AMD64ToPAE.asm@ 5999

Last change on this file since 5999 was 5999, checked in by vboxsync, 17 years ago
The Giant CDDL Dual-License Header Change.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 31.6 KB

Line
1	; $Id: AMD64ToPAE.asm 5999 2007-12-07 15:05:06Z vboxsync $
2	;; @file
3	; VMM - World Switchers, AMD64 to PAE.
4	;
5
6	;
7	; Copyright (C) 2006-2007 innotek GmbH
8	;
9	; This file is part of VirtualBox Open Source Edition (OSE), as
10	; available from http://www.virtualbox.org. This file is free software;
11	; you can redistribute it and/or modify it under the terms of the GNU
12	; General Public License (GPL) as published by the Free Software
13	; Foundation, in version 2 as it comes in the "COPYING" file of the
14	; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	;
17
18	;%define DEBUG_STUFF 1
19	;%define STRICT_IF 1
20
21	;*******************************************************************************
22	;* Defined Constants And Macros *
23	;*******************************************************************************
24	;; Prefix all names.
25	%define NAME_OVERLOAD(name) vmmR3SwitcherAMD64ToPAE_ %+ name
26
27
28	;*******************************************************************************
29	;* Header Files *
30	;*******************************************************************************
31	%include "VBox/asmdefs.mac"
32	%include "VBox/x86.mac"
33	%include "VBox/cpum.mac"
34	%include "VBox/stam.mac"
35	%include "VBox/vm.mac"
36	%include "CPUMInternal.mac"
37	%include "VMMSwitcher/VMMSwitcher.mac"
38
39
40	;
41	; Start the fixup records
42	; We collect the fixups in the .data section as we go along
43	; It is therefore VITAL that no-one is using the .data section
44	; for anything else between 'Start' and 'End'.
45	;
46	BEGINDATA
47	GLOBALNAME Fixups
48
49
50
51	BEGINCODE
52	GLOBALNAME Start
53
54	%ifndef VBOX_WITH_HYBIRD_32BIT_KERNEL
55	BITS 64
56
57	;;
58	; The C interface.
59	;
60	; @param pVM GCC: rdi MSC:rcx The VM handle.
61	;
62	BEGINPROC vmmR0HostToGuest
63	%ifdef DEBUG_STUFF
64	COM64_S_NEWLINE
65	COM64_S_CHAR '^'
66	%endif
67	;
68	; The ordinary version of the code.
69	;
70
71	%ifdef STRICT_IF
72	pushf
73	pop rax
74	test eax, X86_EFL_IF
75	jz .if_clear_in
76	mov eax, 0c0ffee00h
77	ret
78	.if_clear_in:
79	%endif
80
81	;
82	; make r9 = pVM and rdx = pCpum.
83	; rax, rcx and r8 are scratch here after.
84	%ifdef RT_OS_WINDOWS
85	mov r9, rcx
86	%else
87	mov r9, rdi
88	%endif
89	lea rdx, [r9 + VM.cpum]
90
91	%ifdef VBOX_WITH_STATISTICS
92	;
93	; Switcher stats.
94	;
95	lea r8, [r9 + VM.StatSwitcherToGC]
96	STAM64_PROFILE_ADV_START r8
97	%endif
98
99	;
100	; Call worker (far return).
101	;
102	mov eax, cs
103	push rax
104	call NAME(vmmR0HostToGuestAsm)
105
106	%ifdef VBOX_WITH_STATISTICS
107	;
108	; Switcher stats.
109	;
110	lea r8, [r9 + VM.StatSwitcherToGC]
111	STAM64_PROFILE_ADV_STOP r8
112	%endif
113
114	ret
115	ENDPROC vmmR0HostToGuest
116
117
118	%else ; VBOX_WITH_HYBIRD_32BIT_KERNEL
119
120
121	BITS 32
122
123	;;
124	; The C interface.
125	;
126	BEGINPROC vmmR0HostToGuest
127	%ifdef DEBUG_STUFF
128	COM32_S_NEWLINE
129	COM32_S_CHAR '^'
130	%endif
131
132	%ifdef VBOX_WITH_STATISTICS
133	;
134	; Switcher stats.
135	;
136	FIXUP FIX_HC_VM_OFF, 1, VM.StatSwitcherToGC
137	mov edx, 0ffffffffh
138	STAM_PROFILE_ADV_START edx
139	%endif
140
141	; Thunk to/from 64 bit when invoking the worker routine.
142	;
143	FIXUP FIX_HC_VM_OFF, 1, VM.cpum
144	mov edx, 0ffffffffh
145
146	push 0
147	push cs
148	push 0
149	FIXUP FIX_HC_32BIT, 1, .vmmR0HostToGuestReturn - NAME(Start)
150	push 0ffffffffh
151
152	FIXUP FIX_HC_64BIT_CS, 1
153	push 0ffffh
154	FIXUP FIX_HC_32BIT, 1, NAME(vmmR0HostToGuestAsm) - NAME(Start)
155	push 0ffffffffh
156	retf
157	.vmmR0HostToGuestReturn:
158
159	;
160	; This selector reloading is probably not necessary, but we do it anyway to be quite sure
161	; the CPU has the right idea about the selectors.
162	;
163	mov edx, ds
164	mov ds, edx
165	mov ecx, es
166	mov es, ecx
167	mov edx, ss
168	mov ss, edx
169
170	%ifdef VBOX_WITH_STATISTICS
171	;
172	; Switcher stats.
173	;
174	FIXUP FIX_HC_VM_OFF, 1, VM.StatSwitcherToHC
175	mov edx, 0ffffffffh
176	STAM_PROFILE_ADV_STOP edx
177	%endif
178
179	ret
180	ENDPROC vmmR0HostToGuest
181
182	BITS 64
183	%endif ;!VBOX_WITH_HYBIRD_32BIT_KERNEL
184
185
186
187	; *****************************************************************************
188	; vmmR0HostToGuestAsm
189	;
190	; Phase one of the switch from host to guest context (host MMU context)
191	;
192	; INPUT:
193	; - edx virtual address of CPUM structure (valid in host context)
194	;
195	; USES/DESTROYS:
196	; - eax, ecx, edx
197	;
198	; ASSUMPTION:
199	; - current CS and DS selectors are wide open
200	;
201	; *****************************************************************************
202	ALIGNCODE(16)
203	BEGINPROC vmmR0HostToGuestAsm
204	;;
205	;; Save CPU host context
206	;; Skip eax, edx and ecx as these are not preserved over calls.
207	;;
208	; general registers.
209	; mov [rdx + CPUM.Host.rax], rax - scratch
210	mov [rdx + CPUM.Host.rbx], rbx
211	; mov [rdx + CPUM.Host.rcx], rcx - scratch
212	; mov [rdx + CPUM.Host.rdx], rdx - scratch
213	mov [rdx + CPUM.Host.rdi], rdi
214	mov [rdx + CPUM.Host.rsi], rsi
215	mov [rdx + CPUM.Host.rsp], rsp
216	mov [rdx + CPUM.Host.rbp], rbp
217	; mov [rdx + CPUM.Host.r8 ], r8 - scratch
218	; mov [rdx + CPUM.Host.r9 ], r9 - scratch
219	mov [rdx + CPUM.Host.r10], r10
220	mov [rdx + CPUM.Host.r11], r11
221	mov [rdx + CPUM.Host.r12], r12
222	mov [rdx + CPUM.Host.r13], r13
223	mov [rdx + CPUM.Host.r14], r14
224	mov [rdx + CPUM.Host.r15], r15
225	; selectors.
226	mov [rdx + CPUM.Host.ds], ds
227	mov [rdx + CPUM.Host.es], es
228	mov [rdx + CPUM.Host.fs], fs
229	mov [rdx + CPUM.Host.gs], gs
230	mov [rdx + CPUM.Host.ss], ss
231	; MSRs
232	mov rbx, rdx
233	mov ecx, MSR_K8_FS_BASE
234	rdmsr
235	mov [rbx + CPUM.Host.FSbase], eax
236	mov [rbx + CPUM.Host.FSbase + 4], edx
237	mov ecx, MSR_K8_GS_BASE
238	rdmsr
239	mov [rbx + CPUM.Host.GSbase], eax
240	mov [rbx + CPUM.Host.GSbase + 4], edx
241	mov ecx, MSR_K6_EFER
242	rdmsr
243	mov [rbx + CPUM.Host.efer], eax
244	mov [rbx + CPUM.Host.efer + 4], edx
245	mov ecx, MSR_K6_EFER
246	mov rdx, rbx
247	; special registers.
248	sldt [rdx + CPUM.Host.ldtr]
249	sidt [rdx + CPUM.Host.idtr]
250	sgdt [rdx + CPUM.Host.gdtr]
251	str [rdx + CPUM.Host.tr] ; yasm BUG, generates sldt. YASMCHECK!
252	; flags
253	pushf
254	pop qword [rdx + CPUM.Host.rflags]
255
256	FIXUP FIX_NO_SYSENTER_JMP, 0, htg_no_sysenter - NAME(Start) ; this will insert a jmp htg_no_sysenter if host doesn't use sysenter.
257	; save MSR_IA32_SYSENTER_CS register.
258	mov ecx, MSR_IA32_SYSENTER_CS
259	mov rbx, rdx ; save edx
260	rdmsr ; edx:eax <- MSR[ecx]
261	mov [rbx + CPUM.Host.SysEnter.cs], rax
262	mov [rbx + CPUM.Host.SysEnter.cs + 4], rdx
263	xor rax, rax ; load 0:0 to cause #GP upon sysenter
264	xor rdx, rdx
265	wrmsr
266	mov rdx, rbx ; restore edx
267	jmp short htg_no_sysenter
268
269	ALIGNCODE(16)
270	htg_no_sysenter:
271
272	;; handle use flags.
273	mov esi, [rdx + CPUM.fUseFlags] ; esi == use flags.
274	and esi, ~CPUM_USED_FPU ; Clear CPUM_USED_* flags. ;;@todo FPU check can be optimized to use cr0 flags!
275	mov [rdx + CPUM.fUseFlags], esi
276
277	; debug registers.
278	test esi, CPUM_USE_DEBUG_REGS \| CPUM_USE_DEBUG_REGS_HOST
279	jz htg_debug_regs_no
280	jmp htg_debug_regs_save
281	htg_debug_regs_no:
282	DEBUG_CHAR('a') ; trashes esi
283
284	; control registers.
285	mov rax, cr0
286	mov [rdx + CPUM.Host.cr0], rax
287	;mov rax, cr2 ; assume host os don't suff things in cr2. (safe)
288	;mov [rdx + CPUM.Host.cr2], rax
289	mov rax, cr3
290	mov [rdx + CPUM.Host.cr3], rax
291	mov rax, cr4
292	mov [rdx + CPUM.Host.cr4], rax
293
294	;;
295	;; Start switching to VMM context.
296	;;
297
298	;
299	; Change CR0 and CR4 so we can correctly emulate FPU/MMX/SSE[23] exceptions
300	; Also disable WP. (eax==cr4 now)
301	; Note! X86_CR4_PSE and X86_CR4_PAE are important if the host thinks so :-)
302	;
303	and rax, X86_CR4_MCE \| X86_CR4_PSE \| X86_CR4_PAE
304	mov ecx, [rdx + CPUM.Guest.cr4]
305	DEBUG_CHAR('b') ; trashes esi
306	;; @todo Switcher cleanup: Determin base CR4 during CPUMR0Init / VMMR3SelectSwitcher putting it
307	; in CPUM.Hyper.cr4 (which isn't currently being used). That should
308	; simplify this operation a bit (and improve locality of the data).
309
310	;
311	; CR4.AndMask and CR4.OrMask are set in CPUMR3Init based on the presence of
312	; FXSAVE support on the host CPU
313	;
314	and ecx, [rdx + CPUM.CR4.AndMask]
315	or eax, ecx
316	or eax, [rdx + CPUM.CR4.OrMask]
317	mov cr4, rax
318	DEBUG_CHAR('c') ; trashes esi
319
320	mov eax, [rdx + CPUM.Guest.cr0]
321	and eax, X86_CR0_EM
322	or eax, X86_CR0_PE \| X86_CR0_PG \| X86_CR0_TS \| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_MP
323	mov cr0, rax
324	DEBUG_CHAR('0') ; trashes esi
325
326
327	; Load new gdt so we can do far jump to guest code after cr3 reload.
328	lgdt [rdx + CPUM.Hyper.gdtr]
329	DEBUG_CHAR('1') ; trashes esi
330
331	;;
332	;; Load Intermediate memory context.
333	;;
334	FIXUP FIX_INTER_AMD64_CR3, 1
335	mov eax, 0ffffffffh
336	mov cr3, rax
337	DEBUG_CHAR('2') ; trashes esi
338
339	;;
340	;; 1. Switch to compatibility mode, placing ourselves in identity mapped code.
341	;;
342	jmp far [NAME(fpIDEnterTarget) wrt rip]
343
344	; 16:32 Pointer to IDEnterTarget.
345	NAME(fpIDEnterTarget):
346	FIXUP FIX_ID_32BIT, 0, NAME(IDEnterTarget) - NAME(Start)
347	dd 0
348	FIXUP FIX_HYPER_CS, 0
349	dd 0
350
351
352	;;
353	; Detour for saving the host DR7 and DR6.
354	; esi and rdx must be preserved.
355	htg_debug_regs_save:
356	DEBUG_S_CHAR('s');
357	mov rax, dr7 ; not sure, but if I read the docs right this will trap if GD is set. FIXME!!!
358	mov [rdx + CPUM.Host.dr7], rax
359	xor eax, eax ; clear everything. (bit 12? is read as 1...)
360	mov dr7, rax
361	mov rax, dr6 ; just in case we save the state register too.
362	mov [rdx + CPUM.Host.dr6], rax
363	; save host DR0-3?
364	test esi, CPUM_USE_DEBUG_REGS
365	jz near htg_debug_regs_no
366	DEBUG_S_CHAR('S');
367	mov rax, dr0
368	mov [rdx + CPUM.Host.dr0], rax
369	mov rbx, dr1
370	mov [rdx + CPUM.Host.dr1], rbx
371	mov rcx, dr2
372	mov [rdx + CPUM.Host.dr2], rcx
373	mov rax, dr3
374	mov [rdx + CPUM.Host.dr3], rax
375	jmp htg_debug_regs_no
376
377
378	; We're now on an identity mapped pages! in 32-bit compatability mode.
379	BITS 32
380	ALIGNCODE(16)
381	GLOBALNAME IDEnterTarget
382	DEBUG_CHAR('3')
383
384	; 2. Deactivate long mode by turning off paging.
385	mov ebx, cr0
386	and ebx, ~X86_CR0_PG
387	mov cr0, ebx
388	DEBUG_CHAR('4')
389
390	; 3. Load 32-bit intermediate page table.
391	FIXUP FIX_INTER_PAE_CR3, 1
392	mov edx, 0ffffffffh
393	mov cr3, edx
394
395	; 4. Disable long mode.
396	; We also use the chance to disable syscall/sysret and fast fxsave/fxrstor.
397	mov ecx, MSR_K6_EFER
398	rdmsr
399	DEBUG_CHAR('5')
400	and eax, ~(MSR_K6_EFER_LME \| MSR_K6_EFER_SCE \| MSR_K6_EFER_FFXSR)
401	wrmsr
402	DEBUG_CHAR('6')
403
404	; 5. Enable paging.
405	or ebx, X86_CR0_PG
406	mov cr0, ebx
407	jmp short just_a_jump
408	just_a_jump:
409	DEBUG_CHAR('7')
410
411	;;
412	;; 6. Jump to guest code mapping of the code and load the Hypervisor CS.
413	;;
414	FIXUP FIX_ID_2_GC_NEAR_REL, 1, NAME(JmpGCTarget) - NAME(Start)
415	jmp near NAME(JmpGCTarget)
416
417
418	;;
419	;; When we arrive at this label we're at the
420	;; guest code mapping of the switching code.
421	;;
422	ALIGNCODE(16)
423	GLOBALNAME JmpGCTarget
424	DEBUG_CHAR('-')
425	; load final cr3 and do far jump to load cs.
426	FIXUP FIX_HYPER_PAE_CR3, 1
427	mov eax, 0ffffffffh
428	mov cr3, eax
429	DEBUG_CHAR('0')
430
431	;;
432	;; We're in VMM MMU context and VMM CS is loaded.
433	;; Setup the rest of the VMM state.
434	;;
435	; Load selectors
436	DEBUG_CHAR('1')
437	FIXUP FIX_HYPER_DS, 1
438	mov eax, 0ffffh
439	mov ds, eax
440	mov es, eax
441	xor eax, eax
442	mov gs, eax
443	mov fs, eax
444	; Load pCpum into EDX
445	FIXUP FIX_GC_CPUM_OFF, 1, 0
446	mov edx, 0ffffffffh
447	; Activate guest IDT
448	DEBUG_CHAR('2')
449	lidt [edx + CPUM.Hyper.idtr]
450
451	; Setup stack
452	DEBUG_CHAR('3')
453	lss esp, [edx + CPUM.Hyper.esp]
454
455	; Restore TSS selector; must mark it as not busy before using ltr (!)
456	DEBUG_CHAR('4')
457	FIXUP FIX_GC_TSS_GDTE_DW2, 2
458	and dword [0ffffffffh], ~0200h ; clear busy flag (2nd type2 bit)
459	DEBUG_CHAR('5')
460	ltr word [edx + CPUM.Hyper.tr]
461	DEBUG_CHAR('6')
462
463	; Activate the ldt (now we can safely crash).
464	lldt [edx + CPUM.Hyper.ldtr]
465	DEBUG_CHAR('7')
466
467	;; use flags.
468	mov esi, [edx + CPUM.fUseFlags]
469
470	; debug registers
471	test esi, CPUM_USE_DEBUG_REGS
472	jz htg_debug_regs_guest_no
473	jmp htg_debug_regs_guest
474	htg_debug_regs_guest_no:
475	DEBUG_CHAR('9')
476
477	; General registers.
478	mov ebx, [edx + CPUM.Hyper.ebx]
479	mov ebp, [edx + CPUM.Hyper.ebp]
480	mov esi, [edx + CPUM.Hyper.esi]
481	mov edi, [edx + CPUM.Hyper.edi]
482	push dword [edx + CPUM.Hyper.eflags]
483	popfd
484	DEBUG_CHAR('!')
485
486	;;
487	;; Return to the VMM code which either called the switcher or
488	;; the code set up to run by HC.
489	;;
490	%ifdef DEBUG_STUFF
491	COM32_S_PRINT ';eip='
492	mov eax, [edx + CPUM.Hyper.eip]
493	COM32_S_DWORD_REG eax
494	COM32_S_CHAR ';'
495	%endif
496	mov eax, [edx + CPUM.Hyper.eip]
497	%ifdef VBOX_WITH_STATISTICS
498	FIXUP FIX_GC_VM_OFF, 1, VM.StatSwitcherToGC
499	mov edx, 0ffffffffh
500	STAM32_PROFILE_ADV_STOP edx
501	FIXUP FIX_GC_CPUM_OFF, 1, 0
502	mov edx, 0ffffffffh
503	%endif
504	jmp eax
505
506	;;
507	; Detour for saving host DR0-3 and loading hypervisor debug registers.
508	; esi and edx must be preserved.
509	htg_debug_regs_guest:
510	DEBUG_S_CHAR('D')
511	DEBUG_S_CHAR('R')
512	DEBUG_S_CHAR('x')
513	; load hyper DR0-7
514	mov ebx, [edx + CPUM.Hyper.dr0]
515	mov dr0, ebx
516	mov ecx, [edx + CPUM.Hyper.dr1]
517	mov dr1, ecx
518	mov eax, [edx + CPUM.Hyper.dr2]
519	mov dr2, eax
520	mov ebx, [edx + CPUM.Hyper.dr3]
521	mov dr3, ebx
522	;mov eax, [edx + CPUM.Hyper.dr6]
523	mov ecx, 0ffff0ff0h
524	mov dr6, ecx
525	mov eax, [edx + CPUM.Hyper.dr7]
526	mov dr7, eax
527	jmp htg_debug_regs_guest_no
528
529	ENDPROC vmmR0HostToGuestAsm
530
531
532	;;
533	; Trampoline for doing a call when starting the hyper visor execution.
534	;
535	; Push any arguments to the routine.
536	; Push the argument frame size (cArg * 4).
537	; Push the call target (_cdecl convention).
538	; Push the address of this routine.
539	;
540	;
541	ALIGNCODE(16)
542	BEGINPROC vmmGCCallTrampoline
543	%ifdef DEBUG_STUFF
544	COM32_S_CHAR 'c'
545	COM32_S_CHAR 't'
546	COM32_S_CHAR '!'
547	%endif
548
549	; call routine
550	pop eax ; call address
551	mov esi, edx ; save edx
552	pop edi ; argument count.
553	%ifdef DEBUG_STUFF
554	COM32_S_PRINT ';eax='
555	COM32_S_DWORD_REG eax
556	COM32_S_CHAR ';'
557	%endif
558	call eax ; do call
559	add esp, edi ; cleanup stack
560
561	; return to the host context.
562	push byte 0 ; eip
563	mov edx, esi ; CPUM pointer
564
565	%ifdef DEBUG_STUFF
566	COM32_S_CHAR '`'
567	%endif
568	jmp NAME(VMMGCGuestToHostAsm) ; eax = returncode.
569	ENDPROC vmmGCCallTrampoline
570
571
572
573	;;
574	; The C interface.
575	;
576	ALIGNCODE(16)
577	BEGINPROC vmmGCGuestToHost
578	%ifdef DEBUG_STUFF
579	push esi
580	COM_NEWLINE
581	DEBUG_CHAR('b')
582	DEBUG_CHAR('a')
583	DEBUG_CHAR('c')
584	DEBUG_CHAR('k')
585	DEBUG_CHAR('!')
586	COM_NEWLINE
587	pop esi
588	%endif
589	mov eax, [esp + 4]
590	jmp NAME(VMMGCGuestToHostAsm)
591	ENDPROC vmmGCGuestToHost
592
593
594	;;
595	; VMMGCGuestToHostAsmGuestCtx
596	;
597	; Switches from Guest Context to Host Context.
598	; Of course it's only called from within the GC.
599	;
600	; @param eax Return code.
601	; @param esp + 4 Pointer to CPUMCTXCORE.
602	;
603	; @remark ASSUMES interrupts disabled.
604	;
605	ALIGNCODE(16)
606	BEGINPROC VMMGCGuestToHostAsmGuestCtx
607	DEBUG_CHAR('~')
608
609	%ifdef VBOX_WITH_STATISTICS
610	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalInGC
611	mov edx, 0ffffffffh
612	STAM32_PROFILE_ADV_STOP edx
613
614	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalGCToQemu
615	mov edx, 0ffffffffh
616	STAM32_PROFILE_ADV_START edx
617
618	FIXUP FIX_GC_VM_OFF, 1, VM.StatSwitcherToHC
619	mov edx, 0ffffffffh
620	STAM32_PROFILE_ADV_START edx
621	%endif
622
623	;
624	; Load the CPUM pointer.
625	;
626	FIXUP FIX_GC_CPUM_OFF, 1, 0
627	mov edx, 0ffffffffh
628
629	; Skip return address (assumes called!)
630	lea esp, [esp + 4]
631
632	;
633	; Guest Context (assumes CPUMCTXCORE layout).
634	;
635	; general purpose registers (layout is pushad)
636	pop dword [edx + CPUM.Guest.edi]
637	pop dword [edx + CPUM.Guest.esi]
638	pop dword [edx + CPUM.Guest.ebp]
639	pop dword [edx + CPUM.Guest.eax]
640	pop dword [edx + CPUM.Guest.ebx]
641	pop dword [edx + CPUM.Guest.edx]
642	pop dword [edx + CPUM.Guest.ecx]
643	pop dword [edx + CPUM.Guest.esp]
644	pop dword [edx + CPUM.Guest.ss]
645	pop dword [edx + CPUM.Guest.gs]
646	pop dword [edx + CPUM.Guest.fs]
647	pop dword [edx + CPUM.Guest.es]
648	pop dword [edx + CPUM.Guest.ds]
649	pop dword [edx + CPUM.Guest.cs]
650	; flags
651	pop dword [edx + CPUM.Guest.eflags]
652	; eip
653	pop dword [edx + CPUM.Guest.eip]
654	jmp vmmGCGuestToHostAsm_EIPDone
655	ENDPROC VMMGCGuestToHostAsmGuestCtx
656
657
658	;;
659	; VMMGCGuestToHostAsmHyperCtx
660	;
661	; This is an alternative entry point which we'll be using
662	; when the we have the hypervisor context and need to save
663	; that before going to the host.
664	;
665	; This is typically useful when abandoning the hypervisor
666	; because of a trap and want the trap state to be saved.
667	;
668	; @param eax Return code.
669	; @param ecx Points to CPUMCTXCORE.
670	; @uses eax,edx,ecx
671	ALIGNCODE(16)
672	BEGINPROC VMMGCGuestToHostAsmHyperCtx
673	DEBUG_CHAR('#')
674
675	%ifdef VBOX_WITH_STATISTICS
676	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalInGC
677	mov edx, 0ffffffffh
678	STAM32_PROFILE_ADV_STOP edx
679
680	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalGCToQemu
681	mov edx, 0ffffffffh
682	STAM32_PROFILE_ADV_START edx
683
684	FIXUP FIX_GC_VM_OFF, 1, VM.StatSwitcherToHC
685	mov edx, 0ffffffffh
686	STAM32_PROFILE_ADV_START edx
687	%endif
688
689	;
690	; Load the CPUM pointer.
691	;
692	FIXUP FIX_GC_CPUM_OFF, 1, 0
693	mov edx, 0ffffffffh
694
695	push eax ; save return code.
696	; general purpose registers
697	mov eax, [ecx + CPUMCTXCORE.edi]
698	mov [edx + CPUM.Hyper.edi], eax
699	mov eax, [ecx + CPUMCTXCORE.esi]
700	mov [edx + CPUM.Hyper.esi], eax
701	mov eax, [ecx + CPUMCTXCORE.ebp]
702	mov [edx + CPUM.Hyper.ebp], eax
703	mov eax, [ecx + CPUMCTXCORE.eax]
704	mov [edx + CPUM.Hyper.eax], eax
705	mov eax, [ecx + CPUMCTXCORE.ebx]
706	mov [edx + CPUM.Hyper.ebx], eax
707	mov eax, [ecx + CPUMCTXCORE.edx]
708	mov [edx + CPUM.Hyper.edx], eax
709	mov eax, [ecx + CPUMCTXCORE.ecx]
710	mov [edx + CPUM.Hyper.ecx], eax
711	mov eax, [ecx + CPUMCTXCORE.esp]
712	mov [edx + CPUM.Hyper.esp], eax
713	; selectors
714	mov eax, [ecx + CPUMCTXCORE.ss]
715	mov [edx + CPUM.Hyper.ss], eax
716	mov eax, [ecx + CPUMCTXCORE.gs]
717	mov [edx + CPUM.Hyper.gs], eax
718	mov eax, [ecx + CPUMCTXCORE.fs]
719	mov [edx + CPUM.Hyper.fs], eax
720	mov eax, [ecx + CPUMCTXCORE.es]
721	mov [edx + CPUM.Hyper.es], eax
722	mov eax, [ecx + CPUMCTXCORE.ds]
723	mov [edx + CPUM.Hyper.ds], eax
724	mov eax, [ecx + CPUMCTXCORE.cs]
725	mov [edx + CPUM.Hyper.cs], eax
726	; flags
727	mov eax, [ecx + CPUMCTXCORE.eflags]
728	mov [edx + CPUM.Hyper.eflags], eax
729	; eip
730	mov eax, [ecx + CPUMCTXCORE.eip]
731	mov [edx + CPUM.Hyper.eip], eax
732	; jump to common worker code.
733	pop eax ; restore return code.
734	jmp vmmGCGuestToHostAsm_SkipHyperRegs
735
736	ENDPROC VMMGCGuestToHostAsmHyperCtx
737
738
739	;;
740	; VMMGCGuestToHostAsm
741	;
742	; This is an alternative entry point which we'll be using
743	; when the we have saved the guest state already or we haven't
744	; been messing with the guest at all.
745	;
746	; @param eax Return code.
747	; @uses eax, edx, ecx (or it may use them in the future)
748	;
749	ALIGNCODE(16)
750	BEGINPROC VMMGCGuestToHostAsm
751	DEBUG_CHAR('%')
752
753	%ifdef VBOX_WITH_STATISTICS
754	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalInGC
755	mov edx, 0ffffffffh
756	STAM32_PROFILE_ADV_STOP edx
757
758	FIXUP FIX_GC_VM_OFF, 1, VM.StatTotalGCToQemu
759	mov edx, 0ffffffffh
760	STAM32_PROFILE_ADV_START edx
761
762	FIXUP FIX_GC_VM_OFF, 1, VM.StatSwitcherToHC
763	mov edx, 0ffffffffh
764	STAM32_PROFILE_ADV_START edx
765	%endif
766
767	;
768	; Load the CPUM pointer.
769	;
770	FIXUP FIX_GC_CPUM_OFF, 1, 0
771	mov edx, 0ffffffffh
772
773	pop dword [edx + CPUM.Hyper.eip] ; call return from stack
774	jmp short vmmGCGuestToHostAsm_EIPDone
775
776	ALIGNCODE(16)
777	vmmGCGuestToHostAsm_EIPDone:
778	; general registers which we care about.
779	mov dword [edx + CPUM.Hyper.ebx], ebx
780	mov dword [edx + CPUM.Hyper.esi], esi
781	mov dword [edx + CPUM.Hyper.edi], edi
782	mov dword [edx + CPUM.Hyper.ebp], ebp
783	mov dword [edx + CPUM.Hyper.esp], esp
784
785	; special registers which may change.
786	vmmGCGuestToHostAsm_SkipHyperRegs:
787	%ifdef STRICT_IF
788	pushf
789	pop ecx
790	test ecx, X86_EFL_IF
791	jz .if_clear_out
792	mov eax, 0c0ffee01h
793	cli
794	.if_clear_out:
795	%endif
796	; str [edx + CPUM.Hyper.tr] - double fault only, and it won't be right then either.
797	sldt [edx + CPUM.Hyper.ldtr]
798
799	; No need to save CRx here. They are set dynamically according to Guest/Host requirements.
800	; FPU context is saved before restore of host saving (another) branch.
801
802
803	;;
804	;; Load Intermediate memory context.
805	;;
806	mov edi, eax ; save return code in EDI (careful with COM_DWORD_REG from here on!)
807	FIXUP FIX_INTER_PAE_CR3, 1
808	mov eax, 0ffffffffh
809	mov cr3, eax
810	DEBUG_CHAR('?')
811
812	;; We're now in intermediate memory context!
813
814	;;
815	;; 0. Jump to identity mapped location
816	;;
817	FIXUP FIX_GC_2_ID_NEAR_REL, 1, NAME(IDExitTarget) - NAME(Start)
818	jmp near NAME(IDExitTarget)
819
820	; We're now on identity mapped pages!
821	ALIGNCODE(16)
822	GLOBALNAME IDExitTarget
823	DEBUG_CHAR('1')
824
825	; 1. Disable paging.
826	mov ebx, cr0
827	and ebx, ~X86_CR0_PG
828	mov cr0, ebx
829	DEBUG_CHAR('2')
830
831	; 2. Enable PAE - already enabled.
832
833	; 3. Load long mode intermediate CR3.
834	FIXUP FIX_INTER_AMD64_CR3, 1
835	mov ecx, 0ffffffffh
836	mov cr3, ecx
837	DEBUG_CHAR('3')
838
839	; 4. Enable long mode.
840	mov ebp, edx
841	mov ecx, MSR_K6_EFER
842	rdmsr
843	or eax, MSR_K6_EFER_LME
844	wrmsr
845	mov edx, ebp
846	DEBUG_CHAR('4')
847
848	; 5. Enable paging.
849	or ebx, X86_CR0_PG
850	mov cr0, ebx
851	DEBUG_CHAR('5')
852
853	; Jump from compatability mode to 64-bit mode.
854	FIXUP FIX_ID_FAR32_TO_64BIT_MODE, 1, NAME(IDExit64Mode) - NAME(Start)
855	jmp 0ffffh:0fffffffeh
856
857	;
858	; We're in 64-bit mode (ds, ss, es, fs, gs are all bogus).
859	; Move on to the HC mapping.
860	;
861	BITS 64
862	ALIGNCODE(16)
863	NAME(IDExit64Mode):
864	DEBUG_CHAR('6')
865	jmp [NAME(pHCExitTarget) wrt rip]
866
867	; 64-bit jump target
868	NAME(pHCExitTarget):
869	FIXUP FIX_HC_64BIT, 0, NAME(HCExitTarget) - NAME(Start)
870	dq 0ffffffffffffffffh
871
872	; 64-bit pCpum address.
873	NAME(pCpumHC):
874	FIXUP FIX_HC_64BIT_CPUM, 0
875	dq 0ffffffffffffffffh
876
877	;
878	; When we arrive here we're at the host context
879	; mapping of the switcher code.
880	;
881	ALIGNCODE(16)
882	GLOBALNAME HCExitTarget
883	DEBUG_CHAR('9')
884
885	; load final cr3
886	mov rsi, [rdx + CPUM.Host.cr3]
887	mov cr3, rsi
888	DEBUG_CHAR('@')
889
890	;;
891	;; Restore Host context.
892	;;
893	; Load CPUM pointer into edx
894	mov rdx, [NAME(pCpumHC) wrt rip]
895	; activate host gdt and idt
896	lgdt [rdx + CPUM.Host.gdtr]
897	DEBUG_CHAR('0')
898	lidt [rdx + CPUM.Host.idtr]
899	DEBUG_CHAR('1')
900	; Restore TSS selector; must mark it as not busy before using ltr (!)
901	%if 1 ; ASSUME that this is supposed to be 'BUSY'. (saves 20-30 ticks on the T42p)
902	movzx eax, word [rdx + CPUM.Host.tr] ; eax <- TR
903	and al, 0F8h ; mask away TI and RPL bits, get descriptor offset.
904	add rax, [rdx + CPUM.Host.gdtr + 2] ; eax <- GDTR.address + descriptor offset.
905	and dword [rax + 4], ~0200h ; clear busy flag (2nd type2 bit)
906	ltr word [rdx + CPUM.Host.tr]
907	%else
908	movzx eax, word [rdx + CPUM.Host.tr] ; eax <- TR
909	and al, 0F8h ; mask away TI and RPL bits, get descriptor offset.
910	add rax, [rdx + CPUM.Host.gdtr + 2] ; eax <- GDTR.address + descriptor offset.
911	mov ecx, [rax + 4] ; ecx <- 2nd descriptor dword
912	mov ebx, ecx ; save orginal value
913	and ecx, ~0200h ; clear busy flag (2nd type2 bit)
914	mov [rax + 4], ccx ; not using xchg here is paranoia..
915	ltr word [rdx + CPUM.Host.tr]
916	xchg [rax + 4], ebx ; using xchg is paranoia too...
917	%endif
918	; activate ldt
919	DEBUG_CHAR('2')
920	lldt [rdx + CPUM.Host.ldtr]
921	; Restore segment registers
922	mov eax, [rdx + CPUM.Host.ds]
923	mov ds, eax
924	mov eax, [rdx + CPUM.Host.es]
925	mov es, eax
926	mov eax, [rdx + CPUM.Host.fs]
927	mov fs, eax
928	mov eax, [rdx + CPUM.Host.gs]
929	mov gs, eax
930	; restore stack
931	mov eax, [rdx + CPUM.Host.ss]
932	mov ss, eax
933	mov rsp, [rdx + CPUM.Host.rsp]
934
935	FIXUP FIX_NO_SYSENTER_JMP, 0, gth_sysenter_no - NAME(Start) ; this will insert a jmp gth_sysenter_no if host doesn't use sysenter.
936	; restore MSR_IA32_SYSENTER_CS register.
937	mov ecx, MSR_IA32_SYSENTER_CS
938	mov eax, [rdx + CPUM.Host.SysEnter.cs]
939	mov ebx, [rdx + CPUM.Host.SysEnter.cs + 4]
940	mov rbx, rdx ; save/load edx
941	wrmsr ; MSR[ecx] <- edx:eax
942	mov rdx, rbx ; restore edx
943	jmp short gth_sysenter_no
944
945	ALIGNCODE(16)
946	gth_sysenter_no:
947
948	;; @todo AMD syscall
949
950	; Restore FPU if guest has used it.
951	; Using fxrstor should ensure that we're not causing unwanted exception on the host.
952	mov esi, [rdx + CPUM.fUseFlags] ; esi == use flags.
953	test esi, CPUM_USED_FPU
954	jz short gth_fpu_no
955	mov rcx, cr0
956	and rcx, ~(X86_CR0_TS \| X86_CR0_EM)
957	mov cr0, rcx
958
959	fxsave [rdx + CPUM.Guest.fpu]
960	fxrstor [rdx + CPUM.Host.fpu]
961	jmp short gth_fpu_no
962
963	ALIGNCODE(16)
964	gth_fpu_no:
965
966	; Control registers.
967	; Would've liked to have these highere up in case of crashes, but
968	; the fpu stuff must be done before we restore cr0.
969	mov rcx, [rdx + CPUM.Host.cr4]
970	mov cr4, rcx
971	mov rcx, [rdx + CPUM.Host.cr0]
972	mov cr0, rcx
973	;mov rcx, [rdx + CPUM.Host.cr2] ; assumes this is waste of time.
974	;mov cr2, rcx
975
976	; restore debug registers (if modified) (esi must still be fUseFlags!)
977	; (must be done after cr4 reload because of the debug extension.)
978	test esi, CPUM_USE_DEBUG_REGS \| CPUM_USE_DEBUG_REGS_HOST
979	jz short gth_debug_regs_no
980	jmp gth_debug_regs_restore
981	gth_debug_regs_no:
982
983	; Restore MSRs
984	mov rbx, rdx
985	mov ecx, MSR_K8_FS_BASE
986	mov eax, [rbx + CPUM.Host.FSbase]
987	mov edx, [rbx + CPUM.Host.FSbase + 4]
988	wrmsr
989	mov ecx, MSR_K8_GS_BASE
990	mov eax, [rbx + CPUM.Host.GSbase]
991	mov edx, [rbx + CPUM.Host.GSbase + 4]
992	wrmsr
993	mov ecx, MSR_K6_EFER
994	mov eax, [rbx + CPUM.Host.efer]
995	mov edx, [rbx + CPUM.Host.efer + 4]
996	wrmsr
997	mov rdx, rbx
998
999
1000	; restore general registers.
1001	mov eax, edi ; restore return code. eax = return code !!
1002	; mov rax, [rdx + CPUM.Host.rax] - scratch + return code
1003	mov rbx, [rdx + CPUM.Host.rbx]
1004	; mov rcx, [rdx + CPUM.Host.rcx] - scratch
1005	; mov rdx, [rdx + CPUM.Host.rdx] - scratch
1006	mov rdi, [rdx + CPUM.Host.rdi]
1007	mov rsi, [rdx + CPUM.Host.rsi]
1008	mov rsp, [rdx + CPUM.Host.rsp]
1009	mov rbp, [rdx + CPUM.Host.rbp]
1010	; mov r8, [rdx + CPUM.Host.r8 ] - scratch
1011	; mov r9, [rdx + CPUM.Host.r9 ] - scratch
1012	mov r10, [rdx + CPUM.Host.r10]
1013	mov r11, [rdx + CPUM.Host.r11]
1014	mov r12, [rdx + CPUM.Host.r12]
1015	mov r13, [rdx + CPUM.Host.r13]
1016	mov r14, [rdx + CPUM.Host.r14]
1017	mov r15, [rdx + CPUM.Host.r15]
1018
1019	; finally restore flags. (probably not required)
1020	push qword [rdx + CPUM.Host.rflags]
1021	popf
1022
1023
1024	%ifdef DEBUG_STUFF
1025	COM64_S_CHAR '4'
1026	%endif
1027	db 048h
1028	retf
1029
1030	;;
1031	; Detour for restoring the host debug registers.
1032	; edx and edi must be preserved.
1033	gth_debug_regs_restore:
1034	DEBUG_S_CHAR('d')
1035	xor eax, eax
1036	mov dr7, rax ; paranoia or not?
1037	test esi, CPUM_USE_DEBUG_REGS
1038	jz short gth_debug_regs_dr7
1039	DEBUG_S_CHAR('r')
1040	mov rax, [rdx + CPUM.Host.dr0]
1041	mov dr0, rax
1042	mov rbx, [rdx + CPUM.Host.dr1]
1043	mov dr1, rbx
1044	mov rcx, [rdx + CPUM.Host.dr2]
1045	mov dr2, rcx
1046	mov rax, [rdx + CPUM.Host.dr3]
1047	mov dr3, rax
1048	gth_debug_regs_dr7:
1049	mov rbx, [rdx + CPUM.Host.dr6]
1050	mov dr6, rbx
1051	mov rcx, [rdx + CPUM.Host.dr7]
1052	mov dr7, rcx
1053	jmp gth_debug_regs_no
1054
1055	ENDPROC VMMGCGuestToHostAsm
1056
1057
1058	GLOBALNAME End
1059	;
1060	; The description string (in the text section).
1061	;
1062	NAME(Description):
1063	db "AMD64 to/from PAE", 0
1064
1065	extern NAME(Relocate)
1066
1067	;
1068	; End the fixup records.
1069	;
1070	BEGINDATA
1071	db FIX_THE_END ; final entry.
1072	GLOBALNAME FixupsEnd
1073
1074	;;
1075	; The switcher definition structure.
1076	ALIGNDATA(16)
1077	GLOBALNAME Def
1078	istruc VMMSWITCHERDEF
1079	at VMMSWITCHERDEF.pvCode, RTCCPTR_DEF NAME(Start)
1080	at VMMSWITCHERDEF.pvFixups, RTCCPTR_DEF NAME(Fixups)
1081	at VMMSWITCHERDEF.pszDesc, RTCCPTR_DEF NAME(Description)
1082	at VMMSWITCHERDEF.pfnRelocate, RTCCPTR_DEF NAME(Relocate)
1083	at VMMSWITCHERDEF.enmType, dd VMMSWITCHER_AMD64_TO_PAE
1084	at VMMSWITCHERDEF.cbCode, dd NAME(End) - NAME(Start)
1085	at VMMSWITCHERDEF.offR0HostToGuest, dd NAME(vmmR0HostToGuest) - NAME(Start)
1086	at VMMSWITCHERDEF.offGCGuestToHost, dd NAME(vmmGCGuestToHost) - NAME(Start)
1087	at VMMSWITCHERDEF.offGCCallTrampoline, dd NAME(vmmGCCallTrampoline) - NAME(Start)
1088	at VMMSWITCHERDEF.offGCGuestToHostAsm, dd NAME(VMMGCGuestToHostAsm) - NAME(Start)
1089	at VMMSWITCHERDEF.offGCGuestToHostAsmHyperCtx, dd NAME(VMMGCGuestToHostAsmHyperCtx)- NAME(Start)
1090	at VMMSWITCHERDEF.offGCGuestToHostAsmGuestCtx, dd NAME(VMMGCGuestToHostAsmGuestCtx)- NAME(Start)
1091	; disasm help
1092	at VMMSWITCHERDEF.offHCCode0, dd 0
1093	at VMMSWITCHERDEF.cbHCCode0, dd NAME(IDEnterTarget) - NAME(Start)
1094	at VMMSWITCHERDEF.offHCCode1, dd NAME(HCExitTarget) - NAME(Start)
1095	at VMMSWITCHERDEF.cbHCCode1, dd NAME(End) - NAME(HCExitTarget)
1096	at VMMSWITCHERDEF.offIDCode0, dd NAME(IDEnterTarget) - NAME(Start)
1097	at VMMSWITCHERDEF.cbIDCode0, dd NAME(JmpGCTarget) - NAME(IDEnterTarget)
1098	at VMMSWITCHERDEF.offIDCode1, dd NAME(IDExitTarget) - NAME(Start)
1099	at VMMSWITCHERDEF.cbIDCode1, dd NAME(HCExitTarget) - NAME(IDExitTarget)
1100	at VMMSWITCHERDEF.offGCCode, dd NAME(JmpGCTarget) - NAME(Start)
1101	at VMMSWITCHERDEF.cbGCCode, dd NAME(IDExitTarget) - NAME(JmpGCTarget)
1102
1103	iend
1104

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMSwitcher/AMD64ToPAE.asm@ 5999

Download in other formats: