target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu/error-report.h"
  51 #include "qemu/memalign.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/hvf_int.h"
  55 #include "sysemu/runstate.h"
  56 #include "sysemu/cpus.h"
  57 #include "hvf-i386.h"
  58 #include "vmcs.h"
  59 #include "vmx.h"
  60 #include "x86.h"
  61 #include "x86_descr.h"
  62 #include "x86_mmu.h"
  63 #include "x86_decode.h"
  64 #include "x86_emu.h"
  65 #include "x86_task.h"
  66 #include "x86hvf.h"
  67
  68 #include <Hypervisor/hv.h>
  69 #include <Hypervisor/hv_vmx.h>
  70 #include <sys/sysctl.h>
  71
  72 #include "hw/i386/apic_internal.h"
  73 #include "qemu/main-loop.h"
  74 #include "qemu/accel.h"
  75 #include "target/i386/cpu.h"
  76
  77 void vmx_update_tpr(CPUState *cpu)
  78 {
  79     /* TODO: need integrate APIC handling */
  80     X86CPU *x86_cpu = X86_CPU(cpu);
  81     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
  82     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
  83
  84     wreg(cpu->accel->fd, HV_X86_TPR, tpr);
  85     if (irr == -1) {
  86         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
  87     } else {
  88         wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
  89               irr >> 4);
  90     }
  91 }
  92
  93 static void update_apic_tpr(CPUState *cpu)
  94 {
  95     X86CPU *x86_cpu = X86_CPU(cpu);
  96     int tpr = rreg(cpu->accel->fd, HV_X86_TPR) >> 4;
  97     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
  98 }
  99
 100 #define VECTORING_INFO_VECTOR_MASK     0xff
 101
 102 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 103                   int direction, int size, int count)
 104 {
 105     int i;
 106     uint8_t *ptr = buffer;
 107
 108     for (i = 0; i < count; i++) {
 109         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 110                          ptr, size,
 111                          direction);
 112         ptr += size;
 113     }
 114 }
 115
 116 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 117 {
 118     int read, write;
 119
 120     /* EPT fault on an instruction fetch doesn't make sense here */
 121     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 122         return false;
 123     }
 124
 125     /* EPT fault must be a read fault or a write fault */
 126     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 127     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 128     if ((read | write) == 0) {
 129         return false;
 130     }
 131
 132     if (write && slot) {
 133         if (slot->flags & HVF_SLOT_LOG) {
 134             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 135             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 136                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 137         }
 138     }
 139
 140     /*
 141      * The EPT violation must have been caused by accessing a
 142      * guest-physical address that is a translation of a guest-linear
 143      * address.
 144      */
 145     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 146         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 147         return false;
 148     }
 149
 150     if (!slot) {
 151         return true;
 152     }
 153     if (!memory_region_is_ram(slot->region) &&
 154         !(read && memory_region_is_romd(slot->region))) {
 155         return true;
 156     }
 157     return false;
 158 }
 159
 160 void hvf_arch_vcpu_destroy(CPUState *cpu)
 161 {
 162     X86CPU *x86_cpu = X86_CPU(cpu);
 163     CPUX86State *env = &x86_cpu->env;
 164
 165     g_free(env->hvf_mmio_buf);
 166 }
 167
 168 static void init_tsc_freq(CPUX86State *env)
 169 {
 170     size_t length;
 171     uint64_t tsc_freq;
 172
 173     if (env->tsc_khz != 0) {
 174         return;
 175     }
 176
 177     length = sizeof(uint64_t);
 178     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
 179         return;
