target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu-common.h"
  51 #include "qemu/error-report.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/runstate.h"
  55 #include "hvf-i386.h"
  56 #include "vmcs.h"
  57 #include "vmx.h"
  58 #include "x86.h"
  59 #include "x86_descr.h"
  60 #include "x86_mmu.h"
  61 #include "x86_decode.h"
  62 #include "x86_emu.h"
  63 #include "x86_task.h"
  64 #include "x86hvf.h"
  65
  66 #include <Hypervisor/hv.h>
  67 #include <Hypervisor/hv_vmx.h>
  68
  69 #include "exec/address-spaces.h"
  70 #include "hw/i386/apic_internal.h"
  71 #include "qemu/main-loop.h"
  72 #include "sysemu/accel.h"
  73 #include "target/i386/cpu.h"
  74
  75 HVFState *hvf_state;
  76
  77 static void assert_hvf_ok(hv_return_t ret)
  78 {
  79     if (ret == HV_SUCCESS) {
  80         return;
  81     }
  82
  83     switch (ret) {
  84     case HV_ERROR:
  85         error_report("Error: HV_ERROR");
  86         break;
  87     case HV_BUSY:
  88         error_report("Error: HV_BUSY");
  89         break;
  90     case HV_BAD_ARGUMENT:
  91         error_report("Error: HV_BAD_ARGUMENT");
  92         break;
  93     case HV_NO_RESOURCES:
  94         error_report("Error: HV_NO_RESOURCES");
  95         break;
  96     case HV_NO_DEVICE:
  97         error_report("Error: HV_NO_DEVICE");
  98         break;
  99     case HV_UNSUPPORTED:
 100         error_report("Error: HV_UNSUPPORTED");
 101         break;
 102     default:
 103         error_report("Unknown Error");
 104     }
 105
 106     abort();
 107 }
 108
 109 /* Memory slots */
 110 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 111 {
 112     hvf_slot *slot;
 113     int x;
 114     for (x = 0; x < hvf_state->num_slots; ++x) {
 115         slot = &hvf_state->slots[x];
 116         if (slot->size && start < (slot->start + slot->size) &&
 117             (start + size) > slot->start) {
 118             return slot;
 119         }
 120     }
 121     return NULL;
 122 }
 123
 124 struct mac_slot {
 125     int present;
 126     uint64_t size;
 127     uint64_t gpa_start;
 128     uint64_t gva;
 129 };
 130
 131 struct mac_slot mac_slots[32];
 132
 133 static int do_hvf_set_memory(hvf_slot *slot, hv_memory_flags_t flags)
 134 {
 135     struct mac_slot *macslot;
 136     hv_return_t ret;
 137
 138     macslot = &mac_slots[slot->slot_id];
 139
 140     if (macslot->present) {
 141         if (macslot->size != slot->size) {
 142             macslot->present = 0;
 143             ret = hv_vm_unmap(macslot->gpa_start, macslot->size);
 144             assert_hvf_ok(ret);
 145         }
 146     }
 147
 148     if (!slot->size) {
 149         return 0;
 150     }
 151
 152     macslot->present = 1;
 153     macslot->gpa_start = slot->start;
 154     macslot->size = slot->size;
 155     ret = hv_vm_map((hv_uvaddr_t)slot->mem, slot->start, slot->size, flags);
 156     assert_hvf_ok(ret);
 157     return 0;
 158 }
 159
 160 void hvf_set_phys_mem(MemoryRegionSection *section, bool add)
 161 {
 162     hvf_slot *mem;
 163     MemoryRegion *area = section->mr;
 164     bool writeable = !area->readonly && !area->rom_device;
 165     hv_memory_flags_t flags;
 166
 167     if (!memory_region_is_ram(area)) {
 168         if (writeable) {
 169             return;
 170         } else if (!memory_region_is_romd(area)) {
 171             /*
 172              * If the memory device is not in romd_mode, then we actually want
 173              * to remove the hvf memory slot so all accesses will trap.
 174              */
 175              add = false;
 176         }
 177     }
 178
 179     mem = hvf_find_overlap_slot(
 180             section->offset_within_address_space,
 181             int128_get64(section->size));
 182
 183     if (mem && add) {
 184         if (mem->size == int128_get64(section->size) &&
 185             mem->start == section->offset_within_address_space &&
 186             mem->mem == (memory_region_get_ram_ptr(area) +
 187             section->offset_within_region)) {
 188             return; /* Same region was attempted to register, go away. */
 189         }
 190     }
 191
 192     /* Region needs to be reset. set the size to 0 and remap it. */
 193     if (mem) {
 194         mem->size = 0;
 195         if (do_hvf_set_memory(mem, 0)) {
 196             error_report("Failed to reset overlapping slot");
 197             abort();
 198         }
 199     }
 200
 201     if (!add) {
 202         return;
 203     }
 204
 205     if (area->readonly ||
 206         (!memory_region_is_ram(area) && memory_region_is_romd(area))) {
 207         flags = HV_MEMORY_READ | HV_MEMORY_EXEC;
 208     } else {
 209         flags = HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC;
 210     }
 211
 212     /* Now make a new slot. */
 213     int x;
 214
 215     for (x = 0; x < hvf_state->num_slots; ++x) {
 216         mem = &hvf_state->slots[x];
 217         if (!mem->size) {
 218             break;
 219         }
 220     }
 221
 222     if (x == hvf_state->num_slots) {
 223         error_report("No free slots");
 224         abort();
 225     }
 226
 227     mem->size = int128_get64(section->size);
 228     mem->mem = memory_region_get_ram_ptr(area) + section->offset_within_region;
 229     mem->start = section->offset_within_address_space;
 230     mem->region = area;
 231
 232     if (do_hvf_set_memory(mem, flags)) {
 233         error_report("Error registering new memory slot");
 234         abort();
 235     }
 236 }
 237
 238 void vmx_update_tpr(CPUState *cpu)
 239 {
 240     /* TODO: need integrate APIC handling */
 241     X86CPU *x86_cpu = X86_CPU(cpu);
 242     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
 243     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
 244
 245     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
 246     if (irr == -1) {
 247         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 248     } else {
 249         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
 250               irr >> 4);
 251     }
 252 }
 253
 254 void update_apic_tpr(CPUState *cpu)
 255 {
 256     X86CPU *x86_cpu = X86_CPU(cpu);
 257     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
 258     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 259 }
 260
 261 #define VECTORING_INFO_VECTOR_MASK     0xff
 262
 263 static void hvf_handle_interrupt(CPUState * cpu, int mask)
 264 {
 265     cpu->interrupt_request |= mask;
 266     if (!qemu_cpu_is_self(cpu)) {
 267         qemu_cpu_kick(cpu);
 268     }
 269 }
 270
 271 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 272                   int direction, int size, int count)
 273 {
 274     int i;
 275     uint8_t *ptr = buffer;
 276
 277     for (i = 0; i < count; i++) {
 278         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 279                          ptr, size,
 280                          direction);
 281         ptr += size;
 282     }
 283 }
 284
 285 /* TODO: synchronize vcpu state */
 286 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 287 {
 288     CPUState *cpu_state = cpu;
 289     if (cpu_state->vcpu_dirty == 0) {
 290         hvf_get_registers(cpu_state);
 291     }
 292
 293     cpu_state->vcpu_dirty = 1;
 294 }
 295
 296 void hvf_cpu_synchronize_state(CPUState *cpu_state)
 297 {
 298     if (cpu_state->vcpu_dirty == 0) {
 299         run_on_cpu(cpu_state, do_hvf_cpu_synchronize_state, RUN_ON_CPU_NULL);
 300     }
 301 }
 302
 303 static void do_hvf_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
 304 {
 305     CPUState *cpu_state = cpu;
 306     hvf_put_registers(cpu_state);
 307     cpu_state->vcpu_dirty = false;
 308 }
 309
 310 void hvf_cpu_synchronize_post_reset(CPUState *cpu_state)
 311 {
 312     run_on_cpu(cpu_state, do_hvf_cpu_synchronize_post_reset, RUN_ON_CPU_NULL);
 313 }
 314
 315 void _hvf_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 316 {
 317     CPUState *cpu_state = cpu;
 318     hvf_put_registers(cpu_state);
 319     cpu_state->vcpu_dirty = false;
 320 }
 321
 322 void hvf_cpu_synchronize_post_init(CPUState *cpu_state)
 323 {
 324     run_on_cpu(cpu_state, _hvf_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 325 }
 326
 327 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 328 {
 329     int read, write;
 330
 331     /* EPT fault on an instruction fetch doesn't make sense here */
 332     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 333         return false;
 334     }
 335
 336     /* EPT fault must be a read fault or a write fault */
 337     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 338     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 339     if ((read | write) == 0) {
 340         return false;
 341     }
 342
 343     if (write && slot) {
 344         if (slot->flags & HVF_SLOT_LOG) {
 345             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 346             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 347                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 348         }
 349     }
 350
 351     /*
 352      * The EPT violation must have been caused by accessing a
 353      * guest-physical address that is a translation of a guest-linear
 354      * address.
 355      */
 356     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 357         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 358         return false;
 359     }
 360
 361     if (!slot) {
 362         return true;
 363     }
 364     if (!memory_region_is_ram(slot->region) &&
 365         !(read && memory_region_is_romd(slot->region))) {
 366         return true;
 367     }
 368     return false;
 369 }
 370
 371 static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
 372 {
 373     hvf_slot *slot;
 374
 375     slot = hvf_find_overlap_slot(
 376             section->offset_within_address_space,
 377             int128_get64(section->size));
 378
 379     /* protect region against writes; begin tracking it */
 380     if (on) {
 381         slot->flags |= HVF_SLOT_LOG;
 382         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 383                       HV_MEMORY_READ);
 384     /* stop tracking region*/
 385     } else {
 386         slot->flags &= ~HVF_SLOT_LOG;
 387         hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 388                       HV_MEMORY_READ | HV_MEMORY_WRITE);
 389     }
 390 }
 391
 392 static void hvf_log_start(MemoryListener *listener,
 393                           MemoryRegionSection *section, int old, int new)
 394 {
 395     if (old != 0) {
 396         return;
 397     }
 398
 399     hvf_set_dirty_tracking(section, 1);
 400 }
 401
 402 static void hvf_log_stop(MemoryListener *listener,
 403                          MemoryRegionSection *section, int old, int new)
 404 {
 405     if (new != 0) {
 406         return;
 407     }
 408
 409     hvf_set_dirty_tracking(section, 0);
 410 }
 411
 412 static void hvf_log_sync(MemoryListener *listener,
 413                          MemoryRegionSection *section)
 414 {
 415     /*
 416      * sync of dirty pages is handled elsewhere; just make sure we keep
 417      * tracking the region.
 418      */
 419     hvf_set_dirty_tracking(section, 1);
 420 }
 421
 422 static void hvf_region_add(MemoryListener *listener,
 423                            MemoryRegionSection *section)
 424 {
 425     hvf_set_phys_mem(section, true);
 426 }
 427
 428 static void hvf_region_del(MemoryListener *listener,
 429                            MemoryRegionSection *section)
 430 {
 431     hvf_set_phys_mem(section, false);
 432 }
 433
 434 static MemoryListener hvf_memory_listener = {
 435     .priority = 10,
 436     .region_add = hvf_region_add,
 437     .region_del = hvf_region_del,
 438     .log_start = hvf_log_start,
 439     .log_stop = hvf_log_stop,
 440     .log_sync = hvf_log_sync,
 441 };
 442
 443 void hvf_reset_vcpu(CPUState *cpu) {
 444     uint64_t pdpte[4] = {0, 0, 0, 0};
 445     int i;
 446
 447     /* TODO: this shouldn't be needed; there is already a call to
 448      * cpu_synchronize_all_post_reset in vl.c
 449      */
 450     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, 0);
 451     wvmcs(cpu->hvf_fd, VMCS_GUEST_IA32_EFER, 0);
 452
 453     /* Initialize PDPTE */
 454     for (i = 0; i < 4; i++) {
 455         wvmcs(cpu->hvf_fd, VMCS_GUEST_PDPTE0 + i * 2, pdpte[i]);
 456     }
 457
 458     macvm_set_cr0(cpu->hvf_fd, 0x60000010);
 459
 460     wvmcs(cpu->hvf_fd, VMCS_CR4_MASK, CR4_VMXE_MASK);
 461     wvmcs(cpu->hvf_fd, VMCS_CR4_SHADOW, 0x0);
 462     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR4, CR4_VMXE_MASK);
 463
 464     /* set VMCS guest state fields */
 465     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_SELECTOR, 0xf000);
 466     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_LIMIT, 0xffff);
 467     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_ACCESS_RIGHTS, 0x9b);
 468     wvmcs(cpu->hvf_fd, VMCS_GUEST_CS_BASE, 0xffff0000);
 469
 470     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_SELECTOR, 0);
 471     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_LIMIT, 0xffff);
 472     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_ACCESS_RIGHTS, 0x93);
 473     wvmcs(cpu->hvf_fd, VMCS_GUEST_DS_BASE, 0);
 474
 475     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_SELECTOR, 0);
 476     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_LIMIT, 0xffff);
 477     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_ACCESS_RIGHTS, 0x93);
 478     wvmcs(cpu->hvf_fd, VMCS_GUEST_ES_BASE, 0);
 479
 480     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_SELECTOR, 0);
 481     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_LIMIT, 0xffff);
 482     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_ACCESS_RIGHTS, 0x93);
 483     wvmcs(cpu->hvf_fd, VMCS_GUEST_FS_BASE, 0);
 484
 485     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_SELECTOR, 0);
 486     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_LIMIT, 0xffff);
 487     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_ACCESS_RIGHTS, 0x93);
 488     wvmcs(cpu->hvf_fd, VMCS_GUEST_GS_BASE, 0);
 489
 490     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_SELECTOR, 0);
 491     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_LIMIT, 0xffff);
 492     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_ACCESS_RIGHTS, 0x93);
 493     wvmcs(cpu->hvf_fd, VMCS_GUEST_SS_BASE, 0);
 494
 495     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_SELECTOR, 0);
 496     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_LIMIT, 0);
 497     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x10000);
 498     wvmcs(cpu->hvf_fd, VMCS_GUEST_LDTR_BASE, 0);
 499
 500     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_SELECTOR, 0);
 501     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_LIMIT, 0);
 502     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_ACCESS_RIGHTS, 0x83);
 503     wvmcs(cpu->hvf_fd, VMCS_GUEST_TR_BASE, 0);
 504
 505     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_LIMIT, 0);
 506     wvmcs(cpu->hvf_fd, VMCS_GUEST_GDTR_BASE, 0);
 507
 508     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_LIMIT, 0);
 509     wvmcs(cpu->hvf_fd, VMCS_GUEST_IDTR_BASE, 0);
 510
 511     /*wvmcs(cpu->hvf_fd, VMCS_GUEST_CR2, 0x0);*/
 512     wvmcs(cpu->hvf_fd, VMCS_GUEST_CR3, 0x0);
 513
 514     wreg(cpu->hvf_fd, HV_X86_RIP, 0xfff0);
 515     wreg(cpu->hvf_fd, HV_X86_RDX, 0x623);
 516     wreg(cpu->hvf_fd, HV_X86_RFLAGS, 0x2);
 517     wreg(cpu->hvf_fd, HV_X86_RSP, 0x0);
 518     wreg(cpu->hvf_fd, HV_X86_RAX, 0x0);
 519     wreg(cpu->hvf_fd, HV_X86_RBX, 0x0);
 520     wreg(cpu->hvf_fd, HV_X86_RCX, 0x0);
 521     wreg(cpu->hvf_fd, HV_X86_RSI, 0x0);
 522     wreg(cpu->hvf_fd, HV_X86_RDI, 0x0);
 523     wreg(cpu->hvf_fd, HV_X86_RBP, 0x0);
 524
 525     for (int i = 0; i < 8; i++) {
 526         wreg(cpu->hvf_fd, HV_X86_R8 + i, 0x0);
 527     }
 528
 529     hv_vcpu_invalidate_tlb(cpu->hvf_fd);
 530     hv_vcpu_flush(cpu->hvf_fd);
 531 }
 532
 533 void hvf_vcpu_destroy(CPUState *cpu)
 534 {
 535     hv_return_t ret = hv_vcpu_destroy((hv_vcpuid_t)cpu->hvf_fd);
 536     assert_hvf_ok(ret);
 537 }
 538
 539 static void dummy_signal(int sig)
 540 {
 541 }
 542
 543 int hvf_init_vcpu(CPUState *cpu)
 544 {
 545
 546     X86CPU *x86cpu = X86_CPU(cpu);
 547     CPUX86State *env = &x86cpu->env;
 548     int r;
 549
 550     /* init cpu signals */
 551     sigset_t set;
 552     struct sigaction sigact;
 553
 554     memset(&sigact, 0, sizeof(sigact));
 555     sigact.sa_handler = dummy_signal;
 556     sigaction(SIG_IPI, &sigact, NULL);
 557
 558     pthread_sigmask(SIG_BLOCK, NULL, &set);
 559     sigdelset(&set, SIG_IPI);
 560
 561     init_emu();
 562     init_decoder();
 563
 564     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 565     env->hvf_emul = g_new0(HVFX86EmulatorState, 1);
 566
 567     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf_fd, HV_VCPU_DEFAULT);
 568     cpu->vcpu_dirty = 1;
 569     assert_hvf_ok(r);
 570
 571     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 572         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 573         abort();
 574     }
 575     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 576         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 577         abort();
 578     }
 579     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 580         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 581         abort();
 582     }
 583     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 584         &hvf_state->hvf_caps->vmx_cap_entry)) {
 585         abort();
 586     }
 587
 588     /* set VMCS control fields */
 589     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 590           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 591           VMCS_PIN_BASED_CTLS_EXTINT |
 592           VMCS_PIN_BASED_CTLS_NMI |
 593           VMCS_PIN_BASED_CTLS_VNMI));
 594     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 595           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 596           VMCS_PRI_PROC_BASED_CTLS_HLT |
 597           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 598           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 599           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 600           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 601     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 602           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 603                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 604
 605     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 606           0));
 607     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 608
 609     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 610
 611     x86cpu = X86_CPU(cpu);
 612     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 613
 614     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 615     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 616     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 617     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 618     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 619     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 620     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 621     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 622     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
 623     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 624     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 625     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 626
 627     return 0;
 628 }
 629
 630 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 631 {
 632     X86CPU *x86_cpu = X86_CPU(cpu);
 633     CPUX86State *env = &x86_cpu->env;
 634
 635     env->exception_nr = -1;
 636     env->exception_pending = 0;
 637     env->exception_injected = 0;
 638     env->interrupt_injected = -1;
 639     env->nmi_injected = false;
 640     env->ins_len = 0;
 641     env->has_error_code = false;
 642     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 643         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 644         case VMCS_IDT_VEC_HWINTR:
 645         case VMCS_IDT_VEC_SWINTR:
 646             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 647             break;
 648         case VMCS_IDT_VEC_NMI:
 649             env->nmi_injected = true;
 650             break;
 651         case VMCS_IDT_VEC_HWEXCEPTION:
 652         case VMCS_IDT_VEC_SWEXCEPTION:
 653             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 654             env->exception_injected = 1;
 655             break;
 656         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 657         default:
 658             abort();
 659         }
 660         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 661             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 662             env->ins_len = ins_len;
 663         }
 664         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 665             env->has_error_code = true;
 666             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 667         }
 668     }
 669     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 670         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 671         env->hflags2 |= HF2_NMI_MASK;
 672     } else {
 673         env->hflags2 &= ~HF2_NMI_MASK;
 674     }
 675     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 676          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 677          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 678         env->hflags |= HF_INHIBIT_IRQ_MASK;
 679     } else {
 680         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 681     }
 682 }
 683
 684 int hvf_vcpu_exec(CPUState *cpu)
 685 {
 686     X86CPU *x86_cpu = X86_CPU(cpu);
 687     CPUX86State *env = &x86_cpu->env;
 688     int ret = 0;
 689     uint64_t rip = 0;
 690
 691     if (hvf_process_events(cpu)) {
 692         return EXCP_HLT;
 693     }
 694
 695     do {
 696         if (cpu->vcpu_dirty) {
 697             hvf_put_registers(cpu);
 698             cpu->vcpu_dirty = false;
 699         }
 700
 701         if (hvf_inject_interrupts(cpu)) {
 702             return EXCP_INTERRUPT;
 703         }
 704         vmx_update_tpr(cpu);
 705
 706         qemu_mutex_unlock_iothread();
 707         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 708             qemu_mutex_lock_iothread();
 709             return EXCP_HLT;
 710         }
 711
 712         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 713         assert_hvf_ok(r);
 714
 715         /* handle VMEXIT */
 716         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 717         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 718         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 719                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 720
 721         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 722
 723         hvf_store_events(cpu, ins_len, idtvec_info);
 724         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 725         RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 726         env->eflags = RFLAGS(env);
 727
 728         qemu_mutex_lock_iothread();
 729
 730         update_apic_tpr(cpu);
 731         current_cpu = cpu;
 732
 733         ret = 0;
 734         switch (exit_reason) {
 735         case EXIT_REASON_HLT: {
 736             macvm_set_rip(cpu, rip + ins_len);
 737             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 738                 (EFLAGS(env) & IF_MASK))
 739                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 740                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 741                 cpu->halted = 1;
 742                 ret = EXCP_HLT;
 743                 break;
 744             }
 745             ret = EXCP_INTERRUPT;
 746             break;
 747         }
 748         case EXIT_REASON_MWAIT: {
 749             ret = EXCP_INTERRUPT;
 750             break;
 751         }
 752         /* Need to check if MMIO or unmapped fault */
 753         case EXIT_REASON_EPT_FAULT:
 754         {
 755             hvf_slot *slot;
 756             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 757
 758             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 759                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 760                 vmx_set_nmi_blocking(cpu);
 761             }
 762
 763             slot = hvf_find_overlap_slot(gpa, 1);
 764             /* mmio */
 765             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 766                 struct x86_decode decode;
 767
 768                 load_regs(cpu);
 769                 env->hvf_emul->fetch_rip = rip;
 770
 771                 decode_instruction(env, &decode);
 772                 exec_instruction(env, &decode);
 773                 store_regs(cpu);
 774                 break;
 775             }
 776             break;
 777         }
 778         case EXIT_REASON_INOUT:
 779         {
 780             uint32_t in = (exit_qual & 8) != 0;
 781             uint32_t size =  (exit_qual & 7) + 1;
 782             uint32_t string =  (exit_qual & 16) != 0;
 783             uint32_t port =  exit_qual >> 16;
 784             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 785
 786             if (!string && in) {
 787                 uint64_t val = 0;
 788                 load_regs(cpu);
 789                 hvf_handle_io(env, port, &val, 0, size, 1);
 790                 if (size == 1) {
 791                     AL(env) = val;
 792                 } else if (size == 2) {
 793                     AX(env) = val;
 794                 } else if (size == 4) {
 795                     RAX(env) = (uint32_t)val;
 796                 } else {
 797                     RAX(env) = (uint64_t)val;
 798                 }
 799                 RIP(env) += ins_len;
 800                 store_regs(cpu);
 801                 break;
 802             } else if (!string && !in) {
 803                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 804                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 805                 macvm_set_rip(cpu, rip + ins_len);
 806                 break;
 807             }
 808             struct x86_decode decode;
 809
 810             load_regs(cpu);
 811             env->hvf_emul->fetch_rip = rip;
 812
 813             decode_instruction(env, &decode);
 814             assert(ins_len == decode.len);
 815             exec_instruction(env, &decode);
 816             store_regs(cpu);
 817
 818             break;
 819         }
 820         case EXIT_REASON_CPUID: {
 821             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 822             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 823             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 824             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 825
 826             cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 827
 828             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 829             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 830             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 831             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 832
 833             macvm_set_rip(cpu, rip + ins_len);
 834             break;
 835         }
 836         case EXIT_REASON_XSETBV: {
 837             X86CPU *x86_cpu = X86_CPU(cpu);
 838             CPUX86State *env = &x86_cpu->env;
 839             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 840             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 841             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 842
 843             if (ecx) {
 844                 macvm_set_rip(cpu, rip + ins_len);
 845                 break;
 846             }
 847             env->xcr0 = ((uint64_t)edx << 32) | eax;
 848             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 849             macvm_set_rip(cpu, rip + ins_len);
 850             break;
 851         }
 852         case EXIT_REASON_INTR_WINDOW:
 853             vmx_clear_int_window_exiting(cpu);
 854             ret = EXCP_INTERRUPT;
 855             break;
 856         case EXIT_REASON_NMI_WINDOW:
 857             vmx_clear_nmi_window_exiting(cpu);
 858             ret = EXCP_INTERRUPT;
 859             break;
 860         case EXIT_REASON_EXT_INTR:
 861             /* force exit and allow io handling */
 862             ret = EXCP_INTERRUPT;
 863             break;
 864         case EXIT_REASON_RDMSR:
 865         case EXIT_REASON_WRMSR:
 866         {
 867             load_regs(cpu);
 868             if (exit_reason == EXIT_REASON_RDMSR) {
 869                 simulate_rdmsr(cpu);
 870             } else {
 871                 simulate_wrmsr(cpu);
 872             }
 873             RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH);
 874             store_regs(cpu);
 875             break;
 876         }
 877         case EXIT_REASON_CR_ACCESS: {
 878             int cr;
 879             int reg;
 880
 881             load_regs(cpu);
 882             cr = exit_qual & 15;
 883             reg = (exit_qual >> 8) & 15;
 884
 885             switch (cr) {
 886             case 0x0: {
 887                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 888                 break;
 889             }
 890             case 4: {
 891                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 892                 break;
 893             }
 894             case 8: {
 895                 X86CPU *x86_cpu = X86_CPU(cpu);
 896                 if (exit_qual & 0x10) {
 897                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 898                 } else {
 899                     int tpr = RRX(env, reg);
 900                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 901                     ret = EXCP_INTERRUPT;
 902                 }
 903                 break;
 904             }
 905             default:
 906                 error_report("Unrecognized CR %d", cr);
 907                 abort();
 908             }
 909             RIP(env) += ins_len;
 910             store_regs(cpu);
 911             break;
 912         }
 913         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 914             struct x86_decode decode;
 915
 916             load_regs(cpu);
 917             env->hvf_emul->fetch_rip = rip;
 918
 919             decode_instruction(env, &decode);
 920             exec_instruction(env, &decode);
 921             store_regs(cpu);
 922             break;
 923         }
 924         case EXIT_REASON_TPR: {
 925             ret = 1;
 926             break;
 927         }
 928         case EXIT_REASON_TASK_SWITCH: {
 929             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 930             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 931             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 932              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 933              & VMCS_INTR_T_MASK);
 934             break;
 935         }
 936         case EXIT_REASON_TRIPLE_FAULT: {
 937             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 938             ret = EXCP_INTERRUPT;
 939             break;
 940         }
 941         case EXIT_REASON_RDPMC:
 942             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 943             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 944             macvm_set_rip(cpu, rip + ins_len);
 945             break;
 946         case VMX_REASON_VMCALL:
 947             env->exception_nr = EXCP0D_GPF;
 948             env->exception_injected = 1;
 949             env->has_error_code = true;
 950             env->error_code = 0;
 951             break;
 952         default:
 953             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 954         }
 955     } while (ret == 0);
 956
 957     return ret;
 958 }
 959
 960 bool hvf_allowed;
 961
 962 static int hvf_accel_init(MachineState *ms)
 963 {
 964     int x;
 965     hv_return_t ret;
 966     HVFState *s;
 967
 968     ret = hv_vm_create(HV_VM_DEFAULT);
 969     assert_hvf_ok(ret);
 970
 971     s = g_new0(HVFState, 1);
 972
 973     s->num_slots = 32;
 974     for (x = 0; x < s->num_slots; ++x) {
 975         s->slots[x].size = 0;
 976         s->slots[x].slot_id = x;
 977     }
 978
 979     hvf_state = s;
 980     cpu_interrupt_handler = hvf_handle_interrupt;
 981     memory_listener_register(&hvf_memory_listener, &address_space_memory);
 982     return 0;
 983 }
 984
 985 static void hvf_accel_class_init(ObjectClass *oc, void *data)
 986 {
 987     AccelClass *ac = ACCEL_CLASS(oc);
 988     ac->name = "HVF";
 989     ac->init_machine = hvf_accel_init;
 990     ac->allowed = &hvf_allowed;
 991 }
 992
 993 static const TypeInfo hvf_accel_type = {
 994     .name = TYPE_HVF_ACCEL,
 995     .parent = TYPE_ACCEL,
 996     .class_init = hvf_accel_class_init,
 997 };
 998
 999 static void hvf_type_init(void)
1000 {
1001     type_register_static(&hvf_accel_type);
1002 }
1003
1004 type_init(hvf_type_init);