target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu-common.h"
  51 #include "qemu/error-report.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/runstate.h"
  55 #include "hvf-i386.h"
  56 #include "vmcs.h"
  57 #include "vmx.h"
  58 #include "x86.h"
  59 #include "x86_descr.h"
  60 #include "x86_mmu.h"
  61 #include "x86_decode.h"
  62 #include "x86_emu.h"
  63 #include "x86_task.h"
  64 #include "x86hvf.h"
  65
  66 #include <Hypervisor/hv.h>
  67 #include <Hypervisor/hv_vmx.h>
  68
  69 #include "exec/address-spaces.h"
  70 #include "hw/i386/apic_internal.h"
  71 #include "qemu/main-loop.h"
  72 #include "sysemu/accel.h"
  73 #include "target/i386/cpu.h"
  74
  75 #include "hvf-cpus.h"
  76
  77 HVFState *hvf_state;
  78
  79 static void assert_hvf_ok(hv_return_t ret)
  80 {
  81     if (ret == HV_SUCCESS) {
  82         return;
  83     }
  84
  85     switch (ret) {
  86     case HV_ERROR:
  87         error_report("Error: HV_ERROR");
  88         break;
  89     case HV_BUSY:
  90         error_report("Error: HV_BUSY");
  91         break;
  92     case HV_BAD_ARGUMENT:
  93         error_report("Error: HV_BAD_ARGUMENT");
  94         break;
  95     case HV_NO_RESOURCES:
  96         error_report("Error: HV_NO_RESOURCES");
  97         break;
  98     case HV_NO_DEVICE:
  99         error_report("Error: HV_NO_DEVICE");
 100         break;
 101     case HV_UNSUPPORTED:
 102         error_report("Error: HV_UNSUPPORTED");
 103         break;
 104     default:
 105         error_report("Unknown Error");
 106     }
 107
 108     abort();
 109 }
 110
 111 /* Memory slots */
 112 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 113 {
 114     hvf_slot *slot;
 115     int x;
 116     for (x = 0; x < hvf_state->num_slots; ++x) {
 117         slot = &hvf_state->slots[x];
 118         if (slot->size && start < (slot->start + slot->size) &&
 119             (start + size) > slot->start) {
 120             return slot;
 121         }
 122     }
 123     return NULL;
 124 }
 125
 126 struct mac_slot {
 127     int present;
 128     uint64_t size;
 129     uint64_t gpa_start;
 130     uint64_t gva;
 131 };
 132
 133 struct mac_slot mac_slots[32];
 134
 135 static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
 136 {
 137     struct mac_slot *macslot;
 138     hv_return_t ret;
 139
 140     macslot = &mac_slots[slot->slot_id];
 141
 142     if (macslot->present) {
 143         if (macslot->size != slot->size) {
 144             macslot->present = 0;
 145             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 146             assert_hvf_ok(ret);
 147         }
 148     }
 149
 150     if (!slot->size) {
 151         return 0;
 152     }
 153
 154     macslot->present = 1;
 155     macslot->gpa_start = slot->start;
 156     macslot->size = slot->size;
 157     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 158     assert_hvf_ok(ret);
 159     return 0;
 160 }
 161
 162 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 163 {
 164     hvf_slot *mem;
 165     MemoryRegion *area = section->mr;
 166     bool writeable = !area->readonly && !area->rom_device;
 167     hv_memory_flags_t flags;
 168
 169     if (!memory_region_is_ram(area)) {
 170         if (writeable) {
 171             return;
 172         } else if (!memory_region_is_romd(area)) {
 173             /*
 174              * If the memory device is not in romd_mode, then we actually want
 175              * to remove the hvf memory slot so all accesses will trap.
 176              */
 177              add = false;
 178         }
 179     }
 180
 181     mem = hvf_find_overlap_slot(
 182             section->offset_within_address_space,
 183             int128_get64(section->size));
 184
 185     if (mem && add) {
 186         if (mem->size == int128_get64(section->size) &&
 187             mem->start == section->offset_within_address_space &&
 188             mem->mem == (memory_region_get_ram_ptr(area) +
 189             section->offset_within_region)) {
 190             return; /* Same region was attempted to register, go away. */
 191         }
 192     }
 193
 194     /* Region needs to be reset. set the size to 0 and remap it. */
 195     if (mem) {
 196         mem->size = 0;
 197         if (do_hvf_set_memory(mem, 0)) {
 198             error_report("Failed to reset overlapping slot");
 199             abort();
 200         }
 201     }
 202
 203     if (!add) {
 204         return;
 205     }
 206
 207     if (area->readonly ||
 208         (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
 209         flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
 210     } else {
 211         flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 212     }
 213
 214     /* Now make a new slot. */
 215     int x;
 216
 217     for (x = 0; x < hvf_state->num_slots; ++x) {
 218         mem = &hvf_state->slots[x];
 219         if (!mem->size) {
 220             break;
 221         }
 222     }
 223
 224     if (x == hvf_state->num_slots) {
 225         error_report("No free slots");
 226         abort();
 227     }
 228
 229     mem->size = int128_get64(section->size);
 230     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 231     mem->start = section->offset_within_address_space;
 232     mem->region = area;
 233
 234     if (do_hvf_set_memory(mem, flags)) {
 235         error_report("Error registering new memory slot");
 236         abort();
 237     }
 238 }
 239
 240 void vmx_update_tpr(CPUState *cpu)
 241 {
 242     /* TODO: need integrate APIC handling */
 243     X86CPU *x86_cpu = X86_CPU(cpu);
 244     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 245     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 246
 247     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 248     if (irr == -1) {
 249         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 250     } else {
 251         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 252               irr >> 4);
 253     }
 254 }
 255
 256 static void update_apic_tpr(CPUState *cpu)
 257 {
 258     X86CPU *x86_cpu = X86_CPU(cpu);
 259     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 260     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 261 }
 262
 263 #define VECTORING_INFO_VECTOR_MASK     0xff
 264
 265 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 266                   int direction, int size, int count)
 267 {
 268     int i;
 269     uint8_t *ptr = buffer;
 270
 271     for (i = 0; i < count; i++) {
 272         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 273                          ptr, size,
 274                          direction);
 275         ptr += size;
 276     }
 277 }
 278
 279 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 280 {
 281     if (!cpu->vcpu_dirty) {
 282         hvf_get_registers(cpu);
 283         cpu->vcpu_dirty = true;
 284     }
 285 }
 286
 287 void hvf_cpu_synchronize_state(CPUState *cpu)
 288 {
 289     if (!cpu->vcpu_dirty) {
 290         run_on_cpu(cpu, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 291     }
 292 }
 293
 294 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu,
 295                                               run_on_cpu_data arg)
 296 {
 297     hvf_put_registers(cpu);
 298     cpu->vcpu_dirty = false;
 299 }
 300
 301 void hvf_cpu_synchronize_post_reset(CPUState *cpu)
 302 {
 303     run_on_cpu(cpu, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 304 }
 305
 306 static void do_hvf_cpu_synchronize_post_init(CPUState *cpu,
 307                                              run_on_cpu_data arg)
 308 {
 309     hvf_put_registers(cpu);
 310     cpu->vcpu_dirty = false;
 311 }
 312
 313 void hvf_cpu_synchronize_post_init(CPUState *cpu)
 314 {
 315     run_on_cpu(cpu, do_hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 316 }
 317
 318 static void do_hvf_cpu_synchronize_pre_loadvm(CPUState *cpu,
 319                                               run_on_cpu_data arg)
 320 {
 321     cpu->vcpu_dirty = true;
 322 }
 323
 324 void hvf_cpu_synchronize_pre_loadvm(CPUState *cpu)
 325 {
 326     run_on_cpu(cpu, do_hvf_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL);
 327 }
 328
 329 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 330 {
 331     int read, write;
 332
 333     /* EPT fault on an instruction fetch doesn't make sense here */
 334     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 335         return false;
 336     }
 337
 338     /* EPT fault must be a read fault or a write fault */
 339     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 340     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 341     if ((read | write) == 0) {
 342         return false;
 343     }
 344
 345     if (write && slot) {
 346         if (slot->flags & HVF_SLOT_LOG) {
 347             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 348             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 349                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 350         }
 351     }
 352
 353     /*
 354      * The EPT violation must have been caused by accessing a
 355      * guest-physical address that is a translation of a guest-linear
 356      * address.
 357      */
 358     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 359         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 360         return false;
 361     }
 362
 363     if (!slot) {
 364         return true;
 365     }
 366     if (!memory_region_is_ram(slot->region) &&
 367         !(read && memory_region_is_romd(slot->region))) {
 368         return true;
 369     }
 370     return false;
 371 }
 372
 373 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 374 {
 375     hvf_slot *slot;
 376
 377     slot = hvf_find_overlap_slot(
 378             section->offset_within_address_space,
 379             int128_get64(section->size));
 380
 381     /* protect region against writes; begin tracking it */
 382     if (on) {
 383         slot->flags |= HVF_SLOT_LOG;
 384         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 385                       HV_MEMORY_READ);
 386     /* stop tracking region*/
 387     } else {
 388         slot->flags &= ~HVF_SLOT_LOG;
 389         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 390                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 391     }
 392 }
 393
 394 static void hvf_log_start(MemoryListener *listener,
 395                           MemoryRegionSection *section, int old, int new)
 396 {
 397     if (old != 0) {
 398         return;
 399     }
 400
 401     hvf_set_dirty_tracking(section, 1);
 402 }
 403
 404 static void hvf_log_stop(MemoryListener *listener,
 405                          MemoryRegionSection *section, int old, int new)
 406 {
 407     if (new != 0) {
 408         return;
 409     }
 410
 411     hvf_set_dirty_tracking(section, 0);
 412 }
 413
 414 static void hvf_log_sync(MemoryListener *listener,
 415                          MemoryRegionSection *section)
 416 {
 417     /*
 418      * sync of dirty pages is handled elsewhere; just make sure we keep
 419      * tracking the region.
 420      */
 421     hvf_set_dirty_tracking(section, 1);
 422 }
 423
 424 static void hvf_region_add(MemoryListener *listener,
 425                            MemoryRegionSection *section)
 426 {
 427     hvf_set_phys_mem(section, true);
 428 }
 429
 430 static void hvf_region_del(MemoryListener *listener,
 431                            MemoryRegionSection *section)
 432 {
 433     hvf_set_phys_mem(section, false);
 434 }
 435
 436 static MemoryListener hvf_memory_listener = {
 437     .priority = 10,
 438     .region_add = hvf_region_add,
 439     .region_del = hvf_region_del,
 440     .log_start = hvf_log_start,
 441     .log_stop = hvf_log_stop,
 442     .log_sync = hvf_log_sync,
 443 };
 444
 445 void hvf_vcpu_destroy(CPUState *cpu)
 446 {
 447     X86CPU *x86_cpu = X86_CPU(cpu);
 448     CPUX86State *env = &x86_cpu->env;
 449
 450     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 451     g_free(env->hvf_mmio_buf);
 452     assert_hvf_ok(ret);
 453 }
 454
 455 static void dummy_signal(int sig)
 456 {
 457 }
 458
 459 int hvf_init_vcpu(CPUState *cpu)
 460 {
 461
 462     X86CPU *x86cpu = X86_CPU(cpu);
 463     CPUX86State *env = &x86cpu->env;
 464     int r;
 465
 466     /* init cpu signals */
 467     sigset_t set;
 468     struct sigaction sigact;
 469
 470     memset(&sigact, 0, sizeof(sigact));
 471     sigact.sa_handler = dummy_signal;
 472     sigaction(SIG_IPI, &sigact, NULL);
 473
 474     pthread_sigmask(SIG_BLOCK, NULL, &set);
 475     sigdelset(&set, SIG_IPI);
 476
 477     init_emu();
 478     init_decoder();
 479
 480     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 481     env->hvf_mmio_buf = g_new(char, 4096);
 482
 483     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 484     cpu->vcpu_dirty = 1;
 485     assert_hvf_ok(r);
 486
 487     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 488         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 489         abort();
 490     }
 491     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 492         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 493         abort();
 494     }
 495     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 496         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 497         abort();
 498     }
 499     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 500         &hvf_state->hvf_caps->vmx_cap_entry)) {
 501         abort();
 502     }
 503
 504     /* set VMCS control fields */
 505     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 506           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 507           VMCS_PIN_BASED_CTLS_EXTINT |
 508           VMCS_PIN_BASED_CTLS_NMI |
 509           VMCS_PIN_BASED_CTLS_VNMI));
 510     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 511           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 512           VMCS_PRI_PROC_BASED_CTLS_HLT |
 513           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 514           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 515           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 516           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 517     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 518           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 519                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 520
 521     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 522           0));
 523     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 524
 525     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 526
 527     x86cpu = X86_CPU(cpu);
 528     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 529
 530     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 531     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 532     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 533     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 534     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 535     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 536     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 537     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 538     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
 539     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 540     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 541     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 542
 543     return 0;
 544 }
 545
 546 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 547 {
 548     X86CPU *x86_cpu = X86_CPU(cpu);
 549     CPUX86State *env = &x86_cpu->env;
 550
 551     env->exception_nr = -1;
 552     env->exception_pending = 0;
 553     env->exception_injected = 0;
 554     env->interrupt_injected = -1;
 555     env->nmi_injected = false;
 556     env->ins_len = 0;
 557     env->has_error_code = false;
 558     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 559         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 560         case VMCS_IDT_VEC_HWINTR:
 561         case VMCS_IDT_VEC_SWINTR:
 562             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 563             break;
 564         case VMCS_IDT_VEC_NMI:
 565             env->nmi_injected = true;
 566             break;
 567         case VMCS_IDT_VEC_HWEXCEPTION:
 568         case VMCS_IDT_VEC_SWEXCEPTION:
 569             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 570             env->exception_injected = 1;
 571             break;
 572         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 573         default:
 574             abort();
 575         }
 576         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 577             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 578             env->ins_len = ins_len;
 579         }
 580         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 581             env->has_error_code = true;
 582             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 583         }
 584     }
 585     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 586         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 587         env->hflags2 |= HF2_NMI_MASK;
 588     } else {
 589         env->hflags2 &= ~HF2_NMI_MASK;
 590     }
 591     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 592          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 593          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 594         env->hflags |= HF_INHIBIT_IRQ_MASK;
 595     } else {
 596         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 597     }
 598 }
 599
 600 int hvf_vcpu_exec(CPUState *cpu)
 601 {
 602     X86CPU *x86_cpu = X86_CPU(cpu);
 603     CPUX86State *env = &x86_cpu->env;
 604     int ret = 0;
 605     uint64_t rip = 0;
 606
 607     if (hvf_process_events(cpu)) {
 608         return EXCP_HLT;
 609     }
 610
 611     do {
 612         if (cpu->vcpu_dirty) {
 613             hvf_put_registers(cpu);
 614             cpu->vcpu_dirty = false;
 615         }
 616
 617         if (hvf_inject_interrupts(cpu)) {
 618             return EXCP_INTERRUPT;
 619         }
 620         vmx_update_tpr(cpu);
 621
 622         qemu_mutex_unlock_iothread();
 623         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 624             qemu_mutex_lock_iothread();
 625             return EXCP_HLT;
 626         }
 627
 628         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 629         assert_hvf_ok(r);
 630
 631         /* handle VMEXIT */
 632         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 633         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 634         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 635                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 636
 637         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 638
 639         hvf_store_events(cpu, ins_len, idtvec_info);
 640         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 641         env->eflags = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 642
 643         qemu_mutex_lock_iothread();
 644
 645         update_apic_tpr(cpu);
 646         current_cpu = cpu;
 647
 648         ret = 0;
 649         switch (exit_reason) {
 650         case EXIT_REASON_HLT: {
 651             macvm_set_rip(cpu, rip + ins_len);
 652             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 653                 (env->eflags & IF_MASK))
 654                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 655                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 656                 cpu->halted = 1;
 657                 ret = EXCP_HLT;
 658                 break;
 659             }
 660             ret = EXCP_INTERRUPT;
 661             break;
 662         }
 663         case EXIT_REASON_MWAIT: {
 664             ret = EXCP_INTERRUPT;
 665             break;
 666         }
 667         /* Need to check if MMIO or unmapped fault */
 668         case EXIT_REASON_EPT_FAULT:
 669         {
 670             hvf_slot *slot;
 671             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 672
 673             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 674                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 675                 vmx_set_nmi_blocking(cpu);
 676             }
 677
 678             slot = hvf_find_overlap_slot(gpa, 1);
 679             /* mmio */
 680             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 681                 struct x86_decode decode;
 682
 683                 load_regs(cpu);
 684                 decode_instruction(env, &decode);
 685                 exec_instruction(env, &decode);
 686                 store_regs(cpu);
 687                 break;
 688             }
 689             break;
 690         }
 691         case EXIT_REASON_INOUT:
 692         {
 693             uint32_t in = (exit_qual & 8) != 0;
 694             uint32_t size =  (exit_qual & 7) + 1;
 695             uint32_t string =  (exit_qual & 16) != 0;
 696             uint32_t port =  exit_qual >> 16;
 697             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 698
 699             if (!string && in) {
 700                 uint64_t val = 0;
 701                 load_regs(cpu);
 702                 hvf_handle_io(env, port, &val, 0, size, 1);
 703                 if (size == 1) {
 704                     AL(env) = val;
 705                 } else if (size == 2) {
 706                     AX(env) = val;
 707                 } else if (size == 4) {
 708                     RAX(env) = (uint32_t)val;
 709                 } else {
 710                     RAX(env) = (uint64_t)val;
 711                 }
 712                 env->eip += ins_len;
 713                 store_regs(cpu);
 714                 break;
 715             } else if (!string && !in) {
 716                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 717                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 718                 macvm_set_rip(cpu, rip + ins_len);
 719                 break;
 720             }
 721             struct x86_decode decode;
 722
 723             load_regs(cpu);
 724             decode_instruction(env, &decode);
 725             assert(ins_len == decode.len);
 726             exec_instruction(env, &decode);
 727             store_regs(cpu);
 728
 729             break;
 730         }
 731         case EXIT_REASON_CPUID: {
 732             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 733             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 734             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 735             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 736
 737             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 738
 739             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 740             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 741             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 742             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 743
 744             macvm_set_rip(cpu, rip + ins_len);
 745             break;
 746         }
 747         case EXIT_REASON_XSETBV: {
 748             X86CPU *x86_cpu = X86_CPU(cpu);
 749             CPUX86State *env = &x86_cpu->env;
 750             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 751             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 752             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 753
 754             if (ecx) {
 755                 macvm_set_rip(cpu, rip + ins_len);
 756                 break;
 757             }
 758             env->xcr0 = ((uint64_t)edx << 32) | eax;
 759             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 760             macvm_set_rip(cpu, rip + ins_len);
 761             break;
 762         }
 763         case EXIT_REASON_INTR_WINDOW:
 764             vmx_clear_int_window_exiting(cpu);
 765             ret = EXCP_INTERRUPT;
 766             break;
 767         case EXIT_REASON_NMI_WINDOW:
 768             vmx_clear_nmi_window_exiting(cpu);
 769             ret = EXCP_INTERRUPT;
 770             break;
 771         case EXIT_REASON_EXT_INTR:
 772             /* force exit and allow io handling */
 773             ret = EXCP_INTERRUPT;
 774             break;
 775         case EXIT_REASON_RDMSR:
 776         case EXIT_REASON_WRMSR:
 777         {
 778             load_regs(cpu);
 779             if (exit_reason == EXIT_REASON_RDMSR) {
 780                 simulate_rdmsr(cpu);
 781             } else {
 782                 simulate_wrmsr(cpu);
 783             }
 784             env->eip += ins_len;
 785             store_regs(cpu);
 786             break;
 787         }
 788         case EXIT_REASON_CR_ACCESS: {
 789             int cr;
 790             int reg;
 791
 792             load_regs(cpu);
 793             cr = exit_qual & 15;
 794             reg = (exit_qual >> 8) & 15;
 795
 796             switch (cr) {
 797             case 0x0: {
 798                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 799                 break;
 800             }
 801             case 4: {
 802                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 803                 break;
 804             }
 805             case 8: {
 806                 X86CPU *x86_cpu = X86_CPU(cpu);
 807                 if (exit_qual & 0x10) {
 808                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 809                 } else {
 810                     int tpr = RRX(env, reg);
 811                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 812                     ret = EXCP_INTERRUPT;
 813                 }
 814                 break;
 815             }
 816             default:
 817                 error_report("Unrecognized CR %d", cr);
 818                 abort();
 819             }
 820             env->eip += ins_len;
 821             store_regs(cpu);
 822             break;
 823         }
 824         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 825             struct x86_decode decode;
 826
 827             load_regs(cpu);
 828             decode_instruction(env, &decode);
 829             exec_instruction(env, &decode);
 830             store_regs(cpu);
 831             break;
 832         }
 833         case EXIT_REASON_TPR: {
 834             ret = 1;
 835             break;
 836         }
 837         case EXIT_REASON_TASK_SWITCH: {
 838             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 839             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 840             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 841              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 842              & VMCS_INTR_T_MASK);
 843             break;
 844         }
 845         case EXIT_REASON_TRIPLE_FAULT: {
 846             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 847             ret = EXCP_INTERRUPT;
 848             break;
 849         }
 850         case EXIT_REASON_RDPMC:
 851             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 852             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 853             macvm_set_rip(cpu, rip + ins_len);
 854             break;
 855         case VMX_REASON_VMCALL:
 856             env->exception_nr = EXCP0D_GPF;
 857             env->exception_injected = 1;
 858             env->has_error_code = true;
 859             env->error_code = 0;
 860             break;
 861         default:
 862             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 863         }
 864     } while (ret == 0);
 865
 866     return ret;
 867 }
 868
 869 bool hvf_allowed;
 870
 871 static int hvf_accel_init(MachineState *ms)
 872 {
 873     int x;
 874     hv_return_t ret;
 875     HVFState *s;
 876
 877     ret = hv_vm_create(HV_VM_DEFAULT);
 878     assert_hvf_ok(ret);
 879
 880     s = g_new0(HVFState, 1);
 881
 882     s->num_slots = 32;
 883     for (x = 0; x < s->num_slots; ++x) {
 884         s->slots[x].size = 0;
 885         s->slots[x].slot_id = x;
 886     }
 887
 888     hvf_state = s;
 889     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 890     cpus_register_accel(&hvf_cpus);
 891     return 0;
 892 }
 893
 894 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 895 {
 896     AccelClass *ac = ACCEL_CLASS(oc);
 897     ac->name = "HVF";
 898     ac->init_machine = hvf_accel_init;
 899     ac->allowed = &hvf_allowed;
 900 }
 901
 902 static const TypeInfo hvf_accel_type = {
 903     .name = TYPE_HVF_ACCEL,
 904     .parent = TYPE_ACCEL,
 905     .class_init = hvf_accel_class_init,
 906 };
 907
 908 static void hvf_type_init(void)
 909 {
 910     type_register_static(&hvf_accel_type);
 911 }
 912
 913 type_init(hvf_type_init);