VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp

Last change on this file was 107931, checked in by vboxsync, 4 weeks ago

VMM/NEM-win: Only export & import IA32_SPEC_CTRL if the host supports it and we're exposing the register to the guest. (AMD regression from r167064.) jiraref:VBP-947 bugref:10738

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 157.8 KB
Line 
1/* $Id: NEMR3Native-win.cpp 107931 2025-01-24 10:00:36Z vboxsync $ */
2/** @file
3 * NEM - Native execution manager, native ring-3 Windows backend.
4 *
5 * Log group 2: Exit logging.
6 * Log group 3: Log context on exit.
7 * Log group 5: Ring-3 memory management
8 * Log group 6: Ring-0 memory management
9 * Log group 12: API intercepts.
10 */
11
12/*
13 * Copyright (C) 2018-2024 Oracle and/or its affiliates.
14 *
15 * This file is part of VirtualBox base platform packages, as
16 * available from https://www.virtualbox.org.
17 *
18 * This program is free software; you can redistribute it and/or
19 * modify it under the terms of the GNU General Public License
20 * as published by the Free Software Foundation, in version 3 of the
21 * License.
22 *
23 * This program is distributed in the hope that it will be useful, but
24 * WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
26 * General Public License for more details.
27 *
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, see <https://www.gnu.org/licenses>.
30 *
31 * SPDX-License-Identifier: GPL-3.0-only
32 */
33
34
35/*********************************************************************************************************************************
36* Header Files *
37*********************************************************************************************************************************/
38#define LOG_GROUP LOG_GROUP_NEM
39#define VMCPU_INCL_CPUM_GST_CTX
40#include <iprt/nt/nt-and-windows.h>
41#include <iprt/nt/hyperv.h>
42#include <iprt/nt/vid.h>
43#include <WinHvPlatform.h>
44
45#ifndef _WIN32_WINNT_WIN10
46# error "Missing _WIN32_WINNT_WIN10"
47#endif
48#ifndef _WIN32_WINNT_WIN10_RS1 /* Missing define, causing trouble for us. */
49# define _WIN32_WINNT_WIN10_RS1 (_WIN32_WINNT_WIN10 + 1)
50#endif
51#include <sysinfoapi.h>
52#include <debugapi.h>
53#include <errhandlingapi.h>
54#include <fileapi.h>
55#include <winerror.h> /* no api header for this. */
56
57#include <VBox/vmm/nem.h>
58#include <VBox/vmm/iem.h>
59#include <VBox/vmm/em.h>
60#include <VBox/vmm/pdmapic.h>
61#include <VBox/vmm/pdm.h>
62#include <VBox/vmm/dbgftrace.h>
63#include "NEMInternal.h"
64#include <VBox/vmm/vmcc.h>
65
66#include <iprt/ldr.h>
67#include <iprt/path.h>
68#include <iprt/string.h>
69#include <iprt/system.h>
70#include <iprt/utf16.h>
71
72#ifndef NTDDI_WIN10_VB /* Present in W10 2004 SDK, quite possibly earlier. */
73HRESULT WINAPI WHvQueryGpaRangeDirtyBitmap(WHV_PARTITION_HANDLE, WHV_GUEST_PHYSICAL_ADDRESS, UINT64, UINT64 *, UINT32);
74# define WHvMapGpaRangeFlagTrackDirtyPages ((WHV_MAP_GPA_RANGE_FLAGS)0x00000008)
75#endif
76
77
78/*********************************************************************************************************************************
79* Defined Constants And Macros *
80*********************************************************************************************************************************/
81#ifdef LOG_ENABLED
82# define NEM_WIN_INTERCEPT_NT_IO_CTLS
83#endif
84
85/** VID I/O control detection: Fake partition handle input. */
86#define NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE ((HANDLE)(uintptr_t)38479125)
87/** VID I/O control detection: Fake partition ID return. */
88#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID UINT64_C(0xfa1e000042424242)
89/** VID I/O control detection: The property we get via VidGetPartitionProperty. */
90#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE HvPartitionPropertyProcessorVendor
91/** VID I/O control detection: Fake property value return. */
92#define NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE UINT64_C(0xf00dface01020304)
93/** VID I/O control detection: Fake CPU index input. */
94#define NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX UINT32_C(42)
95/** VID I/O control detection: Fake timeout input. */
96#define NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT UINT32_C(0x00080286)
97
98
99#ifndef NTDDI_WIN10_RS4 /* We use this to support older SDKs. */
100# define NTDDI_WIN10_RS4 (NTDDI_WIN10 + 5) /* 17134 */
101#endif
102#ifndef NTDDI_WIN10_RS5 /* We use this to support older SDKs. */
103# define NTDDI_WIN10_RS5 (NTDDI_WIN10 + 6) /* ????? */
104#endif
105#ifndef NTDDI_WIN10_19H1 /* We use this to support older SDKs. */
106# define NTDDI_WIN10_19H1 (NTDDI_WIN10 + 7) /* 18362 */
107#endif
108#ifndef NTDDI_WIN10_VB
109# define NTDDI_WIN10_VB (NTDDI_WIN10 + 8) /* 19040 */
110#endif
111#ifndef NTDDI_WIN10_MN
112# define NTDDI_WIN10_MN (NTDDI_WIN10 + 9) /* ????? */
113#endif
114#ifndef NTDDI_WIN10_FE
115# define NTDDI_WIN10_FE (NTDDI_WIN10 + 10) /* ????? */
116#endif
117#ifndef NTDDI_WIN10_CO
118# define NTDDI_WIN10_CO (NTDDI_WIN10 + 11) /* 22000 */
119#endif
120#ifndef NTDDI_WIN10_NI
121# define NTDDI_WIN10_NI (NTDDI_WIN10 + 12) /* 22621 */
122#endif
123#ifndef NTDDI_WIN10_CU
124# define NTDDI_WIN10_CU (NTDDI_WIN10 + 13) /* ????? */
125#endif
126#ifndef NTDDI_WIN10_ZN
127# define NTDDI_WIN10_ZN (NTDDI_WIN10 + 14) /* ????? */
128#endif
129#ifndef NTDDI_WIN10_GA
130# define NTDDI_WIN10_GA (NTDDI_WIN10 + 15) /* ????? */
131#endif
132#ifndef NTDDI_WIN10_GE
133# define NTDDI_WIN10_GE (NTDDI_WIN10 + 16) /* 26100 */
134#endif
135
136#define MY_NTDDI_WIN10_17134 NTDDI_WIN10_RS4
137#define MY_NTDDI_WIN10_18362 NTDDI_WIN10_19H1
138#define MY_NTDDI_WIN10_19040 NTDDI_WIN10_VB
139#define MY_NTDDI_WIN11_22000 NTDDI_WIN10_CO
140#define MY_NTDDI_WIN11_22621 NTDDI_WIN10_NI
141#define MY_NTDDI_WIN11_26100 NTDDI_WIN10_GE
142
143
144/*********************************************************************************************************************************
145* Global Variables *
146*********************************************************************************************************************************/
147/** @name APIs imported from WinHvPlatform.dll
148 * @{ */
149static decltype(WHvGetCapability) * g_pfnWHvGetCapability;
150static decltype(WHvCreatePartition) * g_pfnWHvCreatePartition;
151static decltype(WHvSetupPartition) * g_pfnWHvSetupPartition;
152static decltype(WHvDeletePartition) * g_pfnWHvDeletePartition;
153static decltype(WHvGetPartitionProperty) * g_pfnWHvGetPartitionProperty;
154static decltype(WHvSetPartitionProperty) * g_pfnWHvSetPartitionProperty;
155static decltype(WHvMapGpaRange) * g_pfnWHvMapGpaRange;
156static decltype(WHvUnmapGpaRange) * g_pfnWHvUnmapGpaRange;
157static decltype(WHvTranslateGva) * g_pfnWHvTranslateGva;
158static decltype(WHvQueryGpaRangeDirtyBitmap) * g_pfnWHvQueryGpaRangeDirtyBitmap;
159static decltype(WHvCreateVirtualProcessor) * g_pfnWHvCreateVirtualProcessor;
160static decltype(WHvDeleteVirtualProcessor) * g_pfnWHvDeleteVirtualProcessor;
161static decltype(WHvRunVirtualProcessor) * g_pfnWHvRunVirtualProcessor;
162static decltype(WHvCancelRunVirtualProcessor) * g_pfnWHvCancelRunVirtualProcessor;
163static decltype(WHvGetVirtualProcessorRegisters) * g_pfnWHvGetVirtualProcessorRegisters;
164static decltype(WHvSetVirtualProcessorRegisters) * g_pfnWHvSetVirtualProcessorRegisters;
165/** @} */
166
167/** @name APIs imported from Vid.dll
168 * @{ */
169static decltype(VidGetHvPartitionId) *g_pfnVidGetHvPartitionId;
170static decltype(VidGetPartitionProperty) *g_pfnVidGetPartitionProperty;
171#ifdef LOG_ENABLED
172static decltype(VidStartVirtualProcessor) *g_pfnVidStartVirtualProcessor;
173static decltype(VidStopVirtualProcessor) *g_pfnVidStopVirtualProcessor;
174static decltype(VidMessageSlotMap) *g_pfnVidMessageSlotMap;
175static decltype(VidMessageSlotHandleAndGetNext) *g_pfnVidMessageSlotHandleAndGetNext;
176static decltype(VidGetVirtualProcessorState) *g_pfnVidGetVirtualProcessorState;
177static decltype(VidSetVirtualProcessorState) *g_pfnVidSetVirtualProcessorState;
178static decltype(VidGetVirtualProcessorRunningStatus) *g_pfnVidGetVirtualProcessorRunningStatus;
179#endif
180/** @} */
181
182/** The Windows build number. */
183static uint32_t g_uBuildNo = 17134;
184
185
186
187/**
188 * Import instructions.
189 */
190static const struct
191{
192 uint8_t idxDll; /**< 0 for WinHvPlatform.dll, 1 for vid.dll. */
193 bool fOptional; /**< Set if import is optional. */
194 PFNRT *ppfn; /**< The function pointer variable. */
195 const char *pszName; /**< The function name. */
196} g_aImports[] =
197{
198#define NEM_WIN_IMPORT(a_idxDll, a_fOptional, a_Name) { (a_idxDll), (a_fOptional), (PFNRT *)&RT_CONCAT(g_pfn,a_Name), #a_Name }
199 NEM_WIN_IMPORT(0, false, WHvGetCapability),
200 NEM_WIN_IMPORT(0, false, WHvCreatePartition),
201 NEM_WIN_IMPORT(0, false, WHvSetupPartition),
202 NEM_WIN_IMPORT(0, false, WHvDeletePartition),
203 NEM_WIN_IMPORT(0, false, WHvGetPartitionProperty),
204 NEM_WIN_IMPORT(0, false, WHvSetPartitionProperty),
205 NEM_WIN_IMPORT(0, false, WHvMapGpaRange),
206 NEM_WIN_IMPORT(0, false, WHvUnmapGpaRange),
207 NEM_WIN_IMPORT(0, false, WHvTranslateGva),
208 NEM_WIN_IMPORT(0, true, WHvQueryGpaRangeDirtyBitmap),
209 NEM_WIN_IMPORT(0, false, WHvCreateVirtualProcessor),
210 NEM_WIN_IMPORT(0, false, WHvDeleteVirtualProcessor),
211 NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
212 NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
213 NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
214 NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
215
216 NEM_WIN_IMPORT(1, true, VidGetHvPartitionId),
217 NEM_WIN_IMPORT(1, true, VidGetPartitionProperty),
218#ifdef LOG_ENABLED
219 NEM_WIN_IMPORT(1, false, VidMessageSlotMap),
220 NEM_WIN_IMPORT(1, false, VidMessageSlotHandleAndGetNext),
221 NEM_WIN_IMPORT(1, false, VidStartVirtualProcessor),
222 NEM_WIN_IMPORT(1, false, VidStopVirtualProcessor),
223 NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorState),
224 NEM_WIN_IMPORT(1, false, VidSetVirtualProcessorState),
225 NEM_WIN_IMPORT(1, false, VidGetVirtualProcessorRunningStatus),
226#endif
227#undef NEM_WIN_IMPORT
228};
229
230
231/** The real NtDeviceIoControlFile API in NTDLL. */
232static decltype(NtDeviceIoControlFile) *g_pfnNtDeviceIoControlFile;
233/** Pointer to the NtDeviceIoControlFile import table entry. */
234static decltype(NtDeviceIoControlFile) **g_ppfnVidNtDeviceIoControlFile;
235#ifdef LOG_ENABLED
236/** Info about the VidGetHvPartitionId I/O control interface. */
237static NEMWINIOCTL g_IoCtlGetHvPartitionId;
238/** Info about the VidGetPartitionProperty I/O control interface. */
239static NEMWINIOCTL g_IoCtlGetPartitionProperty;
240/** Info about the VidStartVirtualProcessor I/O control interface. */
241static NEMWINIOCTL g_IoCtlStartVirtualProcessor;
242/** Info about the VidStopVirtualProcessor I/O control interface. */
243static NEMWINIOCTL g_IoCtlStopVirtualProcessor;
244/** Info about the VidMessageSlotHandleAndGetNext I/O control interface. */
245static NEMWINIOCTL g_IoCtlMessageSlotHandleAndGetNext;
246/** Info about the VidMessageSlotMap I/O control interface - for logging. */
247static NEMWINIOCTL g_IoCtlMessageSlotMap;
248/** Info about the VidGetVirtualProcessorState I/O control interface - for logging. */
249static NEMWINIOCTL g_IoCtlGetVirtualProcessorState;
250/** Info about the VidSetVirtualProcessorState I/O control interface - for logging. */
251static NEMWINIOCTL g_IoCtlSetVirtualProcessorState;
252/** Pointer to what nemR3WinIoctlDetector_ForLogging should fill in. */
253static NEMWINIOCTL *g_pIoCtlDetectForLogging;
254#endif
255
256#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
257/** Mapping slot for CPU #0.
258 * @{ */
259static VID_MESSAGE_MAPPING_HEADER *g_pMsgSlotMapping = NULL;
260static const HV_MESSAGE_HEADER *g_pHvMsgHdr;
261static const HV_X64_INTERCEPT_MESSAGE_HEADER *g_pX64MsgHdr;
262/** @} */
263#endif
264
265
266/*
267 * Let the preprocessor alias the APIs to import variables for better autocompletion.
268 */
269#ifndef IN_SLICKEDIT
270# define WHvGetCapability g_pfnWHvGetCapability
271# define WHvCreatePartition g_pfnWHvCreatePartition
272# define WHvSetupPartition g_pfnWHvSetupPartition
273# define WHvDeletePartition g_pfnWHvDeletePartition
274# define WHvGetPartitionProperty g_pfnWHvGetPartitionProperty
275# define WHvSetPartitionProperty g_pfnWHvSetPartitionProperty
276# define WHvMapGpaRange g_pfnWHvMapGpaRange
277# define WHvUnmapGpaRange g_pfnWHvUnmapGpaRange
278# define WHvTranslateGva g_pfnWHvTranslateGva
279# define WHvQueryGpaRangeDirtyBitmap g_pfnWHvQueryGpaRangeDirtyBitmap
280# define WHvCreateVirtualProcessor g_pfnWHvCreateVirtualProcessor
281# define WHvDeleteVirtualProcessor g_pfnWHvDeleteVirtualProcessor
282# define WHvRunVirtualProcessor g_pfnWHvRunVirtualProcessor
283# define WHvGetRunExitContextSize g_pfnWHvGetRunExitContextSize
284# define WHvCancelRunVirtualProcessor g_pfnWHvCancelRunVirtualProcessor
285# define WHvGetVirtualProcessorRegisters g_pfnWHvGetVirtualProcessorRegisters
286# define WHvSetVirtualProcessorRegisters g_pfnWHvSetVirtualProcessorRegisters
287
288# define VidMessageSlotHandleAndGetNext g_pfnVidMessageSlotHandleAndGetNext
289# define VidStartVirtualProcessor g_pfnVidStartVirtualProcessor
290# define VidStopVirtualProcessor g_pfnVidStopVirtualProcessor
291
292#endif
293
294#if 0 /* unused */
295/** WHV_MEMORY_ACCESS_TYPE names */
296static const char * const g_apszWHvMemAccesstypes[4] = { "read", "write", "exec", "!undefined!" };
297#endif
298
299
300/*********************************************************************************************************************************
301* Internal Functions *
302*********************************************************************************************************************************/
303DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv);
304DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv);
305
306/*
307 * Instantate the code we used to share with ring-0.
308 */
309#include "../VMMAll/NEMAllNativeTemplate-win.cpp.h"
310
311
312
313#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
314/**
315 * Wrapper that logs the call from VID.DLL.
316 *
317 * This is very handy for figuring out why an API call fails.
318 */
319static NTSTATUS WINAPI
320nemR3WinLogWrapper_NtDeviceIoControlFile(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
321 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
322 PVOID pvOutput, ULONG cbOutput)
323{
324
325 char szFunction[32];
326 const char *pszFunction;
327 if (uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction)
328 pszFunction = "VidMessageSlotHandleAndGetNext";
329 else if (uFunction == g_IoCtlStartVirtualProcessor.uFunction)
330 pszFunction = "VidStartVirtualProcessor";
331 else if (uFunction == g_IoCtlStopVirtualProcessor.uFunction)
332 pszFunction = "VidStopVirtualProcessor";
333 else if (uFunction == g_IoCtlMessageSlotMap.uFunction)
334 pszFunction = "VidMessageSlotMap";
335 else if (uFunction == g_IoCtlGetVirtualProcessorState.uFunction)
336 pszFunction = "VidGetVirtualProcessorState";
337 else if (uFunction == g_IoCtlSetVirtualProcessorState.uFunction)
338 pszFunction = "VidSetVirtualProcessorState";
339 else
340 {
341 RTStrPrintf(szFunction, sizeof(szFunction), "%#x", uFunction);
342 pszFunction = szFunction;
343 }
344
345 if (cbInput > 0 && pvInput)
346 Log12(("VID!NtDeviceIoControlFile: %s/input: %.*Rhxs\n", pszFunction, RT_MIN(cbInput, 32), pvInput));
347 NTSTATUS rcNt = g_pfnNtDeviceIoControlFile(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, uFunction,
348 pvInput, cbInput, pvOutput, cbOutput);
349 if (!hEvt && !pfnApcCallback && !pvApcCtx)
350 Log12(("VID!NtDeviceIoControlFile: hFile=%#zx pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
351 hFile, pIos, pIos->Status, pIos->Information, pszFunction, pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
352 else
353 Log12(("VID!NtDeviceIoControlFile: hFile=%#zx hEvt=%#zx Apc=%p/%p pIos=%p->{s:%#x, i:%#zx} uFunction=%s Input=%p LB %#x Output=%p LB %#x) -> %#x; Caller=%p\n",
354 hFile, hEvt, RT_CB_LOG_CAST(pfnApcCallback), pvApcCtx, pIos, pIos->Status, pIos->Information, pszFunction,
355 pvInput, cbInput, pvOutput, cbOutput, rcNt, ASMReturnAddress()));
356 if (cbOutput > 0 && pvOutput)
357 {
358 Log12(("VID!NtDeviceIoControlFile: %s/output: %.*Rhxs\n", pszFunction, RT_MIN(cbOutput, 32), pvOutput));
359 if (uFunction == 0x2210cc && g_pMsgSlotMapping == NULL && cbOutput >= sizeof(void *))
360 {
361 g_pMsgSlotMapping = *(VID_MESSAGE_MAPPING_HEADER **)pvOutput;
362 g_pHvMsgHdr = (const HV_MESSAGE_HEADER *)(g_pMsgSlotMapping + 1);
363 g_pX64MsgHdr = (const HV_X64_INTERCEPT_MESSAGE_HEADER *)(g_pHvMsgHdr + 1);
364 Log12(("VID!NtDeviceIoControlFile: Message slot mapping: %p\n", g_pMsgSlotMapping));
365 }
366 }
367 if ( g_pMsgSlotMapping
368 && ( uFunction == g_IoCtlMessageSlotHandleAndGetNext.uFunction
369 || uFunction == g_IoCtlStopVirtualProcessor.uFunction
370 || uFunction == g_IoCtlMessageSlotMap.uFunction
371 ))
372 Log12(("VID!NtDeviceIoControlFile: enmVidMsgType=%#x cb=%#x msg=%#x payload=%u cs:rip=%04x:%08RX64 (%s)\n",
373 g_pMsgSlotMapping->enmVidMsgType, g_pMsgSlotMapping->cbMessage,
374 g_pHvMsgHdr->MessageType, g_pHvMsgHdr->PayloadSize,
375 g_pX64MsgHdr->CsSegment.Selector, g_pX64MsgHdr->Rip, pszFunction));
376
377 return rcNt;
378}
379#endif /* NEM_WIN_INTERCEPT_NT_IO_CTLS */
380
381
382/**
383 * Patches the call table of VID.DLL so we can intercept NtDeviceIoControlFile.
384 *
385 * This is for used to figure out the I/O control codes and in logging builds
386 * for logging API calls that WinHvPlatform.dll does.
387 *
388 * @returns VBox status code.
389 * @param hLdrModVid The VID module handle.
390 * @param pErrInfo Where to return additional error information.
391 */
392static int nemR3WinInitVidIntercepts(RTLDRMOD hLdrModVid, PRTERRINFO pErrInfo)
393{
394 /*
395 * Locate the real API.
396 */
397 g_pfnNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) *)RTLdrGetSystemSymbol("NTDLL.DLL", "NtDeviceIoControlFile");
398 AssertReturn(g_pfnNtDeviceIoControlFile != NULL,
399 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to resolve NtDeviceIoControlFile from NTDLL.DLL"));
400
401 /*
402 * Locate the PE header and get what we need from it.
403 */
404 uint8_t const *pbImage = (uint8_t const *)RTLdrGetNativeHandle(hLdrModVid);
405 IMAGE_DOS_HEADER const *pMzHdr = (IMAGE_DOS_HEADER const *)pbImage;
406 AssertReturn(pMzHdr->e_magic == IMAGE_DOS_SIGNATURE,
407 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL mapping doesn't start with MZ signature: %#x", pMzHdr->e_magic));
408 IMAGE_NT_HEADERS const *pNtHdrs = (IMAGE_NT_HEADERS const *)&pbImage[pMzHdr->e_lfanew];
409 AssertReturn(pNtHdrs->Signature == IMAGE_NT_SIGNATURE,
410 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL has invalid PE signaturre: %#x @%#x",
411 pNtHdrs->Signature, pMzHdr->e_lfanew));
412
413 uint32_t const cbImage = pNtHdrs->OptionalHeader.SizeOfImage;
414 IMAGE_DATA_DIRECTORY const ImportDir = pNtHdrs->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
415
416 /*
417 * Walk the import descriptor table looking for NTDLL.DLL.
418 */
419 AssertReturn( ImportDir.Size > 0
420 && ImportDir.Size < cbImage,
421 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory size: %#x", ImportDir.Size));
422 AssertReturn( ImportDir.VirtualAddress > 0
423 && ImportDir.VirtualAddress <= cbImage - ImportDir.Size,
424 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory RVA: %#x", ImportDir.VirtualAddress));
425
426 for (PIMAGE_IMPORT_DESCRIPTOR pImps = (PIMAGE_IMPORT_DESCRIPTOR)&pbImage[ImportDir.VirtualAddress];
427 pImps->Name != 0 && pImps->FirstThunk != 0;
428 pImps++)
429 {
430 AssertReturn(pImps->Name < cbImage,
431 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad import directory entry name: %#x", pImps->Name));
432 const char *pszModName = (const char *)&pbImage[pImps->Name];
433 if (RTStrICmpAscii(pszModName, "ntdll.dll"))
434 continue;
435 AssertReturn(pImps->FirstThunk < cbImage,
436 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
437 AssertReturn(pImps->OriginalFirstThunk < cbImage,
438 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad FirstThunk: %#x", pImps->FirstThunk));
439
440 /*
441 * Walk the thunks table(s) looking for NtDeviceIoControlFile.
442 */
443 uintptr_t *puFirstThunk = (uintptr_t *)&pbImage[pImps->FirstThunk]; /* update this. */
444 if ( pImps->OriginalFirstThunk != 0
445 && pImps->OriginalFirstThunk != pImps->FirstThunk)
446 {
447 uintptr_t const *puOrgThunk = (uintptr_t const *)&pbImage[pImps->OriginalFirstThunk]; /* read from this. */
448 uintptr_t cLeft = (cbImage - (RT_MAX(pImps->FirstThunk, pImps->OriginalFirstThunk)))
449 / sizeof(*puFirstThunk);
450 while (cLeft-- > 0 && *puOrgThunk != 0)
451 {
452 if (!(*puOrgThunk & IMAGE_ORDINAL_FLAG64)) /* ASSUMES 64-bit */
453 {
454 AssertReturn(*puOrgThunk > 0 && *puOrgThunk < cbImage,
455 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "VID.DLL bad thunk entry: %#x", *puOrgThunk));
456
457 const char *pszSymbol = (const char *)&pbImage[*puOrgThunk + 2];
458 if (strcmp(pszSymbol, "NtDeviceIoControlFile") == 0)
459 g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)puFirstThunk;
460 }
461
462 puOrgThunk++;
463 puFirstThunk++;
464 }
465 }
466 else
467 {
468 /* No original thunk table, so scan the resolved symbols for a match
469 with the NtDeviceIoControlFile address. */
470 uintptr_t const uNeedle = (uintptr_t)g_pfnNtDeviceIoControlFile;
471 uintptr_t cLeft = (cbImage - pImps->FirstThunk) / sizeof(*puFirstThunk);
472 while (cLeft-- > 0 && *puFirstThunk != 0)
473 {
474 if (*puFirstThunk == uNeedle)
475 g_ppfnVidNtDeviceIoControlFile = (decltype(NtDeviceIoControlFile) **)puFirstThunk;
476 puFirstThunk++;
477 }
478 }
479 }
480
481 if (g_ppfnVidNtDeviceIoControlFile != NULL)
482 {
483 /* Make the thunk writable we can freely modify it. */
484 DWORD fOldProt = PAGE_READONLY;
485 VirtualProtect((void *)(uintptr_t)g_ppfnVidNtDeviceIoControlFile, sizeof(uintptr_t), PAGE_EXECUTE_READWRITE, &fOldProt);
486
487#ifdef NEM_WIN_INTERCEPT_NT_IO_CTLS
488 *g_ppfnVidNtDeviceIoControlFile = nemR3WinLogWrapper_NtDeviceIoControlFile;
489#endif
490 return VINF_SUCCESS;
491 }
492 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Failed to patch NtDeviceIoControlFile import in VID.DLL!");
493}
494
495
496/**
497 * Worker for nemR3NativeInit that probes and load the native API.
498 *
499 * @returns VBox status code.
500 * @param fForced Whether the HMForced flag is set and we should
501 * fail if we cannot initialize.
502 * @param pErrInfo Where to always return error info.
503 */
504static int nemR3WinInitProbeAndLoad(bool fForced, PRTERRINFO pErrInfo)
505{
506 /*
507 * Check that the DLL files we need are present, but without loading them.
508 * We'd like to avoid loading them unnecessarily.
509 */
510 WCHAR wszPath[MAX_PATH + 64];
511 UINT cwcPath = GetSystemDirectoryW(wszPath, MAX_PATH);
512 if (cwcPath >= MAX_PATH || cwcPath < 2)
513 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "GetSystemDirectoryW failed (%#x / %u)", cwcPath, GetLastError());
514
515 if (wszPath[cwcPath - 1] != '\\' || wszPath[cwcPath - 1] != '/')
516 wszPath[cwcPath++] = '\\';
517 RTUtf16CopyAscii(&wszPath[cwcPath], RT_ELEMENTS(wszPath) - cwcPath, "WinHvPlatform.dll");
518 if (GetFileAttributesW(wszPath) == INVALID_FILE_ATTRIBUTES)
519 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "The native API dll was not found (%ls)", wszPath);
520
521 /*
522 * Check that we're in a VM and that the hypervisor identifies itself as Hyper-V.
523 */
524 if (!ASMHasCpuId())
525 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID support");
526 if (!RTX86IsValidStdRange(ASMCpuId_EAX(0)))
527 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "No CPUID leaf #1");
528 if (!(ASMCpuId_ECX(1) & X86_CPUID_FEATURE_ECX_HVP))
529 return RTErrInfoSet(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Not in a hypervisor partition (HVP=0)");
530
531 uint32_t cMaxHyperLeaf = 0;
532 uint32_t uEbx = 0;
533 uint32_t uEcx = 0;
534 uint32_t uEdx = 0;
535 ASMCpuIdExSlow(0x40000000, 0, 0, 0, &cMaxHyperLeaf, &uEbx, &uEcx, &uEdx);
536 if (!RTX86IsValidHypervisorRange(cMaxHyperLeaf))
537 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Invalid hypervisor CPUID range (%#x %#x %#x %#x)",
538 cMaxHyperLeaf, uEbx, uEcx, uEdx);
539 if ( uEbx != UINT32_C(0x7263694d) /* Micr */
540 || uEcx != UINT32_C(0x666f736f) /* osof */
541 || uEdx != UINT32_C(0x76482074) /* t Hv */)
542 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
543 "Not Hyper-V CPUID signature: %#x %#x %#x (expected %#x %#x %#x)",
544 uEbx, uEcx, uEdx, UINT32_C(0x7263694d), UINT32_C(0x666f736f), UINT32_C(0x76482074));
545 if (cMaxHyperLeaf < UINT32_C(0x40000005))
546 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "Too narrow hypervisor CPUID range (%#x)", cMaxHyperLeaf);
547
548 /** @todo would be great if we could recognize a root partition from the
549 * CPUID info, but I currently don't dare do that. */
550
551 /*
552 * Now try load the DLLs and resolve the APIs.
553 */
554 static const char * const s_apszDllNames[2] = { "WinHvPlatform.dll", "vid.dll" };
555 RTLDRMOD ahMods[2] = { NIL_RTLDRMOD, NIL_RTLDRMOD };
556 int rc = VINF_SUCCESS;
557 for (unsigned i = 0; i < RT_ELEMENTS(s_apszDllNames); i++)
558 {
559 int rc2 = RTLdrLoadSystem(s_apszDllNames[i], true /*fNoUnload*/, &ahMods[i]);
560 if (RT_FAILURE(rc2))
561 {
562 if (!RTErrInfoIsSet(pErrInfo))
563 RTErrInfoSetF(pErrInfo, rc2, "Failed to load API DLL: %s: %Rrc", s_apszDllNames[i], rc2);
564 else
565 RTErrInfoAddF(pErrInfo, rc2, "; %s: %Rrc", s_apszDllNames[i], rc2);
566 ahMods[i] = NIL_RTLDRMOD;
567 rc = VERR_NEM_INIT_FAILED;
568 }
569 }
570 if (RT_SUCCESS(rc))
571 rc = nemR3WinInitVidIntercepts(ahMods[1], pErrInfo);
572 if (RT_SUCCESS(rc))
573 {
574 for (unsigned i = 0; i < RT_ELEMENTS(g_aImports); i++)
575 {
576 int rc2 = RTLdrGetSymbol(ahMods[g_aImports[i].idxDll], g_aImports[i].pszName, (void **)g_aImports[i].ppfn);
577 if (RT_SUCCESS(rc2))
578 {
579 if (g_aImports[i].fOptional)
580 LogRel(("NEM: info: Found optional import %s!%s.\n",
581 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName));
582 }
583 else
584 {
585 *g_aImports[i].ppfn = NULL;
586
587 LogRel(("NEM: %s: Failed to import %s!%s: %Rrc",
588 g_aImports[i].fOptional ? "info" : fForced ? "fatal" : "error",
589 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName, rc2));
590 if (!g_aImports[i].fOptional)
591 {
592 if (RTErrInfoIsSet(pErrInfo))
593 RTErrInfoAddF(pErrInfo, rc2, ", %s!%s",
594 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
595 else
596 rc = RTErrInfoSetF(pErrInfo, rc2, "Failed to import: %s!%s",
597 s_apszDllNames[g_aImports[i].idxDll], g_aImports[i].pszName);
598 Assert(RT_FAILURE(rc));
599 }
600 }
601 }
602 if (RT_SUCCESS(rc))
603 {
604 Assert(!RTErrInfoIsSet(pErrInfo));
605 }
606 }
607
608 for (unsigned i = 0; i < RT_ELEMENTS(ahMods); i++)
609 RTLdrClose(ahMods[i]);
610 return rc;
611}
612
613
614/**
615 * Wrapper for different WHvGetCapability signatures.
616 */
617DECLINLINE(HRESULT) WHvGetCapabilityWrapper(WHV_CAPABILITY_CODE enmCap, WHV_CAPABILITY *pOutput, uint32_t cbOutput)
618{
619 return g_pfnWHvGetCapability(enmCap, pOutput, cbOutput, NULL);
620}
621
622
623/**
624 * Worker for nemR3NativeInit that gets the hypervisor capabilities.
625 *
626 * @returns VBox status code.
627 * @param pVM The cross context VM structure.
628 * @param pErrInfo Where to always return error info.
629 */
630static int nemR3WinInitCheckCapabilities(PVM pVM, PRTERRINFO pErrInfo)
631{
632#define NEM_LOG_REL_CAP_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %-38s= " a_szFmt "\n", a_szField, a_Value))
633#define NEM_LOG_REL_CAP_SUB_EX(a_szField, a_szFmt, a_Value) LogRel(("NEM: %36s: " a_szFmt "\n", a_szField, a_Value))
634#define NEM_LOG_REL_CAP_SUB(a_szField, a_Value) NEM_LOG_REL_CAP_SUB_EX(a_szField, "%d", a_Value)
635
636 /*
637 * Is the hypervisor present with the desired capability?
638 *
639 * In build 17083 this translates into:
640 * - CPUID[0x00000001].HVP is set
641 * - CPUID[0x40000000] == "Microsoft Hv"
642 * - CPUID[0x40000001].eax == "Hv#1"
643 * - CPUID[0x40000003].ebx[12] is set.
644 * - VidGetExoPartitionProperty(INVALID_HANDLE_VALUE, 0x60000, &Ignored) returns
645 * a non-zero value.
646 */
647 /**
648 * @todo Someone at Microsoft please explain weird API design:
649 * 1. Pointless CapabilityCode duplication int the output;
650 * 2. No output size.
651 */
652 WHV_CAPABILITY Caps;
653 RT_ZERO(Caps);
654 SetLastError(0);
655 HRESULT hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeHypervisorPresent, &Caps, sizeof(Caps));
656 DWORD rcWin = GetLastError();
657 if (FAILED(hrc))
658 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
659 "WHvGetCapability/WHvCapabilityCodeHypervisorPresent failed: %Rhrc (Last=%#x/%u)",
660 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
661 if (!Caps.HypervisorPresent)
662 {
663 if (!RTPathExists(RTPATH_NT_PASSTHRU_PREFIX "Device\\VidExo"))
664 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE,
665 "WHvCapabilityCodeHypervisorPresent is FALSE! Make sure you have enabled the 'Windows Hypervisor Platform' feature.");
666 return RTErrInfoSetF(pErrInfo, VERR_NEM_NOT_AVAILABLE, "WHvCapabilityCodeHypervisorPresent is FALSE! (%u)", rcWin);
667 }
668 LogRel(("NEM: WHvCapabilityCodeHypervisorPresent is TRUE, so this might work...\n"));
669
670
671 /*
672 * Check what extended VM exits are supported.
673 */
674 RT_ZERO(Caps);
675 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExtendedVmExits, &Caps, sizeof(Caps));
676 if (FAILED(hrc))
677 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
678 "WHvGetCapability/WHvCapabilityCodeExtendedVmExits failed: %Rhrc (Last=%#x/%u)",
679 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
680 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeExtendedVmExits", "%'#018RX64", Caps.ExtendedVmExits.AsUINT64);
681#define NEM_LOG_REL_CAP_VM_EXIT(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ExtendedVmExits.a_Field)
682 NEM_LOG_REL_CAP_VM_EXIT(X64CpuidExit);
683 NEM_LOG_REL_CAP_VM_EXIT(X64MsrExit);
684 NEM_LOG_REL_CAP_VM_EXIT(ExceptionExit);
685#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN10_19040
686 NEM_LOG_REL_CAP_VM_EXIT(X64RdtscExit);
687 NEM_LOG_REL_CAP_VM_EXIT(X64ApicSmiExitTrap);
688 NEM_LOG_REL_CAP_VM_EXIT(HypercallExit);
689 NEM_LOG_REL_CAP_VM_EXIT(X64ApicInitSipiExitTrap);
690#endif
691#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN11_22000 /** @todo Could some of these may have been added earlier... */
692 NEM_LOG_REL_CAP_VM_EXIT(X64ApicWriteLint0ExitTrap);
693 NEM_LOG_REL_CAP_VM_EXIT(X64ApicWriteLint1ExitTrap);
694 NEM_LOG_REL_CAP_VM_EXIT(X64ApicWriteSvrExitTrap);
695 NEM_LOG_REL_CAP_VM_EXIT(UnknownSynicConnection);
696 NEM_LOG_REL_CAP_VM_EXIT(RetargetUnknownVpciDevice);
697 NEM_LOG_REL_CAP_VM_EXIT(X64ApicWriteLdrExitTrap);
698 NEM_LOG_REL_CAP_VM_EXIT(X64ApicWriteDfrExitTrap);
699 NEM_LOG_REL_CAP_VM_EXIT(GpaAccessFaultExit);
700#endif
701#undef NEM_LOG_REL_CAP_VM_EXIT
702 uint64_t const fKnownVmExits = RT_BIT_64(15) - 1U;
703 if (Caps.ExtendedVmExits.AsUINT64 & ~fKnownVmExits)
704 NEM_LOG_REL_CAP_SUB_EX("Unknown VM exit defs", "%#RX64", Caps.ExtendedVmExits.AsUINT64 & ~fKnownVmExits);
705 pVM->nem.s.fExtendedMsrExit = RT_BOOL(Caps.ExtendedVmExits.X64MsrExit);
706 pVM->nem.s.fExtendedCpuIdExit = RT_BOOL(Caps.ExtendedVmExits.X64CpuidExit);
707 pVM->nem.s.fExtendedXcptExit = RT_BOOL(Caps.ExtendedVmExits.ExceptionExit);
708 /** @todo RECHECK: WHV_EXTENDED_VM_EXITS typedef. */
709
710 /*
711 * Check features in case they end up defining any.
712 */
713 RT_ZERO(Caps);
714 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeFeatures, &Caps, sizeof(Caps));
715 if (FAILED(hrc))
716 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
717 "WHvGetCapability/WHvCapabilityCodeFeatures failed: %Rhrc (Last=%#x/%u)",
718 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
719 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeFeatures", "%'#018RX64", Caps.Features.AsUINT64);
720#define NEM_LOG_REL_CAP_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.Features.a_Field)
721#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN10_18362
722 NEM_LOG_REL_CAP_FEATURE(PartialUnmap);
723 NEM_LOG_REL_CAP_FEATURE(LocalApicEmulation);
724 NEM_LOG_REL_CAP_FEATURE(Xsave);
725 NEM_LOG_REL_CAP_FEATURE(DirtyPageTracking);
726 NEM_LOG_REL_CAP_FEATURE(SpeculationControl);
727#endif
728#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN10_19040
729 NEM_LOG_REL_CAP_FEATURE(ApicRemoteRead);
730 NEM_LOG_REL_CAP_FEATURE(IdleSuspend);
731#endif
732#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN11_22000 /** @todo Could some of these may have been added earlier... */
733 NEM_LOG_REL_CAP_FEATURE(VirtualPciDeviceSupport);
734 NEM_LOG_REL_CAP_FEATURE(IommuSupport);
735 NEM_LOG_REL_CAP_FEATURE(VpHotAddRemove);
736#endif
737#undef NEM_LOG_REL_CAP_FEATURE
738 const uint64_t fKnownFeatures = RT_BIT_64(10) - 1U;
739 if (Caps.Features.AsUINT64 & ~fKnownFeatures)
740 NEM_LOG_REL_CAP_SUB_EX("Unknown features", "%#RX64", Caps.ExtendedVmExits.AsUINT64 & ~fKnownVmExits);
741 pVM->nem.s.fSpeculationControl = RT_BOOL(Caps.Features.SpeculationControl);
742 /** @todo RECHECK: WHV_CAPABILITY_FEATURES typedef. */
743
744 /*
745 * Check supported exception exit bitmap bits.
746 * We don't currently require this, so we just log failure.
747 */
748 RT_ZERO(Caps);
749 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeExceptionExitBitmap, &Caps, sizeof(Caps));
750 if (SUCCEEDED(hrc))
751 LogRel(("NEM: Supported exception exit bitmap: %#RX64\n", Caps.ExceptionExitBitmap));
752 else
753 LogRel(("NEM: Warning! WHvGetCapability/WHvCapabilityCodeExceptionExitBitmap failed: %Rhrc (Last=%#x/%u)",
754 hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
755
756 /*
757 * Check that the CPU vendor is supported.
758 */
759 RT_ZERO(Caps);
760 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorVendor, &Caps, sizeof(Caps));
761 if (FAILED(hrc))
762 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
763 "WHvGetCapability/WHvCapabilityCodeProcessorVendor failed: %Rhrc (Last=%#x/%u)",
764 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
765 switch (Caps.ProcessorVendor)
766 {
767 /** @todo RECHECK: WHV_PROCESSOR_VENDOR typedef. */
768 case WHvProcessorVendorIntel:
769 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - Intel", Caps.ProcessorVendor);
770 pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_INTEL;
771 break;
772 case WHvProcessorVendorAmd:
773 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d - AMD", Caps.ProcessorVendor);
774 pVM->nem.s.enmCpuVendor = CPUMCPUVENDOR_AMD;
775 break;
776 default:
777 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorVendor", "%d", Caps.ProcessorVendor);
778 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unknown processor vendor: %d", Caps.ProcessorVendor);
779 }
780
781 /*
782 * CPU features, guessing these are virtual CPU features?
783 */
784 RT_ZERO(Caps);
785 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorFeatures, &Caps, sizeof(Caps));
786 if (FAILED(hrc))
787 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
788 "WHvGetCapability/WHvCapabilityCodeProcessorFeatures failed: %Rhrc (Last=%#x/%u)",
789 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
790 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorFeatures", "%'#018RX64", Caps.ProcessorFeatures.AsUINT64);
791#define NEM_LOG_REL_CPU_FEATURE(a_Field) NEM_LOG_REL_CAP_SUB(#a_Field, Caps.ProcessorFeatures.a_Field)
792 NEM_LOG_REL_CPU_FEATURE(Sse3Support);
793 NEM_LOG_REL_CPU_FEATURE(LahfSahfSupport);
794 NEM_LOG_REL_CPU_FEATURE(Ssse3Support);
795 NEM_LOG_REL_CPU_FEATURE(Sse4_1Support);
796 NEM_LOG_REL_CPU_FEATURE(Sse4_2Support);
797 NEM_LOG_REL_CPU_FEATURE(Sse4aSupport);
798 NEM_LOG_REL_CPU_FEATURE(XopSupport);
799 NEM_LOG_REL_CPU_FEATURE(PopCntSupport);
800 NEM_LOG_REL_CPU_FEATURE(Cmpxchg16bSupport);
801 NEM_LOG_REL_CPU_FEATURE(Altmovcr8Support);
802 NEM_LOG_REL_CPU_FEATURE(LzcntSupport);
803 NEM_LOG_REL_CPU_FEATURE(MisAlignSseSupport);
804 NEM_LOG_REL_CPU_FEATURE(MmxExtSupport);
805 NEM_LOG_REL_CPU_FEATURE(Amd3DNowSupport);
806 NEM_LOG_REL_CPU_FEATURE(ExtendedAmd3DNowSupport);
807 NEM_LOG_REL_CPU_FEATURE(Page1GbSupport);
808 NEM_LOG_REL_CPU_FEATURE(AesSupport);
809 NEM_LOG_REL_CPU_FEATURE(PclmulqdqSupport);
810 NEM_LOG_REL_CPU_FEATURE(PcidSupport);
811 NEM_LOG_REL_CPU_FEATURE(Fma4Support);
812 NEM_LOG_REL_CPU_FEATURE(F16CSupport);
813 NEM_LOG_REL_CPU_FEATURE(RdRandSupport);
814 NEM_LOG_REL_CPU_FEATURE(RdWrFsGsSupport);
815 NEM_LOG_REL_CPU_FEATURE(SmepSupport);
816 NEM_LOG_REL_CPU_FEATURE(EnhancedFastStringSupport);
817 NEM_LOG_REL_CPU_FEATURE(Bmi1Support);
818 NEM_LOG_REL_CPU_FEATURE(Bmi2Support);
819 NEM_LOG_REL_CPU_FEATURE(Reserved1);
820 NEM_LOG_REL_CPU_FEATURE(MovbeSupport);
821 NEM_LOG_REL_CPU_FEATURE(Npiep1Support);
822 NEM_LOG_REL_CPU_FEATURE(DepX87FPUSaveSupport);
823 NEM_LOG_REL_CPU_FEATURE(RdSeedSupport);
824 NEM_LOG_REL_CPU_FEATURE(AdxSupport);
825 NEM_LOG_REL_CPU_FEATURE(IntelPrefetchSupport);
826 NEM_LOG_REL_CPU_FEATURE(SmapSupport);
827 NEM_LOG_REL_CPU_FEATURE(HleSupport);
828 NEM_LOG_REL_CPU_FEATURE(RtmSupport);
829 NEM_LOG_REL_CPU_FEATURE(RdtscpSupport);
830 NEM_LOG_REL_CPU_FEATURE(ClflushoptSupport);
831 NEM_LOG_REL_CPU_FEATURE(ClwbSupport);
832 NEM_LOG_REL_CPU_FEATURE(ShaSupport);
833 NEM_LOG_REL_CPU_FEATURE(X87PointersSavedSupport);
834#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN10_17134 /** @todo maybe some of these were added earlier... */
835 NEM_LOG_REL_CPU_FEATURE(InvpcidSupport);
836 NEM_LOG_REL_CPU_FEATURE(IbrsSupport);
837 NEM_LOG_REL_CPU_FEATURE(StibpSupport);
838 NEM_LOG_REL_CPU_FEATURE(IbpbSupport);
839 NEM_LOG_REL_CPU_FEATURE(Reserved2);
840 NEM_LOG_REL_CPU_FEATURE(SsbdSupport);
841 NEM_LOG_REL_CPU_FEATURE(FastShortRepMovSupport);
842 NEM_LOG_REL_CPU_FEATURE(Reserved3);
843 NEM_LOG_REL_CPU_FEATURE(RdclNo);
844 NEM_LOG_REL_CPU_FEATURE(IbrsAllSupport);
845 NEM_LOG_REL_CPU_FEATURE(Reserved4);
846 NEM_LOG_REL_CPU_FEATURE(SsbNo);
847 NEM_LOG_REL_CPU_FEATURE(RsbANo);
848#endif
849#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN10_19040
850 NEM_LOG_REL_CPU_FEATURE(Reserved5);
851 NEM_LOG_REL_CPU_FEATURE(RdPidSupport);
852 NEM_LOG_REL_CPU_FEATURE(UmipSupport);
853 NEM_LOG_REL_CPU_FEATURE(MdsNoSupport);
854 NEM_LOG_REL_CPU_FEATURE(MdClearSupport);
855#endif
856#if WDK_NTDDI_VERSION >= MY_NTDDI_WIN11_22000
857 NEM_LOG_REL_CPU_FEATURE(TaaNoSupport);
858 NEM_LOG_REL_CPU_FEATURE(TsxCtrlSupport);
859 NEM_LOG_REL_CPU_FEATURE(Reserved6);
860#endif
861#undef NEM_LOG_REL_CPU_FEATURE
862 pVM->nem.s.uCpuFeatures.u64 = Caps.ProcessorFeatures.AsUINT64;
863 /** @todo RECHECK: WHV_PROCESSOR_FEATURES typedef. */
864
865 /*
866 * The cache line flush size.
867 */
868 RT_ZERO(Caps);
869 hrc = WHvGetCapabilityWrapper(WHvCapabilityCodeProcessorClFlushSize, &Caps, sizeof(Caps));
870 if (FAILED(hrc))
871 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
872 "WHvGetCapability/WHvCapabilityCodeProcessorClFlushSize failed: %Rhrc (Last=%#x/%u)",
873 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
874 NEM_LOG_REL_CAP_EX("WHvCapabilityCodeProcessorClFlushSize", "2^%u", Caps.ProcessorClFlushSize);
875 if (Caps.ProcessorClFlushSize < 8 && Caps.ProcessorClFlushSize > 9)
876 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Unsupported cache line flush size: %u", Caps.ProcessorClFlushSize);
877 pVM->nem.s.cCacheLineFlushShift = Caps.ProcessorClFlushSize;
878
879 /*
880 * See if they've added more properties that we're not aware of.
881 */
882 /** @todo RECHECK: WHV_CAPABILITY_CODE typedef. */
883 if (!IsDebuggerPresent()) /* Too noisy when in debugger, so skip. */
884 {
885 static const struct
886 {
887 uint32_t iMin, iMax; } s_aUnknowns[] =
888 {
889 { 0x0004, 0x000f },
890 { 0x1003, 0x100f },
891 { 0x2000, 0x200f },
892 { 0x3000, 0x300f },
893 { 0x4000, 0x400f },
894 };
895 for (uint32_t j = 0; j < RT_ELEMENTS(s_aUnknowns); j++)
896 for (uint32_t i = s_aUnknowns[j].iMin; i <= s_aUnknowns[j].iMax; i++)
897 {
898 RT_ZERO(Caps);
899 hrc = WHvGetCapabilityWrapper((WHV_CAPABILITY_CODE)i, &Caps, sizeof(Caps));
900 if (SUCCEEDED(hrc))
901 LogRel(("NEM: Warning! Unknown capability %#x returning: %.*Rhxs\n", i, sizeof(Caps), &Caps));
902 }
903 }
904
905 /*
906 * For proper operation, we require CPUID exits.
907 */
908 if (!pVM->nem.s.fExtendedCpuIdExit)
909 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended CPUID exit support");
910 if (!pVM->nem.s.fExtendedMsrExit)
911 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended MSR exit support");
912 if (!pVM->nem.s.fExtendedXcptExit)
913 return RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED, "Missing required extended exception exit support");
914
915#undef NEM_LOG_REL_CAP_EX
916#undef NEM_LOG_REL_CAP_SUB_EX
917#undef NEM_LOG_REL_CAP_SUB
918 return VINF_SUCCESS;
919}
920
921#ifdef LOG_ENABLED
922
923/**
924 * Used to fill in g_IoCtlGetHvPartitionId.
925 */
926static NTSTATUS WINAPI
927nemR3WinIoctlDetector_GetHvPartitionId(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
928 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
929 PVOID pvOutput, ULONG cbOutput)
930{
931 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
932 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
933 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
934 AssertLogRelMsgReturn(cbInput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
935 RT_NOREF(pvInput);
936
937 AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
938 AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_ID), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
939 *(HV_PARTITION_ID *)pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID;
940
941 g_IoCtlGetHvPartitionId.cbInput = cbInput;
942 g_IoCtlGetHvPartitionId.cbOutput = cbOutput;
943 g_IoCtlGetHvPartitionId.uFunction = uFunction;
944
945 return STATUS_SUCCESS;
946}
947
948
949/**
950 * Used to fill in g_IoCtlGetHvPartitionId.
951 */
952static NTSTATUS WINAPI
953nemR3WinIoctlDetector_GetPartitionProperty(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
954 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
955 PVOID pvOutput, ULONG cbOutput)
956{
957 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
958 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
959 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
960 AssertLogRelMsgReturn(cbInput == sizeof(VID_PARTITION_PROPERTY_CODE), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
961 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
962 AssertLogRelMsgReturn(*(VID_PARTITION_PROPERTY_CODE *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE,
963 ("*pvInput=%#x, expected %#x\n", *(HV_PARTITION_PROPERTY_CODE *)pvInput,
964 NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE), STATUS_INVALID_PARAMETER_9);
965 AssertLogRelMsgReturn(RT_VALID_PTR(pvOutput), ("pvOutput=%p\n", pvOutput), STATUS_INVALID_PARAMETER_9);
966 AssertLogRelMsgReturn(cbOutput == sizeof(HV_PARTITION_PROPERTY), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
967 *(HV_PARTITION_PROPERTY *)pvOutput = NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE;
968
969 g_IoCtlGetPartitionProperty.cbInput = cbInput;
970 g_IoCtlGetPartitionProperty.cbOutput = cbOutput;
971 g_IoCtlGetPartitionProperty.uFunction = uFunction;
972
973 return STATUS_SUCCESS;
974}
975
976
977/**
978 * Used to fill in g_IoCtlStartVirtualProcessor.
979 */
980static NTSTATUS WINAPI
981nemR3WinIoctlDetector_StartVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
982 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
983 PVOID pvOutput, ULONG cbOutput)
984{
985 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
986 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
987 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
988 AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
989 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
990 AssertLogRelMsgReturn(*(HV_VP_INDEX *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
991 ("*piCpu=%u\n", *(HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
992 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
993 RT_NOREF(pvOutput);
994
995 g_IoCtlStartVirtualProcessor.cbInput = cbInput;
996 g_IoCtlStartVirtualProcessor.cbOutput = cbOutput;
997 g_IoCtlStartVirtualProcessor.uFunction = uFunction;
998
999 return STATUS_SUCCESS;
1000}
1001
1002
1003/**
1004 * Used to fill in g_IoCtlStartVirtualProcessor.
1005 */
1006static NTSTATUS WINAPI
1007nemR3WinIoctlDetector_StopVirtualProcessor(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
1008 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
1009 PVOID pvOutput, ULONG cbOutput)
1010{
1011 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
1012 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
1013 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
1014 AssertLogRelMsgReturn(cbInput == sizeof(HV_VP_INDEX), ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_8);
1015 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
1016 AssertLogRelMsgReturn(*(HV_VP_INDEX *)pvInput == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
1017 ("*piCpu=%u\n", *(HV_VP_INDEX *)pvInput), STATUS_INVALID_PARAMETER_9);
1018 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
1019 RT_NOREF(pvOutput);
1020
1021 g_IoCtlStopVirtualProcessor.cbInput = cbInput;
1022 g_IoCtlStopVirtualProcessor.cbOutput = cbOutput;
1023 g_IoCtlStopVirtualProcessor.uFunction = uFunction;
1024
1025 return STATUS_SUCCESS;
1026}
1027
1028
1029/**
1030 * Used to fill in g_IoCtlMessageSlotHandleAndGetNext
1031 */
1032static NTSTATUS WINAPI
1033nemR3WinIoctlDetector_MessageSlotHandleAndGetNext(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
1034 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
1035 PVOID pvOutput, ULONG cbOutput)
1036{
1037 AssertLogRelMsgReturn(hFile == NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, ("hFile=%p\n", hFile), STATUS_INVALID_PARAMETER_1);
1038 RT_NOREF(hEvt); RT_NOREF(pfnApcCallback); RT_NOREF(pvApcCtx);
1039 AssertLogRelMsgReturn(RT_VALID_PTR(pIos), ("pIos=%p\n", pIos), STATUS_INVALID_PARAMETER_5);
1040
1041 if (g_uBuildNo >= 17758)
1042 {
1043 /* No timeout since about build 17758, it's now always an infinite wait. So, a somewhat compatible change. */
1044 AssertLogRelMsgReturn(cbInput == RT_UOFFSETOF(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT, cMillies),
1045 ("cbInput=%#x\n", cbInput),
1046 STATUS_INVALID_PARAMETER_8);
1047 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
1048 PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
1049 AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
1050 && pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE,
1051 ("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
1052 STATUS_INVALID_PARAMETER_9);
1053 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
1054 }
1055 else
1056 {
1057 AssertLogRelMsgReturn(cbInput == sizeof(VID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT), ("cbInput=%#x\n", cbInput),
1058 STATUS_INVALID_PARAMETER_8);
1059 AssertLogRelMsgReturn(RT_VALID_PTR(pvInput), ("pvInput=%p\n", pvInput), STATUS_INVALID_PARAMETER_9);
1060 PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT pVidIn = (PCVID_IOCTL_INPUT_MESSAGE_SLOT_HANDLE_AND_GET_NEXT)pvInput;
1061 AssertLogRelMsgReturn( pVidIn->iCpu == NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX
1062 && pVidIn->fFlags == VID_MSHAGN_F_HANDLE_MESSAGE
1063 && pVidIn->cMillies == NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT,
1064 ("iCpu=%u fFlags=%#x cMillies=%#x\n", pVidIn->iCpu, pVidIn->fFlags, pVidIn->cMillies),
1065 STATUS_INVALID_PARAMETER_9);
1066 AssertLogRelMsgReturn(cbOutput == 0, ("cbInput=%#x\n", cbInput), STATUS_INVALID_PARAMETER_10);
1067 RT_NOREF(pvOutput);
1068 }
1069
1070 g_IoCtlMessageSlotHandleAndGetNext.cbInput = cbInput;
1071 g_IoCtlMessageSlotHandleAndGetNext.cbOutput = cbOutput;
1072 g_IoCtlMessageSlotHandleAndGetNext.uFunction = uFunction;
1073
1074 return STATUS_SUCCESS;
1075}
1076
1077/**
1078 * Used to fill in what g_pIoCtlDetectForLogging points to.
1079 */
1080static NTSTATUS WINAPI nemR3WinIoctlDetector_ForLogging(HANDLE hFile, HANDLE hEvt, PIO_APC_ROUTINE pfnApcCallback, PVOID pvApcCtx,
1081 PIO_STATUS_BLOCK pIos, ULONG uFunction, PVOID pvInput, ULONG cbInput,
1082 PVOID pvOutput, ULONG cbOutput)
1083{
1084 RT_NOREF(hFile, hEvt, pfnApcCallback, pvApcCtx, pIos, pvInput, pvOutput);
1085
1086 g_pIoCtlDetectForLogging->cbInput = cbInput;
1087 g_pIoCtlDetectForLogging->cbOutput = cbOutput;
1088 g_pIoCtlDetectForLogging->uFunction = uFunction;
1089
1090 return STATUS_SUCCESS;
1091}
1092
1093#endif /* LOG_ENABLED */
1094
1095/**
1096 * Worker for nemR3NativeInit that detect I/O control function numbers for VID.
1097 *
1098 * We use the function numbers directly in ring-0 and to name functions when
1099 * logging NtDeviceIoControlFile calls.
1100 *
1101 * @note We could alternatively do this by disassembling the respective
1102 * functions, but hooking NtDeviceIoControlFile and making fake calls
1103 * more easily provides the desired information.
1104 *
1105 * @returns VBox status code.
1106 * @param pVM The cross context VM structure. Will set I/O
1107 * control info members.
1108 * @param pErrInfo Where to always return error info.
1109 */
1110static int nemR3WinInitDiscoverIoControlProperties(PVM pVM, PRTERRINFO pErrInfo)
1111{
1112 RT_NOREF(pVM, pErrInfo);
1113
1114 /*
1115 * Probe the I/O control information for select VID APIs so we can use
1116 * them directly from ring-0 and better log them.
1117 *
1118 */
1119#ifdef LOG_ENABLED
1120 decltype(NtDeviceIoControlFile) * const pfnOrg = *g_ppfnVidNtDeviceIoControlFile;
1121
1122 /* VidGetHvPartitionId - must work due to our memory management. */
1123 BOOL fRet;
1124 if (g_pfnVidGetHvPartitionId)
1125 {
1126 HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1127 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetHvPartitionId;
1128 fRet = g_pfnVidGetHvPartitionId(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &idHvPartition);
1129 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1130 AssertReturn(fRet && idHvPartition == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_ID && g_IoCtlGetHvPartitionId.uFunction != 0,
1131 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
1132 "Problem figuring out VidGetHvPartitionId: fRet=%u idHvPartition=%#x dwErr=%u",
1133 fRet, idHvPartition, GetLastError()) );
1134 LogRel(("NEM: VidGetHvPartitionId -> fun:%#x in:%#x out:%#x\n",
1135 g_IoCtlGetHvPartitionId.uFunction, g_IoCtlGetHvPartitionId.cbInput, g_IoCtlGetHvPartitionId.cbOutput));
1136 }
1137
1138 /* VidGetPartitionProperty - must work as it's fallback for VidGetHvPartitionId. */
1139 if (g_ppfnVidNtDeviceIoControlFile)
1140 {
1141 HV_PARTITION_PROPERTY uPropValue = ~NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE;
1142 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_GetPartitionProperty;
1143 fRet = g_pfnVidGetPartitionProperty(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_CODE,
1144 &uPropValue);
1145 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1146 AssertReturn( fRet
1147 && uPropValue == NEM_WIN_IOCTL_DETECTOR_FAKE_PARTITION_PROPERTY_VALUE
1148 && g_IoCtlGetHvPartitionId.uFunction != 0,
1149 RTErrInfoSetF(pErrInfo, VERR_NEM_INIT_FAILED,
1150 "Problem figuring out VidGetPartitionProperty: fRet=%u uPropValue=%#x dwErr=%u",
1151 fRet, uPropValue, GetLastError()) );
1152 LogRel(("NEM: VidGetPartitionProperty -> fun:%#x in:%#x out:%#x\n",
1153 g_IoCtlGetPartitionProperty.uFunction, g_IoCtlGetPartitionProperty.cbInput, g_IoCtlGetPartitionProperty.cbOutput));
1154 }
1155
1156 /* VidStartVirtualProcessor */
1157 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StartVirtualProcessor;
1158 fRet = g_pfnVidStartVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1159 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1160 AssertStmt(fRet && g_IoCtlStartVirtualProcessor.uFunction != 0,
1161 RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1162 "Problem figuring out VidStartVirtualProcessor: fRet=%u dwErr=%u", fRet, GetLastError()) );
1163 LogRel(("NEM: VidStartVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStartVirtualProcessor.uFunction,
1164 g_IoCtlStartVirtualProcessor.cbInput, g_IoCtlStartVirtualProcessor.cbOutput));
1165
1166 /* VidStopVirtualProcessor */
1167 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_StopVirtualProcessor;
1168 fRet = g_pfnVidStopVirtualProcessor(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1169 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1170 AssertStmt(fRet && g_IoCtlStopVirtualProcessor.uFunction != 0,
1171 RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1172 "Problem figuring out VidStopVirtualProcessor: fRet=%u dwErr=%u", fRet, GetLastError()) );
1173 LogRel(("NEM: VidStopVirtualProcessor -> fun:%#x in:%#x out:%#x\n", g_IoCtlStopVirtualProcessor.uFunction,
1174 g_IoCtlStopVirtualProcessor.cbInput, g_IoCtlStopVirtualProcessor.cbOutput));
1175
1176 /* VidMessageSlotHandleAndGetNext */
1177 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_MessageSlotHandleAndGetNext;
1178 fRet = g_pfnVidMessageSlotHandleAndGetNext(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE,
1179 NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX, VID_MSHAGN_F_HANDLE_MESSAGE,
1180 NEM_WIN_IOCTL_DETECTOR_FAKE_TIMEOUT);
1181 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1182 AssertStmt(fRet && g_IoCtlMessageSlotHandleAndGetNext.uFunction != 0,
1183 RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_NEM_RING3_ONLY,
1184 "Problem figuring out VidMessageSlotHandleAndGetNext: fRet=%u dwErr=%u",
1185 fRet, GetLastError()) );
1186 LogRel(("NEM: VidMessageSlotHandleAndGetNext -> fun:%#x in:%#x out:%#x\n",
1187 g_IoCtlMessageSlotHandleAndGetNext.uFunction, g_IoCtlMessageSlotHandleAndGetNext.cbInput,
1188 g_IoCtlMessageSlotHandleAndGetNext.cbOutput));
1189
1190 /* The following are only for logging: */
1191 union
1192 {
1193 VID_MAPPED_MESSAGE_SLOT MapSlot;
1194 HV_REGISTER_NAME Name;
1195 HV_REGISTER_VALUE Value;
1196 } uBuf;
1197
1198 /* VidMessageSlotMap */
1199 g_pIoCtlDetectForLogging = &g_IoCtlMessageSlotMap;
1200 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1201 fRet = g_pfnVidMessageSlotMap(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, &uBuf.MapSlot, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX);
1202 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1203 Assert(fRet);
1204 LogRel(("NEM: VidMessageSlotMap -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1205 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1206
1207 /* VidGetVirtualProcessorState */
1208 uBuf.Name = HvRegisterExplicitSuspend;
1209 g_pIoCtlDetectForLogging = &g_IoCtlGetVirtualProcessorState;
1210 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1211 fRet = g_pfnVidGetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
1212 &uBuf.Name, 1, &uBuf.Value);
1213 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1214 Assert(fRet);
1215 LogRel(("NEM: VidGetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1216 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1217
1218 /* VidSetVirtualProcessorState */
1219 uBuf.Name = HvRegisterExplicitSuspend;
1220 g_pIoCtlDetectForLogging = &g_IoCtlSetVirtualProcessorState;
1221 *g_ppfnVidNtDeviceIoControlFile = nemR3WinIoctlDetector_ForLogging;
1222 fRet = g_pfnVidSetVirtualProcessorState(NEM_WIN_IOCTL_DETECTOR_FAKE_HANDLE, NEM_WIN_IOCTL_DETECTOR_FAKE_VP_INDEX,
1223 &uBuf.Name, 1, &uBuf.Value);
1224 *g_ppfnVidNtDeviceIoControlFile = pfnOrg;
1225 Assert(fRet);
1226 LogRel(("NEM: VidSetVirtualProcessorState -> fun:%#x in:%#x out:%#x\n", g_pIoCtlDetectForLogging->uFunction,
1227 g_pIoCtlDetectForLogging->cbInput, g_pIoCtlDetectForLogging->cbOutput));
1228
1229 g_pIoCtlDetectForLogging = NULL;
1230#endif /* LOG_ENABLED */
1231
1232 return VINF_SUCCESS;
1233}
1234
1235
1236/**
1237 * Creates and sets up a Hyper-V (exo) partition.
1238 *
1239 * @returns VBox status code.
1240 * @param pVM The cross context VM structure.
1241 * @param pErrInfo Where to always return error info.
1242 */
1243static int nemR3WinInitCreatePartition(PVM pVM, PRTERRINFO pErrInfo)
1244{
1245 AssertReturn(!pVM->nem.s.hPartition, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1246 AssertReturn(!pVM->nem.s.hPartitionDevice, RTErrInfoSet(pErrInfo, VERR_WRONG_ORDER, "Wrong initalization order"));
1247
1248 /*
1249 * Create the partition.
1250 */
1251 WHV_PARTITION_HANDLE hPartition;
1252 HRESULT hrc = WHvCreatePartition(&hPartition);
1253 if (FAILED(hrc))
1254 return RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED, "WHvCreatePartition failed with %Rhrc (Last=%#x/%u)",
1255 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1256
1257 int rc;
1258
1259 /*
1260 * Set partition properties, most importantly the CPU count.
1261 */
1262 /**
1263 * @todo Someone at Microsoft please explain another weird API:
1264 * - Why this API doesn't take the WHV_PARTITION_PROPERTY_CODE value as an
1265 * argument rather than as part of the struct. That is so weird if you've
1266 * used any other NT or windows API, including WHvGetCapability().
1267 * - Why use PVOID when WHV_PARTITION_PROPERTY is what's expected. We
1268 * technically only need 9 bytes for setting/getting
1269 * WHVPartitionPropertyCodeProcessorClFlushSize, but the API insists on 16. */
1270 WHV_PARTITION_PROPERTY Property;
1271 RT_ZERO(Property);
1272 Property.ProcessorCount = pVM->cCpus;
1273 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorCount, &Property, sizeof(Property));
1274 if (SUCCEEDED(hrc))
1275 {
1276 RT_ZERO(Property);
1277 Property.ExtendedVmExits.X64CpuidExit = pVM->nem.s.fExtendedCpuIdExit; /** @todo Register fixed results and restrict cpuid exits */
1278 Property.ExtendedVmExits.X64MsrExit = pVM->nem.s.fExtendedMsrExit;
1279 Property.ExtendedVmExits.ExceptionExit = pVM->nem.s.fExtendedXcptExit;
1280 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExtendedVmExits, &Property, sizeof(Property));
1281 if (SUCCEEDED(hrc))
1282 {
1283 /*
1284 * We'll continue setup in nemR3NativeInitAfterCPUM.
1285 */
1286 pVM->nem.s.fCreatedEmts = false;
1287 pVM->nem.s.hPartition = hPartition;
1288 LogRel(("NEM: Created partition %p.\n", hPartition));
1289 return VINF_SUCCESS;
1290 }
1291
1292 rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1293 "Failed setting WHvPartitionPropertyCodeExtendedVmExits to %'#RX64: %Rhrc",
1294 Property.ExtendedVmExits.AsUINT64, hrc);
1295 }
1296 else
1297 rc = RTErrInfoSetF(pErrInfo, VERR_NEM_VM_CREATE_FAILED,
1298 "Failed setting WHvPartitionPropertyCodeProcessorCount to %u: %Rhrc (Last=%#x/%u)",
1299 pVM->cCpus, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1300 WHvDeletePartition(hPartition);
1301
1302 Assert(!pVM->nem.s.hPartitionDevice);
1303 Assert(!pVM->nem.s.hPartition);
1304 return rc;
1305}
1306
1307
1308/**
1309 * Makes sure APIC and firmware will not allow X2APIC mode.
1310 *
1311 * This is rather ugly.
1312 *
1313 * @returns VBox status code
1314 * @param pVM The cross context VM structure.
1315 */
1316static int nemR3WinDisableX2Apic(PVM pVM)
1317{
1318 /*
1319 * First make sure the 'Mode' config value of the APIC isn't set to X2APIC.
1320 * This defaults to APIC, so no need to change unless it's X2APIC.
1321 */
1322 PCFGMNODE pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/apic/0/Config");
1323 if (pCfg)
1324 {
1325 uint8_t bMode = 0;
1326 int rc = CFGMR3QueryU8(pCfg, "Mode", &bMode);
1327 AssertLogRelMsgReturn(RT_SUCCESS(rc) || rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1328 if (RT_SUCCESS(rc) && bMode == PDMAPICMODE_X2APIC)
1329 {
1330 LogRel(("NEM: Adjusting APIC configuration from X2APIC to APIC max mode. X2APIC is not supported by the WinHvPlatform API!\n"));
1331 LogRel(("NEM: Disable Hyper-V if you need X2APIC for your guests!\n"));
1332 rc = CFGMR3RemoveValue(pCfg, "Mode");
1333 rc = CFGMR3InsertInteger(pCfg, "Mode", PDMAPICMODE_APIC);
1334 AssertLogRelRCReturn(rc, rc);
1335 }
1336 }
1337
1338 /*
1339 * Now the firmwares.
1340 * These also defaults to APIC and only needs adjusting if configured to X2APIC (2).
1341 */
1342 static const char * const s_apszFirmwareConfigs[] =
1343 {
1344 "/Devices/efi/0/Config",
1345 "/Devices/pcbios/0/Config",
1346 };
1347 for (unsigned i = 0; i < RT_ELEMENTS(s_apszFirmwareConfigs); i++)
1348 {
1349 pCfg = CFGMR3GetChild(CFGMR3GetRoot(pVM), "/Devices/APIC/0/Config");
1350 if (pCfg)
1351 {
1352 uint8_t bMode = 0;
1353 int rc = CFGMR3QueryU8(pCfg, "APIC", &bMode);
1354 AssertLogRelMsgReturn(RT_SUCCESS(rc) || rc == VERR_CFGM_VALUE_NOT_FOUND, ("%Rrc\n", rc), rc);
1355 if (RT_SUCCESS(rc) && bMode == 2)
1356 {
1357 LogRel(("NEM: Adjusting %s/Mode from 2 (X2APIC) to 1 (APIC).\n", s_apszFirmwareConfigs[i]));
1358 rc = CFGMR3RemoveValue(pCfg, "APIC");
1359 rc = CFGMR3InsertInteger(pCfg, "APIC", 1);
1360 AssertLogRelRCReturn(rc, rc);
1361 }
1362 }
1363 }
1364
1365 return VINF_SUCCESS;
1366}
1367
1368
1369/**
1370 * Try initialize the native API.
1371 *
1372 * This may only do part of the job, more can be done in
1373 * nemR3NativeInitAfterCPUM() and nemR3NativeInitCompleted().
1374 *
1375 * @returns VBox status code.
1376 * @param pVM The cross context VM structure.
1377 * @param fFallback Whether we're in fallback mode or use-NEM mode. In
1378 * the latter we'll fail if we cannot initialize.
1379 * @param fForced Whether the HMForced flag is set and we should
1380 * fail if we cannot initialize.
1381 */
1382int nemR3NativeInit(PVM pVM, bool fFallback, bool fForced)
1383{
1384 g_uBuildNo = RTSystemGetNtBuildNo();
1385
1386 /*
1387 * Some state init.
1388 */
1389#ifdef NEM_WIN_WITH_A20
1390 pVM->nem.s.fA20Enabled = true;
1391#endif
1392#if 0
1393 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1394 {
1395 PNEMCPU pNemCpu = &pVM->apCpusR3[idCpu]->nem.s;
1396 }
1397#endif
1398
1399 /*
1400 * Error state.
1401 * The error message will be non-empty on failure and 'rc' will be set too.
1402 */
1403 RTERRINFOSTATIC ErrInfo;
1404 PRTERRINFO pErrInfo = RTErrInfoInitStatic(&ErrInfo);
1405 int rc = nemR3WinInitProbeAndLoad(fForced, pErrInfo);
1406 if (RT_SUCCESS(rc))
1407 {
1408 /*
1409 * Check the capabilties of the hypervisor, starting with whether it's present.
1410 */
1411 rc = nemR3WinInitCheckCapabilities(pVM, pErrInfo);
1412 if (RT_SUCCESS(rc))
1413 {
1414 /*
1415 * Discover the VID I/O control function numbers we need (for interception
1416 * only these days).
1417 */
1418 rc = nemR3WinInitDiscoverIoControlProperties(pVM, pErrInfo);
1419 if (RT_SUCCESS(rc))
1420 {
1421 /*
1422 * Create and initialize a partition.
1423 */
1424 rc = nemR3WinInitCreatePartition(pVM, pErrInfo);
1425 if (RT_SUCCESS(rc))
1426 {
1427 /*
1428 * Set ourselves as the execution engine and make config adjustments.
1429 */
1430 VM_SET_MAIN_EXECUTION_ENGINE(pVM, VM_EXEC_ENGINE_NATIVE_API);
1431 Log(("NEM: Marked active!\n"));
1432 nemR3WinDisableX2Apic(pVM);
1433 nemR3DisableCpuIsaExt(pVM, "MONITOR"); /* MONITOR is not supported by Hyper-V (MWAIT is sometimes). */
1434 PGMR3EnableNemMode(pVM);
1435
1436 /*
1437 * Register release statistics
1438 */
1439 STAMR3Register(pVM, (void *)&pVM->nem.s.cMappedPages, STAMTYPE_U32, STAMVISIBILITY_ALWAYS,
1440 "/NEM/PagesCurrentlyMapped", STAMUNIT_PAGES, "Number guest pages currently mapped by the VM");
1441 STAMR3Register(pVM, (void *)&pVM->nem.s.StatMapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1442 "/NEM/PagesMapCalls", STAMUNIT_PAGES, "Calls to WHvMapGpaRange/HvCallMapGpaPages");
1443 STAMR3Register(pVM, (void *)&pVM->nem.s.StatMapPageFailed, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1444 "/NEM/PagesMapFails", STAMUNIT_PAGES, "Calls to WHvMapGpaRange/HvCallMapGpaPages that failed");
1445 STAMR3Register(pVM, (void *)&pVM->nem.s.StatUnmapPage, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1446 "/NEM/PagesUnmapCalls", STAMUNIT_PAGES, "Calls to WHvUnmapGpaRange/HvCallUnmapGpaPages");
1447 STAMR3Register(pVM, (void *)&pVM->nem.s.StatUnmapPageFailed, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS,
1448 "/NEM/PagesUnmapFails", STAMUNIT_PAGES, "Calls to WHvUnmapGpaRange/HvCallUnmapGpaPages that failed");
1449 STAMR3Register(pVM, &pVM->nem.s.StatProfMapGpaRange, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1450 "/NEM/PagesMapGpaRange", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvMapGpaRange for bigger stuff");
1451 STAMR3Register(pVM, &pVM->nem.s.StatProfUnmapGpaRange, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1452 "/NEM/PagesUnmapGpaRange", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvUnmapGpaRange for bigger stuff");
1453 STAMR3Register(pVM, &pVM->nem.s.StatProfMapGpaRangePage, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1454 "/NEM/PagesMapGpaRangePage", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvMapGpaRange for single pages");
1455 STAMR3Register(pVM, &pVM->nem.s.StatProfUnmapGpaRangePage, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS,
1456 "/NEM/PagesUnmapGpaRangePage", STAMUNIT_TICKS_PER_CALL, "Profiling calls to WHvUnmapGpaRange for single pages");
1457
1458 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1459 {
1460 PNEMCPU pNemCpu = &pVM->apCpusR3[idCpu]->nem.s;
1461 STAMR3RegisterF(pVM, &pNemCpu->StatExitPortIo, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of port I/O exits", "/NEM/CPU%u/ExitPortIo", idCpu);
1462 STAMR3RegisterF(pVM, &pNemCpu->StatExitMemUnmapped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unmapped memory exits", "/NEM/CPU%u/ExitMemUnmapped", idCpu);
1463 STAMR3RegisterF(pVM, &pNemCpu->StatExitMemIntercept, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of intercepted memory exits", "/NEM/CPU%u/ExitMemIntercept", idCpu);
1464 STAMR3RegisterF(pVM, &pNemCpu->StatExitHalt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of HLT exits", "/NEM/CPU%u/ExitHalt", idCpu);
1465 STAMR3RegisterF(pVM, &pNemCpu->StatExitInterruptWindow, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of interrupt window exits", "/NEM/CPU%u/ExitInterruptWindow", idCpu);
1466 STAMR3RegisterF(pVM, &pNemCpu->StatExitCpuId, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of CPUID exits", "/NEM/CPU%u/ExitCpuId", idCpu);
1467 STAMR3RegisterF(pVM, &pNemCpu->StatExitMsr, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of MSR access exits", "/NEM/CPU%u/ExitMsr", idCpu);
1468 STAMR3RegisterF(pVM, &pNemCpu->StatExitException, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of exception exits", "/NEM/CPU%u/ExitException", idCpu);
1469 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionBp, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #BP exits", "/NEM/CPU%u/ExitExceptionBp", idCpu);
1470 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionDb, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #DB exits", "/NEM/CPU%u/ExitExceptionDb", idCpu);
1471 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionGp, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #GP exits", "/NEM/CPU%u/ExitExceptionGp", idCpu);
1472 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionGpMesa, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #GP exits from mesa driver", "/NEM/CPU%u/ExitExceptionGpMesa", idCpu);
1473 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionUd, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of #UD exits", "/NEM/CPU%u/ExitExceptionUd", idCpu);
1474 STAMR3RegisterF(pVM, &pNemCpu->StatExitExceptionUdHandled, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of handled #UD exits", "/NEM/CPU%u/ExitExceptionUdHandled", idCpu);
1475 STAMR3RegisterF(pVM, &pNemCpu->StatExitUnrecoverable, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of unrecoverable exits", "/NEM/CPU%u/ExitUnrecoverable", idCpu);
1476 STAMR3RegisterF(pVM, &pNemCpu->StatGetMsgTimeout, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of get message timeouts/alerts", "/NEM/CPU%u/GetMsgTimeout", idCpu);
1477 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuSuccess, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of successful CPU stops", "/NEM/CPU%u/StopCpuSuccess", idCpu);
1478 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPending, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stops", "/NEM/CPU%u/StopCpuPending", idCpu);
1479 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPendingAlerts,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pending CPU stop alerts", "/NEM/CPU%u/StopCpuPendingAlerts", idCpu);
1480 STAMR3RegisterF(pVM, &pNemCpu->StatStopCpuPendingOdd, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of odd pending CPU stops (see code)", "/NEM/CPU%u/StopCpuPendingOdd", idCpu);
1481 STAMR3RegisterF(pVM, &pNemCpu->StatCancelChangedState, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel changed state", "/NEM/CPU%u/CancelChangedState", idCpu);
1482 STAMR3RegisterF(pVM, &pNemCpu->StatCancelAlertedThread, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel alerted EMT", "/NEM/CPU%u/CancelAlertedEMT", idCpu);
1483 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPre, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of pre execution FF breaks", "/NEM/CPU%u/BreakOnFFPre", idCpu);
1484 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnFFPost, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of post execution FF breaks", "/NEM/CPU%u/BreakOnFFPost", idCpu);
1485 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnCancel, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of cancel execution breaks", "/NEM/CPU%u/BreakOnCancel", idCpu);
1486 STAMR3RegisterF(pVM, &pNemCpu->StatBreakOnStatus, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of status code breaks", "/NEM/CPU%u/BreakOnStatus", idCpu);
1487 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnDemand, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of on-demand state imports", "/NEM/CPU%u/ImportOnDemand", idCpu);
1488 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnReturn, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of state imports on loop return", "/NEM/CPU%u/ImportOnReturn", idCpu);
1489 STAMR3RegisterF(pVM, &pNemCpu->StatImportOnReturnSkipped, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of skipped state imports on loop return", "/NEM/CPU%u/ImportOnReturnSkipped", idCpu);
1490 STAMR3RegisterF(pVM, &pNemCpu->StatQueryCpuTick, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of TSC queries", "/NEM/CPU%u/QueryCpuTick", idCpu);
1491 }
1492
1493#if defined(VBOX_WITH_R0_MODULES) && !defined(VBOX_WITH_MINIMAL_R0)
1494 if (!SUPR3IsDriverless())
1495 {
1496 PUVM pUVM = pVM->pUVM;
1497 STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesAvailable, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1498 STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Free pages available to the hypervisor",
1499 "/NEM/R0Stats/cPagesAvailable");
1500 STAMR3RegisterRefresh(pUVM, &pVM->nem.s.R0Stats.cPagesInUse, STAMTYPE_U64, STAMVISIBILITY_ALWAYS,
1501 STAMUNIT_PAGES, STAM_REFRESH_GRP_NEM, "Pages in use by hypervisor",
1502 "/NEM/R0Stats/cPagesInUse");
1503 }
1504#endif /* VBOX_WITH_R0_MODULES && !VBOX_WITH_MINIMAL_R0 */
1505
1506 }
1507 }
1508 }
1509 }
1510
1511 /*
1512 * We only fail if in forced mode, otherwise just log the complaint and return.
1513 */
1514 Assert(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API || RTErrInfoIsSet(pErrInfo));
1515 if ( (fForced || !fFallback)
1516 && pVM->bMainExecutionEngine != VM_EXEC_ENGINE_NATIVE_API)
1517 return VMSetError(pVM, RT_SUCCESS_NP(rc) ? VERR_NEM_NOT_AVAILABLE : rc, RT_SRC_POS, "%s", pErrInfo->pszMsg);
1518
1519 if (RTErrInfoIsSet(pErrInfo))
1520 LogRel(("NEM: Not available: %s\n", pErrInfo->pszMsg));
1521 return VINF_SUCCESS;
1522}
1523
1524
1525/**
1526 * This is called after CPUMR3Init is done.
1527 *
1528 * @returns VBox status code.
1529 * @param pVM The VM handle..
1530 */
1531int nemR3NativeInitAfterCPUM(PVM pVM)
1532{
1533 /*
1534 * Validate sanity.
1535 */
1536 WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1537 AssertReturn(hPartition != NULL, VERR_WRONG_ORDER);
1538 AssertReturn(!pVM->nem.s.hPartitionDevice, VERR_WRONG_ORDER);
1539 AssertReturn(!pVM->nem.s.fCreatedEmts, VERR_WRONG_ORDER);
1540 AssertReturn(pVM->bMainExecutionEngine == VM_EXEC_ENGINE_NATIVE_API, VERR_WRONG_ORDER);
1541
1542 /*
1543 * Determine whether we can and should export/import IA32_SPEC_CTRL.
1544 */
1545 pVM->nem.s.fDoIa32SpecCtrl = pVM->nem.s.fSpeculationControl
1546 && g_CpumHostFeatures.s.fSpecCtrlMsr
1547 && pVM->cpum.ro.GuestFeatures.fSpecCtrlMsr;
1548
1549 /*
1550 * Continue setting up the partition now that we've got most of the CPUID feature stuff.
1551 */
1552 WHV_PARTITION_PROPERTY Property;
1553 HRESULT hrc;
1554
1555#if 0
1556 /* Not sure if we really need to set the vendor.
1557 Update: Apparently we don't. WHvPartitionPropertyCodeProcessorVendor was removed in 17110. */
1558 RT_ZERO(Property);
1559 Property.ProcessorVendor = pVM->nem.s.enmCpuVendor == CPUMCPUVENDOR_AMD ? WHvProcessorVendorAmd
1560 : WHvProcessorVendorIntel;
1561 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorVendor, &Property, sizeof(Property));
1562 if (FAILED(hrc))
1563 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1564 "Failed to set WHvPartitionPropertyCodeProcessorVendor to %u: %Rhrc (Last=%#x/%u)",
1565 Property.ProcessorVendor, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1566#endif
1567
1568 /* Not sure if we really need to set the cache line flush size. */
1569 RT_ZERO(Property);
1570 Property.ProcessorClFlushSize = pVM->nem.s.cCacheLineFlushShift;
1571 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorClFlushSize, &Property, sizeof(Property));
1572 if (FAILED(hrc))
1573 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1574 "Failed to set WHvPartitionPropertyCodeProcessorClFlushSize to %u: %Rhrc (Last=%#x/%u)",
1575 pVM->nem.s.cCacheLineFlushShift, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1576
1577 /* Intercept #DB, #BP and #UD exceptions. */
1578 RT_ZERO(Property);
1579 Property.ExceptionExitBitmap = RT_BIT_64(WHvX64ExceptionTypeDebugTrapOrFault)
1580 | RT_BIT_64(WHvX64ExceptionTypeBreakpointTrap)
1581 | RT_BIT_64(WHvX64ExceptionTypeInvalidOpcodeFault);
1582
1583 /* Intercept #GP to workaround the buggy mesa vmwgfx driver. */
1584 PVMCPU pVCpu = pVM->apCpusR3[0]; /** @todo In theory per vCPU, in practice same for all. */
1585 if (pVCpu->nem.s.fTrapXcptGpForLovelyMesaDrv)
1586 Property.ExceptionExitBitmap |= RT_BIT_64(WHvX64ExceptionTypeGeneralProtectionFault);
1587
1588 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeExceptionExitBitmap, &Property, sizeof(Property));
1589 if (FAILED(hrc))
1590 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1591 "Failed to set WHvPartitionPropertyCodeExceptionExitBitmap to %#RX64: %Rhrc (Last=%#x/%u)",
1592 Property.ExceptionExitBitmap, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1593
1594
1595 /*
1596 * Sync CPU features with CPUM.
1597 */
1598 /** @todo sync CPU features with CPUM. */
1599
1600 /* Set the partition property. */
1601 RT_ZERO(Property);
1602 Property.ProcessorFeatures.AsUINT64 = pVM->nem.s.uCpuFeatures.u64;
1603 hrc = WHvSetPartitionProperty(hPartition, WHvPartitionPropertyCodeProcessorFeatures, &Property, sizeof(Property));
1604 if (FAILED(hrc))
1605 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1606 "Failed to set WHvPartitionPropertyCodeProcessorFeatures to %'#RX64: %Rhrc (Last=%#x/%u)",
1607 pVM->nem.s.uCpuFeatures.u64, hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1608
1609 /*
1610 * Set up the partition.
1611 *
1612 * Seems like this is where the partition is actually instantiated and we get
1613 * a handle to it.
1614 */
1615 hrc = WHvSetupPartition(hPartition);
1616 if (FAILED(hrc))
1617 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1618 "Call to WHvSetupPartition failed: %Rhrc (Last=%#x/%u)",
1619 hrc, RTNtLastStatusValue(), RTNtLastErrorValue());
1620
1621 /*
1622 * Hysterical raisins: Get the handle (could also fish this out via VID.DLL NtDeviceIoControlFile intercepting).
1623 */
1624 HANDLE hPartitionDevice;
1625 __try
1626 {
1627 hPartitionDevice = ((HANDLE *)hPartition)[1];
1628 if (!hPartitionDevice)
1629 hPartitionDevice = INVALID_HANDLE_VALUE;
1630 }
1631 __except(EXCEPTION_EXECUTE_HANDLER)
1632 {
1633 hrc = GetExceptionCode();
1634 hPartitionDevice = INVALID_HANDLE_VALUE;
1635 }
1636
1637 /* Test the handle. */
1638 HV_PARTITION_PROPERTY uValue = 0;
1639 if ( g_pfnVidGetPartitionProperty
1640 && hPartitionDevice != INVALID_HANDLE_VALUE
1641 && !g_pfnVidGetPartitionProperty(hPartitionDevice, HvPartitionPropertyProcessorVendor, &uValue))
1642 hPartitionDevice = INVALID_HANDLE_VALUE;
1643 LogRel(("NEM: HvPartitionPropertyProcessorVendor=%#llx (%lld)\n", uValue, uValue));
1644
1645 /*
1646 * More hysterical rasins: Get the partition ID if we can.
1647 */
1648 HV_PARTITION_ID idHvPartition = HV_PARTITION_ID_INVALID;
1649 if ( g_pfnVidGetHvPartitionId
1650 && hPartitionDevice != INVALID_HANDLE_VALUE
1651 && !g_pfnVidGetHvPartitionId(hPartitionDevice, &idHvPartition))
1652 {
1653 idHvPartition = HV_PARTITION_ID_INVALID;
1654 Log(("NEM: VidGetHvPartitionId failed: %#x\n", GetLastError()));
1655 }
1656 pVM->nem.s.hPartitionDevice = hPartitionDevice;
1657
1658 /*
1659 * Setup the EMTs.
1660 */
1661 for (VMCPUID idCpu = 0; idCpu < pVM->cCpus; idCpu++)
1662 {
1663 pVCpu = pVM->apCpusR3[idCpu];
1664
1665 hrc = WHvCreateVirtualProcessor(hPartition, idCpu, 0 /*fFlags*/);
1666 if (FAILED(hrc))
1667 {
1668 NTSTATUS const rcNtLast = RTNtLastStatusValue();
1669 DWORD const dwErrLast = RTNtLastErrorValue();
1670 while (idCpu-- > 0)
1671 {
1672 HRESULT hrc2 = WHvDeleteVirtualProcessor(hPartition, idCpu);
1673 AssertLogRelMsg(SUCCEEDED(hrc2), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1674 hPartition, idCpu, hrc2, RTNtLastStatusValue(),
1675 RTNtLastErrorValue()));
1676 }
1677 return VMSetError(pVM, VERR_NEM_VM_CREATE_FAILED, RT_SRC_POS,
1678 "Call to WHvCreateVirtualProcessor failed: %Rhrc (Last=%#x/%u)", hrc, rcNtLast, dwErrLast);
1679 }
1680 }
1681 pVM->nem.s.fCreatedEmts = true;
1682
1683 LogRel(("NEM: Successfully set up partition (device handle %p, partition ID %#llx)\n", hPartitionDevice, idHvPartition));
1684
1685 /*
1686 * Any hyper-v statistics we can get at now? HvCallMapStatsPage isn't accessible any more.
1687 */
1688 /** @todo stats */
1689
1690 /*
1691 * Adjust features.
1692 *
1693 * Note! We've already disabled X2APIC and MONITOR/MWAIT via CFGM during
1694 * the first init call.
1695 */
1696
1697 return VINF_SUCCESS;
1698}
1699
1700
1701int nemR3NativeInitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
1702{
1703 //BOOL fRet = SetThreadPriority(GetCurrentThread(), 0);
1704 //AssertLogRel(fRet);
1705
1706 NOREF(pVM); NOREF(enmWhat);
1707 return VINF_SUCCESS;
1708}
1709
1710
1711int nemR3NativeTerm(PVM pVM)
1712{
1713 /*
1714 * Delete the partition.
1715 */
1716 WHV_PARTITION_HANDLE hPartition = pVM->nem.s.hPartition;
1717 pVM->nem.s.hPartition = NULL;
1718 pVM->nem.s.hPartitionDevice = NULL;
1719 if (hPartition != NULL)
1720 {
1721 VMCPUID idCpu = pVM->nem.s.fCreatedEmts ? pVM->cCpus : 0;
1722 LogRel(("NEM: Destroying partition %p with its %u VCpus...\n", hPartition, idCpu));
1723 while (idCpu-- > 0)
1724 {
1725 PVMCPU pVCpu = pVM->apCpusR3[idCpu];
1726 pVCpu->nem.s.pvMsgSlotMapping = NULL;
1727 HRESULT hrc = WHvDeleteVirtualProcessor(hPartition, idCpu);
1728 AssertLogRelMsg(SUCCEEDED(hrc), ("WHvDeleteVirtualProcessor(%p, %u) -> %Rhrc (Last=%#x/%u)\n",
1729 hPartition, idCpu, hrc, RTNtLastStatusValue(),
1730 RTNtLastErrorValue()));
1731 }
1732 WHvDeletePartition(hPartition);
1733 }
1734 pVM->nem.s.fCreatedEmts = false;
1735 return VINF_SUCCESS;
1736}
1737
1738
1739/**
1740 * VM reset notification.
1741 *
1742 * @param pVM The cross context VM structure.
1743 */
1744void nemR3NativeReset(PVM pVM)
1745{
1746#if 0
1747 /* Unfix the A20 gate. */
1748 pVM->nem.s.fA20Fixed = false;
1749#else
1750 RT_NOREF(pVM);
1751#endif
1752}
1753
1754
1755/**
1756 * Reset CPU due to INIT IPI or hot (un)plugging.
1757 *
1758 * @param pVCpu The cross context virtual CPU structure of the CPU being
1759 * reset.
1760 * @param fInitIpi Whether this is the INIT IPI or hot (un)plugging case.
1761 */
1762void nemR3NativeResetCpu(PVMCPU pVCpu, bool fInitIpi)
1763{
1764#ifdef NEM_WIN_WITH_A20
1765 /* Lock the A20 gate if INIT IPI, make sure it's enabled. */
1766 if (fInitIpi && pVCpu->idCpu > 0)
1767 {
1768 PVM pVM = pVCpu->CTX_SUFF(pVM);
1769 if (!pVM->nem.s.fA20Enabled)
1770 nemR3NativeNotifySetA20(pVCpu, true);
1771 pVM->nem.s.fA20Enabled = true;
1772 pVM->nem.s.fA20Fixed = true;
1773 }
1774#else
1775 RT_NOREF(pVCpu, fInitIpi);
1776#endif
1777}
1778
1779
1780VBOXSTRICTRC nemR3NativeRunGC(PVM pVM, PVMCPU pVCpu)
1781{
1782 return nemHCWinRunGC(pVM, pVCpu);
1783}
1784
1785
1786VMMR3_INT_DECL(bool) NEMR3CanExecuteGuest(PVM pVM, PVMCPU pVCpu)
1787{
1788 Assert(VM_IS_NEM_ENABLED(pVM));
1789
1790#ifndef NEM_WIN_WITH_A20
1791 /*
1792 * Only execute when the A20 gate is enabled because this lovely Hyper-V
1793 * blackbox does not seem to have any way to enable or disable A20.
1794 */
1795 RT_NOREF(pVM);
1796 return PGMPhysIsA20Enabled(pVCpu);
1797#else
1798 RT_NOREF(pVM, pVCpu);
1799 return true;
1800#endif
1801}
1802
1803
1804bool nemR3NativeSetSingleInstruction(PVM pVM, PVMCPU pVCpu, bool fEnable)
1805{
1806 NOREF(pVM); NOREF(pVCpu); NOREF(fEnable);
1807 return false;
1808}
1809
1810
1811void nemR3NativeNotifyFF(PVM pVM, PVMCPU pVCpu, uint32_t fFlags)
1812{
1813 Log8(("nemR3NativeNotifyFF: canceling %u\n", pVCpu->idCpu));
1814 HRESULT hrc = WHvCancelRunVirtualProcessor(pVM->nem.s.hPartition, pVCpu->idCpu, 0);
1815 AssertMsg(SUCCEEDED(hrc), ("WHvCancelRunVirtualProcessor -> hrc=%Rhrc\n", hrc));
1816 RT_NOREF_PV(hrc);
1817 RT_NOREF_PV(fFlags);
1818}
1819
1820
1821DECLHIDDEN(bool) nemR3NativeNotifyDebugEventChanged(PVM pVM, bool fUseDebugLoop)
1822{
1823 RT_NOREF(pVM, fUseDebugLoop);
1824 return false;
1825}
1826
1827
1828DECLHIDDEN(bool) nemR3NativeNotifyDebugEventChangedPerCpu(PVM pVM, PVMCPU pVCpu, bool fUseDebugLoop)
1829{
1830 RT_NOREF(pVM, pVCpu, fUseDebugLoop);
1831 return false;
1832}
1833
1834
1835DECLINLINE(int) nemR3NativeGCPhys2R3PtrReadOnly(PVM pVM, RTGCPHYS GCPhys, const void **ppv)
1836{
1837 PGMPAGEMAPLOCK Lock;
1838 int rc = PGMPhysGCPhys2CCPtrReadOnly(pVM, GCPhys, ppv, &Lock);
1839 if (RT_SUCCESS(rc))
1840 PGMPhysReleasePageMappingLock(pVM, &Lock);
1841 return rc;
1842}
1843
1844
1845DECLINLINE(int) nemR3NativeGCPhys2R3PtrWriteable(PVM pVM, RTGCPHYS GCPhys, void **ppv)
1846{
1847 PGMPAGEMAPLOCK Lock;
1848 int rc = PGMPhysGCPhys2CCPtr(pVM, GCPhys, ppv, &Lock);
1849 if (RT_SUCCESS(rc))
1850 PGMPhysReleasePageMappingLock(pVM, &Lock);
1851 return rc;
1852}
1853
1854
1855VMMR3_INT_DECL(int) NEMR3NotifyPhysRamRegister(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvR3,
1856 uint8_t *pu2State, uint32_t *puNemRange)
1857{
1858 Log5(("NEMR3NotifyPhysRamRegister: %RGp LB %RGp, pvR3=%p pu2State=%p (%d) puNemRange=%p (%d)\n",
1859 GCPhys, cb, pvR3, pu2State, pu2State, puNemRange, *puNemRange));
1860
1861 *pu2State = UINT8_MAX;
1862 RT_NOREF(puNemRange);
1863
1864 if (pvR3)
1865 {
1866 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
1867 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvR3, GCPhys, cb,
1868 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute);
1869 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
1870 if (SUCCEEDED(hrc))
1871 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
1872 else
1873 {
1874 LogRel(("NEMR3NotifyPhysRamRegister: GCPhys=%RGp LB %RGp pvR3=%p hrc=%Rhrc (%#x) Last=%#x/%u\n",
1875 GCPhys, cb, pvR3, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
1876 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
1877 return VERR_NEM_MAP_PAGES_FAILED;
1878 }
1879 }
1880 return VINF_SUCCESS;
1881}
1882
1883
1884VMMR3_INT_DECL(bool) NEMR3IsMmio2DirtyPageTrackingSupported(PVM pVM)
1885{
1886 RT_NOREF(pVM);
1887 return g_pfnWHvQueryGpaRangeDirtyBitmap != NULL;
1888}
1889
1890
1891VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExMapEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags,
1892 void *pvRam, void *pvMmio2, uint8_t *pu2State, uint32_t *puNemRange)
1893{
1894 Log5(("NEMR3NotifyPhysMmioExMapEarly: %RGp LB %RGp fFlags=%#x pvRam=%p pvMmio2=%p pu2State=%p (%d) puNemRange=%p (%#x)\n",
1895 GCPhys, cb, fFlags, pvRam, pvMmio2, pu2State, *pu2State, puNemRange, puNemRange ? *puNemRange : UINT32_MAX));
1896 RT_NOREF(puNemRange);
1897
1898 /*
1899 * Unmap the RAM we're replacing.
1900 */
1901 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_REPLACE)
1902 {
1903 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfUnmapGpaRange, a);
1904 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, cb);
1905 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfUnmapGpaRange, a);
1906 if (SUCCEEDED(hrc))
1907 { /* likely */ }
1908 else if (pvMmio2)
1909 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u (ignored)\n",
1910 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
1911 else
1912 {
1913 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u\n",
1914 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
1915 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
1916 return VERR_NEM_UNMAP_PAGES_FAILED;
1917 }
1918 }
1919
1920 /*
1921 * Map MMIO2 if any.
1922 */
1923 if (pvMmio2)
1924 {
1925 Assert(fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2);
1926 WHV_MAP_GPA_RANGE_FLAGS fWHvFlags = WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute;
1927 if ((fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_TRACK_DIRTY_PAGES) && g_pfnWHvQueryGpaRangeDirtyBitmap)
1928 fWHvFlags |= WHvMapGpaRangeFlagTrackDirtyPages;
1929 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
1930 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvMmio2, GCPhys, cb, fWHvFlags);
1931 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
1932 if (SUCCEEDED(hrc))
1933 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
1934 else
1935 {
1936 LogRel(("NEMR3NotifyPhysMmioExMapEarly: GCPhys=%RGp LB %RGp fFlags=%#x pvMmio2=%p fWHvFlags=%#x: Map -> hrc=%Rhrc (%#x) Last=%#x/%u\n",
1937 GCPhys, cb, fFlags, pvMmio2, fWHvFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
1938 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
1939 return VERR_NEM_MAP_PAGES_FAILED;
1940 }
1941 }
1942 else
1943 {
1944 Assert(!(fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2));
1945 *pu2State = NEM_WIN_PAGE_STATE_UNMAPPED;
1946 }
1947 RT_NOREF(pvRam);
1948 return VINF_SUCCESS;
1949}
1950
1951
1952VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExMapLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags,
1953 void *pvRam, void *pvMmio2, uint32_t *puNemRange)
1954{
1955 RT_NOREF(pVM, GCPhys, cb, fFlags, pvRam, pvMmio2, puNemRange);
1956 return VINF_SUCCESS;
1957}
1958
1959
1960VMMR3_INT_DECL(int) NEMR3NotifyPhysMmioExUnmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t fFlags, void *pvRam,
1961 void *pvMmio2, uint8_t *pu2State, uint32_t *puNemRange)
1962{
1963 int rc = VINF_SUCCESS;
1964 Log5(("NEMR3NotifyPhysMmioExUnmap: %RGp LB %RGp fFlags=%#x pvRam=%p pvMmio2=%p pu2State=%p uNemRange=%#x (%#x)\n",
1965 GCPhys, cb, fFlags, pvRam, pvMmio2, pu2State, puNemRange, *puNemRange));
1966
1967 /*
1968 * Unmap the MMIO2 pages.
1969 */
1970 /** @todo If we implement aliasing (MMIO2 page aliased into MMIO range),
1971 * we may have more stuff to unmap even in case of pure MMIO... */
1972 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_MMIO2)
1973 {
1974 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfUnmapGpaRange, a);
1975 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, cb);
1976 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfUnmapGpaRange, a);
1977 if (FAILED(hrc))
1978 {
1979 LogRel2(("NEMR3NotifyPhysMmioExUnmap: GCPhys=%RGp LB %RGp fFlags=%#x: Unmap -> hrc=%Rhrc (%#x) Last=%#x/%u (ignored)\n",
1980 GCPhys, cb, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
1981 rc = VERR_NEM_UNMAP_PAGES_FAILED;
1982 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
1983 }
1984 }
1985
1986 /*
1987 * Restore the RAM we replaced.
1988 */
1989 if (fFlags & NEM_NOTIFY_PHYS_MMIO_EX_F_REPLACE)
1990 {
1991 AssertPtr(pvRam);
1992 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
1993 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvRam, GCPhys, cb,
1994 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagWrite | WHvMapGpaRangeFlagExecute);
1995 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
1996 if (SUCCEEDED(hrc))
1997 { /* likely */ }
1998 else
1999 {
2000 LogRel(("NEMR3NotifyPhysMmioExUnmap: GCPhys=%RGp LB %RGp pvMmio2=%p hrc=%Rhrc (%#x) Last=%#x/%u\n",
2001 GCPhys, cb, pvMmio2, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2002 rc = VERR_NEM_MAP_PAGES_FAILED;
2003 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2004 }
2005 if (pu2State)
2006 *pu2State = NEM_WIN_PAGE_STATE_WRITABLE;
2007 }
2008 /* Mark the pages as unmapped if relevant. */
2009 else if (pu2State)
2010 *pu2State = NEM_WIN_PAGE_STATE_UNMAPPED;
2011
2012 RT_NOREF(pvMmio2, puNemRange);
2013 return rc;
2014}
2015
2016
2017VMMR3_INT_DECL(int) NEMR3PhysMmio2QueryAndResetDirtyBitmap(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, uint32_t uNemRange,
2018 void *pvBitmap, size_t cbBitmap)
2019{
2020 Assert(VM_IS_NEM_ENABLED(pVM));
2021 AssertReturn(g_pfnWHvQueryGpaRangeDirtyBitmap, VERR_INTERNAL_ERROR_2);
2022 Assert(cbBitmap == (uint32_t)cbBitmap);
2023 RT_NOREF(uNemRange);
2024
2025 /* This is being profiled by PGM, see /PGM/Mmio2QueryAndResetDirtyBitmap. */
2026 HRESULT hrc = WHvQueryGpaRangeDirtyBitmap(pVM->nem.s.hPartition, GCPhys, cb, (UINT64 *)pvBitmap, (uint32_t)cbBitmap);
2027 if (SUCCEEDED(hrc))
2028 return VINF_SUCCESS;
2029
2030 AssertLogRelMsgFailed(("GCPhys=%RGp LB %RGp pvBitmap=%p LB %#zx hrc=%Rhrc (%#x) Last=%#x/%u\n",
2031 GCPhys, cb, pvBitmap, cbBitmap, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2032 return VERR_NEM_QUERY_DIRTY_BITMAP_FAILED;
2033}
2034
2035
2036VMMR3_INT_DECL(int) NEMR3NotifyPhysRomRegisterEarly(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvPages, uint32_t fFlags,
2037 uint8_t *pu2State, uint32_t *puNemRange)
2038{
2039 Log5(("nemR3NativeNotifyPhysRomRegisterEarly: %RGp LB %RGp pvPages=%p fFlags=%#x\n", GCPhys, cb, pvPages, fFlags));
2040 *pu2State = UINT8_MAX;
2041 *puNemRange = 0;
2042
2043#if 0 /* Let's not do this after all. We'll protection change notifications for each page and if not we'll map them lazily. */
2044 RTGCPHYS const cPages = cb >> X86_PAGE_SHIFT;
2045 for (RTGCPHYS iPage = 0; iPage < cPages; iPage++, GCPhys += X86_PAGE_SIZE)
2046 {
2047 const void *pvPage;
2048 int rc = nemR3NativeGCPhys2R3PtrReadOnly(pVM, GCPhys, &pvPage);
2049 if (RT_SUCCESS(rc))
2050 {
2051 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, (void *)pvPage, GCPhys, X86_PAGE_SIZE,
2052 WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagExecute);
2053 if (SUCCEEDED(hrc))
2054 { /* likely */ }
2055 else
2056 {
2057 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2058 GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2059 return VERR_NEM_INIT_FAILED;
2060 }
2061 }
2062 else
2063 {
2064 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp rc=%Rrc\n", GCPhys, rc));
2065 return rc;
2066 }
2067 }
2068 RT_NOREF_PV(fFlags);
2069#else
2070 RT_NOREF(pVM, GCPhys, cb, pvPages, fFlags);
2071#endif
2072 return VINF_SUCCESS;
2073}
2074
2075
2076VMMR3_INT_DECL(int) NEMR3NotifyPhysRomRegisterLate(PVM pVM, RTGCPHYS GCPhys, RTGCPHYS cb, void *pvPages,
2077 uint32_t fFlags, uint8_t *pu2State, uint32_t *puNemRange)
2078{
2079 Log5(("nemR3NativeNotifyPhysRomRegisterLate: %RGp LB %RGp pvPages=%p fFlags=%#x pu2State=%p (%d) puNemRange=%p (%#x)\n",
2080 GCPhys, cb, pvPages, fFlags, pu2State, *pu2State, puNemRange, *puNemRange));
2081 *pu2State = UINT8_MAX;
2082
2083 /*
2084 * (Re-)map readonly.
2085 */
2086 AssertPtrReturn(pvPages, VERR_INVALID_POINTER);
2087 STAM_REL_PROFILE_START(&pVM->nem.s.StatProfMapGpaRange, a);
2088 HRESULT hrc = WHvMapGpaRange(pVM->nem.s.hPartition, pvPages, GCPhys, cb, WHvMapGpaRangeFlagRead | WHvMapGpaRangeFlagExecute);
2089 STAM_REL_PROFILE_STOP(&pVM->nem.s.StatProfMapGpaRange, a);
2090 if (SUCCEEDED(hrc))
2091 *pu2State = NEM_WIN_PAGE_STATE_READABLE;
2092 else
2093 {
2094 LogRel(("nemR3NativeNotifyPhysRomRegisterEarly: GCPhys=%RGp LB %RGp pvPages=%p fFlags=%#x hrc=%Rhrc (%#x) Last=%#x/%u\n",
2095 GCPhys, cb, pvPages, fFlags, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2096 STAM_REL_COUNTER_INC(&pVM->nem.s.StatMapPageFailed);
2097 return VERR_NEM_MAP_PAGES_FAILED;
2098 }
2099 RT_NOREF(fFlags, puNemRange);
2100 return VINF_SUCCESS;
2101}
2102
2103#ifdef NEM_WIN_WITH_A20
2104
2105/**
2106 * @callback_method_impl{FNPGMPHYSNEMCHECKPAGE}
2107 */
2108static DECLCALLBACK(int) nemR3WinUnsetForA20CheckerCallback(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys,
2109 PPGMPHYSNEMPAGEINFO pInfo, void *pvUser)
2110{
2111 /* We'll just unmap the memory. */
2112 if (pInfo->u2NemState > NEM_WIN_PAGE_STATE_UNMAPPED)
2113 {
2114 HRESULT hrc = WHvUnmapGpaRange(pVM->nem.s.hPartition, GCPhys, X86_PAGE_SIZE);
2115 if (SUCCEEDED(hrc))
2116 {
2117 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPage);
2118 uint32_t cMappedPages = ASMAtomicDecU32(&pVM->nem.s.cMappedPages); NOREF(cMappedPages);
2119 Log5(("NEM GPA unmapped/A20: %RGp (was %s, cMappedPages=%u)\n", GCPhys, g_apszPageStates[pInfo->u2NemState], cMappedPages));
2120 pInfo->u2NemState = NEM_WIN_PAGE_STATE_UNMAPPED;
2121 }
2122 else
2123 {
2124 STAM_REL_COUNTER_INC(&pVM->nem.s.StatUnmapPageFailed);
2125 LogRel(("nemR3WinUnsetForA20CheckerCallback/unmap: GCPhys=%RGp hrc=%Rhrc (%#x) Last=%#x/%u\n",
2126 GCPhys, hrc, hrc, RTNtLastStatusValue(), RTNtLastErrorValue()));
2127 return VERR_INTERNAL_ERROR_2;
2128 }
2129 }
2130 RT_NOREF(pVCpu, pvUser);
2131 return VINF_SUCCESS;
2132}
2133
2134
2135/**
2136 * Unmaps a page from Hyper-V for the purpose of emulating A20 gate behavior.
2137 *
2138 * @returns The PGMPhysNemQueryPageInfo result.
2139 * @param pVM The cross context VM structure.
2140 * @param pVCpu The cross context virtual CPU structure.
2141 * @param GCPhys The page to unmap.
2142 */
2143static int nemR3WinUnmapPageForA20Gate(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2144{
2145 PGMPHYSNEMPAGEINFO Info;
2146 return PGMPhysNemPageInfoChecker(pVM, pVCpu, GCPhys, false /*fMakeWritable*/, &Info,
2147 nemR3WinUnsetForA20CheckerCallback, NULL);
2148}
2149
2150#endif /* NEM_WIN_WITH_A20 */
2151
2152VMMR3_INT_DECL(void) NEMR3NotifySetA20(PVMCPU pVCpu, bool fEnabled)
2153{
2154 Log(("nemR3NativeNotifySetA20: fEnabled=%RTbool\n", fEnabled));
2155 Assert(VM_IS_NEM_ENABLED(pVCpu->CTX_SUFF(pVM)));
2156#ifdef NEM_WIN_WITH_A20
2157 PVM pVM = pVCpu->CTX_SUFF(pVM);
2158 if (!pVM->nem.s.fA20Fixed)
2159 {
2160 pVM->nem.s.fA20Enabled = fEnabled;
2161 for (RTGCPHYS GCPhys = _1M; GCPhys < _1M + _64K; GCPhys += X86_PAGE_SIZE)
2162 nemR3WinUnmapPageForA20Gate(pVM, pVCpu, GCPhys);
2163 }
2164#else
2165 RT_NOREF(pVCpu, fEnabled);
2166#endif
2167}
2168
2169
2170/** @page pg_nem_win NEM/win - Native Execution Manager, Windows.
2171 *
2172 * On Windows the Hyper-V root partition (dom0 in zen terminology) does not have
2173 * nested VT-x or AMD-V capabilities. Early on raw-mode worked inside it, but
2174 * for a while now we've been getting \#GPs when trying to modify CR4 in the
2175 * world switcher. So, when Hyper-V is active on Windows we have little choice
2176 * but to use Hyper-V to run our VMs.
2177 *
2178 *
2179 * @section sub_nem_win_whv The WinHvPlatform API
2180 *
2181 * Since Windows 10 build 17083 there is a documented API for managing Hyper-V
2182 * VMs: header file WinHvPlatform.h and implementation in WinHvPlatform.dll.
2183 * This interface is a wrapper around the undocumented Virtualization
2184 * Infrastructure Driver (VID) API - VID.DLL and VID.SYS. The wrapper is
2185 * written in C++, namespaced, early versions (at least) was using standard C++
2186 * container templates in several places.
2187 *
2188 * When creating a VM using WHvCreatePartition, it will only create the
2189 * WinHvPlatform structures for it, to which you get an abstract pointer. The
2190 * VID API that actually creates the partition is first engaged when you call
2191 * WHvSetupPartition after first setting a lot of properties using
2192 * WHvSetPartitionProperty. Since the VID API is just a very thin wrapper
2193 * around CreateFile and NtDeviceIoControlFile, it returns an actual HANDLE for
2194 * the partition to WinHvPlatform. We fish this HANDLE out of the WinHvPlatform
2195 * partition structures because we need to talk directly to VID for reasons
2196 * we'll get to in a bit. (Btw. we could also intercept the CreateFileW or
2197 * NtDeviceIoControlFile calls from VID.DLL to get the HANDLE should fishing in
2198 * the partition structures become difficult.)
2199 *
2200 * The WinHvPlatform API requires us to both set the number of guest CPUs before
2201 * setting up the partition and call WHvCreateVirtualProcessor for each of them.
2202 * The CPU creation function boils down to a VidMessageSlotMap call that sets up
2203 * and maps a message buffer into ring-3 for async communication with hyper-V
2204 * and/or the VID.SYS thread actually running the CPU thru
2205 * WinHvRunVpDispatchLoop(). When for instance a VMEXIT is encountered, hyper-V
2206 * sends a message that the WHvRunVirtualProcessor API retrieves (and later
2207 * acknowledges) via VidMessageSlotHandleAndGetNext. Since or about build
2208 * 17757 a register page is also mapped into user space when creating the
2209 * virtual CPU. It should be noteded that WHvDeleteVirtualProcessor doesn't do
2210 * much as there seems to be no partner function VidMessagesSlotMap that
2211 * reverses what it did.
2212 *
2213 * Memory is managed thru calls to WHvMapGpaRange and WHvUnmapGpaRange (GPA does
2214 * not mean grade point average here, but rather guest physical addressspace),
2215 * which corresponds to VidCreateVaGpaRangeSpecifyUserVa and VidDestroyGpaRange
2216 * respectively. As 'UserVa' indicates, the functions works on user process
2217 * memory. The mappings are also subject to quota restrictions, so the number
2218 * of ranges are limited and probably their total size as well. Obviously
2219 * VID.SYS keeps track of the ranges, but so does WinHvPlatform, which means
2220 * there is a bit of overhead involved and quota restrctions makes sense.
2221 *
2222 * Running guest code is done through the WHvRunVirtualProcessor function. It
2223 * asynchronously starts or resumes hyper-V CPU execution and then waits for an
2224 * VMEXIT message. Hyper-V / VID.SYS will return information about the message
2225 * in the message buffer mapping, and WHvRunVirtualProcessor will convert that
2226 * finto it's own WHV_RUN_VP_EXIT_CONTEXT format.
2227 *
2228 * Other threads can interrupt the execution by using WHvCancelVirtualProcessor,
2229 * which since or about build 17757 uses VidMessageSlotHandleAndGetNext to do
2230 * the work (earlier builds would open the waiting thread, do a dummy
2231 * QueueUserAPC on it, and let it upon return use VidStopVirtualProcessor to
2232 * do the actual stopping). While there is certainly a race between cancelation
2233 * and the CPU causing a natural VMEXIT, it is not known whether this still
2234 * causes extra work on subsequent WHvRunVirtualProcessor calls (it did in and
2235 * earlier than 17134).
2236 *
2237 * Registers are retrieved and set via WHvGetVirtualProcessorRegisters and
2238 * WHvSetVirtualProcessorRegisters. In addition, several VMEXITs include
2239 * essential register state in the exit context information, potentially making
2240 * it possible to emulate the instruction causing the exit without involving
2241 * WHvGetVirtualProcessorRegisters.
2242 *
2243 *
2244 * @subsection subsec_nem_win_whv_cons Issues & Feedback
2245 *
2246 * Here are some observations (mostly against build 17101):
2247 *
2248 * - The VMEXIT performance is dismal (build 17134).
2249 *
2250 * Our proof of concept implementation with a kernel runloop (i.e. not using
2251 * WHvRunVirtualProcessor and friends, but calling VID.SYS fast I/O control
2252 * entry point directly) delivers 9-10% of the port I/O performance and only
2253 * 6-7% of the MMIO performance that we have with our own hypervisor.
2254 *
2255 * When using the offical WinHvPlatform API, the numbers are %3 for port I/O
2256 * and 5% for MMIO.
2257 *
2258 * While the tests we've done are using tight tight loops only doing port I/O
2259 * and MMIO, the problem is clearly visible when running regular guest OSes.
2260 * Anything that hammers the VGA device would be suffering, for example:
2261 *
2262 * - Windows 2000 boot screen animation overloads us with MMIO exits
2263 * and won't even boot because all the time is spent in interrupt
2264 * handlers and redrawin the screen.
2265 *
2266 * - DSL 4.4 and its bootmenu logo is slower than molasses in january.
2267 *
2268 * We have not found a workaround for this yet.
2269 *
2270 * Something that might improve the issue a little is to detect blocks with
2271 * excessive MMIO and port I/O exits and emulate instructions to cover
2272 * multiple exits before letting Hyper-V have a go at the guest execution
2273 * again. This will only improve the situation under some circumstances,
2274 * since emulating instructions without recompilation can be expensive, so
2275 * there will only be real gains if the exitting instructions are tightly
2276 * packed.
2277 *
2278 * Update: Security fixes during the summer of 2018 caused the performance to
2279 * dropped even more.
2280 *
2281 * Update [build 17757]: Some performance improvements here, but they don't
2282 * yet make up for what was lost this summer.
2283 *
2284 *
2285 * - We need a way to directly modify the TSC offset (or bias if you like).
2286 *
2287 * The current approach of setting the WHvX64RegisterTsc register one by one
2288 * on each virtual CPU in sequence will introduce random inaccuracies,
2289 * especially if the thread doing the job is reschduled at a bad time.
2290 *
2291 *
2292 * - Unable to access WHvX64RegisterMsrMtrrCap (build 17134).
2293 *
2294 *
2295 * - On AMD Ryzen grub/debian 9.0 ends up with a unrecoverable exception
2296 * when IA32_MTRR_PHYSMASK0 is written.
2297 *
2298 *
2299 * - The IA32_APIC_BASE register does not work right:
2300 *
2301 * - Attempts by the guest to clear bit 11 (EN) are ignored, both the
2302 * guest and the VMM reads back the old value.
2303 *
2304 * - Attempts to modify the base address (bits NN:12) seems to be ignored
2305 * in the same way.
2306 *
2307 * - The VMM can modify both the base address as well as the the EN and
2308 * BSP bits, however this is useless if we cannot intercept the WRMSR.
2309 *
2310 * - Attempts by the guest to set the EXTD bit (X2APIC) result in \#GP(0),
2311 * while the VMM ends up with with ERROR_HV_INVALID_PARAMETER. Seems
2312 * there is no way to support X2APIC.
2313 *
2314 *
2315 * - Not sure if this is a thing, but WHvCancelVirtualProcessor seems to cause
2316 * cause a lot more spurious WHvRunVirtualProcessor returns that what we get
2317 * with the replacement code. By spurious returns we mean that the
2318 * subsequent call to WHvRunVirtualProcessor would return immediately.
2319 *
2320 * Update [build 17757]: New cancelation code might have addressed this, but
2321 * haven't had time to test it yet.
2322 *
2323 *
2324 * - There is no API for modifying protection of a page within a GPA range.
2325 *
2326 * From what we can tell, the only way to modify the protection (like readonly
2327 * -> writable, or vice versa) is to first unmap the range and then remap it
2328 * with the new protection.
2329 *
2330 * We are for instance doing this quite a bit in order to track dirty VRAM
2331 * pages. VRAM pages starts out as readonly, when the guest writes to a page
2332 * we take an exit, notes down which page it is, makes it writable and restart
2333 * the instruction. After refreshing the display, we reset all the writable
2334 * pages to readonly again, bulk fashion.
2335 *
2336 * Now to work around this issue, we do page sized GPA ranges. In addition to
2337 * add a lot of tracking overhead to WinHvPlatform and VID.SYS, this also
2338 * causes us to exceed our quota before we've even mapped a default sized
2339 * (128MB) VRAM page-by-page. So, to work around this quota issue we have to
2340 * lazily map pages and actively restrict the number of mappings.
2341 *
2342 * Our best workaround thus far is bypassing WinHvPlatform and VID entirely
2343 * when in comes to guest memory management and instead use the underlying
2344 * hypercalls (HvCallMapGpaPages, HvCallUnmapGpaPages) to do it ourselves.
2345 * (This also maps a whole lot better into our own guest page management
2346 * infrastructure.)
2347 *
2348 * Update [build 17757]: Introduces a KVM like dirty logging API which could
2349 * help tracking dirty VGA pages, while being useless for shadow ROM and
2350 * devices trying catch the guest updating descriptors and such.
2351 *
2352 *
2353 * - Observed problems doing WHvUnmapGpaRange immediately followed by
2354 * WHvMapGpaRange.
2355 *
2356 * As mentioned above, we've been forced to use this sequence when modifying
2357 * page protection. However, when transitioning from readonly to writable,
2358 * we've ended up looping forever with the same write to readonly memory
2359 * VMEXIT. We're wondering if this issue might be related to the lazy mapping
2360 * logic in WinHvPlatform.
2361 *
2362 * Workaround: Insert a WHvRunVirtualProcessor call and make sure to get a GPA
2363 * unmapped exit between the two calls. Not entirely great performance wise
2364 * (or the santity of our code).
2365 *
2366 *
2367 * - Implementing A20 gate behavior is tedious, where as correctly emulating the
2368 * A20M# pin (present on 486 and later) is near impossible for SMP setups
2369 * (e.g. possiblity of two CPUs with different A20 status).
2370 *
2371 * Workaround #1 (obsolete): Only do A20 on CPU 0, restricting the emulation
2372 * to HMA. We unmap all pages related to HMA (0x100000..0x10ffff) when the A20
2373 * state changes, lazily syncing the right pages back when accessed.
2374 *
2375 * Workaround #2 (used): Use IEM when the A20 gate is disabled.
2376 *
2377 *
2378 * - WHVRunVirtualProcessor wastes time converting VID/Hyper-V messages to its
2379 * own format (WHV_RUN_VP_EXIT_CONTEXT).
2380 *
2381 * We understand this might be because Microsoft wishes to remain free to
2382 * modify the VID/Hyper-V messages, but it's still rather silly and does slow
2383 * things down a little. We'd much rather just process the messages directly.
2384 *
2385 *
2386 * - WHVRunVirtualProcessor would've benefited from using a callback interface:
2387 *
2388 * - The potential size changes of the exit context structure wouldn't be
2389 * an issue, since the function could manage that itself.
2390 *
2391 * - State handling could probably be simplified (like cancelation).
2392 *
2393 *
2394 * - WHvGetVirtualProcessorRegisters and WHvSetVirtualProcessorRegisters
2395 * internally converts register names, probably using temporary heap buffers.
2396 *
2397 * From the looks of things, they are converting from WHV_REGISTER_NAME to
2398 * HV_REGISTER_NAME from in the "Virtual Processor Register Names" section in
2399 * the "Hypervisor Top-Level Functional Specification" document. This feels
2400 * like an awful waste of time.
2401 *
2402 * We simply cannot understand why HV_REGISTER_NAME isn't used directly here,
2403 * or at least the same values, making any conversion reduntant. Restricting
2404 * access to certain registers could easily be implement by scanning the
2405 * inputs.
2406 *
2407 * To avoid the heap + conversion overhead, we're currently using the
2408 * HvCallGetVpRegisters and HvCallSetVpRegisters calls directly, at least for
2409 * the ring-0 code.
2410 *
2411 * Update [build 17757]: Register translation has been very cleverly
2412 * optimized and made table driven (2 top level tables, 4 + 1 leaf tables).
2413 * Register information consists of the 32-bit HV register name, register page
2414 * offset, and flags (giving valid offset, size and more). Register
2415 * getting/settings seems to be done by hoping that the register page provides
2416 * it all, and falling back on the VidSetVirtualProcessorState if one or more
2417 * registers are not available there.
2418 *
2419 * Note! We have currently not updated our ring-0 code to take the register
2420 * page into account, so it's suffering a little compared to the ring-3 code
2421 * that now uses the offical APIs for registers.
2422 *
2423 *
2424 * - The YMM and XCR0 registers are not yet named (17083). This probably
2425 * wouldn't be a problem if HV_REGISTER_NAME was used, see previous point.
2426 *
2427 * Update [build 17757]: XCR0 is added. YMM register values seems to be put
2428 * into a yet undocumented XsaveState interface. Approach is a little bulky,
2429 * but saves number of enums and dispenses with register transation. Also,
2430 * the underlying Vid setter API duplicates the input buffer on the heap,
2431 * adding a 16 byte header.
2432 *
2433 *
2434 * - Why does VID.SYS only query/set 32 registers at the time thru the
2435 * HvCallGetVpRegisters and HvCallSetVpRegisters hypercalls?
2436 *
2437 * We've not trouble getting/setting all the registers defined by
2438 * WHV_REGISTER_NAME in one hypercall (around 80). Some kind of stack
2439 * buffering or similar?
2440 *
2441 *
2442 * - To handle the VMMCALL / VMCALL instructions, it seems we need to intercept
2443 * \#UD exceptions and inspect the opcodes. A dedicated exit for hypercalls
2444 * would be more efficient, esp. for guests using \#UD for other purposes..
2445 *
2446 *
2447 * - Wrong instruction length in the VpContext with unmapped GPA memory exit
2448 * contexts on 17115/AMD.
2449 *
2450 * One byte "PUSH CS" was reported as 2 bytes, while a two byte
2451 * "MOV [EBX],EAX" was reported with a 1 byte instruction length. Problem
2452 * naturally present in untranslated hyper-v messages.
2453 *
2454 *
2455 * - The I/O port exit context information seems to be missing the address size
2456 * information needed for correct string I/O emulation.
2457 *
2458 * VT-x provides this information in bits 7:9 in the instruction information
2459 * field on newer CPUs. AMD-V in bits 7:9 in the EXITINFO1 field in the VMCB.
2460 *
2461 * We can probably work around this by scanning the instruction bytes for
2462 * address size prefixes. Haven't investigated it any further yet.
2463 *
2464 *
2465 * - Querying WHvCapabilityCodeExceptionExitBitmap returns zero even when
2466 * intercepts demonstrably works (17134).
2467 *
2468 *
2469 * - Querying HvPartitionPropertyDebugChannelId via HvCallGetPartitionProperty
2470 * (hypercall) hangs the host (17134).
2471 *
2472 * - CommonUtilities::GuidToString needs a 'static' before the hex digit array,
2473 * looks pointless to re-init a stack copy it for each call (novice mistake).
2474 *
2475 *
2476 * Old concerns that have been addressed:
2477 *
2478 * - The WHvCancelVirtualProcessor API schedules a dummy usermode APC callback
2479 * in order to cancel any current or future alertable wait in VID.SYS during
2480 * the VidMessageSlotHandleAndGetNext call.
2481 *
2482 * IIRC this will make the kernel schedule the specified callback thru
2483 * NTDLL!KiUserApcDispatcher by modifying the thread context and quite
2484 * possibly the userland thread stack. When the APC callback returns to
2485 * KiUserApcDispatcher, it will call NtContinue to restore the old thread
2486 * context and resume execution from there. This naturally adds up to some
2487 * CPU cycles, ring transitions aren't for free, especially after Spectre &
2488 * Meltdown mitigations.
2489 *
2490 * Using NtAltertThread call could do the same without the thread context
2491 * modifications and the extra kernel call.
2492 *
2493 * Update: All concerns have addressed in or about build 17757.
2494 *
2495 * The WHvCancelVirtualProcessor API is now implemented using a new
2496 * VidMessageSlotHandleAndGetNext() flag (4). Codepath is slightly longer
2497 * than NtAlertThread, but has the added benefit that spurious wakeups can be
2498 * more easily reduced.
2499 *
2500 *
2501 * - When WHvRunVirtualProcessor returns without a message, or on a terse
2502 * VID message like HLT, it will make a kernel call to get some registers.
2503 * This is potentially inefficient if the caller decides he needs more
2504 * register state.
2505 *
2506 * It would be better to just return what's available and let the caller fetch
2507 * what is missing from his point of view in a single kernel call.
2508 *
2509 * Update: All concerns have been addressed in or about build 17757. Selected
2510 * registers are now available via shared memory and thus HLT should (not
2511 * verified) no longer require a system call to compose the exit context data.
2512 *
2513 *
2514 * - The WHvRunVirtualProcessor implementation does lazy GPA range mappings when
2515 * a unmapped GPA message is received from hyper-V.
2516 *
2517 * Since MMIO is currently realized as unmapped GPA, this will slow down all
2518 * MMIO accesses a tiny little bit as WHvRunVirtualProcessor looks up the
2519 * guest physical address to check if it is a pending lazy mapping.
2520 *
2521 * The lazy mapping feature makes no sense to us. We as API user have all the
2522 * information and can do lazy mapping ourselves if we want/have to (see next
2523 * point).
2524 *
2525 * Update: All concerns have been addressed in or about build 17757.
2526 *
2527 *
2528 * - The WHvGetCapability function has a weird design:
2529 * - The CapabilityCode parameter is pointlessly duplicated in the output
2530 * structure (WHV_CAPABILITY).
2531 *
2532 * - API takes void pointer, but everyone will probably be using
2533 * WHV_CAPABILITY due to WHV_CAPABILITY::CapabilityCode making it
2534 * impractical to use anything else.
2535 *
2536 * - No output size.
2537 *
2538 * - See GetFileAttributesEx, GetFileInformationByHandleEx,
2539 * FindFirstFileEx, and others for typical pattern for generic
2540 * information getters.
2541 *
2542 * Update: All concerns have been addressed in build 17110.
2543 *
2544 *
2545 * - The WHvGetPartitionProperty function uses the same weird design as
2546 * WHvGetCapability, see above.
2547 *
2548 * Update: All concerns have been addressed in build 17110.
2549 *
2550 *
2551 * - The WHvSetPartitionProperty function has a totally weird design too:
2552 * - In contrast to its partner WHvGetPartitionProperty, the property code
2553 * is not a separate input parameter here but part of the input
2554 * structure.
2555 *
2556 * - The input structure is a void pointer rather than a pointer to
2557 * WHV_PARTITION_PROPERTY which everyone probably will be using because
2558 * of the WHV_PARTITION_PROPERTY::PropertyCode field.
2559 *
2560 * - Really, why use PVOID for the input when the function isn't accepting
2561 * minimal sizes. E.g. WHVPartitionPropertyCodeProcessorClFlushSize only
2562 * requires a 9 byte input, but the function insists on 16 bytes (17083).
2563 *
2564 * - See GetFileAttributesEx, SetFileInformationByHandle, FindFirstFileEx,
2565 * and others for typical pattern for generic information setters and
2566 * getters.
2567 *
2568 * Update: All concerns have been addressed in build 17110.
2569 *
2570 *
2571 * @section sec_nem_win_large_pages Large Pages
2572 *
2573 * We've got a standalone memory allocation and access testcase bs3-memalloc-1
2574 * which was run with 48GiB of guest RAM configured on a NUC 11 box running
2575 * Windows 11 GA. In the simplified NEM memory mode no exits should be
2576 * generated while the access tests are running.
2577 *
2578 * The bs3-memalloc-1 results kind of hints at some tiny speed-up if the guest
2579 * RAM is allocated using the MEM_LARGE_PAGES flag, but only in the 3rd access
2580 * check (typical 350 000 MiB/s w/o and around 400 000 MiB/s). The result for
2581 * the 2nd access varies a lot, perhaps hinting at some table optimizations
2582 * going on.
2583 *
2584 * The initial access where the memory is locked/whatever has absolutely horrid
2585 * results regardless of whether large pages are enabled or not. Typically
2586 * bobbing close to 500 MiB/s, non-large pages a little faster.
2587 *
2588 * NEM w/ simplified memory and MEM_LARGE_PAGES:
2589 * @verbatim
2590bs3-memalloc-1: TESTING...
2591bs3-memalloc-1: #0/0x0: 0x0000000000000000 LB 0x000000000009fc00 USABLE (1)
2592bs3-memalloc-1: #1/0x1: 0x000000000009fc00 LB 0x0000000000000400 RESERVED (2)
2593bs3-memalloc-1: #2/0x2: 0x00000000000f0000 LB 0x0000000000010000 RESERVED (2)
2594bs3-memalloc-1: #3/0x3: 0x0000000000100000 LB 0x00000000dfef0000 USABLE (1)
2595bs3-memalloc-1: #4/0x4: 0x00000000dfff0000 LB 0x0000000000010000 ACPI_RECLAIMABLE (3)
2596bs3-memalloc-1: #5/0x5: 0x00000000fec00000 LB 0x0000000000001000 RESERVED (2)
2597bs3-memalloc-1: #6/0x6: 0x00000000fee00000 LB 0x0000000000001000 RESERVED (2)
2598bs3-memalloc-1: #7/0x7: 0x00000000fffc0000 LB 0x0000000000040000 RESERVED (2)
2599bs3-memalloc-1: #8/0x9: 0x0000000100000000 LB 0x0000000b20000000 USABLE (1)
2600bs3-memalloc-1: Found 1 interesting entries covering 0xb20000000 bytes (44 GB).
2601bs3-memalloc-1: From 0x100000000 to 0xc20000000
2602bs3-memalloc-1: INT15h/E820 : PASSED
2603bs3-memalloc-1: Mapping memory above 4GB : PASSED
2604bs3-memalloc-1: Pages : 11 665 408 pages
2605bs3-memalloc-1: MiBs : 45 568 MB
2606bs3-memalloc-1: Alloc elapsed : 90 925 263 996 ns
2607bs3-memalloc-1: Alloc elapsed in ticks : 272 340 387 336 ticks
2608bs3-memalloc-1: Page alloc time : 7 794 ns/page
2609bs3-memalloc-1: Page alloc time in ticks : 23 345 ticks/page
2610bs3-memalloc-1: Alloc thruput : 128 296 pages/s
2611bs3-memalloc-1: Alloc thruput in MiBs : 501 MB/s
2612bs3-memalloc-1: Allocation speed : PASSED
2613bs3-memalloc-1: Access elapsed : 85 074 483 467 ns
2614bs3-memalloc-1: Access elapsed in ticks : 254 816 088 412 ticks
2615bs3-memalloc-1: Page access time : 7 292 ns/page
2616bs3-memalloc-1: Page access time in ticks : 21 843 ticks/page
2617bs3-memalloc-1: Access thruput : 137 119 pages/s
2618bs3-memalloc-1: Access thruput in MiBs : 535 MB/s
2619bs3-memalloc-1: 2nd access : PASSED
2620bs3-memalloc-1: Access elapsed : 112 963 925 ns
2621bs3-memalloc-1: Access elapsed in ticks : 338 284 436 ticks
2622bs3-memalloc-1: Page access time : 9 ns/page
2623bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2624bs3-memalloc-1: Access thruput : 103 266 666 pages/s
2625bs3-memalloc-1: Access thruput in MiBs : 403 385 MB/s
2626bs3-memalloc-1: 3rd access : PASSED
2627bs3-memalloc-1: SUCCESS
2628 * @endverbatim
2629 *
2630 * NEM w/ simplified memory and but no MEM_LARGE_PAGES:
2631 * @verbatim
2632bs3-memalloc-1: From 0x100000000 to 0xc20000000
2633bs3-memalloc-1: Pages : 11 665 408 pages
2634bs3-memalloc-1: MiBs : 45 568 MB
2635bs3-memalloc-1: Alloc elapsed : 90 062 027 900 ns
2636bs3-memalloc-1: Alloc elapsed in ticks : 269 754 826 466 ticks
2637bs3-memalloc-1: Page alloc time : 7 720 ns/page
2638bs3-memalloc-1: Page alloc time in ticks : 23 124 ticks/page
2639bs3-memalloc-1: Alloc thruput : 129 526 pages/s
2640bs3-memalloc-1: Alloc thruput in MiBs : 505 MB/s
2641bs3-memalloc-1: Allocation speed : PASSED
2642bs3-memalloc-1: Access elapsed : 3 596 017 220 ns
2643bs3-memalloc-1: Access elapsed in ticks : 10 770 732 620 ticks
2644bs3-memalloc-1: Page access time : 308 ns/page
2645bs3-memalloc-1: Page access time in ticks : 923 ticks/page
2646bs3-memalloc-1: Access thruput : 3 243 980 pages/s
2647bs3-memalloc-1: Access thruput in MiBs : 12 671 MB/s
2648bs3-memalloc-1: 2nd access : PASSED
2649bs3-memalloc-1: Access elapsed : 133 060 160 ns
2650bs3-memalloc-1: Access elapsed in ticks : 398 459 884 ticks
2651bs3-memalloc-1: Page access time : 11 ns/page
2652bs3-memalloc-1: Page access time in ticks : 34 ticks/page
2653bs3-memalloc-1: Access thruput : 87 670 178 pages/s
2654bs3-memalloc-1: Access thruput in MiBs : 342 461 MB/s
2655bs3-memalloc-1: 3rd access : PASSED
2656 * @endverbatim
2657 *
2658 * Same everything but native VT-x and VBox (stripped output a little):
2659 * @verbatim
2660bs3-memalloc-1: From 0x100000000 to 0xc20000000
2661bs3-memalloc-1: Pages : 11 665 408 pages
2662bs3-memalloc-1: MiBs : 45 568 MB
2663bs3-memalloc-1: Alloc elapsed : 776 111 427 ns
2664bs3-memalloc-1: Alloc elapsed in ticks : 2 323 267 035 ticks
2665bs3-memalloc-1: Page alloc time : 66 ns/page
2666bs3-memalloc-1: Page alloc time in ticks : 199 ticks/page
2667bs3-memalloc-1: Alloc thruput : 15 030 584 pages/s
2668bs3-memalloc-1: Alloc thruput in MiBs : 58 713 MB/s
2669bs3-memalloc-1: Allocation speed : PASSED
2670bs3-memalloc-1: Access elapsed : 112 141 904 ns
2671bs3-memalloc-1: Access elapsed in ticks : 335 751 077 ticks
2672bs3-memalloc-1: Page access time : 9 ns/page
2673bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2674bs3-memalloc-1: Access thruput : 104 023 630 pages/s
2675bs3-memalloc-1: Access thruput in MiBs : 406 342 MB/s
2676bs3-memalloc-1: 2nd access : PASSED
2677bs3-memalloc-1: Access elapsed : 112 023 049 ns
2678bs3-memalloc-1: Access elapsed in ticks : 335 418 343 ticks
2679bs3-memalloc-1: Page access time : 9 ns/page
2680bs3-memalloc-1: Page access time in ticks : 28 ticks/page
2681bs3-memalloc-1: Access thruput : 104 133 998 pages/s
2682bs3-memalloc-1: Access thruput in MiBs : 406 773 MB/s
2683bs3-memalloc-1: 3rd access : PASSED
2684 * @endverbatim
2685 *
2686 * VBox with large pages disabled:
2687 * @verbatim
2688bs3-memalloc-1: From 0x100000000 to 0xc20000000
2689bs3-memalloc-1: Pages : 11 665 408 pages
2690bs3-memalloc-1: MiBs : 45 568 MB
2691bs3-memalloc-1: Alloc elapsed : 50 986 588 028 ns
2692bs3-memalloc-1: Alloc elapsed in ticks : 152 714 862 044 ticks
2693bs3-memalloc-1: Page alloc time : 4 370 ns/page
2694bs3-memalloc-1: Page alloc time in ticks : 13 091 ticks/page
2695bs3-memalloc-1: Alloc thruput : 228 793 pages/s
2696bs3-memalloc-1: Alloc thruput in MiBs : 893 MB/s
2697bs3-memalloc-1: Allocation speed : PASSED
2698bs3-memalloc-1: Access elapsed : 2 849 641 741 ns
2699bs3-memalloc-1: Access elapsed in ticks : 8 535 372 249 ticks
2700bs3-memalloc-1: Page access time : 244 ns/page
2701bs3-memalloc-1: Page access time in ticks : 731 ticks/page
2702bs3-memalloc-1: Access thruput : 4 093 640 pages/s
2703bs3-memalloc-1: Access thruput in MiBs : 15 990 MB/s
2704bs3-memalloc-1: 2nd access : PASSED
2705bs3-memalloc-1: Access elapsed : 2 866 960 770 ns
2706bs3-memalloc-1: Access elapsed in ticks : 8 587 097 799 ticks
2707bs3-memalloc-1: Page access time : 245 ns/page
2708bs3-memalloc-1: Page access time in ticks : 736 ticks/page
2709bs3-memalloc-1: Access thruput : 4 068 910 pages/s
2710bs3-memalloc-1: Access thruput in MiBs : 15 894 MB/s
2711bs3-memalloc-1: 3rd access : PASSED
2712 * @endverbatim
2713 *
2714 * Comparing large pages, therer is an allocation speed difference of two order
2715 * of magnitude. When disabling large pages in VBox the allocation numbers are
2716 * closer, and the is clear from the 2nd and 3rd access tests that VBox doesn't
2717 * spend enough memory on nested page tables as Hyper-V does. The similar 2nd
2718 * and 3rd access numbers the two large page testruns seems to hint strongly at
2719 * Hyper-V eventually getting the large pages in place too, only that it sucks
2720 * hundredfold in the setting up phase.
2721 *
2722 *
2723 *
2724 * @section sec_nem_win_impl Our implementation.
2725 *
2726 * We set out with the goal of wanting to run as much as possible in ring-0,
2727 * reasoning that this would give use the best performance.
2728 *
2729 * This goal was approached gradually, starting out with a pure WinHvPlatform
2730 * implementation, gradually replacing parts: register access, guest memory
2731 * handling, running virtual processors. Then finally moving it all into
2732 * ring-0, while keeping most of it configurable so that we could make
2733 * comparisons (see NEMInternal.h and nemR3NativeRunGC()).
2734 *
2735 *
2736 * @subsection subsect_nem_win_impl_ioctl VID.SYS I/O control calls
2737 *
2738 * To run things in ring-0 we need to talk directly to VID.SYS thru its I/O
2739 * control interface. Looking at changes between like build 17083 and 17101 (if
2740 * memory serves) a set of the VID I/O control numbers shifted a little, which
2741 * means we need to determin them dynamically. We currently do this by hooking
2742 * the NtDeviceIoControlFile API call from VID.DLL and snooping up the
2743 * parameters when making dummy calls to relevant APIs. (We could also
2744 * disassemble the relevant APIs and try fish out the information from that, but
2745 * this is way simpler.)
2746 *
2747 * Issuing I/O control calls from ring-0 is facing a small challenge with
2748 * respect to direct buffering. When using direct buffering the device will
2749 * typically check that the buffer is actually in the user address space range
2750 * and reject kernel addresses. Fortunately, we've got the cross context VM
2751 * structure that is mapped into both kernel and user space, it's also locked
2752 * and safe to access from kernel space. So, we place the I/O control buffers
2753 * in the per-CPU part of it (NEMCPU::uIoCtlBuf) and give the driver the user
2754 * address if direct access buffering or kernel address if not.
2755 *
2756 * The I/O control calls are 'abstracted' in the support driver, see
2757 * SUPR0IoCtlSetupForHandle(), SUPR0IoCtlPerform() and SUPR0IoCtlCleanup().
2758 *
2759 *
2760 * @subsection subsect_nem_win_impl_cpumctx CPUMCTX
2761 *
2762 * Since the CPU state needs to live in Hyper-V when executing, we probably
2763 * should not transfer more than necessary when handling VMEXITs. To help us
2764 * manage this CPUMCTX got a new field CPUMCTX::fExtrn that to indicate which
2765 * part of the state is currently externalized (== in Hyper-V).
2766 *
2767 *
2768 * @subsection sec_nem_win_benchmarks Benchmarks.
2769 *
2770 * @subsubsection subsect_nem_win_benchmarks_bs2t1 17134/2018-06-22: Bootsector2-test1
2771 *
2772 * This is ValidationKit/bootsectors/bootsector2-test1.asm as of 2018-06-22
2773 * (internal r123172) running a the release build of VirtualBox from the same
2774 * source, though with exit optimizations disabled. Host is AMD Threadripper 1950X
2775 * running out an up to date 64-bit Windows 10 build 17134.
2776 *
2777 * The base line column is using the official WinHv API for everything but physical
2778 * memory mapping. The 2nd column is the default NEM/win configuration where we
2779 * put the main execution loop in ring-0, using hypercalls when we can and VID for
2780 * managing execution. The 3rd column is regular VirtualBox using AMD-V directly,
2781 * hyper-V is disabled, main execution loop in ring-0.
2782 *
2783 * @verbatim
2784TESTING... WinHv API Hypercalls + VID VirtualBox AMD-V
2785 32-bit paged protected mode, CPUID : 108 874 ins/sec 113% / 123 602 1198% / 1 305 113
2786 32-bit pae protected mode, CPUID : 106 722 ins/sec 115% / 122 740 1232% / 1 315 201
2787 64-bit long mode, CPUID : 106 798 ins/sec 114% / 122 111 1198% / 1 280 404
2788 16-bit unpaged protected mode, CPUID : 106 835 ins/sec 114% / 121 994 1216% / 1 299 665
2789 32-bit unpaged protected mode, CPUID : 105 257 ins/sec 115% / 121 772 1235% / 1 300 860
2790 real mode, CPUID : 104 507 ins/sec 116% / 121 800 1228% / 1 283 848
2791CPUID EAX=1 : PASSED
2792 32-bit paged protected mode, RDTSC : 99 581 834 ins/sec 100% / 100 323 307 93% / 93 473 299
2793 32-bit pae protected mode, RDTSC : 99 620 585 ins/sec 100% / 99 960 952 84% / 83 968 839
2794 64-bit long mode, RDTSC : 100 540 009 ins/sec 100% / 100 946 372 93% / 93 652 826
2795 16-bit unpaged protected mode, RDTSC : 99 688 473 ins/sec 100% / 100 097 751 76% / 76 281 287
2796 32-bit unpaged protected mode, RDTSC : 98 385 857 ins/sec 102% / 100 510 404 94% / 93 379 536
2797 real mode, RDTSC : 100 087 967 ins/sec 101% / 101 386 138 93% / 93 234 999
2798RDTSC : PASSED
2799 32-bit paged protected mode, Read CR4 : 2 156 102 ins/sec 98% / 2 121 967 17114% / 369 009 009
2800 32-bit pae protected mode, Read CR4 : 2 163 820 ins/sec 98% / 2 133 804 17469% / 377 999 261
2801 64-bit long mode, Read CR4 : 2 164 822 ins/sec 98% / 2 128 698 18875% / 408 619 313
2802 16-bit unpaged protected mode, Read CR4 : 2 162 367 ins/sec 100% / 2 168 508 17132% / 370 477 568
2803 32-bit unpaged protected mode, Read CR4 : 2 163 189 ins/sec 100% / 2 169 808 16768% / 362 734 679
2804 real mode, Read CR4 : 2 162 436 ins/sec 100% / 2 164 914 15551% / 336 288 998
2805Read CR4 : PASSED
2806 real mode, 32-bit IN : 104 649 ins/sec 118% / 123 513 1028% / 1 075 831
2807 real mode, 32-bit OUT : 107 102 ins/sec 115% / 123 660 982% / 1 052 259
2808 real mode, 32-bit IN-to-ring-3 : 105 697 ins/sec 98% / 104 471 201% / 213 216
2809 real mode, 32-bit OUT-to-ring-3 : 105 830 ins/sec 98% / 104 598 198% / 210 495
2810 16-bit unpaged protected mode, 32-bit IN : 104 855 ins/sec 117% / 123 174 1029% / 1 079 591
2811 16-bit unpaged protected mode, 32-bit OUT : 107 529 ins/sec 115% / 124 250 992% / 1 067 053
2812 16-bit unpaged protected mode, 32-bit IN-to-ring-3 : 106 337 ins/sec 103% / 109 565 196% / 209 367
2813 16-bit unpaged protected mode, 32-bit OUT-to-ring-3 : 107 558 ins/sec 100% / 108 237 191% / 206 387
2814 32-bit unpaged protected mode, 32-bit IN : 106 351 ins/sec 116% / 123 584 1016% / 1 081 325
2815 32-bit unpaged protected mode, 32-bit OUT : 106 424 ins/sec 116% / 124 252 995% / 1 059 408
2816 32-bit unpaged protected mode, 32-bit IN-to-ring-3 : 104 035 ins/sec 101% / 105 305 202% / 210 750
2817 32-bit unpaged protected mode, 32-bit OUT-to-ring-3 : 103 831 ins/sec 102% / 106 919 205% / 213 198
2818 32-bit paged protected mode, 32-bit IN : 103 356 ins/sec 119% / 123 870 1041% / 1 076 463
2819 32-bit paged protected mode, 32-bit OUT : 107 177 ins/sec 115% / 124 302 998% / 1 069 655
2820 32-bit paged protected mode, 32-bit IN-to-ring-3 : 104 491 ins/sec 100% / 104 744 200% / 209 264
2821 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 106 603 ins/sec 97% / 103 849 197% / 210 219
2822 32-bit pae protected mode, 32-bit IN : 105 923 ins/sec 115% / 122 759 1041% / 1 103 261
2823 32-bit pae protected mode, 32-bit OUT : 107 083 ins/sec 117% / 126 057 1024% / 1 096 667
2824 32-bit pae protected mode, 32-bit IN-to-ring-3 : 106 114 ins/sec 97% / 103 496 199% / 211 312
2825 32-bit pae protected mode, 32-bit OUT-to-ring-3 : 105 675 ins/sec 96% / 102 096 198% / 209 890
2826 64-bit long mode, 32-bit IN : 105 800 ins/sec 113% / 120 006 1013% / 1 072 116
2827 64-bit long mode, 32-bit OUT : 105 635 ins/sec 113% / 120 375 997% / 1 053 655
2828 64-bit long mode, 32-bit IN-to-ring-3 : 105 274 ins/sec 95% / 100 763 197% / 208 026
2829 64-bit long mode, 32-bit OUT-to-ring-3 : 106 262 ins/sec 94% / 100 749 196% / 209 288
2830NOP I/O Port Access : PASSED
2831 32-bit paged protected mode, 32-bit read : 57 687 ins/sec 119% / 69 136 1197% / 690 548
2832 32-bit paged protected mode, 32-bit write : 57 957 ins/sec 118% / 68 935 1183% / 685 930
2833 32-bit paged protected mode, 32-bit read-to-ring-3 : 57 958 ins/sec 95% / 55 432 276% / 160 505
2834 32-bit paged protected mode, 32-bit write-to-ring-3 : 57 922 ins/sec 100% / 58 340 304% / 176 464
2835 32-bit pae protected mode, 32-bit read : 57 478 ins/sec 119% / 68 453 1141% / 656 159
2836 32-bit pae protected mode, 32-bit write : 57 226 ins/sec 118% / 68 097 1157% / 662 504
2837 32-bit pae protected mode, 32-bit read-to-ring-3 : 57 582 ins/sec 94% / 54 651 268% / 154 867
2838 32-bit pae protected mode, 32-bit write-to-ring-3 : 57 697 ins/sec 100% / 57 750 299% / 173 030
2839 64-bit long mode, 32-bit read : 57 128 ins/sec 118% / 67 779 1071% / 611 949
2840 64-bit long mode, 32-bit write : 57 127 ins/sec 118% / 67 632 1084% / 619 395
2841 64-bit long mode, 32-bit read-to-ring-3 : 57 181 ins/sec 94% / 54 123 265% / 151 937
2842 64-bit long mode, 32-bit write-to-ring-3 : 57 297 ins/sec 99% / 57 286 294% / 168 694
2843 16-bit unpaged protected mode, 32-bit read : 58 827 ins/sec 118% / 69 545 1185% / 697 602
2844 16-bit unpaged protected mode, 32-bit write : 58 678 ins/sec 118% / 69 442 1183% / 694 387
2845 16-bit unpaged protected mode, 32-bit read-to-ring-3 : 57 841 ins/sec 96% / 55 730 275% / 159 163
2846 16-bit unpaged protected mode, 32-bit write-to-ring-3 : 57 855 ins/sec 101% / 58 834 304% / 176 169
2847 32-bit unpaged protected mode, 32-bit read : 58 063 ins/sec 120% / 69 690 1233% / 716 444
2848 32-bit unpaged protected mode, 32-bit write : 57 936 ins/sec 120% / 69 633 1199% / 694 753
2849 32-bit unpaged protected mode, 32-bit read-to-ring-3 : 58 451 ins/sec 96% / 56 183 273% / 159 972
2850 32-bit unpaged protected mode, 32-bit write-to-ring-3 : 58 962 ins/sec 99% / 58 955 298% / 175 936
2851 real mode, 32-bit read : 58 571 ins/sec 118% / 69 478 1160% / 679 917
2852 real mode, 32-bit write : 58 418 ins/sec 118% / 69 320 1185% / 692 513
2853 real mode, 32-bit read-to-ring-3 : 58 072 ins/sec 96% / 55 751 274% / 159 145
2854 real mode, 32-bit write-to-ring-3 : 57 870 ins/sec 101% / 58 755 307% / 178 042
2855NOP MMIO Access : PASSED
2856SUCCESS
2857 * @endverbatim
2858 *
2859 * What we see here is:
2860 *
2861 * - The WinHv API approach is 10 to 12 times slower for exits we can
2862 * handle directly in ring-0 in the VBox AMD-V code.
2863 *
2864 * - The WinHv API approach is 2 to 3 times slower for exits we have to
2865 * go to ring-3 to handle with the VBox AMD-V code.
2866 *
2867 * - By using hypercalls and VID.SYS from ring-0 we gain between
2868 * 13% and 20% over the WinHv API on exits handled in ring-0.
2869 *
2870 * - For exits requiring ring-3 handling are between 6% slower and 3% faster
2871 * than the WinHv API.
2872 *
2873 *
2874 * As a side note, it looks like Hyper-V doesn't let the guest read CR4 but
2875 * triggers exits all the time. This isn't all that important these days since
2876 * OSes like Linux cache the CR4 value specifically to avoid these kinds of exits.
2877 *
2878 *
2879 * @subsubsection subsect_nem_win_benchmarks_bs2t1u1 17134/2018-10-02: Bootsector2-test1
2880 *
2881 * Update on 17134. While expectantly testing a couple of newer builds (17758,
2882 * 17763) hoping for some increases in performance, the numbers turned out
2883 * altogether worse than the June test run. So, we went back to the 1803
2884 * (17134) installation, made sure it was fully up to date (as per 2018-10-02)
2885 * and re-tested.
2886 *
2887 * The numbers had somehow turned significantly worse over the last 3-4 months,
2888 * dropping around 70% for the WinHv API test, more for Hypercalls + VID.
2889 *
2890 * @verbatim
2891TESTING... WinHv API Hypercalls + VID VirtualBox AMD-V *
2892 32-bit paged protected mode, CPUID : 33 270 ins/sec 33 154
2893 real mode, CPUID : 33 534 ins/sec 32 711
2894 [snip]
2895 32-bit paged protected mode, RDTSC : 102 216 011 ins/sec 98 225 419
2896 real mode, RDTSC : 102 492 243 ins/sec 98 225 419
2897 [snip]
2898 32-bit paged protected mode, Read CR4 : 2 096 165 ins/sec 2 123 815
2899 real mode, Read CR4 : 2 081 047 ins/sec 2 075 151
2900 [snip]
2901 32-bit paged protected mode, 32-bit IN : 32 739 ins/sec 33 655
2902 32-bit paged protected mode, 32-bit OUT : 32 702 ins/sec 33 777
2903 32-bit paged protected mode, 32-bit IN-to-ring-3 : 32 579 ins/sec 29 985
2904 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 32 750 ins/sec 29 757
2905 [snip]
2906 32-bit paged protected mode, 32-bit read : 20 042 ins/sec 21 489
2907 32-bit paged protected mode, 32-bit write : 20 036 ins/sec 21 493
2908 32-bit paged protected mode, 32-bit read-to-ring-3 : 19 985 ins/sec 19 143
2909 32-bit paged protected mode, 32-bit write-to-ring-3 : 19 972 ins/sec 19 595
2910
2911 * @endverbatim
2912 *
2913 * Suspects are security updates and/or microcode updates installed since then.
2914 * Given that the RDTSC and CR4 numbers are reasonably unchanges, it seems that
2915 * the Hyper-V core loop (in hvax64.exe) aren't affected. Our ring-0 runloop
2916 * is equally affected as the ring-3 based runloop, so it cannot be ring
2917 * switching as such (unless the ring-0 loop is borked and we didn't notice yet).
2918 *
2919 * The issue is probably in the thread / process switching area, could be
2920 * something special for hyper-V interrupt delivery or worker thread switching.
2921 *
2922 * Really wish this thread ping-pong going on in VID.SYS could be eliminated!
2923 *
2924 *
2925 * @subsubsection subsect_nem_win_benchmarks_bs2t1u2 17763: Bootsector2-test1
2926 *
2927 * Some preliminary numbers for build 17763 on the 3.4 GHz AMD 1950X, the second
2928 * column will improve we get time to have a look the register page.
2929 *
2930 * There is a 50% performance loss here compared to the June numbers with
2931 * build 17134. The RDTSC numbers hits that it isn't in the Hyper-V core
2932 * (hvax64.exe), but something on the NT side.
2933 *
2934 * Clearing bit 20 in nt!KiSpeculationFeatures speeds things up (i.e. changing
2935 * the dword from 0x00300065 to 0x00200065 in windbg). This is checked by
2936 * nt!KePrepareToDispatchVirtualProcessor, making it a no-op if the flag is
2937 * clear. winhvr!WinHvpVpDispatchLoop call that function before making
2938 * hypercall 0xc2, which presumably does the heavy VCpu lifting in hvcax64.exe.
2939 *
2940 * @verbatim
2941TESTING... WinHv API Hypercalls + VID clr(bit-20) + WinHv API
2942 32-bit paged protected mode, CPUID : 54 145 ins/sec 51 436 130 076
2943 real mode, CPUID : 54 178 ins/sec 51 713 130 449
2944 [snip]
2945 32-bit paged protected mode, RDTSC : 98 927 639 ins/sec 100 254 552 100 549 882
2946 real mode, RDTSC : 99 601 206 ins/sec 100 886 699 100 470 957
2947 [snip]
2948 32-bit paged protected mode, 32-bit IN : 54 621 ins/sec 51 524 128 294
2949 32-bit paged protected mode, 32-bit OUT : 54 870 ins/sec 51 671 129 397
2950 32-bit paged protected mode, 32-bit IN-to-ring-3 : 54 624 ins/sec 43 964 127 874
2951 32-bit paged protected mode, 32-bit OUT-to-ring-3 : 54 803 ins/sec 44 087 129 443
2952 [snip]
2953 32-bit paged protected mode, 32-bit read : 28 230 ins/sec 34 042 48 113
2954 32-bit paged protected mode, 32-bit write : 27 962 ins/sec 34 050 48 069
2955 32-bit paged protected mode, 32-bit read-to-ring-3 : 27 841 ins/sec 28 397 48 146
2956 32-bit paged protected mode, 32-bit write-to-ring-3 : 27 896 ins/sec 29 455 47 970
2957 * @endverbatim
2958 *
2959 *
2960 * @subsubsection subsect_nem_win_benchmarks_w2k 17134/2018-06-22: Windows 2000 Boot & Shutdown
2961 *
2962 * Timing the startup and automatic shutdown of a Windows 2000 SP4 guest serves
2963 * as a real world benchmark and example of why exit performance is import. When
2964 * Windows 2000 boots up is doing a lot of VGA redrawing of the boot animation,
2965 * which is very costly. Not having installed guest additions leaves it in a VGA
2966 * mode after the bootup sequence is done, keep up the screen access expenses,
2967 * though the graphics driver more economical than the bootvid code.
2968 *
2969 * The VM was configured to automatically logon. A startup script was installed
2970 * to perform the automatic shuting down and powering off the VM (thru
2971 * vts_shutdown.exe -f -p). An offline snapshot of the VM was taken an restored
2972 * before each test run. The test time run time is calculated from the monotonic
2973 * VBox.log timestamps, starting with the state change to 'RUNNING' and stopping
2974 * at 'POWERING_OFF'.
2975 *
2976 * The host OS and VirtualBox build is the same as for the bootsector2-test1
2977 * scenario.
2978 *
2979 * Results:
2980 *
2981 * - WinHv API for all but physical page mappings:
2982 * 32 min 12.19 seconds
2983 *
2984 * - The default NEM/win configuration where we put the main execution loop
2985 * in ring-0, using hypercalls when we can and VID for managing execution:
2986 * 3 min 23.18 seconds
2987 *
2988 * - Regular VirtualBox using AMD-V directly, hyper-V is disabled, main
2989 * execution loop in ring-0:
2990 * 58.09 seconds
2991 *
2992 * - WinHv API with exit history based optimizations:
2993 * 58.66 seconds
2994 *
2995 * - Hypercall + VID.SYS with exit history base optimizations:
2996 * 58.94 seconds
2997 *
2998 * With a well above average machine needing over half an hour for booting a
2999 * nearly 20 year old guest kind of says it all. The 13%-20% exit performance
3000 * increase we get by using hypercalls and VID.SYS directly pays off a lot here.
3001 * The 3m23s is almost acceptable in comparison to the half an hour.
3002 *
3003 * The similarity between the last three results strongly hits at windows 2000
3004 * doing a lot of waiting during boot and shutdown and isn't the best testcase
3005 * once a basic performance level is reached.
3006 *
3007 *
3008 * @subsubsection subsection_iem_win_benchmarks_deb9_nat Debian 9 NAT performance
3009 *
3010 * This benchmark is about network performance over NAT from a 64-bit Debian 9
3011 * VM with a single CPU. For network performance measurements, we use our own
3012 * NetPerf tool (ValidationKit/utils/network/NetPerf.cpp) to measure latency
3013 * and throughput.
3014 *
3015 * The setups, builds and configurations are as in the previous benchmarks
3016 * (release r123172 on 1950X running 64-bit W10/17134 (2016-06-xx). Please note
3017 * that the exit optimizations hasn't yet been in tuned with NetPerf in mind.
3018 *
3019 * The NAT network setup was selected here since it's the default one and the
3020 * slowest one. There is quite a bit of IPC with worker threads and packet
3021 * processing involved.
3022 *
3023 * Latency test is first up. This is a classic back and forth between the two
3024 * NetPerf instances, where the key measurement is the roundrip latency. The
3025 * values here are the lowest result over 3-6 runs.
3026 *
3027 * Against host system:
3028 * - 152 258 ns/roundtrip - 100% - regular VirtualBox SVM
3029 * - 271 059 ns/roundtrip - 178% - Hypercalls + VID.SYS in ring-0 with exit optimizations.
3030 * - 280 149 ns/roundtrip - 184% - Hypercalls + VID.SYS in ring-0
3031 * - 317 735 ns/roundtrip - 209% - Win HV API with exit optimizations.
3032 * - 342 440 ns/roundtrip - 225% - Win HV API
3033 *
3034 * Against a remote Windows 10 system over a 10Gbps link:
3035 * - 243 969 ns/roundtrip - 100% - regular VirtualBox SVM
3036 * - 384 427 ns/roundtrip - 158% - Win HV API with exit optimizations.
3037 * - 402 411 ns/roundtrip - 165% - Hypercalls + VID.SYS in ring-0
3038 * - 406 313 ns/roundtrip - 167% - Win HV API
3039 * - 413 160 ns/roundtrip - 169% - Hypercalls + VID.SYS in ring-0 with exit optimizations.
3040 *
3041 * What we see here is:
3042 *
3043 * - Consistent and signficant latency increase using Hyper-V compared
3044 * to directly harnessing AMD-V ourselves.
3045 *
3046 * - When talking to the host, it's clear that the hypercalls + VID.SYS
3047 * in ring-0 method pays off.
3048 *
3049 * - When talking to a different host, the numbers are closer and it
3050 * is not longer clear which Hyper-V execution method is better.
3051 *
3052 *
3053 * Throughput benchmarks are performed by one side pushing data full throttle
3054 * for 10 seconds (minus a 1 second at each end of the test), then reversing
3055 * the roles and measuring it in the other direction. The tests ran 3-5 times
3056 * and below are the highest and lowest results in each direction.
3057 *
3058 * Receiving from host system:
3059 * - Regular VirtualBox SVM:
3060 * Max: 96 907 549 bytes/s - 100%
3061 * Min: 86 912 095 bytes/s - 100%
3062 * - Hypercalls + VID.SYS in ring-0:
3063 * Max: 84 036 544 bytes/s - 87%
3064 * Min: 64 978 112 bytes/s - 75%
3065 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3066 * Max: 77 760 699 bytes/s - 80%
3067 * Min: 72 677 171 bytes/s - 84%
3068 * - Win HV API with exit optimizations:
3069 * Max: 64 465 905 bytes/s - 67%
3070 * Min: 62 286 369 bytes/s - 72%
3071 * - Win HV API:
3072 * Max: 62 466 631 bytes/s - 64%
3073 * Min: 61 362 782 bytes/s - 70%
3074 *
3075 * Sending to the host system:
3076 * - Regular VirtualBox SVM:
3077 * Max: 87 728 652 bytes/s - 100%
3078 * Min: 86 923 198 bytes/s - 100%
3079 * - Hypercalls + VID.SYS in ring-0:
3080 * Max: 84 280 749 bytes/s - 96%
3081 * Min: 78 369 842 bytes/s - 90%
3082 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3083 * Max: 84 119 932 bytes/s - 96%
3084 * Min: 77 396 811 bytes/s - 89%
3085 * - Win HV API:
3086 * Max: 81 714 377 bytes/s - 93%
3087 * Min: 78 697 419 bytes/s - 91%
3088 * - Win HV API with exit optimizations:
3089 * Max: 80 502 488 bytes/s - 91%
3090 * Min: 71 164 978 bytes/s - 82%
3091 *
3092 * Receiving from a remote Windows 10 system over a 10Gbps link:
3093 * - Hypercalls + VID.SYS in ring-0:
3094 * Max: 115 346 922 bytes/s - 136%
3095 * Min: 112 912 035 bytes/s - 137%
3096 * - Regular VirtualBox SVM:
3097 * Max: 84 517 504 bytes/s - 100%
3098 * Min: 82 597 049 bytes/s - 100%
3099 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3100 * Max: 77 736 251 bytes/s - 92%
3101 * Min: 73 813 784 bytes/s - 89%
3102 * - Win HV API with exit optimizations:
3103 * Max: 63 035 587 bytes/s - 75%
3104 * Min: 57 538 380 bytes/s - 70%
3105 * - Win HV API:
3106 * Max: 62 279 185 bytes/s - 74%
3107 * Min: 56 813 866 bytes/s - 69%
3108 *
3109 * Sending to a remote Windows 10 system over a 10Gbps link:
3110 * - Win HV API with exit optimizations:
3111 * Max: 116 502 357 bytes/s - 103%
3112 * Min: 49 046 550 bytes/s - 59%
3113 * - Regular VirtualBox SVM:
3114 * Max: 113 030 991 bytes/s - 100%
3115 * Min: 83 059 511 bytes/s - 100%
3116 * - Hypercalls + VID.SYS in ring-0:
3117 * Max: 106 435 031 bytes/s - 94%
3118 * Min: 47 253 510 bytes/s - 57%
3119 * - Hypercalls + VID.SYS in ring-0 with exit optimizations:
3120 * Max: 94 842 287 bytes/s - 84%
3121 * Min: 68 362 172 bytes/s - 82%
3122 * - Win HV API:
3123 * Max: 65 165 225 bytes/s - 58%
3124 * Min: 47 246 573 bytes/s - 57%
3125 *
3126 * What we see here is:
3127 *
3128 * - Again consistent numbers when talking to the host. Showing that the
3129 * ring-0 approach is preferable to the ring-3 one.
3130 *
3131 * - Again when talking to a remote host, things get more difficult to
3132 * make sense of. The spread is larger and direct AMD-V gets beaten by
3133 * a different the Hyper-V approaches in each direction.
3134 *
3135 * - However, if we treat the first entry (remote host) as weird spikes, the
3136 * other entries are consistently worse compared to direct AMD-V. For the
3137 * send case we get really bad results for WinHV.
3138 *
3139 */
3140
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette