues & Feedback
2437 *
2438 * Here are some observations (mostly against build 17101):
2439 *
2440 * - The VMEXIT performance is dismal (build 17134).
2441 *
2442 * Our proof of concept implementation with a kernel runloop (i.e. not using
2443 * WHvRunVirtualProcessor and friends, but calling VID.SYS fast I/O control
2444 * entry point directly) delivers 9-10% of the port I/O performance and only
2445 * 6-7% of the MMIO performance that we have with our own hypervisor.
2446 *
2447 * When using the offical WinHvPlatform API, the numbers are %3 for port I/O
2448 * and 5% for MMIO.
2449 *
2450 * While the tests we've done are using tight tight loops only doing port I/O
2451 * and MMIO, the problem is clearly visible when running regular guest OSes.
2452 * Anything that hammers the VGA device would be suffering, for example:
2453 *
2454 * - Windows 2000 boot screen animation overloads us with MMIO exits
2455 * and won't even boot because all the time is spent in interrupt
2456 * handlers and redrawin the screen.
2457 *
2458 * - DSL 4.4 and its bootmenu logo is slower than molasses in january.
2459 *
2460 * We have not found a workaround for this yet.
2461 *
2462 * Something that might improve the issue a little is to detect blocks with
2463 * excessive MMIO and port I/O exits and emulate instructions to cover
2464 * multiple exits before letting Hyper-V have a go at the guest execution
2465 * again. This will only improve the situation under some circumstances,
2466 * since emulating instructions without recompilation can be expensive, so
2467 * there will only be real gains if the exitting instructions are tightly
2468 * packed.
2469 *
2470 * Update: Security fixes during the summer of 2018 caused the performance to
2471 * dropped even more.
2472 *
2473 * Update [build 17757]: Some performance improvements here, but they don't
2474 * yet make up for what was lost this summer.
2475 *
2476 *
2477 * - We need a way to directly modify the TSC offset (or bias if you like).
2478 *
2479 * The current approach of setting the WHvX64RegisterTsc register one by one
2480 * on each virtual CPU in sequence will introduce random inaccuracies,
2481 * especially if the thread doing the job is reschduled at a bad time.
2482 *
2483 *
2484 * - Unable to access WHvX64RegisterMsrMtrrCap (build 17134).
2485 *
2486 *
2487 * - On AMD Ryzen grub/debian 9.0 ends up with a unrecoverable exception
2488 * when IA32_MTRR_PHYSMASK0 is written.
2489 *
2490 *
2491 * - The IA32_APIC_BASE register does not work right:
2492 *
2493 * - Attempts by the guest to clear bit 11 (EN) are ignored, both the
2494 * guest and the VMM reads back the old value.
2495 *
2496 * - Attempts to modify the base address (bits NN:12) seems to be ignored
2497 * in the same way.
2498 *
2499 * - The VMM can modify both the base address as well as the the EN and
2500 * BSP bits, however this is useless if we cannot intercept the WRMSR.
2501 *
2502 * - Attempts by the guest to set the EXTD bit (X2APIC) result in \#GP(0),
2503 * while the VMM ends up with with ERROR_HV_INVALID_PARAMETER. Seems
2504 * there is no way to support X2APIC.
2505 *
2506 *
2507 * - Not sure if this is a thing, but WHvCancelVirtualProcessor seems to cause
2508 * cause a lot more spurious WHvRunVirtualProcessor returns that what we get
2509 * with the replacement code. By spurious returns we mean that the
2510 * subsequent call to WHvRunVirtualProcessor would return immediately.
2511 *
2512 * Update [build 17757]: New cancelation code might have addressed this, but
2513 * haven't had time to test it yet.
2514 *
2515 *
2516 * - There is no API for modifying protection of a page within a GPA range.
2517 *
2518 * From what we can tell, the only way to modify the protection (like readonly
2519 * -> writable, or vice versa) is to first unmap the range and then remap it
2520 * with the new protection.
2521 *
2522 * We are for instance doing this quite a bit in order to track dirty VRAM
2523 * pages. VRAM pages starts out as readonly, when the guest writes to a page
2524 * we take an exit, notes down which page it is, makes it writable and restart
2525 * the instruction. After refreshing the display, we reset all the writable
2526 * pages to readonly again, bulk fashion.
2527 *
2528 * Now to work around this issue, we do page sized GPA ranges. In addition to
2529 * add a lot of tracking overhead to WinHvPlatform and VID.SYS, this also
2530 * causes us to exceed our quota before we've even mapped a default sized
2531 * (128MB) VRAM page-by-page. So, to work around this quota issue we have to
2532 * lazily map pages and actively restrict the number of mappings.
2533 *
2534 * Our best workaround thus far is bypassing WinHvPlatform and VID entirely
2535 * when in comes to guest memory management and instead use the underlying
2536 * hypercalls (HvCallMapGpaPages, HvCallUnmapGpaPages) to do it ourselves.
2537 * (This also maps a whole lot better into our own guest page management
2538 * infrastructure.)
2539 *
2540 * Update [build 17757]: Introduces a KVM like dirty logging API which could
2541 * help tracking dirty VGA pages, while being useless for shadow ROM and
2542 * devices trying catch the guest updating descriptors and such.
2543 *
2544 *
2545 * - Observed problems doing WHvUnmapGpaRange immediately followed by
2546 * WHvMapGpaRange.
2547 *
2548 * As mentioned above, we've been forced to use this sequence when modifying
2549 * page protection. However, when transitioning from readonly to writable,
2550 * we've ended up looping forever with the same write to readonly memory
2551 * VMEXIT. We're wondering if this issue might be related to the lazy mapping
2552 * logic in WinHvPlatform.
2553 *
2554 * Workaround: Insert a WHvRunVirtualProcessor call and make sure to get a GPA
2555 * unmapped exit between the two calls. Not entirely great performance wise
2556 * (or the santity of our code).
2557 *
2558 *
2559 * - Implementing A20 gate behavior is tedious, where as correctly emulating the
2560 * A20M# pin (present on 486 and later) is near impossible for SMP setups
2561 * (e.g. possiblity of two CPUs with different A20 status).
2562 *
2563 * Workaround #1 (obsolete): Only do A20 on CPU 0, restricting the emulation
2564 * to HMA. We unmap all pages related to HMA (0x100000..0x10ffff) when the A20
2565 * state changes, lazily syncing the right pages back when accessed.
2566 *
2567 * Workaround #2 (used): Use IEM when the A20 gate is disabled.
2568 *
2569 *
2570 * - WHVRunVirtualProcessor wastes time converting VID/Hyper-V messages to its
2571 * own format (WHV_RUN_VP_EXIT_CONTEXT).
2572 *
2573 * We understand this might be because Microsoft wishes to remain free to
2574 * modify the VID/Hyper-V messages, but it's still rather silly and does slow
2575 * things down a little. We'd much rather just process the messages directly.
2576 *
2577 *
2578 * - WHVRunVirtualProcessor would've benefited from using a callback interface:
2579 *
2580 * - The potential size changes of the exit context structure wouldn't be
2581 * an issue, since the function could manage that itself.
2582 *
2583 * - State handling could probably be simplified (like cancelation).
2584 *
2585 *
2586 * - WHvGetVirtualProcessorRegisters and WHvSetVirtualProcessorRegisters
2587 * internally converts register names, probably using temporary heap buffers.
2588 *
2589 * From the looks of things, they are converting from WHV_REGISTER_NAME to
2590 * HV_REGISTER_NAME from in the "Virtual Processor Register Names" section in
2591 * the "Hypervisor Top-Level Functional Specification" document. This feels
2592 * like an awful waste of time.
2593 *
2594 * We simply cannot understand why HV_REGISTER_NAME isn't used directly here,
2595 * or at least the same values, making any conversion reduntant. Restricting
2596 * access to certain registers could easily be implement by scanning the
2597 * inputs.
2598 *
2599 * To avoid the heap + conversion overhead, we're currently using the
2600 * HvCallGetVpRegisters and HvCallSetVpRegisters calls directly, at least for
2601 * the ring-0 code.
2602 *
2603 * Update [build 17757]: Register translation has been very cleverly
2604 * optimized and made table driven (2 top level tables, 4 + 1 leaf tables).
2605 * Register information consists of the 32-bit HV register name, register page
2606 * offset, and flags (giving valid offset, size and more). Register
2607 * getting/settings seems to be done by hoping that the register page provides
2608 * it all, and falling back on the VidSetVirtualProcessorState if one or more
2609 * registers are not available there.
2610 *
2611 * Note! We have currently not updated our ring-0 code to take the register
2612 * page into account, so it's suffering a little compared to the ring-3 code
2613 * that now uses the offical APIs for registers.
2614 *
2615 *
2616 * - The YMM and XCR0 registers are not yet named (17083). This probably
2617 * wouldn't be a problem if HV_REGISTER_NAME was used, see previous point.
2618 *
2619 * Update [build 17757]: XCR0 is added. YMM register values seems to be put
2620 * into a yet undocumented XsaveState interface. Approach is a little bulky,
2621 * but saves number of enums and dispenses with register transation. Also,
2622 * the underlying Vid setter API duplicates the input buffer on the heap,
2623 * adding a 16 byte header.
2624 *
2625 *
2626 * - Why does VID.SYS only query/set 32 registers at the time thru the
2627 * HvCallGetVpRegisters and HvCallSetVpRegisters hypercalls?
2628 *
2629 * We've not trouble getting/setting all the registers defined by
2630 * WHV_REGISTER_NAME in one hypercall (around 80). Some kind of stack
2631 * buffering or similar?
2632 *
2633 *
2634 * - To handle the VMMCALL / VMCALL instructions, it seems we need to intercept
2635 * \#UD exceptions and inspect the opcodes. A dedicated exit for hypercalls
2636 * would be more efficient, esp. for guests using \#UD for other purposes..
2637 *
2638 *
2639 * - Wrong instruction length in the VpContext with unmapped GPA memory exit
2640 * contexts on 17115/AMD.
2641 *
2642 * One byte "PUSH CS" was reported as 2 bytes, while a two byte
2643 * "MOV [EBX],EAX" was reported with a 1 byte instruction length. Problem
2644 * naturally present in untranslated hyper-v messages.
2645 *
2646 *
2647 * - The I/O port exit context information seems to be missing the address size
2648 * information needed for correct string I/O emulation.
2649 *
2650 * VT-x provides this information in bits 7:9 in the instruction information
2651 * field on newer CPUs. AMD-V in bits 7:9 in the EXITINFO1 field in the VMCB.
2652 *
2653 * We can probably work around this by scanning the instruction bytes for
2654 * address size prefixes. Haven't investigated it any further yet.
2655 *
2656 *
2657 * - Querying WHvCapabilityCodeExceptionExitBitmap returns zero even when
2658 * intercepts demonstrably works (17134).
2659 *
2660 *
2661 * - Querying HvPartitionPropertyDebugChannelId via HvCallGetPartitionProperty
2662 * (hypercall) hangs the host (17134).
2663 *
2664 * - CommonUtilities::GuidToString needs a 'static' before the hex digit array,
2665 * looks pointless to re-init a stack copy it for each call (novice mistake).
2666 *
2667 *
2668 * Old concerns that have been addressed:
2669 *
2670 * - The WHvCancelVirtualProcessor API schedules a dummy usermode APC callback
2671 * in order to cancel any current or future alertable wait in VID.SYS during
2672 * the VidMessageSlotHandleAndGetNext call.
2673 *
2674 * IIRC this will make the kernel schedule the specified callback thru
2675 * NTDLL!KiUserApcDispatcher by modifying the thread context and quite
2676 * possibly the userland thread stack. When the APC callback returns to
2677 * KiUserApcDispatcher, it will call NtContinue to restore the old thread
2678 * context and resume execution from there. This naturally adds up to some
2679 * CPU cycles, ring transitions aren't for free, especially after Spectre &
2680 * Meltdown mitigations.
2681 *
2682 * Using NtAltertThread call could do the same without the thread context
2683 * modifications and the extra kernel call.
2684 *
2685 * Update: All concerns have addressed in or about build 17757.
2686 *
2687 * The WHvCancelVirtualProcessor API is now implemented using a new
2688 * VidMessageSlotHandleAndGetNext() flag (4). Codepath is slightly longer
2689 * than NtAlertThread, but has the added benefit that spurious wakeups can be
2690 * more easily reduced.
2691 *
2692 *
2693 * - When WHvRunVirtualProcessor returns without a message, or on a terse
2694 * VID message like HLT, it will make a kernel call to get some registers.
2695 * This is potentially inefficient if the caller decides he needs more
2696 * register state.
2697 *
2698 * It would be better to just return what's available and let the caller fetch
2699 * what is missing from his point of view in a single kernel call.
2700 *
2701 * Update: All concerns have been addressed in or about build 17757. Selected
2702 * registers are now available via shared memory and thus HLT should (not
2703 * verified) no longer require a system call to compose the exit context data.
2704 *
2705 *
2706 * - The WHvRunVirtualProcessor implementation does lazy GPA range mappings when
2707 * a unmapped GPA message is received from hyper-V.
2708 *
2709 * Since MMIO is currently realized as unmapped GPA, this will slow down all
2710 * MMIO accesses a tiny little bit as WHvRunVirtualProcessor looks up the
2711 * guest physical address to check if it is a pending lazy mapping.
