target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48 #include "qemu/osdep.h"
  49 #include "qemu-common.h"
  50 #include "qemu/error-report.h"
  51
  52 #include "sysemu/hvf.h"
  53 #include "hvf-i386.h"
  54 #include "vmcs.h"
  55 #include "vmx.h"
  56 #include "x86.h"
  57 #include "x86_descr.h"
  58 #include "x86_mmu.h"
  59 #include "x86_decode.h"
  60 #include "x86_emu.h"
  61 #include "x86_task.h"
  62 #include "x86hvf.h"
  63
  64 #include <Hypervisor/hv.h>
  65 #include <Hypervisor/hv_vmx.h>
  66
  67 #include "exec/address-spaces.h"
  68 #include "hw/i386/apic_internal.h"
  69 #include "qemu/main-loop.h"
  70 #include "sysemu/accel.h"
  71 #include "sysemu/sysemu.h"
  72 #include "target/i386/cpu.h"
  73
  74 HVFState *hvf_state;
  75
  76 static void assert_hvf_ok(hv_return_t ret)
  77 {
  78     if (ret == HV_SUCCESS) {
  79         return;
  80     }
  81
  82     switch (ret) {
  83     case HV_ERROR:
  84         error_report("Error: HV_ERROR");
  85         break;
  86     case HV_BUSY:
  87         error_report("Error: HV_BUSY");
  88         break;
  89     case HV_BAD_ARGUMENT:
  90         error_report("Error: HV_BAD_ARGUMENT");
  91         break;
  92     case HV_NO_RESOURCES:
  93         error_report("Error: HV_NO_RESOURCES");
  94         break;
  95     case HV_NO_DEVICE:
  96         error_report("Error: HV_NO_DEVICE");
  97         break;
  98     case HV_UNSUPPORTED:
  99         error_report("Error: HV_UNSUPPORTED");
 100         break;
 101     default:
 102         error_report("Unknown Error");
 103     }
 104
 105     abort();
 106 }
 107
 108 /* Memory slots */
 109 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t end)
 110 {
 111     hvf_slot *slot;
 112     int x;
 113     for (x = 0; x < hvf_state->num_slots; ++x) {
 114         slot = &hvf_state->slots[x];
 115         if (slot->size && start < (slot->start + slot->size) &&
 116             end > slot->start) {
 117             return slot;
 118         }
 119     }
 120     return NULL;
 121 }
 122
 123 struct mac_slot {
 124     int present;
 125     uint64_t size;
 126     uint64_t gpa_start;
 127     uint64_t gva;
 128 };
 129
 130 struct mac_slot mac_slots[32];
 131 #define ALIGN(x, y)  (((x) + (y) - 1) & ~((y) - 1))
 132
 133 static int do_hvf_set_memory(hvf_slot *slot)
 134 {
 135     struct mac_slot *macslot;
 136     hv_memory_flags_t flags;
 137     hv_return_t ret;
 138
 139     macslot = &mac_slots[slot->slot_id];
 140
 141     if (macslot->present) {
 142         if (macslot->size != slot->size) {
 143             macslot->present = 0;
 144             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 145             assert_hvf_ok(ret);
 146         }
 147     }
 148
 149     if (!slot->size) {
 150         return 0;
 151     }
 152
 153     flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 154
 155     macslot->present = 1;
 156     macslot->gpa_start = slot->start;
 157     macslot->size = slot->size;
 158     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 159     assert_hvf_ok(ret);
 160     return 0;
 161 }
 162
 163 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 164 {
 165     hvf_slot *mem;
 166     MemoryRegion *area = section->mr;
 167
 168     if (!memory_region_is_ram(area)) {
 169         return;
 170     }
 171
 172     mem = hvf_find_overlap_slot(
 173             section->offset_within_address_space,
 174             section->offset_within_address_space + int128_get64(section->size));
 175
 176     if (mem && add) {
 177         if (mem->size == int128_get64(section->size) &&
 178             mem->start == section->offset_within_address_space &&
 179             mem->mem == (memory_region_get_ram_ptr(area) +
 180             section->offset_within_region)) {
 181             return; /* Same region was attempted to register, go away. */
 182         }
 183     }
 184
 185     /* Region needs to be reset. set the size to 0 and remap it. */
 186     if (mem) {
 187         mem->size = 0;
 188         if (do_hvf_set_memory(mem)) {
 189             error_report("Failed to reset overlapping slot");
 190             abort();
 191         }
 192     }
 193
 194     if (!add) {
 195         return;
 196     }
 197
 198     /* Now make a new slot. */
 199     int x;
 200
 201     for (x = 0; x < hvf_state->num_slots; ++x) {
 202         mem = &hvf_state->slots[x];
 203         if (!mem->size) {
 204             break;
 205         }
 206     }
 207
 208     if (x == hvf_state->num_slots) {
 209         error_report("No free slots");
 210         abort();
 211     }
 212
 213     mem->size = int128_get64(section->size);
 214     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 215     mem->start = section->offset_within_address_space;
 216     mem->region = area;
 217
 218     if (do_hvf_set_memory(mem)) {
 219         error_report("Error registering new memory slot");
 220         abort();
 221     }
 222 }
 223
 224 void vmx_update_tpr(CPUState *cpu)
 225 {
 226     /* TODO: need integrate APIC handling */
 227     X86CPU *x86_cpu = X86_CPU(cpu);
 228     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 229     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 230
 231     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 232     if (irr == -1) {
 233         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 234     } else {
 235         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 236               irr >> 4);
 237     }
 238 }
 239
 240 void update_apic_tpr(CPUState *cpu)
 241 {
 242     X86CPU *x86_cpu = X86_CPU(cpu);
 243     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 244     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 245 }
 246
 247 #define VECTORING_INFO_VECTOR_MASK     0xff
 248
 249 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 250 {
 251     cpu->interrupt_request |= mask;
 252     if (!qemu_cpu_is_self(cpu)) {
 253         qemu_cpu_kick(cpu);
 254     }
 255 }
 256
 257 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 258                   int direction, int size, int count)
 259 {
 260     int i;
 261     uint8_t *ptr = buffer;
 262
 263     for (i = 0; i < count; i++) {
 264         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 265                          ptr, size,
 266                          direction);
 267         ptr += size;
 268     }
 269 }
 270
 271 /* TODO: synchronize vcpu state */
 272 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 273 {
 274     CPUState *cpu_state = cpu;
 275     if (cpu_state->vcpu_dirty == 0) {
 276         hvf_get_registers(cpu_state);
 277     }
 278
 279     cpu_state->vcpu_dirty = 1;
 280 }
 281
 282 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 283 {
 284     if (cpu_state->vcpu_dirty == 0) {
 285         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 286     }
 287 }
 288
 289 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 290 {
 291     CPUState *cpu_state = cpu;
 292     hvf_put_registers(cpu_state);
 293     cpu_state->vcpu_dirty = false;
 294 }
 295
 296 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
 297 {
 298     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 299 }
 300
 301 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 302 {
 303     CPUState *cpu_state = cpu;
 304     hvf_put_registers(cpu_state);
 305     cpu_state->vcpu_dirty = false;
 306 }
 307
 308 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
 309 {
 310     run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 311 }
 312
 313 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 314 {
 315     int read, write;
 316
 317     /* EPT fault on an instruction fetch doesn't make sense here */
 318     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 319         return false;
 320     }
 321
 322     /* EPT fault must be a read fault or a write fault */
 323     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 324     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 325     if ((read | write) == 0) {
 326         return false;
 327     }
 328
 329     if (write && slot) {
 330         if (slot->flags & HVF_SLOT_LOG) {
 331             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 332             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 333                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 334         }
 335     }
 336
 337     /*
 338      * The EPT violation must have been caused by accessing a
 339      * guest-physical address that is a translation of a guest-linear
 340      * address.
 341      */
 342     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 343         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 344         return false;
 345     }
 346
 347     return !slot;
 348 }
 349
 350 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 351 {
 352     hvf_slot *slot;
 353
 354     slot = hvf_find_overlap_slot(
 355             section->offset_within_address_space,
 356             section->offset_within_address_space + int128_get64(section->size));
 357
 358     /* protect region against writes; begin tracking it */
 359     if (on) {
 360         slot->flags |= HVF_SLOT_LOG;
 361         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 362                       HV_MEMORY_READ);
 363     /* stop tracking region*/
 364     } else {
 365         slot->flags &= ~HVF_SLOT_LOG;
 366         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 367                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 368     }
 369 }
 370
 371 static void hvf_log_start(MemoryListener *listener,
 372                           MemoryRegionSection *section, int old, int new)
 373 {
 374     if (old != 0) {
 375         return;
 376     }
 377
 378     hvf_set_dirty_tracking(section, 1);
 379 }
 380
 381 static void hvf_log_stop(MemoryListener *listener,
 382                          MemoryRegionSection *section, int old, int new)
 383 {
 384     if (new != 0) {
 385         return;
 386     }
 387
 388     hvf_set_dirty_tracking(section, 0);
 389 }
 390
 391 static void hvf_log_sync(MemoryListener *listener,
 392                          MemoryRegionSection *section)
 393 {
 394     /*
 395      * sync of dirty pages is handled elsewhere; just make sure we keep
 396      * tracking the region.
 397      */
 398     hvf_set_dirty_tracking(section, 1);
 399 }
 400
 401 static void hvf_region_add(MemoryListener *listener,
 402                            MemoryRegionSection *section)
 403 {
 404     hvf_set_phys_mem(section, true);
 405 }
 406
 407 static void hvf_region_del(MemoryListener *listener,
 408                            MemoryRegionSection *section)
 409 {
 410     hvf_set_phys_mem(section, false);
 411 }
 412
 413 static MemoryListener hvf_memory_listener = {
 414     .priority = 10,
 415     .region_add = hvf_region_add,
 416     .region_del = hvf_region_del,
 417     .log_start = hvf_log_start,
 418     .log_stop = hvf_log_stop,
 419     .log_sync = hvf_log_sync,
 420 };
 421
 422 void hvf_reset_vcpu(CPUState *cpu) {
 423
 424     /* TODO: this shouldn't be needed; there is already a call to
 425      * cpu_synchronize_all_post_reset in vl.c
 426      */
 427     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
 428     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
 429     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
 430
 431     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
 432     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
 433     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
 434
 435     /* set VMCS guest state fields */
 436     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
 437     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
 438     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
 439     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
 440
 441     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
 442     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
 443     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
 444     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
 445
 446     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
 447     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
 448     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
 449     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
 450
 451     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
 452     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
 453     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
 454     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
 455
 456     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
 457     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
 458     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
 459     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
 460
 461     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
 462     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
 463     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
 464     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
 465
 466     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
 467     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
 468     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
 469     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
 470
 471     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
 472     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
 473     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
 474     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
 475
 476     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
 477     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
 478
 479     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
 480     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
 481
 482     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
 483     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
 484
 485     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
 486     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
 487     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
 488     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
 489     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
 490     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
 491     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
 492     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
 493     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
 494     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
 495
 496     for (int i = 0; i < 8; i++) {
 497         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
 498     }
 499
 500     hv_vm_sync_tsc(0);
 501     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
 502     hv_vcpu_flush(cpu->hvf_fd);
 503 }
 504
 505 void hvf_vcpu_destroy(CPUState *cpu)
 506 {
 507     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 508     assert_hvf_ok(ret);
 509 }
 510
 511 static void dummy_signal(int sig)
 512 {
 513 }
 514
 515 int hvf_init_vcpu(CPUState *cpu)
 516 {
 517
 518     X86CPU *x86cpu = X86_CPU(cpu);
 519     CPUX86State *env = &x86cpu->env;
 520     int r;
 521
 522     /* init cpu signals */
 523     sigset_t set;
 524     struct sigaction sigact;
 525
 526     memset(&sigact, 0, sizeof(sigact));
 527     sigact.sa_handler = dummy_signal;
 528     sigaction(SIG_IPI, &sigact, NULL);
 529
 530     pthread_sigmask(SIG_BLOCK, NULL, &set);
 531     sigdelset(&set, SIG_IPI);
 532
 533     init_emu();
 534     init_decoder();
 535
 536     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 537     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
 538
 539     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 540     cpu->vcpu_dirty = 1;
 541     assert_hvf_ok(r);
 542
 543     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 544         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 545         abort();
 546     }
 547     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 548         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 549         abort();
 550     }
 551     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 552         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 553         abort();
 554     }
 555     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 556         &hvf_state->hvf_caps->vmx_cap_entry)) {
 557         abort();
 558     }
 559
 560     /* set VMCS control fields */
 561     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 562           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 563           VMCS_PIN_BASED_CTLS_EXTINT |
 564           VMCS_PIN_BASED_CTLS_NMI |
 565           VMCS_PIN_BASED_CTLS_VNMI));
 566     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 567           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 568           VMCS_PRI_PROC_BASED_CTLS_HLT |
 569           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 570           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 571           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 572           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 573     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 574           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 575                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 576
 577     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 578           0));
 579     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 580
 581     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 582
 583     x86cpu = X86_CPU(cpu);
 584     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 585
 586     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 587     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 588     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 589     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 590     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 591     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 592     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 593     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 594     /*hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);*/
 595     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 596     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 597     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 598
 599     return 0;
 600 }
 601
 602 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 603 {
 604     X86CPU *x86_cpu = X86_CPU(cpu);
 605     CPUX86State *env = &x86_cpu->env;
 606
 607     env->exception_nr = -1;
 608     env->exception_pending = 0;
 609     env->exception_injected = 0;
 610     env->interrupt_injected = -1;
 611     env->nmi_injected = false;
 612     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 613         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 614         case VMCS_IDT_VEC_HWINTR:
 615         case VMCS_IDT_VEC_SWINTR:
 616             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 617             break;
 618         case VMCS_IDT_VEC_NMI:
 619             env->nmi_injected = true;
 620             break;
 621         case VMCS_IDT_VEC_HWEXCEPTION:
 622         case VMCS_IDT_VEC_SWEXCEPTION:
 623             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 624             env->exception_injected = 1;
 625             break;
 626         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 627         default:
 628             abort();
 629         }
 630         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 631             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 632             env->ins_len = ins_len;
 633         }
 634         if (idtvec_info & VMCS_INTR_DEL_ERRCODE) {
 635             env->has_error_code = true;
 636             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 637         }
 638     }
 639     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 640         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 641         env->hflags2 |= HF2_NMI_MASK;
 642     } else {
 643         env->hflags2 &= ~HF2_NMI_MASK;
 644     }
 645     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 646          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 647          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 648         env->hflags |= HF_INHIBIT_IRQ_MASK;
 649     } else {
 650         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 651     }
 652 }
 653
 654 int hvf_vcpu_exec(CPUState *cpu)
 655 {
 656     X86CPU *x86_cpu = X86_CPU(cpu);
 657     CPUX86State *env = &x86_cpu->env;
 658     int ret = 0;
 659     uint64_t rip = 0;
 660
 661     if (hvf_process_events(cpu)) {
 662         return EXCP_HLT;
 663     }
 664
 665     do {
 666         if (cpu->vcpu_dirty) {
 667             hvf_put_registers(cpu);
 668             cpu->vcpu_dirty = false;
 669         }
 670
 671         if (hvf_inject_interrupts(cpu)) {
 672             return EXCP_INTERRUPT;
 673         }
 674         vmx_update_tpr(cpu);
 675
 676         qemu_mutex_unlock_iothread();
 677         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 678             qemu_mutex_lock_iothread();
 679             return EXCP_HLT;
 680         }
 681
 682         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 683         assert_hvf_ok(r);
 684
 685         /* handle VMEXIT */
 686         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 687         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 688         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 689                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 690
 691         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 692
 693         hvf_store_events(cpu, ins_len, idtvec_info);
 694         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 695         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 696         env->eflags = RFLAGS(env);
 697
 698         qemu_mutex_lock_iothread();
 699
 700         update_apic_tpr(cpu);
 701         current_cpu = cpu;
 702
 703         ret = 0;
 704         switch (exit_reason) {
 705         case EXIT_REASON_HLT: {
 706             macvm_set_rip(cpu, rip + ins_len);
 707             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 708                 (EFLAGS(env) & IF_MASK))
 709                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 710                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 711                 cpu->halted = 1;
 712                 ret = EXCP_HLT;
 713                 break;
 714             }
 715             ret = EXCP_INTERRUPT;
 716             break;
 717         }
 718         case EXIT_REASON_MWAIT: {
 719             ret = EXCP_INTERRUPT;
 720             break;
 721         }
 722             /* Need to check if MMIO or unmmaped fault */
 723         case EXIT_REASON_EPT_FAULT:
 724         {
 725             hvf_slot *slot;
 726             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 727
 728             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 729                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 730                 vmx_set_nmi_blocking(cpu);
 731             }
 732
 733             slot = hvf_find_overlap_slot(gpa, gpa);
 734             /* mmio */
 735             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 736                 struct x86_decode decode;
 737
 738                 load_regs(cpu);
 739                 env->hvf_emul->fetch_rip = rip;
 740
 741                 decode_instruction(env, &decode);
 742                 exec_instruction(env, &decode);
 743                 store_regs(cpu);
 744                 break;
 745             }
 746             break;
 747         }
 748         case EXIT_REASON_INOUT:
 749         {
 750             uint32_t in = (exit_qual & 8) != 0;
 751             uint32_t size =  (exit_qual & 7) + 1;
 752             uint32_t string =  (exit_qual & 16) != 0;
 753             uint32_t port =  exit_qual >> 16;
 754             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 755
 756             if (!string && in) {
 757                 uint64_t val = 0;
 758                 load_regs(cpu);
 759                 hvf_handle_io(env, port, &val, 0, size, 1);
 760                 if (size == 1) {
 761                     AL(env) = val;
 762                 } else if (size == 2) {
 763                     AX(env) = val;
 764                 } else if (size == 4) {
 765                     RAX(env) = (uint32_t)val;
 766                 } else {
 767                     RAX(env) = (uint64_t)val;
 768                 }
 769                 RIP(env) += ins_len;
 770                 store_regs(cpu);
 771                 break;
 772             } else if (!string && !in) {
 773                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 774                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 775                 macvm_set_rip(cpu, rip + ins_len);
 776                 break;
 777             }
 778             struct x86_decode decode;
 779
 780             load_regs(cpu);
 781             env->hvf_emul->fetch_rip = rip;
 782
 783             decode_instruction(env, &decode);
 784             assert(ins_len == decode.len);
 785             exec_instruction(env, &decode);
 786             store_regs(cpu);
 787
 788             break;
 789         }
 790         case EXIT_REASON_CPUID: {
 791             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 792             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 793             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 794             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 795
 796             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 797
 798             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 799             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 800             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 801             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 802
 803             macvm_set_rip(cpu, rip + ins_len);
 804             break;
 805         }
 806         case EXIT_REASON_XSETBV: {
 807             X86CPU *x86_cpu = X86_CPU(cpu);
 808             CPUX86State *env = &x86_cpu->env;
 809             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 810             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 811             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 812
 813             if (ecx) {
 814                 macvm_set_rip(cpu, rip + ins_len);
 815                 break;
 816             }
 817             env->xcr0 = ((uint64_t)edx << 32) | eax;
 818             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 819             macvm_set_rip(cpu, rip + ins_len);
 820             break;
 821         }
 822         case EXIT_REASON_INTR_WINDOW:
 823             vmx_clear_int_window_exiting(cpu);
 824             ret = EXCP_INTERRUPT;
 825             break;
 826         case EXIT_REASON_NMI_WINDOW:
 827             vmx_clear_nmi_window_exiting(cpu);
 828             ret = EXCP_INTERRUPT;
 829             break;
 830         case EXIT_REASON_EXT_INTR:
 831             /* force exit and allow io handling */
 832             ret = EXCP_INTERRUPT;
 833             break;
 834         case EXIT_REASON_RDMSR:
 835         case EXIT_REASON_WRMSR:
 836         {
 837             load_regs(cpu);
 838             if (exit_reason == EXIT_REASON_RDMSR) {
 839                 simulate_rdmsr(cpu);
 840             } else {
 841                 simulate_wrmsr(cpu);
 842             }
 843             RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
 844             store_regs(cpu);
 845             break;
 846         }
 847         case EXIT_REASON_CR_ACCESS: {
 848             int cr;
 849             int reg;
 850
 851             load_regs(cpu);
 852             cr = exit_qual & 15;
 853             reg = (exit_qual >> 8) & 15;
 854
 855             switch (cr) {
 856             case 0x0: {
 857                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 858                 break;
 859             }
 860             case 4: {
 861                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 862                 break;
 863             }
 864             case 8: {
 865                 X86CPU *x86_cpu = X86_CPU(cpu);
 866                 if (exit_qual & 0x10) {
 867                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 868                 } else {
 869                     int tpr = RRX(env, reg);
 870                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 871                     ret = EXCP_INTERRUPT;
 872                 }
 873                 break;
 874             }
 875             default:
 876                 error_report("Unrecognized CR %d", cr);
 877                 abort();
 878             }
 879             RIP(env) += ins_len;
 880             store_regs(cpu);
 881             break;
 882         }
 883         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 884             struct x86_decode decode;
 885
 886             load_regs(cpu);
 887             env->hvf_emul->fetch_rip = rip;
 888
 889             decode_instruction(env, &decode);
 890             exec_instruction(env, &decode);
 891             store_regs(cpu);
 892             break;
 893         }
 894         case EXIT_REASON_TPR: {
 895             ret = 1;
 896             break;
 897         }
 898         case EXIT_REASON_TASK_SWITCH: {
 899             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 900             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 901             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 902              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 903              & VMCS_INTR_T_MASK);
 904             break;
 905         }
 906         case EXIT_REASON_TRIPLE_FAULT: {
 907             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 908             ret = EXCP_INTERRUPT;
 909             break;
 910         }
 911         case EXIT_REASON_RDPMC:
 912             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 913             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 914             macvm_set_rip(cpu, rip + ins_len);
 915             break;
 916         case VMX_REASON_VMCALL:
 917             env->exception_nr = EXCP0D_GPF;
 918             env->exception_injected = 1;
 919             env->has_error_code = true;
 920             env->error_code = 0;
 921             break;
 922         default:
 923             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 924         }
 925     } while (ret == 0);
 926
 927     return ret;
 928 }
 929
 930 bool hvf_allowed;
 931
 932 static int hvf_accel_init(MachineState *ms)
 933 {
 934     int x;
 935     hv_return_t ret;
 936     HVFState *s;
 937
 938     ret = hv_vm_create(HV_VM_DEFAULT);
 939     assert_hvf_ok(ret);
 940
 941     s = g_new0(HVFState, 1);
 942
 943     s->num_slots = 32;
 944     for (x = 0; x < s->num_slots; ++x) {
 945         s->slots[x].size = 0;
 946         s->slots[x].slot_id = x;
 947     }
 948
 949     hvf_state = s;
 950     cpu_interrupt_handler = hvf_handle_interrupt;
 951     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 952     return 0;
 953 }
 954
 955 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 956 {
 957     AccelClass *ac = ACCEL_CLASS(oc);
 958     ac->name = "HVF";
 959     ac->init_machine = hvf_accel_init;
 960     ac->allowed = &hvf_allowed;
 961 }
 962
 963 static const TypeInfo hvf_accel_type = {
 964     .name = TYPE_HVF_ACCEL,
 965     .parent = TYPE_ACCEL,
 966     .class_init = hvf_accel_class_init,
 967 };
 968
 969 static void hvf_type_init(void)
 970 {
 971     type_register_static(&hvf_accel_type);
 972 }
 973
 974 type_init(hvf_type_init);