 180     }
 181     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
 182 }
 183
 184 static void init_apic_bus_freq(CPUX86State *env)
 185 {
 186     size_t length;
 187     uint64_t bus_freq;
 188
 189     if (env->apic_bus_freq != 0) {
 190         return;
 191     }
 192
 193     length = sizeof(uint64_t);
 194     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
 195         return;
 196     }
 197     env->apic_bus_freq = bus_freq;
 198 }
 199
 200 static inline bool tsc_is_known(CPUX86State *env)
 201 {
 202     return env->tsc_khz != 0;
 203 }
 204
 205 static inline bool apic_bus_freq_is_known(CPUX86State *env)
 206 {
 207     return env->apic_bus_freq != 0;
 208 }
 209
 210 void hvf_kick_vcpu_thread(CPUState *cpu)
 211 {
 212     cpus_kick_thread(cpu);
 213 }
 214
 215 int hvf_arch_init(void)
 216 {
 217     return 0;
 218 }
 219
 220 int hvf_arch_init_vcpu(CPUState *cpu)
 221 {
 222     X86CPU *x86cpu = X86_CPU(cpu);
 223     CPUX86State *env = &x86cpu->env;
 224     uint64_t reqCap;
 225
 226     init_emu();
 227     init_decoder();
 228
 229     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 230     env->hvf_mmio_buf = g_new(char, 4096);
 231
 232     if (x86cpu->vmware_cpuid_freq) {
 233         init_tsc_freq(env);
 234         init_apic_bus_freq(env);
 235
 236         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 237             error_report("vmware-cpuid-freq: feature couldn't be enabled");
 238         }
 239     }
 240
 241     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 242         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 243         abort();
 244     }
 245     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 246         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 247         abort();
 248     }
 249     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 250         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 251         abort();
 252     }
 253     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 254         &hvf_state->hvf_caps->vmx_cap_entry)) {
 255         abort();
 256     }
 257
 258     /* set VMCS control fields */
 259     wvmcs(cpu->accel->fd, VMCS_PIN_BASED_CTLS,
 260           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 261                    VMCS_PIN_BASED_CTLS_EXTINT |
 262                    VMCS_PIN_BASED_CTLS_NMI |
 263                    VMCS_PIN_BASED_CTLS_VNMI));
 264     wvmcs(cpu->accel->fd, VMCS_PRI_PROC_BASED_CTLS,
 265           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 266                    VMCS_PRI_PROC_BASED_CTLS_HLT |
 267                    VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 268                    VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 269                    VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 270           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 271
 272     reqCap = VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES;
 273
 274     /* Is RDTSCP support in CPUID?  If so, enable it in the VMCS. */
 275     if (hvf_get_supported_cpuid(0x80000001, 0, R_EDX) & CPUID_EXT2_RDTSCP) {
 276         reqCap |= VMCS_PRI_PROC_BASED2_CTLS_RDTSCP;
 277     }
 278
 279     wvmcs(cpu->accel->fd, VMCS_SEC_PROC_BASED_CTLS,
 280           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2, reqCap));
 281
 282     wvmcs(cpu->accel->fd, VMCS_ENTRY_CTLS,
 283           cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry, 0));
 284     wvmcs(cpu->accel->fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 285
 286     wvmcs(cpu->accel->fd, VMCS_TPR_THRESHOLD, 0);
 287
 288     x86cpu = X86_CPU(cpu);
 289     x86cpu->env.xsave_buf_len = 4096;
 290     x86cpu->env.xsave_buf = qemu_memalign(4096, x86cpu->env.xsave_buf_len);
 291
 292     /*
 293      * The allocated storage must be large enough for all of the
 294      * possible XSAVE state components.
 295      */
 296     assert(hvf_get_supported_cpuid(0xd, 0, R_ECX) <= x86cpu->env.xsave_buf_len);
 297
 298     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_STAR, 1);
 299     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_LSTAR, 1);
 300     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_CSTAR, 1);
 301     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FMASK, 1);
 302     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_FSBASE, 1);
 303     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_GSBASE, 1);
 304     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_KERNELGSBASE, 1);
 305     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_TSC_AUX, 1);
 306     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_TSC, 1);
 307     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_CS, 1);
 308     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_EIP, 1);
 309     hv_vcpu_enable_native_msr(cpu->accel->fd, MSR_IA32_SYSENTER_ESP, 1);
 310
 311     return 0;
 312 }
 313
 314 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 315 {
 316     X86CPU *x86_cpu = X86_CPU(cpu);
 317     CPUX86State *env = &x86_cpu->env;
 318
 319     env->exception_nr = -1;
 320     env->exception_pending = 0;
 321     env->exception_injected = 0;
 322     env->interrupt_injected = -1;
 323     env->nmi_injected = false;
 324     env->ins_len = 0;
 325     env->has_error_code = false;
 326     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 327         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 328         case VMCS_IDT_VEC_HWINTR:
 329         case VMCS_IDT_VEC_SWINTR:
 330             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 331             break;
 332         case VMCS_IDT_VEC_NMI:
 333             env->nmi_injected = true;
 334             break;
 335         case VMCS_IDT_VEC_HWEXCEPTION:
 336         case VMCS_IDT_VEC_SWEXCEPTION:
 337             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 338             env->exception_injected = 1;
 339             break;
 340         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 341         default:
 342             abort();
 343         }
 344         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 345             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 346             env->ins_len = ins_len;
 347         }
 348         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 349             env->has_error_code = true;
 350             env->error_code = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_ERROR);
 351         }
 352     }
 353     if ((rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
 354         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 355         env->hflags2 |= HF2_NMI_MASK;
 356     } else {
 357         env->hflags2 &= ~HF2_NMI_MASK;
 358     }
 359     if (rvmcs(cpu->accel->fd, VMCS_GUEST_INTERRUPTIBILITY) &
 360          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 361          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 362         env->hflags |= HF_INHIBIT_IRQ_MASK;
 363     } else {
 364         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 365     }
 366 }
 367
 368 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
 369                               uint32_t *eax, uint32_t *ebx,
 370                               uint32_t *ecx, uint32_t *edx)
 371 {
 372     /*
 373      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
 374      * leafs 0x40000001-0x4000000F are filled with zeros
 375      * Provides vmware-cpuid-freq support to hvf
 376      *
 377      * Note: leaf 0x40000000 not exposes HVF,
 378      * leaving hypervisor signature empty
 379      */
 380
 381     if (index < 0x40000000 || index > 0x40000010 ||
 382         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 383
 384         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
 385         return;
 386     }
 387
 388     switch (index) {
 389     case 0x40000000:
 390         *eax = 0x40000010;    /* Max available cpuid leaf */
 391         *ebx = 0;             /* Leave signature empty */
 392         *ecx = 0;
 393         *edx = 0;
 394         break;
 395     case 0x40000010:
 396         *eax = env->tsc_khz;
 397         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
 398         *ecx = 0;
 399         *edx = 0;
 400         break;
 401     default:
 402         *eax = 0;
 403         *ebx = 0;
 404         *ecx = 0;
 405         *edx = 0;
 406         break;
 407     }
 408 }
 409
 410 int hvf_vcpu_exec(CPUState *cpu)
 411 {
 412     X86CPU *x86_cpu = X86_CPU(cpu);
 413     CPUX86State *env = &x86_cpu->env;
 414     int ret = 0;
 415     uint64_t rip = 0;
 416
 417     if (hvf_process_events(cpu)) {
 418         return EXCP_HLT;
 419     }
 420
 421     do {
 422         if (cpu->vcpu_dirty) {
 423             hvf_put_registers(cpu);
 424             cpu->vcpu_dirty = false;
 425         }
 426
 427         if (hvf_inject_interrupts(cpu)) {
 428             return EXCP_INTERRUPT;
 429         }
 430         vmx_update_tpr(cpu);
 431
 432         bql_unlock();
 433         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 434             bql_lock();
 435             return EXCP_HLT;
 436         }
 437
 438         hv_return_t r  = hv_vcpu_run(cpu->accel->fd);
 439         assert_hvf_ok(r);
 440
 441         /* handle VMEXIT */
 442         uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
 443         uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
 444         uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
 445                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 446
 447         uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
 448
 449         hvf_store_events(cpu, ins_len, idtvec_info);
 450         rip = rreg(cpu->accel->fd, HV_X86_RIP);
 451         env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
 452
 453         bql_lock();
 454
 455         update_apic_tpr(cpu);
 456         current_cpu = cpu;
 457
 458         ret = 0;
 459         switch (exit_reason) {
 460         case EXIT_REASON_HLT: {
 461             macvm_set_rip(cpu, rip + ins_len);
 462             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 463                 (env->eflags & IF_MASK))
 464                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 465                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 466                 cpu->halted = 1;
 467                 ret = EXCP_HLT;
 468                 break;
 469             }
 470             ret = EXCP_INTERRUPT;
 471             break;
 472         }
 473         case EXIT_REASON_MWAIT: {
 474             ret = EXCP_INTERRUPT;
 475             break;
 476         }
 477         /* Need to check if MMIO or unmapped fault */
 478         case EXIT_REASON_EPT_FAULT:
 479         {
 480             hvf_slot *slot;
 481             uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 482
 483             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 484                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 485                 vmx_set_nmi_blocking(cpu);
 486             }
 487
 488             slot = hvf_find_overlap_slot(gpa, 1);
 489             /* mmio */
 490             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 491                 struct x86_decode decode;
 492
 493                 load_regs(cpu);
 494                 decode_instruction(env, &decode);
 495                 exec_instruction(env, &decode);
 496                 store_regs(cpu);
 497                 break;
 498             }
 499             break;
 500         }
 501         case EXIT_REASON_INOUT:
 502         {
 503             uint32_t in = (exit_qual & 8) != 0;
 504             uint32_t size =  (exit_qual & 7) + 1;
 505             uint32_t string =  (exit_qual & 16) != 0;
 506             uint32_t port =  exit_qual >> 16;
 507             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 508
 509             if (!string && in) {
 510                 uint64_t val = 0;
 511                 load_regs(cpu);
 512                 hvf_handle_io(env, port, &val, 0, size, 1);
 513                 if (size == 1) {
 514                     AL(env) = val;
 515                 } else if (size == 2) {
 516                     AX(env) = val;
 517                 } else if (size == 4) {
 518                     RAX(env) = (uint32_t)val;
 519                 } else {
 520                     RAX(env) = (uint64_t)val;
 521                 }
 522                 env->eip += ins_len;
 523                 store_regs(cpu);
 524                 break;
 525             } else if (!string && !in) {
 526                 RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
 527                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 528                 macvm_set_rip(cpu, rip + ins_len);
 529                 break;
 530             }
 531             struct x86_decode decode;
 532
 533             load_regs(cpu);
 534             decode_instruction(env, &decode);
 535             assert(ins_len == decode.len);
 536             exec_instruction(env, &decode);
 537             store_regs(cpu);
 538
 539             break;
 540         }
 541         case EXIT_REASON_CPUID: {
 542             uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
 543             uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
 544             uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
 545             uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 546
 547             if (rax == 1) {
 548                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
 549                 env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
 550             }
 551             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 552
 553             wreg(cpu->accel->fd, HV_X86_RAX, rax);
 554             wreg(cpu->accel->fd, HV_X86_RBX, rbx);
 555             wreg(cpu->accel->fd, HV_X86_RCX, rcx);
 556             wreg(cpu->accel->fd, HV_X86_RDX, rdx);
 557
 558             macvm_set_rip(cpu, rip + ins_len);
 559             break;
 560         }
 561         case EXIT_REASON_XSETBV: {
 562             X86CPU *x86_cpu = X86_CPU(cpu);
 563             CPUX86State *env = &x86_cpu->env;
 564             uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
 565             uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
 566             uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
 567
 568             if (ecx) {
 569                 macvm_set_rip(cpu, rip + ins_len);
 570                 break;
 571             }
 572             env->xcr0 = ((uint64_t)edx << 32) | eax;
 573             wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
 574             macvm_set_rip(cpu, rip + ins_len);
 575             break;
 576         }
 577         case EXIT_REASON_INTR_WINDOW:
 578             vmx_clear_int_window_exiting(cpu);
 579             ret = EXCP_INTERRUPT;
 580             break;
 581         case EXIT_REASON_NMI_WINDOW:
 582             vmx_clear_nmi_window_exiting(cpu);
 583             ret = EXCP_INTERRUPT;
 584             break;
 585         case EXIT_REASON_EXT_INTR:
 586             /* force exit and allow io handling */
 587             ret = EXCP_INTERRUPT;
 588             break;
 589         case EXIT_REASON_RDMSR:
 590         case EXIT_REASON_WRMSR:
 591         {
 592             load_regs(cpu);
 593             if (exit_reason == EXIT_REASON_RDMSR) {
 594                 simulate_rdmsr(env);
 595             } else {
 596                 simulate_wrmsr(env);
 597             }
 598             env->eip += ins_len;
 599             store_regs(cpu);
 600             break;
 601         }
 602         case EXIT_REASON_CR_ACCESS: {
 603             int cr;
 604             int reg;
 605
 606             load_regs(cpu);
 607             cr = exit_qual & 15;
 608             reg = (exit_qual >> 8) & 15;
 609
 610             switch (cr) {
 611             case 0x0: {
 612                 macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
 613                 break;
 614             }
 615             case 4: {
 616                 macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
 617                 break;
 618             }
 619             case 8: {
 620                 X86CPU *x86_cpu = X86_CPU(cpu);
 621                 if (exit_qual & 0x10) {
 622                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 623                 } else {
 624                     int tpr = RRX(env, reg);
 625                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 626                     ret = EXCP_INTERRUPT;
 627                 }
 628                 break;
 629             }
 630             default:
 631                 error_report("Unrecognized CR %d", cr);
 632                 abort();
 633             }
 634             env->eip += ins_len;
 635             store_regs(cpu);
 636             break;
 637         }
 638         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 639             struct x86_decode decode;
 640
 641             load_regs(cpu);
 642             decode_instruction(env, &decode);
 643             exec_instruction(env, &decode);
 644             store_regs(cpu);
 645             break;
 646         }
 647         case EXIT_REASON_TPR: {
 648             ret = 1;
 649             break;
 650         }
 651         case EXIT_REASON_TASK_SWITCH: {
 652             uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
 653             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 654             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 655              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 656              & VMCS_INTR_T_MASK);
 657             break;
 658         }
 659         case EXIT_REASON_TRIPLE_FAULT: {
 660             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 661             ret = EXCP_INTERRUPT;
 662             break;
 663         }
 664         case EXIT_REASON_RDPMC:
 665             wreg(cpu->accel->fd, HV_X86_RAX, 0);
 666             wreg(cpu->accel->fd, HV_X86_RDX, 0);
 667             macvm_set_rip(cpu, rip + ins_len);
 668             break;
 669         case VMX_REASON_VMCALL:
 670             env->exception_nr = EXCP0D_GPF;
 671             env->exception_injected = 1;
 672             env->has_error_code = true;
 673             env->error_code = 0;
 674             break;
 675         default:
 676             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 677         }
 678     } while (ret == 0);
 679
 680     return ret;
 681 }
 682
 683 int hvf_arch_insert_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
 684 {
 685     return -ENOSYS;
 686 }
 687
 688 int hvf_arch_remove_sw_breakpoint(CPUState *cpu, struct hvf_sw_breakpoint *bp)
 689 {
 690     return -ENOSYS;
 691 }
 692
 693 int hvf_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
 694 {
 695     return -ENOSYS;
 696 }
 697
 698 int hvf_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
 699 {
 700     return -ENOSYS;
 701 }
 702
 703 void hvf_arch_remove_all_hw_breakpoints(void)
 704 {
 705 }
 706
 707 void hvf_arch_update_guest_debug(CPUState *cpu)
 708 {
 709 }
 710
 711 bool hvf_arch_supports_guest_debug(void)
 712 {
 713     return false;
 714 }