2712 *
2713 * The lazy mapping feature makes no sense to us. We as API user have all the
2714 * information and can do lazy mapping ourselves if we want/have to (see next
2715 * point).
2716 *
2717 * Update: All concerns have been addressed in or about build 17757.
2718 *
2719 *
2720 * - The WHvGetCapability function has a weird design:
2721 * - The CapabilityCode parameter is pointlessly duplicated in the output
2722 * structure (WHV_CAPABILITY).
2723 *
2724 * - API takes void pointer, but everyone will probably be using
2725 * WHV_CAPABILITY due to WHV_CAPABILITY::CapabilityCode making it
2726 * impractical to use anything else.
2727 *
2728 * - No output size.
2729 *
2730 * - See GetFileAttributesEx, GetFileInformationByHandleEx,
2731 * FindFirstFileEx, and others for typical pattern for generic
2732 * information getters.
2733 *
2734 * Update: All concerns have been addressed in build 17110.
2735 *
2736 *
2737 * - The WHvGetPartitionProperty function uses the same weird design as
2738 * WHvGetCapability, see above.
2739 *
2740 * Update: All concerns have been addressed in build 17110.
2741 *
2742 *
2743 * - The WHvSetPartitionProperty function has a totally weird design too:
2744 * - In contrast to its partner WHvGetPartitionProperty, the property code
2745 * is not a separate input parameter here but part of the input
2746 * structure.
2747 *
2748 * - The input structure is a void pointer rather than a pointer to
2749 * WHV_PARTITION_PROPERTY which everyone probably will be using because
2750 * of the WHV_PARTITION_PROPERTY::PropertyCode field.
2751 *
2752 * - Really, why use PVOID for the input when the function isn't accepting
2753 * minimal sizes. E.g. WHVPartitionPropertyCodeProcessorClFlushSize only
2754 * requires a 9 byte input, but the function insists on 16 bytes (17083).
2755 *
2756 * - See GetFileAttributesEx, SetFileInformationByHandle, FindFirstFileEx,
2757 * and others for typical pattern for generic information setters and
2758 * getters.
2759 *
2760 * Update: All concerns have been addressed in build 17110.
2761 *
2762 *
2763 * @section sec_nem_win_large_pages Large Pages
2764 *
2765 * We've got a standalone memory allocation and access testcase bs3-memalloc-1
2766 * which was run with 48GiB of guest RAM configured on a NUC 11 box running
2767 * Windows 11 GA. In the simplified NEM memory mode no exits should be
2768 * generated while the access tests are running.
2769 *
2770 * The bs3-memalloc-1 results kind of hints at some tiny speed-up if the guest
2771 * RAM is allocated using the MEM_LARGE_PAGES flag, but only in the 3rd access
2772 * check (typical 350 000 MiB/s w/o and around 400 000 MiB/s). The result for
2773 * the 2nd access varies a lot, perhaps hinting at some table optimizations
2774 * going on.
2775 *
2776 * The initial access where the memory is locked/whatever has absolutely horrid
2777 * results regardless of whether large pages are enabled or not. Typically
2778 * bobbing close to 500 MiB/s, non-large pages a little faster.
2779 *
2780 * NEM w/ simplified memory and MEM_LARGE_PAGES:
2781 * @verbatim
2782bs3-memalloc-1: TESTING...
2783bs3-memalloc-1: #0/0x0: 0x0000000000000000 LB 0x000000000009fc00 USABLE (1)
2784bs3-memalloc-1: #1/0x1: 0x000000000009fc00 LB 0x0000000000000400 RESERVED (2)
2785bs3-memalloc-1: #2/0x2: 0x00000000000f0000 LB 0x0000000000010000 RESERVED (2)
2786bs3-memalloc-1: #3/0x3: 0x0000000000100000 LB 0x00000000dfef0000 USABLE (1)
2787bs3-memalloc-1: #4/0x4: 0x00000000dfff0000 LB 0x0000000000010000 ACPI_RECLAIMABLE (3)
2788bs3-memalloc-1: #5/0x5: 0x00000000fec00000 LB 0x0000000000001000 RESERVED (2)
2789bs3-memalloc-1: #6/0x6: 0x00000000fee00000 LB 0x0000000000001000 RESERVED (2)
2790bs3-memalloc-1: #7/0x7: 0x00000000fffc0000 LB 0x0000000000040000 RESERVED (2)
2791bs3-memalloc-1: #8/0x9: 0x0000000100000000 LB 0x0000000b20000000 USABLE (1)
2792bs3-memalloc-1: Found 1 interesting entries covering 0xb20000000 bytes (44 GB).
2793bs3-memalloc-1: From 0x100000000 to 0xc20000000
2794bs3-memalloc-1: INT15h/E820 : PASSED
2795bs3-memalloc-1: Mapping memory above 4GB : PASSED
2796bs3-memalloc-1: Pages : 11 665 408 pages
2797bs3-memalloc-1: MiBs : 45 568 MB
2798bs3-memalloc-1: Alloc elapsed : 90 925 263 996 ns
2799bs3-memalloc-1: Alloc elapsed in ticks : 272 340 387 336 ticks
2800bs3-memalloc-1: Page alloc time : 7 794 ns/page
2801bs3-memalloc-1: Page alloc time in ticks : 23 345 ticks/page
2802bs3-memalloc-1: Alloc thruput : 128 296 pages/s
2803bs3-memalloc-1: Alloc thruput in MiBs : 501 MB/s
2804bs3-memalloc-1: Allocation speed : PASSED
2805bs3-memalloc-1: Access elapsed : 85 074 483 467 ns
2806bs3-memalloc-1: Access elapsed in ticks : 254 816 088 412 ticks
2807bs3-memalloc-1: Page access time : 7 292 ns/page
2808bs3-memalloc-1: Page access time in ticks : 21 843 ticks/page
2809bs3-memalloc-1: Access thruput : 137 119 pages/s
2810bs3-memalloc-1: Access thruput in MiBs : 535 MB/s
2811bs3-memalloc-1: 2nd access : PASSED
2812bs3-memalloc-1: Access elapsed : 112 963 925 ns
2813bs3-memalloc-1: Access elapsed in ticks : 338 284 436 ticks
2814bs3-memalloc-1: Page access time : 9 ns/page
2815bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2816bs3-memalloc-1: Access thruput : 103 266 666 pages/s
2817bs3-memalloc-1: Access thruput in MiBs : 403 385 MB/s
2818bs3-memalloc-1: 3rd access : PASSED
2819bs3-memalloc-1: SUCCESS
2820 * @endverbatim
2821 *
2822 * NEM w/ simplified memory and but no MEM_LARGE_PAGES:
2823 * @verbatim
2824bs3-memalloc-1: From 0x100000000 to 0xc20000000
2825bs3-memalloc-1: Pages : 11 665 408 pages
2826bs3-memalloc-1: MiBs : 45 568 MB
2827bs3-memalloc-1: Alloc elapsed : 90 062 027 900 ns
2828bs3-memalloc-1: Alloc elapsed in ticks : 269 754 826 466 ticks
2829bs3-memalloc-1: Page alloc time : 7 720 ns/page
2830bs3-memalloc-1: Page alloc time in ticks : 23 124 ticks/page
2831bs3-memalloc-1: Alloc thruput : 129 526 pages/s
2832bs3-memalloc-1: Alloc thruput in MiBs : 505 MB/s
2833bs3-memalloc-1: Allocation speed : PASSED
2834bs3-memalloc-1: Access elapsed : 3 596 017 220 ns
2835bs3-memalloc-1: Access elapsed in ticks : 10 770 732 620 ticks
2836bs3-memalloc-1: Page access time : 308 ns/page
2837bs3-memalloc-1: Page access time in ticks : 923 ticks/page
2838bs3-memalloc-1: Access thruput : 3 243 980 pages/s
2839bs3-memalloc-1: Access thruput in MiBs : 12 671 MB/s
2840bs3-memalloc-1: 2nd access : PASSED
2841bs3-memalloc-1: Access elapsed : 133 060 160 ns
2842bs3-memalloc-1: Access elapsed in ticks : 398 459 884 ticks
2843bs3-memalloc-1: Page access time : 11 ns/page
2844bs3-memalloc-1: Page access time in ticks : 34 ticks/page
2845bs3-memalloc-1: Access thruput : 87 670 178 pages/s
2846bs3-memalloc-1: Access thruput in MiBs : 342 461 MB/s
2847bs3-memalloc-1: 3rd access : PASSED
2848 * @endverbatim
2849 *
2850 * Same everything but native VT-x and VBox (stripped output a little):
2851 * @verbatim
2852bs3-memalloc-1: From 0x100000000 to 0xc20000000
2853bs3-memalloc-1: Pages : 11 665 408 pages
2854bs3-memalloc-1: MiBs : 45 568 MB
2855bs3-memalloc-1: Alloc elapsed : 776 111 427 ns
2856bs3-memalloc-1: Alloc elapsed in ticks : 2 323 267 035 ticks
2857bs3-memalloc-1: Page alloc time : 66 ns/page
2858bs3-memalloc-1: Page alloc time in ticks : 199 ticks/page
2859bs3-memalloc-1: Alloc thruput : 15 030 584 pages/s
2860bs3-memalloc-1: Alloc thruput in MiBs : 58 713 MB/s
2861bs3-memalloc-1: Allocation speed : PASSED
2862bs3-memalloc-1: Access elapsed : 112 141 904 ns
2863bs3-memalloc-1: Access elapsed in ticks : 335 751 077 ticks
2864bs3-memalloc-1: Page access time : 9 ns/page
2865bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2866bs3-memalloc-1: Access thruput : 104 023 630 pages/s
2867bs3-memalloc-1: Access thruput in MiBs : 406 342 MB/s
2868bs3-memalloc-1: 2nd access : PASSED
2869bs3-memalloc-1: Access elapsed : 112 023 049 ns
2870bs3-memalloc-1: Access elapsed in ticks : 335 418 343 ticks
2871bs3-memalloc-1: Page access time : 9 ns/page
2872bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2873bs3-memalloc-1: Access thruput : 104 133 998 pages/s
2874bs3-memalloc-1: Access thruput in MiBs : 406 773 MB/s
2875bs3-memalloc-1: 3rd access : PASSED
2876 * @endverbatim
2877 *
2878 * VBox with large pages disabled:
2879 * @verbatim
2880bs3-memalloc-1: From 0x100000000 to 0xc20000000
2881bs3-memalloc-1: Pages : 11 665 408 pages
2882bs3-memalloc-1: MiBs : 45 568 MB
2883bs3-memalloc-1: Alloc elapsed : 50 986 588 028 ns
2884bs3-memalloc-1: Alloc elapsed in ticks : 152 714 862 044 ticks
2885bs3-memalloc-1: Page alloc time : 4 370 ns/page
2886bs3-memalloc-1: Page alloc time in ticks : 13 091 ticks/page
2887bs3-memalloc-1: Alloc thruput : 228 793 pages/s
2888bs3-memalloc-1: Alloc thruput in MiBs : 893 MB/s
2889bs3-memalloc-1: Allocation speed : PASSED
2890bs3-memalloc-1: Access elapsed : 2 849 641 741 ns
2891bs3-memalloc-1: Access elapsed in ticks : 8 535 372 249 ticks
2892bs3-memalloc-1: Page access time : 244 ns/page
2893bs3-memalloc-1: Page access time in ticks : 731 ticks/page
2894bs3-memalloc-1: Access thruput : 4 093 640 pages/s
2895bs3-memalloc-1: Access thruput in MiBs : 15 990 MB/s
2896bs3-memalloc-1: 2nd access : PASSED
2897bs3-memalloc-1: Access elapsed : 2 866 960 770 ns
2898bs3-memalloc-1: Access elapsed in ticks : 8 587 097 799 ticks
2899bs3-memalloc-1: Page access time : 245 ns/page
2900bs3-memalloc-1: Page access time in ticks : 736 ticks/page
2901bs3-memalloc-1: Access thruput : 4 068 910 pages/s
2902bs3-memalloc-1: Access thruput in MiBs : 15 894 MB/s
2903bs3-memalloc-1: 3rd access : PASSED
2904 * @endverbatim
2905 *
2906 * Comparing large pages, therer is an allocation speed difference of two order
2907 * of magnitude. When disabling large pages in VBox the allocation numbers are
2908 * closer, and the is clear from the 2nd and 3rd access tests that VBox doesn't
2909 * spend enough memory on nested page tables as Hyper-V does. The similar 2nd
2910 * and 3rd access numbers the two large page testruns seems to hint strongly at
2911 * Hyper-V eventually getting the large pages in place too, only that it sucks
2912 * hundredfold in the setting up phase.
2913 *
2914 *
2915 *
2916 * @section sec_nem_win_impl Our implementation.
2917 *
2918 * We set out with the goal of wanting to run as much as possible in ring-0,
2919 * reasoning that this would give use the best performance.
2920 *
2921 * This goal was approached gradually, starting out with a pure WinHvPlatform
2922 * implementation, gradually replacing parts: register access, guest memory
2923 * handling, running virtual processors. Then finally moving it all into
2924 * ring-0, while keeping most of it configurable so that we could make
2925 * comparisons (see NEMInternal.h and nemR3NativeRunGC()).
2926 *
2927 *
2928 * @subsection subsect_nem_win_impl_ioctl VID.SYS I/O control calls
2929 *
2930 * To run things in ring-0 we need to talk directly to VID.SYS thru its I/O
2931 * control interface. Looking at changes between like build 17083 and 17101 (if
2932 * memory serves) a set of the VID I/O control numbers shifted a little, which
2933 * means we need to determin them dynamically. We currently do this by hooking
2934 * the NtDeviceIoControlFile API call from VID.DLL and snooping up the
2935 * parameters when making dummy calls to relevant APIs. (We could also
2936 * disassemble the relevant APIs and try fish out the information from that, but
2937 * this is way simpler.)
2938 *
2939 * Issuing I/O control calls from ring-0 is facing a small challenge with
2940 * respect to direct buffering. When using direct buffering the device will
2941 * typically check that the buffer is actually in the user address space range
2942 * and reject kernel addresses. Fortunately, we've got the cross context VM
2943 * structure that is mapped into both kernel and user space, it's also locked
2944 * and safe to access from kernel space. So, we place the I/O control buffers
2945 * in the per-CPU part of it (NEMCPU::uIoCtlBuf) and give the driver the user
2946 * address if direct access buffering or kernel address if not.
2947 *
2948 * The I/O control calls are 'abstracted' in the support driver, see
2949 * SUPR0IoCtlSetupForHandle(), SUPR0IoCtlPerform() and SUPR0IoCtlCleanup().
2950 *
2951 *
2952 * @subsection subsect_nem_win_impl_cpumctx CPUMCTX
2953 *
2954 * Since the CPU state needs to live in Hyper-V when executing, we probably
2955 * should not transfer more than necessary when handling VMEXITs. To help us
2956 * manage this CPUMCTX got a new field CPUMCTX::fExtrn that to indicate which
2957 * part of the state is currently externalized (== in Hyper-V).
2958 *
2959 *
2960 * @subsection sec_nem_win_benchmarks Benchmarks.
2961 *
2962 * @subsubsection subsect_nem_win_benchmarks_bs2t1 17134/2018-06-22: Bootsector2-test1
2963 *
2964 * This is ValidationKit/bootsectors/bootsector2-test1.asm as of 2018-06-22
2965 * (internal r123172) running a the release build of VirtualBox from the same
2966 * source, though with exit optimizations disabled. Host is AMD Threadripper 1950X
2967 * running out an up to date 64-bit Windows 10 build 17134.
2968 *
2969 * The base line column is using the official WinHv API for everything but physical
2970 * memory mapping. The 2nd column is the default NEM/win configuration where we
2971 * put the main execution loop in ring-0, using hypercalls when we can and VID for
2972 * managing execution. The 3rd column is regular VirtualBox using AMD-V directly,
2973 * hyper-V is disabled, main execution loop in ring-0.
2974 *
2975 * @verbatim
2976TESTING... WinHv API Hypercalls + VID VirtualBox AMD-V
2977 32-bit paged protected mode, CPUID : 108 874 ins/sec 113% / 123 602 1198% / 1 305 113
2978 32-bit pae protected mode, CPUID : 106 722 ins/sec 115% / 122 740 1232% / 1 315 201
2979 64-bit long mode, CPUID : 106 798 ins/sec 114% / 122 111 1198% / 1 280 404
2980 16-bit unpaged protected mode, CPUID : 106 835 ins/sec 114% / 121 994 1216% / 1 299 665
2981 32-bit unpaged protected mode, CPUID : 105 257 ins/sec 115% / 121 772 1235% / 1 300 860
2982 real mode, CPUID : 104 507 ins/sec 116% / 121 800 1228% / 1 283 848
2983CPUID EAX=1 : PASSED
2984 32-bit paged protected mode, RDTSC : 99 581 834 ins/sec 100% / 100 323 307 93% / 93 473 299
2985 32-bit pae protected mode, RDTSC : 99 620 585 ins/sec 100% / 99 960 952 84% / 83 968 839
2986 64-bit long mode, RDTSC : 100 540 009 ins/sec 100% / 100 946 372 93% / 93 652 826
2987 16-bit unpaged protected mode, RDTSC : 99 688 473 ins/sec 100% / 100 097 751 76% / 76 281 287
2988 32-bit unpaged protected mode, RDTSC : 98 385 857 ins/sec 102% / 100 510 404 94% / 93 379 536
2989 real mode, RDTSC : 100 087 967 ins/sec 101% / 101 386 138 93% / 93 234 999
2990RDTSC : PASSED
2991 32-bit paged protected mode, Read CR4 : 2 156 102 ins/sec 98% / 2 121 967 17114% / 369 009 009
2992 32-bit pae protected mode, Read CR4 : 2 163 820 ins/sec 98% / 2 133 804 17469% / 377 999 261
2993 64-bit long mode, Read CR4 : 2 164 822 ins/sec 98% / 2 128 698 18875% / 408 619 313
2994 16-bit unpaged protected mode, Read CR4 : 2 162 367 ins/sec 100% / 2 168 508 17132% / 370 477 568
2995 32-bit unpaged protected mode, Read CR4 : 2 163 189 ins/sec 100% / 2 169 808 16768% / 362 734 679
2996 real mode, Read CR4 : 2 162 436 ins/sec 100% / 2 164 914 15551% / 336 288 998
2997Read CR4 : PASSED
2998 real mode, 32-bit IN : 104 649 ins/sec 118% / 123 513 1028% / 1 075 831
2999 real mode, 32-bit OUT : 107 102 ins/sec 115% / 123 660 982% / 1 052 259
3000 real mode, 32-bit IN-to-ring-3 : 105 697 ins/sec 98% / 104 471 201% / 213 216
3001 real mode, 32-bit OUT-to-ring-3 : 105 830 ins/sec 98% / 104 598 198% / 210 495
3002 16-bit unpaged protected mode, 32-bit IN : 104 855 ins/sec 117% / 123 174 1029% / 1 079 591
3003 16-bit unpaged protected mode, 32-bit OUT : 107 529 ins/sec 115% / 124 250 992% / 1 067 053
3004 16-bit unpaged protected mode, 32-bit IN-to-ring-3 : 106 337 ins/sec 103% / 109 565 196% / 209 367
3005 16-bit unpaged protected mode, 32-bit OUT-to-ring-3 : 107 558 ins/sec 100% / 108 237 191% / 206 387
3006 32-bit unpaged protected mode, 32-bit IN : 106 351 ins/sec 116% / 123 584 1016% / 1 081 325
3007 32-bit unpaged protected mode, 32-bit OUT : 106 424 ins/sec 116% / 124 252 995% / 1 059 408
3008 32-bit unpaged protected mode, 32-bit IN-to-ring-3 : 104 035 ins/sec 101% / 105 305 202% / 210 750
3009 32-bit unpaged protected mode, 32-bit OUT-to-ring-3 : 103 831 ins/sec 102% / 106 919 205% / 213 198
3010 32-bit paged protected mode, 32-bit IN : 103 356 ins/sec 119% / 123 870 1041% / 1 076 463
3011 32-bit paged protected mode, 32-bit OUT : 107 177 ins/sec 115% / 124 302 998% / 1 069 655
3012 32-bit paged protected mode, 32-bit IN-to-ring-3 : 104 491 ins/sec 100% / 104 744 200% / 209 264
3013 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 106 603 ins/sec 97% / 103 849 197% / 210 219
3014 32-bit pae protected mode, 32-bit IN : 105 923 ins/sec 115% / 122 759 1041% / 1 103 261
3015 32-bit pae protected mode, 32-bit OUT : 107 083 ins/sec 117% / 126 057 1024% / 1 096 667
3016 32-bit pae protected mode, 32-bit IN-to-ring-3 : 106 114 ins/sec 97% / 103 496 199% / 211 312
3017 32-bit pae protected mode, 32-bit OUT-to-ring-3 : 105 675 ins/sec 96% / 102 096 198% / 209 890
3018 64-bit long mode, 32-bit IN : 105 800 ins/sec 113% / 120 006 1013% / 1 072 116
3019 64-bit long mode, 32-bit OUT : 105 635 ins/sec 113% / 120 375 997% / 1 053 655
3020 64-bit long mode, 32-bit IN-to-ring-3 : 105 274 ins/sec 95% / 100 763 197% / 208 026
3021 64-bit long mode, 32-bit OUT-to-ring-3 : 106 262 ins/sec 94% / 100 749 196% / 209 288
3022NOP I/O Port Access : PASSED
3023 32-bit paged protected mode, 32-bit read : 57 687 ins/sec 119% / 69 136 1197% / 690 548
3024 32-bit paged protected mode, 32-bit write : 57 957 ins/sec 118% / 68 935 1183% / 685 930
3025 32-bit paged protected mode, 32-bit read-to-ring-3 : 57 958 ins/sec 95% / 55 432 276% / 160 505
3026 32-bit paged protected mode, 32-bit write-to-ring-3 : 57 922 ins/sec 100% / 58 340 304% / 176 464
3027 32-bit pae protected mode, 32-bit read : 57 478 ins/sec 119% / 68 453 1141% / 656 159
3028 32-bit pae protected mode, 32-bit write : 57 226 ins/sec 118% / 68 097 1157% / 662 504
3029 32-bit pae protected mode, 32-bit read-to-ring-3 : 57 582 ins/sec 94% / 54 651 268% / 154 867
3030 32-bit pae protected mode, 32-bit write-to-ring-3 : 57 697 ins/sec 100% / 57 750 299% / 173 030
3031 64-bit long mode, 32-bit read : 57 128 ins/sec 118% / 67 779 1071% / 611 949
3032 64-bit long mode, 32-bit write : 57 127 ins/sec 118% / 67 632 1084% / 619 395
3033 64-bit long mode, 32-bit read-to-ring-3 : 57 181 ins/sec 94% / 54 123 265% / 151 937
3034 64-bit long mode, 32-bit write-to-ring-3 : 57 297 ins/sec 99% / 57 286 294% / 168 694
3035 16-bit unpaged protected mode, 32-bit read : 58 827 ins/sec 118% / 69 545 1185% / 697 602
3036 16-bit unpaged protected mode, 32-bit write : 58 678 ins/sec 118% / 69 442 1183% / 694 387
3037 16-bit unpaged protected mode, 32-bit read-to-ring-3 : 57 841 ins/sec 96% / 55 730 275% / 159 163
3038 16-bit unpaged protected mode, 32-bit write-to-ring-3 : 57 855 ins/sec 101% / 58 834 304% / 176 169
3039 32-bit unpaged protected mode, 32-bit read : 58 063 ins/sec 120% / 69 690 1233% / 716 444
3040 32-bit unpaged protected mode, 32-bit write : 57 936 ins/sec 120% / 69 633 1199% / 694 753
3041 32-bit unpaged protected mode, 32-bit read-to-ring-3 : 58 451 ins/sec 96% / 56 183 273% / 159 972
3042 32-bit unpaged protected mode, 32-bit write-to-ring-3 : 58 962 ins/sec 99% / 58 955 298% / 175 936
3043 real mode, 32-bit read : 58 571 ins/sec 118% / 69 478 1160% / 679 917
3044 real mode, 32-bit write : 58 418 ins/sec 118% / 69 320 1185% / 692 513
3045 real mode, 32-bit read-to-ring-3 : 58 072 ins/sec 96% / 55 751 274% / 159 145
3046 real mode, 32-bit write-to-ring-3 : 57 870 ins/sec 101% / 58 755 307% / 178 042
3047NOP MMIO Access : PASSED
3048SUCCESS
3049 * @endverbatim
3050 *
3051 * What we see here is:
3052 *
3053 * - The WinHv API approach is 10 to 12 times slower for exits we can
3054 * handle directly in ring-0 in the VBox AMD-V code.
3055 *
3056 * - The WinHv API approach is 2 to 3 times slower for exits we have to
3057 * go to ring-3 to handle with the VBox AMD-V code.
3058 *
3059 * - By using hypercalls and VID.SYS from ring-0 we gain between
3060 * 13% and 20% over the WinHv API on exits handled in ring-0.
3061 *
3062 * - For exits requiring ring-3 handling are between 6% slower and 3% faster
3063 * than the WinHv API.
3064 *
3065 *
3066 * As a side note, it looks like Hyper-V doesn't let the guest read CR4 but
3067 * triggers exits all the time. This isn't all that important these days since
3068 * OSes like Linux cache the CR4 value specifically to avoid these kinds of exits.
3069 *
3070 *
3071 * @subsubsection subsect_nem_win_benchmarks_bs2t1u1 17134/2018-10-02: Bootsector2-test1
3072 *
3073 * Update on 17134. While expectantly testing a couple of newer builds (17758,
3074 * 17763) hoping for some increases in performance, the numbers turned out
3075 * altogether worse than the June test run. So, we went back to the 1803
3076 * (17134) installation, made sure it was fully up to date (as per 2018-10-02)
3077 * and re-tested.
3078 *
3079 * The numbers had somehow turned significantly worse over the last 3-4 months,
3080 * dropping around 70% for the WinHv API test, more for Hypercalls + VID.
3081 *
3082 * @verbatim
3083TESTING... WinHv API Hypercalls + VID VirtualBox AMD-V *
3084 32-bit paged protected mode, CPUID : 33 270 ins/sec 33 154
3085 real mode, CPUID : 33 534 ins/sec 32 711
3086 [snip]
3087 32-bit paged protected mode, RDTSC : 102 216 011 ins/sec 98 225 419
3088 real mode, RDTSC : 102 492 243 ins/sec 98 225 419
3089 [snip]
3090 32-bit paged protected mode, Read CR4 : 2 096 165 ins/sec 2 123 815
3091 real mode, Read CR4 : 2 081 047 ins/sec 2 075 151
3092 [snip]
3093 32-bit paged protected mode, 32-bit IN : 32 739 ins/sec 33 655
3094 32-bit paged protected mode, 32-bit OUT : 32 702 ins/sec 33 777
3095 32-bit paged protected mode, 32-bit IN-to-ring-3 : 32 579 ins/sec 29 985
3096 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 32 750 ins/sec 29 757
3097 [snip]
3098 32-bit paged protected mode, 32-bit read : 20 042 ins/sec 21 489
3099 32-bit paged protected mode, 32-bit write : 20 036 ins/sec 21 493
3100 32-bit paged protected mode, 32-bit read-to-ring-3 : 19 985 ins/sec 19 143
3101 32-bit paged protected mode, 32-bit write-to-ring-3 : 19 972 ins/sec 19 595
3102
3103 * @endverbatim
3104 *
3105 * Suspects are security updates and/or microcode updates installed since then.
3106 * Given that the RDTSC and CR4 numbers are reasonably unchanges, it seems that
3107 * the Hyper-V core loop (in hvax64.exe) aren't affected. Our ring-0 runloop
3108 * is equally affected as the ring-3 based runloop, so it cannot be ring
3109 * switching as such (unless the ring-0 loop is borked and we didn't notice yet).
3110 *
3111 * The issue is probably in the thread / process switching area, could be
3112 * something special for hyper-V interrupt delivery or worker thread switching.
3113 *
3114 * Really wish this thread ping-pong going on in VID.SYS could be eliminated!
3115 *
3116 *
3117 * @subsubsection subsect_nem_win_benchmarks_bs2t1u2 17763: Bootsector2-test1
3118 *
3119 * Some preliminary numbers for build 17763 on the 3.4 GHz AMD 1950X, the second
3120 * column will improve we get time to have a look the register page.
3121 *
3122 * There is a 50% performance loss here compared to the June numbers with
3123 * build 17134. The RDTSC numbers hits that it isn't in the Hyper-V core
3124 * (hvax64.exe), but something on the NT side.
3125 *
3126 * Clearing bit 20 in nt!KiSpeculationFeatures speeds things up (i.e. changing
3127 * the dword from 0x00300065 to 0x00200065 in windbg). This is checked by
3128 * nt!KePrepareToDispatchVirtualProcessor, making it a no-op if the flag is
3129 * clear. winhvr!WinHvpVpDispatchLoop call that function before making
3130 * hypercall 0xc2, which presumably does the heavy VCpu lifting in hvcax64.exe.
3131 *
3132 * @verbatim
3133TESTING... WinHv API Hypercalls + VID clr(bit-20) + WinHv API
3134 32-bit paged protected mode, CPUID : 54 145 ins/sec 51 436 130 076
3135 real mode, CPUID : 54 178 ins/sec 51 713 130 449
3136 [snip]
3137 32-bit paged protected mode, RDTSC : 98 927 639 ins/sec 100 254 552 100 549 882
3138 real mode, RDTSC : 99 601 206 ins/sec 100 886 699 100 470 957
3139 [snip]
3140 32-bit paged protected mode, 32-bit IN : 54 621 ins/sec 51 524 128 294
3141 32-bit paged protected mode, 32-bit OUT : 54 870 ins/sec 51 671 129 397
3142 32-bit paged protected mode, 32-bit IN-to-ring-3 : 54 624 ins/sec 43 964 127 874
3143 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 54 803 ins/sec 44 087 129 443
3144 [snip]
3145 32-bit paged protected mode, 32-bit read : 28 230 ins/sec 34 042 48 113
3146 32-bit paged protected mode, 32-bit write : 27 962 ins/sec 34 050 48 069
3147 32-bit paged protected mode, 32-bit read-to-ring-3 : 27 841 ins/sec 28 397 48 146
3148 32-bit paged protected mode, 32-bit write-to-ring-3 : 27 896 ins/sec 29 455 47 970
3149 * @endverbatim
3150 *
3151 *
3152 * @subsubsection subsect_nem_win_benchmarks_w2k 17134/2018-06-22: Windows 2000 Boot & Shutdown
3153 *
3154 * Timing the startup and automatic shutdown of a Windows 2000 SP4 guest serves
3155 * as a real world benchmark and example of why exit performance is import. When
3156 * Windows 2000 boots up is doing a lot of VGA redrawing of the boot animation,
3157 * which is very costly. Not having installed guest additions leaves it in a VGA
3158 * mode after the bootup sequence is done, keep up the screen access expenses,
3159 * though the graphics driver more economical than the bootvid code.
3160 *
3161 * The VM was configured to automatically logon. A startup script was installed
3162 * to perform the automatic shuting down and powering off the VM (thru
3163 * vts_shutdown.exe -f -p). An offline snapshot of the VM was taken an restored
3164 * before each test run. The test time run time is calculated from the monotonic
3165 * VBox.log timestamps, starting with the state change to 'RUNNING' and stopping
3166 * at 'POWERING_OFF'.
3167 *
3168 * The host OS and VirtualBox build is the same as for the bootsector2-test1
3169 * scenario.
3170 *
3171 * Results:
3172 *
3173 * - WinHv API for all but physical page mappings:
3174 * 32 min 12.19 seconds
3175 *
3176 * - The default NEM/win configuration where we put the main execution loop
3177 * in ring-0, using hypercalls when we can and VID for managing execution:
3178 * 3 min 23.18 seconds
3179 *
3180 * - Regular VirtualBox using AMD-V directly, hyper-V is disabled, main
3181 * execution loop in ring-0:
3182 * 58.09 seconds
3183 *
3184 * - WinHv API with exit history based optimizations:
3185 * 58.66 seconds
3186 *
3187 * - Hypercall + VID.SYS with exit history base optimizations:
3188 * 58.94 seconds
3189 *
3190 * With a well above average machine needing over half an hour for booting a
3191 * nearly 20 year old guest kind of says it all. The 13%-20% exit performance
3192 * increase we get by using hypercalls and VID.SYS directly pays off a lot here.
3193 * The 3m23s is almost acceptable in comparison to the half an hour.
3194 *
3195 * The similarity between the last three results strongly hits at windows 2000
3196 * doing a lot of waiting during boot and shutdown and isn't the best testcase
3197 * once a basic performance level is reached.
3198 *
3199 *
3200 * @subsubsection subsection_iem_win_benchmarks_deb9_nat Debian 9 NAT performance
3201 *
3202 * This benchmark is about network performance over NAT from a 64-bit Debian 9
3203 * VM with a single CPU. For network performance measurements, we use our own
3204 * NetPerf tool (ValidationKit/utils/network/NetPerf.cpp) to measure latency
3205 * and throughput.
3206 *
3207 * The setups, builds and configurations are as in the previous benchmarks
3208 * (release r123172 on 1950X running 64-bit W10/17134 (2016-06-xx). Please note
3209 * that the exit optimizations hasn't yet been in tuned with NetPerf in mind.
3210 *
3211 * The NAT network setup was selected here since it's the default one and the
3212 * slowest one. There is quite a bit of IPC with worker threads and packet
3213 * processing involved.
3214 *
3215 * Latency test is first up. This is a classic back and forth between the two
3216 * NetPerf instances, where the key measurement is the roundrip latency. The
3217 * values here are the lowest result over 3-6 runs.
3218 *
3219 * Against host system:
3220 * - 152 258 ns/roundtrip - 100% - regular VirtualBox SVM
3221 * - 271 059 ns/roundtrip - 178% - Hypercalls + VID.SYS in ring-0 with exit optimizations.
3222 * - 280 149 ns/roundtrip - 184% - Hypercalls + VID.SYS in ring-0
3223 * - 317 735 ns/roundtrip - 209% - Win HV API with exit optimizations.
3224 * - 342 440 ns/roundtrip - 225% - Win HV API
3225 *
3226 * Against a remote Windows 10 system over a 10Gbps link:
3227 * - 243 969 ns/roundtrip - 100% - regular VirtualBox SVM
3228 * - 384 427 ns/roundtrip - 158% - Win HV API with exit optimizations.
3229 * - 402 411 ns/roundtrip - 165% - Hypercalls + VID.SYS in ring-0
3230 * - 406 313 ns/roundtrip - 167% - Win HV API
3231 * - 413 160 ns/roundtrip - 169% - Hypercalls + VID.SYS in ring-0 with exit optimizations.
3232 *
3233 * What we see here is:
3234 *
3235 * - Consistent and signficant latency increase using Hyper-V compared
3236 * to directly harnessing AMD-V ourselves.
3237 *
3238 * - When talking to the host, it's clear that the hypercalls + VID.SYS
3239 * in ring-0 method pays off.
3240 *
3241 * - When talking to a different host, the numbers are closer and it
3242 * is not longer clear which Hyper-V execution method is better.
3243 *
3244 *
3245 * Throughput benchmarks are performed by one side pushing data full throttle
3246 * for 10 seconds (minus a 1 second at each end of the test), then reversing
3247 * the roles and measuring it in the other direction. The tests ran 3-5 times
3248 * and below are the highest and lowest results in each direction.
3249 *
3250 * Receiving from host system:
3251 * - Regular VirtualBox SVM:
3252 * Max: 96 907 549 bytes/s - 100%
3253 * Min: 86 912 095 bytes/s - 100%
3254 * - Hypercalls + VID.SYS in ring-0:
3255 * Max: 84 036 544 bytes/s - 87%
3256 * Min: 64 978 112 bytes/s - 75%
3257 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3258 * Max: 77 760 699 bytes/s - 80%
3259 * Min: 72 677 171 bytes/s - 84%
3260 * - Win HV API with exit optimizations:
3261 * Max: 64 465 905 bytes/s - 67%
3262 * Min: 62 286 369 bytes/s - 72%
3263 * - Win HV API:
3264 * Max: 62 466 631 bytes/s - 64%
3265 * Min: 61 362 782 bytes/s - 70%
3266 *
3267 * Sending to the host system:
3268 * - Regular VirtualBox SVM:
3269 * Max: 87 728 652 bytes/s - 100%
3270 * Min: 86 923 198 bytes/s - 100%
3271 * - Hypercalls + VID.SYS in ring-0:
3272 * Max: 84 280 749 bytes/s - 96%
3273 * Min: 78 369 842 bytes/s - 90%
3274 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3275 * Max: 84 119 932 bytes/s - 96%
3276 * Min: 77 396 811 bytes/s - 89%
3277 * - Win HV API:
3278 * Max: 81 714 377 bytes/s - 93%
3279 * Min: 78 697 419 bytes/s - 91%
3280 * - Win HV API with exit optimizations:
3281 * Max: 80 502 488 bytes/s - 91%
3282 * Min: 71 164 978 bytes/s - 82%
3283 *
3284 * Receiving from a remote Windows 10 system over a 10Gbps link:
3285 * - Hypercalls + VID.SYS in ring-0:
3286 * Max: 115 346 922 bytes/s - 136%
3287 * Min: 112 912 035 bytes/s - 137%
3288 * - Regular VirtualBox SVM:
3289 * Max: 84 517 504 bytes/s - 100%
3290 * Min: 82 597 049 bytes/s - 100%
3291 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3292 * Max: 77 736 251 bytes/s - 92%
3293 * Min: 73 813 784 bytes/s - 89%
3294 * - Win HV API with exit optimizations:
3295 * Max: 63 035 587 bytes/s - 75%
3296 * Min: 57 538 380 bytes/s - 70%
3297 * - Win HV API:
3298 * Max: 62 279 185 bytes/s - 74%
3299 * Min: 56 813 866 bytes/s - 69%
3300 *
3301 * Sending to a remote Windows 10 system over a 10Gbps link:
3302 * - Win HV API with exit optimizations:
3303 * Max: 116 502 357 bytes/s - 103%
3304 * Min: 49 046 550 bytes/s - 59%
3305 * - Regular VirtualBox SVM:
3306 * Max: 113 030 991 bytes/s - 100%
3307 * Min: 83 059 511 bytes/s - 100%
3308 * - Hypercalls + VID.SYS in ring-0:
3309 * Max: 106 435 031 bytes/s - 94%
3310 * Min: 47 253 510 bytes/s - 57%
3311 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3312 * Max: 94 842 287 bytes/s - 84%
3313 * Min: 68 362 172 bytes/s - 82%
3314 * - Win HV API:
3315 * Max: 65 165 225 bytes/s - 58%
3316 * Min: 47 246 573 bytes/s - 57%
3317 *
3318 * What we see here is:
3319 *
3320 * - Again consistent numbers when talking to the host. Showing that the
3321 * ring-0 approach is preferable to the ring-3 one.
3322 *
3323 * - Again when talking to a remote host, things get more difficult to
3324 * make sense of. The spread is larger and direct AMD-V gets beaten by
3325 * a different the Hyper-V approaches in each direction.
3326 *
3327 * - However, if we treat the first entry (remote host) as weird spikes, the
3328 * other entries are consistently worse compared to direct AMD-V. For the
3329 * send case we get really bad results for WinHV.
3330 *
3331 */
3332
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette