target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu-common.h"
  51 #include "qemu/error-report.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/runstate.h"
  55 #include "hvf-i386.h"
  56 #include "vmcs.h"
  57 #include "vmx.h"
  58 #include "x86.h"
  59 #include "x86_descr.h"
  60 #include "x86_mmu.h"
  61 #include "x86_decode.h"
  62 #include "x86_emu.h"
  63 #include "x86_task.h"
  64 #include "x86hvf.h"
  65
  66 #include <Hypervisor/hv.h>
  67 #include <Hypervisor/hv_vmx.h>
  68
  69 #include "exec/address-spaces.h"
  70 #include "hw/i386/apic_internal.h"
  71 #include "qemu/main-loop.h"
  72 #include "sysemu/accel.h"
  73 #include "target/i386/cpu.h"
  74
  75 HVFState *hvf_state;
  76
  77 static void assert_hvf_ok(hv_return_t ret)
  78 {
  79     if (ret == HV_SUCCESS) {
  80         return;
  81     }
  82
  83     switch (ret) {
  84     case HV_ERROR:
  85         error_report("Error: HV_ERROR");
  86         break;
  87     case HV_BUSY:
  88         error_report("Error: HV_BUSY");
  89         break;
  90     case HV_BAD_ARGUMENT:
  91         error_report("Error: HV_BAD_ARGUMENT");
  92         break;
  93     case HV_NO_RESOURCES:
  94         error_report("Error: HV_NO_RESOURCES");
  95         break;
  96     case HV_NO_DEVICE:
  97         error_report("Error: HV_NO_DEVICE");
  98         break;
  99     case HV_UNSUPPORTED:
 100         error_report("Error: HV_UNSUPPORTED");
 101         break;
 102     default:
 103         error_report("Unknown Error");
 104     }
 105
 106     abort();
 107 }
 108
 109 /* Memory slots */
 110 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 111 {
 112     hvf_slot *slot;
 113     int x;
 114     for (x = 0; x < hvf_state->num_slots; ++x) {
 115         slot = &hvf_state->slots[x];
 116         if (slot->size && start < (slot->start + slot->size) &&
 117             (start + size) > slot->start) {
 118             return slot;
 119         }
 120     }
 121     return NULL;
 122 }
 123
 124 struct mac_slot {
 125     int present;
 126     uint64_t size;
 127     uint64_t gpa_start;
 128     uint64_t gva;
 129 };
 130
 131 struct mac_slot mac_slots[32];
 132
 133 static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
 134 {
 135     struct mac_slot *macslot;
 136     hv_return_t ret;
 137
 138     macslot = &mac_slots[slot->slot_id];
 139
 140     if (macslot->present) {
 141         if (macslot->size != slot->size) {
 142             macslot->present = 0;
 143             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 144             assert_hvf_ok(ret);
 145         }
 146     }
 147
 148     if (!slot->size) {
 149         return 0;
 150     }
 151
 152     macslot->present = 1;
 153     macslot->gpa_start = slot->start;
 154     macslot->size = slot->size;
 155     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 156     assert_hvf_ok(ret);
 157     return 0;
 158 }
 159
 160 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 161 {
 162     hvf_slot *mem;
 163     MemoryRegion *area = section->mr;
 164     bool writeable = !area->readonly && !area->rom_device;
 165     hv_memory_flags_t flags;
 166
 167     if (!memory_region_is_ram(area)) {
 168         if (writeable) {
 169             return;
 170         } else if (!memory_region_is_romd(area)) {
 171             /*
 172              * If the memory device is not in romd_mode, then we actually want
 173              * to remove the hvf memory slot so all accesses will trap.
 174              */
 175              add = false;
 176         }
 177     }
 178
 179     mem = hvf_find_overlap_slot(
 180             section->offset_within_address_space,
 181             int128_get64(section->size));
 182
 183     if (mem && add) {
 184         if (mem->size == int128_get64(section->size) &&
 185             mem->start == section->offset_within_address_space &&
 186             mem->mem == (memory_region_get_ram_ptr(area) +
 187             section->offset_within_region)) {
 188             return; /* Same region was attempted to register, go away. */
 189         }
 190     }
 191
 192     /* Region needs to be reset. set the size to 0 and remap it. */
 193     if (mem) {
 194         mem->size = 0;
 195         if (do_hvf_set_memory(mem, 0)) {
 196             error_report("Failed to reset overlapping slot");
 197             abort();
 198         }
 199     }
 200
 201     if (!add) {
 202         return;
 203     }
 204
 205     if (area->readonly ||
 206         (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
 207         flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
 208     } else {
 209         flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 210     }
 211
 212     /* Now make a new slot. */
 213     int x;
 214
 215     for (x = 0; x < hvf_state->num_slots; ++x) {
 216         mem = &hvf_state->slots[x];
 217         if (!mem->size) {
 218             break;
 219         }
 220     }
 221
 222     if (x == hvf_state->num_slots) {
 223         error_report("No free slots");
 224         abort();
 225     }
 226
 227     mem->size = int128_get64(section->size);
 228     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 229     mem->start = section->offset_within_address_space;
 230     mem->region = area;
 231
 232     if (do_hvf_set_memory(mem, flags)) {
 233         error_report("Error registering new memory slot");
 234         abort();
 235     }
 236 }
 237
 238 void vmx_update_tpr(CPUState *cpu)
 239 {
 240     /* TODO: need integrate APIC handling */
 241     X86CPU *x86_cpu = X86_CPU(cpu);
 242     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 243     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 244
 245     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 246     if (irr == -1) {
 247         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 248     } else {
 249         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 250               irr >> 4);
 251     }
 252 }
 253
 254 static void update_apic_tpr(CPUState *cpu)
 255 {
 256     X86CPU *x86_cpu = X86_CPU(cpu);
 257     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 258     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 259 }
 260
 261 #define VECTORING_INFO_VECTOR_MASK     0xff
 262
 263 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 264 {
 265     cpu->interrupt_request |= mask;
 266     if (!qemu_cpu_is_self(cpu)) {
 267         qemu_cpu_kick(cpu);
 268     }
 269 }
 270
 271 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 272                   int direction, int size, int count)
 273 {
 274     int i;
 275     uint8_t *ptr = buffer;
 276
 277     for (i = 0; i < count; i++) {
 278         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 279                          ptr, size,
 280                          direction);
 281         ptr += size;
 282     }
 283 }
 284
 285 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 286 {
 287     if (!cpu->vcpu_dirty) {
 288         hvf_get_registers(cpu);
 289         cpu->vcpu_dirty = true;
 290     }
 291 }
 292
 293 void hvf_cpu_synchronize_state(CPUState *cpu)
 294 {
 295     if (!cpu->vcpu_dirty) {
 296         run_on_cpu(cpu, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 297     }
 298 }
 299
 300 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu,
 301                                               run_on_cpu_data arg)
 302 {
 303     hvf_put_registers(cpu);
 304     cpu->vcpu_dirty = false;
 305 }
 306
 307 void hvf_cpu_synchronize_post_reset(CPUState *cpu)
 308 {
 309     run_on_cpu(cpu, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 310 }
 311
 312 static void do_hvf_cpu_synchronize_post_init(CPUState *cpu,
 313                                              run_on_cpu_data arg)
 314 {
 315     hvf_put_registers(cpu);
 316     cpu->vcpu_dirty = false;
 317 }
 318
 319 void hvf_cpu_synchronize_post_init(CPUState *cpu)
 320 {
 321     run_on_cpu(cpu, do_hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 322 }
 323
 324 static void do_hvf_cpu_synchronize_pre_loadvm(CPUState *cpu,
 325                                               run_on_cpu_data arg)
 326 {
 327     cpu->vcpu_dirty = true;
 328 }
 329
 330 void hvf_cpu_synchronize_pre_loadvm(CPUState *cpu)
 331 {
 332     run_on_cpu(cpu, do_hvf_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL);
 333 }
 334
 335 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 336 {
 337     int read, write;
 338
 339     /* EPT fault on an instruction fetch doesn't make sense here */
 340     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 341         return false;
 342     }
 343
 344     /* EPT fault must be a read fault or a write fault */
 345     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 346     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 347     if ((read | write) == 0) {
 348         return false;
 349     }
 350
 351     if (write && slot) {
 352         if (slot->flags & HVF_SLOT_LOG) {
 353             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 354             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 355                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 356         }
 357     }
 358
 359     /*
 360      * The EPT violation must have been caused by accessing a
 361      * guest-physical address that is a translation of a guest-linear
 362      * address.
 363      */
 364     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 365         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 366         return false;
 367     }
 368
 369     if (!slot) {
 370         return true;
 371     }
 372     if (!memory_region_is_ram(slot->region) &&
 373         !(read && memory_region_is_romd(slot->region))) {
 374         return true;
 375     }
 376     return false;
 377 }
 378
 379 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 380 {
 381     hvf_slot *slot;
 382
 383     slot = hvf_find_overlap_slot(
 384             section->offset_within_address_space,
 385             int128_get64(section->size));
 386
 387     /* protect region against writes; begin tracking it */
 388     if (on) {
 389         slot->flags |= HVF_SLOT_LOG;
 390         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 391                       HV_MEMORY_READ);
 392     /* stop tracking region*/
 393     } else {
 394         slot->flags &= ~HVF_SLOT_LOG;
 395         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 396                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 397     }
 398 }
 399
 400 static void hvf_log_start(MemoryListener *listener,
 401                           MemoryRegionSection *section, int old, int new)
 402 {
 403     if (old != 0) {
 404         return;
 405     }
 406
 407     hvf_set_dirty_tracking(section, 1);
 408 }
 409
 410 static void hvf_log_stop(MemoryListener *listener,
 411                          MemoryRegionSection *section, int old, int new)
 412 {
 413     if (new != 0) {
 414         return;
 415     }
 416
 417     hvf_set_dirty_tracking(section, 0);
 418 }
 419
 420 static void hvf_log_sync(MemoryListener *listener,
 421                          MemoryRegionSection *section)
 422 {
 423     /*
 424      * sync of dirty pages is handled elsewhere; just make sure we keep
 425      * tracking the region.
 426      */
 427     hvf_set_dirty_tracking(section, 1);
 428 }
 429
 430 static void hvf_region_add(MemoryListener *listener,
 431                            MemoryRegionSection *section)
 432 {
 433     hvf_set_phys_mem(section, true);
 434 }
 435
 436 static void hvf_region_del(MemoryListener *listener,
 437                            MemoryRegionSection *section)
 438 {
 439     hvf_set_phys_mem(section, false);
 440 }
 441
 442 static MemoryListener hvf_memory_listener = {
 443     .priority = 10,
 444     .region_add = hvf_region_add,
 445     .region_del = hvf_region_del,
 446     .log_start = hvf_log_start,
 447     .log_stop = hvf_log_stop,
 448     .log_sync = hvf_log_sync,
 449 };
 450
 451 void hvf_vcpu_destroy(CPUState *cpu)
 452 {
 453     X86CPU *x86_cpu = X86_CPU(cpu);
 454     CPUX86State *env = &x86_cpu->env;
 455
 456     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 457     g_free(env->hvf_mmio_buf);
 458     assert_hvf_ok(ret);
 459 }
 460
 461 static void dummy_signal(int sig)
 462 {
 463 }
 464
 465 int hvf_init_vcpu(CPUState *cpu)
 466 {
 467
 468     X86CPU *x86cpu = X86_CPU(cpu);
 469     CPUX86State *env = &x86cpu->env;
 470     int r;
 471
 472     /* init cpu signals */
 473     sigset_t set;
 474     struct sigaction sigact;
 475
 476     memset(&sigact, 0, sizeof(sigact));
 477     sigact.sa_handler = dummy_signal;
 478     sigaction(SIG_IPI, &sigact, NULL);
 479
 480     pthread_sigmask(SIG_BLOCK, NULL, &set);
 481     sigdelset(&set, SIG_IPI);
 482
 483     init_emu();
 484     init_decoder();
 485
 486     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 487     env->hvf_mmio_buf = g_new(char, 4096);
 488
 489     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 490     cpu->vcpu_dirty = 1;
 491     assert_hvf_ok(r);
 492
 493     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 494         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 495         abort();
 496     }
 497     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 498         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 499         abort();
 500     }
 501     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 502         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 503         abort();
 504     }
 505     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 506         &hvf_state->hvf_caps->vmx_cap_entry)) {
 507         abort();
 508     }
 509
 510     /* set VMCS control fields */
 511     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 512           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 513           VMCS_PIN_BASED_CTLS_EXTINT |
 514           VMCS_PIN_BASED_CTLS_NMI |
 515           VMCS_PIN_BASED_CTLS_VNMI));
 516     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 517           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 518           VMCS_PRI_PROC_BASED_CTLS_HLT |
 519           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 520           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 521           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 522           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 523     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 524           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 525                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 526
 527     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 528           0));
 529     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 530
 531     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 532
 533     x86cpu = X86_CPU(cpu);
 534     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 535
 536     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 537     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 538     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 539     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 540     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 541     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 542     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 543     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 544     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
 545     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 546     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 547     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 548
 549     return 0;
 550 }
 551
 552 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 553 {
 554     X86CPU *x86_cpu = X86_CPU(cpu);
 555     CPUX86State *env = &x86_cpu->env;
 556
 557     env->exception_nr = -1;
 558     env->exception_pending = 0;
 559     env->exception_injected = 0;
 560     env->interrupt_injected = -1;
 561     env->nmi_injected = false;
 562     env->ins_len = 0;
 563     env->has_error_code = false;
 564     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 565         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 566         case VMCS_IDT_VEC_HWINTR:
 567         case VMCS_IDT_VEC_SWINTR:
 568             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 569             break;
 570         case VMCS_IDT_VEC_NMI:
 571             env->nmi_injected = true;
 572             break;
 573         case VMCS_IDT_VEC_HWEXCEPTION:
 574         case VMCS_IDT_VEC_SWEXCEPTION:
 575             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 576             env->exception_injected = 1;
 577             break;
 578         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 579         default:
 580             abort();
 581         }
 582         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 583             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 584             env->ins_len = ins_len;
 585         }
 586         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 587             env->has_error_code = true;
 588             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 589         }
 590     }
 591     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 592         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 593         env->hflags2 |= HF2_NMI_MASK;
 594     } else {
 595         env->hflags2 &= ~HF2_NMI_MASK;
 596     }
 597     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 598          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 599          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 600         env->hflags |= HF_INHIBIT_IRQ_MASK;
 601     } else {
 602         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 603     }
 604 }
 605
 606 int hvf_vcpu_exec(CPUState *cpu)
 607 {
 608     X86CPU *x86_cpu = X86_CPU(cpu);
 609     CPUX86State *env = &x86_cpu->env;
 610     int ret = 0;
 611     uint64_t rip = 0;
 612
 613     if (hvf_process_events(cpu)) {
 614         return EXCP_HLT;
 615     }
 616
 617     do {
 618         if (cpu->vcpu_dirty) {
 619             hvf_put_registers(cpu);
 620             cpu->vcpu_dirty = false;
 621         }
 622
 623         if (hvf_inject_interrupts(cpu)) {
 624             return EXCP_INTERRUPT;
 625         }
 626         vmx_update_tpr(cpu);
 627
 628         qemu_mutex_unlock_iothread();
 629         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 630             qemu_mutex_lock_iothread();
 631             return EXCP_HLT;
 632         }
 633
 634         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 635         assert_hvf_ok(r);
 636
 637         /* handle VMEXIT */
 638         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 639         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 640         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 641                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 642
 643         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 644
 645         hvf_store_events(cpu, ins_len, idtvec_info);
 646         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 647         env->eflags = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 648
 649         qemu_mutex_lock_iothread();
 650
 651         update_apic_tpr(cpu);
 652         current_cpu = cpu;
 653
 654         ret = 0;
 655         switch (exit_reason) {
 656         case EXIT_REASON_HLT: {
 657             macvm_set_rip(cpu, rip + ins_len);
 658             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 659                 (env->eflags & IF_MASK))
 660                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 661                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 662                 cpu->halted = 1;
 663                 ret = EXCP_HLT;
 664                 break;
 665             }
 666             ret = EXCP_INTERRUPT;
 667             break;
 668         }
 669         case EXIT_REASON_MWAIT: {
 670             ret = EXCP_INTERRUPT;
 671             break;
 672         }
 673         /* Need to check if MMIO or unmapped fault */
 674         case EXIT_REASON_EPT_FAULT:
 675         {
 676             hvf_slot *slot;
 677             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 678
 679             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 680                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 681                 vmx_set_nmi_blocking(cpu);
 682             }
 683
 684             slot = hvf_find_overlap_slot(gpa, 1);
 685             /* mmio */
 686             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 687                 struct x86_decode decode;
 688
 689                 load_regs(cpu);
 690                 decode_instruction(env, &decode);
 691                 exec_instruction(env, &decode);
 692                 store_regs(cpu);
 693                 break;
 694             }
 695             break;
 696         }
 697         case EXIT_REASON_INOUT:
 698         {
 699             uint32_t in = (exit_qual & 8) != 0;
 700             uint32_t size =  (exit_qual & 7) + 1;
 701             uint32_t string =  (exit_qual & 16) != 0;
 702             uint32_t port =  exit_qual >> 16;
 703             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 704
 705             if (!string && in) {
 706                 uint64_t val = 0;
 707                 load_regs(cpu);
 708                 hvf_handle_io(env, port, &val, 0, size, 1);
 709                 if (size == 1) {
 710                     AL(env) = val;
 711                 } else if (size == 2) {
 712                     AX(env) = val;
 713                 } else if (size == 4) {
 714                     RAX(env) = (uint32_t)val;
 715                 } else {
 716                     RAX(env) = (uint64_t)val;
 717                 }
 718                 env->eip += ins_len;
 719                 store_regs(cpu);
 720                 break;
 721             } else if (!string && !in) {
 722                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 723                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 724                 macvm_set_rip(cpu, rip + ins_len);
 725                 break;
 726             }
 727             struct x86_decode decode;
 728
 729             load_regs(cpu);
 730             decode_instruction(env, &decode);
 731             assert(ins_len == decode.len);
 732             exec_instruction(env, &decode);
 733             store_regs(cpu);
 734
 735             break;
 736         }
 737         case EXIT_REASON_CPUID: {
 738             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 739             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 740             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 741             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 742
 743             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 744
 745             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 746             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 747             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 748             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 749
 750             macvm_set_rip(cpu, rip + ins_len);
 751             break;
 752         }
 753         case EXIT_REASON_XSETBV: {
 754             X86CPU *x86_cpu = X86_CPU(cpu);
 755             CPUX86State *env = &x86_cpu->env;
 756             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 757             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 758             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 759
 760             if (ecx) {
 761                 macvm_set_rip(cpu, rip + ins_len);
 762                 break;
 763             }
 764             env->xcr0 = ((uint64_t)edx << 32) | eax;
 765             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 766             macvm_set_rip(cpu, rip + ins_len);
 767             break;
 768         }
 769         case EXIT_REASON_INTR_WINDOW:
 770             vmx_clear_int_window_exiting(cpu);
 771             ret = EXCP_INTERRUPT;
 772             break;
 773         case EXIT_REASON_NMI_WINDOW:
 774             vmx_clear_nmi_window_exiting(cpu);
 775             ret = EXCP_INTERRUPT;
 776             break;
 777         case EXIT_REASON_EXT_INTR:
 778             /* force exit and allow io handling */
 779             ret = EXCP_INTERRUPT;
 780             break;
 781         case EXIT_REASON_RDMSR:
 782         case EXIT_REASON_WRMSR:
 783         {
 784             load_regs(cpu);
 785             if (exit_reason == EXIT_REASON_RDMSR) {
 786                 simulate_rdmsr(cpu);
 787             } else {
 788                 simulate_wrmsr(cpu);
 789             }
 790             env->eip += ins_len;
 791             store_regs(cpu);
 792             break;
 793         }
 794         case EXIT_REASON_CR_ACCESS: {
 795             int cr;
 796             int reg;
 797
 798             load_regs(cpu);
 799             cr = exit_qual & 15;
 800             reg = (exit_qual >> 8) & 15;
 801
 802             switch (cr) {
 803             case 0x0: {
 804                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 805                 break;
 806             }
 807             case 4: {
 808                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 809                 break;
 810             }
 811             case 8: {
 812                 X86CPU *x86_cpu = X86_CPU(cpu);
 813                 if (exit_qual & 0x10) {
 814                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 815                 } else {
 816                     int tpr = RRX(env, reg);
 817                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 818                     ret = EXCP_INTERRUPT;
 819                 }
 820                 break;
 821             }
 822             default:
 823                 error_report("Unrecognized CR %d", cr);
 824                 abort();
 825             }
 826             env->eip += ins_len;
 827             store_regs(cpu);
 828             break;
 829         }
 830         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 831             struct x86_decode decode;
 832
 833             load_regs(cpu);
 834             decode_instruction(env, &decode);
 835             exec_instruction(env, &decode);
 836             store_regs(cpu);
 837             break;
 838         }
 839         case EXIT_REASON_TPR: {
 840             ret = 1;
 841             break;
 842         }
 843         case EXIT_REASON_TASK_SWITCH: {
 844             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 845             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 846             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 847              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 848              & VMCS_INTR_T_MASK);
 849             break;
 850         }
 851         case EXIT_REASON_TRIPLE_FAULT: {
 852             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 853             ret = EXCP_INTERRUPT;
 854             break;
 855         }
 856         case EXIT_REASON_RDPMC:
 857             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 858             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 859             macvm_set_rip(cpu, rip + ins_len);
 860             break;
 861         case VMX_REASON_VMCALL:
 862             env->exception_nr = EXCP0D_GPF;
 863             env->exception_injected = 1;
 864             env->has_error_code = true;
 865             env->error_code = 0;
 866             break;
 867         default:
 868             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 869         }
 870     } while (ret == 0);
 871
 872     return ret;
 873 }
 874
 875 bool hvf_allowed;
 876
 877 static int hvf_accel_init(MachineState *ms)
 878 {
 879     int x;
 880     hv_return_t ret;
 881     HVFState *s;
 882
 883     ret = hv_vm_create(HV_VM_DEFAULT);
 884     assert_hvf_ok(ret);
 885
 886     s = g_new0(HVFState, 1);
 887
 888     s->num_slots = 32;
 889     for (x = 0; x < s->num_slots; ++x) {
 890         s->slots[x].size = 0;
 891         s->slots[x].slot_id = x;
 892     }
 893
 894     hvf_state = s;
 895     cpu_interrupt_handler = hvf_handle_interrupt;
 896     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 897     return 0;
 898 }
 899
 900 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 901 {
 902     AccelClass *ac = ACCEL_CLASS(oc);
 903     ac->name = "HVF";
 904     ac->init_machine = hvf_accel_init;
 905     ac->allowed = &hvf_allowed;
 906 }
 907
 908 static const TypeInfo hvf_accel_type = {
 909     .name = TYPE_HVF_ACCEL,
 910     .parent = TYPE_ACCEL,
 911     .class_init = hvf_accel_class_init,
 912 };
 913
 914 static void hvf_type_init(void)
 915 {
 916     type_register_static(&hvf_accel_type);
 917 }
 918
 919 type_init(hvf_type_init);