#
685dc743 |
|
16-Aug-2023 |
Warner Losh <imp@FreeBSD.org> |
sys: Remove $FreeBSD$: one-line .c pattern Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
|
#
95ee2897 |
|
16-Aug-2023 |
Warner Losh <imp@FreeBSD.org> |
sys: Remove $FreeBSD$: two-line .h pattern Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
|
#
4d846d26 |
|
10-May-2023 |
Warner Losh <imp@FreeBSD.org> |
spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
|
#
7d9ef309 |
|
24-Mar-2023 |
John Baldwin <jhb@FreeBSD.org> |
libvmmapi: Add a struct vcpu and use it in most APIs. This replaces the 'struct vm, int vcpuid' tuple passed to most API calls and is similar to the changes recently made in vmm(4) in the kernel. struct vcpu is an opaque type managed by libvmmapi. For now it stores a pointer to the VM context and an integer id. As an immediate effect this removes the divergence between the kernel and userland for the instruction emulation code introduced by the recent vmm(4) changes. Since this is a major change to the vmmapi API, bump VMMAPI_VERSION to 0x200 (2.0) and the shared library major version. While here (and since the major version is bumped), remove unused vcpu argument from vm_setup_pptdev_msi*(). Add new functions vm_suspend_all_cpus() and vm_resume_all_cpus() for use by the debug server. The underyling ioctl (which uses a vcpuid of -1) remains unchanged, but the userlevel API now uses separate functions for global CPU suspend/resume. Reviewed by: corvink, markj Differential Revision: https://reviews.freebsd.org/D38124
|
#
d3956e46 |
|
18-Nov-2022 |
John Baldwin <jhb@FreeBSD.org> |
vmm: Use struct vcpu in the instruction emulation code. This passes struct vcpu down in place of struct vm and and integer vcpu index through the in-kernel instruction emulation code. To minimize userland disruption, helper macros are used for the vCPU arguments passed into and through the shared instruction emulation code. A few other APIs used by the instruction emulation code have also been updated to accept struct vcpu in the kernel including vm_get/set_register and vm_inject_fault. Reviewed by: corvink, markj Differential Revision: https://reviews.freebsd.org/D37161
|
#
2b4fe856 |
|
18-Nov-2022 |
John Baldwin <jhb@FreeBSD.org> |
bhyve: Remove unused vm and vcpu arguments from vm_copy routines. The arguments identifying the VM and vCPU are only needed for vm_copy_setup. Reviewed by: corvink, markj Differential Revision: https://reviews.freebsd.org/D37158
|
#
ed721684 |
|
23-Oct-2022 |
Mark Johnston <markj@FreeBSD.org> |
bhyve: Address some signed/unsigned comparison warnings MFC after: 1 week
|
#
98d920d9 |
|
08-Oct-2022 |
Mark Johnston <markj@FreeBSD.org> |
bhyve: Annotate unused function parameters MFC after: 1 week
|
#
d4e82073 |
|
10-Apr-2022 |
Robert Wing <rew@FreeBSD.org> |
vmm_instruction_emul.c: fix bhyve build The __diagused macro was used to cure a "set but not used" warning. This broke the build for bhyve since __diagused is only defined in the kernel. Define __diagused when not building the kernel. Fixes: 5241577a223d ("vmm: fix set but not used warning") Reported by: Jenkins
|
#
5241577a |
|
10-Apr-2022 |
Robert Wing <rew@FreeBSD.org> |
vmm: fix set but not used warning
|
#
f3eb12e4 |
|
23-Aug-2020 |
Konstantin Belousov <kib@FreeBSD.org> |
Add bhyve support for LA57 guest mode. Noted and reviewed by: grehan Sponsored by: The FreeBSD Foundation Differential revision: https://reviews.freebsd.org/D25273
|
#
4daa95f8 |
|
24-Jun-2020 |
Conrad Meyer <cem@FreeBSD.org> |
bhyve(8): For prototyping, reattempt decode in userspace If userspace has a newer bhyve than the kernel, it may be able to decode and emulate some instructions vmm.ko is unaware of. In this scenario, reset decoder state and try again. Reviewed by: grehan Differential Revision: https://reviews.freebsd.org/D24464
|
#
47332982 |
|
21-Apr-2020 |
Conrad Meyer <cem@FreeBSD.org> |
vmm(4): Decode and emulate BEXTR Clang 10 -march=native kernels on znver1 emit BEXTR for APIC reads, apparently. Decode and emulate the instruction. Reviewed by: grehan Differential Revision: https://reviews.freebsd.org/D24463
|
#
cfdea69d |
|
21-Apr-2020 |
Conrad Meyer <cem@FreeBSD.org> |
vmm(4): Decode 3-byte VEX-prefixed instructions Reviewed by: grehan Differential Revision: https://reviews.freebsd.org/D24462
|
#
b645fd45 |
|
16-Apr-2020 |
Conrad Meyer <cem@FreeBSD.org> |
vmm(4): Expose instruction decode to userspace build Permit instruction decoding logic to be compiled outside of the kernel for rapid iteration and validation. Reviewed by: grehan Differential Revision: https://reviews.freebsd.org/D24439
|
#
e4da41f9 |
|
26-Jun-2019 |
Rodney W. Grimes <rgrimes@FreeBSD.org> |
Emulate the "TEST r/m{16,32,64}, imm{16,32,32}" instructions (opcode F7H). This adds emulation for: test r/m16, imm16 test r/m32, imm32 test r/m64, imm32 sign-extended to 64 OpenBSD guests compiled with clang 8.0.0 use TEST directly against a Local APIC register instead of separate read via MOV followed by a TEST against the register. PR: 238794 Submitted by: jhb Reported by: Jason Tubnor jason@tubnor.net Tested by: Jason Tubnor jason@tubnor.net Reviewed by: markj, Patrick Mooney patrick.mooney@joyent.com MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D20755
|
#
c2b4cedd |
|
03-May-2019 |
John Baldwin <jhb@FreeBSD.org> |
Emulate the "ADD reg, r/m" instruction (opcode 03H). OVMF's flash variable storage is using add instructions when indexing the variable store bootrom location. Submitted by: D Scott Phillips <d.scott.phillips@intel.com> Reviewed by: rgrimes MFC after: 1 week Sponsored by: Intel Corporation Differential Revision: https://reviews.freebsd.org/D19975
|
#
78a36527 |
|
12-Oct-2018 |
Konstantin Belousov <kib@FreeBSD.org> |
bhyve: emulate CLFLUSH and CLFLUSHOPT. Apparently CLFLUSH on mmio can cause VM exit, as reported in the PR. I do not see that anything useful can be done except emulating page faults on invalid addresses. Due to the instruction encoding pecularity, also emulate SFENCE. PR: 232081 Reported by: phk Reviewed by: araujo, avg, jhb (all: previous version) Sponsored by: The FreeBSD Foundation Approved by: re (gjb) MFC after: 1 week Differential revision: https://reviews.freebsd.org/D17482
|
#
5f8754c0 |
|
26-Feb-2018 |
John Baldwin <jhb@FreeBSD.org> |
Add a new variant of the GLA2GPA ioctl for use by the debug server. Unlike the existing GLA2GPA ioctl, GLA2GPA_NOFAULT does not modify the guest. In particular, it does not inject any faults or modify PTEs in the guest when performing an address space translation. This is used by bhyve's debug server to read and write memory for the remote debugger. Reviewed by: grehan MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D14075
|
#
c49761dd |
|
27-Nov-2017 |
Pedro F. Giffuni <pfg@FreeBSD.org> |
sys/amd64: further adoption of SPDX licensing ID tags. Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts.
|
#
9d210a4a |
|
31-Oct-2017 |
Peter Grehan <grehan@FreeBSD.org> |
Emulate the "OR reg, r/m" instruction (opcode 0BH). This is needed for the HDA emulation with FreeBSD guests. Reviewed by: marcelo MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D12832
|
#
500eb14a |
|
03-May-2016 |
Pedro F. Giffuni <pfg@FreeBSD.org> |
vmm(4): Small spelling fixes. Reviewed by: grehan
|
#
ea587cd8 |
|
26-Jun-2015 |
Tycho Nightingale <tychon@FreeBSD.org> |
verify_gla() needs to account for non-zero segment base addresses. Reviewed by: neel
|
#
9b1aa8d6 |
|
18-Jun-2015 |
Neel Natu <neel@FreeBSD.org> |
Restructure memory allocation in bhyve to support "devmem". devmem is used to represent MMIO devices like the boot ROM or a VESA framebuffer where doing a trap-and-emulate for every access is impractical. devmem is a hybrid of system memory (sysmem) and emulated device models. devmem is mapped in the guest address space via nested page tables similar to sysmem. However the address range where devmem is mapped may be changed by the guest at runtime (e.g. by reprogramming a PCI BAR). Also devmem is usually mapped RO or RW as compared to RWX mappings for sysmem. Each devmem segment is named (e.g. "bootrom") and this name is used to create a device node for the devmem segment (e.g. /dev/vmm/testvm.bootrom). The device node supports mmap(2) and this decouples the host mapping of devmem from its mapping in the guest address space (which can change). Reviewed by: tychon Discussed with: grehan Differential Revision: https://reviews.freebsd.org/D2762 MFC after: 4 weeks
|
#
647c8782 |
|
05-Jun-2015 |
Neel Natu <neel@FreeBSD.org> |
The 'verify_gla()' function is used to ensure that the effective address after decoding the instruction matches the one provided by hardware. Prior to r283293 'vie->num_valid' used to contain the actual length of the instruction whereas now it contains the maximum instruction length possible. This introduced a bug when calculating a RIP-relative base address. Fix this by using 'vie->num_processed' rather than 'vie->num_valid' as the length of the emulated instruction. Reported and tested by: tychon MFC after: 1 week
|
#
f149ce54 |
|
22-May-2015 |
Neel Natu <neel@FreeBSD.org> |
Remove the verification of instruction length after instruction decode. The check has been bogus since r273375. MFC after: 1 week
|
#
b32d1908 |
|
21-May-2015 |
Neel Natu <neel@FreeBSD.org> |
Emulate the "CMP r/m, reg" instruction (opcode 39H). Reported and tested by: Leon Dang (ldang@nahannisys.com) MFC after: 1 week
|
#
9c4d5478 |
|
06-May-2015 |
Neel Natu <neel@FreeBSD.org> |
Deprecate the 3-way return values from vm_gla2gpa() and vm_copy_setup(). Prior to this change both functions returned 0 for success, -1 for failure and +1 to indicate that an exception was injected into the guest. The numerical value of ERESTART also happens to be -1 so when these functions returned -1 it had to be translated to a positive errno value to prevent the VM_RUN ioctl from being inadvertently restarted. This made it easy to introduce bugs when writing emulation code. Fix this by adding an 'int *guest_fault' parameter and setting it to '1' if an exception was delivered to the guest. The return value is 0 or EFAULT so no additional translation is needed. Reviewed by: tychon MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D2428
|
#
6a273d5e |
|
03-May-2015 |
Neel Natu <neel@FreeBSD.org> |
Emulate the 'CMP r/m8, imm8' instruction encountered when booting a Windows Vista guest. Reported by: Leon Dang (ldang@nahannisys.com) MFC after: 1 week
|
#
b8070ef5 |
|
28-Apr-2015 |
Neel Natu <neel@FreeBSD.org> |
Emulate the 'bit test' instruction. Windows 7 uses 'bit test' to check the 'Delivery Status' bit in APIC ICR register. Reported by: Leon Dang (ldang@nahannisys.com) MFC after: 2 weeks
|
#
57f7026c |
|
25-Apr-2015 |
Tycho Nightingale <tychon@FreeBSD.org> |
STOS/STOSB/STOSW/STOSD/STOSQ instruction emulation. Reviewed by: neel
|
#
fb5e95b4 |
|
05-Apr-2015 |
Tycho Nightingale <tychon@FreeBSD.org> |
Enhance the support for Group 1 Extended opcodes: * Implemement the 0x81 and 0x83 CMP instructions. * Implemement the 0x83 AND instruction. * Implemement the 0x81 OR instruction. Reviewed by: neel
|
#
ef7c2a82 |
|
31-Mar-2015 |
Tycho Nightingale <tychon@FreeBSD.org> |
Fix "MOVS" instruction memory to MMIO emulation. Currently updates to %rdi, %rsi, etc are inadvertently bypassed along with the check to see if the instruction needs to be repeated per the 'rep' prefix. Add "MOVS" instruction support for the 'MMIO to MMIO' case. Reviewed by: neel
|
#
e4f605ee |
|
24-Mar-2015 |
Tycho Nightingale <tychon@FreeBSD.org> |
When fetching an instruction in non-64bit mode, consider the value of the code segment base address. Also if an instruction doesn't support a mod R/M (modRM) byte, don't be concerned if the CPU is in real mode. Reviewed by: neel
|
#
75346353 |
|
18-Jan-2015 |
Neel Natu <neel@FreeBSD.org> |
MOVS instruction emulation. These instructions are emitted by 'bus_space_read_region()' when accessing MMIO regions. Since MOVS can be used with a repeat prefix start decoding the REPZ and REPNZ prefixes. Also start decoding the segment override prefix since MOVS allows overriding the source operand segment register. Tested by: tychon MFC after: 1 week
|
#
d63e02ea |
|
14-Oct-2014 |
Neel Natu <neel@FreeBSD.org> |
Emulate "POP r/m". This is needed to boot OpenBSD/i386 MP kernel in bhyve. Reported by: grehan MFC after: 1 week
|
#
c2a875f9 |
|
13-Sep-2014 |
Neel Natu <neel@FreeBSD.org> |
AMD processors that have the SVM decode assist capability will store the instruction bytes in the VMCB on a nested page fault. This is useful because it saves having to walk the guest page tables to fetch the instruction. vie_init() now takes two additional parameters 'inst_bytes' and 'inst_len' that map directly to 'vie->inst[]' and 'vie->num_valid'. The instruction emulation handler skips calling 'vmm_fetch_instruction()' if 'vie->num_valid' is non-zero. The use of this capability can be turned off by setting the sysctl/tunable 'hw.vmm.svm.disable_npf_assist' to '1'. Reviewed by: Anish Gupta (akgupt3@gmail.com) Discussed with: grehan
|
#
4c98655e |
|
30-Aug-2014 |
Neel Natu <neel@FreeBSD.org> |
The "SUB" instruction used in getcc() actually does 'x -= y' so use the proper constraint for 'x'. The "+r" constraint indicates that 'x' is an input and output register operand. While here generate code for different variants of getcc() using a macro GETCC(sz) where 'sz' indicates the operand size. Update the status bits in %rflags when emulating AND and OR opcodes. Reviewed by: grehan
|
#
fc3dde90 |
|
26-Aug-2014 |
Peter Grehan <grehan@FreeBSD.org> |
Implement the 0x2B SUB instruction, and the OR variant of 0x81. Found with local APIC accesses from bitrig/amd64 bsd.rd, 07/15-snap. Reviewed by: neel MFC after: 3 days
|
#
12a6eb99 |
|
07-Aug-2014 |
Neel Natu <neel@FreeBSD.org> |
Support PCI extended config space in bhyve. Add the ACPI MCFG table to advertise the extended config memory window. Introduce a new flag MEM_F_IMMUTABLE for memory ranges that cannot be deleted or moved in the guest's address space. The PCI extended config space is an example of an immutable memory range. Add emulation for the "movzw" instruction. This instruction is used by FreeBSD to read a 16-bit extended config space register. CR: https://phabric.freebsd.org/D505 Reviewed by: jhb, grehan Requested by: tychon
|
#
1edccd0f |
|
25-Jul-2014 |
Neel Natu <neel@FreeBSD.org> |
Don't return -1 from the push emulation handler. Negative return values are interpreted specially on return from sys_ioctl() and may cause undesirable side-effects like restarting the system call.
|
#
830be8ac |
|
24-Jul-2014 |
Neel Natu <neel@FreeBSD.org> |
Fix a couple of issues in the PUSH emulation: It is not possible to PUSH a 32-bit operand on the stack in 64-bit mode. The default operand size for PUSH is 64-bits and the operand size override prefix changes that to 16-bits. vm_copy_setup() can return '1' if it encounters a fault when walking the guest page tables. This is a guest issue and is now handled properly by resuming the guest to handle the fault.
|
#
d665d229 |
|
22-Jul-2014 |
Neel Natu <neel@FreeBSD.org> |
Emulate instructions emitted by OpenBSD/i386 version 5.5: - CMP REG, r/m - MOV AX/EAX/RAX, moffset - MOV moffset, AX/EAX/RAX - PUSH r/m
|
#
f7a9f178 |
|
15-Jul-2014 |
Neel Natu <neel@FreeBSD.org> |
Add support for operand size and address size override prefixes in bhyve's instruction emulation [1]. Fix bug in emulation of opcode 0x8A where the destination is a legacy high byte register and the guest vcpu is in 32-bit mode. Prior to this change instead of modifying %ah, %bh, %ch or %dh the emulation would end up modifying %spl, %bpl, %sil or %dil instead. Add support for moffsets by treating it as a 2, 4 or 8 byte immediate value during instruction decoding. Fix bug in verify_gla() where the linear address computed after decoding the instruction was not being truncated to the effective address size [2]. Tested by: Leon Dang [1] Reported by: Peter Grehan [2] Sponsored by: Nahanni Systems
|
#
3ada6e07 |
|
10-Jul-2014 |
Neel Natu <neel@FreeBSD.org> |
Use the correct offset when converting a logical address (segment:offset) to a linear address.
|
#
896d1f77 |
|
26-Jun-2014 |
Tycho Nightingale <tychon@FreeBSD.org> |
Add support for emulating the move instruction: "mov r/m8, imm8". Reviewed by: neel
|
#
65ffa035 |
|
26-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Add segment protection and limits violation checks in vie_calculate_gla() for 32-bit x86 guests. Tested using ins/outs executed in a FreeBSD/i386 guest.
|
#
5382c19d |
|
24-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Do the linear address calculation for the ins/outs emulation using a new API function 'vie_calculate_gla()'. While the current implementation is simplistic it forms the basis of doing segmentation checks if the guest is in 32-bit protected mode.
|
#
e813a873 |
|
24-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Consolidate all the information needed by the guest page table walker into 'struct vm_guest_paging'. Check for canonical addressing in vmm_gla2gpa() and inject a protection fault into the guest if a violation is detected. If the page table walk is restarted in vmm_gla2gpa() then reset 'ptpphys' to point to the root of the page tables.
|
#
37a723a5 |
|
24-May-2014 |
Neel Natu <neel@FreeBSD.org> |
When injecting a page fault into the guest also update the guest's %cr2 to indicate the faulting linear address. If the guest PML4 entry has the PG_PS bit set then inject a page fault into the guest with the PGEX_RSV bit set in the error_code. Get rid of redundant checks for the PG_RW violations when walking the page tables.
|
#
a7424861 |
|
23-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Check for alignment check violation when processing in/out string instructions.
|
#
d17b5104 |
|
22-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Add emulation of the "outsb" instruction. NetBSD guests use this to write to the UART FIFO. The emulation is constrained in a number of ways: 64-bit only, doesn't check for all exception conditions, limited to i/o ports emulated in userspace. Some of these constraints will be relaxed in followup commits. Requested by: grehan Reviewed by: tychon (partially and a much earlier version)
|
#
fd949af6 |
|
21-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Inject page fault into the guest if the page table walker detects an invalid translation for the guest linear address.
|
#
f888763d |
|
20-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Add PG_RW check when translating a guest linear to guest physical address. Set the accessed and dirty bits in the page table entry. If it fails then restart the page table walk from the beginning. This might happen if another vcpu modifies the page tables simultaneously. Reviewed by: alc, kib
|
#
e4c8a13d |
|
18-May-2014 |
Neel Natu <neel@FreeBSD.org> |
Add PG_U (user/supervisor) checks when translating a guest linear address to a guest physical address. PG_PS (page size) field is valid only in a PDE or a PDPTE so it is now checked only in non-terminal paging entries. Ignore the upper 32-bits of the CR3 for PAE paging.
|
#
13545712 |
|
15-Apr-2014 |
Tycho Nightingale <tychon@FreeBSD.org> |
Add support for emulating the byte move and sign extend instructions: "movsx r/m8, r32" and "movsx r/m8, r64". Approved by: grehan (co-mentor)
|
#
00f3efe1 |
|
04-Feb-2014 |
John Baldwin <jhb@FreeBSD.org> |
Add support for FreeBSD/i386 guests under bhyve. - Similar to the hack for bootinfo32.c in userboot, define _MACHINE_ELF_WANT_32BIT in the load_elf32 file handlers in userboot. This allows userboot to load 32-bit kernels and modules. - Copy the SMAP generation code out of bootinfo64.c and into its own file so it can be shared with bootinfo32.c to pass an SMAP to the i386 kernel. - Use uint32_t instead of u_long when aligning module metadata in bootinfo32.c in userboot, as otherwise the metadata used 64-bit alignment which corrupted the layout. - Populate the basemem and extmem members of the bootinfo struct passed to 32-bit kernels. - Fix the 32-bit stack in userboot to start at the top of the stack instead of the bottom so that there is room to grow before the kernel switches to its own stack. - Push a fake return address onto the 32-bit stack in addition to the arguments normally passed to exec() in the loader. This return address is needed to convince recover_bootinfo() in the 32-bit locore code that it is being invoked from a "new" boot block. - Add a routine to libvmmapi to setup a 32-bit flat mode register state including a GDT and TSS that is able to start the i386 kernel and update bhyveload to use it when booting an i386 kernel. - Use the guest register state to determine the CPU's current instruction mode (32-bit vs 64-bit) and paging mode (flat, 32-bit, PAE, or long mode) in the instruction emulation code. Update the gla2gpa() routine used when fetching instructions to handle flat mode, 32-bit paging, and PAE paging in addition to long mode paging. Don't look for a REX prefix when the CPU is in 32-bit mode, and use the detected mode to enable the existing 32-bit mode code when decoding the mod r/m byte. Reviewed by: grehan, neel MFC after: 1 month
|
#
54e03e07 |
|
04-Feb-2014 |
Tycho Nightingale <tychon@FreeBSD.org> |
Add support for emulating the byte move and zero extend instructions: "mov r/m8, r32" and "mov r/m8, r64". Approved by: neel (co-mentor)
|
#
e9ed7bc4 |
|
03-Feb-2014 |
Peter Grehan <grehan@FreeBSD.org> |
Roll back botched partial MFC :(
|
#
a0b78f09 |
|
18-Dec-2013 |
Peter Grehan <grehan@FreeBSD.org> |
Enable memory overcommit for AMD processors. - No emulation of A/D bits is required since AMD-V RVI supports A/D bits. - Enable pmap PT_RVI support(w/o PAT) which is required for memory over-commit support. - Other minor fixes: * Make use of VMCB EXITINTINFO field. If a #VMEXIT happens while delivering an interrupt, EXITINTINFO has all the details that bhyve needs to inject the same interrupt. * SVM h/w decode assist code was incomplete - removed for now. * Some minor code clean-up (more coming). Submitted by: Anish Gupta (akgupt3@gmail.com)
|
#
e2f5d9a1 |
|
28-Oct-2013 |
Neel Natu <neel@FreeBSD.org> |
Remove unnecessary includes of <machine/pmap.h> Requested by: alc@
|
#
318224bb |
|
05-Oct-2013 |
Neel Natu <neel@FreeBSD.org> |
Merge projects/bhyve_npt_pmap into head. Make the amd64/pmap code aware of nested page table mappings used by bhyve guests. This allows bhyve to associate each guest with its own vmspace and deal with nested page faults in the context of that vmspace. This also enables features like accessed/dirty bit tracking, swapping to disk and transparent superpage promotions of guest memory. Guest vmspace: Each bhyve guest has a unique vmspace to represent the physical memory allocated to the guest. Each memory segment allocated by the guest is mapped into the guest's address space via the 'vmspace->vm_map' and is backed by an object of type OBJT_DEFAULT. pmap types: The amd64/pmap now understands two types of pmaps: PT_X86 and PT_EPT. The PT_X86 pmap type is used by the vmspace associated with the host kernel as well as user processes executing on the host. The PT_EPT pmap is used by the vmspace associated with a bhyve guest. Page Table Entries: The EPT page table entries as mostly similar in functionality to regular page table entries although there are some differences in terms of what bits are used to express that functionality. For e.g. the dirty bit is represented by bit 9 in the nested PTE as opposed to bit 6 in the regular x86 PTE. Therefore the bitmask representing the dirty bit is now computed at runtime based on the type of the pmap. Thus PG_M that was previously a macro now becomes a local variable that is initialized at runtime using 'pmap_modified_bit(pmap)'. An additional wrinkle associated with EPT mappings is that older Intel processors don't have hardware support for tracking accessed/dirty bits in the PTE. This means that the amd64/pmap code needs to emulate these bits to provide proper accounting to the VM subsystem. This is achieved by using the following mapping for EPT entries that need emulation of A/D bits: Bit Position Interpreted By PG_V 52 software (accessed bit emulation handler) PG_RW 53 software (dirty bit emulation handler) PG_A 0 hardware (aka EPT_PG_RD) PG_M 1 hardware (aka EPT_PG_WR) The idea to use the mapping listed above for A/D bit emulation came from Alan Cox (alc@). The final difference with respect to x86 PTEs is that some EPT implementations do not support superpage mappings. This is recorded in the 'pm_flags' field of the pmap. TLB invalidation: The amd64/pmap code has a number of ways to do invalidation of mappings that may be cached in the TLB: single page, multiple pages in a range or the entire TLB. All of these funnel into a single EPT invalidation routine called 'pmap_invalidate_ept()'. This routine bumps up the EPT generation number and sends an IPI to the host cpus that are executing the guest's vcpus. On a subsequent entry into the guest it will detect that the EPT has changed and invalidate the mappings from the TLB. Guest memory access: Since the guest memory is no longer wired we need to hold the host physical page that backs the guest physical page before we can access it. The helper functions 'vm_gpa_hold()/vm_gpa_release()' are available for this purpose. PCI passthru: Guest's with PCI passthru devices will wire the entire guest physical address space. The MMIO BAR associated with the passthru device is backed by a vm_object of type OBJT_SG. An IOMMU domain is created only for guest's that have one or more PCI passthru devices attached to them. Limitations: There isn't a way to map a guest physical page without execute permissions. This is because the amd64/pmap code interprets the guest physical mappings as user mappings since they are numerically below VM_MAXUSER_ADDRESS. Since PG_U shares the same bit position as EPT_PG_EXECUTE all guest mappings become automatically executable. Thanks to Alan Cox and Konstantin Belousov for their rigorous code reviews as well as their support and encouragement. Thanks for John Baldwin for reviewing the use of OBJT_SG as the backing object for pci passthru mmio regions. Special thanks to Peter Holm for testing the patch on short notice. Approved by: re Discussed with: grehan Reviewed by: alc, kib Tested by: pho
|
#
0f9d5dc7 |
|
17-Sep-2013 |
Neel Natu <neel@FreeBSD.org> |
Fix a bug in decoding an instruction that has an SIB byte as well as an immediate operand. The presence of an SIB byte in decoding the ModR/M field would cause 'imm_bytes' to not be set to the correct value. Fix this by initializing 'imm_bytes' independent of the ModR/M decoding. Reported by: grehan@ Approved by: re@
|
#
6f6ebf3c |
|
27-Aug-2013 |
Neel Natu <neel@FreeBSD.org> |
Add support for emulating the byte move instruction "mov r/m8, r8". This emulation is required when dumping MMIO space via the ddb "examine" command.
|
#
df5e6de3 |
|
22-Aug-2013 |
Peter Grehan <grehan@FreeBSD.org> |
Add in last remaining files to get AMD-SVM operational. Submitted by: Anish Gupta (akgupt3@gmail.com)
|
#
84e169c6 |
|
23-Jul-2013 |
Neel Natu <neel@FreeBSD.org> |
Add support for emulation of the "or r/m, imm8" instruction. Submitted by: Zhixiang Yu (zxyu.core@gmail.com) Obtained from: GSoC 2013 (AHCI device emulation for bhyve)
|
#
de16308c |
|
03-Jul-2013 |
Neel Natu <neel@FreeBSD.org> |
Verify that all bytes in the instruction buffer are consumed during decoding. Suggested by: grehan
|
#
f5efbffe |
|
01-May-2013 |
Ed Maste <emaste@FreeBSD.org> |
Switch to standard copyright license text The initial version of this came from Sandvine but had "PROVIDED BY NETAPP, INC" in the copyright text, presuambly because the license block was copied from another file. Replace it with standard "AUTHOR AND CONTRIBUTORS" form. Approvided by: grehan@
|
#
d3c11f40 |
|
24-Apr-2013 |
Peter Grehan <grehan@FreeBSD.org> |
Add RIP-relative addressing to the instruction decoder. Rework the guest register fetch code to allow the RIP to be extracted from the VMCS while the kernel decoder is functioning. Hit by the OpenBSD local-apic code. Submitted by: neel Reviewed by: grehan Obtained from: NetApp
|
#
66f71b7d |
|
28-Mar-2013 |
Neel Natu <neel@FreeBSD.org> |
Allow caller to skip 'guest linear address' validation when doing instruction decode. This is to accomodate hardware assist implementations that do not provide the 'guest linear address' as part of nested page fault collateral. Submitted by: Anish Gupta (akgupt3 at gmail dot com)
|
#
8faceb32 |
|
29-Jan-2013 |
Neel Natu <neel@FreeBSD.org> |
Add emulation support for instruction "88/r: mov r/m8, r8". This instruction moves a byte from a register to a memory location. Tested by: tycho nightingale at pluribusnetworks com
|
#
e6f1f347 |
|
29-Nov-2012 |
Peter Grehan <grehan@FreeBSD.org> |
Properly screen for the AND 0x81 instruction from the set of group1 0x81 instructions that use the reg bits as an extended opcode. Still todo: properly update rflags. Pointed out by: jilles@
|
#
b1f95796 |
|
29-Nov-2012 |
Peter Grehan <grehan@FreeBSD.org> |
Remove debug printf. Pointed out by: emaste
|
#
3b2b0011 |
|
28-Nov-2012 |
Peter Grehan <grehan@FreeBSD.org> |
Add support for the 0x81 AND instruction, now generated by clang in the local APIC code. 0x81 is a read-modify-write instruction - the EPT check that only allowed read or write and not both has been relaxed to allow read and write. Reviewed by: neel Obtained from: NetApp
|
#
ba9b7bf7 |
|
27-Nov-2012 |
Neel Natu <neel@FreeBSD.org> |
Revamp the x86 instruction emulation in bhyve. On a nested page table fault the hypervisor will: - fetch the instruction using the guest %rip and %cr3 - decode the instruction in 'struct vie' - emulate the instruction in host kernel context for local apic accesses - any other type of mmio access is punted up to user-space (e.g. ioapic) The decoded instruction is passed as collateral to the user-space process that is handling the PAGING exit. The emulation code is fleshed out to include more addressing modes (e.g. SIB) and more types of operands (e.g. imm8). The source code is unified into a single file (vmm_instruction_emul.c) that is compiled into vmm.ko as well as /usr/sbin/bhyve. Reviewed by: grehan Obtained from: NetApp
|
#
4db4fb2c |
|
02-Oct-2012 |
Neel Natu <neel@FreeBSD.org> |
Get rid of assumptions in the hypervisor that the host physical memory associated with guest physical memory is contiguous. Add check to vm_gpa2hpa() that the range indicated by [gpa,gpa+len) is all contained within a single 4KB page.
|
#
70593114 |
|
26-Sep-2012 |
Neel Natu <neel@FreeBSD.org> |
Intel VT-x provides the length of the instruction at the time of the nested page table fault. Use this when fetching the instruction bytes from the guest memory. Also modify the lapic_mmio() API so that a decoded instruction is fed into it instead of having it fetch the instruction bytes from the guest. This is useful for hardware assists like SVM that provide the faulting instruction as part of the vmexit.
|
#
a2da7af6 |
|
25-Sep-2012 |
Neel Natu <neel@FreeBSD.org> |
Add support for trapping MMIO writes to local apic registers and emulating them. The default behavior is still to present the local apic to the guest in the x2apic mode.
|